v28.2.0

Prepare changelog for v28.2.0
v28.2.0-rc.1
2023-09-26 12:07:30 +01:00 · 2023-09-26 12:07:26 +01:00 · 2023-09-19 12:34:58 +01:00 · 2023-09-19 12:34:55 +01:00 · 2023-09-18 17:08:53 +00:00 · 2023-09-18 14:49:24 +00:00
99 changed files with 7538 additions and 1947 deletions
@@ -3,4 +3,6 @@
 /package.json             @matrix-org/element-web-app-team
 /yarn.lock                @matrix-org/element-web-app-team
 /src/webrtc               @matrix-org/element-call-reviewers
+/src/matrixrtc               @matrix-org/element-call-reviewers
 /spec/*/webrtc            @matrix-org/element-call-reviewers
+/spec/*/matrixrtc            @matrix-org/element-call-reviewers
@@ -23,7 +23,7 @@ jobs:
              )
            )
        steps:
-            - uses: tibdex/backport@2e217641d82d02ba0603f46b1aeedefb258890ac # v2
+            - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # v2
              with:
                  labels_template: "<%= JSON.stringify([...labels, 'X-Release-Blocker']) %>"
                  # We can't use GITHUB_TOKEN here or CI won't run on the new PR
@@ -15,7 +15,7 @@ concurrency:
 jobs:
    cypress:
        name: Cypress
-        uses: matrix-org/matrix-react-sdk/.github/workflows/cypress.yaml@v3.76.0
+        uses: matrix-org/matrix-react-sdk/.github/workflows/cypress.yaml@v3.79.0
        permissions:
            actions: read
            issues: read
@@ -21,7 +21,7 @@ concurrency:
 jobs:
    build-element-web:
        name: Build element-web
-        uses: matrix-org/matrix-react-sdk/.github/workflows/element-web.yaml@v3.76.0
+        uses: matrix-org/matrix-react-sdk/.github/workflows/element-web.yaml@v3.79.0
        with:
            matrix-js-sdk-sha: ${{ github.sha }}
            react-sdk-repository: matrix-org/matrix-react-sdk
@@ -20,7 +20,7 @@ jobs:
        runs-on: ubuntu-latest
        steps:
            - name: Notify matrix-react-sdk repo that a new SDK build is on develop so it can CI against it
-              uses: peter-evans/repository-dispatch@26b39ed245ab8f31526069329e112ab2fb224588 # v2
+              uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2
              with:
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  repository: ${{ matrix.repo }}
@@ -11,7 +11,7 @@ jobs:
        runs-on: ubuntu-latest
        steps:
            - name: 🧮 Checkout code
-              uses: actions/checkout@v3
+              uses: actions/checkout@v4

            - name: 🔧 Yarn cache
              uses: actions/setup-node@v3
@@ -9,10 +9,10 @@ jobs:
        runs-on: ubuntu-latest
        steps:
            - name: 🧮 Checkout code
-              uses: actions/checkout@v3
+              uses: actions/checkout@v4

            - name: 🧮 Checkout gh-pages
-              uses: actions/checkout@v3
+              uses: actions/checkout@v4
              with:
                  ref: gh-pages
                  path: _docs
@@ -13,7 +13,7 @@ jobs:
        name: "Typescript Syntax Check"
        runs-on: ubuntu-latest
        steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4

            - uses: actions/setup-node@v3
              with:
@@ -39,7 +39,7 @@ jobs:
        name: "ESLint"
        runs-on: ubuntu-latest
        steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4

            - uses: actions/setup-node@v3
              with:
@@ -55,7 +55,7 @@ jobs:
        name: "JSDoc Checker"
        runs-on: ubuntu-latest
        steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4

            - uses: actions/setup-node@v3
              with:
@@ -21,7 +21,7 @@ jobs:
                node: [18, latest]
        steps:
            - name: Checkout code
-              uses: actions/checkout@v3
+              uses: actions/checkout@v4

            - name: Setup Node
              uses: actions/setup-node@v3
@@ -9,7 +9,7 @@ jobs:
    upgrade:
        runs-on: ubuntu-latest
        steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4

            - uses: actions/setup-node@v3
              with:
@@ -1,6 +1,57 @@
-Changes in [27.2.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v27.2.0-rc.1) (2023-08-08)
+Changes in [28.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v28.2.0) (2023-09-26)
+==================================================================================================
+
+## 🦖 Deprecations
+ * Implement `getEncryptionInfoForEvent` and deprecate `getEventEncryptionInfo` ([\#3693](https://github.com/matrix-org/matrix-js-sdk/pull/3693)).
+ * **The Browserify artifact is being deprecated, scheduled for removal in the October 10th release cycle. (#3189)**
+
+## ✨ Features
+ * Delete knocked room when knock membership changes ([\#3729](https://github.com/matrix-org/matrix-js-sdk/pull/3729)). Contributed by @maheichyk.
+ * Introduce MatrixRTCSession lower level group call primitive ([\#3663](https://github.com/matrix-org/matrix-js-sdk/pull/3663)).
+ * Sync knock rooms ([\#3703](https://github.com/matrix-org/matrix-js-sdk/pull/3703)). Contributed by @maheichyk.
+
+## 🐛 Bug Fixes
+ * Dont access indexed db when undefined ([\#3707](https://github.com/matrix-org/matrix-js-sdk/pull/3707)). Contributed by @finsterwalder.
+ * Don't reset unread count when adding a synthetic receipt ([\#3706](https://github.com/matrix-org/matrix-js-sdk/pull/3706)). Fixes #3684. Contributed by @andybalaam.
+
+Changes in [28.1.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v28.1.0) (2023-09-12)
 ============================================================================================================

+## 🦖 Deprecations
+ * Deprecate `MatrixClient.checkUserTrust` ([\#3691](https://github.com/matrix-org/matrix-js-sdk/pull/3691)).
+ * Deprecate `MatrixClient.{prepare,create}KeyBackupVersion` in favour of new `CryptoApi.resetKeyBackup` API ([\#3689](https://github.com/matrix-org/matrix-js-sdk/pull/3689)).
+ * **The Browserify artifact is being deprecated, scheduled for removal in the October 10th release cycle. (#3189)**
+
+## ✨ Features
+ * Allow calls without ICE/TURN/STUN servers ([\#3695](https://github.com/matrix-org/matrix-js-sdk/pull/3695)).
+ * Emit summary update event ([\#3687](https://github.com/matrix-org/matrix-js-sdk/pull/3687)). Fixes vector-im/element-web#26033.
+ * ElementR: Update `CryptoApi.userHasCrossSigningKeys` ([\#3646](https://github.com/matrix-org/matrix-js-sdk/pull/3646)). Contributed by @florianduros.
+ * Add `join_rule` field to /publicRooms response ([\#3673](https://github.com/matrix-org/matrix-js-sdk/pull/3673)). Contributed by @charlynguyen.
+ * Use sender instead of content.creator field on m.room.create events ([\#3675](https://github.com/matrix-org/matrix-js-sdk/pull/3675)).
+
+## 🐛 Bug Fixes
+ * Provide better error for ICE Server SyntaxError ([\#3694](https://github.com/matrix-org/matrix-js-sdk/pull/3694)). Fixes vector-im/element-web#21804.
+ * Legacy crypto: re-check key backup after `bootstrapSecretStorage` ([\#3692](https://github.com/matrix-org/matrix-js-sdk/pull/3692)). Fixes vector-im/element-web#26115.
+
+Changes in [28.0.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v28.0.0) (2023-08-29)
+==================================================================================================
+
+## 🚨 BREAKING CHANGES
+ * Set minimum supported Matrix 1.1 version (drop legacy r0 versions) ([\#3007](https://github.com/matrix-org/matrix-js-sdk/pull/3007)). Fixes vector-im/element-web#16876.
+
+## 🦖 Deprecations
+ * **The Browserify artifact is being deprecated, scheduled for removal in the October 10th release cycle. (#3189)**
+
+## ✨ Features
+ * ElementR: Add `CryptoApi.requestVerificationDM` ([\#3643](https://github.com/matrix-org/matrix-js-sdk/pull/3643)). Contributed by @florianduros.
+ * Implement `CryptoApi.checkKeyBackupAndEnable` ([\#3633](https://github.com/matrix-org/matrix-js-sdk/pull/3633)). Fixes vector-im/crypto-internal#111 and vector-im/crypto-internal#112.
+
+## 🐛 Bug Fixes
+ * ElementR: Process all verification events, not just requests ([\#3650](https://github.com/matrix-org/matrix-js-sdk/pull/3650)). Contributed by @florianduros.
+
+Changes in [27.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v27.2.0) (2023-08-15)
+==================================================================================================
+
 ## 🦖 Deprecations
 * **The Browserify artifact is being deprecated, scheduled for removal in the October 10th release cycle. (#3189)**

@@ -11,6 +11,8 @@
 This is the [Matrix](https://matrix.org) Client-Server SDK for JavaScript and TypeScript. This SDK can be run in a
 browser or in Node.js.

+#### Minimum Matrix server version: v1.1
+
 The Matrix specification is constantly evolving - while this SDK aims for maximum backwards compatibility, it only
 guarantees that a feature will be supported for at least 4 spec releases. For example, if a feature the js-sdk supports
 is removed in v1.4 then the feature is _eligible_ for removal from the SDK when v1.8 is released. This SDK has no
@@ -1,6 +1,6 @@
 {
    "name": "matrix-js-sdk",
-    "version": "27.2.0-rc.1",
+    "version": "28.2.0",
    "description": "Matrix Client-Server SDK for Javascript",
    "engines": {
        "node": ">=18.0.0"
@@ -55,14 +55,14 @@
    ],
    "dependencies": {
        "@babel/runtime": "^7.12.5",
-        "@matrix-org/matrix-sdk-crypto-wasm": "^1.2.0",
+        "@matrix-org/matrix-sdk-crypto-wasm": "^1.2.3-alpha.0",
        "another-json": "^0.2.0",
        "bs58": "^5.0.0",
        "content-type": "^1.0.4",
        "jwt-decode": "^3.1.2",
        "loglevel": "^1.7.1",
        "matrix-events-sdk": "0.0.1",
-        "matrix-widget-api": "^1.5.0",
+        "matrix-widget-api": "^1.6.0",
        "oidc-client-ts": "^2.2.4",
        "p-retry": "4",
        "sdp-transform": "^2.14.1",
@@ -101,9 +101,9 @@
        "browserify-swap": "^0.2.2",
        "debug": "^4.3.4",
        "domexception": "^4.0.0",
-        "eslint": "8.45.0",
+        "eslint": "8.48.0",
        "eslint-config-google": "^0.14.0",
-        "eslint-config-prettier": "^8.5.0",
+        "eslint-config-prettier": "^9.0.0",
        "eslint-import-resolver-typescript": "^3.5.1",
        "eslint-plugin-import": "^2.26.0",
        "eslint-plugin-jest": "^27.1.6",
@@ -90,7 +90,7 @@ export class TestClient implements IE2EKeyReceiver, ISyncResponder {
        logger.log(this + ": starting");
        this.httpBackend.when("GET", "/versions").respond(200, {
            // we have tests that rely on support for lazy-loading members
-            versions: ["r0.5.0"],
+            versions: ["v1.1"],
        });
        this.httpBackend.when("GET", "/pushrules").respond(200, {});
        this.httpBackend.when("POST", "/filter").respond(200, { filter_id: "fid" });
@@ -25,17 +25,28 @@ import Olm from "@matrix-org/olm";
 import type { IDeviceKeys } from "../../../src/@types/crypto";
 import * as testUtils from "../../test-utils/test-utils";
 import { CRYPTO_BACKENDS, getSyncResponse, InitCrypto, syncPromise } from "../../test-utils/test-utils";
-import { TEST_ROOM_ID, TEST_ROOM_ID as ROOM_ID, TEST_USER_ID } from "../../test-utils/test-data";
+import {
+    BOB_SIGNED_CROSS_SIGNING_KEYS_DATA,
+    BOB_SIGNED_TEST_DEVICE_DATA,
+    BOB_TEST_USER_ID,
+    SIGNED_CROSS_SIGNING_KEYS_DATA,
+    SIGNED_TEST_DEVICE_DATA,
+    TEST_ROOM_ID,
+    TEST_ROOM_ID as ROOM_ID,
+    TEST_USER_ID,
+} from "../../test-utils/test-data";
 import { TestClient } from "../../TestClient";
 import { logger } from "../../../src/logger";
 import {
    Category,
    createClient,
+    CryptoEvent,
    IClaimOTKsResult,
    IContent,
    IDownloadKeyResult,
    IEvent,
    IndexedDBCryptoStore,
+    IRoomEvent,
    IStartClientOpts,
    MatrixClient,
    MatrixEvent,
@@ -44,18 +55,23 @@ import {
    Room,
    RoomMember,
    RoomStateEvent,
-    IRoomEvent,
 } from "../../../src/matrix";
 import { DeviceInfo } from "../../../src/crypto/deviceinfo";
+import * as testData from "../../test-utils/test-data";
 import { E2EKeyReceiver, IE2EKeyReceiver } from "../../test-utils/E2EKeyReceiver";
 import { ISyncResponder, SyncResponder } from "../../test-utils/SyncResponder";
 import { escapeRegExp } from "../../../src/utils";
 import { downloadDeviceToJsDevice } from "../../../src/rust-crypto/device-converter";
 import { flushPromises } from "../../test-utils/flushPromises";
-import { mockInitialApiRequests, mockSetupCrossSigningRequests } from "../../test-utils/mockEndpoints";
+import {
+    mockInitialApiRequests,
+    mockSetupCrossSigningRequests,
+    mockSetupMegolmBackupRequests,
+} from "../../test-utils/mockEndpoints";
 import { AddSecretStorageKeyOpts, SECRET_STORAGE_ALGORITHM_V1_AES } from "../../../src/secret-storage";
-import { CryptoCallbacks } from "../../../src/crypto-api";
+import { CrossSigningKey, CryptoCallbacks, KeyBackupInfo } from "../../../src/crypto-api";
 import { E2EKeyResponder } from "../../test-utils/E2EKeyResponder";
+import { DecryptionError } from "../../../src/crypto/algorithms";

 afterEach(() => {
    // reset fake-indexeddb after each test, to make sure we don't leak connections
@@ -615,6 +631,107 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
        expect(decryptedEvent.getContent().body).toEqual("42");
    });

+    describe("Unable to decrypt error codes", function () {
+        it("Encryption fails with expected UISI error", async () => {
+            expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+            await startClientAndAwaitFirstSync();
+
+            const awaitUISI = new Promise<void>((resolve) => {
+                aliceClient.on(MatrixEventEvent.Decrypted, (ev, err) => {
+                    const error = err as DecryptionError;
+                    if (error.code == "MEGOLM_UNKNOWN_INBOUND_SESSION_ID") {
+                        resolve();
+                    }
+                });
+            });
+
+            // Alice gets both the events in a single sync
+            const syncResponse = {
+                next_batch: 1,
+                rooms: {
+                    join: {
+                        [testData.TEST_ROOM_ID]: { timeline: { events: [testData.ENCRYPTED_EVENT] } },
+                    },
+                },
+            };
+
+            syncResponder.sendOrQueueSyncResponse(syncResponse);
+            await syncPromise(aliceClient);
+
+            await awaitUISI;
+        });
+
+        it("Encryption fails with expected Unknown Index error", async () => {
+            expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+            await startClientAndAwaitFirstSync();
+
+            const awaitUnknownIndex = new Promise<void>((resolve) => {
+                aliceClient.on(MatrixEventEvent.Decrypted, (ev, err) => {
+                    const error = err as DecryptionError;
+                    if (error.code == "OLM_UNKNOWN_MESSAGE_INDEX") {
+                        resolve();
+                    }
+                });
+            });
+
+            await aliceClient.getCrypto()!.importRoomKeys([testData.RATCHTED_MEGOLM_SESSION_DATA]);
+
+            // Alice gets both the events in a single sync
+            const syncResponse = {
+                next_batch: 1,
+                rooms: {
+                    join: {
+                        [testData.TEST_ROOM_ID]: { timeline: { events: [testData.ENCRYPTED_EVENT] } },
+                    },
+                },
+            };
+
+            syncResponder.sendOrQueueSyncResponse(syncResponse);
+            await syncPromise(aliceClient);
+
+            await awaitUnknownIndex;
+        });
+
+        it("Encryption fails with Unable to decrypt for other errors", async () => {
+            expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+            await startClientAndAwaitFirstSync();
+
+            await aliceClient.getCrypto()!.importRoomKeys([testData.MEGOLM_SESSION_DATA]);
+
+            const awaitDecryptionError = new Promise<void>((resolve) => {
+                aliceClient.on(MatrixEventEvent.Decrypted, (ev, err) => {
+                    const error = err as DecryptionError;
+                    // rust and libolm can't have an exact 1:1 mapping for all errors,
+                    // but some errors are part of API and should match
+                    if (
+                        error.code != "MEGOLM_UNKNOWN_INBOUND_SESSION_ID" &&
+                        error.code != "OLM_UNKNOWN_MESSAGE_INDEX"
+                    ) {
+                        resolve();
+                    }
+                });
+            });
+
+            const malformedEvent: Partial<IEvent> = JSON.parse(JSON.stringify(testData.ENCRYPTED_EVENT));
+            malformedEvent.content!.ciphertext = "AwgAEnAkBmciEAyhh1j6DCk29UXJ7kv/kvayUNfuNT0iAioLxcXjFX";
+
+            // Alice gets both the events in a single sync
+            const syncResponse = {
+                next_batch: 1,
+                rooms: {
+                    join: {
+                        [testData.TEST_ROOM_ID]: { timeline: { events: [malformedEvent] } },
+                    },
+                },
+            };
+
+            syncResponder.sendOrQueueSyncResponse(syncResponse);
+            await syncPromise(aliceClient);
+
+            await awaitDecryptionError;
+        });
+    });
+
    it("Alice receives a megolm message before the session keys", async () => {
        expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
        await startClientAndAwaitFirstSync();
@@ -1945,7 +2062,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                    };
                };

-                for (const path of ["/_matrix/client/r0/keys/upload", "/_matrix/client/v3/keys/upload"]) {
+                for (const path of ["/_matrix/client/v3/keys/upload", "/_matrix/client/v3/keys/upload"]) {
                    fetchMock.post(new URL(path, aliceClient.getHomeserverUrl()).toString(), listener, {
                        // These routes are already defined in the E2EKeyReceiver
                        // We want to overwrite the behaviour of the E2EKeyReceiver
@@ -2082,9 +2199,10 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                    return queryResponseBody;
                };

-                for (const path of ["/_matrix/client/r0/keys/query", "/_matrix/client/v3/keys/query"]) {
-                    fetchMock.post(new URL(path, aliceClient.getHomeserverUrl()).toString(), listener);
-                }
+                fetchMock.post(
+                    new URL("/_matrix/client/v3/keys/query", aliceClient.getHomeserverUrl()).toString(),
+                    listener,
+                );
            });
        }

@@ -2164,7 +2282,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
        });
    });

-    describe("bootstrapSecretStorage", () => {
+    describe("Secret Storage and Key Backup", () => {
        /**
         * Create a fake secret storage key
         * Async because `bootstrapSecretStorage` expect an async method
@@ -2174,33 +2292,15 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
            privateKey: Uint8Array.of(32, 33),
        });

-        /**
-         * Create a mock to respond to the PUT request `/_matrix/client/r0/user/:userId/account_data/:type(m.secret_storage.*)`
-         * Resolved when a key is uploaded (ie in `body.content.key`)
-         * https://spec.matrix.org/v1.6/client-server-api/#put_matrixclientv3useruseridaccount_datatype
-         */
-        function awaitSecretStorageKeyStoredInAccountData(): Promise<string> {
-            return new Promise((resolve) => {
-                // This url is called multiple times during the secret storage bootstrap process
-                // When we received the newly generated key, we return it
-                fetchMock.put(
-                    "express:/_matrix/client/r0/user/:userId/account_data/:type(m.secret_storage.*)",
-                    (url: string, options: RequestInit) => {
-                        const content = JSON.parse(options.body as string);
+        beforeEach(async () => {
+            createSecretStorageKey.mockClear();

-                        if (content.key) {
-                            resolve(content.key);
-                        }
-
-                        return {};
-                    },
-                    { overwriteRoutes: true },
-                );
-            });
-        }
+            expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+            await startClientAndAwaitFirstSync();
+        });

        /**
-         * Create a mock to respond to the PUT request `/_matrix/client/r0/user/:userId/account_data/m.cross_signing.${key}`
+         * Create a mock to respond to the PUT request `/_matrix/client/v3/user/:userId/account_data/m.cross_signing.${key}`
         * Resolved when the cross signing key is uploaded
         * https://spec.matrix.org/v1.6/client-server-api/#put_matrixclientv3useruseridaccount_datatype
         */
@@ -2208,7 +2308,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
            return new Promise((resolve) => {
                // Called when the cross signing key is uploaded
                fetchMock.put(
-                    `express:/_matrix/client/r0/user/:userId/account_data/m.cross_signing.${key}`,
+                    `express:/_matrix/client/v3/user/:userId/account_data/m.cross_signing.${key}`,
                    (url: string, options: RequestInit) => {
                        const content = JSON.parse(options.body as string);
                        resolve(content.encrypted);
@@ -2233,14 +2333,12 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                            type: "m.secret_storage.default_key",
                            content: {
                                key: secretStorageKey,
-                                algorithm: SECRET_STORAGE_ALGORITHM_V1_AES,
                            },
                        },
                        // Needed for secretStorage.getKey or secretStorage.hasKey
                        {
                            type: `m.secret_storage.key.${secretStorageKey}`,
                            content: {
-                                key: secretStorageKey,
                                algorithm: SECRET_STORAGE_ALGORITHM_V1_AES,
                            },
                        },
@@ -2249,26 +2347,79 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
            });
        }

-        beforeEach(async () => {
-            createSecretStorageKey.mockClear();
+        /**
+         * Create a mock to respond to the PUT request `/_matrix/client/v3/user/:userId/account_data/:type(m.secret_storage.*)`
+         * Resolved when a key is uploaded (ie in `body.content.key`)
+         * https://spec.matrix.org/v1.6/client-server-api/#put_matrixclientv3useruseridaccount_datatype
+         */
+        function awaitSecretStorageKeyStoredInAccountData(): Promise<string> {
+            return new Promise((resolve) => {
+                // This url is called multiple times during the secret storage bootstrap process
+                // When we received the newly generated key, we return it
+                fetchMock.put(
+                    "express:/_matrix/client/v3/user/:userId/account_data/:type(m.secret_storage.*)",
+                    (url: string, options: RequestInit) => {
+                        const content = JSON.parse(options.body as string);
+                        if (content.key) {
+                            resolve(content.key);
+                        }
+                        return {};
+                    },
+                    { overwriteRoutes: true },
+                );
+            });
+        }

-            expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
-            await startClientAndAwaitFirstSync();
-        });
+        function awaitMegolmBackupKeyUpload(): Promise<Record<string, {}>> {
+            return new Promise((resolve) => {
+                // Called when the megolm backup key is uploaded
+                fetchMock.put(
+                    `express:/_matrix/client/v3/user/:userId/account_data/m.megolm_backup.v1`,
+                    (url: string, options: RequestInit) => {
+                        const content = JSON.parse(options.body as string);
+                        resolve(content.encrypted);
+                        return {};
+                    },
+                    { overwriteRoutes: true },
+                );
+            });
+        }

-        newBackendOnly(
-            "should throw an error if we are unable to create a key because createSecretStorageKey is not set",
-            async () => {
-                await expect(
-                    aliceClient.getCrypto()!.bootstrapSecretStorage({ setupNewSecretStorage: true }),
-                ).rejects.toThrow("unable to create a new secret storage key, createSecretStorageKey is not set");
-            },
-        );
+        /**
+         * Add all mocks needed to setup cross-signing, key backup, 4S and then
+         * configure the account to have recovery.
+         *
+         * @param backupVersion - The version of the created backup
+         */
+        async function bootstrapSecurity(backupVersion: string): Promise<void> {
+            mockSetupCrossSigningRequests();
+            mockSetupMegolmBackupRequests(backupVersion);

-        newBackendOnly("should create a new key", async () => {
-            const bootstrapPromise = aliceClient
-                .getCrypto()!
-                .bootstrapSecretStorage({ setupNewSecretStorage: true, createSecretStorageKey });
+            // promise which will resolve when a `KeyBackupStatus` event is emitted with `enabled: true`
+            const backupStatusUpdate = new Promise<void>((resolve) => {
+                aliceClient.on(CryptoEvent.KeyBackupStatus, (enabled) => {
+                    if (enabled) {
+                        resolve();
+                    }
+                });
+            });
+
+            const setupPromises = [
+                awaitCrossSigningKeyUpload("master"),
+                awaitCrossSigningKeyUpload("user_signing"),
+                awaitCrossSigningKeyUpload("self_signing"),
+                awaitMegolmBackupKeyUpload(),
+            ];
+
+            // Before setting up secret-storage, bootstrap cross-signing, so that the client has cross-signing keys.
+            await aliceClient.getCrypto()!.bootstrapCrossSigning({});
+
+            // Now, when we bootstrap secret-storage, the cross-signing keys should be uploaded.
+            const bootstrapPromise = aliceClient.getCrypto()!.bootstrapSecretStorage({
+                setupNewSecretStorage: true,
+                createSecretStorageKey,
+                setupNewKeyBackup: true,
+            });

            // Wait for the key to be uploaded in the account data
            const secretStorageKey = await awaitSecretStorageKeyStoredInAccountData();
@@ -2276,20 +2427,30 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
            // Return the newly created key in the sync response
            sendSyncResponse(secretStorageKey);

-            // Finally, wait for bootstrapSecretStorage to finished
+            // Wait for the cross signing keys to be uploaded
+            await Promise.all(setupPromises);
+
+            // wait for bootstrapSecretStorage to finished
            await bootstrapPromise;
+            // Finally ensure backup is working
+            await aliceClient.getCrypto()!.checkKeyBackupAndEnable();
+            await backupStatusUpdate;
+        }

-            const defaultKeyId = await aliceClient.secretStorage.getDefaultKeyId();
-            // Check that the uploaded key in stored in the secret storage
-            expect(await aliceClient.secretStorage.hasKey(secretStorageKey)).toBeTruthy();
-            // Check that the uploaded key is the default key
-            expect(defaultKeyId).toBe(secretStorageKey);
-        });
+        describe("bootstrapSecretStorage", () => {
+            newBackendOnly(
+                "should throw an error if we are unable to create a key because createSecretStorageKey is not set",
+                async () => {
+                    await expect(
+                        aliceClient.getCrypto()!.bootstrapSecretStorage({ setupNewSecretStorage: true }),
+                    ).rejects.toThrow("unable to create a new secret storage key, createSecretStorageKey is not set");
+                },
+            );

-        newBackendOnly(
-            "should do nothing if an AES key is already in the secret storage and setupNewSecretStorage is not set",
-            async () => {
-                const bootstrapPromise = aliceClient.getCrypto()!.bootstrapSecretStorage({ createSecretStorageKey });
+            it("should create a new key", async () => {
+                const bootstrapPromise = aliceClient
+                    .getCrypto()!
+                    .bootstrapSecretStorage({ setupNewSecretStorage: true, createSecretStorageKey });

                // Wait for the key to be uploaded in the account data
                const secretStorageKey = await awaitSecretStorageKeyStoredInAccountData();
@@ -2297,20 +2458,41 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                // Return the newly created key in the sync response
                sendSyncResponse(secretStorageKey);

-                // Wait for bootstrapSecretStorage to finished
+                // Finally, wait for bootstrapSecretStorage to finished
                await bootstrapPromise;

-                // Call again bootstrapSecretStorage
-                await aliceClient.getCrypto()!.bootstrapSecretStorage({ createSecretStorageKey });
+                const defaultKeyId = await aliceClient.secretStorage.getDefaultKeyId();
+                // Check that the uploaded key in stored in the secret storage
+                expect(await aliceClient.secretStorage.hasKey(secretStorageKey)).toBeTruthy();
+                // Check that the uploaded key is the default key
+                expect(defaultKeyId).toBe(secretStorageKey);
+            });

-                // createSecretStorageKey should be called only on the first run of bootstrapSecretStorage
-                expect(createSecretStorageKey).toHaveBeenCalledTimes(1);
-            },
-        );
+            newBackendOnly(
+                "should do nothing if an AES key is already in the secret storage and setupNewSecretStorage is not set",
+                async () => {
+                    const bootstrapPromise = aliceClient
+                        .getCrypto()!
+                        .bootstrapSecretStorage({ createSecretStorageKey });

-        newBackendOnly(
-            "should create a new key if setupNewSecretStorage is at true even if an AES key is already in the secret storage",
-            async () => {
+                    // Wait for the key to be uploaded in the account data
+                    const secretStorageKey = await awaitSecretStorageKeyStoredInAccountData();
+
+                    // Return the newly created key in the sync response
+                    sendSyncResponse(secretStorageKey);
+
+                    // Wait for bootstrapSecretStorage to finished
+                    await bootstrapPromise;
+
+                    // Call again bootstrapSecretStorage
+                    await aliceClient.getCrypto()!.bootstrapSecretStorage({ createSecretStorageKey });
+
+                    // createSecretStorageKey should be called only on the first run of bootstrapSecretStorage
+                    expect(createSecretStorageKey).toHaveBeenCalledTimes(1);
+                },
+            );
+
+            it("should create a new key if setupNewSecretStorage is at true even if an AES key is already in the secret storage", async () => {
                let bootstrapPromise = aliceClient
                    .getCrypto()!
                    .bootstrapSecretStorage({ setupNewSecretStorage: true, createSecretStorageKey });
@@ -2340,40 +2522,140 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,

                // createSecretStorageKey should have been called twice, one time every bootstrapSecretStorage call
                expect(createSecretStorageKey).toHaveBeenCalledTimes(2);
-            },
-        );
+            });

-        newBackendOnly("should upload cross signing keys", async () => {
-            mockSetupCrossSigningRequests();
+            it("should upload cross signing keys", async () => {
+                mockSetupCrossSigningRequests();

-            // Before setting up secret-storage, bootstrap cross-signing, so that the client has cross-signing keys.
-            await aliceClient.getCrypto()?.bootstrapCrossSigning({});
+                // Before setting up secret-storage, bootstrap cross-signing, so that the client has cross-signing keys.
+                await aliceClient.getCrypto()!.bootstrapCrossSigning({});

-            // Now, when we bootstrap secret-storage, the cross-signing keys should be uploaded.
-            const bootstrapPromise = aliceClient
-                .getCrypto()!
-                .bootstrapSecretStorage({ setupNewSecretStorage: true, createSecretStorageKey });
+                // Now, when we bootstrap secret-storage, the cross-signing keys should be uploaded.
+                const bootstrapPromise = aliceClient
+                    .getCrypto()!
+                    .bootstrapSecretStorage({ setupNewSecretStorage: true, createSecretStorageKey });

-            // Wait for the key to be uploaded in the account data
-            const secretStorageKey = await awaitSecretStorageKeyStoredInAccountData();
+                // Wait for the key to be uploaded in the account data
+                const secretStorageKey = await awaitSecretStorageKeyStoredInAccountData();

-            // Return the newly created key in the sync response
-            sendSyncResponse(secretStorageKey);
+                // Return the newly created key in the sync response
+                sendSyncResponse(secretStorageKey);

-            // Wait for the cross signing keys to be uploaded
-            const [masterKey, userSigningKey, selfSigningKey] = await Promise.all([
-                awaitCrossSigningKeyUpload("master"),
-                awaitCrossSigningKeyUpload("user_signing"),
-                awaitCrossSigningKeyUpload("self_signing"),
-            ]);
+                // Wait for the cross signing keys to be uploaded
+                const [masterKey, userSigningKey, selfSigningKey] = await Promise.all([
+                    awaitCrossSigningKeyUpload("master"),
+                    awaitCrossSigningKeyUpload("user_signing"),
+                    awaitCrossSigningKeyUpload("self_signing"),
+                ]);

-            // Finally, wait for bootstrapSecretStorage to finished
-            await bootstrapPromise;
+                // Finally, wait for bootstrapSecretStorage to finished
+                await bootstrapPromise;

-            // Expect the cross signing master key to be uploaded and to be encrypted with `secretStorageKey`
-            expect(masterKey[secretStorageKey]).toBeDefined();
-            expect(userSigningKey[secretStorageKey]).toBeDefined();
-            expect(selfSigningKey[secretStorageKey]).toBeDefined();
+                // Expect the cross signing master key to be uploaded and to be encrypted with `secretStorageKey`
+                expect(masterKey[secretStorageKey]).toBeDefined();
+                expect(userSigningKey[secretStorageKey]).toBeDefined();
+                expect(selfSigningKey[secretStorageKey]).toBeDefined();
+            });
+
+            it("should create a new megolm backup", async () => {
+                const backupVersion = "abc";
+                await bootstrapSecurity(backupVersion);
+
+                // Expect a backup to be available and used
+                const activeBackup = await aliceClient.getCrypto()!.getActiveSessionBackupVersion();
+                expect(activeBackup).toStrictEqual(backupVersion);
+
+                // check that there is a MSK signature
+                const signatures = (await aliceClient.getCrypto()!.checkKeyBackupAndEnable())!.backupInfo.auth_data!
+                    .signatures;
+                expect(signatures).toBeDefined();
+                expect(signatures![aliceClient.getUserId()!]).toBeDefined();
+                const mskId = await aliceClient.getCrypto()!.getCrossSigningKeyId(CrossSigningKey.Master)!;
+                expect(signatures![aliceClient.getUserId()!][`ed25519:${mskId}`]).toBeDefined();
+            });
+        });
+
+        describe("Manage Key Backup", () => {
+            it("Reset key backup should create a new backup and update 4S", async () => {
+                // First set up 4S and key backup
+                const backupVersion = "1";
+                await bootstrapSecurity(backupVersion);
+
+                const currentVersion = await aliceClient.getCrypto()!.getActiveSessionBackupVersion();
+                const currentBackupKey = await aliceClient.getCrypto()!.getSessionBackupPrivateKey();
+
+                // we will call reset backup, it should delete the existing one, then setup a new one
+                // Let's mock for that
+
+                // Mock delete and replace the GET to return 404 as soon as called
+                const awaitDeleteCalled = new Promise<void>((resolve) => {
+                    fetchMock.delete(
+                        "express:/_matrix/client/v3/room_keys/version/:version",
+                        (url: string, options: RequestInit) => {
+                            fetchMock.get(
+                                "path:/_matrix/client/v3/room_keys/version",
+                                {
+                                    status: 404,
+                                    body: { errcode: "M_NOT_FOUND", error: "Account data not found." },
+                                },
+                                { overwriteRoutes: true },
+                            );
+                            resolve();
+                            return {};
+                        },
+                        { overwriteRoutes: true },
+                    );
+                });
+
+                const newVersion = "2";
+                fetchMock.post(
+                    "path:/_matrix/client/v3/room_keys/version",
+                    (url, request) => {
+                        const backupData: KeyBackupInfo = JSON.parse(request.body?.toString() ?? "{}");
+                        backupData.version = newVersion;
+                        backupData.count = 0;
+                        backupData.etag = "zer";
+
+                        // update get call with new version
+                        fetchMock.get("path:/_matrix/client/v3/room_keys/version", backupData, {
+                            overwriteRoutes: true,
+                        });
+                        return {
+                            version: backupVersion,
+                        };
+                    },
+                    { overwriteRoutes: true },
+                );
+
+                const newBackupStatusUpdate = new Promise<void>((resolve) => {
+                    aliceClient.on(CryptoEvent.KeyBackupStatus, (enabled) => {
+                        if (enabled) {
+                            resolve();
+                        }
+                    });
+                });
+
+                const newBackupUploadPromise = awaitMegolmBackupKeyUpload();
+
+                await aliceClient.getCrypto()!.resetKeyBackup();
+                await awaitDeleteCalled;
+                await newBackupStatusUpdate;
+                await newBackupUploadPromise;
+
+                const nextVersion = await aliceClient.getCrypto()!.getActiveSessionBackupVersion();
+                const nextKey = await aliceClient.getCrypto()!.getSessionBackupPrivateKey();
+
+                expect(nextVersion).toBeDefined();
+                expect(nextVersion).not.toEqual(currentVersion);
+                expect(nextKey).not.toEqual(currentBackupKey);
+
+                // The `deleteKeyBackupVersion` API is deprecated but has been modified to work with both crypto backend
+                // ensure that it works anyhow
+                await aliceClient.deleteKeyBackupVersion(nextVersion!);
+                await aliceClient.getCrypto()!.checkKeyBackupAndEnable();
+                // XXX Legacy crypto does not update 4S when doing that; should ensure that rust implem does it.
+                expect(await aliceClient.getCrypto()!.getActiveSessionBackupVersion()).toBeNull();
+            });
        });
    });

@@ -2565,4 +2847,46 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
            },
        );
    });
+
+    describe("Check if the cross signing keys are available for a user", () => {
+        beforeEach(async () => {
+            // anything that we don't have a specific matcher for silently returns a 404
+            fetchMock.catch(404);
+
+            keyResponder = new E2EKeyResponder(aliceClient.getHomeserverUrl());
+            keyResponder.addCrossSigningData(SIGNED_CROSS_SIGNING_KEYS_DATA);
+            keyResponder.addDeviceKeys(SIGNED_TEST_DEVICE_DATA);
+            keyResponder.addKeyReceiver(BOB_TEST_USER_ID, keyReceiver);
+            keyResponder.addCrossSigningData(BOB_SIGNED_CROSS_SIGNING_KEYS_DATA);
+            keyResponder.addDeviceKeys(BOB_SIGNED_TEST_DEVICE_DATA);
+
+            expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+            await startClientAndAwaitFirstSync();
+        });
+
+        it("Cross signing keys are available for an untracked user with cross signing keys on the homeserver", async () => {
+            // Needed for old crypto, download and cache locally the cross signing keys of Bob
+            await aliceClient.getCrypto()?.getUserDeviceInfo([BOB_TEST_USER_ID], true);
+
+            const hasCrossSigningKeysForUser = await aliceClient
+                .getCrypto()!
+                .userHasCrossSigningKeys(BOB_TEST_USER_ID, true);
+            expect(hasCrossSigningKeysForUser).toBe(true);
+        });
+
+        it("Cross signing keys are available for a tracked user", async () => {
+            // Process Alice keys, old crypto has a sleep(5ms) during the process
+            await jest.advanceTimersByTimeAsync(5);
+            await flushPromises();
+
+            // Alice is the local user and should be tracked !
+            const hasCrossSigningKeysForUser = await aliceClient.getCrypto()!.userHasCrossSigningKeys(TEST_USER_ID);
+            expect(hasCrossSigningKeysForUser).toBe(true);
+        });
+
+        it("Cross signing keys are not available for an unknown user", async () => {
+            const hasCrossSigningKeysForUser = await aliceClient.getCrypto()!.userHasCrossSigningKeys("@unknown:xyz");
+            expect(hasCrossSigningKeysForUser).toBe(false);
+        });
+    });
 });
@@ -18,8 +18,7 @@ import fetchMock from "fetch-mock-jest";
 import "fake-indexeddb/auto";
 import { IDBFactory } from "fake-indexeddb";

-import { IKeyBackupSession } from "../../../src/crypto/keybackup";
-import { createClient, CryptoEvent, ICreateClientOpts, IEvent, MatrixClient } from "../../../src";
+import { createClient, CryptoEvent, ICreateClientOpts, MatrixClient, TypedEventEmitter } from "../../../src";
 import { SyncResponder } from "../../test-utils/SyncResponder";
 import { E2EKeyReceiver } from "../../test-utils/E2EKeyReceiver";
 import { E2EKeyResponder } from "../../test-utils/E2EKeyResponder";
@@ -27,52 +26,13 @@ import { mockInitialApiRequests } from "../../test-utils/mockEndpoints";
 import { awaitDecryption, CRYPTO_BACKENDS, InitCrypto, syncPromise } from "../../test-utils/test-utils";
 import * as testData from "../../test-utils/test-data";
 import { KeyBackupInfo } from "../../../src/crypto-api/keybackup";
+import { IKeyBackup } from "../../../src/crypto/backup";

-const ROOM_ID = "!ROOM:ID";
+const ROOM_ID = testData.TEST_ROOM_ID;

 /** The homeserver url that we give to the test client, and where we intercept /sync, /keys, etc requests. */
 const TEST_HOMESERVER_URL = "https://alice-server.com";

-const SESSION_ID = "o+21hSjP+mgEmcfdslPsQdvzWnkdt0Wyo00Kp++R8Kc";
-
-const ENCRYPTED_EVENT: Partial<IEvent> = {
-    type: "m.room.encrypted",
-    content: {
-        algorithm: "m.megolm.v1.aes-sha2",
-        sender_key: "SENDER_CURVE25519",
-        session_id: SESSION_ID,
-        ciphertext:
-            "AwgAEjD+VwXZ7PoGPRS/H4kwpAsMp/g+WPvJVtPEKE8fmM9IcT/N" +
-            "CiwPb8PehecDKP0cjm1XO88k6Bw3D17aGiBHr5iBoP7oSw8CXULXAMTkBl" +
-            "mkufRQq2+d0Giy1s4/Cg5n13jSVrSb2q7VTSv1ZHAFjUCsLSfR0gxqcQs",
-    },
-    room_id: "!ROOM:ID",
-    event_id: "$event1",
-    origin_server_ts: 1507753886000,
-};
-
-const CURVE25519_KEY_BACKUP_DATA: IKeyBackupSession = {
-    first_message_index: 0,
-    forwarded_count: 0,
-    is_verified: false,
-    session_data: {
-        ciphertext:
-            "2z2M7CZ+azAiTHN1oFzZ3smAFFt+LEOYY6h3QO3XXGdw" +
-            "6YpNn/gpHDO6I/rgj1zNd4FoTmzcQgvKdU8kN20u5BWRHxaHTZ" +
-            "Slne5RxE6vUdREsBgZePglBNyG0AogR/PVdcrv/v18Y6rLM5O9" +
-            "SELmwbV63uV9Kuu/misMxoqbuqEdG7uujyaEKtjlQsJ5MGPQOy" +
-            "Syw7XrnesSwF6XWRMxcPGRV0xZr3s9PI350Wve3EncjRgJ9IGF" +
-            "ru1bcptMqfXgPZkOyGvrphHoFfoK7nY3xMEHUiaTRfRIjq8HNV" +
-            "4o8QY1qmWGnxNBQgOlL8MZlykjg3ULmQ3DtFfQPj/YYGS3jzxv" +
-            "C+EBjaafmsg+52CTeK3Rswu72PX450BnSZ1i3If4xWAUKvjTpe" +
-            "Ug5aDLqttOv1pITolTJDw5W/SD+b5rjEKg1CFCHGEGE9wwV3Nf" +
-            "QHVCQL+dfpd7Or0poy4dqKMAi3g0o3Tg7edIF8d5rREmxaALPy" +
-            "iie8PHD8mj/5Y0GLqrac4CD6+Mop7eUTzVovprjg",
-        mac: "5lxYBHQU80M",
-        ephemeral: "/Bn0A4UMFwJaDDvh0aEk1XZj3k1IfgCxgFY9P9a0b14",
-    },
-};
-
 const TEST_USER_ID = "@alice:localhost";
 const TEST_DEVICE_ID = "xzcvb";

@@ -83,10 +43,63 @@ afterEach(() => {
    indexedDB = new IDBFactory();
 });

+enum MockKeyUploadEvent {
+    KeyUploaded = "KeyUploaded",
+}
+
+type MockKeyUploadEventHandlerMap = {
+    [MockKeyUploadEvent.KeyUploaded]: (roomId: string, sessionId: string, backupVersion: string) => void;
+};
+
+/*
+ * Test helper. Returns an event emitter that will emit an event every time fetchmock sees a request to backup a key.
+ */
+function mockUploadEmitter(
+    expectedVersion: string,
+): TypedEventEmitter<MockKeyUploadEvent, MockKeyUploadEventHandlerMap> {
+    const emitter = new TypedEventEmitter();
+    fetchMock.put(
+        "path:/_matrix/client/v3/room_keys/keys",
+        (url, request) => {
+            const version = new URLSearchParams(new URL(url).search).get("version");
+            if (version != expectedVersion) {
+                return {
+                    status: 403,
+                    body: {
+                        current_version: expectedVersion,
+                        errcode: "M_WRONG_ROOM_KEYS_VERSION",
+                        error: "Wrong backup version.",
+                    },
+                };
+            }
+            const uploadPayload: IKeyBackup = JSON.parse(request.body?.toString() ?? "{}");
+            let count = 0;
+            for (const [roomId, value] of Object.entries(uploadPayload.rooms)) {
+                for (const sessionId of Object.keys(value.sessions)) {
+                    emitter.emit(MockKeyUploadEvent.KeyUploaded, roomId, sessionId, version);
+                    count++;
+                }
+            }
+            return {
+                status: 200,
+                body: {
+                    count: count,
+                    etag: "abcdefg",
+                },
+            };
+        },
+        {
+            overwriteRoutes: true,
+        },
+    );
+    return emitter;
+}
+
 describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backend: string, initCrypto: InitCrypto) => {
    // oldBackendOnly is an alternative to `it` or `test` which will skip the test if we are running against the
    // Rust backend. Once we have full support in the rust sdk, it will go away.
-    const oldBackendOnly = backend === "rust-sdk" ? test.skip : test;
+    // const oldBackendOnly = backend === "rust-sdk" ? test.skip : test;
+    // const newBackendOnly = backend === "libolm" ? test.skip : test;

    let aliceClient: MatrixClient;
    /** an object which intercepts `/sync` requests on the test homeserver */
@@ -136,21 +149,24 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
        return client;
    }

-    oldBackendOnly("Alice checks key backups when receiving a message she can't decrypt", async function () {
+    it("Alice checks key backups when receiving a message she can't decrypt", async function () {
        const syncResponse = {
            next_batch: 1,
            rooms: {
                join: {
                    [ROOM_ID]: {
                        timeline: {
-                            events: [ENCRYPTED_EVENT],
+                            events: [testData.ENCRYPTED_EVENT],
                        },
                    },
                },
            },
        };

-        fetchMock.get("express:/_matrix/client/v3/room_keys/keys/:room_id/:session_id", CURVE25519_KEY_BACKUP_DATA);
+        fetchMock.get(
+            "express:/_matrix/client/v3/room_keys/keys/:room_id/:session_id",
+            testData.CURVE25519_KEY_BACKUP_DATA,
+        );
        fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);

        aliceClient = await initTestClient();
@@ -164,7 +180,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
        // XXX: should we automatically re-check after a device becomes verified?
        await waitForDeviceList();
        await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
-        await aliceClient.checkKeyBackup();
+        await aliceClient.getCrypto()!.checkKeyBackupAndEnable();

        // Now, send Alice a message that she won't be able to decrypt, and check that she fetches the key from the backup.
        syncResponder.sendOrQueueSyncResponse(syncResponse);
@@ -173,10 +189,370 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
        const room = aliceClient.getRoom(ROOM_ID)!;
        const event = room.getLiveTimeline().getEvents()[0];
        await awaitDecryption(event, { waitOnDecryptionFailure: true });
-        expect(event.getContent()).toEqual("testytest");
+
+        expect(event.getContent()).toEqual(testData.CLEAR_EVENT.content);
    });

