v36.0.0-rc.0

* remove all legacy call related code and adjust tests.
We actually had a bit of tests just for legacy and not for session events. All those tests got ported over so we do not remove any tests.

* dont adjust tests but remove legacy tests

* Remove deprecated CallMembership.getLocalExpiry()

* Remove references to legacy in test case names

* Clean up SessionMembershipData tsdoc

* Remove CallMembership.expires

* Use correct expire duration.

* make expiration methods not return optional values and update docstring

* add docs to `SessionMembershipData`

* Add new tests for session type member events that before only existed for legacy member events.

This reverts commit 795a3cffb61d672941c49e8139eb1d7b15c87d73.

* remove code we do not need yet.

* Cleanup

---------

Co-authored-by: Hugh Nimmo-Smith <hughns@matrix.org>

.github/workflows/pull_request.yaml

@@ -15,7 +15,7 @@ jobs:
         name: Preview Changelog
         runs-on: ubuntu-24.04
         steps:
-            - uses: mheap/github-action-required-labels@d25134c992b943fb6ad00c25ea00eb5988c0a9dd # v5
+            - uses: mheap/github-action-required-labels@388fd6af37b34cdfe5a23b37060e763217e58b03 # v5
               if: github.