-    oldBackendOnly("getActiveSessionBackupVersion() should give correct result", async function () {
+    describe("recover from backup", () => {
+        it("can restore from backup (Curve25519 version)", async function () {
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);
+
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+            await aliceClient.startClient();
+
+            // tell Alice to trust the dummy device that signed the backup
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            const fullBackup = {
+                rooms: {
+                    [ROOM_ID]: {
+                        sessions: {
+                            [testData.MEGOLM_SESSION_DATA.session_id]: testData.CURVE25519_KEY_BACKUP_DATA,
+                        },
+                    },
+                },
+            };
+
+            fetchMock.get("express:/_matrix/client/v3/room_keys/keys", fullBackup);
+
+            const check = await aliceCrypto.checkKeyBackupAndEnable();
+
+            let onKeyCached: () => void;
+            const awaitKeyCached = new Promise<void>((resolve) => {
+                onKeyCached = resolve;
+            });
+
+            const result = await aliceClient.restoreKeyBackupWithRecoveryKey(
+                testData.BACKUP_DECRYPTION_KEY_BASE58,
+                undefined,
+                undefined,
+                check!.backupInfo!,
+                {
+                    cacheCompleteCallback: () => onKeyCached(),
+                },
+            );
+
+            expect(result.imported).toStrictEqual(1);
+
+            await awaitKeyCached;
+        });
+
+        it("recover specific session from backup", async function () {
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);
+
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+            await aliceClient.startClient();
+
+            // tell Alice to trust the dummy device that signed the backup
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            fetchMock.get(
+                "express:/_matrix/client/v3/room_keys/keys/:room_id/:session_id",
+                testData.CURVE25519_KEY_BACKUP_DATA,
+            );
+
+            const check = await aliceCrypto.checkKeyBackupAndEnable();
+
+            const result = await aliceClient.restoreKeyBackupWithRecoveryKey(
+                testData.BACKUP_DECRYPTION_KEY_BASE58,
+                ROOM_ID,
+                testData.MEGOLM_SESSION_DATA.session_id,
+                check!.backupInfo!,
+            );
+
+            expect(result.imported).toStrictEqual(1);
+        });
+
+        it("Fails on bad recovery key", async function () {
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);
+
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+            await aliceClient.startClient();
+
+            // tell Alice to trust the dummy device that signed the backup
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            const fullBackup = {
+                rooms: {
+                    [ROOM_ID]: {
+                        sessions: {
+                            [testData.MEGOLM_SESSION_DATA.session_id]: testData.CURVE25519_KEY_BACKUP_DATA,
+                        },
+                    },
+                },
+            };
+
+            fetchMock.get("express:/_matrix/client/v3/room_keys/keys", fullBackup);
+
+            const check = await aliceCrypto.checkKeyBackupAndEnable();
+
+            await expect(
+                aliceClient.restoreKeyBackupWithRecoveryKey(
+                    "EsTx A7Xn aNFF k3jH zpV3 MQoN LJEg mscC HecF 982L wC77 mYQD",
+                    undefined,
+                    undefined,
+                    check!.backupInfo!,
+                ),
+            ).rejects.toThrow();
+        });
+    });
+
+    describe("backupLoop", () => {
+        it("Alice should upload known keys when backup is enabled", async function () {
+            // 404 means that there is no active backup
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", 404);
+
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+            await aliceClient.startClient();
+
+            // tell Alice to trust the dummy device that signed the backup
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            // check that signalling is working
+            const remainingZeroPromise = new Promise<void>((resolve, reject) => {
+                aliceClient.on(CryptoEvent.KeyBackupSessionsRemaining, (remaining) => {
+                    if (remaining == 0) {
+                        resolve();
+                    }
+                });
+            });
+
+            const someRoomKeys = testData.MEGOLM_SESSION_DATA_ARRAY;
+
+            const uploadMockEmitter = mockUploadEmitter(testData.SIGNED_BACKUP_DATA.version!);
+
+            const uploadPromises = someRoomKeys.map((data) => {
+                new Promise<void>((resolve) => {
+                    uploadMockEmitter.on(MockKeyUploadEvent.KeyUploaded, (roomId, sessionId, version) => {
+                        if (
+                            data.room_id == roomId &&
+                            data.session_id == sessionId &&
+                            version == testData.SIGNED_BACKUP_DATA.version
+                        ) {
+                            resolve();
+                        }
+                    });
+                });
+            });
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA, {
+                overwriteRoutes: true,
+            });
+
+            const result = await aliceCrypto.checkKeyBackupAndEnable();
+            expect(result).toBeTruthy();
+
+            await aliceCrypto.importRoomKeys(someRoomKeys);
+
+            // The backup loop is waiting a random amount of time to avoid different clients firing at the same time.
+            jest.runAllTimers();
+
+            await Promise.all(uploadPromises);
+
+            // Wait until all keys are backed up to ensure that when a new key is received the loop is restarted
+            await remainingZeroPromise;
+
+            // A new key import should trigger a new upload.
+            const newKey = testData.MEGOLM_SESSION_DATA;
+
+            const newKeyUploadPromise = new Promise<void>((resolve) => {
+                uploadMockEmitter.on(MockKeyUploadEvent.KeyUploaded, (roomId, sessionId, version) => {
+                    if (
+                        newKey.room_id == roomId &&
+                        newKey.session_id == sessionId &&
+                        version == testData.SIGNED_BACKUP_DATA.version
+                    ) {
+                        resolve();
+                    }
+                });
+            });
+
+            await aliceCrypto.importRoomKeys([newKey]);
+
+            jest.runAllTimers();
+            await newKeyUploadPromise;
+        });
+
+        it("Alice should re-upload all keys if a new trusted backup is available", async function () {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+            await aliceClient.startClient();
+
+            // tell Alice to trust the dummy device that signed the backup
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            // check that signalling is working
+            const remainingZeroPromise = new Promise<void>((resolve) => {
+                aliceClient.on(CryptoEvent.KeyBackupSessionsRemaining, (remaining) => {
+                    if (remaining == 0) {
+                        resolve();
+                    }
+                });
+            });
+
+            const someRoomKeys = testData.MEGOLM_SESSION_DATA_ARRAY;
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA, {
+                overwriteRoutes: true,
+            });
+
+            const result = await aliceCrypto.checkKeyBackupAndEnable();
+            expect(result).toBeTruthy();
+
+            mockUploadEmitter(testData.SIGNED_BACKUP_DATA.version!);
+            await aliceCrypto.importRoomKeys(someRoomKeys);
+
+            // The backup loop is waiting a random amount of time to avoid different clients firing at the same time.
+            jest.runAllTimers();
+
+            // wait for all keys to be backed up
+            await remainingZeroPromise;
+
+            const newBackupVersion = "2";
+            const uploadMockEmitter = mockUploadEmitter(newBackupVersion);
+            const newBackup = JSON.parse(JSON.stringify(testData.SIGNED_BACKUP_DATA));
+            newBackup.version = newBackupVersion;
+
+            // Let's simulate that a new backup is available by returning error code on key upload
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", newBackup, {
+                overwriteRoutes: true,
+            });
+
+            // If we import a new key the loop will try to upload to old version, it will
+            // fail then check the current version and switch if trusted
+            const uploadPromises = someRoomKeys.map((data) => {
+                new Promise<void>((resolve) => {
+                    uploadMockEmitter.on(MockKeyUploadEvent.KeyUploaded, (roomId, sessionId, version) => {
+                        if (data.room_id == roomId && data.session_id == sessionId && version == newBackupVersion) {
+                            resolve();
+                        }
+                    });
+                });
+            });
+
+            const disableOldBackup = new Promise<void>((resolve) => {
+                aliceClient.on(CryptoEvent.KeyBackupFailed, (errCode) => {
+                    if (errCode == "M_WRONG_ROOM_KEYS_VERSION") {
+                        resolve();
+                    }
+                });
+            });
+
+            const enableNewBackup = new Promise<void>((resolve) => {
+                aliceClient.on(CryptoEvent.KeyBackupStatus, (enabled) => {
+                    if (enabled) {
+                        resolve();
+                    }
+                });
+            });
+
+            // A new key import should trigger a new upload.
+            const newKey = testData.MEGOLM_SESSION_DATA;
+
+            const newKeyUploadPromise = new Promise<void>((resolve) => {
+                uploadMockEmitter.on(MockKeyUploadEvent.KeyUploaded, (roomId, sessionId, version) => {
+                    if (newKey.room_id == roomId && newKey.session_id == sessionId && version == newBackupVersion) {
+                        resolve();
+                    }
+                });
+            });
+
+            await aliceCrypto.importRoomKeys([newKey]);
+
+            jest.runAllTimers();
+
+            await disableOldBackup;
+            await enableNewBackup;
+
+            jest.runAllTimers();
+
+            await Promise.all(uploadPromises);
+            await newKeyUploadPromise;
+        });
+
+        it("Backup loop should be resistant to network failures", async function () {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+            await aliceClient.startClient();
+
+            // tell Alice to trust the dummy device that signed the backup
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA, {
+                overwriteRoutes: true,
+            });
+
+            // on the first key upload attempt, simulate a network failure
+            const failurePromise = new Promise((resolve) => {
+                fetchMock.put(
+                    "path:/_matrix/client/v3/room_keys/keys",
+                    () => {
+                        resolve(undefined);
+                        throw new TypeError(`Failed to fetch`);
+                    },
+                    {
+                        overwriteRoutes: true,
+                    },
+                );
+            });
+
+            // kick the import loop off and wait for the failed request
+            const someRoomKeys = testData.MEGOLM_SESSION_DATA_ARRAY;
+            await aliceCrypto.importRoomKeys(someRoomKeys);
+
+            const result = await aliceCrypto.checkKeyBackupAndEnable();
+            expect(result).toBeTruthy();
+            jest.runAllTimers();
+            await failurePromise;
+
+            // Fix the endpoint to do successful uploads
+            const successPromise = new Promise((resolve) => {
+                fetchMock.put(
+                    "path:/_matrix/client/v3/room_keys/keys",
+                    () => {
+                        resolve(undefined);
+                        return {
+                            status: 200,
+                            body: {
+                                count: 2,
+                                etag: "abcdefg",
+                            },
+                        };
+                    },
+                    {
+                        overwriteRoutes: true,
+                    },
+                );
+            });
+
+            // check that a `KeyBackupSessionsRemaining` event is emitted with `remaining == 0`
+            const allKeysUploadedPromise = new Promise((resolve) => {
+                aliceClient.on(CryptoEvent.KeyBackupSessionsRemaining, (remaining) => {
+                    if (remaining == 0) {
+                        resolve(undefined);
+                    }
+                });
+            });
+
+            // run the timers, which will make the backup loop redo the request
+            await jest.runAllTimersAsync();
+            await successPromise;
+            await allKeysUploadedPromise;
+        });
+    });
+
+    it("getActiveSessionBackupVersion() should give correct result", async function () {
        // 404 means that there is no active backup
        fetchMock.get("express:/_matrix/client/v3/room_keys/version", 404);

@@ -187,7 +563,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
        // tell Alice to trust the dummy device that signed the backup
        await waitForDeviceList();
        await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
-        await aliceClient.checkKeyBackup();
+        await aliceCrypto.checkKeyBackupAndEnable();

        // At this point there is no backup
        let backupStatus: string | null;
@@ -201,9 +577,9 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
            overwriteRoutes: true,
        });

-        const checked = await aliceClient.checkKeyBackup();
+        const checked = await aliceCrypto.checkKeyBackupAndEnable();
        expect(checked?.backupInfo?.version).toStrictEqual(unsignedBackup.version);
-        expect(checked?.trustInfo?.usable).toBeFalsy();
+        expect(checked?.trustInfo?.trusted).toBeFalsy();

        backupStatus = await aliceCrypto.getActiveSessionBackupVersion();
        expect(backupStatus).toBeNull();
@@ -222,8 +598,8 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
            });
        });

-        const validCheck = await aliceClient.checkKeyBackup();
-        expect(validCheck?.trustInfo?.usable).toStrictEqual(true);
+        const validCheck = await aliceCrypto.checkKeyBackupAndEnable();
+        expect(validCheck?.trustInfo?.trusted).toStrictEqual(true);

        await backupPromise;

@@ -286,6 +662,128 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backe
        });
    });

+    describe("checkKeyBackupAndEnable", () => {
+        it("enables a backup signed by a trusted device", async () => {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+
+            // tell Alice to trust the dummy device that signed the backup
+            await aliceClient.startClient();
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);
+
+            const result = await aliceCrypto.checkKeyBackupAndEnable();
+            expect(result).toBeTruthy();
+            expect(result!.trustInfo).toEqual({ trusted: true, matchesDecryptionKey: false });
+            expect(await aliceCrypto.getActiveSessionBackupVersion()).toEqual(testData.SIGNED_BACKUP_DATA.version);
+        });
+
+        it("does not enable a backup signed by an untrusted device", async () => {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+
+            // download the device list, to match the trusted case
+            await aliceClient.startClient();
+            await waitForDeviceList();
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);
+
+            const result = await aliceCrypto.checkKeyBackupAndEnable();
+            expect(result).toBeTruthy();
+            expect(result!.trustInfo).toEqual({ trusted: false, matchesDecryptionKey: false });
+            expect(await aliceCrypto.getActiveSessionBackupVersion()).toBeNull();
+        });
+
+        it("disables backup when a new untrusted backup is available", async () => {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+
+            // tell Alice to trust the dummy device that signed the backup
+            await aliceClient.startClient();
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);
+
+            const result = await aliceCrypto.checkKeyBackupAndEnable();
+            expect(result).toBeTruthy();
+            expect(await aliceCrypto.getActiveSessionBackupVersion()).toEqual(testData.SIGNED_BACKUP_DATA.version);
+
+            const unsignedBackup = JSON.parse(JSON.stringify(testData.SIGNED_BACKUP_DATA));
+            delete unsignedBackup.auth_data.signatures;
+            unsignedBackup.version = "2";
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", unsignedBackup, {
+                overwriteRoutes: true,
+            });
+
+            await aliceCrypto.checkKeyBackupAndEnable();
+            expect(await aliceCrypto.getActiveSessionBackupVersion()).toBeNull();
+        });
+
+        it("switches backup when a new trusted backup is available", async () => {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+
+            // tell Alice to trust the dummy device that signed the backup
+            await aliceClient.startClient();
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);
+
+            const result = await aliceCrypto.checkKeyBackupAndEnable();
+            expect(result).toBeTruthy();
+            expect(await aliceCrypto.getActiveSessionBackupVersion()).toEqual(testData.SIGNED_BACKUP_DATA.version);
+
+            const newBackupVersion = "2";
+            const newBackup = JSON.parse(JSON.stringify(testData.SIGNED_BACKUP_DATA));
+            newBackup.version = newBackupVersion;
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", newBackup, {
+                overwriteRoutes: true,
+            });
+
+            await aliceCrypto.checkKeyBackupAndEnable();
+            expect(await aliceCrypto.getActiveSessionBackupVersion()).toEqual(newBackupVersion);
+        });
+
+        it("Disables when backup is deleted", async () => {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+
+            // tell Alice to trust the dummy device that signed the backup
+            await aliceClient.startClient();
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);
+
+            const result = await aliceCrypto.checkKeyBackupAndEnable();
+            expect(result).toBeTruthy();
+            expect(await aliceCrypto.getActiveSessionBackupVersion()).toEqual(testData.SIGNED_BACKUP_DATA.version);
+
+            fetchMock.get(
+                "path:/_matrix/client/v3/room_keys/version",
+                {
+                    status: 404,
+                    body: {
+                        errcode: "M_NOT_FOUND",
+                        error: "No backup found",
+                    },
+                },
+                {
+                    overwriteRoutes: true,
+                },
+            );
+            const noResult = await aliceCrypto.checkKeyBackupAndEnable();
+            expect(noResult).toBeNull();
+            expect(await aliceCrypto.getActiveSessionBackupVersion()).toBeNull();
+        });
+    });
+
    /** make sure that the client knows about the dummy device */
    async function waitForDeviceList(): Promise<void> {
        // Completing the initial sync will make the device list download outdated device lists (of which our own
@@ -87,4 +87,19 @@ describe("MatrixClient.clearStores", () => {
        await matrixClient.clearStores();
        expect(await indexedDB.databases()).toHaveLength(0);
    });
+
+    it("should not fail in environments without indexedDB", async () => {
+        // eslint-disable-next-line no-global-assign
+        indexedDB = undefined!;
+        const matrixClient = createClient({
+            baseUrl: "http://test.server",
+            userId: "@alice:localhost",
+            deviceId: "aliceDevice",
+        });
+
+        await matrixClient.stopClient();
+
+        await matrixClient.clearStores();
+        // No error thrown in clearStores
+    });
 });
@@ -22,7 +22,15 @@ import fetchMock from "fetch-mock-jest";
 import { IDBFactory } from "fake-indexeddb";
 import { createHash } from "crypto";

-import { createClient, CryptoEvent, ICreateClientOpts, MatrixClient } from "../../../src";
+import {
+    createClient,
+    CryptoEvent,
+    IContent,
+    ICreateClientOpts,
+    MatrixClient,
+    MatrixEvent,
+    MatrixEventEvent,
+} from "../../../src";
 import {
    canAcceptVerificationRequest,
    ShowQrCodeCallbacks,
@@ -34,15 +42,20 @@ import {
    VerifierEvent,
 } from "../../../src/crypto-api/verification";
 import { escapeRegExp } from "../../../src/utils";
-import { CRYPTO_BACKENDS, emitPromise, InitCrypto } from "../../test-utils/test-utils";
+import { CRYPTO_BACKENDS, emitPromise, getSyncResponse, InitCrypto, syncPromise } from "../../test-utils/test-utils";
 import { SyncResponder } from "../../test-utils/SyncResponder";
 import {
+    BOB_SIGNED_CROSS_SIGNING_KEYS_DATA,
+    BOB_SIGNED_TEST_DEVICE_DATA,
+    BOB_TEST_USER_ID,
    MASTER_CROSS_SIGNING_PUBLIC_KEY_BASE64,
    SIGNED_CROSS_SIGNING_KEYS_DATA,
    SIGNED_TEST_DEVICE_DATA,
    TEST_DEVICE_ID,
    TEST_DEVICE_PUBLIC_ED25519_KEY_BASE64,
+    TEST_ROOM_ID,
    TEST_USER_ID,
+    BOB_ONE_TIME_KEYS,
 } from "../../test-utils/test-data";
 import { mockInitialApiRequests } from "../../test-utils/mockEndpoints";
 import { E2EKeyResponder } from "../../test-utils/E2EKeyResponder";
@@ -808,6 +821,82 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
        });
    });

+    describe("Send verification request in DM", () => {
+        beforeEach(async () => {
+            aliceClient = await startTestClient();
+            aliceClient.setGlobalErrorOnUnknownDevices(false);
+
+            e2eKeyResponder.addCrossSigningData(BOB_SIGNED_CROSS_SIGNING_KEYS_DATA);
+            e2eKeyResponder.addDeviceKeys(BOB_SIGNED_TEST_DEVICE_DATA);
+            syncResponder.sendOrQueueSyncResponse(getSyncResponse([BOB_TEST_USER_ID]));
+
+            // Wait for the sync response to be processed
+            await syncPromise(aliceClient);
+        });
+
+        /**
+         * Create a mock to respond when the verification request is sent
+         * Handle both encrypted and unencrypted requests
+         */
+        function awaitRoomMessageRequest(): Promise<IContent> {
+            return new Promise((resolve) => {
+                // Case of unencrypted message of the new crypto
+                fetchMock.put(
+                    "express:/_matrix/client/v3/rooms/:roomId/send/m.room.message/:txId",
+                    (url: string, options: RequestInit) => {
+                        resolve(JSON.parse(options.body as string));
+                        return { event_id: "$YUwRidLecu:example.com" };
+                    },
+                );
+
+                // Case of encrypted message of the old crypto
+                fetchMock.put(
+                    "express:/_matrix/client/v3/rooms/:roomId/send/m.room.encrypted/:txId",
+                    async (url: string, options: RequestInit) => {
+                        const encryptedMessage = JSON.parse(options.body as string);
+                        const event = new MatrixEvent({
+                            content: encryptedMessage,
+                            type: "m.room.encrypted",
+                            room_id: TEST_ROOM_ID,
+                        });
+                        // Try to decrypt the event
+                        event.once(MatrixEventEvent.Decrypted, (decryptedEvent: MatrixEvent, error?: Error) => {
+                            expect(error).not.toBeDefined();
+                            resolve(decryptedEvent.getContent());
+                        });
+                        await aliceClient.decryptEventIfNeeded(event);
+                        return { event_id: "$YUwRidLecu:example.com" };
+                    },
+                );
+            });
+        }
+
+        it("alice sends a verification request in a DM to bob", async () => {
+            fetchMock.post("express:/_matrix/client/v3/keys/claim", () => ({ one_time_keys: BOB_ONE_TIME_KEYS }));
+
+            // In `DeviceList#doQueuedQueries`, the key download response is processed every 5ms
+            // 5ms by users, ie Bob and Alice
+            await jest.advanceTimersByTimeAsync(10);
+
+            const messageRequestPromise = awaitRoomMessageRequest();
+            const verificationRequest = await aliceClient
+                .getCrypto()!
+                .requestVerificationDM(BOB_TEST_USER_ID, TEST_ROOM_ID);
+            const requestContent = await messageRequestPromise;
+
+            expect(requestContent.from_device).toBe(aliceClient.getDeviceId());
+            expect(requestContent.methods.sort()).toStrictEqual(
+                ["m.sas.v1", "m.qr_code.scan.v1", "m.qr_code.show.v1", "m.reciprocate.v1"].sort(),
+            );
+            expect(requestContent.msgtype).toBe("m.key.verification.request");
+            expect(requestContent.to).toBe(BOB_TEST_USER_ID);
+
+            expect(verificationRequest.roomId).toBe(TEST_ROOM_ID);
+            expect(verificationRequest.isSelfVerification).toBe(false);
+            expect(verificationRequest.otherUserId).toBe(BOB_TEST_USER_ID);
+        });
+    });
+
    async function startTestClient(opts: Partial<ICreateClientOpts> = {}): Promise<MatrixClient> {
        const client = createClient({
            baseUrl: TEST_HOMESERVER_URL,
@@ -92,9 +92,7 @@ describe("MatrixClient events", function () {
                                    type: "m.room.create",
                                    room: "!erufh:bar",
                                    user: "@foo:bar",
-                                    content: {
-                                        creator: "@foo:bar",
-                                    },
+                                    content: {},
                                }),
                            ],
                        },
@@ -107,9 +107,7 @@ const INITIAL_SYNC_DATA = {
                        utils.mkEvent({
                            type: "m.room.create",
                            user: userId,
-                            content: {
-                                creator: userId,
-                            },
+                            content: {},
                            event: false,
                        }),
                    ],
@@ -1342,7 +1340,7 @@ describe("MatrixClient event timelines", function () {
        function respondToContext(event: Partial<IEvent> = THREAD_ROOT): ExpectedHttpRequest {
            const request = httpBackend.when(
                "GET",
-                encodeUri("/_matrix/client/r0/rooms/$roomId/context/$eventId", {
+                encodeUri("/_matrix/client/v3/rooms/$roomId/context/$eventId", {
                    $roomId: roomId,
                    $eventId: event.event_id!,
                }),
@@ -1360,7 +1358,7 @@ describe("MatrixClient event timelines", function () {
        function respondToEvent(event: Partial<IEvent> = THREAD_ROOT): ExpectedHttpRequest {
            const request = httpBackend.when(
                "GET",
-                encodeUri("/_matrix/client/r0/rooms/$roomId/event/$eventId", {
+                encodeUri("/_matrix/client/v3/rooms/$roomId/event/$eventId", {
                    $roomId: roomId,
                    $eventId: event.event_id!,
                }),
@@ -1371,7 +1369,7 @@ describe("MatrixClient event timelines", function () {
        function respondToMessagesRequest(): ExpectedHttpRequest {
            const request = httpBackend.when(
                "GET",
-                encodeUri("/_matrix/client/r0/rooms/$roomId/messages", {
+                encodeUri("/_matrix/client/v3/rooms/$roomId/messages", {
                    $roomId: roomId,
                }),
            );
@@ -73,7 +73,7 @@ describe("MatrixClient", function () {

        it("should upload the file", function () {
            httpBackend
-                .when("POST", "/_matrix/media/r0/upload")
+                .when("POST", "/_matrix/media/v3/upload")
                .check(function (req) {
                    expect(req.rawData).toEqual(buf);
                    expect(req.queryParams?.filename).toEqual("hi.txt");
@@ -108,7 +108,7 @@ describe("MatrixClient", function () {

        it("should parse errors into a MatrixError", function () {
            httpBackend
-                .when("POST", "/_matrix/media/r0/upload")
+                .when("POST", "/_matrix/media/v3/upload")
                .check(function (req) {
                    expect(req.rawData).toEqual(buf);
                    // @ts-ignore private property
@@ -708,7 +708,7 @@ describe("MatrixClient", function () {
        const auth = { identifier: 1 };
        it("should pass through an auth dict", function () {
            httpBackend
-                .when("DELETE", "/_matrix/client/r0/devices/my_device")
+                .when("DELETE", "/_matrix/client/v3/devices/my_device")
                .check(function (req) {
                    expect(req.data).toEqual({ auth: auth });
                })
@@ -1102,10 +1102,6 @@ describe("MatrixClient", function () {
                submit_url: "https://foobar.matrix/_matrix/matrix",
            };

-            httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-                versions: ["r0.6.0"],
-            });
-
            const prom = client.requestRegisterEmailToken("bob@email", "secret", 1);
            httpBackend
                .when("POST", "/register/email/requestToken")
@@ -1126,10 +1122,6 @@ describe("MatrixClient", function () {
        it("should supply an id_access_token", async () => {
            const targetEmail = "gerald@example.org";

-            httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-                versions: ["r0.6.0"],
-            });
-
            httpBackend
                .when("POST", "/invite")
                .check((req) => {
@@ -1165,10 +1157,6 @@ describe("MatrixClient", function () {
                ],
            };

-            httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-                versions: ["r0.6.0"],
-            });
-
            httpBackend
                .when("POST", "/createRoom")
                .check((req) => {
@@ -1652,6 +1640,82 @@ describe("MatrixClient", function () {
            ]);
        });
    });
+
+    describe("getFallbackAuthUrl", () => {
+        it("should return fallback url", () => {
+            expect(client.getFallbackAuthUrl("loginType", "authSessionId")).toMatchInlineSnapshot(
+                `"http://alice.localhost.test.server/_matrix/client/v3/auth/loginType/fallback/web?session=authSessionId"`,
+            );
+        });
+    });
+
+    describe("addThreePidOnly", () => {
+        it("should make expected POST request", async () => {
+            httpBackend
+                .when("POST", "/_matrix/client/v3/account/3pid/add")
+                .check(function (req) {
+                    expect(req.data).toEqual({
+                        client_secret: "secret",
+                        sid: "sid",
+                    });
+                    expect(req.headers["Authorization"]).toBe("Bearer " + accessToken);
+                })
+                .respond(200, {});
+
+            await Promise.all([
+                client.addThreePidOnly({
+                    client_secret: "secret",
+                    sid: "sid",
+                }),
+                httpBackend.flushAllExpected(),
+            ]);
+        });
+    });
+
+    describe("bindThreePid", () => {
+        it("should make expected POST request", async () => {
+            httpBackend
+                .when("POST", "/_matrix/client/v3/account/3pid/bind")
+                .check(function (req) {
+                    expect(req.data).toEqual({
+                        client_secret: "secret",
+                        id_server: "server",
+                        id_access_token: "token",
+                        sid: "sid",
+                    });
+                    expect(req.headers["Authorization"]).toBe("Bearer " + accessToken);
+                })
+                .respond(200, {});
+
+            await Promise.all([
+                client.bindThreePid({
+                    client_secret: "secret",
+                    id_server: "server",
+                    id_access_token: "token",
+                    sid: "sid",
+                }),
+                httpBackend.flushAllExpected(),
+            ]);
+        });
+    });
+
+    describe("unbindThreePid", () => {
+        it("should make expected POST request", async () => {
+            httpBackend
+                .when("POST", "/_matrix/client/v3/account/3pid/unbind")
+                .check(function (req) {
+                    expect(req.data).toEqual({
+                        medium: "email",
+                        address: "alice@server.com",
+                        id_server: "identity.localhost",
+                    });
+                    expect(req.headers["Authorization"]).toBe("Bearer " + accessToken);
+                })
+                .respond(200, {});
+
+            await Promise.all([client.unbindThreePid("email", "alice@server.com"), httpBackend.flushAllExpected()]);
+        });
+    });
 });

 function withThreadId(event: MatrixEvent, newThreadId: string): MatrixEvent {
@@ -1925,7 +1989,6 @@ const buildEventCreate = () =>
    new MatrixEvent({
        age: 80126105,
        content: {
-            creator: "@andybalaam-test1:matrix.org",
            room_version: "6",
        },
        event_id: "$e7j2Gt37k5NPwB6lz2N3V9lO5pUdNK8Ai7i2FPEK-oI",
@@ -57,9 +57,7 @@ describe("MatrixClient opts", function () {
                                type: "m.room.create",
                                room: roomId,
                                user: userId,
-                                content: {
-                                    creator: userId,
-                                },
+                                content: {},
                            }),
                        ],
                    },
@@ -85,9 +85,7 @@ describe("MatrixClient room timelines", function () {
                                type: "m.room.create",
                                room: roomId,
                                user: userId,
-                                content: {
-                                    creator: userId,
-                                },
+                                content: {},
                            }),
                        ],
                    },
@@ -223,9 +223,122 @@ describe("MatrixClient syncing", () => {
            expect(fires).toBe(3);
        });

-        it("should honour lazyLoadMembers if user is not a guest", () => {
-            client!.doesServerSupportLazyLoading = jest.fn().mockResolvedValue(true);
+        it("should emit RoomEvent.MyMembership for knock->leave->knock cycles", async () => {
+            await client!.initCrypto();

+            const roomId = "!cycles:example.org";
+
+            // First sync: an knock
+            const knockSyncRoomSection = {
+                knock: {
+                    [roomId]: {
+                        knock_state: {
+                            events: [
+                                {
+                                    type: "m.room.member",
+                                    state_key: selfUserId,
+                                    content: {
+                                        membership: "knock",
+                                    },
+                                },
+                            ],
+                        },
+                    },
+                },
+            };
+            httpBackend!.when("GET", "/sync").respond(200, {
+                ...syncData,
+                rooms: knockSyncRoomSection,
+            });
+
+            // Second sync: a leave (reject of some kind)
+            httpBackend!.when("POST", "/leave").respond(200, {});
+            httpBackend!.when("GET", "/sync").respond(200, {
+                ...syncData,
+                rooms: {
+                    leave: {
+                        [roomId]: {
+                            account_data: { events: [] },
+                            ephemeral: { events: [] },
+                            state: {
+                                events: [
+                                    {
+                                        type: "m.room.member",
+                                        state_key: selfUserId,
+                                        content: {
+                                            membership: "leave",
+                                        },
+                                        prev_content: {
+                                            membership: "knock",
+                                        },
+                                        // XXX: And other fields required on an event
+                                    },
+                                ],
+                            },
+                            timeline: {
+                                limited: false,
+                                events: [
+                                    {
+                                        type: "m.room.member",
+                                        state_key: selfUserId,
+                                        content: {
+                                            membership: "leave",
+                                        },
+                                        prev_content: {
+                                            membership: "knock",
+                                        },
+                                        // XXX: And other fields required on an event
+                                    },
+                                ],
+                            },
+                        },
+                    },
+                },
+            });
+
+            // Third sync: another knock
+            httpBackend!.when("GET", "/sync").respond(200, {
+                ...syncData,
+                rooms: knockSyncRoomSection,
+            });
+
+            // First fire: an initial knock
+            let fires = 0;
+            client!.once(RoomEvent.MyMembership, (room, membership, oldMembership) => {
+                // Room, string, string
+                fires++;
+                expect(room.roomId).toBe(roomId);
+                expect(membership).toBe("knock");
+                expect(oldMembership).toBeFalsy();
+
+                // Second fire: a leave
+                client!.once(RoomEvent.MyMembership, (room, membership, oldMembership) => {
+                    fires++;
+                    expect(room.roomId).toBe(roomId);
+                    expect(membership).toBe("leave");
+                    expect(oldMembership).toBe("knock");
+
+                    // Third/final fire: a second knock
+                    client!.once(RoomEvent.MyMembership, (room, membership, oldMembership) => {
+                        fires++;
+                        expect(room.roomId).toBe(roomId);
+                        expect(membership).toBe("knock");
+                        expect(oldMembership).toBe("leave");
+                    });
+                });
+
+                // For maximum safety, "leave" the room after we register the handler
+                client!.leave(roomId);
+            });
+
+            // noinspection ES6MissingAwait
+            client!.startClient();
+            await httpBackend!.flushAllExpected();
+
+            expect(fires).toBe(3);
+        });
+
+        it("should honour lazyLoadMembers if user is not a guest", () => {
            httpBackend!
                .when("GET", "/sync")
                .check((req) => {
@@ -242,8 +355,6 @@ describe("MatrixClient syncing", () => {
        it("should not honour lazyLoadMembers if user is a guest", () => {
            httpBackend!.expectedRequests = [];
            httpBackend!.when("GET", "/versions").respond(200, {});
-            client!.doesServerSupportLazyLoading = jest.fn().mockResolvedValue(true);
-
            httpBackend!
                .when("GET", "/sync")
                .check((req) => {
@@ -297,6 +408,46 @@ describe("MatrixClient syncing", () => {
            expect(fires).toBe(1);
        });

+        it("should emit ClientEvent.Room when knocked while crypto is disabled", async () => {
+            const roomId = "!knock:example.org";
+
+            // First sync: a knock
+            const knockSyncRoomSection = {
+                knock: {
+                    [roomId]: {
+                        knock_state: {
+                            events: [
+                                {
+                                    type: "m.room.member",
+                                    state_key: selfUserId,
+                                    content: {
+                                        membership: "knock",
+                                    },
+                                },
+                            ],
+                        },
+                    },
+                },
+            };
+            httpBackend!.when("GET", "/sync").respond(200, {
+                ...syncData,
+                rooms: knockSyncRoomSection,
+            });
+
+            // First fire: an initial knock
+            let fires = 0;
+            client!.once(ClientEvent.Room, (room) => {
+                fires++;
+                expect(room.roomId).toBe(roomId);
+            });
+
+            // noinspection ES6MissingAwait
+            client!.startClient();
+            await httpBackend!.flushAllExpected();
+
+            expect(fires).toBe(1);
+        });
+
        it("should work when all network calls fail", async () => {
            httpBackend!.expectedRequests = [];
            httpBackend!.when("GET", "").fail(0, new Error("CORS or something"));
@@ -362,6 +513,7 @@ describe("MatrixClient syncing", () => {
                join: {},
                invite: {},
                leave: {},
+                knock: {},
            },
        };

@@ -393,9 +545,7 @@ describe("MatrixClient syncing", () => {
                            type: "m.room.create",
                            room: roomOne,
                            user: selfUserId,
-                            content: {
-                                creator: selfUserId,
-                            },
+                            content: {},
                        }),
                    ],
                },
@@ -581,9 +731,7 @@ describe("MatrixClient syncing", () => {
                                    type: "m.room.create",
                                    room: roomOne,
                                    user: selfUserId,
-                                    content: {
-                                        creator: selfUserId,
-                                    },
+                                    content: {},
                                }),
                            ],
                        },
@@ -615,9 +763,7 @@ describe("MatrixClient syncing", () => {
                                    type: "m.room.create",
                                    room: roomTwo,
                                    user: selfUserId,
-                                    content: {
-                                        creator: selfUserId,
-                                    },
+                                    content: {},
                                }),
                            ],
                        },
@@ -762,7 +908,6 @@ describe("MatrixClient syncing", () => {
                        room: roomOne,
                        user: otherUserId,
                        content: {
-                            creator: otherUserId,
                            room_version: "9",
                        },
                    });
@@ -848,7 +993,6 @@ describe("MatrixClient syncing", () => {
                        room: roomOne,
                        user: otherUserId,
                        content: {
-                            creator: otherUserId,
                            room_version: testMeta.roomVersion,
                        },
                    });
@@ -1376,9 +1520,7 @@ describe("MatrixClient syncing", () => {
                                    type: "m.room.create",
                                    room: roomOne,
                                    user: selfUserId,
-                                    content: {
-                                        creator: selfUserId,
-                                    },
+                                    content: {},
                                }),
                            ],
                        } as Partial<IJoinedRoom>,
@@ -1475,9 +1617,7 @@ describe("MatrixClient syncing", () => {
                                    type: "m.room.create",
                                    room: roomOne,
                                    user: selfUserId,
-                                    content: {
-                                        creator: selfUserId,
-                                    },
+                                    content: {},
                                }),
                            ],
                        },
@@ -1633,9 +1773,7 @@ describe("MatrixClient syncing", () => {
                                        type: "m.room.create",
                                        room: roomId,
                                        user: selfUserId,
-                                        content: {
-                                            creator: selfUserId,
-                                        },
+                                        content: {},
                                    }),
                                ],
                            },
@@ -179,7 +179,6 @@ describe("MatrixClient syncing", () => {
                            events: [
                                {
                                    content: {
-                                        creator: userB,
                                        room_version: "9",
                                    },
                                    origin_server_ts: 1,
@@ -377,6 +376,7 @@ describe("MatrixClient syncing", () => {
                },
                [Category.Leave]: {},
                [Category.Invite]: {},
+                [Category.Knock]: {},
            },
        };
    }
@@ -121,7 +121,7 @@ describe("SlidingSyncSdk", () => {
            await client!.initCrypto();
            syncOpts.cryptoCallbacks = syncOpts.crypto = client!.crypto;
        }
-        httpBackend!.when("GET", "/_matrix/client/r0/pushrules").respond(200, {});
+        httpBackend!.when("GET", "/_matrix/client/v3/pushrules").respond(200, {});
        sdk = new SlidingSyncSdk(mockSlidingSync, client, testOpts, syncOpts);
    };

@@ -188,7 +188,7 @@ describe("SlidingSyncSdk", () => {
                [roomA]: {
                    name: "A",
                    required_state: [
-                        mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                        mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                        mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                        mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                        mkOwnStateEvent(EventType.RoomName, { name: "A" }, ""),
@@ -203,7 +203,7 @@ describe("SlidingSyncSdk", () => {
                    name: "B",
                    required_state: [],
                    timeline: [
-                        mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                        mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                        mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                        mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                        mkOwnEvent(EventType.RoomMessage, { body: "hello B" }),
@@ -215,7 +215,7 @@ describe("SlidingSyncSdk", () => {
                    name: "C",
                    required_state: [],
                    timeline: [
-                        mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                        mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                        mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                        mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                        mkOwnEvent(EventType.RoomMessage, { body: "hello C" }),
@@ -228,7 +228,7 @@ describe("SlidingSyncSdk", () => {
                    name: "D",
                    required_state: [],
                    timeline: [
-                        mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                        mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                        mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                        mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                        mkOwnEvent(EventType.RoomMessage, { body: "hello D" }),
@@ -264,7 +264,7 @@ describe("SlidingSyncSdk", () => {
                [roomF]: {
                    name: "#foo:localhost",
                    required_state: [
-                        mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                        mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                        mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                        mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                        mkOwnStateEvent(EventType.RoomCanonicalAlias, { alias: "#foo:localhost" }, ""),
@@ -280,7 +280,7 @@ describe("SlidingSyncSdk", () => {
                    name: "G",
                    required_state: [],
                    timeline: [
-                        mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                        mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                        mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                        mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                    ],
@@ -292,7 +292,7 @@ describe("SlidingSyncSdk", () => {
                    name: "H",
                    required_state: [],
                    timeline: [
-                        mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                        mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                        mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                        mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                        mkOwnEvent(EventType.RoomMessage, { body: "live event" }),
@@ -602,7 +602,7 @@ describe("SlidingSyncSdk", () => {
                name: "Room with Invite",
                required_state: [],
                timeline: [
-                    mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                    mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                    mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                    mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                    mkOwnStateEvent(EventType.RoomMember, { membership: "invite" }, invitee),
@@ -718,7 +718,7 @@ describe("SlidingSyncSdk", () => {
                name: "Room with account data",
                required_state: [],
                timeline: [
-                    mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                    mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                    mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                    mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                    mkOwnEvent(EventType.RoomMessage, { body: "hello" }),
@@ -922,7 +922,7 @@ describe("SlidingSyncSdk", () => {
                name: "Room with typing",
                required_state: [],
                timeline: [
-                    mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                    mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                    mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                    mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                    mkOwnEvent(EventType.RoomMessage, { body: "hello" }),
@@ -963,7 +963,7 @@ describe("SlidingSyncSdk", () => {
                name: "Room with typing",
                required_state: [],
                timeline: [
-                    mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                    mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                    mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                    mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                    mkOwnEvent(EventType.RoomMessage, { body: "hello" }),
@@ -1049,7 +1049,7 @@ describe("SlidingSyncSdk", () => {
                name: "Room with receipts",
                required_state: [],
                timeline: [
-                    mkOwnStateEvent(EventType.RoomCreate, { creator: selfUserId }, ""),
+                    mkOwnStateEvent(EventType.RoomCreate, {}, ""),
                    mkOwnStateEvent(EventType.RoomMember, { membership: "join" }, selfUserId),
                    mkOwnStateEvent(EventType.RoomPowerLevels, { users: { [selfUserId]: 100 } }, ""),
                    {
@@ -75,8 +75,6 @@ export class E2EKeyReceiver implements IE2EKeyReceiver {
            const listener = (url: string, options: RequestInit) =>
                this.onKeyUploadRequest(resolveOneTimeKeys, options);

-            // catch both r0 and v3 variants
-            fetchMock.post(new URL("/_matrix/client/r0/keys/upload", homeserverUrl).toString(), listener);
            fetchMock.post(new URL("/_matrix/client/v3/keys/upload", homeserverUrl).toString(), listener);
        });
    }
@@ -43,8 +43,6 @@ export class E2EKeyResponder {
    public constructor(homeserverUrl: string) {
        // set up a listener for /keys/query.
        const listener = (url: string, options: RequestInit) => this.onKeyQueryRequest(options);
-        // catch both r0 and v3 variants
-        fetchMock.post(new URL("/_matrix/client/r0/keys/query", homeserverUrl).toString(), listener);
        fetchMock.post(new URL("/_matrix/client/v3/keys/query", homeserverUrl).toString(), listener);
    }

@@ -75,7 +75,7 @@ export class SyncResponder implements ISyncResponder {
     */
    public constructor(homeserverUrl: string) {
        this.debug = debugFunc(`sync-responder:[${homeserverUrl}]`);
-        fetchMock.get("begin:" + new URL("/_matrix/client/r0/sync?", homeserverUrl).toString(), (_url, _options) =>
+        fetchMock.get("begin:" + new URL("/_matrix/client/v3/sync?", homeserverUrl).toString(), (_url, _options) =>
            this.onSyncRequest(),
        );
    }
@@ -86,7 +86,6 @@ export const mockClientMethodsEvents = () => ({
 * Returns basic mocked client methods related to server support
 */
 export const mockClientMethodsServer = (): Partial<Record<MethodLikeKeys<MatrixClient>, unknown>> => ({
-    doesServerSupportSeparateAddAndBind: jest.fn(),
    getIdentityServerUrl: jest.fn(),
    getHomeserverUrl: jest.fn(),
    getCapabilities: jest.fn().mockReturnValue({}),
@@ -16,15 +16,17 @@ limitations under the License.

 import fetchMock from "fetch-mock-jest";

+import { KeyBackupInfo } from "../../src/crypto-api";
+
 /**
 * Mock out the endpoints that the js-sdk calls when we call `MatrixClient.start()`.
 *
 * @param homeserverUrl - the homeserver url for the client under test
 */
 export function mockInitialApiRequests(homeserverUrl: string) {
-    fetchMock.getOnce(new URL("/_matrix/client/versions", homeserverUrl).toString(), { versions: ["r0.5.0"] });
-    fetchMock.getOnce(new URL("/_matrix/client/r0/pushrules/", homeserverUrl).toString(), {});
-    fetchMock.postOnce(new URL("/_matrix/client/r0/user/%40alice%3Alocalhost/filter", homeserverUrl).toString(), {
+    fetchMock.getOnce(new URL("/_matrix/client/versions", homeserverUrl).toString(), { versions: ["v1.1"] });
+    fetchMock.getOnce(new URL("/_matrix/client/v3/pushrules/", homeserverUrl).toString(), {});
+    fetchMock.postOnce(new URL("/_matrix/client/v3/user/%40alice%3Alocalhost/filter", homeserverUrl).toString(), {
        filter_id: "fid",
    });
 }
@@ -32,13 +34,13 @@ export function mockInitialApiRequests(homeserverUrl: string) {
 /**
 * Mock the requests needed to set up cross signing
 *
- * Return 404 error for `GET _matrix/client/r0/user/:userId/account_data/:type` request
+ * Return 404 error for `GET _matrix/client/v3/user/:userId/account_data/:type` request
 * Return `{}` for `POST _matrix/client/v3/keys/signatures/upload` request (named `upload-sigs` for fetchMock check)
 * Return `{}` for `POST /_matrix/client/(unstable|v3)/keys/device_signing/upload` request (named `upload-keys` for fetchMock check)
 */
 export function mockSetupCrossSigningRequests(): void {
    // have account_data requests return an empty object
-    fetchMock.get("express:/_matrix/client/r0/user/:userId/account_data/:type", {
+    fetchMock.get("express:/_matrix/client/v3/user/:userId/account_data/:type", {
        status: 404,
        body: { errcode: "M_NOT_FOUND", error: "Account data not found." },
    });
@@ -56,3 +58,35 @@ export function mockSetupCrossSigningRequests(): void {
        {},
    );
 }
+
+/**
+ * Mock out requests to `/room_keys/version`.
+ *
+ * Returns `404 M_NOT_FOUND` for GET requests until `POST room_keys/version` is called.
+ * Once the POST is done, `GET /room_keys/version` will return the posted backup
+ * instead of 404.
+ *
+ * @param backupVersion - The backup version that will be returned by `POST room_keys/version`.
+ */
+export function mockSetupMegolmBackupRequests(backupVersion: string): void {
+    fetchMock.get("path:/_matrix/client/v3/room_keys/version", {
+        status: 404,
+        body: {
+            errcode: "M_NOT_FOUND",
+            error: "No current backup version",
+        },
+    });
+
+    fetchMock.post("path:/_matrix/client/v3/room_keys/version", (url, request) => {
+        const backupData: KeyBackupInfo = JSON.parse(request.body?.toString() ?? "{}");
+        backupData.version = backupVersion;
+        backupData.count = 0;
+        backupData.etag = "zer";
+        fetchMock.get("path:/_matrix/client/v3/room_keys/version", backupData, {
+            overwriteRoutes: true,
+        });
+        return {
+            version: backupVersion,
+        };
+    });
+}
@@ -26,78 +26,140 @@ python -m venv env

 import base64
 import json
+import base58

 from canonicaljson import encode_canonical_json
 from cryptography.hazmat.primitives.asymmetric import ed25519, x25519
 from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+from cryptography.hazmat.primitives import hashes, padding, hmac
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

-# input data
-TEST_USER_ID = "@alice:localhost"
-TEST_DEVICE_ID = "test_device"
-TEST_ROOM_ID = "!room:id"
-# any 32-byte string can be an ed25519 private key.
-TEST_DEVICE_PRIVATE_KEY_BYTES = b"deadbeefdeadbeefdeadbeefdeadbeef"
+from random import randbytes, seed

-MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES = b"doyouspeakwhaaaaaaaaaaaaaaaaaale"
-USER_CROSS_SIGNING_PRIVATE_KEY_BYTES = b"useruseruseruseruseruseruseruser"
-SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES = b"selfselfselfselfselfselfselfself"
+ALICE_DATA = {
+    "TEST_USER_ID": "@alice:localhost",
+    "TEST_DEVICE_ID": "test_device",
+    "TEST_ROOM_ID": "!room:id",
+    # any 32-byte string can be an ed25519 private key.
+    "TEST_DEVICE_PRIVATE_KEY_BYTES": b"deadbeefdeadbeefdeadbeefdeadbeef",
+    # any 32-byte string can be an curve25519 private key.
+    "TEST_DEVICE_CURVE_PRIVATE_KEY_BYTES": b"deadmuledeadmuledeadmuledeadmule",

-# Private key for secure key backup. There are some sessions encrypted with this key in megolm-backup.spec.ts
-B64_BACKUP_DECRYPTION_KEY = "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo="
+    "MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES": b"doyouspeakwhaaaaaaaaaaaaaaaaaale",
+    "USER_CROSS_SIGNING_PRIVATE_KEY_BYTES": b"useruseruseruseruseruseruseruser",
+    "SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES": b"selfselfselfselfselfselfselfself",
+
+    # Private key for secure key backup. There are some sessions encrypted with this key in megolm-backup.spec.ts
+    "B64_BACKUP_DECRYPTION_KEY": "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo=",
+
+    "OTK": "j3fR3HemM16M7CWhoI4Sk5ZsdmdfQHsKL1xuSft6MSw"
+}
+
+BOB_DATA = {
+    "TEST_USER_ID": "@bob:xyz",
+    "TEST_DEVICE_ID": "bob_device",
+    "TEST_ROOM_ID": "!room:id",
+    # any 32-byte string can be an ed25519 private key.
+    "TEST_DEVICE_PRIVATE_KEY_BYTES": b"Deadbeefdeadbeefdeadbeefdeadbeef",
+    # any 32-byte string can be an curve25519 private key.
+    "TEST_DEVICE_CURVE_PRIVATE_KEY_BYTES": b"Deadmuledeadmuledeadmuledeadmule",
+
+    "MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES": b"Doyouspeakwhaaaaaaaaaaaaaaaaaale",
+    "USER_CROSS_SIGNING_PRIVATE_KEY_BYTES": b"Useruseruseruseruseruseruseruser",
+    "SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES": b"Selfselfselfselfselfselfselfself",
+
+    # Private key for secure key backup. There are some sessions encrypted with this key in megolm-backup.spec.ts
+    "B64_BACKUP_DECRYPTION_KEY": "DwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo=",
+
+    "OTK": "j3fR3HemM16M7CWhoI4Sk5ZsdmdfQHsKL1xuSft6MSw"
+}

 def main() -> None:
-    private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
-        TEST_DEVICE_PRIVATE_KEY_BYTES
+    print(
+        f"""\
+/* Test data for cryptography tests
+ *
+ * Do not edit by hand! This file is generated by `./generate-test-data.py`
+ */
+
+import {{ IDeviceKeys, IMegolmSessionData }} from "../../../src/@types/crypto";
+import {{ IDownloadKeyResult, IEvent }} from "../../../src";
+import {{ KeyBackupSession, KeyBackupInfo }} from "../../../src/crypto-api/keybackup";
+
+/* eslint-disable comma-dangle */
+
+// Alice data
+
+{build_test_data(ALICE_DATA)}
+// Bob data
+
+{build_test_data(BOB_DATA, "BOB_")}
+""",
+        end="",
    )
+
+# Use static seed to have stable random test data upon new generation
+seed(10)
+
+def build_test_data(user_data, prefix = "") -> str:
+    private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
+             user_data["TEST_DEVICE_PRIVATE_KEY_BYTES"]
+        )
+
+    device_curve_key = x25519.X25519PrivateKey.from_private_bytes(
+             user_data["TEST_DEVICE_CURVE_PRIVATE_KEY_BYTES"]
+        )
+
    b64_public_key = encode_base64(
        private_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
    )

    device_data = {
        "algorithms": ["m.olm.v1.curve25519-aes-sha2", "m.megolm.v1.aes-sha2"],
-        "device_id": TEST_DEVICE_ID,
+        "device_id":  user_data["TEST_DEVICE_ID"],
        "keys": {
-            f"curve25519:{TEST_DEVICE_ID}": "F4uCNNlcbRvc7CfBz95ZGWBvY1ALniG1J8+6rhVoKS0",
-            f"ed25519:{TEST_DEVICE_ID}": b64_public_key,
+            f"curve25519:{user_data['TEST_DEVICE_ID']}": "F4uCNNlcbRvc7CfBz95ZGWBvY1ALniG1J8+6rhVoKS0",
+            f"ed25519:{user_data['TEST_DEVICE_ID']}": b64_public_key,
        },
-        "signatures": {TEST_USER_ID: {}},
-        "user_id": TEST_USER_ID,
+        "signatures": {user_data['TEST_USER_ID']: {}},
+        "user_id": user_data["TEST_USER_ID"],
    }

-    device_data["signatures"][TEST_USER_ID][f"ed25519:{TEST_DEVICE_ID}"] = sign_json(
+    device_data["signatures"][user_data["TEST_USER_ID"]][f"ed25519:{user_data['TEST_DEVICE_ID']}"] = sign_json(
        device_data, private_key
    )

    master_private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
-        MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES
+        user_data["MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES"]
    )
    b64_master_public_key = encode_base64(
        master_private_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
    )
-    b64_master_private_key = encode_base64(MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES)
+    b64_master_private_key = encode_base64(user_data["MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES"])

    self_signing_private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
-        SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES
+        user_data["SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES"]
    )
    b64_self_signing_public_key = encode_base64(
        self_signing_private_key.public_key().public_bytes(
            Encoding.Raw, PublicFormat.Raw
        )
    )
-    b64_self_signing_private_key = encode_base64(SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES)
+    b64_self_signing_private_key = encode_base64( user_data["SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES"])

    user_signing_private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
-        USER_CROSS_SIGNING_PRIVATE_KEY_BYTES
+         user_data["USER_CROSS_SIGNING_PRIVATE_KEY_BYTES"]
    )
    b64_user_signing_public_key = encode_base64(
        user_signing_private_key.public_key().public_bytes(
            Encoding.Raw, PublicFormat.Raw
        )
    )
-    b64_user_signing_private_key = encode_base64(USER_CROSS_SIGNING_PRIVATE_KEY_BYTES)
+    b64_user_signing_private_key = encode_base64(user_data["USER_CROSS_SIGNING_PRIVATE_KEY_BYTES"])

    backup_decryption_key = x25519.X25519PrivateKey.from_private_bytes(
-        base64.b64decode(B64_BACKUP_DECRYPTION_KEY)
+        base64.b64decode(user_data["B64_BACKUP_DECRYPTION_KEY"])
    )
    b64_backup_public_key = encode_base64(
        backup_decryption_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
@@ -113,75 +175,121 @@ def main() -> None:
    # sign with our device key
    sig = sign_json(backup_data["auth_data"], private_key)
    backup_data["auth_data"]["signatures"] = {
-        TEST_USER_ID: {f"ed25519:{TEST_DEVICE_ID}": sig}
+        user_data["TEST_USER_ID"]: {f"ed25519:{user_data['TEST_DEVICE_ID']}": sig}
    }

-    print(
-        f"""\
-/* Test data for cryptography tests
- *
- * Do not edit by hand! This file is generated by `./generate-test-data.py`
- */
+    set_of_exported_room_keys = [build_exported_megolm_key(device_curve_key)[0], build_exported_megolm_key(device_curve_key)[0]]

-import {{ IDeviceKeys }} from "../../../src/@types/crypto";
-import {{ IDownloadKeyResult }} from "../../../src";
-import {{ KeyBackupInfo }} from "../../../src/crypto-api";
+    additional_exported_room_key, additional_exported_ed_key = build_exported_megolm_key(device_curve_key)
+    ratcheted_exported_room_key = symetric_ratchet_step_of_megolm_key(additional_exported_room_key, additional_exported_ed_key)

-/* eslint-disable comma-dangle */
+    otk_to_sign = {
+        "key": user_data['OTK']
+    }
+    # sign our public otk key with our device key
+    otk = sign_json(otk_to_sign, private_key)
+    otks = {
+        user_data["TEST_USER_ID"]: {
+            user_data['TEST_DEVICE_ID']: {
+                 "signed_curve25519:AAAAHQ": {
+                    "key": user_data["OTK"],
+                    "signatures": {
+                        user_data["TEST_USER_ID"]: {f"ed25519:{user_data['TEST_DEVICE_ID']}": otk}
+                    }
+                 }
+            }
+        }
+    }

-export const TEST_USER_ID = "{TEST_USER_ID}";
-export const TEST_DEVICE_ID = "{TEST_DEVICE_ID}";
-export const TEST_ROOM_ID = "{TEST_ROOM_ID}";
+
+    backed_up_room_key = encrypt_megolm_key_for_backup(additional_exported_room_key, backup_decryption_key.public_key())
+
+    clear_event, encrypted_event = generate_encrypted_event_content(additional_exported_room_key, additional_exported_ed_key, device_curve_key)
+
+    backup_recovery_key = export_recovery_key(user_data["B64_BACKUP_DECRYPTION_KEY"])
+
+    return f"""\
+export const {prefix}TEST_USER_ID = "{user_data['TEST_USER_ID']}";
+export const {prefix}TEST_DEVICE_ID = "{user_data['TEST_DEVICE_ID']}";
+export const {prefix}TEST_ROOM_ID = "{user_data['TEST_ROOM_ID']}";

 /** The base64-encoded public ed25519 key for this device */
-export const TEST_DEVICE_PUBLIC_ED25519_KEY_BASE64 = "{b64_public_key}";
+export const {prefix}TEST_DEVICE_PUBLIC_ED25519_KEY_BASE64 = "{b64_public_key}";

 /** Signed device data, suitable for returning from a `/keys/query` call */
-export const SIGNED_TEST_DEVICE_DATA: IDeviceKeys = {json.dumps(device_data, indent=4)};
+export const {prefix}SIGNED_TEST_DEVICE_DATA: IDeviceKeys = {json.dumps(device_data, indent=4)};

 /** base64-encoded public master cross-signing key */
-export const MASTER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "{b64_master_public_key}";
+export const {prefix}MASTER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "{b64_master_public_key}";

 /** base64-encoded private master cross-signing key */
-export const MASTER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "{b64_master_private_key}";
+export const {prefix}MASTER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "{b64_master_private_key}";

 /** base64-encoded public self cross-signing key */
-export const SELF_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "{b64_self_signing_public_key}";
+export const {prefix}SELF_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "{b64_self_signing_public_key}";

 /** base64-encoded private self signing cross-signing key */
-export const SELF_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "{b64_self_signing_private_key}";
+export const {prefix}SELF_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "{b64_self_signing_private_key}";

 /** base64-encoded public user cross-signing key */
-export const USER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "{b64_user_signing_public_key}";
+export const {prefix}USER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "{b64_user_signing_public_key}";

 /** base64-encoded private user signing cross-signing key */
-export const USER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "{b64_user_signing_private_key}";
+export const {prefix}USER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "{b64_user_signing_private_key}";

 /** Signed cross-signing keys data, also suitable for returning from a `/keys/query` call */
-export const SIGNED_CROSS_SIGNING_KEYS_DATA: Partial<IDownloadKeyResult> = {
-        json.dumps(build_cross_signing_keys_data(), indent=4)
+export const {prefix}SIGNED_CROSS_SIGNING_KEYS_DATA: Partial<IDownloadKeyResult> = {
+        json.dumps(build_cross_signing_keys_data(user_data), indent=4)
 };

+/** Signed OTKs, returned by `POST /keys/claim` */
+export const {prefix}ONE_TIME_KEYS = { json.dumps(otks, indent=4) };
+
 /** base64-encoded backup decryption (private) key */
-export const BACKUP_DECRYPTION_KEY_BASE64 = "{ B64_BACKUP_DECRYPTION_KEY }";
+export const {prefix}BACKUP_DECRYPTION_KEY_BASE64 = "{ user_data['B64_BACKUP_DECRYPTION_KEY'] }";
+
+/** Backup decryption key in export format */
+export const {prefix}BACKUP_DECRYPTION_KEY_BASE58 = "{ backup_recovery_key }";

 /** Signed backup data, suitable for return from `GET /_matrix/client/v3/room_keys/keys/{{roomId}}/{{sessionId}}` */
-export const SIGNED_BACKUP_DATA: KeyBackupInfo = { json.dumps(backup_data, indent=4) };
-""",
-        end="",
-    )
+export const {prefix}SIGNED_BACKUP_DATA: KeyBackupInfo = { json.dumps(backup_data, indent=4) };
+
+/** A set of megolm keys that can be imported via CryptoAPI#importRoomKeys */
+export const {prefix}MEGOLM_SESSION_DATA_ARRAY: IMegolmSessionData[] = {
+    json.dumps(set_of_exported_room_keys, indent=4)
+};
+
+/** An exported megolm session */
+export const {prefix}MEGOLM_SESSION_DATA: IMegolmSessionData = {
+        json.dumps(additional_exported_room_key, indent=4)
+};
+
+/** A ratcheted version of {prefix}MEGOLM_SESSION_DATA */
+export const {prefix}RATCHTED_MEGOLM_SESSION_DATA: IMegolmSessionData = {
+        json.dumps(ratcheted_exported_room_key, indent=4)
+};
+
+/** The key from {prefix}MEGOLM_SESSION_DATA, encrypted for backup using `m.megolm_backup.v1.curve25519-aes-sha2` algorithm*/
+export const {prefix}CURVE25519_KEY_BACKUP_DATA: KeyBackupSession = {json.dumps(backed_up_room_key, indent=4)};
+
+/** A test clear event */
+export const {prefix}CLEAR_EVENT: Partial<IEvent> = {json.dumps(clear_event, indent=4)};
+
+/** The encrypted CLEAR_EVENT by MEGOLM_SESSION_DATA */
+export const {prefix}ENCRYPTED_EVENT: Partial<IEvent> = {json.dumps(encrypted_event, indent=4)};
+"""


-def build_cross_signing_keys_data() -> dict:
+def build_cross_signing_keys_data(user_data) -> dict:
    """Build the signed cross-signing-keys data for return from /keys/query"""
    master_private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
-        MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES
+        user_data["MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES"]
    )
    b64_master_public_key = encode_base64(
        master_private_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
    )
    self_signing_private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
-        SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES
+         user_data["SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES"]
    )
    b64_self_signing_public_key = encode_base64(
        self_signing_private_key.public_key().public_bytes(
@@ -189,7 +297,7 @@ def build_cross_signing_keys_data() -> dict:
        )
    )
    user_signing_private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
-        USER_CROSS_SIGNING_PRIVATE_KEY_BYTES
+         user_data["USER_CROSS_SIGNING_PRIVATE_KEY_BYTES"]
    )
    b64_user_signing_public_key = encode_base64(
        user_signing_private_key.public_key().public_bytes(
@@ -199,39 +307,39 @@ def build_cross_signing_keys_data() -> dict:
    # create without signatures initially
    cross_signing_keys_data = {
        "master_keys": {
-            TEST_USER_ID: {
+             user_data["TEST_USER_ID"]: {
                "keys": {
                    f"ed25519:{b64_master_public_key}": b64_master_public_key,
                },
-                "user_id": TEST_USER_ID,
+                "user_id": user_data["TEST_USER_ID"],
                "usage": ["master"],
            }
        },
        "self_signing_keys": {
-            TEST_USER_ID: {
+            user_data["TEST_USER_ID"]: {
                "keys": {
                    f"ed25519:{b64_self_signing_public_key}": b64_self_signing_public_key,
                },
-                "user_id": TEST_USER_ID,
+                "user_id": user_data["TEST_USER_ID"],
                "usage": ["self_signing"],
            },
        },
        "user_signing_keys": {
-            TEST_USER_ID: {
+            user_data["TEST_USER_ID"]: {
                "keys": {
                    f"ed25519:{b64_user_signing_public_key}": b64_user_signing_public_key,
                },
-                "user_id": TEST_USER_ID,
+                "user_id": user_data["TEST_USER_ID"],
                "usage": ["user_signing"],
            },
        },
    }
    # sign the sub-keys with the master
    for k in ["self_signing_keys", "user_signing_keys"]:
-        to_sign = cross_signing_keys_data[k][TEST_USER_ID]
+        to_sign = cross_signing_keys_data[k][user_data["TEST_USER_ID"]]
        sig = sign_json(to_sign, master_private_key)
        to_sign["signatures"] = {
-            TEST_USER_ID: {f"ed25519:{b64_master_public_key}": sig}
+            user_data["TEST_USER_ID"]: {f"ed25519:{b64_master_public_key}": sig}
        }

    return cross_signing_keys_data
@@ -265,6 +373,282 @@ def sign_json(json_object: dict, private_key: ed25519.Ed25519PrivateKey) -> str:

    return signature_base64

+def build_exported_megolm_key(device_curve_key: x25519.X25519PrivateKey) -> tuple[dict, ed25519.Ed25519PrivateKey]:
+    """
+    Creates an exported megolm room key, as per https://gitlab.matrix.org/matrix-org/olm/blob/master/docs/megolm.md#session-export-format
+    that can be imported via importRoomKeys API.
+    Returns the exported key, the matching privat edKey (needed to encrypt)
+    """
+    index = 0
+    private_key = ed25519.Ed25519PrivateKey.from_private_bytes(randbytes(32))
+    # Just use radom bytes for the ratchet parts
+    ratchet = randbytes(32 * 4)
+    # exported key, start with version byte
+    exported_key = bytearray(b'\x01')
+    exported_key += index.to_bytes(4, 'big')
+    exported_key += ratchet
+    # KPub
+    exported_key += private_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+
+
+    megolm_export = {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "room_id": "!room:id",
+        "sender_key": encode_base64(
+            device_curve_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+        ),
+        "session_id": encode_base64(
+            private_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+        ),
+        "session_key": encode_base64(exported_key),
+        "sender_claimed_keys": {
+            "ed25519": encode_base64(ed25519.Ed25519PrivateKey.from_private_bytes(randbytes(32)).public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)),
+        },
+        "forwarding_curve25519_key_chain": [],
+    }
+
+    return megolm_export, private_key
+
+def symetric_ratchet_step_of_megolm_key(previous: dict , megolm_private_key: ed25519.Ed25519PrivateKey) -> dict:
+
+    """
+    Very simple ratchet step from 0 to 1
+    Used to generate a ratcheted key to test unknown message index.
+    """
+    session_key: str = previous["session_key"]
+
+    # Get the megolm R0 from the export format
+    decoded = base64.b64decode(session_key.encode("ascii"))
+    ri = decoded[5:133]
+
+    ri0 = ri[0:32]
+    ri1 = ri[32:64]
+    ri2 = ri[64:96]
+    ri3 = ri[96:128]
+
+    h = hmac.HMAC(ri3, hashes.SHA256())
+    h.update(b'x\03')
+    ri1_3 = h.finalize()
+
+    index = 1
+    private_key = megolm_private_key
+
+    # exported key, start with version byte
+    exported_key = bytearray(b'\x01')
+    exported_key += index.to_bytes(4, 'big')
+    exported_key += ri0
+    exported_key += ri1
+    exported_key += ri2
+    exported_key += ri1_3
+    # KPub
+    exported_key += private_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+
+
+    megolm_export = {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "room_id": "!room:id",
+        "sender_key": previous["sender_key"],
+        "session_id": previous["session_id"],
+        "session_key": encode_base64(exported_key),
+        "sender_claimed_keys": previous["sender_claimed_keys"],
+        "forwarding_curve25519_key_chain": [],
+    }
+
+    return megolm_export
+
+def encrypt_megolm_key_for_backup(session_data: dict, backup_public_key: x25519.X25519PublicKey) -> dict:
+
+    """
+    Encrypts an exported megolm key for key backup, using the m.megolm_backup.v1.curve25519-aes-sha2 algorithm.
+    """
+    data = encode_canonical_json(session_data)
+
+    # Generate an ephemeral curve25519 key, and perform an ECDH with the ephemeral key
+    # and the backup’s public key to generate a shared secret.
+    # The public half of the ephemeral key, encoded using unpadded base64,
+    # becomes the ephemeral property of the session_data.
+    ephemeral_keypair = x25519.X25519PrivateKey.from_private_bytes(randbytes(32))
+    shared_secret = ephemeral_keypair.exchange(backup_public_key)
+    ephemeral = encode_base64(ephemeral_keypair.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw))
+
+    # Using the shared secret, generate 80 bytes by performing an HKDF using SHA-256 as the hash,
+    # with a salt of 32 bytes of 0, and with the empty string as the info.
+    # The first 32 bytes are used as the AES key, the next 32 bytes are used as the MAC key,
+    #  and the last 16 bytes are used as the AES initialization vector.
+    salt = bytes(32)
+    info = b""
+
+    hkdf = HKDF(
+        algorithm=hashes.SHA256(),
+        length=80,
+        salt=salt,
+        info=info,
+    )
+
+    raw_key = hkdf.derive(shared_secret)
+    aes_key = raw_key[:32]
+    mac = raw_key[32:64]
+    iv = raw_key[64:80]
+
+    # Stringify the JSON object, and encrypt it using AES-CBC-256 with PKCS#7 padding.
+    # This encrypted data, encoded using unpadded base64, becomes the ciphertext property of the session_data.
+    cipher = Cipher(algorithms.AES(aes_key), modes.CBC(iv))
+    encryptor = cipher.encryptor()
+    padder = padding.PKCS7(128).padder()
+    padded_data = padder.update(data) + padder.finalize()
+    ct = encryptor.update(padded_data) + encryptor.finalize()
+    cipher_text = encode_base64(ct)
+
+    # Pass the raw encrypted data (prior to base64 encoding) through HMAC-SHA-256 using the MAC key generated above.
+    # The first 8 bytes of the resulting MAC are base64-encoded, and become the mac property of the session_data.
+    h = hmac.HMAC(mac, hashes.SHA256())
+    # h.update(ct)
+    signature = h.finalize()
+    mac = encode_base64(signature[:8])
+
+    encrypted_key = {
+        "first_message_index": 1,
+        "forwarded_count": 0,
+        "is_verified": False,
+        "session_data": {
+            "ciphertext": cipher_text,
+            "ephemeral": ephemeral,
+            "mac": mac
+        }
+
+    }
+
+    return encrypted_key
+
+def generate_encrypted_event_content(exported_key: dict, ed_key: ed25519.Ed25519PrivateKey, curve_key: x25519.X25519PrivateKey) -> tuple[dict, dict]:
+    """
+        Encrypts an event using the given key in session export format.
+        Will not do any ratcheting, just encrypt at index 0.
+    """
+
+    clear_event = {
+        "type": "m.room.message",
+        "room_id": "!room:id",
+        "sender": "@alice:localhost",
+        "content": {
+            "msgtype": "m.text",
+            "body": "Hello world"
+        }
+    }
+
+    session_key: str = exported_key["session_key"]
+
+    # Get the megolm R0 from the export format
+    decoded = base64.b64decode(session_key.encode("ascii"))
+    r0 = decoded[5:133]
+
+    hkdf = HKDF(
+        algorithm=hashes.SHA256(),
+        length=80,
+        salt=bytes(32),
+        info=b"MEGOLM_KEYS",
+    )
+
+    raw_key = hkdf.derive(r0)
+    aes_key = raw_key[:32]
+    mac = raw_key[32:64]
+    aes_iv = raw_key[64:80]
+
+    payload_json = {
+        "room_id": clear_event["room_id"],
+        "type": clear_event["type"],
+        "content": clear_event["content"]
+    }
+
+    payload_string = encode_canonical_json(payload_json)
+
+    cipher = Cipher(algorithms.AES(aes_key), modes.CBC(aes_iv))
+    encryptor = cipher.encryptor()
+    padder = padding.PKCS7(128).padder()
+
+    padded_data = padder.update(payload_string)
+    padded_data += padder.finalize()
+
+    ct = encryptor.update(padded_data) + encryptor.finalize()
+
+    # The ratchet index i, and the cipher-text, are then packed
+    # into a message as described in Message format. Then the entire message
+    # (including the version bytes and all payload bytes) are passed through
+    # HMAC-SHA-256. The first 8 bytes of the MAC are appended to the message.
+    message = bytearray()
+    message += b'\x03'
+    # int tag for index
+    message += b'\x08'
+    # index is 0
+    message += b'\x00'
+    message += b'\x12'
+    # probably works only for short messages
+    message += len(ct).to_bytes(1, 'big')
+    # encrypted data
+    message += ct
+
+    h = hmac.HMAC(mac, hashes.SHA256())
+    h.update(message)
+    signature = h.finalize()
+    mac = signature[:8]
+
+    message += mac
+
+    # Finally, the authenticated message is signed using the Ed25519 keypair;
+    # the 64 byte signature is appended to the message
+    signature = ed_key.sign(bytes(message))
+
+    message += signature
+
+    cipher_text = encode_base64(message)
+
+    encrypted_payload = {
+        "algorithm" : "m.megolm.v1.aes-sha2",
+        "sender_key" : encode_base64(curve_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)),
+        "ciphertext" : cipher_text,
+        "session_id" : exported_key["session_id"],
+        "device_id" : "TEST_DEVICE"
+    }
+
+    encrypted_event = {
+        "type": "m.room.encrypted",
+        "room_id": "!room:id",
+        "sender": "@alice:localhost",
+        "content": encrypted_payload,
+        "event_id": "$event1",
+        "origin_server_ts": 1507753886000,
+    }
+
+    return clear_event, encrypted_event
+
+
+def export_recovery_key(key_b64: str) -> str:
+    """
+        Export a private recovery key as a recovery key that can be presented to users.
+        As per spec https://spec.matrix.org/v1.8/client-server-api/#recovery-key
+    """
+    private_key_bytes = base64.b64decode(key_b64)
+
+    # The 256-bit curve25519 private key is prepended by the bytes 0x8B and 0x01
+    export_bytes = bytearray()
+    export_bytes += b'\x8b'
+    export_bytes += b'\x01'
+
+    export_bytes += private_key_bytes
+
+    # All the bytes in the string above, including the two header bytes,
+    # are XORed together to form a parity byte. This parity byte is appended to the byte string.
+    parity_byte = 0 #b'\x8b' ^ b'\x01'
+    [parity_byte := parity_byte ^ x for x in export_bytes]
+
+    export_bytes += parity_byte.to_bytes(1, 'big')
+
+    # The byte string is encoded using base58
+    recovery_key = base58.b58encode(export_bytes).decode('utf-8')
+
+    split = [recovery_key[i:i + 4] for i in range(0, len(recovery_key), 4)]
+    return ' '.join(split)
+

 if __name__ == "__main__":
    main()
@@ -3,12 +3,14 @@
 * Do not edit by hand! This file is generated by `./generate-test-data.py`
 */

-import { IDeviceKeys } from "../../../src/@types/crypto";
-import { IDownloadKeyResult } from "../../../src";
-import { KeyBackupInfo } from "../../../src/crypto-api";
+import { IDeviceKeys, IMegolmSessionData } from "../../../src/@types/crypto";
+import { IDownloadKeyResult, IEvent } from "../../../src";
+import { KeyBackupSession, KeyBackupInfo } from "../../../src/crypto-api/keybackup";

 /* eslint-disable comma-dangle */

+// Alice data
+
 export const TEST_USER_ID = "@alice:localhost";
 export const TEST_DEVICE_ID = "test_device";
 export const TEST_ROOM_ID = "!room:id";
@@ -100,9 +102,28 @@ export const SIGNED_CROSS_SIGNING_KEYS_DATA: Partial<IDownloadKeyResult> = {
    }
 };

+/** Signed OTKs, returned by `POST /keys/claim` */
+export const ONE_TIME_KEYS = {
+    "@alice:localhost": {
+        "test_device": {
+            "signed_curve25519:AAAAHQ": {
+                "key": "j3fR3HemM16M7CWhoI4Sk5ZsdmdfQHsKL1xuSft6MSw",
+                "signatures": {
+                    "@alice:localhost": {
+                        "ed25519:test_device": "25djC6Rk6gIgFBMVawY9X9LnY8XMMziey6lKqL8Q5Bbp7T1vw9uk0RE7eKO2a/jNLcYroO2xRztGhBrKz5sOCQ"
+                    }
+                }
+            }
+        }
+    }
+};
+
 /** base64-encoded backup decryption (private) key */
 export const BACKUP_DECRYPTION_KEY_BASE64 = "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo=";

+/** Backup decryption key in export format */
+export const BACKUP_DECRYPTION_KEY_BASE58 = "EsTc LW2K PGiF wKEA 3As5 g5c4 BXwk qeeJ ZJV8 Q9fu gUMN UE4d";
+
 /** Signed backup data, suitable for return from `GET /_matrix/client/v3/room_keys/keys/{roomId}/{sessionId}` */
 export const SIGNED_BACKUP_DATA: KeyBackupInfo = {
    "algorithm": "m.megolm_backup.v1.curve25519-aes-sha2",
@@ -116,3 +137,315 @@ export const SIGNED_BACKUP_DATA: KeyBackupInfo = {
        }
    }
 };
+
+/** A set of megolm keys that can be imported via CryptoAPI#importRoomKeys */
+export const MEGOLM_SESSION_DATA_ARRAY: IMegolmSessionData[] = [
+    {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "room_id": "!room:id",
+        "sender_key": "WimPd2udAU/1S/+YBpPbmr9L+0H5H+BnAVHSwDxlPGc",
+        "session_id": "FYOoKQSwe4d9jhTZ/LQCZFJINjPEqZ7Or4Z08reP92M",
+        "session_key": "AQAAAABZ0jXQOprFfXe41tIFmAtHxflJp4O2hM/vzQQpOazOCFeWSoW5P3Z9Q+voU3eXehMwyP8/hm/Q8xLP6/PmJdy+71se/17kdFwcDGgLxBWfa4ODM9zlI4EjKbNqmiii5loJ7rBhA/XXaw80m0hfU6zTDX/KrO55J0Pt4vJ0LDa3LBWDqCkEsHuHfY4U2fy0AmRSSDYzxKmezq+GdPK3j/dj",
+        "sender_claimed_keys": {
+            "ed25519": "QdgHgdpDgihgovpPzUiThXur1fbErTFh7paFvNKSgN0"
+        },
+        "forwarding_curve25519_key_chain": []
+    },
+    {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "room_id": "!room:id",
+        "sender_key": "WimPd2udAU/1S/+YBpPbmr9L+0H5H+BnAVHSwDxlPGc",
+        "session_id": "mPYSGA2l1tOQiipEDEVYhDSdTSFh2lDW1qpGKYZRxTc",
+        "session_key": "AQAAAAAHwgkB49BTPAEGTCK6degxUIbl8GPG2ugPRYhNtOpNic63u11+baXFfjDw5fmVfD1gJXpQQjGsqrIYioxrB1xzl7mfb942UHhYdaMQZowpp1fSpJVsxR5TddUU2EWifYD9EQsoz8mY1zqoazm4vUP4v9yxaTcUBj2c6HMJCY0gCJj2EhgNpdbTkIoqRAxFWIQ0nU0hYdpQ1taqRimGUcU3",
+        "sender_claimed_keys": {
+            "ed25519": "IrkbT6H+0urDf6wKDSyVC1fh1t84Vz6T62snni86Cog"
+        },
+        "forwarding_curve25519_key_chain": []
+    }
+];
+
+/** An exported megolm session */
+export const MEGOLM_SESSION_DATA: IMegolmSessionData = {
+    "algorithm": "m.megolm.v1.aes-sha2",
+    "room_id": "!room:id",
+    "sender_key": "WimPd2udAU/1S/+YBpPbmr9L+0H5H+BnAVHSwDxlPGc",
+    "session_id": "ipdI6Zs/7DzFTEhiA2iGaMDfHkIYCleqXT6L+5e1/co",
+    "session_key": "AQAAAABXGO+Z9jlQJhIL6ByhXrv2BwCIxkhh7MXpKLsYmXkJcWrQlirmXmD79ga1zo+I4DCtEZzyGSpDWXBC6G7ez3H4gDMBam1RE3Jm5tc+oTlIri32UkYgSL0kBkcEnttqmIXBlK8tAfJo3cJnlh7F4ltEOAqrdME6dU0zXTkqXmURqYqXSOmbP+w8xUxIYgNohmjA3x5CGApXql0+i/uXtf3K",
+    "sender_claimed_keys": {
+        "ed25519": "Bhbpt6hqMZlSH4sJV7xiEEEiPVeTWz4Vkujl1EMdIPI"
+    },
+    "forwarding_curve25519_key_chain": []
+};
+
+/** A ratcheted version of MEGOLM_SESSION_DATA */
+export const RATCHTED_MEGOLM_SESSION_DATA: IMegolmSessionData = {
+    "algorithm": "m.megolm.v1.aes-sha2",
+    "room_id": "!room:id",
+    "sender_key": "WimPd2udAU/1S/+YBpPbmr9L+0H5H+BnAVHSwDxlPGc",
+    "session_id": "ipdI6Zs/7DzFTEhiA2iGaMDfHkIYCleqXT6L+5e1/co",
+    "session_key": "AQAAAAFXGO+Z9jlQJhIL6ByhXrv2BwCIxkhh7MXpKLsYmXkJcWrQlirmXmD79ga1zo+I4DCtEZzyGSpDWXBC6G7ez3H4gDMBam1RE3Jm5tc+oTlIri32UkYgSL0kBkcEnttqmIUWvpwC7by/yg231+gyzu9lDHAU4ivCj48pt7WGiORWmIqXSOmbP+w8xUxIYgNohmjA3x5CGApXql0+i/uXtf3K",
+    "sender_claimed_keys": {
+        "ed25519": "Bhbpt6hqMZlSH4sJV7xiEEEiPVeTWz4Vkujl1EMdIPI"
+    },
+    "forwarding_curve25519_key_chain": []
+};
+
+/** The key from MEGOLM_SESSION_DATA, encrypted for backup using `m.megolm_backup.v1.curve25519-aes-sha2` algorithm*/
+export const CURVE25519_KEY_BACKUP_DATA: KeyBackupSession = {
+    "first_message_index": 1,
+    "forwarded_count": 0,
+    "is_verified": false,
+    "session_data": {
+        "ciphertext": "r6HRk2/Im2yJe5cLP8R81aVjFWjYWPHpw7TVxphiSK1cdIDZTTK57r6MfU+0i/mTPn+/PosT74OvYwCnehy2d1BPGxhDl8AhPcBu3//Kzlq2o5CssPsw+88gRehkAsPg9Zp5G9sL9to6giltvTWTbsaQpmvv3HLmBOYSFIxvyZrOT/Ffqu325f0IEsKcyV2BdIkw8Ob9Xt+VWoe4MYEGG6y1T8W125zeFgKWI4Ow76uput64H9zZjIo+Cc+hCTO9Ea4EnosSjizCotevkNck7C/zGgfhBikiohROb6SbaZgxicSsEDZ+f7brnri9yP3iXS3PMDHHpa1+XzG2VOG/Y9OQZpkPq+pbLrCC+NWJeJPslDAK5i+RURwzjnPmaHKCRHTq86CwhFyiCDf61MGwCY3xjrmBJg44BCdxWqCx0YJvwsvVqqnl4vTieUfrwThNPsQ81aVkDHvlmrgrTt8icDa8jTJhu34jem+pbRSEM5aJikV4B+zYiLz+dH/v6UpYA2eG8ReOvwpPXp6CAcIlplRPpWbMBeLFVcPkT4KAXTp9exFpB4on4pf8OsaDomlt4qAA0rhAZmhPWPKcU/A0Tz4gyMu54OivVtw1SPj+5Iq+YDQ8jB6Po3ApzMf6fwF9x/FjevbboFB05X2Jr0NrbFqXMOUwXHMgDAGiIWX8+gkmmbaiNWqg2etjN94pobQSGZelb18XGN7kuwMk+Zwk7A",
+        "ephemeral": "q+P1WdRtEiPIEtNuuGrRcueZxUbLnSKdsuTAkxewXgU",
+        "mac": "OibmACbORhI"
+    }
+};
+
+/** A test clear event */
+export const CLEAR_EVENT: Partial<IEvent> = {
+    "type": "m.room.message",
+    "room_id": "!room:id",
+    "sender": "@alice:localhost",
+    "content": {
+        "msgtype": "m.text",
+        "body": "Hello world"
+    }
+};
+
+/** The encrypted CLEAR_EVENT by MEGOLM_SESSION_DATA */
+export const ENCRYPTED_EVENT: Partial<IEvent> = {
+    "type": "m.room.encrypted",
+    "room_id": "!room:id",
+    "sender": "@alice:localhost",
+    "content": {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "sender_key": "WimPd2udAU/1S/+YBpPbmr9L+0H5H+BnAVHSwDxlPGc",
+        "ciphertext": "AwgAEnAkBmciEAyhh1j6DCk29UXJ7kv/kvayUNfuNT0iAioLxcXjFXOZ5ho3jF1/wrytlt0Lb298uMM67OxdVMi+/mMfYpwlvi07P9cIH6CMSj8tyhYoWl0SrKY6tkPf5GWOlRSRRKbziXa96FHXvnA3V2FCAIGtAe3G4ei5RPbhkmKAFBLAen33/D6MjJVqU8Ojr5vTkgls5eyirarlVpsmnH06alDaxO8avrU0NL+Vsw26xvlUQgEMOnUJ",
+        "session_id": "ipdI6Zs/7DzFTEhiA2iGaMDfHkIYCleqXT6L+5e1/co",
+        "device_id": "TEST_DEVICE"
+    },
+    "event_id": "$event1",
+    "origin_server_ts": 1507753886000
+};
+
+// Bob data
+
+export const BOB_TEST_USER_ID = "@bob:xyz";
+export const BOB_TEST_DEVICE_ID = "bob_device";
+export const BOB_TEST_ROOM_ID = "!room:id";
+
+/** The base64-encoded public ed25519 key for this device */
+export const BOB_TEST_DEVICE_PUBLIC_ED25519_KEY_BASE64 = "jmY0h8QS6Te6gxyjOmMc0eKOqmbAtXpVo4CCWFubk50";
+
+/** Signed device data, suitable for returning from a `/keys/query` call */
+export const BOB_SIGNED_TEST_DEVICE_DATA: IDeviceKeys = {
+    "algorithms": [
+        "m.olm.v1.curve25519-aes-sha2",
+        "m.megolm.v1.aes-sha2"
+    ],
+    "device_id": "bob_device",
+    "keys": {
+        "curve25519:bob_device": "F4uCNNlcbRvc7CfBz95ZGWBvY1ALniG1J8+6rhVoKS0",
+        "ed25519:bob_device": "jmY0h8QS6Te6gxyjOmMc0eKOqmbAtXpVo4CCWFubk50"
+    },
+    "user_id": "@bob:xyz",
+    "signatures": {
+        "@bob:xyz": {
+            "ed25519:bob_device": "4ApBs9jaeGyfdYaWRUdBvQAkDyXjACJ9KJ0xLHMgiFT/1yo6VqPTx2iziKGnrBiGhbtKNxEhDPOvZZkBU73cDQ"
+        }
+    }
+};
+
+/** base64-encoded public master cross-signing key */
+export const BOB_MASTER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "KKVOHOB2LsW7hFJwqyzXpA+vp7u5+gaMWUJvBS7mjuA";
+
+/** base64-encoded private master cross-signing key */
+export const BOB_MASTER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "RG95b3VzcGVha3doYWFhYWFhYWFhYWFhYWFhYWFhbGU";
+
+/** base64-encoded public self cross-signing key */
+export const BOB_SELF_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "DaScI3WulBvDjf/d2vdyP5Cgjdypn1c/PSDX23MgN+A";
+
+/** base64-encoded private self signing cross-signing key */
+export const BOB_SELF_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "U2VsZnNlbGZzZWxmc2VsZnNlbGZzZWxmc2VsZnNlbGY";
+
+/** base64-encoded public user cross-signing key */
+export const BOB_USER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "lXP89FP6zvFH9TSbU1S8uSdAsVawm1NmV6z+Rfr3lEw";
+
+/** base64-encoded private user signing cross-signing key */
+export const BOB_USER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "VXNlcnVzZXJ1c2VydXNlcnVzZXJ1c2VydXNlcnVzZXI";
+
+/** Signed cross-signing keys data, also suitable for returning from a `/keys/query` call */
+export const BOB_SIGNED_CROSS_SIGNING_KEYS_DATA: Partial<IDownloadKeyResult> = {
+    "master_keys": {
+        "@bob:xyz": {
+            "keys": {
+                "ed25519:KKVOHOB2LsW7hFJwqyzXpA+vp7u5+gaMWUJvBS7mjuA": "KKVOHOB2LsW7hFJwqyzXpA+vp7u5+gaMWUJvBS7mjuA"
+            },
+            "user_id": "@bob:xyz",
+            "usage": [
+                "master"
+            ]
+        }
+    },
+    "self_signing_keys": {
+        "@bob:xyz": {
+            "keys": {
+                "ed25519:DaScI3WulBvDjf/d2vdyP5Cgjdypn1c/PSDX23MgN+A": "DaScI3WulBvDjf/d2vdyP5Cgjdypn1c/PSDX23MgN+A"
+            },
+            "user_id": "@bob:xyz",
+            "usage": [
+                "self_signing"
+            ],
+            "signatures": {
+                "@bob:xyz": {
+                    "ed25519:KKVOHOB2LsW7hFJwqyzXpA+vp7u5+gaMWUJvBS7mjuA": "RxM8iJU6ZkyzQSVtNnXIJMPyEahVsN+fQQTBNKAs+kqySFyXBgchx+8czZaAhJCpXh9gD1nskT4yyFd2eyUXBw"
+                }
+            }
+        }
+    },
+    "user_signing_keys": {
+        "@bob:xyz": {
+            "keys": {
+                "ed25519:lXP89FP6zvFH9TSbU1S8uSdAsVawm1NmV6z+Rfr3lEw": "lXP89FP6zvFH9TSbU1S8uSdAsVawm1NmV6z+Rfr3lEw"
+            },
+            "user_id": "@bob:xyz",
+            "usage": [
+                "user_signing"
+            ],
+            "signatures": {
+                "@bob:xyz": {
+                    "ed25519:KKVOHOB2LsW7hFJwqyzXpA+vp7u5+gaMWUJvBS7mjuA": "jF8fvnPZulrPyh/4E8dNDVBP3iHHl9bRc+rRArVyGzoom+uVrokOck7BN2YmPyCRFZJJx7fgRA1Bveyu+mTVAg"
+                }
+            }
+        }
+    }
+};
+
+/** Signed OTKs, returned by `POST /keys/claim` */
+export const BOB_ONE_TIME_KEYS = {
+    "@bob:xyz": {
+        "bob_device": {
+            "signed_curve25519:AAAAHQ": {
+                "key": "j3fR3HemM16M7CWhoI4Sk5ZsdmdfQHsKL1xuSft6MSw",
+                "signatures": {
+                    "@bob:xyz": {
+                        "ed25519:bob_device": "dlZc9VA/hP980Mxvu9qwi0qJx8VK7sADGOM48CE01YM7K/Mbty9lis/QjtQAWqDg371QyynVRjEzt9qj7eSFCg"
+                    }
+                }
+            }
+        }
+    }
+};
+
+/** base64-encoded backup decryption (private) key */
+export const BOB_BACKUP_DECRYPTION_KEY_BASE64 = "DwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo=";
+
+/** Backup decryption key in export format */
+export const BOB_BACKUP_DECRYPTION_KEY_BASE58 = "EsT5 Sd5m mEXs NQYE ibRe 3q9E 4aXW rHih 5f9J 6rU6 AfwY mASR";
+
+/** Signed backup data, suitable for return from `GET /_matrix/client/v3/room_keys/keys/{roomId}/{sessionId}` */
+export const BOB_SIGNED_BACKUP_DATA: KeyBackupInfo = {
+    "algorithm": "m.megolm_backup.v1.curve25519-aes-sha2",
+    "version": "1",
+    "auth_data": {
+        "public_key": "ZRuVWcWlDuvOwZRygccUCD4Avtnt130800I+WQNwwRY",
+        "signatures": {
+            "@bob:xyz": {
+                "ed25519:bob_device": "lDIMj3VC0WazE2FamGHpmbiqKf9Z4pO4qapZ5TL5BnD3c+dvb+2waOEd6pgay/pmrQ6MW4Eu2KDEpe1fnHc3BA"
+            }
+        }
+    }
+};
+
+/** A set of megolm keys that can be imported via CryptoAPI#importRoomKeys */
+export const BOB_MEGOLM_SESSION_DATA_ARRAY: IMegolmSessionData[] = [
+    {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "room_id": "!room:id",
+        "sender_key": "FOvlmz18LLI3k/llCpqRoKT90+gFF8YhuL+v1YBXHlw",
+        "session_id": "/2K+V777vipCxPZ0gpY9qcpz1DYaXwuMRIu0UEP0Wa0",
+        "session_key": "AQAAAAAclzWVMeWBKH+B/WMowa3rb4ma3jEl6n5W4GCs9ue65CruzD3ihX+85pZ9hsV9Bf6fvhjp76WNRajoJYX0UIt7aosjmu0i+H+07hEQ0zqTKpVoSH0ykJ6stAMhdr6Q4uW5crBmdTTBIsqmoWsNJZKKoE2+ldYrZ1lrFeaJbjBIY/9ivle++74qQsT2dIKWPanKc9Q2Gl8LjESLtFBD9Fmt",
+        "sender_claimed_keys": {
+            "ed25519": "F4P7f1Z0RjbiZMgHk1xBCG3KC4/Ng9PmxLJ4hQ13sHA"
+        },
+        "forwarding_curve25519_key_chain": []
+    },
+    {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "room_id": "!room:id",
+        "sender_key": "FOvlmz18LLI3k/llCpqRoKT90+gFF8YhuL+v1YBXHlw",
+        "session_id": "+07YOpSgdZ1X9le3n3NMByw0V1B0H0Djnbm76jgmWoo",
+        "session_key": "AQAAAAAjWfIMo9+BWS8IvhfsQuomxXXXGy11tJs0ej505xxd1RzOIP4ftq3MbZYsfH8kqSMBc2l1Ym2u3Dksv2/nR0zGQeNIgOxeMuwHU3Ry7+DdV1I96blPylVCCn/f5RAy6smKoaeylptPdXgVXmw3YBBUVYpHpm+xCIUUp9foAdb8hftO2DqUoHWdV/ZXt59zTAcsNFdQdB9A4525u+o4JlqK",
+        "sender_claimed_keys": {
+            "ed25519": "OsZMdC1gQ5nPr+L9tuT6xXsaFJkVPkgxP2FexHF1/QM"
+        },
+        "forwarding_curve25519_key_chain": []
+    }
+];
+
+/** An exported megolm session */
+export const BOB_MEGOLM_SESSION_DATA: IMegolmSessionData = {
+    "algorithm": "m.megolm.v1.aes-sha2",
+    "room_id": "!room:id",
+    "sender_key": "FOvlmz18LLI3k/llCpqRoKT90+gFF8YhuL+v1YBXHlw",
+    "session_id": "gywydBrIJcJWktC/ic3tunKZM1XZm1MpYiYtdbj8Rpc",
+    "session_key": "AQAAAADZJL7OdM/KHfPzXPZ3CtlLBIlzbwk06dnZTd3bvkcdP5u73rdmThBKdqGA4xzCyxZsHdYLZRrlmD3VwOmNfvWMqYdPxA1X0vs3d172y9EIG8i+N/skJxTRypcVSV9XoinBNIWr/gkyepuAKiQqemlc8J5amD9OkmbVkmnrxP1uyYMsMnQayCXCVpLQv4nN7bpymTNV2ZtTKWImLXW4/EaX",
+    "sender_claimed_keys": {
+        "ed25519": "zBdpQwWYyz1MkZuEUhXqcdMfUNN/B9psLFDDDTJOg64"
+    },
+    "forwarding_curve25519_key_chain": []
+};
+
+/** A ratcheted version of BOB_MEGOLM_SESSION_DATA */
+export const BOB_RATCHTED_MEGOLM_SESSION_DATA: IMegolmSessionData = {
+    "algorithm": "m.megolm.v1.aes-sha2",
+    "room_id": "!room:id",
+    "sender_key": "FOvlmz18LLI3k/llCpqRoKT90+gFF8YhuL+v1YBXHlw",
+    "session_id": "gywydBrIJcJWktC/ic3tunKZM1XZm1MpYiYtdbj8Rpc",
+    "session_key": "AQAAAAHZJL7OdM/KHfPzXPZ3CtlLBIlzbwk06dnZTd3bvkcdP5u73rdmThBKdqGA4xzCyxZsHdYLZRrlmD3VwOmNfvWMqYdPxA1X0vs3d172y9EIG8i+N/skJxTRypcVSV9Xoil2JdGx9oPqR0dFVh661Aqs86rJRbQ4IeRiuEm35VMxboMsMnQayCXCVpLQv4nN7bpymTNV2ZtTKWImLXW4/EaX",
+    "sender_claimed_keys": {
+        "ed25519": "zBdpQwWYyz1MkZuEUhXqcdMfUNN/B9psLFDDDTJOg64"
+    },
+    "forwarding_curve25519_key_chain": []
+};
+
+/** The key from BOB_MEGOLM_SESSION_DATA, encrypted for backup using `m.megolm_backup.v1.curve25519-aes-sha2` algorithm*/
+export const BOB_CURVE25519_KEY_BACKUP_DATA: KeyBackupSession = {
+    "first_message_index": 1,
+    "forwarded_count": 0,
+    "is_verified": false,
+    "session_data": {
+        "ciphertext": "d7UVOK17WEVky/8hK0h3HsTQrFMEbKbfqMcl2KtyTWcI9S5gGFWK9Git5BzVRxRggvxQ0c8PDfqL+dr3zHytAMW+71BJqIPQW910vV7SX3IcGylnoUcS3doVkJZiprXytXMP89AKcgv5Dj7mS2ZdvNGE+Atro74bzZ5yot5BrE0ZE5SjoUBPLaLMMu9HopLIV+qx01Rc3F0wmkocSPo51N0nv6wvO5Cst0FiOGHDK6r1pFlgDEJLmBkOyC4e8oMVbKTJzsSQVbJ8tJ37xuhI+T5P0ZlmiqKDqYRp8uh50w+txLEixYhEUunFgCTt1DAmiS9pLNYhLyl1ggwuQjzZe+AV6timbRxNJy18/AEcPomJw7z/pxYIiNLHRKOC13Wp8kGWx9cOgfMQ5KmBuLS8psGiLTBkfWPLOfNYqjbeqAR+OGZQoS6hUjbBYU7QuFa4FOYBHkNB2UqNsdsMb9qB/qs7QGTSb8Lok5YjW1c81BUpmIyKvuqnKma0MZskrpTYGQD2eJDABFCZwLFm+LgDyUTeSiV5xguYztLrHOk8LHKo9M8dIZgoBjeFVJxyjbcXKsVS3aQkMXKCrRlKLqhZTws/ZJwVfW9DbktZ9dT+tRZQvI7tjJofojcLX61AGJDnqUf5+2Gv1tEnmUI953gIzc8NlcFabPOsDsZEODt7MdOCTPT3w29umyhKbCsslpb64LoS/AB2QRPRCgkJS7snRA",
+        "ephemeral": "oO0VX84OUIzm2i/12zAhTWOZT5IFRH5mXaKZ8fXkCgU",
+        "mac": "lEfHlqfJQwU"
+    }
+};
+
+/** A test clear event */
+export const BOB_CLEAR_EVENT: Partial<IEvent> = {
+    "type": "m.room.message",
+    "room_id": "!room:id",
+    "sender": "@alice:localhost",
+    "content": {
+        "msgtype": "m.text",
+        "body": "Hello world"
+    }
+};
+
+/** The encrypted CLEAR_EVENT by MEGOLM_SESSION_DATA */
+export const BOB_ENCRYPTED_EVENT: Partial<IEvent> = {
+    "type": "m.room.encrypted",
+    "room_id": "!room:id",
+    "sender": "@alice:localhost",
+    "content": {
+        "algorithm": "m.megolm.v1.aes-sha2",
+        "sender_key": "FOvlmz18LLI3k/llCpqRoKT90+gFF8YhuL+v1YBXHlw",
+        "ciphertext": "AwgAEnA/mEqZm2lSrhoG11OpDqsohGSBJWsudbuoItLlivmpFZQHrKMbE6z/dhCTwUi76vwfRCtf4tyPMD845cqZH1nL0bowq3/awyzZ8Q263Y3WrLfkUTFBU6oPF/IULUFZZuw6kLdfd5g5+uigvqUhFFpICoj7KNHznv4sFNssd00/WgJquZ6PRt6e1v6ANFNiZPAwghIL+kBc6pb8i6MUWt9JnXilJhTqFDHdXiY4qkaKBWbwebC26PYM",
+        "session_id": "gywydBrIJcJWktC/ic3tunKZM1XZm1MpYiYtdbj8Rpc",
+        "device_id": "TEST_DEVICE"
+    },
+    "event_id": "$event1",
+    "origin_server_ts": 1507753886000
+};
+
@@ -99,6 +99,7 @@ export function getSyncResponse(roomMembers: string[], roomId = TEST_ROOM_ID): I
            join: { [roomId]: roomResponse },
            invite: {},
            leave: {},
+            knock: {},
        },
        account_data: { events: [] },
    };
@@ -520,10 +521,19 @@ export async function awaitDecryption(
    }

    return new Promise((resolve) => {
-        event.once(MatrixEventEvent.Decrypted, (ev, err) => {
-            logger.log(`${Date.now()}: MatrixEventEvent.Decrypted for event ${event.getId()}: ${err ?? "success"}`);
-            resolve(ev);
-        });
+        if (waitOnDecryptionFailure) {
+            event.on(MatrixEventEvent.Decrypted, (ev, err) => {
+                logger.log(`${Date.now()}: MatrixEventEvent.Decrypted for event ${event.getId()}: ${err ?? "success"}`);
+                if (!err) {
+                    resolve(ev);
+                }
+            });
+        } else {
+            event.once(MatrixEventEvent.Decrypted, (ev, err) => {
+                logger.log(`${Date.now()}: MatrixEventEvent.Decrypted for event ${event.getId()}: ${err ?? "success"}`);
+                resolve(ev);
+            });
+        }
    });
 }

@@ -485,6 +485,7 @@ export class MockCallMatrixClient extends TypedEventEmitter<EmittedEvents, Emitt

    public getRooms = jest.fn<Room[], []>().mockReturnValue([]);
    public getRoom = jest.fn();
+    public getFoci = jest.fn();

    public supportsThreads(): boolean {
        return true;
@@ -18,7 +18,7 @@ limitations under the License.
 import fetchMock from "fetch-mock-jest";
 import MockHttpBackend from "matrix-mock-request";

-import { M_AUTHENTICATION } from "../../src";
+import { AutoDiscoveryAction, M_AUTHENTICATION } from "../../src";
 import { AutoDiscovery } from "../../src/autodiscovery";
 import { OidcError } from "../../src/oidc/error";
 import { makeDelegatedAuthConfig } from "../test-utils/oidc";
@@ -351,7 +351,7 @@ describe("AutoDiscovery", function () {
        function () {
            const httpBackend = getHttpBackend();
            httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-                not_matrix_versions: ["r0.0.1"],
+                not_matrix_versions: ["v1.1"],
            });
            httpBackend.when("GET", "/.well-known/matrix/client").respond(200, {
                "m.homeserver": {
@@ -388,7 +388,7 @@ describe("AutoDiscovery", function () {
                expect(req.path).toEqual("https://example.org/_matrix/client/versions");
            })
            .respond(200, {
-                versions: ["r0.0.1"],
+                versions: ["v1.1"],
            });
        httpBackend.when("GET", "/.well-known/matrix/client").respond(200, {
            "m.homeserver": {
@@ -428,7 +428,7 @@ describe("AutoDiscovery", function () {
                expect(req.path).toEqual("https://chat.example.org/_matrix/client/versions");
            })
            .respond(200, {
-                versions: ["r0.0.1"],
+                versions: ["v1.1"],
            });
        httpBackend.when("GET", "/.well-known/matrix/client").respond(200, {
            "m.homeserver": {
@@ -469,7 +469,7 @@ describe("AutoDiscovery", function () {
                expect(req.path).toEqual("https://chat.example.org/_matrix/client/versions");
            })
            .respond(200, {
-                versions: ["r0.0.1"],
+                versions: ["v1.1"],
            });
        httpBackend.when("GET", "/.well-known/matrix/client").respond(200, {
            "m.homeserver": {
@@ -515,7 +515,7 @@ describe("AutoDiscovery", function () {
                    expect(req.path).toEqual("https://chat.example.org/_matrix/client/versions");
                })
                .respond(200, {
-                    versions: ["r0.0.1"],
+                    versions: ["v1.1"],
                });
            httpBackend.when("GET", "/.well-known/matrix/client").respond(200, {
                "m.homeserver": {
@@ -560,7 +560,7 @@ describe("AutoDiscovery", function () {
                    expect(req.path).toEqual("https://chat.example.org/_matrix/client/versions");
                })
                .respond(200, {
-                    versions: ["r0.0.1"],
+                    versions: ["v1.1"],
                });
            httpBackend.when("GET", "/.well-known/matrix/client").respond(200, {
                "m.homeserver": {
@@ -606,7 +606,7 @@ describe("AutoDiscovery", function () {
                    expect(req.path).toEqual("https://chat.example.org/_matrix/client/versions");
                })
                .respond(200, {
-                    versions: ["r0.0.1"],
+                    versions: ["v1.1"],
                });
            httpBackend.when("GET", "/_matrix/identity/v2").respond(404, {});
            httpBackend.when("GET", "/.well-known/matrix/client").respond(200, {
@@ -653,7 +653,7 @@ describe("AutoDiscovery", function () {
                    expect(req.path).toEqual("https://chat.example.org/_matrix/client/versions");
                })
                .respond(200, {
-                    versions: ["r0.0.1"],
+                    versions: ["v1.1"],
                });
            httpBackend.when("GET", "/_matrix/identity/v2").respond(500, {});
            httpBackend.when("GET", "/.well-known/matrix/client").respond(200, {
@@ -697,7 +697,7 @@ describe("AutoDiscovery", function () {
                expect(req.path).toEqual("https://chat.example.org/_matrix/client/versions");
            })
            .respond(200, {
-                versions: ["r0.0.1"],
+                versions: ["v1.1"],
            });
        httpBackend
            .when("GET", "/_matrix/identity/v2")
@@ -747,7 +747,7 @@ describe("AutoDiscovery", function () {
                expect(req.path).toEqual("https://chat.example.org/_matrix/client/versions");
            })
            .respond(200, {
-                versions: ["r0.0.1"],
+                versions: ["v1.1"],
            });
        httpBackend
            .when("GET", "/_matrix/identity/v2")
@@ -867,6 +867,37 @@ describe("AutoDiscovery", function () {
        ]);
    });

+    it("should FAIL_ERROR for unsupported Matrix version", () => {
+        const httpBackend = getHttpBackend();
+        httpBackend.when("GET", "/.well-known/matrix/client").respond(200, {
+            "m.homeserver": {
+                base_url: "https://example.org",
+            },
+        });
+        httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
+            versions: ["r0.6.0"],
+        });
+        return Promise.all([
+            httpBackend.flushAllExpected(),
+            AutoDiscovery.findClientConfig("example.org").then((conf) => {
+                const expected = {
+                    "m.homeserver": {
+                        state: AutoDiscoveryAction.FAIL_ERROR,
+                        error: AutoDiscovery.ERROR_HOMESERVER_TOO_OLD,
+                        base_url: "https://example.org",
+                    },
+                    "m.identity_server": {
+                        state: "PROMPT",
+                        error: null,
+                        base_url: null,
+                    },
+                };
+
+                expect(conf).toEqual(expected);
+            }),
+        ]);
+    });
+
    describe("m.authentication", () => {
        const homeserverName = "example.org";
        const homeserverUrl = "https://chat.example.org/";
@@ -879,7 +910,7 @@ describe("AutoDiscovery", function () {

        beforeEach(() => {
            fetchMock.resetBehavior();
-            fetchMock.get(`${homeserverUrl}_matrix/client/versions`, { versions: ["r0.0.1"] });
+            fetchMock.get(`${homeserverUrl}_matrix/client/versions`, { versions: ["v1.1"] });

            fetchMock.get("https://example.org/.well-known/matrix/client", {
                "m.homeserver": {
@@ -33,7 +33,7 @@ describe("ContentRepo", function () {
        it("should return a download URL if no width/height/resize are specified", function () {
            const mxcUri = "mxc://server.name/resourceid";
            expect(getHttpUriForMxc(baseUrl, mxcUri)).toEqual(
-                baseUrl + "/_matrix/media/r0/download/server.name/resourceid",
+                baseUrl + "/_matrix/media/v3/download/server.name/resourceid",
            );
        });

@@ -44,21 +44,21 @@ describe("ContentRepo", function () {
        it("should return a thumbnail URL if a width/height/resize is specified", function () {
            const mxcUri = "mxc://server.name/resourceid";
            expect(getHttpUriForMxc(baseUrl, mxcUri, 32, 64, "crop")).toEqual(
-                baseUrl + "/_matrix/media/r0/thumbnail/server.name/resourceid" + "?width=32&height=64&method=crop",
+                baseUrl + "/_matrix/media/v3/thumbnail/server.name/resourceid" + "?width=32&height=64&method=crop",
            );
        });

        it("should put fragments from mxc:// URIs after any query parameters", function () {
            const mxcUri = "mxc://server.name/resourceid#automade";
            expect(getHttpUriForMxc(baseUrl, mxcUri, 32)).toEqual(
-                baseUrl + "/_matrix/media/r0/thumbnail/server.name/resourceid" + "?width=32#automade",
+                baseUrl + "/_matrix/media/v3/thumbnail/server.name/resourceid" + "?width=32#automade",
            );
        });

        it("should put fragments from mxc:// URIs at the end of the HTTP URI", function () {
            const mxcUri = "mxc://server.name/resourceid#automade";
            expect(getHttpUriForMxc(baseUrl, mxcUri)).toEqual(
-                baseUrl + "/_matrix/media/r0/download/server.name/resourceid#automade",
+                baseUrl + "/_matrix/media/v3/download/server.name/resourceid#automade",
            );
        });
    });
@@ -15,11 +15,16 @@ import { sleep } from "../../src/utils";
 import { CRYPTO_ENABLED } from "../../src/client";
 import { DeviceInfo } from "../../src/crypto/deviceinfo";
 import { logger } from "../../src/logger";
-import { MemoryStore } from "../../src";
+import { DeviceVerification, MemoryStore } from "../../src";
 import { RoomKeyRequestState } from "../../src/crypto/OutgoingRoomKeyRequestManager";
 import { RoomMember } from "../../src/models/room-member";
 import { IStore } from "../../src/store";
 import { IRoomEncryption, RoomList } from "../../src/crypto/RoomList";
+import { EventShieldColour, EventShieldReason } from "../../src/crypto-api";
+import { UserTrustLevel } from "../../src/crypto/CrossSigning";
+import { CryptoBackend } from "../../src/common-crypto/CryptoBackend";
+import { EventDecryptionResult } from "../../src/common-crypto/CryptoBackend";
+import * as testData from "../test-utils/test-data";

 const Olm = global.Olm;

@@ -111,13 +116,14 @@ describe("Crypto", function () {
    });

    describe("encrypted events", function () {
-        it("provides encryption information", async function () {
+        it("provides encryption information for events from unverified senders", async function () {
            const client = new TestClient("@alice:example.com", "deviceid").client;
            await client.initCrypto();

            // unencrypted event
            const event = {
                getId: () => "$event_id",
+                getSender: () => "@bob:example.com",
                getSenderKey: () => null,
                getWireContent: () => {
                    return {};
@@ -127,6 +133,8 @@ describe("Crypto", function () {
            let encryptionInfo = client.getEventEncryptionInfo(event);
            expect(encryptionInfo.encrypted).toBeFalsy();

+            expect(await client.getCrypto()!.getEncryptionInfoForEvent(event)).toBe(null);
+
            // unknown sender (e.g. deleted device), forwarded megolm key (untrusted)
            event.getSenderKey = () => "YmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmI";
            event.getWireContent = () => {
@@ -141,6 +149,11 @@ describe("Crypto", function () {
            expect(encryptionInfo.authenticated).toBeFalsy();
            expect(encryptionInfo.sender).toBeFalsy();

+            expect(await client.getCrypto()!.getEncryptionInfoForEvent(event)).toEqual({
+                shieldColour: EventShieldColour.GREY,
+                shieldReason: EventShieldReason.AUTHENTICITY_NOT_GUARANTEED,
+            });
+
            // known sender, megolm key from backup
            event.getForwardingCurve25519KeyChain = () => [];
            event.isKeySourceUntrusted = () => true;
@@ -155,6 +168,11 @@ describe("Crypto", function () {
            expect(encryptionInfo.sender).toBeTruthy();
            expect(encryptionInfo.mismatchedSender).toBeFalsy();

+            expect(await client.getCrypto()!.getEncryptionInfoForEvent(event)).toEqual({
+                shieldColour: EventShieldColour.GREY,
+                shieldReason: EventShieldReason.AUTHENTICITY_NOT_GUARANTEED,
+            });
+
            // known sender, trusted megolm key, but bad ed25519key
            event.isKeySourceUntrusted = () => false;
            device.keys["ed25519:FLIBBLE"] = "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
@@ -165,9 +183,115 @@ describe("Crypto", function () {
            expect(encryptionInfo.sender).toBeTruthy();
            expect(encryptionInfo.mismatchedSender).toBeTruthy();

+            expect(await client.getCrypto()!.getEncryptionInfoForEvent(event)).toEqual({
+                shieldColour: EventShieldColour.RED,
+                shieldReason: EventShieldReason.MISMATCHED_SENDER_KEY,
+            });
+
            client.stopClient();
        });

+        describe("provides encryption information for events from verified senders", function () {
+            const testDeviceId = testData.BOB_TEST_DEVICE_ID;
+            const testDevice = testData.BOB_SIGNED_TEST_DEVICE_DATA;
+
+            let client: MatrixClient;
+            beforeEach(async () => {
+                client = new TestClient("@alice:example.com", "deviceid").client;
+                await client.initCrypto();
+
+                // mock out the verification check
+                client.crypto!.checkUserTrust = (userId) => new UserTrustLevel(true, false, false);
+            });
+
+            afterEach(() => {
+                client.stopClient();
+            });
+
+            async function buildEncryptedEvent(
+                decryptionResult: Partial<EventDecryptionResult> = {},
+            ): Promise<MatrixEvent> {
+                const mockCryptoBackend = {
+                    decryptEvent: async (event: MatrixEvent): Promise<EventDecryptionResult> => {
+                        return {
+                            claimedEd25519Key: testDevice.keys["ed25519:" + testDeviceId],
+                            clearEvent: {
+                                room_id: "!room_id",
+                                type: "m.room.message",
+                                content: { body: "test" },
+                            },
+                            forwardingCurve25519KeyChain: [],
+                            senderCurve25519Key: testDevice.keys["curve25519:" + testDeviceId],
+                            ...decryptionResult,
+                        };
+                    },
+                } as unknown as CryptoBackend;
+
+                const event = new MatrixEvent({
+                    event_id: "$event_id",
+                    sender: testData.BOB_TEST_USER_ID,
+                    type: "m.room.encrypted",
+                    content: { algorithm: "m.megolm.v1.aes-sha2" },
+                });
+                await event.attemptDecryption(mockCryptoBackend);
+                return event;
+            }
+
+            it("unknown device", async () => {
+                const event = await buildEncryptedEvent();
+                expect(await client.getCrypto()!.getEncryptionInfoForEvent(event)).toEqual({
+                    shieldColour: EventShieldColour.GREY,
+                    shieldReason: EventShieldReason.UNKNOWN_DEVICE,
+                });
+            });
+
+            it("known but unsigned device", async () => {
+                client.crypto!.deviceList.storeDevicesForUser(testData.BOB_TEST_USER_ID, {
+                    [testDeviceId]: {
+                        keys: testDevice.keys,
+                        algorithms: testDevice.algorithms,
+                        verified: DeviceVerification.Unverified,
+                        known: true,
+                    },
+                });
+
+                const event = await buildEncryptedEvent();
+                expect(await client.getCrypto()!.getEncryptionInfoForEvent(event)).toEqual({
+                    shieldColour: EventShieldColour.RED,
+                    shieldReason: EventShieldReason.UNVERIFIED_IDENTITY,
+                });
+            });
+
+            describe("known and verified device", () => {
+                beforeEach(() => {
+                    client.crypto!.deviceList.storeDevicesForUser(testData.BOB_TEST_USER_ID, {
+                        [testDeviceId]: {
+                            keys: testDevice.keys,
+                            algorithms: testDevice.algorithms,
+                            verified: DeviceVerification.Verified,
+                            known: true,
+                        },
+                    });
+                });
+
+                it("regular key", async () => {
+                    const event = await buildEncryptedEvent();
+                    expect(await client.getCrypto()!.getEncryptionInfoForEvent(event)).toEqual({
+                        shieldColour: EventShieldColour.NONE,
+                        shieldReason: null,
+                    });
+                });
+
+                it("unauthenticated key", async () => {
+                    const event = await buildEncryptedEvent({ untrusted: true });
+                    expect(await client.getCrypto()!.getEncryptionInfoForEvent(event)).toEqual({
+                        shieldColour: EventShieldColour.GREY,
+                        shieldReason: EventShieldReason.AUTHENTICITY_NOT_GUARANTEED,
+                    });
+                });
+            });
+        });
+
        it("doesn't throw an error when attempting to decrypt a redacted event", async () => {
            const client = new TestClient("@alice:example.com", "deviceid").client;
            await client.initCrypto();
@@ -0,0 +1,52 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { TextEncoder, TextDecoder } from "util";
+
+import { decodeBase64, encodeBase64, encodeUnpaddedBase64 } from "../../../src/common-crypto/base64";
+
+describe("Crypto Base64 encoding", () => {
+    it("Should decode properly encoded data", async () => {
+        const toEncode = "encoding hello world";
+        const encoded = encodeBase64(new TextEncoder().encode(toEncode));
+        const decoded = new TextDecoder().decode(decodeBase64(encoded));
+
+        expect(decoded).toStrictEqual(toEncode);
+    });
+
+    it("Encode unpadded should not have padding", async () => {
+        const toEncode = "encoding hello world";
+        const data = new TextEncoder().encode(toEncode);
+
+        const paddedEncoded = encodeBase64(data);
+        const unpaddedEncoded = encodeUnpaddedBase64(data);
+
+        expect(paddedEncoded).not.toEqual(unpaddedEncoded);
+
+        const padding = paddedEncoded.charAt(paddedEncoded.length - 1);
+        expect(padding).toStrictEqual("=");
+    });
+
+    it("Decode should be indifferent to padding", async () => {
+        const withPadding = "ZW5jb2RpbmcgaGVsbG8gd29ybGQ=";
+        const withoutPadding = "ZW5jb2RpbmcgaGVsbG8gd29ybGQ";
+
+        const decodedPad = decodeBase64(withPadding);
+        const decodedNoPad = decodeBase64(withoutPadding);
+
+        expect(decodedPad).toStrictEqual(decodedNoPad);
+    });
+});
@@ -312,6 +312,7 @@ describe("Secrets", function () {
                this.emit(ClientEvent.AccountData, event);
                return {};
            };
+            bob.getKeyBackupVersion = jest.fn().mockResolvedValue(null);

            await bob.bootstrapCrossSigning({
                authUploadDeviceSigningKeys: async (func) => {
@@ -23,7 +23,14 @@ limitations under the License.
 // eslint-disable-next-line no-restricted-imports
 import { EventEmitter } from "events";
 import { MockedObject } from "jest-mock";
-import { WidgetApi, WidgetApiToWidgetAction, MatrixCapabilities, ITurnServer, IRoomEvent } from "matrix-widget-api";
+import {
+    WidgetApi,
+    WidgetApiToWidgetAction,
+    MatrixCapabilities,
+    ITurnServer,
+    IRoomEvent,
+    IOpenIDCredentials,
+} from "matrix-widget-api";

 import { createRoomWidgetClient, MsgType } from "../../src/matrix";
 import { MatrixClient, ClientEvent, ITurnServer as IClientTurnServer } from "../../src/client";
@@ -33,6 +40,12 @@ import { MatrixEvent } from "../../src/models/event";
 import { ToDeviceBatch } from "../../src/models/ToDeviceMessage";
 import { DeviceInfo } from "../../src/crypto/deviceinfo";

+const testOIDCToken = {
+    access_token: "12345678",
+    expires_in: "10",
+    matrix_server_name: "homeserver.oabc",
+    token_type: "Bearer",
+};
 class MockWidgetApi extends EventEmitter {
    public start = jest.fn();
    public requestCapability = jest.fn();
@@ -49,8 +62,15 @@ class MockWidgetApi extends EventEmitter {
    public sendRoomEvent = jest.fn(() => ({ event_id: `$${Math.random()}` }));
    public sendStateEvent = jest.fn();
    public sendToDevice = jest.fn();
+    public requestOpenIDConnectToken = jest.fn(() => {
+        return testOIDCToken;
+        return new Promise<IOpenIDCredentials>(() => {
+            return testOIDCToken;
+        });
+    });
    public readStateEvents = jest.fn(() => []);
    public getTurnServers = jest.fn(() => []);
+    public sendContentLoaded = jest.fn();

    public transport = { reply: jest.fn() };
 }
@@ -285,7 +305,12 @@ describe("RoomWidgetClient", () => {
            expect(await emittedSync).toEqual(SyncState.Syncing);
        });
    });
-
+    describe("oidc token", () => {
+        it("requests an oidc token", async () => {
+            await makeClient({});
+            expect(await client.getOpenIdToken()).toStrictEqual(testOIDCToken);
+        });
+    });
    it("gets TURN servers", async () => {
        const server1: ITurnServer = {
            uris: [
@@ -6,6 +6,6 @@ exports[`MatrixHttpApi should return expected object from \`getContentUri\` 1`]
  "params": {
    "access_token": "token",
  },
-  "path": "/_matrix/media/r0/upload",
+  "path": "/_matrix/media/v3/upload",
 }
 `;
@@ -84,7 +84,7 @@ describe("MatrixHttpApi", () => {
        upload = api.uploadContent({} as File);
        expect(xhr.open).toHaveBeenCalledWith(
            Method.Post,
-            baseUrl.toLowerCase() + "/_matrix/media/r0/upload?access_token=token",
+            baseUrl.toLowerCase() + "/_matrix/media/v3/upload?access_token=token",
        );
        expect(xhr.setRequestHeader).not.toHaveBeenCalledWith("Authorization");
    });
@@ -96,7 +96,7 @@ describe("MatrixHttpApi", () => {
            accessToken: "token",
        });
        upload = api.uploadContent({} as File);
-        expect(xhr.open).toHaveBeenCalledWith(Method.Post, baseUrl.toLowerCase() + "/_matrix/media/r0/upload");
+        expect(xhr.open).toHaveBeenCalledWith(Method.Post, baseUrl.toLowerCase() + "/_matrix/media/v3/upload");
        expect(xhr.setRequestHeader).toHaveBeenCalledWith("Authorization", "Bearer token");
    });

@@ -105,14 +105,14 @@ describe("MatrixHttpApi", () => {
        upload = api.uploadContent({} as File, { name: "name" });
        expect(xhr.open).toHaveBeenCalledWith(
            Method.Post,
-            baseUrl.toLowerCase() + "/_matrix/media/r0/upload?filename=name",
+            baseUrl.toLowerCase() + "/_matrix/media/v3/upload?filename=name",
        );
    });

    it("should allow not sending the filename", () => {
        const api = new MatrixHttpApi(new TypedEventEmitter<any, any>(), { baseUrl, prefix });
        upload = api.uploadContent({} as File, { name: "name", includeFilename: false });
-        expect(xhr.open).toHaveBeenCalledWith(Method.Post, baseUrl.toLowerCase() + "/_matrix/media/r0/upload");
+        expect(xhr.open).toHaveBeenCalledWith(Method.Post, baseUrl.toLowerCase() + "/_matrix/media/v3/upload");
    });

    it("should abort xhr when the upload is aborted", () => {
@@ -560,7 +560,7 @@ describe("InteractiveAuth", () => {
        expect(ia.getChosenFlow()?.stages).toEqual([AuthType.Password]);
    });

-    it("should fire stateUpdated callback if with error when encountered", async () => {
+    it("should fire stateUpdated callback with error when a request fails", async () => {
        const doRequest = jest.fn();
        const stateUpdated = jest.fn();

@@ -578,15 +578,20 @@ describe("InteractiveAuth", () => {
            },
        });

-        // first we expect a call here
+        // StateUpdated should be called. We call submitAuthDict() to trigger a request ...
+        let firstTime = true;
        stateUpdated.mockImplementation((stage) => {
            expect(stage).toEqual(AuthType.Password);
-            ia.submitAuthDict({
-                type: AuthType.Password,
-            });
+            // Only trigger the request the first time, to avoid an infinite loop
+            if (firstTime) {
+                firstTime = false;
+                ia.submitAuthDict({
+                    type: AuthType.Password,
+                });
+            }
        });

-        // .. which should trigger a call here
+        // .. which which we then reject, so we can test the behaviour in that case.
        doRequest.mockRejectedValue(new MatrixError({ errcode: "M_UNKNOWN", error: "This is an error" }));

        await Promise.allSettled([ia.attemptAuth()]);
@@ -201,7 +201,7 @@ describe("MatrixClient", function () {
        if (path === KEEP_ALIVE_PATH && acceptKeepalives) {
            return Promise.resolve({
                unstable_features: unstableFeatures,
-                versions: ["r0.6.0", "r0.6.1"],
+                versions: ["v1.1"],
            });
        }
        const next = httpLookups.shift();
@@ -2266,7 +2266,6 @@ describe("MatrixClient", function () {
        function roomCreateEvent(newRoomId: string, predecessorRoomId: string): MatrixEvent {
            return new MatrixEvent({
                content: {
-                    "creator": "@daryl:alexandria.example.com",
                    "m.federate": true,
                    "predecessor": {
                        event_id: "id_of_last_event",
@@ -0,0 +1,139 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { MatrixEvent } from "../../../src";
+import { CallMembership, CallMembershipData } from "../../../src/matrixrtc/CallMembership";
+
+const membershipTemplate: CallMembershipData = {
+    call_id: "",
+    scope: "m.room",
+    application: "m.call",
+    device_id: "AAAAAAA",
+    expires: 5000,
+};
+
+function makeMockEvent(originTs = 0): MatrixEvent {
+    return {
+        getTs: jest.fn().mockReturnValue(originTs),
+        sender: {
+            userId: "@alice:example.org",
+        },
+    } as unknown as MatrixEvent;
+}
+
+describe("CallMembership", () => {
+    it("rejects membership with no expiry", () => {
+        expect(() => {
+            new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { expires: undefined }));
+        }).toThrow();
+    });
+
+    it("rejects membership with no device_id", () => {
+        expect(() => {
+            new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { device_id: undefined }));
+        }).toThrow();
+    });
+
+    it("rejects membership with no call_id", () => {
+        expect(() => {
+            new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { call_id: undefined }));
+        }).toThrow();
+    });
+
+    it("rejects membership with no scope", () => {
+        expect(() => {
+            new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { scope: undefined }));
+        }).toThrow();
+    });
+
+    it("uses event timestamp if no created_ts", () => {
+        const membership = new CallMembership(makeMockEvent(12345), membershipTemplate);
+        expect(membership.createdTs()).toEqual(12345);
+    });
+
+    it("uses created_ts if present", () => {
+        const membership = new CallMembership(
+            makeMockEvent(12345),
+            Object.assign({}, membershipTemplate, { created_ts: 67890 }),
+        );
+        expect(membership.createdTs()).toEqual(67890);
+    });
+
+    it("computes absolute expiry time", () => {
+        const membership = new CallMembership(makeMockEvent(1000), membershipTemplate);
+        expect(membership.getAbsoluteExpiry()).toEqual(5000 + 1000);
+    });
+
+    it("considers memberships unexpired if local age low enough", () => {
+        const fakeEvent = makeMockEvent(1000);
+        fakeEvent.getLocalAge = jest.fn().mockReturnValue(3000);
+        const membership = new CallMembership(fakeEvent, membershipTemplate);
+        expect(membership.isExpired()).toEqual(false);
+    });
+
+    it("considers memberships expired when local age large", () => {
+        const fakeEvent = makeMockEvent(1000);
+        fakeEvent.getLocalAge = jest.fn().mockReturnValue(6000);
+        const membership = new CallMembership(fakeEvent, membershipTemplate);
+        expect(membership.isExpired()).toEqual(true);
+    });
+
+    it("returns active foci", () => {
+        const fakeEvent = makeMockEvent();
+        const mockFocus = { type: "this_is_a_mock_focus" };
+        const membership = new CallMembership(
+            fakeEvent,
+            Object.assign({}, membershipTemplate, { foci_active: [mockFocus] }),
+        );
+        expect(membership.getActiveFoci()).toEqual([mockFocus]);
+    });
+
+    describe("expiry calculation", () => {
+        let fakeEvent: MatrixEvent;
+        let membership: CallMembership;
+
+        beforeEach(() => {
+            // server origin timestamp for this event is 1000
+            fakeEvent = makeMockEvent(1000);
+            // our clock would have been at 2000 at the creation time (our clock at event receive time - age)
+            // (ie. the local clock is 1 second ahead of the servers' clocks)
+            fakeEvent.localTimestamp = 2000;
+
+            // for simplicity's sake, we say that the event's age is zero
+            fakeEvent.getLocalAge = jest.fn().mockReturnValue(0);
+
+            membership = new CallMembership(fakeEvent!, membershipTemplate);
+
+            jest.useFakeTimers();
+        });
+
+        afterEach(() => {
+            jest.useRealTimers();
+        });
+
+        it("converts expiry time into local clock", () => {
+            // for sanity's sake, make sure the server-relative expiry time is what we expect
+            expect(membership.getAbsoluteExpiry()).toEqual(6000);
+            // therefore the expiry time converted to our clock should be 1 second later
+            expect(membership.getLocalExpiry()).toEqual(7000);
+        });
+
+        it("calculates time until expiry", () => {
+            jest.setSystemTime(2000);
+            expect(membership.getMsUntilExpiry()).toEqual(5000);
+        });
+    });
+});
@@ -0,0 +1,405 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { EventTimeline, EventType, MatrixClient, Room } from "../../../src";
+import { CallMembershipData } from "../../../src/matrixrtc/CallMembership";
+import { MatrixRTCSession, MatrixRTCSessionEvent } from "../../../src/matrixrtc/MatrixRTCSession";
+import { randomString } from "../../../src/randomstring";
+import { makeMockRoom, mockRTCEvent } from "./mocks";
+
+const membershipTemplate: CallMembershipData = {
+    call_id: "",
+    scope: "m.room",
+    application: "m.call",
+    device_id: "AAAAAAA",
+    expires: 60 * 60 * 1000,
+};
+
+const mockFocus = { type: "mock" };
+
+describe("MatrixRTCSession", () => {
+    let client: MatrixClient;
+    let sess: MatrixRTCSession | undefined;
+
+    beforeEach(() => {
+        client = new MatrixClient({ baseUrl: "base_url" });
+        client.getUserId = jest.fn().mockReturnValue("@alice:example.org");
+        client.getDeviceId = jest.fn().mockReturnValue("AAAAAAA");
+    });
+
+    afterEach(() => {
+        client.stopClient();
+        client.matrixRTC.stop();
+        if (sess) sess.stop();
+        sess = undefined;
+    });
+
+    it("Creates a room-scoped session from room state", () => {
+        const mockRoom = makeMockRoom([membershipTemplate]);
+
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess?.memberships.length).toEqual(1);
+        expect(sess?.memberships[0].callId).toEqual("");
+        expect(sess?.memberships[0].scope).toEqual("m.room");
+        expect(sess?.memberships[0].application).toEqual("m.call");
+        expect(sess?.memberships[0].deviceId).toEqual("AAAAAAA");
+        expect(sess?.memberships[0].isExpired()).toEqual(false);
+    });
+
+    it("ignores expired memberships events", () => {
+        const expiredMembership = Object.assign({}, membershipTemplate);
+        expiredMembership.expires = 1000;
+        expiredMembership.device_id = "EXPIRED";
+        const mockRoom = makeMockRoom([membershipTemplate, expiredMembership], () => 10000);
+
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess?.memberships.length).toEqual(1);
+        expect(sess?.memberships[0].deviceId).toEqual("AAAAAAA");
+    });
+
+    it("honours created_ts", () => {
+        const expiredMembership = Object.assign({}, membershipTemplate);
+        expiredMembership.created_ts = 500;
+        expiredMembership.expires = 1000;
+        const mockRoom = makeMockRoom([expiredMembership]);
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess?.memberships[0].getAbsoluteExpiry()).toEqual(1500);
+    });
+
+    it("returns empty session if no membership events are present", () => {
+        const mockRoom = makeMockRoom([]);
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess?.memberships).toHaveLength(0);
+    });
+
+    it("safely ignores events with no memberships section", () => {
+        const mockRoom = {
+            roomId: randomString(8),
+            getLiveTimeline: jest.fn().mockReturnValue({
+                getState: jest.fn().mockReturnValue({
+                    getStateEvents: (_type: string, _stateKey: string) => [
+                        {
+                            getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
+                            getContent: jest.fn().mockReturnValue({}),
+                            getSender: jest.fn().mockReturnValue("@mock:user.example"),
+                            getTs: jest.fn().mockReturnValue(1000),
+                            getLocalAge: jest.fn().mockReturnValue(0),
+                        },
+                    ],
+                }),
+            }),
+        };
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom as unknown as Room);
+        expect(sess.memberships).toHaveLength(0);
+    });
+
+    it("safely ignores events with junk memberships section", () => {
+        const mockRoom = {
+            roomId: randomString(8),
+            getLiveTimeline: jest.fn().mockReturnValue({
+                getState: jest.fn().mockReturnValue({
+                    getStateEvents: (_type: string, _stateKey: string) => [
+                        {
+                            getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
+                            getContent: jest.fn().mockReturnValue({ memberships: "i am a fish" }),
+                            getSender: jest.fn().mockReturnValue("@mock:user.example"),
+                            getTs: jest.fn().mockReturnValue(1000),
+                            getLocalAge: jest.fn().mockReturnValue(0),
+                        },
+                    ],
+                }),
+            }),
+        };
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom as unknown as Room);
+        expect(sess.memberships).toHaveLength(0);
+    });
+
+    it("ignores memberships with no expires_ts", () => {
+        const expiredMembership = Object.assign({}, membershipTemplate);
+        (expiredMembership.expires as number | undefined) = undefined;
+        const mockRoom = makeMockRoom([expiredMembership]);
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess.memberships).toHaveLength(0);
+    });
+
+    it("ignores memberships with no device_id", () => {
+        const testMembership = Object.assign({}, membershipTemplate);
+        (testMembership.device_id as string | undefined) = undefined;
+        const mockRoom = makeMockRoom([testMembership]);
+        const sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess.memberships).toHaveLength(0);
+    });
+
+    it("ignores memberships with no call_id", () => {
+        const testMembership = Object.assign({}, membershipTemplate);
+        (testMembership.call_id as string | undefined) = undefined;
+        const mockRoom = makeMockRoom([testMembership]);
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess.memberships).toHaveLength(0);
+    });
+
+    it("ignores memberships with no scope", () => {
+        const testMembership = Object.assign({}, membershipTemplate);
+        (testMembership.scope as string | undefined) = undefined;
+        const mockRoom = makeMockRoom([testMembership]);
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess.memberships).toHaveLength(0);
+    });
+
+    it("ignores anything that's not a room-scoped call (for now)", () => {
+        const testMembership = Object.assign({}, membershipTemplate);
+        testMembership.scope = "m.user";
+        const mockRoom = makeMockRoom([testMembership]);
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        expect(sess.memberships).toHaveLength(0);
+    });
+
+    describe("getOldestMembership", () => {
+        it("returns the oldest membership event", () => {
+            const mockRoom = makeMockRoom([
+                Object.assign({}, membershipTemplate, { device_id: "foo", created_ts: 3000 }),
+                Object.assign({}, membershipTemplate, { device_id: "old", created_ts: 1000 }),
+                Object.assign({}, membershipTemplate, { device_id: "bar", created_ts: 2000 }),
+            ]);
+
+            sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+            expect(sess.getOldestMembership()!.deviceId).toEqual("old");
+        });
+    });
+
+    describe("joining", () => {
+        let mockRoom: Room;
+
+        beforeEach(() => {
+            mockRoom = makeMockRoom([]);
+            sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        });
+
+        afterEach(() => {
+            // stop the timers
+            sess!.leaveRoomSession();
+        });
+
+        it("starts un-joined", () => {
+            expect(sess!.isJoined()).toEqual(false);
+        });
+
+        it("shows joined once join is called", () => {
+            sess!.joinRoomSession([mockFocus]);
+            expect(sess!.isJoined()).toEqual(true);
+        });
+
+        it("sends a membership event when joining a call", () => {
+            client.sendStateEvent = jest.fn();
+
+            sess!.joinRoomSession([mockFocus]);
+
+            expect(client.sendStateEvent).toHaveBeenCalledWith(
+                mockRoom!.roomId,
+                EventType.GroupCallMemberPrefix,
+                {
+                    memberships: [
+                        {
+                            application: "m.call",
+                            scope: "m.room",
+                            call_id: "",
+                            device_id: "AAAAAAA",
+                            expires: 3600000,
+                            foci_active: [{ type: "mock" }],
+                        },
+                    ],
+                },
+                "@alice:example.org",
+            );
+        });
+
+        it("does nothing if join called when already joined", () => {
+            const sendStateEventMock = jest.fn();
+            client.sendStateEvent = sendStateEventMock;
+
+            sess!.joinRoomSession([mockFocus]);
+
+            expect(client.sendStateEvent).toHaveBeenCalledTimes(1);
+
+            sess!.joinRoomSession([mockFocus]);
+            expect(client.sendStateEvent).toHaveBeenCalledTimes(1);
+        });
+
+        it("renews membership event before expiry time", async () => {
+            jest.useFakeTimers();
+            let resolveFn: ((_roomId: string, _type: string, val: Record<string, any>) => void) | undefined;
+
+            const eventSentPromise = new Promise<Record<string, any>>((r) => {
+                resolveFn = (_roomId: string, _type: string, val: Record<string, any>) => {
+                    r(val);
+                };
+            });
+            try {
+                const sendStateEventMock = jest.fn().mockImplementation(resolveFn);
+                client.sendStateEvent = sendStateEventMock;
+
+                sess!.joinRoomSession([mockFocus]);
+
+                const eventContent = await eventSentPromise;
+
+                // definitely should have renewed by 1 second before the expiry!
+                const timeElapsed = 60 * 60 * 1000 - 1000;
+                mockRoom.getLiveTimeline().getState(EventTimeline.FORWARDS)!.getStateEvents = jest
+                    .fn()
+                    .mockReturnValue(mockRTCEvent(eventContent.memberships, mockRoom.roomId, () => timeElapsed));
+
+                const eventReSentPromise = new Promise<Record<string, any>>((r) => {
+                    resolveFn = (_roomId: string, _type: string, val: Record<string, any>) => {
+                        r(val);
+                    };
+                });
+
+                sendStateEventMock.mockReset().mockImplementation(resolveFn);
+
+                jest.setSystemTime(Date.now() + timeElapsed);
+                jest.advanceTimersByTime(timeElapsed);
+                await eventReSentPromise;
+
+                expect(sendStateEventMock).toHaveBeenCalledWith(
+                    mockRoom.roomId,
+                    EventType.GroupCallMemberPrefix,
+                    {
+                        memberships: [
+                            {
+                                application: "m.call",
+                                scope: "m.room",
+                                call_id: "",
+                                device_id: "AAAAAAA",
+                                expires: 3600000 * 2,
+                                foci_active: [{ type: "mock" }],
+                                created_ts: 1000,
+                            },
+                        ],
+                    },
+                    "@alice:example.org",
+                );
+            } finally {
+                jest.useRealTimers();
+            }
+        });
+    });
+
+    it("emits an event at the time a membership event expires", () => {
+        jest.useFakeTimers();
+        try {
+            let eventAge = 0;
+
+            const membership = Object.assign({}, membershipTemplate);
+            const mockRoom = makeMockRoom([membership], () => eventAge);
+
+            sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+            const membershipObject = sess.memberships[0];
+
+            const onMembershipsChanged = jest.fn();
+            sess.on(MatrixRTCSessionEvent.MembershipsChanged, onMembershipsChanged);
+
+            eventAge = 61 * 1000 * 1000;
+            jest.advanceTimersByTime(61 * 1000 * 1000);
+
+            expect(onMembershipsChanged).toHaveBeenCalledWith([membershipObject], []);
+            expect(sess?.memberships.length).toEqual(0);
+        } finally {
+            jest.useRealTimers();
+        }
+    });
+
+    it("prunes expired memberships on update", () => {
+        client.sendStateEvent = jest.fn();
+
+        let eventAge = 0;
+
+        const mockRoom = makeMockRoom(
+            [
+                Object.assign({}, membershipTemplate, {
+                    device_id: "OTHERDEVICE",
+                    expires: 1000,
+                }),
+            ],
+            () => eventAge,
+        );
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+
+        // sanity check
+        expect(sess.memberships).toHaveLength(1);
+        expect(sess.memberships[0].deviceId).toEqual("OTHERDEVICE");
+
+        eventAge = 10000;
+
+        sess.joinRoomSession([mockFocus]);
+
+        expect(client.sendStateEvent).toHaveBeenCalledWith(
+            mockRoom!.roomId,
+            EventType.GroupCallMemberPrefix,
+            {
+                memberships: [
+                    {
+                        application: "m.call",
+                        scope: "m.room",
+                        call_id: "",
+                        device_id: "AAAAAAA",
+                        expires: 3600000,
+                        foci_active: [mockFocus],
+                    },
+                ],
+            },
+            "@alice:example.org",
+        );
+    });
+
+    it("fills in created_ts for other memberships on update", () => {
+        client.sendStateEvent = jest.fn();
+
+        const mockRoom = makeMockRoom([
+            Object.assign({}, membershipTemplate, {
+                device_id: "OTHERDEVICE",
+            }),
+        ]);
+        sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+
+        sess.joinRoomSession([mockFocus]);
+
+        expect(client.sendStateEvent).toHaveBeenCalledWith(
+            mockRoom!.roomId,
+            EventType.GroupCallMemberPrefix,
+            {
+                memberships: [
+                    {
+                        application: "m.call",
+                        scope: "m.room",
+                        call_id: "",
+                        device_id: "OTHERDEVICE",
+                        expires: 3600000,
+                        created_ts: 1000,
+                    },
+                    {
+                        application: "m.call",
+                        scope: "m.room",
+                        call_id: "",
+                        device_id: "AAAAAAA",
+                        expires: 3600000,
+                        foci_active: [mockFocus],
+                    },
+                ],
+            },
+            "@alice:example.org",
+        );
+    });
+});
@@ -0,0 +1,80 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { ClientEvent, EventTimeline, MatrixClient } from "../../../src";
+import { RoomStateEvent } from "../../../src/models/room-state";
+import { CallMembershipData } from "../../../src/matrixrtc/CallMembership";
+import { MatrixRTCSessionManagerEvents } from "../../../src/matrixrtc/MatrixRTCSessionManager";
+import { makeMockRoom } from "./mocks";
+
+const membershipTemplate: CallMembershipData = {
+    call_id: "",
+    scope: "m.room",
+    application: "m.call",
+    device_id: "AAAAAAA",
+    expires: 60 * 60 * 1000,
+};
+
+describe("MatrixRTCSessionManager", () => {
+    let client: MatrixClient;
+
+    beforeEach(async () => {
+        client = new MatrixClient({ baseUrl: "base_url" });
+        client.matrixRTC.start();
+    });
+
+    afterEach(() => {
+        client.stopClient();
+        client.matrixRTC.stop();
+    });
+
+    it("Fires event when session starts", () => {
+        const onStarted = jest.fn();
+        client.matrixRTC.on(MatrixRTCSessionManagerEvents.SessionStarted, onStarted);
+
+        try {
+            const room1 = makeMockRoom([membershipTemplate]);
+            jest.spyOn(client, "getRooms").mockReturnValue([room1]);
+
+            client.emit(ClientEvent.Room, room1);
+            expect(onStarted).toHaveBeenCalledWith(room1.roomId, client.matrixRTC.getActiveRoomSession(room1));
+        } finally {
+            client.matrixRTC.off(MatrixRTCSessionManagerEvents.SessionStarted, onStarted);
+        }
+    });
+
+    it("Fires event when session ends", () => {
+        const onEnded = jest.fn();
+        client.matrixRTC.on(MatrixRTCSessionManagerEvents.SessionEnded, onEnded);
+
+        const memberships = [membershipTemplate];
+
+        const room1 = makeMockRoom(memberships);
+        jest.spyOn(client, "getRooms").mockReturnValue([room1]);
+        jest.spyOn(client, "getRoom").mockReturnValue(room1);
+
+        client.emit(ClientEvent.Room, room1);
+
+        memberships.splice(0, 1);
+
+        const roomState = room1.getLiveTimeline().getState(EventTimeline.FORWARDS)!;
+        const membEvent = roomState.getStateEvents("")[0];
+
+        client.emit(RoomStateEvent.Events, membEvent, roomState, null);
+
+        expect(onEnded).toHaveBeenCalledWith(room1.roomId, client.matrixRTC.getActiveRoomSession(room1));
+    });
+});
@@ -0,0 +1,66 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { EventType, MatrixEvent, Room } from "../../../src";
+import { CallMembershipData } from "../../../src/matrixrtc/CallMembership";
+import { randomString } from "../../../src/randomstring";
+
+export function makeMockRoom(
+    memberships: CallMembershipData[],
+    getLocalAge: (() => number) | undefined = undefined,
+): Room {
+    const roomId = randomString(8);
+    return {
+        roomId: roomId,
+        getLiveTimeline: jest.fn().mockReturnValue({
+            getState: jest.fn().mockReturnValue(makeMockRoomState(memberships, roomId, getLocalAge)),
+        }),
+    } as unknown as Room;
+}
+
+function makeMockRoomState(memberships: CallMembershipData[], roomId: string, getLocalAge: (() => number) | undefined) {
+    return {
+        getStateEvents: (_: string, stateKey: string) => {
+            const event = mockRTCEvent(memberships, roomId, getLocalAge);
+
+            if (stateKey !== undefined) return event;
+            return [event];
+        },
+    };
+}
+
+export function mockRTCEvent(
+    memberships: CallMembershipData[],
+    roomId: string,
+    getLocalAge: (() => number) | undefined,
+): MatrixEvent {
+    const getLocalAgeFn = getLocalAge ?? (() => 10);
+
+    return {
+        getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
+        getContent: jest.fn().mockReturnValue({
+            memberships: memberships,
+        }),
+        getSender: jest.fn().mockReturnValue("@mock:user.example"),
+        getTs: jest.fn().mockReturnValue(1000),
+        getLocalAge: getLocalAgeFn,
+        localTimestamp: Date.now(),
+        getRoomId: jest.fn().mockReturnValue(roomId),
+        sender: {
+            userId: "@mock:user.example",
+        },
+    } as unknown as MatrixEvent;
+}
@@ -195,7 +195,7 @@ describe.each([[StoreType.Memory], [StoreType.IndexedDB]])("queueToDevice (%s st

    it("retries on retryImmediately()", async function () {
        httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-            versions: ["r0.0.1"],
+            versions: ["v1.1"],
        });

        await Promise.all([client.startClient(), httpBackend.flush(undefined, 1, 20)]);
@@ -219,7 +219,7 @@ describe.each([[StoreType.Memory], [StoreType.IndexedDB]])("queueToDevice (%s st

    it("retries on when client is started", async function () {
        httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-            versions: ["r0.0.1"],
+            versions: ["v1.1"],
        });

        await Promise.all([client.startClient(), httpBackend.flush("/_matrix/client/versions", 1, 20)]);
@@ -243,7 +243,7 @@ describe.each([[StoreType.Memory], [StoreType.IndexedDB]])("queueToDevice (%s st

    it("retries when a message is retried", async function () {
        httpBackend.when("GET", "/_matrix/client/versions").respond(200, {
-            versions: ["r0.0.1"],
+            versions: ["v1.1"],
        });

        await Promise.all([client.startClient(), httpBackend.flush(undefined, 1, 20)]);
@@ -70,9 +70,7 @@ describe("RoomState", function () {
                user: userA,
                room: roomId,
                event: true,
-                content: {
-                    creator: userA,
-                },
+                content: {},
            }),
        ]);
    });
@@ -228,7 +228,7 @@ describe("Room", function () {
    });

    describe("getCreator", () => {
-        it("should return the creator from m.room.create", function () {
+        it("should return the sender from m.room.create", function () {
            // @ts-ignore - mocked doesn't handle overloads sanely
            mocked(room.currentState.getStateEvents).mockImplementation(function (type, key) {
                if (type === EventType.RoomCreate && key === "") {
@@ -239,7 +239,7 @@ describe("Room", function () {
                        room: roomId,
                        user: userA,
                        content: {
-                            creator: userA,
+                            creator: userB, // The creator field was dropped in room version 11 but a malicious client might still send it
                        },
                    });
                }
@@ -247,6 +247,24 @@ describe("Room", function () {
            const roomCreator = room.getCreator();
            expect(roomCreator).toStrictEqual(userA);
        });
+
+        it("should return null if the sender is undefined", function () {
+            // @ts-ignore - mocked doesn't handle overloads sanely
+            mocked(room.currentState.getStateEvents).mockImplementation(function (type, key) {
+                if (type === EventType.RoomCreate && key === "") {
+                    return utils.mkEvent({
+                        event: true,
+                        type: EventType.RoomCreate,
+                        skey: "",
+                        room: roomId,
+                        user: undefined,
+                        content: {},
+                    });
+                }
+            });
+            const roomCreator = room.getCreator();
+            expect(roomCreator).toBeNull();
+        });
    });

    describe("getAvatarUrl", function () {
@@ -1184,6 +1202,21 @@ describe("Room", function () {
                room.recalculate();
                expect(room.name).toEqual("Empty room");
            });
+
+            it("emits an update event", function () {
+                const spy = jest.fn();
+                const summary = {
+                    "m.heroes": [],
+                    "m.invited_member_count": 1,
+                };
+
+                room.once(RoomEvent.Summary, spy);
+
+                room.setSummary(summary);
+                room.recalculate();
+
+                expect(spy).toHaveBeenCalledWith(summary);
+            });
        });

        describe("Room.recalculate => Room Name", function () {
@@ -1420,6 +1453,87 @@ describe("Room", function () {
        }

        describe("addReceipt", function () {
+            describe("resets the unread count", () => {
+                const event1 = utils.mkMessage({ room: roomId, user: userA, msg: "1", event: true });
+                const event2 = utils.mkMessage({ room: roomId, user: userA, msg: "2", event: true });
+
+                it("should reset the unread count when our non-synthetic receipt points to the latest event", () => {
+                    // Given a room with 2 events, and an unread count set.
+                    room.client.isInitialSyncComplete = jest.fn().mockReturnValue(true);
+                    room.timeline = [event1, event2];
+                    room.setUnread(NotificationCountType.Total, 45);
+                    room.setUnread(NotificationCountType.Highlight, 57);
+                    // Sanity check:
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Total)).toEqual(45);
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Highlight)).toEqual(57);
+
+                    // When I receive a receipt for me for the last event
+                    const receipt = mkReceipt(roomId, [mkRecord(event2.getId()!, "m.read", userA, 123)]);
+                    room.addReceipt(receipt);
+
+                    // Then the count is set to 0
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Total)).toEqual(0);
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Highlight)).toEqual(0);
+                });
+
+                it("should not reset the unread count when someone else's receipt points to the latest event", () => {
+                    // Given a room with 2 events, and an unread count set.
+                    room.client.isInitialSyncComplete = jest.fn().mockReturnValue(true);
+                    room.timeline = [event1, event2];
+                    room.setUnread(NotificationCountType.Total, 45);
+                    room.setUnread(NotificationCountType.Highlight, 57);
+                    // Sanity check:
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Total)).toEqual(45);
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Highlight)).toEqual(57);
+
+                    // When I receive a receipt for someone else for the last event
+                    const receipt = mkReceipt(roomId, [mkRecord(event2.getId()!, "m.read", userB, 123)]);
+                    room.addReceipt(receipt);
+
+                    // Then the count is unchanged because it's not my receipt
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Total)).toEqual(45);
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Highlight)).toEqual(57);
+                });
+
+                it("should not reset the unread count when our non-synthetic receipt points to an earlier event", () => {
+                    // Given a room with 2 events, and an unread count set.
+                    room.client.isInitialSyncComplete = jest.fn().mockReturnValue(true);
+                    room.timeline = [event1, event2];
+                    room.setUnread(NotificationCountType.Total, 45);
+                    room.setUnread(NotificationCountType.Highlight, 57);
+                    // Sanity check:
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Total)).toEqual(45);
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Highlight)).toEqual(57);
+
+                    // When I receive a receipt for me for an earlier event
+                    const receipt = mkReceipt(roomId, [mkRecord(event1.getId()!, "m.read", userA, 123)]);
+                    room.addReceipt(receipt);
+
+                    // Then the count is unchanged because it wasn't the latest event
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Total)).toEqual(45);
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Highlight)).toEqual(57);
+                });
+
+                it("should not reset the unread count when our a synthetic receipt points to the latest event", () => {
+                    // Given a room with 2 events, and an unread count set.
+                    room.client.isInitialSyncComplete = jest.fn().mockReturnValue(true);
+                    room.timeline = [event1, event2];
+                    room.setUnread(NotificationCountType.Total, 45);
+                    room.setUnread(NotificationCountType.Highlight, 57);
+                    // Sanity check:
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Total)).toEqual(45);
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Highlight)).toEqual(57);
+
+                    // When I receive a synthetic receipt for me for the last event
+                    const receipt = mkReceipt(roomId, [mkRecord(event2.getId()!, "m.read", userA, 123)]);
+                    room.addReceipt(receipt, true);
+
+                    // Then the count is unchanged because the receipt was synthetic
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Total)).toEqual(45);
+                    expect(room.getUnreadNotificationCount(NotificationCountType.Highlight)).toEqual(57);
+                });
+            });
+
            it("should store the receipt so it can be obtained via getReceiptsForEvent", function () {
                const ts = 13787898424;
                room.addReceipt(mkReceipt(roomId, [mkRecord(eventToAck.getId()!, "m.read", userB, ts)]));
@@ -3471,12 +3585,10 @@ describe("Room", function () {

        function roomCreateEvent(newRoomId: string, predecessorRoomId: string | null): MatrixEvent {
            const content: {
-                creator: string;
                ["m.federate"]: boolean;
                room_version: string;
                predecessor: { event_id: string; room_id: string } | undefined;
            } = {
-                "creator": "@daryl:alexandria.example.com",
                "predecessor": undefined,
                "m.federate": true,
                "room_version": "9",
@@ -52,7 +52,7 @@ describe("CrossSigningIdentity", () => {
                get: jest.fn(),
            } as unknown as Mocked<ServerSideSecretStorage>;

-            crossSigning = new CrossSigningIdentity(olmMachine, outgoingRequestProcessor, secretStorage, jest.fn());
+            crossSigning = new CrossSigningIdentity(olmMachine, outgoingRequestProcessor, secretStorage);
        });

        it("should do nothing if keys are present on-device and in secret storage", async () => {
@@ -29,8 +29,9 @@ import {
 } from "@matrix-org/matrix-sdk-crypto-wasm";

 import { TypedEventEmitter } from "../../../src/models/typed-event-emitter";
-import { HttpApiEvent, HttpApiEventHandlerMap, MatrixHttpApi, UIAuthCallback } from "../../../src";
+import { HttpApiEvent, HttpApiEventHandlerMap, IHttpOpts, MatrixHttpApi, UIAuthCallback } from "../../../src";
 import { OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
+import { defer } from "../../../src/utils";

 describe("OutgoingRequestProcessor", () => {
    /** the OutgoingRequestProcessor implementation under test */
@@ -161,7 +162,7 @@ describe("OutgoingRequestProcessor", () => {
            .when("PUT", "/_matrix")
            .check((req) => {
                expect(req.path).toEqual(
-                    "https://example.com/_matrix/client/v3/room/test%2Froom/send/test%2Ftype/test%2Ftxnid",
+                    "https://example.com/_matrix/client/v3/rooms/test%2Froom/send/test%2Ftype/test%2Ftxnid",
                );
                expect(req.rawData).toEqual(testBody);
                expect(req.headers["Accept"]).toEqual("application/json");
@@ -218,4 +219,40 @@ describe("OutgoingRequestProcessor", () => {
        await Promise.all([processor.makeOutgoingRequest(outgoingRequest), markSentCallPromise]);
        expect(olmMachine.markRequestAsSent).toHaveBeenCalledWith("5678", 987, "");
    });
+
+    it("does not explode if the OlmMachine is stopped while the request is in flight", async () => {
+        // we use a real olm machine for this test
+        const olmMachine = await RustSdkCryptoJs.OlmMachine.initialize(
+            new RustSdkCryptoJs.UserId("@alice:example.com"),
+            new RustSdkCryptoJs.DeviceId("TEST_DEVICE"),
+        );
+
+        const authRequestResultDefer = defer<string>();
+
+        const authRequestCalledPromise = new Promise<void>((resolve) => {
+            const mockHttpApi = {
+                authedRequest: async () => {
+                    resolve();
+                    return await authRequestResultDefer.promise;
+                },
+            } as unknown as Mocked<MatrixHttpApi<IHttpOpts & { onlyData: true }>>;
+            processor = new OutgoingRequestProcessor(olmMachine, mockHttpApi);
+        });
+
+        // build a request
+        const request = olmMachine.queryKeysForUsers([new RustSdkCryptoJs.UserId("@bob:example.com")]);
+        const result = processor.makeOutgoingRequest(request);
+
+        // wait for the HTTP request to be made
+        await authRequestCalledPromise;
+
+        // while the HTTP request is in flight, the OlmMachine gets stopped.
+        olmMachine.close();
+
+        // the HTTP request completes...
+        authRequestResultDefer.resolve("{}");
+
+        // ... and `makeOutgoingRequest` resolves satisfactorily
+        await result;
+    });
 });
@@ -16,7 +16,7 @@ limitations under the License.

 import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
 import { KeysQueryRequest, OlmMachine } from "@matrix-org/matrix-sdk-crypto-wasm";
-import { Mocked } from "jest-mock";
+import { mocked, Mocked } from "jest-mock";
 import fetchMock from "fetch-mock-jest";

 import { RustCrypto } from "../../../src/rust-crypto/rust-crypto";
@@ -30,6 +30,7 @@ import {
    IHttpOpts,
    IToDeviceEvent,
    MatrixClient,
+    MatrixEvent,
    MatrixHttpApi,
    TypedEventEmitter,
 } from "../../../src";
@@ -38,8 +39,15 @@ import { CryptoBackend } from "../../../src/common-crypto/CryptoBackend";
 import { IEventDecryptionResult } from "../../../src/@types/crypto";
 import { OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
 import { ServerSideSecretStorage } from "../../../src/secret-storage";
-import { CryptoCallbacks, ImportRoomKeysOpts, VerificationRequest } from "../../../src/crypto-api";
+import {
+    CryptoCallbacks,
+    EventShieldColour,
+    EventShieldReason,
+    ImportRoomKeysOpts,
+    VerificationRequest,
+} from "../../../src/crypto-api";
 import * as testData from "../../test-utils/test-data";
+import { defer } from "../../../src/utils";

 const TEST_USER = "@alice:example.com";
 const TEST_DEVICE_ID = "TEST_DEVICE";
@@ -61,32 +69,7 @@ describe("RustCrypto", () => {
        );

        it("should import and export keys", async () => {
-            const someRoomKeys = [
-                {
-                    algorithm: "m.megolm.v1.aes-sha2",
-                    room_id: "!cLDYAnjpiQXIrSwngM:localhost:8480",
-                    sender_key: "C9FMqTD20C0VaGWE/aSImkimuE6HDa/RyYj5gRUg3gY",
-                    session_id: "iGQG5GaP1/B3dSH6zCQDQqrNuotrtQjVC7w1OsUDwbg",
-                    session_key:
-                        "AQAAAADaCbP2gdOy8jrhikjploKgSBaFSJ5rvHcziaADbwNEzeCSrfuAUlXvCvxik8kU+MfCHIi5arN2M7UM5rGKdzkHnkReoIByFkeMdbjKWk5SFpVQexcM74eDhBGj+ICkQqOgApfnEbSswrmreB0+MhHHyLStwW5fy5f8A9QW1sbPuohkBuRmj9fwd3Uh+swkA0KqzbqLa7UI1Qu8NTrFA8G4",
-                    sender_claimed_keys: {
-                        ed25519: "RSq0Xw0RR0DeqlJ/j3qrF5qbN0D96fKk8lz9kZJlG9k",
-                    },
-                    forwarding_curve25519_key_chain: [],
-                },
-                {
-                    algorithm: "m.megolm.v1.aes-sha2",
-                    room_id: "!cLDYAnjpiQXIrSwngM:localhost:8480",
-                    sender_key: "C9FMqTD20C0VaGWE/aSImkimuE6HDa/RyYj5gRUg3gY",
-                    session_id: "P/Jy9Tog4CMtLseeS4Fe2AEXZov3k6cibcop/uyhr78",
-                    session_key:
-                        "AQAAAAATyAVm0c9c9DW9Od72MxvfSDYoysBw3C6yMJ3bYuTmssHN7yNGm59KCtKeFp2Y5qO7lvUmwOfSTvTASUb7HViE7Lt+Bvp5WiMTJ2Pv6m+N12ihyowV5lgtKFWI18Wxd0AugMTVQRwjBK6aMobf86NXWD2hiKm3N6kWbC0PXmqV7T/ycvU6IOAjLS7HnkuBXtgBF2aL95OnIm3KKf7soa+/",
-                    sender_claimed_keys: {
-                        ed25519: "RSq0Xw0RR0DeqlJ/j3qrF5qbN0D96fKk8lz9kZJlG9k",
-                    },
-                    forwarding_curve25519_key_chain: [],
-                },
-            ];
+            const someRoomKeys = testData.MEGOLM_SESSION_DATA_ARRAY;
            let importTotal = 0;
            const opt: ImportRoomKeysOpts = {
                progressCallback: (stage) => {
@@ -95,11 +78,11 @@ describe("RustCrypto", () => {
            };
            await rustCrypto.importRoomKeys(someRoomKeys, opt);

-            expect(importTotal).toBe(2);
+            expect(importTotal).toBe(someRoomKeys.length);

            const keys = await rustCrypto.exportRoomKeys();
            expect(Array.isArray(keys)).toBeTruthy();
-            expect(keys.length).toBe(2);
+            expect(keys.length).toBe(someRoomKeys.length);

            const aSession = someRoomKeys[0];

@@ -175,6 +158,44 @@ describe("RustCrypto", () => {
        await expect(rustCrypto.getCrossSigningKeyId()).resolves.toBe(null);
    });

+    describe("getCrossSigningStatus", () => {
+        it("returns sensible values on a default client", async () => {
+            const secretStorage = {
+                isStored: jest.fn().mockResolvedValue(null),
+            } as unknown as Mocked<ServerSideSecretStorage>;
+            const rustCrypto = await makeTestRustCrypto(undefined, undefined, undefined, secretStorage);
+
+            const result = await rustCrypto.getCrossSigningStatus();
+
+            expect(secretStorage.isStored).toHaveBeenCalledWith("m.cross_signing.master");
+            expect(result).toEqual({
+                privateKeysCachedLocally: {
+                    masterKey: false,
+                    selfSigningKey: false,
+                    userSigningKey: false,
+                },
+                privateKeysInSecretStorage: false,
+                publicKeysOnDevice: false,
+            });
+        });
+
+        it("throws if `stop` is called mid-call", async () => {
+            const secretStorage = {
+                isStored: jest.fn().mockResolvedValue(null),
+            } as unknown as Mocked<ServerSideSecretStorage>;
+            const rustCrypto = await makeTestRustCrypto(undefined, undefined, undefined, secretStorage);
+
+            // start the call off
+            const result = rustCrypto.getCrossSigningStatus();
+
+            // call `.stop`
+            rustCrypto.stop();
+
+            // getCrossSigningStatus should abort
+            await expect(result).rejects.toEqual(new Error("MatrixClient has been stopped"));
+        });
+    });
+
    it("bootstrapCrossSigning delegates to CrossSigningIdentity", async () => {
        const rustCrypto = await makeTestRustCrypto();
        const mockCrossSigningIdentity = {
@@ -261,6 +282,31 @@ describe("RustCrypto", () => {
            expect(outgoingRequestProcessor.makeOutgoingRequest).toHaveBeenCalledWith(testReq);
        });

+        it("should go round the loop again if another sync completes while the first `outgoingRequests` is running", async () => {
+            // the first call to `outgoingMessages` will return a promise which blocks for a while
+            const firstOutgoingRequestsDefer = defer<Array<any>>();
+            mocked(olmMachine.outgoingRequests).mockReturnValueOnce(firstOutgoingRequestsDefer.promise);
+
+            // the second will return a KeysQueryRequest.
+            const testReq = new KeysQueryRequest("1234", "{}");
+            outgoingRequestQueue.push([testReq]);
+
+            // the first sync completes, triggering the first call to `outgoingMessages`
+            rustCrypto.onSyncCompleted({});
+            expect(olmMachine.outgoingRequests).toHaveBeenCalledTimes(1);
+
+            // a second /sync completes before the first call to `outgoingRequests` completes. It shouldn't trigger
+            // a second call immediately, but should queue one up.
+            rustCrypto.onSyncCompleted({});
+            expect(olmMachine.outgoingRequests).toHaveBeenCalledTimes(1);
+
+            // the first call now completes, *with an empty result*, which would normally cause us to exit the loop, but
+            // we should have a second call queued. It should trigger a call to `makeOutgoingRequest`.
+            firstOutgoingRequestsDefer.resolve([]);
+            await awaitCallToMakeOutgoingRequest();
+            expect(olmMachine.outgoingRequests).toHaveBeenCalledTimes(2);
+        });
+
        it("stops looping when stop() is called", async () => {
            for (let i = 0; i < 5; i++) {
                outgoingRequestQueue.push([new KeysQueryRequest("1234", "{}")]);
@@ -334,6 +380,111 @@ describe("RustCrypto", () => {
        });
    });

+    describe(".getEncryptionInfoForEvent", () => {
+        let rustCrypto: RustCrypto;
+        let olmMachine: Mocked<RustSdkCryptoJs.OlmMachine>;
+
+        beforeEach(() => {
+            olmMachine = {
+                getRoomEventEncryptionInfo: jest.fn(),
+            } as unknown as Mocked<RustSdkCryptoJs.OlmMachine>;
+            rustCrypto = new RustCrypto(
+                olmMachine,
+                {} as MatrixClient["http"],
+                TEST_USER,
+                TEST_DEVICE_ID,
+                {} as ServerSideSecretStorage,
+                {} as CryptoCallbacks,
+            );
+        });
+
+        afterEach(() => {
+            jest.restoreAllMocks();
+        });
+
+        async function makeEncryptedEvent(): Promise<MatrixEvent> {
+            const encryptedEvent = mkEvent({
+                event: true,
+                type: "m.room.encrypted",
+                content: { algorithm: "fake_alg" },
+                room: "!room:id",
+            });
+            encryptedEvent.event.event_id = "$event:id";
+            const mockCryptoBackend = {
+                decryptEvent: () =>
+                    ({
+                        clearEvent: { content: { body: "1234" } },
+                    } as unknown as IEventDecryptionResult),
+            } as unknown as CryptoBackend;
+            await encryptedEvent.attemptDecryption(mockCryptoBackend);
+            return encryptedEvent;
+        }
+
+        it("should handle unencrypted events", async () => {
+            const event = mkEvent({ event: true, type: "m.room.message", content: { body: "xyz" } });
+            const res = await rustCrypto.getEncryptionInfoForEvent(event);
+            expect(res).toBe(null);
+            expect(olmMachine.getRoomEventEncryptionInfo).not.toHaveBeenCalled();
+        });
+
+        it("passes the event into the OlmMachine", async () => {
+            const encryptedEvent = await makeEncryptedEvent();
+            const res = await rustCrypto.getEncryptionInfoForEvent(encryptedEvent);
+            expect(res).toBe(null);
+            expect(olmMachine.getRoomEventEncryptionInfo).toHaveBeenCalledTimes(1);
+            const [passedEvent, passedRoom] = olmMachine.getRoomEventEncryptionInfo.mock.calls[0];
+            expect(passedRoom.toString()).toEqual("!room:id");
+            expect(JSON.parse(passedEvent)).toStrictEqual(
+                expect.objectContaining({
+                    event_id: "$event:id",
+                }),
+            );
+        });
+
+        it.each([
+            [RustSdkCryptoJs.ShieldColor.None, EventShieldColour.NONE],
+            [RustSdkCryptoJs.ShieldColor.Grey, EventShieldColour.GREY],
+            [RustSdkCryptoJs.ShieldColor.Red, EventShieldColour.RED],
+        ])("gets the right shield color (%i)", async (rustShield, expectedShield) => {
+            const mockEncryptionInfo = {
+                shieldState: jest.fn().mockReturnValue({ color: rustShield, message: null }),
+            } as unknown as RustSdkCryptoJs.EncryptionInfo;
+            olmMachine.getRoomEventEncryptionInfo.mockResolvedValue(mockEncryptionInfo);
+
+            const res = await rustCrypto.getEncryptionInfoForEvent(await makeEncryptedEvent());
+            expect(mockEncryptionInfo.shieldState).toHaveBeenCalledWith(false);
+            expect(res).not.toBe(null);
+            expect(res!.shieldColour).toEqual(expectedShield);
+        });
+
+        it.each([
+            [null, null],
+            ["Encrypted by an unverified user.", EventShieldReason.UNVERIFIED_IDENTITY],
+            ["Encrypted by a device not verified by its owner.", EventShieldReason.UNSIGNED_DEVICE],
+            [
+                "The authenticity of this encrypted message can't be guaranteed on this device.",
+                EventShieldReason.AUTHENTICITY_NOT_GUARANTEED,
+            ],
+            ["Encrypted by an unknown or deleted device.", EventShieldReason.UNKNOWN_DEVICE],
+            ["bloop", EventShieldReason.UNKNOWN],
+        ])("gets the right shield reason (%s)", async (rustReason, expectedReason) => {
+            // suppress the warning from the unknown shield reason
+            jest.spyOn(console, "warn").mockImplementation(() => {});
+
+            const mockEncryptionInfo = {
+                shieldState: jest
+                    .fn()
+                    .mockReturnValue({ color: RustSdkCryptoJs.ShieldColor.None, message: rustReason }),
+            } as unknown as RustSdkCryptoJs.EncryptionInfo;
+            olmMachine.getRoomEventEncryptionInfo.mockResolvedValue(mockEncryptionInfo);
+
+            const res = await rustCrypto.getEncryptionInfoForEvent(await makeEncryptedEvent());
+            expect(mockEncryptionInfo.shieldState).toHaveBeenCalledWith(false);
+            expect(res).not.toBe(null);
+            expect(res!.shieldReason).toEqual(expectedReason);
+        });
+    });
+
    describe("get|setTrustCrossSignedDevices", () => {
        let rustCrypto: RustCrypto;

@@ -485,6 +636,23 @@ describe("RustCrypto", () => {

            await expect(rustCrypto.userHasCrossSigningKeys()).resolves.toBe(true);
        });
+
+        it("returns true if the user is untracked, downloadUncached is set at true and the cross-signing keys are available", async () => {
+            fetchMock.post("path:/_matrix/client/v3/keys/query", {
+                device_keys: {
+                    [testData.BOB_TEST_USER_ID]: {
+                        [testData.BOB_TEST_DEVICE_ID]: testData.BOB_SIGNED_TEST_DEVICE_DATA,
+                    },
+                },
+                ...testData.BOB_SIGNED_CROSS_SIGNING_KEYS_DATA,
+            });
+
+            await expect(rustCrypto.userHasCrossSigningKeys(testData.BOB_TEST_USER_ID, true)).resolves.toBe(true);
+        });
+
+        it("returns false if the user is unknown", async () => {
+            await expect(rustCrypto.userHasCrossSigningKeys(testData.BOB_TEST_USER_ID)).resolves.toBe(false);
+        });
    });

    describe("createRecoveryKeyFromPassphrase", () => {
@@ -585,6 +753,52 @@ describe("RustCrypto", () => {
            );
        });
    });
+
+    describe("requestVerificationDM", () => {
+        it("send verification request to an unknown user", async () => {
+            const rustCrypto = await makeTestRustCrypto();
+            await expect(() =>
+                rustCrypto.requestVerificationDM("@bob:example.com", testData.TEST_ROOM_ID),
+            ).rejects.toThrow("unknown userId @bob:example.com");
+        });
+    });
+
+    describe("getUserVerificationStatus", () => {
+        let rustCrypto: RustCrypto;
+        let olmMachine: Mocked<RustSdkCryptoJs.OlmMachine>;
+
+        beforeEach(() => {
+            olmMachine = {
+                getIdentity: jest.fn(),
+            } as unknown as Mocked<RustSdkCryptoJs.OlmMachine>;
+            rustCrypto = new RustCrypto(
+                olmMachine,
+                {} as MatrixClient["http"],
+                TEST_USER,
+                TEST_DEVICE_ID,
+                {} as ServerSideSecretStorage,
+                {} as CryptoCallbacks,
+            );
+        });
+
+        it("returns an unverified UserVerificationStatus when there is no UserIdentity", async () => {
+            const userVerificationStatus = await rustCrypto.getUserVerificationStatus(testData.TEST_USER_ID);
+            expect(userVerificationStatus.isVerified()).toBeFalsy();
+            expect(userVerificationStatus.isTofu()).toBeFalsy();
+            expect(userVerificationStatus.isCrossSigningVerified()).toBeFalsy();
+            expect(userVerificationStatus.wasCrossSigningVerified()).toBeFalsy();
+        });
+
+        it("returns a verified UserVerificationStatus when the UserIdentity is verified", async () => {
+            olmMachine.getIdentity.mockResolvedValue({ isVerified: jest.fn().mockReturnValue(true) });
+
+            const userVerificationStatus = await rustCrypto.getUserVerificationStatus(testData.TEST_USER_ID);
+            expect(userVerificationStatus.isVerified()).toBeTruthy();
+            expect(userVerificationStatus.isTofu()).toBeFalsy();
+            expect(userVerificationStatus.isCrossSigningVerified()).toBeTruthy();
+            expect(userVerificationStatus.wasCrossSigningVerified()).toBeFalsy();
+        });
+    });
 });

 /** build a basic RustCrypto instance for testing
@@ -17,8 +17,9 @@ limitations under the License.
 import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
 import { Mocked } from "jest-mock";

-import { RustVerificationRequest } from "../../../src/rust-crypto/verification";
+import { isVerificationEvent, RustVerificationRequest } from "../../../src/rust-crypto/verification";
 import { OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
+import { EventType, MatrixEvent, MsgType } from "../../../src";

 describe("VerificationRequest", () => {
    describe("pending", () => {
@@ -80,6 +81,40 @@ describe("VerificationRequest", () => {
    });
 });

+describe("isVerificationEvent", () => {
+    it.each([
+        [EventType.KeyVerificationCancel],
+        [EventType.KeyVerificationDone],
+        [EventType.KeyVerificationMac],
+        [EventType.KeyVerificationStart],
+        [EventType.KeyVerificationKey],
+        [EventType.KeyVerificationReady],
+        [EventType.KeyVerificationAccept],
+    ])("should return true with %s event", (eventType) => {
+        const event = new MatrixEvent({
+            type: eventType,
+        });
+        expect(isVerificationEvent(event)).toBe(true);
+    });
+
+    it("should return true with EventType.RoomMessage and MsgType.KeyVerificationRequest", () => {
+        const event = new MatrixEvent({
+            type: EventType.RoomMessage,
+            content: {
+                msgtype: MsgType.KeyVerificationRequest,
+            },
+        });
+        expect(isVerificationEvent(event)).toBe(true);
+    });
+
+    it("should return false with a non verification event", () => {
+        const event = new MatrixEvent({
+            type: EventType.RoomName,
+        });
+        expect(isVerificationEvent(event)).toBe(false);
+    });
+});
+
 /** build a RustVerificationRequest with default parameters */
 function makeTestRequest(
    inner?: RustSdkCryptoJs.VerificationRequest,
@@ -16,8 +16,21 @@ limitations under the License.
 */

 import { ReceiptType } from "../../src/@types/read_receipts";
-import { IJoinedRoom, ISyncResponse, SyncAccumulator } from "../../src/sync-accumulator";
+import {
+    IJoinedRoom,
+    IInvitedRoom,
+    IKnockedRoom,
+    IKnockState,
+    ILeftRoom,
+    IRoomEvent,
+    IStateEvent,
+    IStrippedState,
+    ISyncResponse,
+    SyncAccumulator,
+    IInviteState,
+} from "../../src/sync-accumulator";
 import { IRoomSummary } from "../../src";
+import * as utils from "../test-utils/test-utils";

 // The event body & unsigned object get frozen to assert that they don't get altered
 // by the impl
@@ -95,6 +108,13 @@ describe("SyncAccumulator", function () {
                        },
                    },
                },
+                knock: {
+                    "!knock": {
+                        knock_state: {
+                            events: [member("alice", "knock")],
+                        },
+                    },
+                },
            },
        } as unknown as ISyncResponse;
        sa.accumulate(res);
@@ -287,6 +307,268 @@ describe("SyncAccumulator", function () {
        expect(sa.getJSON().accountData[0]).toEqual(acc2);
    });

+    it("should delete invite room when invite request is rejected", () => {
+        const initInviteState: IInviteState = {
+            events: [
+                {
+                    content: {
+                        membership: "invite",
+                    },
+                    state_key: "bob",
+                    sender: "alice",
+                    type: "m.room.member",
+                },
+            ],
+        };
+
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {
+                    "!invite:bar": {
+                        invite_state: initInviteState,
+                    },
+                },
+            ),
+        );
+        expect(sa.getJSON().roomsData.invite["!invite:bar"].invite_state).toBe(initInviteState);
+
+        const rejectMemberEvent: IStateEvent = {
+            event_id: "$" + Math.random(),
+            content: {
+                membership: "leave",
+            },
+            origin_server_ts: 123456789,
+            state_key: "bob",
+            sender: "bob",
+            type: "m.room.member",
+            unsigned: {
+                prev_content: {
+                    membership: "invite",
+                },
+            },
+        };
+        const leftRoomState = leftRoomSkeleton([rejectMemberEvent]);
+
+        // bob rejects invite
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {},
+                {
+                    "!invite:bar": leftRoomState,
+                },
+            ),
+        );
+
+        expect(sa.getJSON().roomsData.invite["!invite:bar"]).toBeUndefined();
+    });
+
+    it("should accumulate knock state", () => {
+        const initKnockState = {
+            events: [member("alice", "knock")],
+        };
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {},
+                {},
+                {
+                    knock_state: initKnockState,
+                },
+            ),
+        );
+        expect(sa.getJSON().roomsData.knock["!knock:bar"].knock_state).toBe(initKnockState);
+
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {},
+                {},
+                {
+                    knock_state: {
+                        events: [
+                            utils.mkEvent({
+                                user: "alice",
+                                room: "!knock:bar",
+                                type: "m.room.name",
+                                content: {
+                                    name: "Room 1",
+                                },
+                            }) as IStrippedState,
+                        ],
+                    },
+                },
+            ),
+        );
+
+        expect(
+            sa.getJSON().roomsData.knock["!knock:bar"].knock_state.events.find((e) => e.type === "m.room.name")?.content
+                .name,
+        ).toEqual("Room 1");
+
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {},
+                {},
+                {
+                    knock_state: {
+                        events: [
+                            utils.mkEvent({
+                                user: "alice",
+                                room: "!knock:bar",
+                                type: "m.room.name",
+                                content: {
+                                    name: "Room 2",
+                                },
+                            }) as IStrippedState,
+                        ],
+                    },
+                },
+            ),
+        );
+
+        expect(
+            sa.getJSON().roomsData.knock["!knock:bar"].knock_state.events.find((e) => e.type === "m.room.name")?.content
+                .name,
+        ).toEqual("Room 2");
+    });
+
+    it("should delete knocked room when knock request is approved", () => {
+        const initKnockState = makeKnockState();
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {},
+                {},
+                {
+                    knock_state: initKnockState,
+                },
+            ),
+        );
+        expect(sa.getJSON().roomsData.knock["!knock:bar"].knock_state).toBe(initKnockState);
+
+        // alice approves bob's knock request
+        const inviteStateEvents = [
+            {
+                content: {
+                    membership: "invite",
+                },
+                state_key: "bob",
+                sender: "alice",
+                type: "m.room.member",
+            },
+        ];
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {
+                    "!knock:bar": {
+                        invite_state: {
+                            events: inviteStateEvents,
+                        },
+                    },
+                },
+            ),
+        );
+
+        expect(sa.getJSON().roomsData.knock["!knock:bar"]).toBeUndefined();
+        expect(sa.getJSON().roomsData.invite["!knock:bar"].invite_state.events).toEqual(inviteStateEvents);
+    });
+
+    it("should delete knocked room when knock request is cancelled by user himself", () => {
+        // bob cancels his knock state
+        const memberEvent: IStateEvent = {
+            event_id: "$" + Math.random(),
+            content: {
+                membership: "leave",
+            },
+            origin_server_ts: 123456789,
+            state_key: "bob",
+            sender: "bob",
+            type: "m.room.member",
+            unsigned: {
+                prev_content: {
+                    membership: "knock",
+                },
+            },
+        };
+        const leftRoomState = leftRoomSkeleton([memberEvent]);
+
+        const initKnockState = makeKnockState();
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {},
+                {},
+                {
+                    knock_state: initKnockState,
+                },
+            ),
+        );
+        expect(sa.getJSON().roomsData.knock["!knock:bar"].knock_state).toBe(initKnockState);
+
+        // bob cancels his knock request
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {},
+                {
+                    "!knock:bar": leftRoomState,
+                },
+            ),
+        );
+
+        expect(sa.getJSON().roomsData.knock["!knock:bar"]).toBeUndefined();
+    });
+
+    it("should delete knocked room when knock request is denied by another user", () => {
+        // alice denies bob knock state
+        const memberEvent: IStateEvent = {
+            event_id: "$" + Math.random(),
+            content: {
+                membership: "leave",
+            },
+            origin_server_ts: 123456789,
+            state_key: "bob",
+            sender: "alice",
+            type: "m.room.member",
+            unsigned: {
+                prev_content: {
+                    membership: "knock",
+                },
+            },
+        };
+        const leftRoomState = leftRoomSkeleton([memberEvent]);
+
+        const initKnockState = makeKnockState();
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {},
+                {},
+                {
+                    knock_state: initKnockState,
+                },
+            ),
+        );
+        expect(sa.getJSON().roomsData.knock["!knock:bar"].knock_state).toBe(initKnockState);
+
+        // alice denies bob's knock request
+        sa.accumulate(
+            syncSkeleton(
+                {},
+                {},
+                {
+                    "!knock:bar": leftRoomState,
+                },
+            ),
+        );
+
+        expect(sa.getJSON().roomsData.knock["!knock:bar"]).toBeUndefined();
+    });
+
    it("should accumulate read receipts", () => {
        const receipt1 = {
            type: "m.receipt",
@@ -601,7 +883,12 @@ describe("SyncAccumulator", function () {
    });
 });

-function syncSkeleton(joinObj: Partial<IJoinedRoom>): ISyncResponse {
+function syncSkeleton(
+    joinObj: Partial<IJoinedRoom>,
+    invite?: Record<string, IInvitedRoom>,
+    leave?: Record<string, ILeftRoom>,
+    knockObj?: Partial<IKnockedRoom>,
+): ISyncResponse {
    joinObj = joinObj || {};
    return {
        next_batch: "abc",
@@ -609,10 +896,48 @@ function syncSkeleton(joinObj: Partial<IJoinedRoom>): ISyncResponse {
            join: {
                "!foo:bar": joinObj,
            },
+            invite,
+            leave,
+            knock: knockObj
+                ? {
+                      "!knock:bar": knockObj,
+                  }
+                : undefined,
        },
    } as unknown as ISyncResponse;
 }

+function leftRoomSkeleton(timelineEvents: Array<IRoomEvent | IStateEvent> = []): ILeftRoom {
+    return {
+        state: {
+            events: [],
+        },
+        timeline: {
+            events: timelineEvents,
+            prev_batch: "something",
+        },
+        account_data: {
+            events: [],
+        },
+    };
+}
+
+function makeKnockState(): IKnockState {
+    return {
+        events: [
+            utils.mkEvent({
+                user: "alice",
+                room: "!knock:bar",
+                type: "m.room.name",
+                content: {
+                    name: "Room",
+                },
+            }) as IStrippedState,
+            member("bob", "knock"),
+        ],
+    };
+}
+
 function msg(localpart: string, text: string) {
    return {
        event_id: "$" + Math.random(),
@@ -47,6 +47,7 @@ import {
 } from "../../test-utils/webrtc";
 import { CallFeed } from "../../../src/webrtc/callFeed";
 import { EventType, IContent, ISendEventResponse, MatrixEvent, Room } from "../../../src";
+import { emitPromise } from "../../test-utils/test-utils";

 const FAKE_ROOM_ID = "!foo:bar";
 const CALL_LIFETIME = 60000;
@@ -1812,4 +1813,30 @@ describe("Call", function () {
            expect(call.peerConn?.setRemoteDescription).toHaveBeenCalled();
        });
    });
+
+    it("should emit IceFailed error on the successor call if RTCPeerConnection throws", async () => {
+        // @ts-ignore - writing to window as we are simulating browser edge-cases
+        global.window = {};
+        Object.defineProperty(global.window, "RTCPeerConnection", {
+            get: () => {
+                throw Error("Secure mode, naaah!");
+            },
+        });
+
+        const call = new MatrixCall({
+            client: client.client,
+            roomId: "!room_id",
+        });
+        const successor = new MatrixCall({
+            client: client.client,
+            roomId: "!room_id",
+        });
+        call.replacedBy(successor);
+
+        const prom = emitPromise(successor, CallEvent.Error);
+        call.placeCall(true, true);
+
+        const err = await prom;
+        expect(err.code).toBe(CallErrorCode.IceFailed);
+    });
 });
@@ -71,7 +71,8 @@ describe("Group Call Event Handler", function () {
            getMember: (userId: string) => (userId === FAKE_USER_ID ? mockMember : null),
        } as unknown as Room;

-        (mockClient as any).getRoom = jest.fn().mockReturnValue(mockRoom);
+        mockClient.getRoom = jest.fn().mockReturnValue(mockRoom);
+        mockClient.getFoci.mockReturnValue([{}]);
    });

    describe("reacts to state changes", () => {
@@ -14,7 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import type { IClearEvent } from "../models/event";
 import type { ISignatures } from "./signed";

 export type OlmGroupSessionExtraData = {
@@ -22,33 +21,8 @@ export type OlmGroupSessionExtraData = {
    sharedHistory?: boolean;
 };

-/**
- * The result of a (successful) call to {@link Crypto.decryptEvent}
- */
-export interface IEventDecryptionResult {
-    /**
-     * The plaintext payload for the event (typically containing <tt>type</tt> and <tt>content</tt> fields).
-     */
-    clearEvent: IClearEvent;
-    /**
-     * List of curve25519 keys involved in telling us about the senderCurve25519Key and claimedEd25519Key.
-     * See {@link MatrixEvent#getForwardingCurve25519KeyChain}.
-     */
-    forwardingCurve25519KeyChain?: string[];
-    /**
-     * Key owned by the sender of this event.  See {@link MatrixEvent#getSenderKey}.
-     */
-    senderCurve25519Key?: string;
-    /**
-     * ed25519 key claimed by the sender of this event. See {@link MatrixEvent#getClaimedEd25519Key}.
-     */
-    claimedEd25519Key?: string;
-    untrusted?: boolean;
-    /**
-     * The sender doesn't authorize the unverified devices to decrypt his messages
-     */
-    encryptedDisabledForUnverifiedDevices?: boolean;
-}
+// Backwards compatible re-export
+export type { EventDecryptionResult as IEventDecryptionResult } from "../common-crypto/CryptoBackend";

 interface Extensible {
    [key: string]: any;
@@ -193,12 +193,6 @@ export interface IBindThreePidBody {
    sid: string;
 }

-export interface IAddThreePidBody {
-    client_secret: string;
-    id_server: string;
-    sid: string;
-}
-
 export interface IRelationsRequestOpts {
    from?: string;
    to?: string;
@@ -28,6 +28,7 @@ import {
    validateWellKnownAuthentication,
 } from "./oidc/validate";
 import { OidcError } from "./oidc/error";
+import { MINIMUM_MATRIX_VERSION } from "./version-support";

 // Dev note: Auto discovery is part of the spec.
 // See: https://matrix.org/docs/spec/client_server/r0.4.0.html#server-discovery
@@ -50,6 +51,9 @@ enum AutoDiscoveryError {
    InvalidIs = "Invalid identity server discovery response",
    MissingWellknown = "No .well-known JSON file found",
    InvalidJson = "Invalid JSON",
+    HomeserverTooOld = "The homeserver does not meet the minimum version requirements",
+    // TODO: Implement when Sydent supports the `/versions` endpoint - https://github.com/matrix-org/sydent/issues/424
+    //IdentityServerTooOld = "The identity server does not meet the minimum version requirements",
 }

 interface AutoDiscoveryState {
@@ -108,6 +112,8 @@ export class AutoDiscovery {

    public static readonly ERROR_INVALID_JSON = AutoDiscoveryError.InvalidJson;

+    public static readonly ERROR_HOMESERVER_TOO_OLD = AutoDiscoveryError.HomeserverTooOld;
+
    public static readonly ALL_ERRORS = Object.keys(AutoDiscoveryError);

    /**
@@ -199,7 +205,7 @@ export class AutoDiscovery {

        // Step 3: Make sure the homeserver URL points to a homeserver.
        const hsVersions = await this.fetchWellKnownObject<IServerVersions>(`${hsUrl}/_matrix/client/versions`);
-        if (!hsVersions?.raw?.["versions"]) {
+        if (!hsVersions || !Array.isArray(hsVersions.raw?.["versions"])) {
            logger.error("Invalid /versions response");
            clientConfig["m.homeserver"].error = AutoDiscovery.ERROR_INVALID_HOMESERVER;

@@ -210,6 +216,18 @@ export class AutoDiscovery {
            return Promise.resolve(clientConfig);
        }

+        // Step 3.1: Non-spec check to ensure the server will actually work for us
+        if (!hsVersions.raw!["versions"].includes(MINIMUM_MATRIX_VERSION)) {
+            logger.error("Homeserver does not meet minimum version requirements");
+            clientConfig["m.homeserver"].error = AutoDiscovery.ERROR_HOMESERVER_TOO_OLD;
+
+            // Supply the base_url to the caller because they may be ignoring liveliness
+            // errors, like this one.
+            clientConfig["m.homeserver"].base_url = hsUrl;
+
+            return Promise.resolve(clientConfig);
+        }
+
        // Step 4: Now that the homeserver looks valid, update our client config.
        clientConfig["m.homeserver"] = {
            state: AutoDiscovery.SUCCESS,
@@ -133,7 +133,6 @@ import {
    IFilterResponse,
    ITagsResponse,
    IStatusResponse,
-    IAddThreePidBody,
    KnockRoomOpts,
 } from "./@types/requests";
 import {
@@ -149,7 +148,7 @@ import {
    UNSTABLE_MSC3089_TREE_SUBTYPE,
    MSC3912_RELATION_BASED_REDACTIONS_PROP,
 } from "./@types/event";
-import { IdServerUnbindResult, IImageInfo, Preset, Visibility } from "./@types/partials";
+import { IdServerUnbindResult, IImageInfo, JoinRule, Preset, Visibility } from "./@types/partials";
 import { EventMapper, eventMapperFor, MapperOpts } from "./event-mapper";
 import { randomString } from "./randomstring";
 import { BackupManager, IKeyBackup, IKeyBackupCheck, IPreparedKeyBackupVersion, TrustInfo } from "./crypto/backup";
@@ -220,6 +219,7 @@ import {
    ServerSideSecretStorageImpl,
 } from "./secret-storage";
 import { RegisterRequest, RegisterResponse } from "./@types/registration";
+import { MatrixRTCSessionManager } from "./matrixrtc/MatrixRTCSessionManager";

 export type Store = IStore;

@@ -383,6 +383,8 @@ export interface ICreateClientOpts {
     */
    useE2eForGroupCall?: boolean;

+    livekitServiceURL?: string;
+
    /**
     * Crypto callbacks provided by the application
     */
@@ -400,6 +402,12 @@ export interface ICreateClientOpts {
     * Default: false.
     */
    isVoipWithNoMediaAllowed?: boolean;
+
+    /**
+     * If true, group calls will not establish media connectivity and only create the signaling events,
+     * so that livekit media can be used in the application layert (js-sdk contains no livekit code).
+     */
+    useLivekitForGroupCalls?: boolean;
 }

 export interface IMatrixClientCreateOpts extends ICreateClientOpts {
@@ -737,6 +745,7 @@ export interface IPublicRoomsChunkRoom {
    guest_can_join: boolean;
    num_joined_members: number;
    room_type?: RoomType | string; // Added by MSC3827
+    join_rule?: JoinRule.Knock | JoinRule.Public; // Added by MSC2403
 }

 interface IPublicRoomsResponse {
@@ -1211,6 +1220,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
    public baseUrl: string;
    public readonly isVoipWithNoMediaAllowed;

+    public useLivekitForGroupCalls: boolean;
+
    // Note: these are all `protected` to let downstream consumers make mistakes if they want to.
    // We don't technically support this usage, but have reasons to do this.

@@ -1258,12 +1269,15 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa

    private useE2eForGroupCall = true;
    private toDeviceMessageQueue: ToDeviceMessageQueue;
+    public livekitServiceURL?: string;

    private _secretStorage: ServerSideSecretStorageImpl;

    // A manager for determining which invites should be ignored.
    public readonly ignoredInvites: IgnoredInvites;

+    public readonly matrixRTC: MatrixRTCSessionManager;
+
    public constructor(opts: IMatrixClientCreateOpts) {
        super();

@@ -1287,7 +1301,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            baseUrl: opts.baseUrl,
            idBaseUrl: opts.idBaseUrl,
            accessToken: opts.accessToken,
-            prefix: ClientPrefix.R0,
+            prefix: ClientPrefix.V3,
            onlyData: true,
            extraParams: opts.queryParams,
            localTimeoutMs: opts.localTimeoutMs,
@@ -1317,6 +1331,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            this.pickleKey = opts.pickleKey;
        }

+        this.useLivekitForGroupCalls = Boolean(opts.useLivekitForGroupCalls);
+
        this.scheduler = opts.scheduler;
        if (this.scheduler) {
            this.scheduler.setProcessFunction(async (eventToSend: MatrixEvent) => {
@@ -1344,6 +1360,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            this.on(ClientEvent.Sync, this.startCallEventHandler);
        }

+        // NB. We initialise MatrixRTC whether we have call support or not: this is just
+        // the underlying session management and doesn't use any actual media capabilities
+        this.matrixRTC = new MatrixRTCSessionManager(this);
+
        this.on(ClientEvent.Sync, this.fixupRoomNotifications);

        this.timelineSupport = Boolean(opts.timelineSupport);
@@ -1360,6 +1380,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa

        if (opts.useE2eForGroupCall !== undefined) this.useE2eForGroupCall = opts.useE2eForGroupCall;

+        this.livekitServiceURL = opts.livekitServiceURL;
+
        // List of which rooms have encryption enabled: separate from crypto because
        // we still want to know which rooms are encrypted even if crypto is disabled:
        // we don't want to start sending unencrypted events to them.
@@ -1442,6 +1464,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            return;
        }
        this.clientRunning = true;
+
+        this.on(ClientEvent.Sync, this.startMatrixRTC);
+
        // backwards compat for when 'opts' was 'historyLen'.
        if (typeof opts === "number") {
            opts = {
@@ -1544,6 +1569,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
    public stopClient(): void {
        this.cryptoBackend?.stop(); // crypto might have been initialised even if the client wasn't fully started

+        this.off(ClientEvent.Sync, this.startMatrixRTC);
+
        if (!this.clientRunning) return; // already stopped

        logger.log("stopping MatrixClient");
@@ -1568,6 +1595,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        }

        this.toDeviceMessageQueue.stop();
+
+        this.matrixRTC.stop();
    }

    /**
@@ -1748,8 +1777,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            let indexedDB: IDBFactory;
            try {
                indexedDB = global.indexedDB;
+                if (!indexedDB) return; // No indexedDB support
            } catch (e) {
-                // No indexeddb support
+                // No indexedDB support
                return;
            }
            for (const dbname of [
@@ -1937,9 +1967,21 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            dataChannelsEnabled || this.isVoipWithNoMediaAllowed,
            dataChannelOptions,
            this.isVoipWithNoMediaAllowed,
+            this.useLivekitForGroupCalls,
+            this.livekitServiceURL,
        ).create();
    }

+    public getLivekitServiceURL(): string | undefined {
+        return this.livekitServiceURL;
+    }
+
+    // This shouldn't need to exist, but the widget API has startup ordering problems that
+    // mean it doesn't know the livekit URL fast enough: remove this once this is fixed.
+    public setLivekitServiceURL(newURL: string): void {
+        this.livekitServiceURL = newURL;
+    }
+
    /**
     * Wait until an initial state for the given room has been processed by the
     * client and the client is aware of any ongoing group calls. Awaiting on
@@ -2252,6 +2294,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        this.reEmitter.reEmit(rustCrypto, [
            CryptoEvent.VerificationRequestReceived,
            CryptoEvent.UserTrustStatusChanged,
+            CryptoEvent.KeyBackupStatus,
+            CryptoEvent.KeyBackupSessionsRemaining,
+            CryptoEvent.KeyBackupFailed,
        ]);
    }

@@ -2442,6 +2487,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *
     * @returns resolves to a VerificationRequest
     *    when the request has been sent to the other party.
+     *
+     * @deprecated Prefer {@link CryptoApi.requestVerificationDM}.
     */
    public requestVerificationDM(userId: string, roomId: string): Promise<VerificationRequest> {
        if (!this.crypto) {
@@ -2623,6 +2670,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @param userId - the user ID to get the cross-signing info for.
     *
     * @returns the cross signing information for the user.
+     * @deprecated Prefer {@link CryptoApi#userHasCrossSigningKeys}
     */
    public getStoredCrossSigningForUser(userId: string): CrossSigningInfo | null {
        if (!this.cryptoBackend) {
@@ -2637,6 +2685,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * The cross-signing API is currently UNSTABLE and may change without notice.
     *
     * @param userId - The ID of the user to check.
+     *
+     * @deprecated Use {@link Crypto.CryptoApi.getUserVerificationStatus | `CryptoApi.getUserVerificationStatus`}
     */
    public checkUserTrust(userId: string): UserTrustLevel {
        if (!this.cryptoBackend) {
@@ -2840,6 +2890,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *
     * @param event - event to be checked
     * @returns The event information.
+     * @deprecated Prefer {@link CryptoApi.getEncryptionInfoForEvent | `CryptoApi.getEncryptionInfoForEvent`}.
     */
    public getEventEncryptionInfo(event: MatrixEvent): IEncryptedEventInfo {
        if (!this.cryptoBackend) {
@@ -3251,6 +3302,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *     getKeyBackupVersion) in backupInfo and
     *     trust information (as returned by isKeyBackupTrusted)
     *     in trustInfo.
+     *
+     * @deprecated Prefer {@link CryptoApi.checkKeyBackupAndEnable}.
     */
    public checkKeyBackup(): Promise<IKeyBackupCheck | null> {
        if (!this.crypto) {
@@ -3262,6 +3315,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
    /**
     * Get information about the current key backup.
     * @returns Information object from API or null
+     *
+     * @deprecated Prefer {@link CryptoApi.checkKeyBackupAndEnable}.
     */
    public async getKeyBackupVersion(): Promise<IKeyBackupInfo | null> {
        let res: IKeyBackupInfo;
@@ -3320,6 +3375,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *
     * @param info - Backup information object as returned by getKeyBackupVersion
     * @returns Promise which resolves when complete.
+     *
+     * @deprecated Do not call this directly. Instead call {@link CryptoApi.checkKeyBackupAndEnable}.
     */
    public enableKeyBackup(info: IKeyBackupInfo): Promise<void> {
        if (!this.crypto) {
@@ -3331,6 +3388,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa

    /**
     * Disable backing up of keys.
+     *
+     * @deprecated It should be unnecessary to disable key backup.
     */
    public disableKeyBackup(): void {
        if (!this.crypto) {
@@ -3350,6 +3409,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *
     * @returns Object that can be passed to createKeyBackupVersion and
     *     additionally has a 'recovery_key' member with the user-facing recovery key string.
+     *
+     * @deprecated Use {@link Crypto.CryptoApi.resetKeyBackup | `CryptoApi.resetKeyBackup`}.
     */
    public async prepareKeyBackupVersion(
        password?: string | Uint8Array | null,
@@ -3393,6 +3454,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *
     * @param info - Info object from prepareKeyBackupVersion
     * @returns Object with 'version' param indicating the version created
+     *
+     * @deprecated Use {@link Crypto.CryptoApi.resetKeyBackup | `CryptoApi.resetKeyBackup`}.
     */
    public async createKeyBackupVersion(info: IKeyBackupInfo): Promise<IKeyBackupInfo> {
        if (!this.crypto) {
@@ -3425,9 +3488,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            await this.crypto.crossSigningInfo.signObject(data.auth_data, "master");
        }

-        const res = await this.http.authedRequest<IKeyBackupInfo>(Method.Post, "/room_keys/version", undefined, data, {
-            prefix: ClientPrefix.V3,
-        });
+        const res = await this.http.authedRequest<IKeyBackupInfo>(Method.Post, "/room_keys/version", undefined, data);

        // We could assume everything's okay and enable directly, but this ensures
        // we run the same signature verification that will be used for future
@@ -3440,29 +3501,17 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        return res;
    }

+    /**
+     * @deprecated Use {@link Crypto.CryptoApi.deleteKeyBackupVersion | `CryptoApi.deleteKeyBackupVersion`}.
+     */
    public async deleteKeyBackupVersion(version: string): Promise<void> {
-        if (!this.crypto) {
+        if (!this.cryptoBackend) {
            throw new Error("End-to-end encryption disabled");
        }

-        // If we're currently backing up to this backup... stop.
-        // (We start using it automatically in createKeyBackupVersion
-        // so this is symmetrical).
-        // TODO: convert this to use crypto.getActiveSessionBackupVersion. And actually check the version.
-        if (this.crypto.backupManager.version) {
-            this.crypto.backupManager.disableKeyBackup();
-        }
-
-        const path = utils.encodeUri("/room_keys/version/$version", {
-            $version: version,
-        });
-
-        await this.http.authedRequest(Method.Delete, path, undefined, undefined, { prefix: ClientPrefix.V3 });
+        await this.cryptoBackend.deleteKeyBackupVersion(version);
    }

-    private makeKeyBackupPath(roomId: undefined, sessionId: undefined, version?: string): IKeyBackupPath;
-    private makeKeyBackupPath(roomId: string, sessionId: undefined, version?: string): IKeyBackupPath;
-    private makeKeyBackupPath(roomId: string, sessionId: string, version?: string): IKeyBackupPath;
    private makeKeyBackupPath(roomId?: string, sessionId?: string, version?: string): IKeyBackupPath {
        let path: string;
        if (sessionId !== undefined) {
@@ -3591,7 +3640,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * Restores all rooms if omitted.
     * @param targetSessionId - Session ID to target a specific session.
     * Restores all sessions if omitted.
-     * @param backupInfo - Backup metadata from `checkKeyBackup`
+     * @param backupInfo - Backup metadata from `getKeyBackupVersion` or `checkKeyBackup`.`backupInfo`
     * @param opts - Optional params such as callbacks
     * @returns Status of restoration with `total` and `imported`
     * key counts.
@@ -3782,22 +3831,13 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        let totalKeyCount = 0;
        let keys: IMegolmSessionData[] = [];

-        const path = this.makeKeyBackupPath(targetRoomId!, targetSessionId!, backupInfo.version);
+        const path = this.makeKeyBackupPath(targetRoomId, targetSessionId, backupInfo.version);

-        const algorithm = await BackupManager.makeAlgorithm(backupInfo, async () => {
-            return privKey;
-        });
+        const backupDecryptor = await this.cryptoBackend.getBackupDecryptor(backupInfo, privKey);

-        const untrusted = algorithm.untrusted;
+        const untrusted = !backupDecryptor.sourceTrusted;

        try {
-            // If the pubkey computed from the private data we've been given
-            // doesn't match the one in the auth_data, the user has entered
-            // a different recovery key / the wrong passphrase.
-            if (!(await algorithm.keyMatches(privKey))) {
-                return Promise.reject(new MatrixError({ errcode: MatrixClient.RESTORE_BACKUP_ERROR_BAD_KEY }));
-            }
-
            if (!(privKey instanceof Uint8Array)) {
                // eslint-disable-next-line @typescript-eslint/no-base-to-string
                throw new Error(`restoreKeyBackup expects Uint8Array, got ${privKey}`);
@@ -3831,7 +3871,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                    if (!roomData.sessions) continue;

                    totalKeyCount += Object.keys(roomData.sessions).length;
-                    const roomKeys = await algorithm.decryptSessions(roomData.sessions);
+                    const roomKeys = await backupDecryptor.decryptSessions(roomData.sessions);
                    for (const k of roomKeys) {
                        k.room_id = roomId;
                        keys.push(k);
@@ -3840,14 +3880,14 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            } else if ((res as IRoomKeysResponse).sessions) {
                const sessions = (res as IRoomKeysResponse).sessions;
                totalKeyCount = Object.keys(sessions).length;
-                keys = await algorithm.decryptSessions(sessions);
+                keys = await backupDecryptor.decryptSessions(sessions);
                for (const k of keys) {
                    k.room_id = targetRoomId!;
                }
            } else {
                totalKeyCount = 1;
                try {
-                    const [key] = await algorithm.decryptSessions({
+                    const [key] = await backupDecryptor.decryptSessions({
                        [targetSessionId!]: res as IKeyBackupSession,
                    });
                    key.room_id = targetRoomId!;
@@ -3858,7 +3898,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                }
            }
        } finally {
-            algorithm.free();
+            backupDecryptor.free();
        }

        await this.cryptoBackend.importRoomKeys(keys, {
@@ -3867,7 +3907,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            source: "backup",
        });

-        await this.checkKeyBackup();
+        /// in case entering the passphrase would add a new signature?
+        await this.cryptoBackend.checkKeyBackupAndEnable();

        return { total: totalKeyCount, imported: keys.length };
    }
@@ -3924,7 +3965,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     */
    public getMediaConfig(): Promise<IMediaConfig> {
        return this.http.authedRequest(Method.Get, "/config", undefined, undefined, {
-            prefix: MediaPrefix.R0,
+            prefix: MediaPrefix.V3,
        });
    }

@@ -5179,7 +5220,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            },
            undefined,
            {
-                prefix: MediaPrefix.R0,
+                prefix: MediaPrefix.V3,
                priority: "low",
            },
        );
@@ -5346,7 +5387,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            address: address,
        };

-        if (this.identityServer?.getAccessToken && (await this.doesServerAcceptIdentityAccessToken())) {
+        if (this.identityServer?.getAccessToken) {
            const identityAccessToken = await this.identityServer.getAccessToken();
            if (identityAccessToken) {
                params["id_access_token"] = identityAccessToken;
@@ -6138,7 +6179,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        const opts = {
            prefix:
                Thread.hasServerSideListSupport === FeatureSupport.Stable
-                    ? "/_matrix/client/v1"
+                    ? ClientPrefix.V1
                    : "/_matrix/client/unstable/org.matrix.msc3856",
        };

@@ -6664,20 +6705,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
    ): Promise<T> {
        const postParams = Object.assign({}, params);

-        // If the HS supports separate add and bind, then requestToken endpoints
-        // don't need an IS as they are all validated by the HS directly.
-        if (!(await this.doesServerSupportSeparateAddAndBind()) && this.idBaseUrl) {
-            const idServerUrl = new URL(this.idBaseUrl);
-            postParams.id_server = idServerUrl.host;
-
-            if (this.identityServer?.getAccessToken && (await this.doesServerAcceptIdentityAccessToken())) {
-                const identityAccessToken = await this.identityServer.getAccessToken();
-                if (identityAccessToken) {
-                    postParams.id_access_token = identityAccessToken;
-                }
-            }
-        }
-
        return this.http.request(Method.Post, endpoint, undefined, postParams);
    }

@@ -7062,12 +7089,23 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa

    private startCallEventHandler = (): void => {
        if (this.isInitialSyncComplete()) {
-            this.callEventHandler!.start();
-            this.groupCallEventHandler!.start();
+            if (supportsMatrixCall()) {
+                this.callEventHandler!.start();
+                this.groupCallEventHandler!.start();
+            }
+
            this.off(ClientEvent.Sync, this.startCallEventHandler);
        }
    };

+    private startMatrixRTC = (): void => {
+        if (this.isInitialSyncComplete()) {
+            this.matrixRTC.start();
+
+            this.off(ClientEvent.Sync, this.startMatrixRTC);
+        }
+    };
+
    /**
     * Once the client has been initialised, we want to clear notifications we
     * know for a fact should be here.
@@ -7382,78 +7420,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        return versions && versions.includes(version);
    }

-    /**
-     * Query the server to see if it supports members lazy loading
-     * @returns true if server supports lazy loading
-     */
-    public async doesServerSupportLazyLoading(): Promise<boolean> {
-        const response = await this.getVersions();
-        if (!response) return false;
-
-        const versions = response["versions"];
-        const unstableFeatures = response["unstable_features"];
-
-        return (
-            (versions && versions.includes("r0.5.0")) || (unstableFeatures && unstableFeatures["m.lazy_load_members"])
-        );
-    }
-
-    /**
-     * Query the server to see if the `id_server` parameter is required
-     * when registering with an 3pid, adding a 3pid or resetting password.
-     * @returns true if id_server parameter is required
-     */
-    public async doesServerRequireIdServerParam(): Promise<boolean> {
-        const response = await this.getVersions();
-        if (!response) return true;
-
-        const versions = response["versions"];
-
-        // Supporting r0.6.0 is the same as having the flag set to false
-        if (versions && versions.includes("r0.6.0")) {
-            return false;
-        }
-
-        const unstableFeatures = response["unstable_features"];
-        if (!unstableFeatures) return true;
-        if (unstableFeatures["m.require_identity_server"] === undefined) {
-            return true;
-        } else {
-            return unstableFeatures["m.require_identity_server"];
-        }
-    }
-
-    /**
-     * Query the server to see if the `id_access_token` parameter can be safely
-     * passed to the homeserver. Some homeservers may trigger errors if they are not
-     * prepared for the new parameter.
-     * @returns true if id_access_token can be sent
-     */
-    public async doesServerAcceptIdentityAccessToken(): Promise<boolean> {
-        const response = await this.getVersions();
-        if (!response) return false;
-
-        const versions = response["versions"];
-        const unstableFeatures = response["unstable_features"];
-        return (versions && versions.includes("r0.6.0")) || (unstableFeatures && unstableFeatures["m.id_access_token"]);
-    }
-
-    /**
-     * Query the server to see if it supports separate 3PID add and bind functions.
-     * This affects the sequence of API calls clients should use for these operations,
-     * so it's helpful to be able to check for support.
-     * @returns true if separate functions are supported
-     */
-    public async doesServerSupportSeparateAddAndBind(): Promise<boolean> {
-        const response = await this.getVersions();
-        if (!response) return false;
-
-        const versions = response["versions"];
-        const unstableFeatures = response["unstable_features"];
-
-        return versions?.includes("r0.6.0") || unstableFeatures?.["m.separate_add_and_bind"];
-    }
-
    /**
     * Query the server to see if it lists support for an unstable feature
     * in the /versions response
@@ -7525,14 +7491,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        }
    }

-    /**
-     * Query the server to see if it supports the MSC2457 `logout_devices` parameter when setting password
-     * @returns true if server supports the `logout_devices` parameter
-     */
-    public doesServerSupportLogoutDevices(): Promise<boolean> {
-        return this.isVersionSupported("r0.6.1");
-    }
-
    /**
     * Get if lazy loading members is being used.
     * @returns Whether or not members are lazy loaded by this client
@@ -7917,18 +7875,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        });
    }

-    /**
-     * @param relayState - URL Callback after SAML2 Authentication
-     * @returns Promise which resolves to a LoginResponse object
-     * @returns Rejects: with an error response.
-     * @deprecated this isn't in the Matrix spec anymore
-     */
-    public loginWithSAML2(relayState: string): Promise<LoginResponse> {
-        return this.login("m.login.saml2", {
-            relay_state: relayState,
-        });
-    }
-
    /**
     * @param redirectUrl - The URL to redirect to after the HS
     * authenticates with CAS.
@@ -7958,7 +7904,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            [SSO_ACTION_PARAM.unstable!]: action,
        };

-        return this.http.getUrl(url, params, ClientPrefix.R0).href;
+        return this.http.getUrl(url, params).href;
    }

    /**
@@ -8076,13 +8022,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            $loginType: loginType,
        });

-        return this.http.getUrl(
-            path,
-            {
-                session: authSessionId,
-            },
-            ClientPrefix.R0,
-        ).href;
+        return this.http.getUrl(path, {
+            session: authSessionId,
+        }).href;
    }

    /**
@@ -8097,11 +8039,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa

        // inject the id_access_token if inviting 3rd party addresses
        const invitesNeedingToken = (options.invite_3pid || []).filter((i) => !i.id_access_token);
-        if (
-            invitesNeedingToken.length > 0 &&
-            this.identityServer?.getAccessToken &&
-            (await this.doesServerAcceptIdentityAccessToken())
-        ) {
+        if (invitesNeedingToken.length > 0 && this.identityServer?.getAccessToken) {
            const identityAccessToken = await this.identityServer.getAccessToken();
            if (identityAccessToken) {
                for (const invite of invitesNeedingToken) {
@@ -8460,30 +8398,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        return this.http.authedRequest(Method.Put, path, undefined, { visibility });
    }

-    /**
-     * Set the visbility of a room bridged to a 3rd party network in
-     * the current HS's room directory.
-     * @param networkId - the network ID of the 3rd party
-     *                 instance under which this room is published under.
-     * @param visibility - "public" to make the room visible
-     *                 in the public directory, or "private" to make
-     *                 it invisible.
-     * @returns Promise which resolves: result object
-     * @returns Rejects: with an error response.
-     * @deprecated missing from the spec
-     */
-    public setRoomDirectoryVisibilityAppService(
-        networkId: string,
-        roomId: string,
-        visibility: "public" | "private",
-    ): Promise<any> {
-        const path = utils.encodeUri("/directory/list/appservice/$networkId/$roomId", {
-            $networkId: networkId,
-            $roomId: roomId,
-        });
-        return this.http.authedRequest(Method.Put, path, undefined, { visibility: visibility });
-    }
-
    /**
     * Query the user directory with a term matching user IDs, display names and domains.
     * @param term - the term with which to search.
@@ -8566,31 +8480,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        return this.http.authedRequest(Method.Get, "/account/3pid");
    }

-    /**
-     * Add a 3PID to your homeserver account and optionally bind it to an identity
-     * server as well. An identity server is required as part of the `creds` object.
-     *
-     * @deprecated this API is deprecated, and you should instead use `addThreePidOnly` for homeservers that support it.
-     *
-     * @returns Promise which resolves: on success
-     * @returns Rejects: with an error response.
-     */
-    public addThreePid(creds: IAddThreePidBody, bind: boolean): Promise<{ submit_url?: string }> {
-        const path = "/account/3pid";
-        const data = {
-            threePidCreds: creds,
-            bind: bind,
-        };
-        return this.http.authedRequest(Method.Post, path, undefined, data);
-    }
-
    /**
     * Add a 3PID to your homeserver account. This API does not use an identity
     * server, as the homeserver is expected to handle 3PID ownership validation.
     *
-     * You can check whether a homeserver supports this API via
-     * `doesServerSupportSeparateAddAndBind`.
-     *
     * @param data - A object with 3PID validation data from having called
     * `account/3pid/<medium>/requestToken` on the homeserver.
     * @returns Promise which resolves: to an empty object `{}`
@@ -8598,8 +8491,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     */
    public async addThreePidOnly(data: IAddThreePidOnlyBody): Promise<{}> {
        const path = "/account/3pid/add";
-        const prefix = (await this.isVersionSupported("r0.6.0")) ? ClientPrefix.R0 : ClientPrefix.Unstable;
-        return this.http.authedRequest(Method.Post, path, undefined, data, { prefix });
+        return this.http.authedRequest(Method.Post, path, undefined, data);
    }

    /**
@@ -8607,9 +8499,6 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * identity server handles 3PID ownership validation and the homeserver records
     * the new binding to track where all 3PIDs for the account are bound.
     *
-     * You can check whether a homeserver supports this API via
-     * `doesServerSupportSeparateAddAndBind`.
-     *
     * @param data - A object with 3PID validation data from having called
     * `validate/<medium>/requestToken` on the identity server. It should also
     * contain `id_server` and `id_access_token` fields as well.
@@ -8618,8 +8507,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     */
    public async bindThreePid(data: IBindThreePidBody): Promise<{}> {
        const path = "/account/3pid/bind";
-        const prefix = (await this.isVersionSupported("r0.6.0")) ? ClientPrefix.R0 : ClientPrefix.Unstable;
-        return this.http.authedRequest(Method.Post, path, undefined, data, { prefix });
+        return this.http.authedRequest(Method.Post, path, undefined, data);
    }

    /**
@@ -8644,8 +8532,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            address,
            id_server: this.getIdentityServerUrl(true),
        };
-        const prefix = (await this.isVersionSupported("r0.6.0")) ? ClientPrefix.R0 : ClientPrefix.Unstable;
-        return this.http.authedRequest(Method.Post, path, undefined, data, { prefix });
+        return this.http.authedRequest(Method.Post, path, undefined, data);
    }

    /**
@@ -8953,9 +8840,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
    }

    public uploadKeySignatures(content: KeySignatures): Promise<IUploadKeySignaturesResponse> {
-        return this.http.authedRequest(Method.Post, "/keys/signatures/upload", undefined, content, {
-            prefix: ClientPrefix.V3,
-        });
+        return this.http.authedRequest(Method.Post, "/keys/signatures/upload", undefined, content);
    }

    /**
@@ -15,12 +15,13 @@ limitations under the License.
 */

 import type { IDeviceLists, IToDeviceEvent } from "../sync-accumulator";
-import { MatrixEvent } from "../models/event";
+import { IClearEvent, MatrixEvent } from "../models/event";
 import { Room } from "../models/room";
 import { CryptoApi } from "../crypto-api";
 import { CrossSigningInfo, UserTrustLevel } from "../crypto/CrossSigning";
 import { IEncryptedEventInfo } from "../crypto/api";
-import { IEventDecryptionResult } from "../@types/crypto";
+import { KeyBackupInfo, KeyBackupSession } from "../crypto-api/keybackup";
+import { IMegolmSessionData } from "../@types/crypto";

 /**
 * Common interface for the crypto implementations
@@ -47,9 +48,9 @@ export interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {
    /**
     * Get the verification level for a given user
     *
-     * TODO: define this better
-     *
     * @param userId - user to be checked
+     *
+     * @deprecated Superceded by {@link CryptoApi#getUserVerificationStatus}.
     */
    checkUserTrust(userId: string): UserTrustLevel;

@@ -71,7 +72,7 @@ export interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {
     * @returns a promise which resolves once we have finished decrypting.
     * Rejects with an error if there is a problem decrypting the event.
     */
-    decryptEvent(event: MatrixEvent): Promise<IEventDecryptionResult>;
+    decryptEvent(event: MatrixEvent): Promise<EventDecryptionResult>;

    /**
     * Get information about the encryption of an event
@@ -88,6 +89,7 @@ export interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {
     * @param userId - the user ID to get the cross-signing info for.
     *
     * @returns the cross signing information for the user.
+     * @deprecated Prefer {@link CryptoApi#userHasCrossSigningKeys}
     */
    getStoredCrossSigningForUser(userId: string): CrossSigningInfo | null;

@@ -99,6 +101,13 @@ export interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {
     * @deprecated Unneeded for the new crypto
     */
    checkOwnCrossSigningTrust(opts?: CheckOwnCrossSigningTrustOpts): Promise<void>;
+
+    /**
+     * Get a backup decryptor capable of decrypting megolm session data encrypted with the given backup information.
+     * @param backupInfo - The backup information
+     * @param privKey - The private decryption key.
+     */
+    getBackupDecryptor(backupInfo: KeyBackupInfo, privKey: ArrayLike<number>): Promise<BackupDecryptor>;
 }

 /** The methods which crypto implementations should expose to the Sync api
@@ -181,3 +190,67 @@ export interface OnSyncCompletedData {
 export interface CheckOwnCrossSigningTrustOpts {
    allowPrivateKeyRequests?: boolean;
 }
+
+/**
+ * The result of a (successful) call to {@link CryptoBackend.decryptEvent}
+ */
+export interface EventDecryptionResult {
+    /**
+     * The plaintext payload for the event (typically containing <tt>type</tt> and <tt>content</tt> fields).
+     */
+    clearEvent: IClearEvent;
+    /**
+     * List of curve25519 keys involved in telling us about the senderCurve25519Key and claimedEd25519Key.
+     * See {@link MatrixEvent#getForwardingCurve25519KeyChain}.
+     */
+    forwardingCurve25519KeyChain?: string[];
+    /**
+     * Key owned by the sender of this event.  See {@link MatrixEvent#getSenderKey}.
+     */
+    senderCurve25519Key?: string;
+    /**
+     * ed25519 key claimed by the sender of this event. See {@link MatrixEvent#getClaimedEd25519Key}.
+     */
+    claimedEd25519Key?: string;
+    /**
+     * Whether the keys for this event have been received via an unauthenticated source (eg via key forwards, or
+     * restored from backup)
+     */
+    untrusted?: boolean;
+    /**
+     * The sender doesn't authorize the unverified devices to decrypt his messages
+     */
+    encryptedDisabledForUnverifiedDevices?: boolean;
+}
+
+/**
+ * Responsible for decrypting megolm session data retrieved from a remote backup.
+ * The result of {@link CryptoBackend#getBackupDecryptor}.
+ */
+export interface BackupDecryptor {
+    /**
+     * Whether keys retrieved from this backup can be trusted.
+     *
+     * Depending on the backup algorithm, keys retrieved from the backup can be trusted or not.
+     * If false, keys retrieved from the backup  must be considered unsafe (authenticity cannot be guaranteed).
+     * It could be by design (deniability) or for some technical reason (eg asymmetric encryption).
+     */
+    readonly sourceTrusted: boolean;
+
+    /**
+     *
+     * Decrypt megolm session data retrieved from backup.
+     *
+     * @param ciphertexts - a Record of sessionId to session data.
+     *
+     * @returns An array of decrypted `IMegolmSessionData`
+     */
+    decryptSessions(ciphertexts: Record<string, KeyBackupSession>): Promise<IMegolmSessionData[]>;
+
+    /**
+     * Free any resources held by this decryptor.
+     *
+     * Should be called once the decryptor is no longer needed.
+     */
+    free(): void;
+}
@@ -0,0 +1,46 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+/**
+ * Base64 encoding and decoding utility for crypo.
+ */
+
+/**
+ * Encode a typed array of uint8 as base64.
+ * @param uint8Array - The data to encode.
+ * @returns The base64.
+ */
+export function encodeBase64(uint8Array: ArrayBuffer | Uint8Array): string {
+    return Buffer.from(uint8Array).toString("base64");
+}
+
+/**
+ * Encode a typed array of uint8 as unpadded base64.
+ * @param uint8Array - The data to encode.
+ * @returns The unpadded base64.
+ */
+export function encodeUnpaddedBase64(uint8Array: ArrayBuffer | Uint8Array): string {
+    return encodeBase64(uint8Array).replace(/={1,2}$/, "");
+}
+
+/**
+ * Decode a base64 string to a typed array of uint8.
+ * @param base64 - The base64 to decode.
+ * @returns The decoded data.
+ */
+export function decodeBase64(base64: string): Uint8Array {
+    return Buffer.from(base64, "base64");
+}
@@ -49,7 +49,7 @@ export function getHttpUriForMxc(
        }
    }
    let serverAndMediaId = mxc.slice(6); // strips mxc://
-    let prefix = "/_matrix/media/r0/download/";
+    let prefix = "/_matrix/media/v3/download/";
    const params: Record<string, string> = {};

    if (width) {
@@ -64,7 +64,7 @@ export function getHttpUriForMxc(
    if (Object.keys(params).length > 0) {
        // these are thumbnailing params so they probably want the
        // thumbnailing API...
-        prefix = "/_matrix/media/r0/thumbnail/";
+        prefix = "/_matrix/media/v3/thumbnail/";
    }

    const fragmentOffset = serverAndMediaId.indexOf("#");
@@ -20,8 +20,9 @@ import { DeviceMap } from "./models/device";
 import { UIAuthCallback } from "./interactive-auth";
 import { AddSecretStorageKeyOpts, SecretStorageCallbacks, SecretStorageKeyDescription } from "./secret-storage";
 import { VerificationRequest } from "./crypto-api/verification";
-import { BackupTrustInfo, KeyBackupInfo } from "./crypto-api/keybackup";
+import { BackupTrustInfo, KeyBackupCheck, KeyBackupInfo } from "./crypto-api/keybackup";
 import { ISignatures } from "./@types/signed";
+import { MatrixEvent } from "./models/event";

 /**
 * Public interface to the cryptography parts of the js-sdk
@@ -38,16 +39,6 @@ export interface CryptoApi {
     */
    globalBlacklistUnverifiedDevices: boolean;

-    /**
-     * Checks if the user has previously published cross-signing keys
-     *
-     * This means downloading the devicelist for the user and checking if the list includes
-     * the cross-signing pseudo-device.
-     *
-     * @returns true if the user has previously published cross-signing keys
-     */
-    userHasCrossSigningKeys(): Promise<boolean>;
-
    /**
     * Perform any background tasks that can be done before a message is ready to
     * send, in order to speed up sending of the message.
@@ -88,6 +79,22 @@ export interface CryptoApi {
     */
    importRoomKeys(keys: IMegolmSessionData[], opts?: ImportRoomKeysOpts): Promise<void>;

+    /**
+     * Check if the given user has published cross-signing keys.
+     *
+     * - If the user is tracked, a `/keys/query` request is made to update locally the cross signing keys.
+     * - If the user is not tracked locally and downloadUncached is set to true,
+     *   a `/keys/query` request is made to the server to retrieve the cross signing keys.
+     * - Otherwise, return false
+     *
+     * @param userId - the user ID to check. Defaults to the local user.
+     * @param downloadUncached - If true, download the device list for users whose device list we are not
+     *    currently tracking. Defaults to false, in which case `false` will be returned for such users.
+     *
+     * @returns true if the cross signing keys are available.
+     */
+    userHasCrossSigningKeys(userId?: string, downloadUncached?: boolean): Promise<boolean>;
+
    /**
     * Get the device information for the given list of users.
     *
@@ -126,6 +133,14 @@ export interface CryptoApi {
     */
    getTrustCrossSignedDevices(): boolean;

+    /**
+     * Get the verification status of a given user.
+     *
+     * @param userId - The ID of the user to check.
+     *
+     */
+    getUserVerificationStatus(userId: string): Promise<UserVerificationStatus>;
+
    /**
     * Get the verification status of a given device.
     *
@@ -164,6 +179,8 @@ export interface CryptoApi {
     * return true.
     *
     * @returns True if cross-signing is ready to be used on this device
+     *
+     * @throws May throw {@link ClientStoppedError} if the `MatrixClient` is stopped before or during the call.
     */
    isCrossSigningReady(): Promise<boolean>;

@@ -228,7 +245,10 @@ export interface CryptoApi {
    /**
     * Get the status of our cross-signing keys.
     *
-     * @returns The current status of cross-signing keys: whether we have public and private keys cached locally, and whether the private keys are in secret storage.
+     * @returns The current status of cross-signing keys: whether we have public and private keys cached locally, and
+     * whether the private keys are in secret storage.
+     *
+     * @throws May throw {@link ClientStoppedError} if the `MatrixClient` is stopped before or during the call.
     */
    getCrossSigningStatus(): Promise<CrossSigningStatus>;

@@ -246,6 +266,16 @@ export interface CryptoApi {
     */
    createRecoveryKeyFromPassphrase(password?: string): Promise<GeneratedSecretStorageKey>;

+    /**
+     * Get information about the encryption of the given event.
+     *
+     * @param event - the event to get information for
+     *
+     * @returns `null` if the event is not encrypted, or has not (yet) been successfully decrypted. Otherwise, an
+     *      object with information about the encryption of the event.
+     */
+    getEncryptionInfoForEvent(event: MatrixEvent): Promise<EventEncryptionInfo | null>;
+
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    //
    // Device/User verification
@@ -281,6 +311,16 @@ export interface CryptoApi {
     */
    findVerificationRequestDMInProgress(roomId: string, userId?: string): VerificationRequest | undefined;

+    /**
+     * Request a key verification from another user, using a DM.
+     *
+     * @param userId - the user to request verification with.
+     * @param roomId - the room to use for verification.
+     *
+     * @returns resolves to a VerificationRequest when the request has been sent to the other party.
+     */
+    requestVerificationDM(userId: string, roomId: string): Promise<VerificationRequest>;
+
    /**
     * Send a verification request to our other devices.
     *
@@ -350,6 +390,35 @@ export interface CryptoApi {
     * @param info - key backup info dict from {@link MatrixClient#getKeyBackupVersion}.
     */
    isKeyBackupTrusted(info: KeyBackupInfo): Promise<BackupTrustInfo>;
+
+    /**
+     * Force a re-check of the key backup and enable/disable it as appropriate.
+     *
+     * Fetches the current backup information from the server. If there is a backup, and it is trusted, starts
+     * backing up to it; otherwise, disables backups.
+     *
+     * @returns `null` if there is no backup on the server. Otherwise, data on the backup as returned by the server,
+     *   and trust information (as returned by {@link isKeyBackupTrusted}).
+     */
+    checkKeyBackupAndEnable(): Promise<KeyBackupCheck | null>;
+
+    /**
+     * Creates a new key backup version.
+     *
+     * If there are existing backups they will be replaced.
+     *
+     * The decryption key will be saved in Secret Storage (the {@link SecretStorageCallbacks.getSecretStorageKey} Crypto
+     * callback will be called)
+     * and the backup engine will be started.
+     */
+    resetKeyBackup(): Promise<void>;
+
+    /**
+     * Deletes the given key backup.
+     *
+     * @param version - The backup version to delete.
+     */
+    deleteKeyBackupVersion(version: string): Promise<void>;
 }

 /**
@@ -366,6 +435,46 @@ export interface BootstrapCrossSigningOpts {
    authUploadDeviceSigningKeys?: UIAuthCallback<void>;
 }

+/**
+ * Represents the ways in which we trust a user
+ */
+export class UserVerificationStatus {
+    public constructor(
+        private readonly crossSigningVerified: boolean,
+        private readonly crossSigningVerifiedBefore: boolean,
+        private readonly tofu: boolean,
+    ) {}
+
+    /**
+     * @returns true if this user is verified via any means
+     */
+    public isVerified(): boolean {
+        return this.isCrossSigningVerified();
+    }
+
+    /**
+     * @returns true if this user is verified via cross signing
+     */
+    public isCrossSigningVerified(): boolean {
+        return this.crossSigningVerified;
+    }
+
+    /**
+     * @returns true if we ever verified this user before (at least for
+     * the history of verifications observed by this device).
+     */
+    public wasCrossSigningVerified(): boolean {
+        return this.crossSigningVerifiedBefore;
+    }
+
+    /**
+     * @returns true if this user's key is trusted on first use
+     */
+    public isTofu(): boolean {
+        return this.tofu;
+    }
+}
+
 export class DeviceVerificationStatus {
    /**
     * True if this device has been signed by its owner (and that signature verified).
@@ -567,5 +676,57 @@ export interface GeneratedSecretStorageKey {
    encodedPrivateKey?: string;
 }

+/**
+ *  Result type of {@link CryptoApi#getEncryptionInfoForEvent}.
+ */
+export interface EventEncryptionInfo {
+    /** "Shield" to be shown next to this event representing its verification status */
+    shieldColour: EventShieldColour;
+
+    /**
+     * `null` if `shieldColour` is `EventShieldColour.NONE`; otherwise a reason code for the shield in `shieldColour`.
+     */
+    shieldReason: EventShieldReason | null;
+}
+
+/**
+ * Types of shield to be shown for {@link EventEncryptionInfo#shieldColour}.
+ */
+export enum EventShieldColour {
+    NONE,
+    GREY,
+    RED,
+}
+
+/**
+ * Reason codes for {@link EventEncryptionInfo#shieldReason}.
+ */
+export enum EventShieldReason {
+    /** An unknown reason from the crypto library (if you see this, it is a bug in matrix-js-sdk). */
+    UNKNOWN,
+
+    /** "Encrypted by an unverified user." */
+    UNVERIFIED_IDENTITY,
+
+    /** "Encrypted by a device not verified by its owner." */
+    UNSIGNED_DEVICE,
+
+    /** "Encrypted by an unknown or deleted device." */
+    UNKNOWN_DEVICE,
+
+    /**
+     * "The authenticity of this encrypted message can't be guaranteed on this device."
+     *
+     * ie: the key has been forwarded, or retrieved from an insecure backup.
+     */
+    AUTHENTICITY_NOT_GUARANTEED,
+
+    /**
+     * The (deprecated) sender_key field in the event does not match the Ed25519 key of the device that sent us the
+     * decryption keys.
+     */
+    MISMATCHED_SENDER_KEY,
+}
+
 export * from "./crypto-api/verification";
 export * from "./crypto-api/keybackup";
@@ -15,6 +15,7 @@ limitations under the License.
 */

 import { ISigned } from "../@types/signed";
+import { IEncryptedPayload } from "../crypto/aes";

 export interface Curve25519AuthData {
    public_key: string;
@@ -60,3 +61,29 @@ export interface BackupTrustInfo {
     */
    readonly matchesDecryptionKey: boolean;
 }
+
+/**
+ * The result of {@link CryptoApi.checkKeyBackupAndEnable}.
+ */
+export interface KeyBackupCheck {
+    backupInfo: KeyBackupInfo;
+    trustInfo: BackupTrustInfo;
+}
+
+export interface Curve25519SessionData {
+    ciphertext: string;
+    ephemeral: string;
+    mac: string;
+}
+
+/* eslint-disable camelcase */
+export interface KeyBackupSession<T = Curve25519SessionData | IEncryptedPayload> {
+    first_message_index: number;
+    forwarded_count: number;
+    is_verified: boolean;
+    session_data: T;
+}
+
+export interface KeyBackupRoomSessions {
+    [sessionId: string]: KeyBackupSession;
+}
@@ -30,7 +30,10 @@ import { ICryptoCallbacks } from ".";
 import { ISignatures } from "../@types/signed";
 import { CryptoStore, SecretStorePrivateKeys } from "./store/base";
 import { ServerSideSecretStorage, SecretStorageKeyDescription } from "../secret-storage";
-import { DeviceVerificationStatus } from "../crypto-api";
+import { DeviceVerificationStatus, UserVerificationStatus as UserTrustLevel } from "../crypto-api";
+
+// backwards-compatibility re-exports
+export { UserTrustLevel };

 const KEY_REQUEST_TIMEOUT_MS = 1000 * 60;

@@ -587,46 +590,6 @@ export enum CrossSigningLevel {
    SELF_SIGNING = 1,
 }

-/**
- * Represents the ways in which we trust a user
- */
-export class UserTrustLevel {
-    public constructor(
-        private readonly crossSigningVerified: boolean,
-        private readonly crossSigningVerifiedBefore: boolean,
-        private readonly tofu: boolean,
-    ) {}
-
-    /**
-     * @returns true if this user is verified via any means
-     */
-    public isVerified(): boolean {
-        return this.isCrossSigningVerified();
-    }
-
-    /**
-     * @returns true if this user is verified via cross signing
-     */
-    public isCrossSigningVerified(): boolean {
-        return this.crossSigningVerified;
-    }
-
-    /**
-     * @returns true if we ever verified this user before (at least for
-     * the history of verifications observed by this device).
-     */
-    public wasCrossSigningVerified(): boolean {
-        return this.crossSigningVerifiedBefore;
-    }
-
-    /**
-     * @returns true if this user's key is trusted on first use
-     */
-    public isTofu(): boolean {
-        return this.tofu;
-    }
-}
-
 /**
 * Represents the ways in which we trust a device.
 *
@@ -228,6 +228,8 @@ export class EncryptionSetupOperation {
                    prefix: ClientPrefix.V3,
                });
            }
+            // tell the backup manager to re-check the keys now that they have been (maybe) updated
+            await crypto.backupManager.checkKeyBackup();
        }
    }
 }
@@ -25,7 +25,7 @@ import { MEGOLM_ALGORITHM, verifySignature } from "./olmlib";
 import { DeviceInfo } from "./deviceinfo";
 import { DeviceTrustLevel } from "./CrossSigning";
 import { keyFromPassphrase } from "./key_passphrase";
-import { safeSet, sleep } from "../utils";
+import { encodeUri, safeSet, sleep } from "../utils";
 import { IndexedDBCryptoStore } from "./store/indexeddb-crypto-store";
 import { encodeRecoveryKey } from "./recoverykey";
 import { calculateKeyCheck, decryptAES, encryptAES, IEncryptedPayload } from "./aes";
@@ -39,8 +39,9 @@ import {
 import { UnstableValue } from "../NamespacedValue";
 import { CryptoEvent } from "./index";
 import { crypto } from "./crypto";
-import { HTTPError, MatrixError } from "../http-api";
+import { ClientPrefix, HTTPError, MatrixError, Method } from "../http-api";
 import { BackupTrustInfo } from "../crypto-api/keybackup";
+import { BackupDecryptor } from "../common-crypto/CryptoBackend";

 const KEY_BACKUP_KEYS_PER_REQUEST = 200;
 const KEY_BACKUP_CHECK_RATE_LIMIT = 5000; // ms
@@ -224,6 +225,33 @@ export class BackupManager {
        this.algorithm = await BackupManager.makeAlgorithm(info, this.getKey);
    }

+    /**
+     * Deletes all key backups.
+     *
+     * Will call the API to delete active backup until there is no more present.
+     */
+    public async deleteAllKeyBackupVersions(): Promise<void> {
+        // there could be several backup versions, delete all to be safe.
+        let current = (await this.baseApis.getKeyBackupVersion())?.version ?? null;
+        while (current != null) {
+            await this.deleteKeyBackupVersion(current);
+            this.disableKeyBackup();
+            current = (await this.baseApis.getKeyBackupVersion())?.version ?? null;
+        }
+    }
+
+    /**
+     * Deletes the given key backup.
+     *
+     * @param version - The backup version to delete.
+     */
+    public async deleteKeyBackupVersion(version: string): Promise<void> {
+        const path = encodeUri("/room_keys/version/$version", { $version: version });
+        await this.baseApis.http.authedRequest<void>(Method.Delete, path, undefined, undefined, {
+            prefix: ClientPrefix.V3,
+        });
+    }
+
    /**
     * Check the server for an active key backup and
     * if one is present and has a valid signature from
@@ -333,7 +361,7 @@ export class BackupManager {
        };

        if (!backupInfo || !backupInfo.algorithm || !backupInfo.auth_data || !backupInfo.auth_data.signatures) {
-            logger.info("Key backup is absent or missing required data");
+            logger.info(`Key backup is absent or missing required data: ${JSON.stringify(backupInfo)}`);
            return ret;
        }

@@ -440,6 +468,7 @@ export class BackupManager {
     * @param maxDelay - Maximum delay to wait in ms. 0 means no delay.
     */
    public async scheduleKeyBackupSend(maxDelay = 10000): Promise<void> {
+        logger.debug(`Key backup: scheduleKeyBackupSend currentSending:${this.sendingBackups} delay:${maxDelay}`);
        if (this.sendingBackups) return;

        this.sendingBackups = true;
@@ -452,6 +481,7 @@ export class BackupManager {
            await sleep(delay);
            if (!this.clientRunning) {
                logger.debug("Key backup send aborted, client stopped");
+                this.sendingBackups = false;
                return;
            }
            let numFailures = 0; // number of consecutive failures
@@ -463,24 +493,26 @@ export class BackupManager {
                    const numBackedUp = await this.backupPendingKeys(KEY_BACKUP_KEYS_PER_REQUEST);
                    if (numBackedUp === 0) {
                        // no sessions left needing backup: we're done
+                        this.sendingBackups = false;
                        return;
                    }
                    numFailures = 0;
                } catch (err) {
                    numFailures++;
                    logger.log("Key backup request failed", err);
-                    if ((<MatrixError>err).data) {
-                        if (
-                            (<MatrixError>err).data.errcode == "M_NOT_FOUND" ||
-                            (<MatrixError>err).data.errcode == "M_WRONG_ROOM_KEYS_VERSION"
-                        ) {
-                            // Re-check key backup status on error, so we can be
-                            // sure to present the current situation when asked.
-                            await this.checkKeyBackup();
+                    if (err instanceof MatrixError) {
+                        const errCode = err.data.errcode;
+                        if (errCode == "M_NOT_FOUND" || errCode == "M_WRONG_ROOM_KEYS_VERSION") {
+                            // Set to false now as `checkKeyBackup` might schedule a backupsend before this one ends.
+                            this.sendingBackups = false;
                            // Backup version has changed or this backup version
                            // has been deleted
-                            this.baseApis.crypto!.emit(CryptoEvent.KeyBackupFailed, (<MatrixError>err).data.errcode!);
-                            throw err;
+                            this.baseApis.crypto!.emit(CryptoEvent.KeyBackupFailed, errCode);
+                            // Re-check key backup status on error, so we can be
+                            // sure to present the current situation when asked.
+                            // This call might restart the backup loop if new backup version is trusted
+                            await this.checkKeyBackup();
+                            return;
                        }
                    }
                }
@@ -491,10 +523,14 @@ export class BackupManager {

                if (!this.clientRunning) {
                    logger.debug("Key backup send loop aborted, client stopped");
+                    this.sendingBackups = false;
                    return;
                }
            }
-        } finally {
+        } catch (err) {
+            // No one actually checks errors on this promise, it's spawned internally.
+            // Just log, apps/client should use events to check status
+            logger.log(`Backup loop failed ${err}`);
            this.sendingBackups = false;
        }
    }
@@ -843,3 +879,32 @@ export function backupTrustInfoFromLegacyTrustInfo(trustInfo: TrustInfo): Backup
        matchesDecryptionKey: trustInfo.trusted_locally ?? false,
    };
 }
+
+/**
+ * Implementation of {@link BackupDecryptor} for the libolm crypto backend.
+ */
+export class LibOlmBackupDecryptor implements BackupDecryptor {
+    private algorithm: BackupAlgorithm;
+    public readonly sourceTrusted: boolean;
+
+    public constructor(algorithm: BackupAlgorithm) {
+        this.algorithm = algorithm;
+        this.sourceTrusted = !algorithm.untrusted;
+    }
+
+    /**
+     * Implements {@link BackupDecryptor#free}
+     */
+    public free(): void {
+        this.algorithm.free();
+    }
+
+    /**
+     * Implements {@link BackupDecryptor#decryptSessions}
+     */
+    public async decryptSessions(
+        sessions: Record<string, IKeyBackupSession<Curve25519SessionData>>,
+    ): Promise<IMegolmSessionData[]> {
+        return await this.algorithm.decryptSessions(sessions);
+    }
+}
@@ -50,7 +50,7 @@ import { IllegalMethod } from "./verification/IllegalMethod";
 import { KeySignatureUploadError } from "../errors";
 import { calculateKeyCheck, decryptAES, encryptAES, IEncryptedPayload } from "./aes";
 import { DehydrationManager } from "./dehydration";
-import { BackupManager, backupTrustInfoFromLegacyTrustInfo } from "./backup";
+import { BackupManager, LibOlmBackupDecryptor, backupTrustInfoFromLegacyTrustInfo } from "./backup";
 import { IStore } from "../store";
 import { Room, RoomEvent } from "../models/room";
 import { RoomMember, RoomMemberEvent } from "../models/room-member";
@@ -73,7 +73,7 @@ import { TypedEventEmitter } from "../models/typed-event-emitter";
 import { IDeviceLists, ISyncResponse, IToDeviceEvent } from "../sync-accumulator";
 import { ISignatures } from "../@types/signed";
 import { IMessage } from "./algorithms/olm";
-import { CryptoBackend, OnSyncCompletedData } from "../common-crypto/CryptoBackend";
+import { BackupDecryptor, CryptoBackend, OnSyncCompletedData } from "../common-crypto/CryptoBackend";
 import { RoomState, RoomStateEvent } from "../models/room-state";
 import { MapWithDefault, recursiveMapToObject } from "../utils";
 import {
@@ -91,12 +91,17 @@ import {
    BootstrapCrossSigningOpts,
    CrossSigningStatus,
    DeviceVerificationStatus,
+    EventEncryptionInfo,
+    EventShieldColour,
+    EventShieldReason,
    ImportRoomKeysOpts,
+    KeyBackupCheck,
    KeyBackupInfo,
    VerificationRequest as CryptoApiVerificationRequest,
 } from "../crypto-api";
 import { Device, DeviceMap } from "../models/device";
 import { deviceInfoToDevice } from "./device-converter";
+import { ClientPrefix, MatrixError, Method } from "../http-api";

 /* re-exports for backwards compatibility */
 export type {
@@ -699,9 +704,9 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     *
     * @internal
     */
-    public async userHasCrossSigningKeys(): Promise<boolean> {
-        await this.downloadKeys([this.userId]);
-        return this.deviceList.getStoredCrossSigningForUser(this.userId) !== null;
+    public async userHasCrossSigningKeys(userId = this.userId): Promise<boolean> {
+        await this.downloadKeys([userId]);
+        return this.deviceList.getStoredCrossSigningForUser(userId) !== null;
    }

    /**
@@ -1087,7 +1092,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
                // and want to write to the local secretStorage object
                { secureSecretStorage: false },
            );
-            // write the key ourselves to 4S
+            // write the key to 4S
            const privateKey = decodeRecoveryKey(info.recovery_key);
            await secretStorage.store("m.megolm_backup.v1", olmlib.encodeBase64(privateKey));

@@ -1144,6 +1149,48 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        logger.log("Secure Secret Storage ready");
    }

+    /**
+     * Implementation of {@link CryptoApi#resetKeyBackup}.
+     */
+    public async resetKeyBackup(): Promise<void> {
+        // Delete existing ones
+        // There is no use case for having several key backup version live server side.
+        // Even if not deleted it would be lost as the key to restore is lost.
+        // There should be only one backup at a time.
+        await this.backupManager.deleteAllKeyBackupVersions();
+
+        const info = await this.backupManager.prepareKeyBackupVersion();
+
+        await this.signObject(info.auth_data);
+
+        // add new key backup
+        const { version } = await this.baseApis.http.authedRequest<{ version: string }>(
+            Method.Post,
+            "/room_keys/version",
+            undefined,
+            info,
+            {
+                prefix: ClientPrefix.V3,
+            },
+        );
+
+        logger.log(`Created backup version ${version}`);
+
+        // write the key to 4S
+        const privateKey = info.privateKey;
+        await this.secretStorage.store("m.megolm_backup.v1", olmlib.encodeBase64(privateKey));
+        await this.storeSessionBackupPrivateKey(privateKey);
+
+        await this.backupManager.checkAndStart();
+    }
+
+    /**
+     * Implementation of {@link CryptoApi#deleteKeyBackupVersion}.
+     */
+    public async deleteKeyBackupVersion(version: string): Promise<void> {
+        await this.backupManager.deleteKeyBackupVersion(version);
+    }
+
    /**
     * @deprecated Use {@link MatrixClient#secretStorage} and {@link SecretStorage.ServerSideSecretStorage#addKey}.
     */
@@ -1304,6 +1351,20 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        return backupTrustInfoFromLegacyTrustInfo(trustInfo);
    }

+    /**
+     * Force a re-check of the key backup and enable/disable it as appropriate.
+     *
+     * Implementation of {@link CryptoApi.checkKeyBackupAndEnable}.
+     */
+    public async checkKeyBackupAndEnable(): Promise<KeyBackupCheck | null> {
+        const checkResult = await this.backupManager.checkKeyBackup();
+        if (!checkResult || !checkResult.backupInfo) return null;
+        return {
+            backupInfo: checkResult.backupInfo,
+            trustInfo: backupTrustInfoFromLegacyTrustInfo(checkResult.trustInfo),
+        };
+    }
+
    /**
     * Checks that a given cross-signing private key matches a given public key.
     * This can be used by the getCrossSigningKey callback to verify that the
@@ -1509,6 +1570,13 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        return this.crossSigningInfo.checkUserTrust(userCrossSigning);
    }

+    /**
+     * Implementation of {@link CryptoApi.getUserVerificationStatus}.
+     */
+    public async getUserVerificationStatus(userId: string): Promise<UserTrustLevel> {
+        return this.checkUserTrust(userId);
+    }
+
    /**
     * Check whether a given device is trusted.
     *
@@ -1777,6 +1845,28 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        // the backup with the new key (if not already signed)?
    }

+    /**
+     * Implementation of {@link CryptoBackend#getBackupDecryptor}.
+     */
+    public async getBackupDecryptor(backupInfo: KeyBackupInfo, privKey: ArrayLike<number>): Promise<BackupDecryptor> {
+        if (!(privKey instanceof Uint8Array)) {
+            throw new Error(`getBackupDecryptor expects Uint8Array`);
+        }
+
+        const algorithm = await BackupManager.makeAlgorithm(backupInfo, async () => {
+            return privKey;
+        });
+
+        // If the pubkey computed from the private data we've been given
+        // doesn't match the one in the auth_data, the user has entered
+        // a different recovery key / the wrong passphrase.
+        if (!(await algorithm.keyMatches(privKey))) {
+            return Promise.reject(new MatrixError({ errcode: MatrixClient.RESTORE_BACKUP_ERROR_BAD_KEY }));
+        }
+
+        return new LibOlmBackupDecryptor(algorithm);
+    }
+
    /**
     * Store a set of keys as our own, trusted, cross-signing keys.
     *
@@ -2636,6 +2726,68 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        return ret as IEncryptedEventInfo;
    }

+    /**
+     * Implementation of {@link CryptoApi.getEncryptionInfoForEvent}.
+     */
+    public async getEncryptionInfoForEvent(event: MatrixEvent): Promise<EventEncryptionInfo | null> {
+        const encryptionInfo = this.getEventEncryptionInfo(event);
+        if (!encryptionInfo.encrypted) {
+            return null;
+        }
+
+        const senderId = event.getSender();
+        if (!senderId || encryptionInfo.mismatchedSender) {
+            // something definitely wrong is going on here
+            return {
+                shieldColour: EventShieldColour.RED,
+                shieldReason: EventShieldReason.MISMATCHED_SENDER_KEY,
+            };
+        }
+
+        const userTrust = this.checkUserTrust(senderId);
+        if (!userTrust.isCrossSigningVerified()) {
+            // If the message is unauthenticated, then display a grey
+            // shield, otherwise if the user isn't cross-signed then
+            // nothing's needed
+            if (!encryptionInfo.authenticated) {
+                return {
+                    shieldColour: EventShieldColour.GREY,
+                    shieldReason: EventShieldReason.AUTHENTICITY_NOT_GUARANTEED,
+                };
+            } else {
+                return { shieldColour: EventShieldColour.NONE, shieldReason: null };
+            }
+        }
+
+        const eventSenderTrust =
+            senderId &&
+            encryptionInfo.sender &&
+            (await this.getDeviceVerificationStatus(senderId, encryptionInfo.sender.deviceId));
+
+        if (!eventSenderTrust) {
+            return {
+                shieldColour: EventShieldColour.GREY,
+                shieldReason: EventShieldReason.UNKNOWN_DEVICE,
+            };
+        }
+
+        if (!eventSenderTrust.isVerified()) {
+            return {
+                shieldColour: EventShieldColour.RED,
+                shieldReason: EventShieldReason.UNVERIFIED_IDENTITY,
+            };
+        }
+
+        if (!encryptionInfo.authenticated) {
+            return {
+                shieldColour: EventShieldColour.GREY,
+                shieldReason: EventShieldReason.AUTHENTICITY_NOT_GUARANTEED,
+            };
+        }
+
+        return { shieldColour: EventShieldColour.NONE, shieldReason: null };
+    }
+
    /**
     * Forces the current outbound group session to be discarded such
     * that another one will be created next time an event is sent.
@@ -14,31 +14,14 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import { IEncryptedPayload } from "./aes";
-
-export interface Curve25519SessionData {
-    ciphertext: string;
-    ephemeral: string;
-    mac: string;
-}
-
-/* eslint-disable camelcase */
-export interface IKeyBackupSession<T = Curve25519SessionData | IEncryptedPayload> {
-    first_message_index: number;
-    forwarded_count: number;
-    is_verified: boolean;
-    session_data: T;
-}
-
-export interface IKeyBackupRoomSessions {
-    [sessionId: string]: IKeyBackupSession;
-}
-
 // Export for backward compatibility
 export type {
    Curve25519AuthData as ICurve25519AuthData,
    Aes256AuthData as IAes256AuthData,
    KeyBackupInfo as IKeyBackupInfo,
+    Curve25519SessionData,
+    KeyBackupSession as IKeyBackupSession,
+    KeyBackupRoomSessions as IKeyBackupRoomSessions,
 } from "../crypto-api/keybackup";

 /* eslint-enable camelcase */
@@ -19,6 +19,7 @@ import * as bs58 from "bs58";
 // picked arbitrarily but to try & avoid clashing with any bitcoin ones
 // (which are also base58 encoded, but bitcoin's involve a lot more hashing)
 const OLM_RECOVERY_KEY_PREFIX = [0x8b, 0x01];
+const KEY_SIZE = 32;

 export function encodeRecoveryKey(key: ArrayLike<number>): string | undefined {
    const buf = Buffer.alloc(OLM_RECOVERY_KEY_PREFIX.length + key.length + 1);
@@ -52,11 +53,9 @@ export function decodeRecoveryKey(recoveryKey: string): Uint8Array {
        }
    }

-    if (result.length !== OLM_RECOVERY_KEY_PREFIX.length + global.Olm.PRIVATE_KEY_LENGTH + 1) {
+    if (result.length !== OLM_RECOVERY_KEY_PREFIX.length + KEY_SIZE + 1) {
        throw new Error("Incorrect length");
    }

-    return Uint8Array.from(
-        result.slice(OLM_RECOVERY_KEY_PREFIX.length, OLM_RECOVERY_KEY_PREFIX.length + global.Olm.PRIVATE_KEY_LENGTH),
-    );
+    return Uint8Array.from(result.slice(OLM_RECOVERY_KEY_PREFIX.length, OLM_RECOVERY_KEY_PREFIX.length + KEY_SIZE));
 }
@@ -29,7 +29,14 @@ import { MatrixEvent, IEvent, IContent, EventStatus } from "./models/event";
 import { ISendEventResponse } from "./@types/requests";
 import { EventType } from "./@types/event";
 import { logger } from "./logger";
-import { MatrixClient, ClientEvent, IMatrixClientCreateOpts, IStartClientOpts, SendToDeviceContentMap } from "./client";
+import {
+    MatrixClient,
+    ClientEvent,
+    IMatrixClientCreateOpts,
+    IStartClientOpts,
+    SendToDeviceContentMap,
+    IOpenIDToken,
+} from "./client";
 import { SyncApi, SyncState } from "./sync";
 import { SlidingSyncSdk } from "./sliding-sync-sdk";
 import { User } from "./models/user";
@@ -153,6 +160,12 @@ export class RoomWidgetClient extends MatrixClient {

        // Open communication with the host
        widgetApi.start();
+        // Send a content loaded event now we've started the widget API
+        // Note that element-web currently does not use waitForIFrameLoad=false and so
+        // does *not* (yes, that is the right way around) wait for this event. Let's
+        // start sending this, then once this has rolled out, we can change element-web to
+        // use waitForIFrameLoad=false and have a widget API that's less racy.
+        widgetApi.sendContentLoaded();
    }

    public async startClient(opts: IStartClientOpts = {}): Promise<void> {
@@ -197,6 +210,8 @@ export class RoomWidgetClient extends MatrixClient {
        this.setSyncState(SyncState.Syncing);
        logger.info("Finished backfilling events");

+        this.matrixRTC.start();
+
        // Watch for TURN servers, if requested
        if (this.capabilities.turnServers) this.watchTurnServers();
    }
@@ -241,6 +256,18 @@ export class RoomWidgetClient extends MatrixClient {
        return {};
    }

+    public async getOpenIdToken(): Promise<IOpenIDToken> {
+        const token = await this.widgetApi.requestOpenIDConnectToken();
+        // the IOpenIDCredentials from the widget-api and IOpenIDToken form the matrix-js-sdk are compatible.
+        // we still recreate the token to make this transparent and catch'able by the linter in case the types change in the future.
+        return <IOpenIDToken>{
+            access_token: token.access_token,
+            expires_in: token.expires_in,
+            matrix_server_name: token.matrix_server_name,
+            token_type: token.token_type,
+        };
+    }
+
    public async queueToDevice({ eventType, batch }: ToDeviceBatch): Promise<void> {
        // map: user Id → device Id → payload
        const contentMap: MapWithDefault<string, Map<string, ToDevicePayload>> = new MapWithDefault(() => new Map());
@@ -51,3 +51,17 @@ export class KeySignatureUploadError extends Error {
        super(message);
    }
 }
+
+/**
+ * It is invalid to call most methods once {@link MatrixClient#stopClient} has been called.
+ *
+ * This error will be thrown if you attempt to do so.
+ *
+ * {@link MatrixClient#stopClient} itself is an exception to this: it may safely be called multiple times on the same
+ * instance.
+ */
+export class ClientStoppedError extends Error {
+    public constructor() {
+        super("MatrixClient has been stopped");
+    }
+}
@@ -110,7 +110,7 @@ export class MatrixHttpApi<O extends IHttpOpts> extends FetchHttpApi<O> {
                });
            };

-            const url = this.getUrl("/upload", undefined, MediaPrefix.R0);
+            const url = this.getUrl("/upload", undefined, MediaPrefix.V3);

            if (includeFilename && fileName) {
                url.searchParams.set("filename", encodeURIComponent(fileName));
@@ -139,7 +139,7 @@ export class MatrixHttpApi<O extends IHttpOpts> extends FetchHttpApi<O> {
            const headers: Record<string, string> = { "Content-Type": contentType };

            this.authedRequest<UploadResponse>(Method.Post, "/upload", queryParams, file, {
-                prefix: MediaPrefix.R0,
+                prefix: MediaPrefix.V3,
                headers,
                abortSignal: abortController.signal,
            })
@@ -182,7 +182,7 @@ export class MatrixHttpApi<O extends IHttpOpts> extends FetchHttpApi<O> {
    public getContentUri(): IContentUri {
        return {
            base: this.opts.baseUrl,
-            path: MediaPrefix.R0 + "/upload",
+            path: MediaPrefix.V3 + "/upload",
            params: {
                access_token: this.opts.accessToken!,
            },
@@ -16,11 +16,7 @@ limitations under the License.

 export enum ClientPrefix {
    /**
-     * A constant representing the URI path for release 0 of the Client-Server HTTP API.
-     */
-    R0 = "/_matrix/client/r0",
-    /**
-     * A constant representing the URI path for the legacy release v1 of the Client-Server HTTP API.
+     * A constant representing the URI path for Client-Server API endpoints versioned at v1.
     */
    V1 = "/_matrix/client/v1",
    /**
@@ -42,7 +38,11 @@ export enum IdentityPrefix {

 export enum MediaPrefix {
    /**
-     * URI path for the media repo API
+     * A constant representing the URI path for Client-Server API Media endpoints versioned at v1.
     */
-    R0 = "/_matrix/media/r0",
+    V1 = "/_matrix/media/v3",
+    /**
+     * A constant representing the URI path for Client-Server API Media endpoints versioned at v3.
+     */
+    V3 = "/_matrix/media/v3",
 }
@@ -345,10 +345,8 @@ export class InteractiveAuth<T> {
                    sid: this.emailSid,
                    client_secret: this.clientSecret,
                };
-                if (await this.matrixClient.doesServerRequireIdServerParam()) {
-                    const idServerParsedUrl = new URL(this.matrixClient.getIdentityServerUrl()!);
-                    creds.id_server = idServerParsedUrl.host;
-                }
+                const idServerParsedUrl = new URL(this.matrixClient.getIdentityServerUrl()!);
+                creds.id_server = idServerParsedUrl.host;
                authDict = {
                    type: EMAIL_STAGE_TYPE,
                    // TODO: Remove `threepid_creds` once servers support proper UIA
@@ -50,6 +50,7 @@ export * from "./service-types";
 export * from "./store/memory";
 export * from "./store/indexeddb";
 export * from "./crypto/store/memory-crypto-store";
+export * from "./crypto/store/localStorage-crypto-store";
 export * from "./crypto/store/indexeddb-crypto-store";
 export type { OutgoingRoomKeyRequest } from "./crypto/store/base";
 export * from "./content-repo";
@@ -59,6 +60,18 @@ export * from "./@types/PushRules";
 export * from "./@types/partials";
 export * from "./@types/requests";
 export * from "./@types/search";
+export * from "./@types/beacon";
+export * from "./@types/topic";
+export * from "./@types/location";
+export * from "./@types/threepids";
+export * from "./@types/auth";
+export * from "./@types/polls";
+export * from "./@types/local_notifications";
+export * from "./@types/registration";
+export * from "./@types/read_receipts";
+export * from "./@types/crypto";
+export * from "./@types/extensible_events";
+export * from "./@types/IIdentityServerProvider";
 export * from "./models/room-summary";
 export * from "./models/event-status";
 export * as ContentHelpers from "./content-helpers";
@@ -0,0 +1,95 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { MatrixEvent, RoomMember } from "../matrix";
+import { deepCompare } from "../utils";
+import { Focus } from "./focus";
+
+type CallScope = "m.room" | "m.user";
+
+// Represents an entry in the memberships section of an m.call.member event as it is on the wire
+export interface CallMembershipData {
+    application?: string;
+    call_id: string;
+    scope: CallScope;
+    device_id: string;
+    created_ts?: number;
+    expires: number;
+    foci_active?: Focus[];
+}
+
+export class CallMembership {
+    public static equal(a: CallMembership, b: CallMembership): boolean {
+        return deepCompare(a.data, b.data);
+    }
+
+    public constructor(private parentEvent: MatrixEvent, private data: CallMembershipData) {
+        if (typeof data.expires !== "number") throw new Error("Malformed membership: expires must be numeric");
+        if (typeof data.device_id !== "string") throw new Error("Malformed membership event: device_id must be string");
+        if (typeof data.call_id !== "string") throw new Error("Malformed membership event: call_id must be string");
+        if (typeof data.scope !== "string") throw new Error("Malformed membership event: scope must be string");
+        if (!parentEvent.sender) throw new Error("Invalid parent event: sender is null");
+    }
+
+    public get member(): RoomMember {
+        return this.parentEvent.sender!;
+    }
+
+    public get callId(): string {
+        return this.data.call_id;
+    }
+
+    public get deviceId(): string {
+        return this.data.device_id;
+    }
+
+    public get application(): string | undefined {
+        return this.data.application;
+    }
+
+    public get scope(): CallScope {
+        return this.data.scope;
+    }
+
+    public createdTs(): number {
+        return this.data.created_ts ?? this.parentEvent.getTs();
+    }
+
+    public getAbsoluteExpiry(): number {
+        return this.createdTs() + this.data.expires;
+    }
+
+    // gets the expiry time of the event, converted into the device's local time
+    public getLocalExpiry(): number {
+        const relativeCreationTime = this.parentEvent.getTs() - this.createdTs();
+
+        const localCreationTs = this.parentEvent.localTimestamp - relativeCreationTime;
+
+        return localCreationTs + this.data.expires;
+    }
+
+    public getMsUntilExpiry(): number {
+        return this.getLocalExpiry() - Date.now();
+    }
+
+    public isExpired(): boolean {
+        return this.getAbsoluteExpiry() < this.parentEvent.getTs() + this.parentEvent.getLocalAge();
+    }
+
+    public getActiveFoci(): Focus[] {
+        return this.data.foci_active ?? [];
+    }
+}
@@ -0,0 +1,418 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { logger } from "../logger";
+import { TypedEventEmitter } from "../models/typed-event-emitter";
+import { EventTimeline } from "../models/event-timeline";
+import { Room } from "../models/room";
+import { MatrixClient } from "../client";
+import { EventType } from "../@types/event";
+import { CallMembership, CallMembershipData } from "./CallMembership";
+import { Focus } from "./focus";
+import { MatrixEvent } from "../matrix";
+
+const MEMBERSHIP_EXPIRY_TIME = 60 * 60 * 1000;
+const MEMBER_EVENT_CHECK_PERIOD = 2 * 60 * 1000; // How often we check to see if we need to re-send our member event
+const CALL_MEMBER_EVENT_RETRY_DELAY_MIN = 3000;
+
+export enum MatrixRTCSessionEvent {
+    // A member joined, left, or updated a property of their membership.
+    MembershipsChanged = "memberships_changed",
+    // We joined or left the session: our own local idea of whether we are joined,
+    // separate from MembershipsChanged, ie. independent of whether our member event
+    // has succesfully gone through.
+    JoinStateChanged = "join_state_changed",
+}
+
+export type MatrixRTCSessionEventHandlerMap = {
+    [MatrixRTCSessionEvent.MembershipsChanged]: (
+        oldMemberships: CallMembership[],
+        newMemberships: CallMembership[],
+    ) => void;
+    [MatrixRTCSessionEvent.JoinStateChanged]: (isJoined: boolean) => void;
+};
+
+/**
+ * A MatrixRTCSession manages the membership & properties of a MatrixRTC session.
+ * This class doesn't deal with media at all, just membership & properties of a session.
+ */
+export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, MatrixRTCSessionEventHandlerMap> {
+    // How many ms after we joined the call, that our membership should expire, or undefined
+    // if we're not yet joined
+    private relativeExpiry: number | undefined;
+
+    private memberEventTimeout?: ReturnType<typeof setTimeout>;
+    private expiryTimeout?: ReturnType<typeof setTimeout>;
+
+    private activeFoci: Focus[] | undefined;
+
+    private updateCallMembershipRunning = false;
+    private needCallMembershipUpdate = false;
+
+    /**
+     * Returns all the call memberships for a room, oldest first
+     */
+    public static callMembershipsForRoom(room: Room): CallMembership[] {
+        const roomState = room.getLiveTimeline().getState(EventTimeline.FORWARDS);
+        if (!roomState) {
+            logger.warn("Couldn't get state for room " + room.roomId);
+            throw new Error("Could't get state for room " + room.roomId);
+        }
+        const callMemberEvents = roomState.getStateEvents(EventType.GroupCallMemberPrefix);
+
+        const callMemberships: CallMembership[] = [];
+        for (const memberEvent of callMemberEvents) {
+            const eventMemberships: CallMembershipData[] = memberEvent.getContent()["memberships"];
+            if (eventMemberships === undefined) {
+                logger.warn(`Ignoring malformed member event from ${memberEvent.getSender()}: no memberships section`);
+                continue;
+            }
+            if (!Array.isArray(eventMemberships)) {
+                logger.warn(`Malformed member event from ${memberEvent.getSender()}: memberships is not an array`);
+                continue;
+            }
+
+            for (const membershipData of eventMemberships) {
+                try {
+                    const membership = new CallMembership(memberEvent, membershipData);
+
+                    if (membership.callId !== "" || membership.scope !== "m.room") {
+                        // for now, just ignore anything that isn't the a room scope call
+                        logger.info(`Ignoring user-scoped call`);
+                        continue;
+                    }
+
+                    if (membership.isExpired()) {
+                        logger.info(
+                            `Ignoring expired device membership ${memberEvent.getSender()}/${membership.deviceId}`,
+                        );
+                        continue;
+                    }
+                    callMemberships.push(membership);
+                } catch (e) {
+                    logger.warn("Couldn't construct call membership: ", e);
+                }
+            }
+        }
+
+        callMemberships.sort((a, b) => a.createdTs() - b.createdTs());
+        logger.debug(
+            "Call memberships, in order: ",
+            callMemberships.map((m) => [m.createdTs(), m.member.userId]),
+        );
+
+        return callMemberships;
+    }
+
+    /**
+     * Return a the MatrixRTC for the room, whether there are currently active members or not
+     */
+    public static roomSessionForRoom(client: MatrixClient, room: Room): MatrixRTCSession {
+        const callMemberships = MatrixRTCSession.callMembershipsForRoom(room);
+
+        return new MatrixRTCSession(client, room, callMemberships);
+    }
+
+    private constructor(
+        private readonly client: MatrixClient,
+        public readonly room: Room,
+        public memberships: CallMembership[],
+    ) {
+        super();
+        this.setExpiryTimer();
+    }
+
+    /*
+     * Returns true if we intend to be participating in the MatrixRTC session.
+     */
+    public isJoined(): boolean {
+        return this.relativeExpiry !== undefined;
+    }
+
+    /**
+     * Performs cleanup & removes timers for client shutdown
+     */
+    public stop(): void {
+        this.leaveRoomSession();
+        if (this.expiryTimeout) {
+            clearTimeout(this.expiryTimeout);
+            this.expiryTimeout = undefined;
+        }
+        if (this.memberEventTimeout) {
+            clearTimeout(this.memberEventTimeout);
+            this.memberEventTimeout = undefined;
+        }
+    }
+
+    /**
+     * Announces this user and device as joined to the MatrixRTC session,
+     * and continues to update the membership event to keep it valid until
+     * leaveRoomSession() is called
+     * This will not subscribe to updates: remember to call subscribe() separately if
+     * desired.
+     * This method will return immediately and the session will be joined in the background.
+     */
+    public joinRoomSession(activeFoci: Focus[]): void {
+        if (this.isJoined()) {
+            logger.info(`Already joined to session in room ${this.room.roomId}: ignoring join call`);
+            return;
+        }
+
+        logger.info(`Joining call session in room ${this.room.roomId}`);
+        this.activeFoci = activeFoci;
+        this.relativeExpiry = MEMBERSHIP_EXPIRY_TIME;
+        this.emit(MatrixRTCSessionEvent.JoinStateChanged, true);
+        // We don't wait for this, mostly because it may fail and schedule a retry, so this
+        // function returning doesn't really mean anything at all.
+        this.triggerCallMembershipEventUpdate();
+    }
+
+    /**
+     * Announces this user and device as having left the MatrixRTC session
+     * and stops scheduled updates.
+     * This will not unsubscribe from updates: remember to call unsubscribe() separately if
+     * desired.
+     */
+    public leaveRoomSession(): void {
+        if (!this.isJoined()) {
+            logger.info(`Not joined to session in room ${this.room.roomId}: ignoring leave call`);
+            return;
+        }
+
+        logger.info(`Leaving call session in room ${this.room.roomId}`);
+        this.relativeExpiry = undefined;
+        this.activeFoci = undefined;
+        this.emit(MatrixRTCSessionEvent.JoinStateChanged, false);
+        this.triggerCallMembershipEventUpdate();
+    }
+
+    /**
+     * Sets a timer for the soonest membership expiry
+     */
+    private setExpiryTimer(): void {
+        if (this.expiryTimeout) {
+            clearTimeout(this.expiryTimeout);
+            this.expiryTimeout = undefined;
+        }
+
+        let soonestExpiry;
+        for (const membership of this.memberships) {
+            const thisExpiry = membership.getMsUntilExpiry();
+            if (soonestExpiry === undefined || thisExpiry < soonestExpiry) {
+                soonestExpiry = thisExpiry;
+            }
+        }
+
+        if (soonestExpiry != undefined) {
+            this.expiryTimeout = setTimeout(this.onMembershipUpdate, soonestExpiry);
+        }
+    }
+
+    public getOldestMembership(): CallMembership | undefined {
+        return this.memberships[0];
+    }
+
+    public onMembershipUpdate = (): void => {
+        const oldMemberships = this.memberships;
+        this.memberships = MatrixRTCSession.callMembershipsForRoom(this.room);
+
+        const changed =
+            oldMemberships.length != this.memberships.length ||
+            oldMemberships.some((m, i) => !CallMembership.equal(m, this.memberships[i]));
+
+        if (changed) {
+            logger.info(`Memberships for call in room ${this.room.roomId} have changed: emitting`);
+            this.emit(MatrixRTCSessionEvent.MembershipsChanged, oldMemberships, this.memberships);
+        }
+
+        this.setExpiryTimer();
+    };
+
+    /**
+     * Constructs our own membership
+     * @param prevEvent - The previous version of our call membership, if any
+     */
+    private makeMyMembership(prevMembership?: CallMembership): CallMembershipData {
+        if (this.relativeExpiry === undefined) {
+            throw new Error("Tried to create our own membership event when we're not joined!");
+        }
+
+        const m: CallMembershipData = {
+            call_id: "",
+            scope: "m.room",
+            application: "m.call",
+            device_id: this.client.getDeviceId()!,
+            expires: this.relativeExpiry,
+            foci_active: this.activeFoci,
+        };
+
+        if (prevMembership) m.created_ts = prevMembership.createdTs();
+
+        return m;
+    }
+
+    /**
+     * Returns true if our membership event needs to be updated
+     */
+    private membershipEventNeedsUpdate(
+        myPrevMembershipData?: CallMembershipData,
+        myPrevMembership?: CallMembership,
+    ): boolean {
+        // work out if we need to update our membership event
+        let needsUpdate = false;
+        // Need to update if there's a membership for us but we're not joined (valid or otherwise)
+        if (!this.isJoined() && myPrevMembershipData) needsUpdate = true;
+        if (this.isJoined()) {
+            // ...or if we are joined, but there's no valid membership event
+            if (!myPrevMembership) {
+                needsUpdate = true;
+            } else if (myPrevMembership.getMsUntilExpiry() < MEMBERSHIP_EXPIRY_TIME / 2) {
+                // ...or if the expiry time needs bumping
+                needsUpdate = true;
+                this.relativeExpiry! += MEMBERSHIP_EXPIRY_TIME;
+            }
+        }
+
+        return needsUpdate;
+    }
+
+    /**
+     * Makes a new membership list given the old list alonng with this user's previous membership event
+     * (if any) and this device's previous membership (if any)
+     */
+    private makeNewMemberships(
+        oldMemberships: CallMembershipData[],
+        myCallMemberEvent?: MatrixEvent,
+        myPrevMembership?: CallMembership,
+    ): CallMembershipData[] {
+        const localDeviceId = this.client.getDeviceId();
+        if (!localDeviceId) throw new Error("Local device ID is null!");
+
+        const filterExpired = (m: CallMembershipData): boolean => {
+            let membershipObj;
+            try {
+                membershipObj = new CallMembership(myCallMemberEvent!, m);
+            } catch (e) {
+                return false;
+            }
+
+            return !membershipObj.isExpired();
+        };
+
+        const transformMemberships = (m: CallMembershipData): CallMembershipData => {
+            if (m.created_ts === undefined) {
+                // we need to fill this in with the origin_server_ts from its original event
+                m.created_ts = myCallMemberEvent!.getTs();
+            }
+
+            return m;
+        };
+
+        // Filter our any invalid or expired memberships, and also our own - we'll add that back in next
+        let newMemberships = oldMemberships.filter(filterExpired).filter((m) => m.device_id !== localDeviceId);
+
+        // Fix up any memberships that need their created_ts adding
+        newMemberships = newMemberships.map(transformMemberships);
+
+        // If we're joined, add our own
+        if (this.isJoined()) {
+            newMemberships.push(this.makeMyMembership(myPrevMembership));
+        }
+
+        return newMemberships;
+    }
+
+    private triggerCallMembershipEventUpdate = async (): Promise<void> => {
+        if (this.updateCallMembershipRunning) {
+            this.needCallMembershipUpdate = true;
+            return;
+        }
+
+        this.updateCallMembershipRunning = true;
+        try {
+            // if anything triggers an update while the update is running, do another update afterwards
+            do {
+                this.needCallMembershipUpdate = false;
+                await this.updateCallMembershipEvent();
+            } while (this.needCallMembershipUpdate);
+        } finally {
+            this.updateCallMembershipRunning = false;
+        }
+    };
+
+    private async updateCallMembershipEvent(): Promise<void> {
+        if (this.memberEventTimeout) {
+            clearTimeout(this.memberEventTimeout);
+            this.memberEventTimeout = undefined;
+        }
+
+        const roomState = this.room.getLiveTimeline().getState(EventTimeline.FORWARDS);
+        if (!roomState) throw new Error("Couldn't get room state for room " + this.room.roomId);
+
+        const localUserId = this.client.getUserId();
+        const localDeviceId = this.client.getDeviceId();
+        if (!localUserId || !localDeviceId) throw new Error("User ID or device ID was null!");
+
+        const myCallMemberEvent = roomState.getStateEvents(EventType.GroupCallMemberPrefix, localUserId) ?? undefined;
+        const content = myCallMemberEvent?.getContent<Record<any, unknown>>() ?? {};
+        const memberships: CallMembershipData[] = Array.isArray(content["memberships"]) ? content["memberships"] : [];
+
+        const myPrevMembershipData = memberships.find((m) => m.device_id === localDeviceId);
+        let myPrevMembership;
+        try {
+            if (myCallMemberEvent && myPrevMembershipData) {
+                myPrevMembership = new CallMembership(myCallMemberEvent, myPrevMembershipData);
+            }
+        } catch (e) {
+            // This would indicate a bug or something weird if our own call membership
+            // wasn't valid
+            logger.warn("Our previous call membership was invalid - this shouldn't happen.", e);
+        }
+
+        if (myPrevMembership) {
+            logger.debug(`${myPrevMembership.getMsUntilExpiry()} until our membership expires`);
+        }
+
+        if (!this.membershipEventNeedsUpdate(myPrevMembershipData, myPrevMembership)) {
+            // nothing to do - reschedule the check again
+            this.memberEventTimeout = setTimeout(this.triggerCallMembershipEventUpdate, MEMBER_EVENT_CHECK_PERIOD);
+            return;
+        }
+
+        const newContent = {
+            memberships: this.makeNewMemberships(memberships, myCallMemberEvent, myPrevMembership),
+        };
+
+        let resendDelay;
+        try {
+            await this.client.sendStateEvent(
+                this.room.roomId,
+                EventType.GroupCallMemberPrefix,
+                newContent,
+                localUserId,
+            );
+            logger.info(`Sent updated call member event.`);
+
+            // check periodically to see if we need to refresh our member event
+            if (this.isJoined()) resendDelay = MEMBER_EVENT_CHECK_PERIOD;
+        } catch (e) {
+            resendDelay = CALL_MEMBER_EVENT_RETRY_DELAY_MIN + Math.random() * 2000;
+            logger.warn(`Failed to send call member event: retrying in ${resendDelay}`);
+        }
+
+        if (resendDelay) this.memberEventTimeout = setTimeout(this.triggerCallMembershipEventUpdate, resendDelay);
+    }
+}
@@ -0,0 +1,128 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { logger } from "../logger";
+import { MatrixClient, ClientEvent } from "../client";
+import { TypedEventEmitter } from "../models/typed-event-emitter";
+import { Room } from "../models/room";
+import { RoomState, RoomStateEvent } from "../models/room-state";
+import { MatrixEvent } from "../models/event";
+import { MatrixRTCSession } from "./MatrixRTCSession";
+
+export enum MatrixRTCSessionManagerEvents {
+    // A member has joined the MatrixRTC session, creating an active session in a room where there wasn't previously
+    SessionStarted = "session_started",
+    // All participants have left a given MatrixRTC session.
+    SessionEnded = "session_ended",
+}
+
+type EventHandlerMap = {
+    [MatrixRTCSessionManagerEvents.SessionStarted]: (roomId: string, session: MatrixRTCSession) => void;
+    [MatrixRTCSessionManagerEvents.SessionEnded]: (roomId: string, session: MatrixRTCSession) => void;
+};
+
+/**
+ * Holds all active MatrixRTC session objects and creates new ones as events arrive.
+ * This interface is UNSTABLE and may change without warning.
+ */
+export class MatrixRTCSessionManager extends TypedEventEmitter<MatrixRTCSessionManagerEvents, EventHandlerMap> {
+    // All the room-scoped sessions we know about. This will include any where the app
+    // has queried for the MatrixRTC sessions in a room, whether it's ever had any members
+    // or not). We keep a (lazily created) session object for every room to ensure that there
+    // is only ever one single room session object for any given room for the lifetime of the
+    // client: that way there can never be any code holding onto a stale object that is no
+    // longer the correct session object for the room.
+    private roomSessions = new Map<string, MatrixRTCSession>();
+
+    public constructor(private client: MatrixClient) {
+        super();
+    }
+
+    public start(): void {
+        // We shouldn't need to null-check here, but matrix-client.spec.ts mocks getRooms
+        // returing nothing, and breaks tests if you change it to return an empty array :'(
+        for (const room of this.client.getRooms() ?? []) {
+            const session = MatrixRTCSession.roomSessionForRoom(this.client, room);
+            if (session.memberships.length > 0) {
+                this.roomSessions.set(room.roomId, session);
+            }
+        }
+
+        this.client.on(ClientEvent.Room, this.onRoom);
+        this.client.on(RoomStateEvent.Events, this.onRoomState);
+    }
+
+    public stop(): void {
+        for (const sess of this.roomSessions.values()) {
+            sess.stop();
+        }
+        this.roomSessions.clear();
+
+        this.client.removeListener(ClientEvent.Room, this.onRoom);
+        this.client.removeListener(RoomStateEvent.Events, this.onRoomState);
+    }
+
+    /**
+     * Gets the main MatrixRTC session for a room, or undefined if there is
+     * no current session
+     */
+    public getActiveRoomSession(room: Room): MatrixRTCSession | undefined {
+        return this.roomSessions.get(room.roomId)!;
+    }
+
+    /**
+     * Gets the main MatrixRTC session for a room, returning an empty session
+     * if no members are currently participating
+     */
+    public getRoomSession(room: Room): MatrixRTCSession {
+        if (!this.roomSessions.has(room.roomId)) {
+            this.roomSessions.set(room.roomId, MatrixRTCSession.roomSessionForRoom(this.client, room));
+        }
+
+        return this.roomSessions.get(room.roomId)!;
+    }
+
+    private onRoom = (room: Room): void => {
+        this.refreshRoom(room);
+    };
+
+    private onRoomState = (event: MatrixEvent, _state: RoomState): void => {
+        const room = this.client.getRoom(event.getRoomId());
+        if (!room) {
+            logger.error(`Got room state event for unknown room ${event.getRoomId()}!`);
+            return;
+        }
+
+        this.refreshRoom(room);
+    };
+
+    private refreshRoom(room: Room): void {
+        const isNewSession = !this.roomSessions.has(room.roomId);
+        const sess = this.getRoomSession(room);
+
+        const wasActiveAndKnown = sess.memberships.length > 0 && !isNewSession;
+
+        sess.onMembershipUpdate();
+
+        const nowActive = sess.memberships.length > 0;
+
+        if (wasActiveAndKnown && !nowActive) {
+            this.emit(MatrixRTCSessionManagerEvents.SessionEnded, room.roomId, this.roomSessions.get(room.roomId)!);
+        } else if (!wasActiveAndKnown && nowActive) {
+            this.emit(MatrixRTCSessionManagerEvents.SessionStarted, room.roomId, this.roomSessions.get(room.roomId)!);
+        }
+    }
+}
@@ -0,0 +1,24 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+/**
+ * Information about a MatrixRTC conference focus. The only attribute that
+ * the js-sdk (currently) knows about is the type: applications can extend
+ * this class for different types of focus.
+ */
+export interface Focus {
+    type: string;
+}
@@ -1026,7 +1026,7 @@ export class MatrixEvent extends TypedEventEmitter<MatrixEventEmittedEvents, Mat
     * signing the public curve25519 key with the ed25519 key.
     *
     * In general, applications should not use this method directly, but should
-     * instead use MatrixClient.getEventSenderDeviceInfo.
+     * instead use {@link CryptoApi#getEncryptionInfoForEvent}.
     */
    public getClaimedEd25519Key(): string | null {
        return this.claimedEd25519Key;
@@ -1684,7 +1684,6 @@ const REDACT_KEEP_KEYS = new Set([
 // a map from state event type to the .content keys we keep when an event is redacted
 const REDACT_KEEP_CONTENT_MAP: Record<string, Record<string, 1>> = {
    [EventType.RoomMember]: { membership: 1 },
-    [EventType.RoomCreate]: { creator: 1 },
    [EventType.RoomJoinRules]: { join_rule: 1 },
    [EventType.RoomPowerLevels]: {
        ban: 1,
@@ -146,6 +146,7 @@ export enum RoomEvent {
    CurrentStateUpdated = "Room.CurrentStateUpdated",
    HistoryImportedWithinTimeline = "Room.historyImportedWithinTimeline",
    UnreadNotifications = "Room.UnreadNotifications",
+    Summary = "Room.Summary",
 }

 export type RoomEmittedEvents =
@@ -290,6 +291,14 @@ export type RoomEventHandlerMap = {
    [RoomEvent.HistoryImportedWithinTimeline]: (markerEvent: MatrixEvent, room: Room) => void;
    [RoomEvent.UnreadNotifications]: (unreadNotifications?: NotificationCount, threadId?: string) => void;
    [RoomEvent.TimelineRefresh]: (room: Room, eventTimelineSet: EventTimelineSet) => void;
+    /**
+     * Fires when a new room summary is returned by `/sync`.
+     *
+     * See https://spec.matrix.org/v1.8/client-server-api/#_matrixclientv3sync_roomsummary
+     * for full details
+     * @param summary - the room summary object
+     */
+    [RoomEvent.Summary]: (summary: IRoomSummary) => void;
    [ThreadEvent.New]: (thread: Thread, toStartOfTimeline: boolean) => void;
    /**
     * Fires when a new poll instance is added to the room state
@@ -569,7 +578,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
     */
    public getCreator(): string | null {
        const createEvent = this.currentState.getStateEvents(EventType.RoomCreate, "");
-        return createEvent?.getContent()["creator"] ?? null;
+        return createEvent?.getSender() ?? null;
    }

    /**
@@ -840,7 +849,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
    }

    /**
-     * @returns the membership type (join | leave | invite) for the logged in user
+     * @returns the membership type (join | leave | invite | knock) for the logged in user
     */
    public getMyMembership(): string {
        return this.selfMembership ?? "leave";
@@ -1499,6 +1508,8 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                return userId !== this.myUserId;
            });
        }
+
+        this.emit(RoomEvent.Summary, summary);
    }

    /**
@@ -2936,12 +2947,18 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {

                        // If the read receipt sent for the logged in user matches
                        // the last event of the live timeline, then we know for a fact
-                        // that the user has read that message.
-                        // We can mark the room as read and not wait for the local echo
-                        // from synapse
+                        // that the user has read that message, so we can mark the room
+                        // as read and not wait for the remote echo from synapse.
+                        //
                        // This needs to be done after the initial sync as we do not want this
                        // logic to run whilst the room is being initialised
-                        if (this.client.isInitialSyncComplete() && userId === this.client.getUserId()) {
+                        //
+                        // We only do this for non-synthetic receipts, because
+                        // our intention is to do this when the user really did
+                        // just read a message, not when we are e.g. receiving
+                        // an event during the sync. More explanation at:
+                        // https://github.com/matrix-org/matrix-js-sdk/issues/3684
+                        if (!synthetic && this.client.isInitialSyncComplete() && userId === this.client.getUserId()) {
                            const lastEvent = receiptDestination.timeline[receiptDestination.timeline.length - 1];
                            if (lastEvent && eventId === lastEvent.getId() && userId === lastEvent.getSender()) {
                                receiptDestination.setUnread(NotificationCountType.Total, 0);
@@ -32,8 +32,6 @@ export class CrossSigningIdentity {
        private readonly olmMachine: OlmMachine,
        private readonly outgoingRequestProcessor: OutgoingRequestProcessor,
        private readonly secretStorage: ServerSideSecretStorage,
-        /** Called if the cross signing keys are imported from the secret storage */
-        private readonly onCrossSigningKeysImport: () => void,
    ) {}

    /**
@@ -95,8 +93,6 @@ export class CrossSigningIdentity {
            // Sign the device with our cross-signing key and upload the signature
            const request: RustSdkCryptoJs.SignatureUploadRequest = await device.verify();
            await this.outgoingRequestProcessor.makeOutgoingRequest(request);
-
-            this.onCrossSigningKeysImport();
        }

        // TODO: we might previously have bootstrapped cross-signing but not completed uploading the keys to the
@@ -75,7 +75,12 @@ export class OutgoingRequestProcessor {
        } else if (msg instanceof SignatureUploadRequest) {
            resp = await this.rawJsonRequest(Method.Post, "/_matrix/client/v3/keys/signatures/upload", {}, msg.body);
        } else if (msg instanceof KeysBackupRequest) {
-            resp = await this.rawJsonRequest(Method.Put, "/_matrix/client/v3/room_keys/keys", {}, msg.body);
+            resp = await this.rawJsonRequest(
+                Method.Put,
+                "/_matrix/client/v3/room_keys/keys",
+                { version: msg.version },
+                msg.body,
+            );
        } else if (msg instanceof ToDeviceRequest) {
            const path =
                `/_matrix/client/v3/sendToDevice/${encodeURIComponent(msg.event_type)}/` +
@@ -83,7 +88,7 @@ export class OutgoingRequestProcessor {
            resp = await this.rawJsonRequest(Method.Put, path, {}, msg.body);
        } else if (msg instanceof RoomMessageRequest) {
            const path =
-                `/_matrix/client/v3/room/${encodeURIComponent(msg.room_id)}/send/` +
+                `/_matrix/client/v3/rooms/${encodeURIComponent(msg.room_id)}/send/` +
                `${encodeURIComponent(msg.event_type)}/${encodeURIComponent(msg.txn_id)}`;
            resp = await this.rawJsonRequest(Method.Put, path, {}, msg.body);
        } else if (msg instanceof SigningKeysUploadRequest) {
@@ -100,7 +105,20 @@ export class OutgoingRequestProcessor {
        }

        if (msg.id) {
-            await this.olmMachine.markRequestAsSent(msg.id, msg.type, resp);
+            try {
+                await this.olmMachine.markRequestAsSent(msg.id, msg.type, resp);
+            } catch (e) {
+                // Ignore errors which are caused by the olmMachine having been freed. The exact error message depends
+                // on whether we are using a release or develop build of rust-sdk-crypto-wasm.
+                if (
+                    e instanceof Error &&
+                    (e.message === "Attempt to use a moved value" || e.message === "null pointer passed to rust")
+                ) {
+                    logger.log(`Ignoring error '${e.message}': client is likely shutting down`);
+                } else {
+                    throw e;
+                }
+            }
        }
    }

@@ -17,20 +17,73 @@ limitations under the License.
 import { OlmMachine, SignatureVerification } from "@matrix-org/matrix-sdk-crypto-wasm";
 import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";

-import { BackupTrustInfo, Curve25519AuthData, KeyBackupInfo } from "../crypto-api/keybackup";
+import {
+    BackupTrustInfo,
+    Curve25519AuthData,
+    KeyBackupCheck,
+    KeyBackupInfo,
+    KeyBackupSession,
+    Curve25519SessionData,
+} from "../crypto-api/keybackup";
+import { logger } from "../logger";
+import { ClientPrefix, IHttpOpts, MatrixError, MatrixHttpApi, Method } from "../http-api";
+import { CryptoEvent, IMegolmSessionData } from "../crypto";
+import { TypedEventEmitter } from "../models/typed-event-emitter";
+import { encodeUri } from "../utils";
+import { OutgoingRequestProcessor } from "./OutgoingRequestProcessor";
+import { sleep } from "../utils";
+import { BackupDecryptor } from "../common-crypto/CryptoBackend";
+import { IEncryptedPayload } from "../crypto/aes";
+
+/** Authentification of the backup info, depends on algorithm */
+type AuthData = KeyBackupInfo["auth_data"];
+
+/**
+ * Holds information of a created keybackup.
+ * Useful to get the generated private key material and save it securely somewhere.
+ */
+interface KeyBackupCreationInfo {
+    version: string;
+    algorithm: string;
+    authData: AuthData;
+    decryptionKey: RustSdkCryptoJs.BackupDecryptionKey;
+}

 /**
 * @internal
 */
-export class RustBackupManager {
-    public constructor(private readonly olmMachine: OlmMachine) {}
+export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents, RustBackupCryptoEventMap> {
+    /** Have we checked if there is a backup on the server which we can use */
+    private checkedForBackup = false;
+    private activeBackupVersion: string | null = null;
+    private stopped = false;
+
+    /** whether {@link backupKeysLoop} is currently running */
+    private backupKeysLoopRunning = false;
+
+    public constructor(
+        private readonly olmMachine: OlmMachine,
+        private readonly http: MatrixHttpApi<IHttpOpts & { onlyData: true }>,
+        private readonly outgoingRequestProcessor: OutgoingRequestProcessor,
+    ) {
+        super();
+    }
+
+    /**
+     * Tells the RustBackupManager to stop.
+     * The RustBackupManager is scheduling background uploads of keys to the backup, this
+     * call allows to cancel the process when the client is stoppped.
+     */
+    public stop(): void {
+        this.stopped = true;
+    }

    /**
     * Get the backup version we are currently backing up to, if any
     */
    public async getActiveBackupVersion(): Promise<string | null> {
-        // TODO stub
-        return null;
+        if (!this.olmMachine.isBackupEnabled()) return null;
+        return this.activeBackupVersion;
    }

    /**
@@ -52,4 +105,332 @@ export class RustBackupManager {
            trusted: signatureVerification.trusted(),
        };
    }
+
+    /**
+     * Re-check the key backup and enable/disable it as appropriate.
+     *
+     * @param force - whether we should force a re-check even if one has already happened.
+     */
+    public checkKeyBackupAndEnable(force: boolean): Promise<KeyBackupCheck | null> {
+        if (!force && this.checkedForBackup) {
+            return Promise.resolve(null);
+        }
+
+        // make sure there is only one check going on at a time
+        if (!this.keyBackupCheckInProgress) {
+            this.keyBackupCheckInProgress = this.doCheckKeyBackup().finally(() => {
+                this.keyBackupCheckInProgress = null;
+            });
+        }
+        return this.keyBackupCheckInProgress;
+    }
+    private keyBackupCheckInProgress: Promise<KeyBackupCheck | null> | null = null;
+
+    /** Helper for `checkKeyBackup` */
+    private async doCheckKeyBackup(): Promise<KeyBackupCheck | null> {
+        logger.log("Checking key backup status...");
+        let backupInfo: KeyBackupInfo | null = null;
+        try {
+            backupInfo = await this.requestKeyBackupVersion();
+        } catch (e) {
+            logger.warn("Error checking for active key backup", e);
+            return null;
+        }
+        this.checkedForBackup = true;
+
+        if (backupInfo && !backupInfo.version) {
+            logger.warn("active backup lacks a useful 'version'; ignoring it");
+        }
+
+        const activeVersion = await this.getActiveBackupVersion();
+
+        if (!backupInfo) {
+            if (activeVersion !== null) {
+                logger.log("No key backup present on server: disabling key backup");
+                await this.disableKeyBackup();
+            } else {
+                logger.log("No key backup present on server: not enabling key backup");
+            }
+            return null;
+        }
+
+        const trustInfo = await this.isKeyBackupTrusted(backupInfo);
+
+        if (!trustInfo.trusted) {
+            if (activeVersion !== null) {
+                logger.log("Key backup present on server but not trusted: disabling key backup");
+                await this.disableKeyBackup();
+            } else {
+                logger.log("Key backup present on server but not trusted: not enabling key backup");
+            }
+        } else {
+            if (activeVersion === null) {
+                logger.log(`Found usable key backup v${backupInfo.version}: enabling key backups`);
+                await this.enableKeyBackup(backupInfo);
+            } else if (activeVersion !== backupInfo.version) {
+                logger.log(`On backup version ${activeVersion} but found version ${backupInfo.version}: switching.`);
+                // This will remove any pending backup request, remove the backup key and reset the backup state of each room key we have.
+                await this.disableKeyBackup();
+                // Enabling will now trigger re-upload of all the keys
+                await this.enableKeyBackup(backupInfo);
+            } else {
+                logger.log(`Backup version ${backupInfo.version} still current`);
+            }
+        }
+        return { backupInfo, trustInfo };
+    }
+
+    private async enableKeyBackup(backupInfo: KeyBackupInfo): Promise<void> {
+        // we know for certain it must be a Curve25519 key, because we have verified it and only Curve25519
+        // keys can be verified.
+        //
+        // we also checked it has a valid `version`.
+        await this.olmMachine.enableBackupV1(
+            (backupInfo.auth_data as Curve25519AuthData).public_key,
+            backupInfo.version!,
+        );
+        this.activeBackupVersion = backupInfo.version!;
+
+        this.emit(CryptoEvent.KeyBackupStatus, true);
+
+        this.backupKeysLoop();
+    }
+
+    /**
+     * Restart the backup key loop if there is an active trusted backup.
+     * Doesn't try to check the backup server side. To be called when a new
+     * megolm key is known locally.
+     */
+    public async maybeUploadKey(): Promise<void> {
+        if (this.activeBackupVersion != null) {
+            this.backupKeysLoop();
+        }
+    }
+
+    private async disableKeyBackup(): Promise<void> {
+        await this.olmMachine.disableBackup();
+        this.activeBackupVersion = null;
+        this.emit(CryptoEvent.KeyBackupStatus, false);
+    }
+
+    private async backupKeysLoop(maxDelay = 10000): Promise<void> {
+        if (this.backupKeysLoopRunning) {
+            logger.log(`Backup loop already running`);
+            return;
+        }
+        this.backupKeysLoopRunning = true;
+
+        logger.log(`Starting loop for ${this.activeBackupVersion}.`);
+
+        // wait between 0 and `maxDelay` seconds, to avoid backup
+        // requests from different clients hitting the server all at
+        // the same time when a new key is sent
+        const delay = Math.random() * maxDelay;
+        await sleep(delay);
+
+        try {
+            let numFailures = 0; // number of consecutive network failures for exponential backoff
+
+            while (!this.stopped) {
+                // Get a batch of room keys to upload
+                const request: RustSdkCryptoJs.KeysBackupRequest | null = await this.olmMachine.backupRoomKeys();
+
+                if (!request || this.stopped || !this.activeBackupVersion) {
+                    logger.log(`Ending loop for ${this.activeBackupVersion}.`);
+                    return;
+                }
+
+                try {
+                    await this.outgoingRequestProcessor.makeOutgoingRequest(request);
+                    numFailures = 0;
+
+                    const keyCount: RustSdkCryptoJs.RoomKeyCounts = await this.olmMachine.roomKeyCounts();
+                    const remaining = keyCount.total - keyCount.backedUp;
+                    this.emit(CryptoEvent.KeyBackupSessionsRemaining, remaining);
+                } catch (err) {
+                    numFailures++;
+                    logger.error("Error processing backup request for rust crypto-sdk", err);
+                    if (err instanceof MatrixError) {
+                        const errCode = err.data.errcode;
+                        if (errCode == "M_NOT_FOUND" || errCode == "M_WRONG_ROOM_KEYS_VERSION") {
+                            await this.disableKeyBackup();
+                            this.emit(CryptoEvent.KeyBackupFailed, err.data.errcode!);
+                            // There was an active backup and we are out of sync with the server
+                            // force a check server side
+                            this.backupKeysLoopRunning = false;
+                            this.checkKeyBackupAndEnable(true);
+                            return;
+                        } else if (errCode == "M_LIMIT_EXCEEDED") {
+                            // wait for that and then continue?
+                            const waitTime = err.data.retry_after_ms;
+                            if (waitTime > 0) {
+                                sleep(waitTime);
+                                continue;
+                            } // else go to the normal backoff
+                        }
+                    }
+
+                    // Some other errors (mx, network, or CORS or invalid urls?) anyhow backoff
+                    // exponential backoff if we have failures
+                    await sleep(1000 * Math.pow(2, Math.min(numFailures - 1, 4)));
+                }
+            }
+        } finally {
+            this.backupKeysLoopRunning = false;
+        }
+    }
+
+    /**
+     * Get information about the current key backup from the server
+     *
+     * @returns Information object from API or null if there is no active backup.
+     */
+    private async requestKeyBackupVersion(): Promise<KeyBackupInfo | null> {
+        try {
+            return await this.http.authedRequest<KeyBackupInfo>(
+                Method.Get,
+                "/room_keys/version",
+                undefined,
+                undefined,
+                {
+                    prefix: ClientPrefix.V3,
+                },
+            );
+        } catch (e) {
+            if ((<MatrixError>e).errcode === "M_NOT_FOUND") {
+                return null;
+            } else {
+                throw e;
+            }
+        }
+    }
+
+    /**
+     * Creates a new key backup by generating a new random private key.
+     *
+     * If there is an existing backup server side it will be deleted and replaced
+     * by the new one.
+     *
+     * @param signObject - Method that should sign the backup with existing device and
+     * existing identity.
+     * @returns a KeyBackupCreationInfo - All information related to the backup.
+     */
+    public async setupKeyBackup(signObject: (authData: AuthData) => Promise<void>): Promise<KeyBackupCreationInfo> {
+        // Clean up any existing backup
+        await this.deleteAllKeyBackupVersions();
+
+        const randomKey = RustSdkCryptoJs.BackupDecryptionKey.createRandomKey();
+        const pubKey = randomKey.megolmV1PublicKey;
+
+        const authData = { public_key: pubKey.publicKeyBase64 };
+
+        await signObject(authData);
+
+        const res = await this.http.authedRequest<{ version: string }>(
+            Method.Post,
+            "/room_keys/version",
+            undefined,
+            {
+                algorithm: pubKey.algorithm,
+                auth_data: authData,
+            },
+            {
+                prefix: ClientPrefix.V3,
+            },
+        );
+
+        this.olmMachine.saveBackupDecryptionKey(randomKey, res.version);
+
+        return {
+            version: res.version,
+            algorithm: pubKey.algorithm,
+            authData: authData,
+            decryptionKey: randomKey,
+        };
+    }
+
+    /**
+     * Deletes all key backups.
+     *
+     * Will call the API to delete active backup until there is no more present.
+     */
+    public async deleteAllKeyBackupVersions(): Promise<void> {
+        // there could be several backup versions. Delete all to be safe.
+        let current = (await this.requestKeyBackupVersion())?.version ?? null;
+        while (current != null) {
+            await this.deleteKeyBackupVersion(current);
+            current = (await this.requestKeyBackupVersion())?.version ?? null;
+        }
+
+        // XXX: Should this also update Secret Storage and delete any existing keys?
+    }
+
+    /**
+     * Deletes the given key backup.
+     *
+     * @param version - The backup version to delete.
+     */
+    public async deleteKeyBackupVersion(version: string): Promise<void> {
+        logger.debug(`deleteKeyBackupVersion v:${version}`);
+        const path = encodeUri("/room_keys/version/$version", { $version: version });
+        await this.http.authedRequest<void>(Method.Delete, path, undefined, undefined, {
+            prefix: ClientPrefix.V3,
+        });
+    }
 }
+
+/**
+ * Implementation of {@link BackupDecryptor} for the rust crypto backend.
+ */
+export class RustBackupDecryptor implements BackupDecryptor {
+    private decryptionKey: RustSdkCryptoJs.BackupDecryptionKey;
+    public sourceTrusted: boolean;
+
+    public constructor(decryptionKey: RustSdkCryptoJs.BackupDecryptionKey) {
+        this.decryptionKey = decryptionKey;
+        this.sourceTrusted = false;
+    }
+
+    /**
+     * Implements {@link BackupDecryptor#decryptSessions}
+     */
+    public async decryptSessions(
+        ciphertexts: Record<string, KeyBackupSession<Curve25519SessionData | IEncryptedPayload>>,
+    ): Promise<IMegolmSessionData[]> {
+        const keys: IMegolmSessionData[] = [];
+        for (const [sessionId, sessionData] of Object.entries(ciphertexts)) {
+            try {
+                const decrypted = JSON.parse(
+                    await this.decryptionKey.decryptV1(
+                        sessionData.session_data.ephemeral,
+                        sessionData.session_data.mac,
+                        sessionData.session_data.ciphertext,
+                    ),
+                );
+                decrypted.session_id = sessionId;
+                keys.push(decrypted);
+            } catch (e) {
+                logger.log("Failed to decrypt megolm session from backup", e, sessionData);
+            }
+        }
+        return keys;
+    }
+
+    /**
+     * Implements {@link BackupDecryptor#free}
+     */
+    public free(): void {
+        this.decryptionKey.free();
+    }
+}
+
+export type RustBackupCryptoEvents =
+    | CryptoEvent.KeyBackupStatus
+    | CryptoEvent.KeyBackupSessionsRemaining
+    | CryptoEvent.KeyBackupFailed;
+
+export type RustBackupCryptoEventMap = {
+    [CryptoEvent.KeyBackupStatus]: (enabled: boolean) => void;
+    [CryptoEvent.KeyBackupSessionsRemaining]: (remaining: number) => void;
+    [CryptoEvent.KeyBackupFailed]: (errCode: string) => void;
+};
@@ -65,6 +65,9 @@ export async function initRustCrypto(
    await olmMachine.registerRoomKeyUpdatedCallback((sessions: RustSdkCryptoJs.RoomKeyInfo[]) =>
        rustCrypto.onRoomKeysUpdated(sessions),
    );
+    await olmMachine.registerUserIdentityUpdatedCallback((userId: RustSdkCryptoJs.UserId) =>
+        rustCrypto.onUserIdentityUpdated(userId),
+    );

    // Tell the OlmMachine to think about its outgoing requests before we hand control back to the application.
    //
@@ -14,6 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+import anotherjson from "another-json";
 import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";

 import type { IEventDecryptionResult, IMegolmSessionData } from "../@types/crypto";
@@ -22,14 +23,13 @@ import type { IEncryptedEventInfo } from "../crypto/api";
 import { IContent, MatrixEvent, MatrixEventEvent } from "../models/event";
 import { Room } from "../models/room";
 import { RoomMember } from "../models/room-member";
-import { CryptoBackend, OnSyncCompletedData } from "../common-crypto/CryptoBackend";
+import { BackupDecryptor, CryptoBackend, OnSyncCompletedData } from "../common-crypto/CryptoBackend";
 import { logger } from "../logger";
-import { IHttpOpts, MatrixHttpApi, Method } from "../http-api";
-import { UserTrustLevel } from "../crypto/CrossSigning";
+import { ClientPrefix, IHttpOpts, MatrixHttpApi, Method } from "../http-api";
 import { RoomEncryptor } from "./RoomEncryptor";
 import { OutgoingRequest, OutgoingRequestProcessor } from "./OutgoingRequestProcessor";
 import { KeyClaimManager } from "./KeyClaimManager";
-import { MapWithDefault } from "../utils";
+import { MapWithDefault, encodeUri } from "../utils";
 import {
    BackupTrustInfo,
    BootstrapCrossSigningOpts,
@@ -38,11 +38,18 @@ import {
    CrossSigningKeyInfo,
    CrossSigningStatus,
    CryptoCallbacks,
+    Curve25519AuthData,
    DeviceVerificationStatus,
+    EventEncryptionInfo,
+    EventShieldColour,
+    EventShieldReason,
    GeneratedSecretStorageKey,
    ImportRoomKeyProgressData,
    ImportRoomKeysOpts,
+    KeyBackupCheck,
    KeyBackupInfo,
+    KeyBackupSession,
+    UserVerificationStatus,
    VerificationRequest,
 } from "../crypto-api";
 import { deviceKeysToDeviceMap, rustDeviceToJsDevice } from "./device-converter";
@@ -54,14 +61,27 @@ import { secretStorageContainsCrossSigningKeys } from "./secret-storage";
 import { keyFromPassphrase } from "../crypto/key_passphrase";
 import { encodeRecoveryKey } from "../crypto/recoverykey";
 import { crypto } from "../crypto/crypto";
-import { RustVerificationRequest, verificationMethodIdentifierToMethod } from "./verification";
-import { EventType, MsgType } from "../@types/event";
+import { isVerificationEvent, RustVerificationRequest, verificationMethodIdentifierToMethod } from "./verification";
+import { EventType } from "../@types/event";
 import { CryptoEvent } from "../crypto";
 import { TypedEventEmitter } from "../models/typed-event-emitter";
-import { RustBackupManager } from "./backup";
+import { RustBackupCryptoEventMap, RustBackupCryptoEvents, RustBackupDecryptor, RustBackupManager } from "./backup";
+import { TypedReEmitter } from "../ReEmitter";
+import { randomString } from "../randomstring";
+import { ClientStoppedError } from "../errors";
+import { ISignatures } from "../@types/signed";
+import { encodeBase64 } from "../common-crypto/base64";
+import { DecryptionError } from "../crypto/algorithms";

 const ALL_VERIFICATION_METHODS = ["m.sas.v1", "m.qr_code.scan.v1", "m.qr_code.show.v1", "m.reciprocate.v1"];

+interface ISignableObject {
+    signatures?: ISignatures;
+    unsigned?: object;
+}
+
+const KEY_BACKUP_CHECK_RATE_LIMIT = 5000; // ms
+
 /**
 * An implementation of {@link CryptoBackend} using the Rust matrix-sdk-crypto.
 *
@@ -77,6 +97,13 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
    /** whether {@link outgoingRequestLoop} is currently running */
    private outgoingRequestLoopRunning = false;

+    /**
+     * whether we check the outgoing requests queue again after the current check finishes.
+     *
+     * This should never be `true` unless `outgoingRequestLoopRunning` is also true.
+     */
+    private outgoingRequestLoopOneMoreLoop = false;
+
    /** mapping of roomId → encryptor class */
    private roomEncryptors: Record<string, RoomEncryptor> = {};

@@ -84,8 +111,11 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
    private keyClaimManager: KeyClaimManager;
    private outgoingRequestProcessor: OutgoingRequestProcessor;
    private crossSigningIdentity: CrossSigningIdentity;
+    private readonly backupManager: RustBackupManager;

-    public readonly backupManager: RustBackupManager;
+    private sessionLastCheckAttemptedTime: Record<string, number> = {}; // When did we last try to check the server for a given session id?
+
+    private readonly reemitter = new TypedReEmitter<RustCryptoEvents, RustCryptoEventMap>(this);

    public constructor(
        /** The `OlmMachine` from the underlying rust crypto sdk. */
@@ -113,19 +143,70 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        super();
        this.outgoingRequestProcessor = new OutgoingRequestProcessor(olmMachine, http);
        this.keyClaimManager = new KeyClaimManager(olmMachine, this.outgoingRequestProcessor);
-        this.eventDecryptor = new EventDecryptor(olmMachine);
-        this.backupManager = new RustBackupManager(olmMachine);
+        this.eventDecryptor = new EventDecryptor(olmMachine, this);

-        // Fire if the cross signing keys are imported from the secret storage
-        const onCrossSigningKeysImport = (): void => {
-            this.emit(CryptoEvent.UserTrustStatusChanged, this.userId, this.checkUserTrust(this.userId));
-        };
-        this.crossSigningIdentity = new CrossSigningIdentity(
-            olmMachine,
-            this.outgoingRequestProcessor,
-            secretStorage,
-            onCrossSigningKeysImport,
-        );
+        this.backupManager = new RustBackupManager(olmMachine, http, this.outgoingRequestProcessor);
+        this.reemitter.reEmit(this.backupManager, [
+            CryptoEvent.KeyBackupStatus,
+            CryptoEvent.KeyBackupSessionsRemaining,
+            CryptoEvent.KeyBackupFailed,
+        ]);
+
+        this.crossSigningIdentity = new CrossSigningIdentity(olmMachine, this.outgoingRequestProcessor, secretStorage);
+    }
+
+    /**
+     * Attempts to retrieve a session from a key backup, if enough time
+     * has elapsed since the last check for this session id.
+     */
+    public async queryKeyBackupRateLimited(targetRoomId: string, targetSessionId: string): Promise<void> {
+        const backupKeys: RustSdkCryptoJs.BackupKeys = await this.olmMachine.getBackupKeys();
+        if (!backupKeys.decryptionKey) return;
+        const version = backupKeys.backupVersion;
+
+        const now = new Date().getTime();
+        if (
+            !this.sessionLastCheckAttemptedTime[targetSessionId!] ||
+            now - this.sessionLastCheckAttemptedTime[targetSessionId!] > KEY_BACKUP_CHECK_RATE_LIMIT
+        ) {
+            this.sessionLastCheckAttemptedTime[targetSessionId!] = now;
+
+            const path = encodeUri("/room_keys/keys/$roomId/$sessionId", {
+                $roomId: targetRoomId,
+                $sessionId: targetSessionId,
+            });
+
+            const res = await this.http.authedRequest<KeyBackupSession>(Method.Get, path, { version }, undefined, {
+                prefix: ClientPrefix.V3,
+            });
+
+            if (this.stopped) return;
+
+            const backupDecryptor = new RustBackupDecryptor(backupKeys.decryptionKey);
+            if (res) {
+                const sessionsToImport: Record<string, KeyBackupSession> = {};
+                sessionsToImport[targetSessionId] = res;
+                const keys = await backupDecryptor.decryptSessions(sessionsToImport);
+                for (const k of keys) {
+                    k.room_id = targetRoomId!;
+                }
+                await this.importRoomKeys(keys);
+            }
+        }
+    }
+
+    /**
+     * Return the OlmMachine only if {@link RustCrypto#stop} has not been called.
+     *
+     * This allows us to better handle race conditions where the client is stopped before or during a crypto API call.
+     *
+     * @throws ClientStoppedError if {@link RustCrypto#stop} has been called.
+     */
+    private getOlmMachineOrThrow(): RustSdkCryptoJs.OlmMachine {
+        if (this.stopped) {
+            throw new ClientStoppedError();
+        }
+        return this.olmMachine;
    }

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -143,6 +224,7 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        this.stopped = true;

        this.keyClaimManager.stop();
+        this.backupManager.stop();

        // make sure we close() the OlmMachine; doing so means that all the Rust objects will be
        // cleaned up; in particular, the indexeddb connections will be closed, which means they
@@ -174,6 +256,11 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        return await this.eventDecryptor.attemptEventDecryption(event);
    }

+    /**
+     * Implementation of (deprecated) {@link MatrixClient#getEventEncryptionInfo}.
+     *
+     * @param event - event to inspect
+     */
    public getEventEncryptionInfo(event: MatrixEvent): IEncryptedEventInfo {
        // TODO: make this work properly. Or better, replace it.

@@ -192,9 +279,14 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        return ret as IEncryptedEventInfo;
    }

-    public checkUserTrust(userId: string): UserTrustLevel {
-        // TODO
-        return new UserTrustLevel(false, false, false);
+    /**
+     * Implementation of {@link CryptoBackend#checkUserTrust}.
+     *
+     * Stub for backwards compatibility.
+     *
+     */
+    public checkUserTrust(userId: string): UserVerificationStatus {
+        return new UserVerificationStatus(false, false, false);
    }

    /**
@@ -218,7 +310,6 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
     * The function is stub to keep the compatibility with the old crypto.
     * More information: https://github.com/vector-im/element-web/issues/25648
     *
-     *
     * Implementation of {@link CryptoBackend#checkOwnCrossSigningTrust}
     */
    public async checkOwnCrossSigningTrust(): Promise<void> {
@@ -233,20 +324,6 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv

    public globalBlacklistUnverifiedDevices = false;

-    /**
-     * Implementation of {@link CryptoApi.userHasCrossSigningKeys}.
-     */
-    public async userHasCrossSigningKeys(): Promise<boolean> {
-        const userId = new RustSdkCryptoJs.UserId(this.userId);
-        /* make sure we have an *up-to-date* idea of the user's cross-signing keys. This is important, because if we
-         * return "false" here, we will end up generating new cross-signing keys and replacing the existing ones.
-         */
-        const request = this.olmMachine.queryKeysForUsers([userId]);
-        await this.outgoingRequestProcessor.makeOutgoingRequest(request);
-        const userIdentity = await this.olmMachine.getIdentity(userId);
-        return userIdentity !== undefined;
-    }
-
    public prepareToEncrypt(room: Room): void {
        const encryptor = this.roomEncryptors[room.roomId];

@@ -278,6 +355,47 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        });
    }

+    /**
+     * Implementation of {@link CryptoApi.userHasCrossSigningKeys}.
+     */
+    public async userHasCrossSigningKeys(userId = this.userId, downloadUncached = false): Promise<boolean> {
+        // TODO: could probably do with a more efficient way of doing this than returning the whole set and searching
+        const rustTrackedUsers: Set<RustSdkCryptoJs.UserId> = await this.olmMachine.trackedUsers();
+        let rustTrackedUser: RustSdkCryptoJs.UserId | undefined;
+        for (const u of rustTrackedUsers) {
+            if (userId === u.toString()) {
+                rustTrackedUser = u;
+                break;
+            }
+        }
+
+        if (rustTrackedUser !== undefined) {
+            if (userId === this.userId) {
+                /* make sure we have an *up-to-date* idea of the user's cross-signing keys. This is important, because if we
+                 * return "false" here, we will end up generating new cross-signing keys and replacing the existing ones.
+                 */
+                const request = this.olmMachine.queryKeysForUsers([rustTrackedUser]);
+                await this.outgoingRequestProcessor.makeOutgoingRequest(request);
+            }
+            const userIdentity = await this.olmMachine.getIdentity(rustTrackedUser);
+            return userIdentity !== undefined;
+        } else if (downloadUncached) {
+            // Download the cross signing keys and check if the master key is available
+            const keyResult = await this.downloadDeviceList(new Set([userId]));
+            const keys = keyResult.master_keys?.[userId];
+
+            // No master key
+            if (!keys) return false;
+
+            // `keys` is an object with { [`ed25519:${pubKey}`]: pubKey }
+            // We assume only a single key, and we want the bare form without type
+            // prefix, so we select the values.
+            return Boolean(Object.values(keys.keys)[0]);
+        } else {
+            return false;
+        }
+    }
+
    /**
     * Get the device information for the given list of users.
     *
@@ -422,6 +540,18 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        });
    }

+    /**
+     * Implementation of {@link CryptoApi#getUserVerificationStatus}.
+     */
+    public async getUserVerificationStatus(userId: string): Promise<UserVerificationStatus> {
+        const userIdentity: RustSdkCryptoJs.UserIdentity | RustSdkCryptoJs.OwnUserIdentity | undefined =
+            await this.olmMachine.getIdentity(new RustSdkCryptoJs.UserId(userId));
+        if (userIdentity === undefined) {
+            return new UserVerificationStatus(false, false, false);
+        }
+        return new UserVerificationStatus(userIdentity.isVerified(), false, false);
+    }
+
    /**
     * Implementation of {@link CryptoApi#isCrossSigningReady}
     */
@@ -502,6 +632,7 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
    public async bootstrapSecretStorage({
        createSecretStorageKey,
        setupNewSecretStorage,
+        setupNewKeyBackup,
    }: CreateSecretStorageOpts = {}): Promise<void> {
        // If an AES Key is already stored in the secret storage and setupNewSecretStorage is not set
        // we don't want to create a new key
@@ -545,6 +676,10 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
            await this.secretStorage.store("m.cross_signing.master", crossSigningPrivateKeys.masterKey);
            await this.secretStorage.store("m.cross_signing.user_signing", crossSigningPrivateKeys.userSigningKey);
            await this.secretStorage.store("m.cross_signing.self_signing", crossSigningPrivateKeys.self_signing_key);
+
+            if (setupNewKeyBackup) {
+                await this.resetKeyBackup();
+            }
        }
    }

@@ -597,16 +732,17 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
     * Implementation of {@link CryptoApi#getCrossSigningStatus}
     */
    public async getCrossSigningStatus(): Promise<CrossSigningStatus> {
-        const userIdentity: RustSdkCryptoJs.OwnUserIdentity | null = await this.olmMachine.getIdentity(
+        const userIdentity: RustSdkCryptoJs.OwnUserIdentity | null = await this.getOlmMachineOrThrow().getIdentity(
            new RustSdkCryptoJs.UserId(this.userId),
        );
+
        const publicKeysOnDevice =
            Boolean(userIdentity?.masterKey) &&
            Boolean(userIdentity?.selfSigningKey) &&
            Boolean(userIdentity?.userSigningKey);
        const privateKeysInSecretStorage = await secretStorageContainsCrossSigningKeys(this.secretStorage);
        const crossSigningStatus: RustSdkCryptoJs.CrossSigningStatus | null =
-            await this.olmMachine.crossSigningStatus();
+            await this.getOlmMachineOrThrow().crossSigningStatus();

        return {
            publicKeysOnDevice,
@@ -649,6 +785,13 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        };
    }

+    /**
+     * Implementation of {@link CryptoApi.getEncryptionInfoForEvent}.
+     */
+    public async getEncryptionInfoForEvent(event: MatrixEvent): Promise<EventEncryptionInfo | null> {
+        return this.eventDecryptor.getEncryptionInfoForEvent(event);
+    }
+
    /**
     * Returns to-device verification requests that are already in progress for the given user id.
     *
@@ -704,6 +847,62 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        }
    }

+    /**
+     * Implementation of {@link CryptoApi#requestVerificationDM}
+     */
+    public async requestVerificationDM(userId: string, roomId: string): Promise<VerificationRequest> {
+        const userIdentity: RustSdkCryptoJs.UserIdentity | undefined = await this.olmMachine.getIdentity(
+            new RustSdkCryptoJs.UserId(userId),
+        );
+
+        if (!userIdentity) throw new Error(`unknown userId ${userId}`);
+
+        // Transform the verification methods into rust objects
+        const methods = this._supportedVerificationMethods.map((method) =>
+            verificationMethodIdentifierToMethod(method),
+        );
+        // Get the request content to send to the DM room
+        const verificationEventContent: string = await userIdentity.verificationRequestContent(methods);
+
+        // Send the request content to send to the DM room
+        const eventId = await this.sendVerificationRequestContent(roomId, verificationEventContent);
+
+        // Get a verification request
+        const request: RustSdkCryptoJs.VerificationRequest = await userIdentity.requestVerification(
+            new RustSdkCryptoJs.RoomId(roomId),
+            new RustSdkCryptoJs.EventId(eventId),
+            methods,
+        );
+        return new RustVerificationRequest(request, this.outgoingRequestProcessor, this._supportedVerificationMethods);
+    }
+
+    /**
+     * Send the verification content to a room
+     * See https://spec.matrix.org/v1.7/client-server-api/#put_matrixclientv3roomsroomidsendeventtypetxnid
+     *
+     * Prefer to use {@link OutgoingRequestProcessor.makeOutgoingRequest} when dealing with {@link RustSdkCryptoJs.RoomMessageRequest}
+     *
+     * @param roomId - the targeted room
+     * @param verificationEventContent - the request body.
+     *
+     * @returns the event id
+     */
+    private async sendVerificationRequestContent(roomId: string, verificationEventContent: string): Promise<string> {
+        const txId = randomString(32);
+        // Send the verification request content to the DM room
+        const { event_id: eventId } = await this.http.authedRequest<{ event_id: string }>(
+            Method.Put,
+            `/_matrix/client/v3/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${encodeURIComponent(txId)}`,
+            undefined,
+            verificationEventContent,
+            {
+                prefix: "",
+            },
+        );
+
+        return eventId;
+    }
+
    /**
     * The verification methods we offer to the other side during an interactive verification.
     */
@@ -795,7 +994,7 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
     * @param key - the backup decryption key
     */
    public async storeSessionBackupPrivateKey(key: Uint8Array): Promise<void> {
-        const base64Key = Buffer.from(key).toString("base64");
+        const base64Key = encodeBase64(key);

        // TODO get version from backupManager
        await this.olmMachine.saveBackupDecryptionKey(RustSdkCryptoJs.BackupDecryptionKey.fromBase64(base64Key), "");
@@ -819,6 +1018,87 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        return await this.backupManager.isKeyBackupTrusted(info);
    }

+    /**
+     * Force a re-check of the key backup and enable/disable it as appropriate.
+     *
+     * Implementation of {@link Crypto.CryptoApi.checkKeyBackupAndEnable}.
+     */
+    public async checkKeyBackupAndEnable(): Promise<KeyBackupCheck | null> {
+        return await this.backupManager.checkKeyBackupAndEnable(true);
+    }
+
+    /**
+     * Implementation of {@link CryptoApi#deleteKeyBackupVersion}.
+     */
+    public async deleteKeyBackupVersion(version: string): Promise<void> {
+        await this.backupManager.deleteKeyBackupVersion(version);
+    }
+
+    /**
+     * Implementation of {@link CryptoApi#resetKeyBackup}.
+     */
+    public async resetKeyBackup(): Promise<void> {
+        const backupInfo = await this.backupManager.setupKeyBackup((o) => this.signObject(o));
+
+        // we want to store the private key in 4S
+        // need to check if 4S is set up?
+        if (await this.secretStorageHasAESKey()) {
+            await this.secretStorage.store("m.megolm_backup.v1", backupInfo.decryptionKey.toBase64());
+        }
+
+        // we can check and start async
+        this.checkKeyBackupAndEnable();
+    }
+
+    /**
+     * Signs the given object with the current device and current identity (if available).
+     * As defined in {@link https://spec.matrix.org/v1.8/appendices/#signing-json | Signing JSON}.
+     *
+     * @param obj - The object to sign
+     */
+    private async signObject<T extends ISignableObject & object>(obj: T): Promise<void> {
+        const sigs = new Map(Object.entries(obj.signatures || {}));
+        const unsigned = obj.unsigned;
+
+        delete obj.signatures;
+        delete obj.unsigned;
+
+        const userSignatures = sigs.get(this.userId) || {};
+
+        const canonalizedJson = anotherjson.stringify(obj);
+        const signatures: RustSdkCryptoJs.Signatures = await this.olmMachine.sign(canonalizedJson);
+
+        const map = JSON.parse(signatures.asJSON());
+
+        sigs.set(this.userId, { ...userSignatures, ...map[this.userId] });
+
+        if (unsigned !== undefined) obj.unsigned = unsigned;
+        obj.signatures = Object.fromEntries(sigs.entries());
+    }
+
+    /**
+     * Implementation of {@link CryptoBackend#getBackupDecryptor}.
+     */
+    public async getBackupDecryptor(backupInfo: KeyBackupInfo, privKey: ArrayLike<number>): Promise<BackupDecryptor> {
+        if (backupInfo.algorithm != "m.megolm_backup.v1.curve25519-aes-sha2") {
+            throw new Error(`getBackupDecryptor Unsupported algorithm ${backupInfo.algorithm}`);
+        }
+
+        const authData = <Curve25519AuthData>backupInfo.auth_data;
+
+        if (!(privKey instanceof Uint8Array)) {
+            throw new Error(`getBackupDecryptor expects Uint8Array`);
+        }
+
+        const backupDecryptionKey = RustSdkCryptoJs.BackupDecryptionKey.fromBase64(encodeBase64(privKey));
+
+        if (authData.public_key != backupDecryptionKey.megolmV1PublicKey.publicKeyBase64) {
+            throw new Error(`getBackupDecryptor key mismatch error`);
+        }
+
+        return new RustBackupDecryptor(backupDecryptionKey);
+    }
+
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    //
    // SyncCryptoCallbacks implementation
@@ -1008,9 +1288,11 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        for (const key of keys) {
            this.onRoomKeyUpdated(key);
        }
+        this.backupManager.maybeUploadKey();
    }

    private onRoomKeyUpdated(key: RustSdkCryptoJs.RoomKeyInfo): void {
+        if (this.stopped) return;
        logger.debug(`Got update for session ${key.senderKey.toBase64()}|${key.sessionId} in ${key.roomId.toString()}`);
        const pendingList = this.eventDecryptor.getEventsPendingRoomKey(key);
        if (pendingList.length === 0) return;
@@ -1033,6 +1315,19 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
        }
    }

+    /**
+     * Callback for `OlmMachine.registerUserIdentityUpdatedCallback`
+     *
+     * Called by the rust-sdk whenever there is an update to any user's cross-signing status. We re-check their trust
+     * status and emit a `UserTrustStatusChanged` event.
+     *
+     * @param userId - the user with the updated identity
+     */
+    public async onUserIdentityUpdated(userId: RustSdkCryptoJs.UserId): Promise<void> {
+        const newVerification = await this.getUserVerificationStatus(userId.toString());
+        this.emit(CryptoEvent.UserTrustStatusChanged, userId.toString(), newVerification);
+    }
+
    /**
     * Handle a live event received via /sync.
     * See {@link ClientEventHandlerMap#event}
@@ -1040,15 +1335,13 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
     * @param event - live event
     */
    public async onLiveEventFromSync(event: MatrixEvent): Promise<void> {
-        // Ignore state event
-        if (event.isState()) return;
+        // Ignore state event or remote echo
+        // transaction_id is provided in case of remote echo {@link https://spec.matrix.org/v1.7/client-server-api/#local-echo}
+        if (event.isState() || !!event.getUnsigned().transaction_id) return;

        const processEvent = async (evt: MatrixEvent): Promise<void> => {
-            // Process only key validation request
-            if (
-                evt.getType() === EventType.RoomMessage &&
-                evt.getContent().msgtype === MsgType.KeyVerificationRequest
-            ) {
+            // Process only verification event
+            if (isVerificationEvent(event)) {
                await this.onKeyVerificationRequest(evt);
            }
        };
@@ -1058,6 +1351,7 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
            // 5 mins
            const TIMEOUT_DELAY = 5 * 60 * 1000;

+            // After 5mins, we are not expecting the event to be decrypted
            const timeoutId = setTimeout(() => event.off(MatrixEventEvent.Decrypted, onDecrypted), TIMEOUT_DELAY);

            const onDecrypted = (decryptedEvent: MatrixEvent, error?: Error): void => {
@@ -1067,7 +1361,6 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
                event.off(MatrixEventEvent.Decrypted, onDecrypted);
                processEvent(decryptedEvent);
            };
-            // After 5mins, we are not expecting the event to be decrypted

            event.on(MatrixEventEvent.Decrypted, onDecrypted);
        } else {
@@ -1087,6 +1380,8 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
            throw new Error("missing roomId in the event");
        }

+        logger.debug(`Incoming verification event ${event.getId()} type ${event.getType()} from ${event.getSender()}`);
+
        await this.olmMachine.receiveVerificationEvent(
            JSON.stringify({
                event_id: event.getId(),
@@ -1098,6 +1393,9 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
            }),
            new RustSdkCryptoJs.RoomId(roomId),
        );
+
+        // that may have caused us to queue up outgoing requests, so make sure we send them.
+        this.outgoingRequestLoop();
    }

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -1106,24 +1404,56 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEv
    //
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////

-    private async outgoingRequestLoop(): Promise<void> {
+    /** start the outgoing request loop if it is not already running */
+    private outgoingRequestLoop(): void {
        if (this.outgoingRequestLoopRunning) {
+            // The loop is already running, but we have reason to believe that there may be new items in the queue.
+            //
+            // There is potential for a race whereby the item is added *after* `OlmMachine.outgoingRequests` checks
+            // the queue, but *before* it returns. In such a case, the item could sit there unnoticed for some time.
+            //
+            // In order to circumvent the race, we set a flag which tells the loop to go round once again even if the
+            // queue appears to be empty.
+            this.outgoingRequestLoopOneMoreLoop = true;
            return;
        }
+        // fire off the loop in the background
+        this.outgoingRequestLoopInner().catch((e) => {
+            logger.error("Error processing outgoing-message requests from rust crypto-sdk", e);
+        });
+    }
+
+    private async outgoingRequestLoopInner(): Promise<void> {
+        /* istanbul ignore if */
+        if (this.outgoingRequestLoopRunning) {
+            throw new Error("Cannot run two outgoing request loops");
+        }
        this.outgoingRequestLoopRunning = true;
        try {
            while (!this.stopped) {
+                // we clear the "one more loop" flag just before calling `OlmMachine.outgoingRequests()`, so we can tell
+                // if `this.outgoingRequestLoop()` was called while `OlmMachine.outgoingRequests()` was running.
+                this.outgoingRequestLoopOneMoreLoop = false;
+
+                logger.debug("Calling OlmMachine.outgoingRequests()");
                const outgoingRequests: Object[] = await this.olmMachine.outgoingRequests();
-                if (outgoingRequests.length == 0 || this.stopped) {
-                    // no more messages to send (or we have been told to stop): exit the loop
+
+                if (this.stopped) {
+                    // we've been told to stop while `outgoingRequests` was running: exit the loop without processing
+                    // any of the returned requests (anything important will happen next time the client starts.)
                    return;
                }
+
+                if (outgoingRequests.length === 0 && !this.outgoingRequestLoopOneMoreLoop) {
+                    // `OlmMachine.outgoingRequests` returned no messages, and there was no call to
+                    // `this.outgoingRequestLoop()` while it was running. We can stop the loop for a while.
+                    return;
+                }
+
                for (const msg of outgoingRequests) {
                    await this.outgoingRequestProcessor.makeOutgoingRequest(msg as OutgoingRequest);
                }
            }
-        } catch (e) {
-            logger.error("Error processing outgoing-message requests from rust crypto-sdk", e);
        } finally {
            this.outgoingRequestLoopRunning = false;
        }
@@ -1140,7 +1470,7 @@ class EventDecryptor {
        () => new MapWithDefault<string, Set<MatrixEvent>>(() => new Set()),
    );

-    public constructor(private readonly olmMachine: RustSdkCryptoJs.OlmMachine) {}
+    public constructor(private readonly olmMachine: RustSdkCryptoJs.OlmMachine, private readonly crypto: RustCrypto) {}

    public async attemptEventDecryption(event: MatrixEvent): Promise<IEventDecryptionResult> {
        logger.info("Attempting decryption of event", event);
@@ -1150,28 +1480,78 @@ class EventDecryptor {
        // (fixes https://github.com/vector-im/element-web/issues/5001)
        this.addEventToPendingList(event);

-        const res = (await this.olmMachine.decryptRoomEvent(
-            JSON.stringify({
-                event_id: event.getId(),
-                type: event.getWireType(),
-                sender: event.getSender(),
-                state_key: event.getStateKey(),
-                content: event.getWireContent(),
-                origin_server_ts: event.getTs(),
-            }),
+        try {
+            const res = (await this.olmMachine.decryptRoomEvent(
+                stringifyEvent(event),
+                new RustSdkCryptoJs.RoomId(event.getRoomId()!),
+            )) as RustSdkCryptoJs.DecryptedRoomEvent;
+
+            // Success. We can remove the event from the pending list, if
+            // that hasn't already happened.
+            this.removeEventFromPendingList(event);
+
+            return {
+                clearEvent: JSON.parse(res.event),
+                claimedEd25519Key: res.senderClaimedEd25519Key,
+                senderCurve25519Key: res.senderCurve25519Key,
+                forwardingCurve25519KeyChain: res.forwardingCurve25519KeyChain,
+            };
+        } catch (err) {
+            // We need to map back to regular decryption errors (used for analytics for example)
+            // The DecryptionErrors are used by react-sdk so is implicitly part of API, but poorly typed
+            if (err instanceof RustSdkCryptoJs.MegolmDecryptionError) {
+                const content = event.getWireContent();
+                let jsError;
+                switch (err.code) {
+                    case RustSdkCryptoJs.DecryptionErrorCode.MissingRoomKey: {
+                        jsError = new DecryptionError(
+                            "MEGOLM_UNKNOWN_INBOUND_SESSION_ID",
+                            "The sender's device has not sent us the keys for this message.",
+                            {
+                                session: content.sender_key + "|" + content.session_id,
+                            },
+                        );
+                        this.crypto.queryKeyBackupRateLimited(event.getRoomId()!, event.getWireContent().session_id!);
+                        break;
+                    }
+                    case RustSdkCryptoJs.DecryptionErrorCode.UnknownMessageIndex: {
+                        jsError = new DecryptionError(
+                            "OLM_UNKNOWN_MESSAGE_INDEX",
+                            "The sender's device has not sent us the keys for this message at this index.",
+                            {
+                                session: content.sender_key + "|" + content.session_id,
+                            },
+                        );
+                        this.crypto.queryKeyBackupRateLimited(event.getRoomId()!, event.getWireContent().session_id!);
+                        break;
+                    }
+                    // We don't map MismatchedIdentityKeys for now, as there is no equivalent in legacy.
+                    // Just put it on the `UNABLE_TO_DECRYPT` bucket.
+                    default: {
+                        jsError = new DecryptionError("UNABLE_TO_DECRYPT", err.description, {
+                            session: content.sender_key + "|" + content.session_id,
+                        });
+                        break;
+                    }
+                }
+                throw jsError;
+            }
+            throw new DecryptionError("UNABLE_TO_DECRYPT", "Unknown error");
+        }
+    }
+
+    public async getEncryptionInfoForEvent(event: MatrixEvent): Promise<EventEncryptionInfo | null> {
+        if (!event.getClearContent()) {
+            // not successfully decrypted
+            return null;
+        }
+
+        const encryptionInfo = await this.olmMachine.getRoomEventEncryptionInfo(
+            stringifyEvent(event),
            new RustSdkCryptoJs.RoomId(event.getRoomId()!),
-        )) as RustSdkCryptoJs.DecryptedRoomEvent;
+        );

-        // Success. We can remove the event from the pending list, if
-        // that hasn't already happened.
-        this.removeEventFromPendingList(event);
-
-        return {
-            clearEvent: JSON.parse(res.event),
-            claimedEd25519Key: res.senderClaimedEd25519Key,
-            senderCurve25519Key: res.senderCurve25519Key,
-            forwardingCurve25519KeyChain: res.forwardingCurve25519KeyChain,
-        };
+        return rustEncryptionInfoToJsEncryptionInfo(encryptionInfo);
    }

    /**
@@ -1231,7 +1611,65 @@ class EventDecryptor {
    }
 }

-type RustCryptoEvents = CryptoEvent.VerificationRequestReceived | CryptoEvent.UserTrustStatusChanged;
+function stringifyEvent(event: MatrixEvent): string {
+    return JSON.stringify({
+        event_id: event.getId(),
+        type: event.getWireType(),
+        sender: event.getSender(),
+        state_key: event.getStateKey(),
+        content: event.getWireContent(),
+        origin_server_ts: event.getTs(),
+    });
+}
+
+function rustEncryptionInfoToJsEncryptionInfo(
+    encryptionInfo: RustSdkCryptoJs.EncryptionInfo | undefined,
+): EventEncryptionInfo | null {
+    if (encryptionInfo === undefined) {
+        // not decrypted here
+        return null;
+    }
+
+    // TODO: use strict shield semantics.
+    const shieldState = encryptionInfo.shieldState(false);
+
+    let shieldColour: EventShieldColour;
+    switch (shieldState.color) {
+        case RustSdkCryptoJs.ShieldColor.Grey:
+            shieldColour = EventShieldColour.GREY;
+            break;
+        case RustSdkCryptoJs.ShieldColor.None:
+            shieldColour = EventShieldColour.NONE;
+            break;
+        default:
+            shieldColour = EventShieldColour.RED;
+    }
+
+    let shieldReason: EventShieldReason | null;
+    if (shieldState.message === null) {
+        shieldReason = null;
+    } else if (shieldState.message === "Encrypted by an unverified user.") {
+        shieldReason = EventShieldReason.UNVERIFIED_IDENTITY;
+    } else if (shieldState.message === "Encrypted by a device not verified by its owner.") {
+        shieldReason = EventShieldReason.UNSIGNED_DEVICE;
+    } else if (
+        shieldState.message === "The authenticity of this encrypted message can't be guaranteed on this device."
+    ) {
+        shieldReason = EventShieldReason.AUTHENTICITY_NOT_GUARANTEED;
+    } else if (shieldState.message === "Encrypted by an unknown or deleted device.") {
+        shieldReason = EventShieldReason.UNKNOWN_DEVICE;
+    } else {
+        logger.warn(`Unknown shield state message '${shieldState.message}'`);
+        shieldReason = EventShieldReason.UNKNOWN;
+    }
+
+    return { shieldColour, shieldReason };
+}
+
+type RustCryptoEvents =
+    | CryptoEvent.VerificationRequestReceived
+    | CryptoEvent.UserTrustStatusChanged
+    | RustBackupCryptoEvents;

 type RustCryptoEventMap = {
    /**
@@ -1240,7 +1678,7 @@ type RustCryptoEventMap = {
    [CryptoEvent.VerificationRequestReceived]: (request: VerificationRequest) => void;

    /**
-     * Fires when the cross signing keys are imported during {@link CryptoApi#bootstrapCrossSigning}
+     * Fires when the trust status of a user changes.
     */
-    [CryptoEvent.UserTrustStatusChanged]: (userId: string, userTrustLevel: UserTrustLevel) => void;
-};
+    [CryptoEvent.UserTrustStatusChanged]: (userId: string, userTrustLevel: UserVerificationStatus) => void;
+} & RustBackupCryptoEventMap;
@@ -31,6 +31,8 @@ import {
 import { TypedEventEmitter } from "../models/typed-event-emitter";
 import { OutgoingRequest, OutgoingRequestProcessor } from "./OutgoingRequestProcessor";
 import { TypedReEmitter } from "../ReEmitter";
+import { MatrixEvent } from "../models/event";
+import { EventType, MsgType } from "../@types/event";

 /**
 * An incoming, or outgoing, request to verify a user or a device via cross-signing.
@@ -700,3 +702,28 @@ export function verificationMethodIdentifierToMethod(method: string): RustSdkCry
    }
    return meth;
 }
+
+/**
+ * Return true if the event's type matches that of an in-room verification event
+ *
+ * @param event - MatrixEvent
+ * @returns
+ *
+ * @internal
+ */
+export function isVerificationEvent(event: MatrixEvent): boolean {
+    switch (event.getType()) {
+        case EventType.KeyVerificationCancel:
+        case EventType.KeyVerificationDone:
+        case EventType.KeyVerificationMac:
+        case EventType.KeyVerificationStart:
+        case EventType.KeyVerificationKey:
+        case EventType.KeyVerificationReady:
+        case EventType.KeyVerificationAccept:
+            return true;
+        case EventType.RoomMessage:
+            return event.getContent().msgtype === MsgType.KeyVerificationRequest;
+        default:
+            return false;
+    }
+}
@@ -99,6 +99,10 @@ export interface IInviteState {
    events: IStrippedState[];
 }

+export interface IKnockState {
+    events: IStrippedState[];
+}
+
 export interface IInvitedRoom {
    invite_state: IInviteState;
 }
@@ -109,10 +113,15 @@ export interface ILeftRoom {
    account_data: IAccountData;
 }

+export interface IKnockedRoom {
+    knock_state: IKnockState;
+}
+
 export interface IRooms {
    [Category.Join]: Record<string, IJoinedRoom>;
    [Category.Invite]: Record<string, IInvitedRoom>;
    [Category.Leave]: Record<string, ILeftRoom>;
+    [Category.Knock]: Record<string, IKnockedRoom>;
 }

 interface IPresence {
@@ -156,6 +165,7 @@ export enum Category {
    Invite = "invite",
    Leave = "leave",
    Join = "join",
+    Knock = "knock",
 }

 interface IRoom {
@@ -196,6 +206,7 @@ function isTaggedEvent(event: IRoomEvent): event is TaggedEvent {
 export class SyncAccumulator {
    private accountData: Record<string, IMinimalEvent> = {}; // $event_type: Object
    private inviteRooms: Record<string, IInvitedRoom> = {}; // $roomId: { ... sync 'invite' json data ... }
+    private knockRooms: Record<string, IKnockedRoom> = {}; // $roomId: { ... sync 'knock' json data ... }
    private joinRooms: { [roomId: string]: IRoom } = {};
    // the /sync token which corresponds to the last time rooms were
    // accumulated. We remember this so that any caller can obtain a
@@ -247,11 +258,17 @@ export class SyncAccumulator {
                this.accumulateRoom(roomId, Category.Leave, syncResponse.rooms.leave[roomId], fromDatabase);
            });
        }
+        if (syncResponse.rooms.knock) {
+            Object.keys(syncResponse.rooms.knock).forEach((roomId) => {
+                this.accumulateRoom(roomId, Category.Knock, syncResponse.rooms.knock[roomId], fromDatabase);
+            });
+        }
    }

    private accumulateRoom(roomId: string, category: Category.Invite, data: IInvitedRoom, fromDatabase: boolean): void;
    private accumulateRoom(roomId: string, category: Category.Join, data: IJoinedRoom, fromDatabase: boolean): void;
    private accumulateRoom(roomId: string, category: Category.Leave, data: ILeftRoom, fromDatabase: boolean): void;
+    private accumulateRoom(roomId: string, category: Category.Knock, data: IKnockedRoom, fromDatabase: boolean): void;
    private accumulateRoom(roomId: string, category: Category, data: any, fromDatabase = false): void {
        // Valid /sync state transitions
        //       +--------+ <======+            1: Accept an invite
@@ -266,9 +283,17 @@ export class SyncAccumulator {
        // * equivalent to "no state"
        switch (category) {
            case Category.Invite: // (5)
+                if (this.knockRooms[roomId]) {
+                    // was previously knock, now invite, need to delete knock state
+                    delete this.knockRooms[roomId];
+                }
                this.accumulateInviteState(roomId, data as IInvitedRoom);
                break;

+            case Category.Knock:
+                this.accumulateKnockState(roomId, data as IKnockedRoom);
+                break;
+
            case Category.Join:
                if (this.inviteRooms[roomId]) {
                    // (1)
@@ -282,7 +307,10 @@ export class SyncAccumulator {
                break;

            case Category.Leave:
-                if (this.inviteRooms[roomId]) {
+                if (this.knockRooms[roomId]) {
+                    // delete knock state on leave
+                    delete this.knockRooms[roomId];
+                } else if (this.inviteRooms[roomId]) {
                    // (4)
                    delete this.inviteRooms[roomId];
                } else {
@@ -326,6 +354,36 @@ export class SyncAccumulator {
        });
    }

+    private accumulateKnockState(roomId: string, data: IKnockedRoom): void {
+        if (!data.knock_state || !data.knock_state.events) {
+            // no new data
+            return;
+        }
+        if (!this.knockRooms[roomId]) {
+            this.knockRooms[roomId] = {
+                knock_state: data.knock_state,
+            };
+            return;
+        }
+        // accumulate extra keys
+        // clobber based on event type / state key
+        // We expect knock_state to be small, so just loop over the events
+        const currentData = this.knockRooms[roomId];
+        data.knock_state.events.forEach((e) => {
+            let hasAdded = false;
+            for (let i = 0; i < currentData.knock_state.events.length; i++) {
+                const current = currentData.knock_state.events[i];
+                if (current.type === e.type && current.state_key == e.state_key) {
+                    currentData.knock_state.events[i] = e; // update
+                    hasAdded = true;
+                }
+            }
+            if (!hasAdded) {
+                currentData.knock_state.events.push(e);
+            }
+        });
+    }
+
    // Accumulate timeline and state events in a room.
    private accumulateJoinState(roomId: string, data: IJoinedRoom, fromDatabase = false): void {
        // We expect this function to be called a lot (every /sync) so we want
@@ -485,6 +543,7 @@ export class SyncAccumulator {
        const data: IRooms = {
            join: {},
            invite: {},
+            knock: {},
            // always empty. This is set by /sync when a room was previously
            // in 'invite' or 'join'. On fresh startup, the client won't know
            // about any previous room being in 'invite' or 'join' so we can
@@ -501,6 +560,9 @@ export class SyncAccumulator {
        Object.keys(this.inviteRooms).forEach((roomId) => {
            data.invite[roomId] = this.inviteRooms[roomId];
        });
+        Object.keys(this.knockRooms).forEach((roomId) => {
+            data.knock[roomId] = this.knockRooms[roomId];
+        });
        Object.keys(this.joinRooms).forEach((roomId) => {
            const roomData = this.joinRooms[roomId];
            const roomJson: IJoinedRoom = {
@@ -40,6 +40,7 @@ import {
    IInviteState,
    IJoinedRoom,
    ILeftRoom,
+    IKnockedRoom,
    IMinimalEvent,
    IRoomEvent,
    IStateEvent,
@@ -649,18 +650,11 @@ export class SyncApi {
            this.opts.lazyLoadMembers = false;
        }
        if (this.opts.lazyLoadMembers) {
-            debuglog("Checking server lazy load support...");
-            const supported = await this.client.doesServerSupportLazyLoading();
-            if (supported) {
-                debuglog("Enabling lazy load on sync filter...");
-                if (!this.opts.filter) {
-                    this.opts.filter = this.buildDefaultFilter();
-                }
-                this.opts.filter.setLazyLoadMembers(true);
-            } else {
-                debuglog("LL: lazy loading requested but not supported " + "by server, so disabling");
-                this.opts.lazyLoadMembers = false;
+            debuglog("Enabling lazy load on sync filter...");
+            if (!this.opts.filter) {
+                this.opts.filter = this.buildDefaultFilter();
            }
+            this.opts.filter.setLazyLoadMembers(true);
        }
        // need to vape the store when enabling LL and wasn't enabled before
        debuglog("Checking whether lazy loading has changed in store...");
@@ -1247,6 +1241,7 @@ export class SyncApi {
        let inviteRooms: WrappedRoom<IInvitedRoom>[] = [];
        let joinRooms: WrappedRoom<IJoinedRoom>[] = [];
        let leaveRooms: WrappedRoom<ILeftRoom>[] = [];
+        let knockRooms: WrappedRoom<IKnockedRoom>[] = [];

        if (data.rooms) {
            if (data.rooms.invite) {
@@ -1258,6 +1253,9 @@ export class SyncApi {
            if (data.rooms.leave) {
                leaveRooms = this.mapSyncResponseToRoomArray(data.rooms.leave);
            }
+            if (data.rooms.knock) {
+                knockRooms = this.mapSyncResponseToRoomArray(data.rooms.knock);
+            }
        }

        this.notifEvents = [];
@@ -1518,6 +1516,26 @@ export class SyncApi {
            });
        });

+        // Handle knocks
+        await promiseMapSeries(knockRooms, async (knockObj) => {
+            const room = knockObj.room;
+            const stateEvents = this.mapSyncEventsFormat(knockObj.knock_state, room);
+
+            await this.injectRoomEvents(room, stateEvents);
+
+            if (knockObj.isBrandNewRoom) {
+                room.recalculate();
+                client.store.storeRoom(room);
+                client.emit(ClientEvent.Room, room);
+            } else {
+                // Update room state for knock->leave->knock cycles
+                room.recalculate();
+            }
+            stateEvents.forEach(function (e) {
+                client.emit(ClientEvent.Event, e);
+            });
+        });
+
        // update the notification timeline, if appropriate.
        // we only do this for live events, as otherwise we can't order them sanely
        // in the timeline relative to ones paginated in by /notifications.
@@ -1636,7 +1654,7 @@ export class SyncApi {
            );
    }

-    private mapSyncResponseToRoomArray<T extends ILeftRoom | IJoinedRoom | IInvitedRoom>(
+    private mapSyncResponseToRoomArray<T extends ILeftRoom | IJoinedRoom | IInvitedRoom | IKnockedRoom>(
        obj: Record<string, T>,
    ): Array<WrappedRoom<T>> {
        // Maps { roomid: {stuff}, roomid: {stuff} }
@@ -0,0 +1,20 @@
+/*
+Copyright 2022 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+/**
+ * The minimum Matrix specification version the js-sdk supports.
+ */
+export const MINIMUM_MATRIX_VERSION = "v1.1";
@@ -2220,7 +2220,7 @@ export class MatrixCall extends TypedEventEmitter<CallEvent, CallEventHandlerMap
            CallEvent.Error,
            new CallError(
                CallErrorCode.NoUserMedia,
-                "Couldn't start capturing media! Is your microphone set up and " + "does this app have permission?",
+                "Couldn't start capturing media! Is your microphone set up and does this app have permission?",
                err,
            ),
            this,
@@ -2228,6 +2228,22 @@ export class MatrixCall extends TypedEventEmitter<CallEvent, CallEventHandlerMap
        this.terminate(CallParty.Local, CallErrorCode.NoUserMedia, false);
    };

+    private placeCallFailed = (err: Error): void => {
+        if (this.successor) {
+            this.successor.placeCallFailed(err);
+            return;
+        }
+
+        logger.warn(`Call ${this.callId} placeCallWithCallFeeds() failed - ending call`, err);
+
+        this.emit(
+            CallEvent.Error,
+            new CallError(CallErrorCode.IceFailed, "Couldn't start call! Invalid ICE server configuration.", err),
+            this,
+        );
+        this.terminate(CallParty.Local, CallErrorCode.IceFailed, false);
+    };
+
    private onIceConnectionStateChanged = (): void => {
        if (this.callHasEnded()) {
            return; // because ICE can still complete as we're ending the call
@@ -2775,6 +2791,7 @@ export class MatrixCall extends TypedEventEmitter<CallEvent, CallEventHandlerMap
        }
        this.state = CallState.WaitLocalMedia;

+        let callFeed: CallFeed;
        try {
            const stream = await this.client.getMediaHandler().getUserMediaStream(audio, video);

@@ -2783,7 +2800,7 @@ export class MatrixCall extends TypedEventEmitter<CallEvent, CallEventHandlerMap
            setTracksEnabled(stream.getAudioTracks(), true);
            setTracksEnabled(stream.getVideoTracks(), true);

-            const callFeed = new CallFeed({
+            callFeed = new CallFeed({
                client: this.client,
                roomId: this.roomId,
                userId: this.client.getUserId()!,
@@ -2793,11 +2810,17 @@ export class MatrixCall extends TypedEventEmitter<CallEvent, CallEventHandlerMap
                audioMuted: false,
                videoMuted: false,
            });
-            await this.placeCallWithCallFeeds([callFeed]);
        } catch (e) {
            this.getUserMediaFailed(<Error>e);
            return;
        }
+
+        try {
+            await this.placeCallWithCallFeeds([callFeed]);
+        } catch (e) {
+            this.placeCallFailed(<Error>e);
+            return;
+        }
    }

    /**
@@ -2834,7 +2857,7 @@ export class MatrixCall extends TypedEventEmitter<CallEvent, CallEventHandlerMap
    private createPeerConnection(): RTCPeerConnection {
        const pc = new window.RTCPeerConnection({
            iceTransportPolicy: this.forceTURN ? "relay" : undefined,
-            iceServers: this.turnServers,
+            iceServers: this.turnServers.length ? this.turnServers : undefined,
            iceCandidatePoolSize: this.client.iceCandidatePoolSize,
            bundlePolicy: "max-bundle",
        });
@@ -170,6 +170,8 @@ export interface IGroupCallRoomState {
    // TODO: Specify data-channels
    "dataChannelsEnabled"?: boolean;
    "dataChannelOptions"?: IGroupCallDataChannelOptions;
+
+    "io.element.livekit_service_url"?: string;
 }

 export interface IGroupCallRoomMemberFeed {
@@ -250,6 +252,7 @@ export class GroupCall extends TypedEventEmitter<
    private initWithAudioMuted = false;
    private initWithVideoMuted = false;
    private initCallFeedPromise?: Promise<void>;
+    private _livekitServiceURL?: string;

    private stats: GroupCallStats | undefined;
    /**
@@ -268,10 +271,16 @@ export class GroupCall extends TypedEventEmitter<
        private dataChannelsEnabled?: boolean,
        private dataChannelOptions?: IGroupCallDataChannelOptions,
        isCallWithoutVideoAndAudio?: boolean,
+        // this tells the js-sdk not to actually establish any calls to exchange media and just to
+        // create the group call signaling events, with the intention that the actual media will be
+        // handled using livekit. The js-sdk doesn't contain any code to do the actual livekit call though.
+        private useLivekit = false,
+        livekitServiceURL?: string,
    ) {
        super();
        this.reEmitter = new ReEmitter(this);
        this.groupCallId = groupCallId ?? genCallID();
+        this._livekitServiceURL = livekitServiceURL;
        this.creationTs =
            room.currentState.getStateEvents(EventType.GroupCallPrefix, this.groupCallId)?.getTs() ?? null;
        this.updateParticipants();
@@ -320,6 +329,12 @@ export class GroupCall extends TypedEventEmitter<
        this.client.groupCallEventHandler!.groupCalls.set(this.room.roomId, this);
        this.client.emit(GroupCallEventHandlerEvent.Outgoing, this);

+        await this.sendCallStateEvent();
+
+        return this;
+    }
+
+    private async sendCallStateEvent(): Promise<void> {
        const groupCallState: IGroupCallRoomState = {
            "m.intent": this.intent,
            "m.type": this.type,
@@ -328,10 +343,20 @@ export class GroupCall extends TypedEventEmitter<
            "dataChannelsEnabled": this.dataChannelsEnabled,
            "dataChannelOptions": this.dataChannelsEnabled ? this.dataChannelOptions : undefined,
        };
+        if (this.livekitServiceURL) {
+            groupCallState["io.element.livekit_service_url"] = this.livekitServiceURL;
+        }

        await this.client.sendStateEvent(this.room.roomId, EventType.GroupCallPrefix, groupCallState, this.groupCallId);
+    }

-        return this;
+    public get livekitServiceURL(): string | undefined {
+        return this._livekitServiceURL;
+    }
+
+    public updateLivekitServiceURL(newURL: string): Promise<void> {
+        this._livekitServiceURL = newURL;
+        return this.sendCallStateEvent();
    }

    private _state = GroupCallState.LocalCallFeedUninitialized;
@@ -442,6 +467,11 @@ export class GroupCall extends TypedEventEmitter<
    }

    public async initLocalCallFeed(): Promise<void> {
+        if (this.useLivekit) {
+            logger.info("Livekit group call: not starting local call feed.");
+            return;
+        }
+
        if (this.state !== GroupCallState.LocalCallFeedUninitialized) {
            throw new Error(`Cannot initialize local call feed in the "${this.state}" state.`);
        }
@@ -537,11 +567,13 @@ export class GroupCall extends TypedEventEmitter<
            this.onIncomingCall(call);
        }

-        this.retryCallLoopInterval = setInterval(this.onRetryCallLoop, this.retryCallInterval);
+        if (!this.useLivekit) {
+            this.retryCallLoopInterval = setInterval(this.onRetryCallLoop, this.retryCallInterval);

-        this.activeSpeaker = undefined;
-        this.onActiveSpeakerLoop();
-        this.activeSpeakerLoopInterval = setInterval(this.onActiveSpeakerLoop, this.activeSpeakerInterval);
+            this.activeSpeaker = undefined;
+            this.onActiveSpeakerLoop();
+            this.activeSpeakerLoopInterval = setInterval(this.onActiveSpeakerLoop, this.activeSpeakerInterval);
+        }
    }

    private dispose(): void {
@@ -923,6 +955,11 @@ export class GroupCall extends TypedEventEmitter<
            return;
        }

+        if (this.useLivekit) {
+            logger.info("Received incoming call whilst in signaling-only mode! Ignoring.");
+            return;
+        }
+
        const deviceMap = this.calls.get(opponentUserId) ?? new Map<string, MatrixCall>();
        const prevCall = deviceMap.get(newCall.getOpponentDeviceId()!);

@@ -1629,7 +1666,7 @@ export class GroupCall extends TypedEventEmitter<
            }
        });

-        if (this.state === GroupCallState.Entered) this.placeOutgoingCalls();
+        if (this.state === GroupCallState.Entered && !this.useLivekit) this.placeOutgoingCalls();

        // Update the participants stored in the stats object
    };
@@ -84,6 +84,7 @@ export class GroupCallEventHandler {
    }

    public stop(): void {
+        this.client.removeListener(ClientEvent.Room, this.onRoomsChanged);
        this.client.removeListener(RoomStateEvent.Events, this.onRoomStateChanged);
    }

@@ -189,6 +190,8 @@ export class GroupCallEventHandler {
            content?.dataChannelsEnabled || this.client.isVoipWithNoMediaAllowed,
            dataChannelOptions,
            this.client.isVoipWithNoMediaAllowed,
+            this.client.useLivekitForGroupCalls,
+            content["io.element.livekit_service_url"],
        );

        this.groupCalls.set(room.roomId, groupCall);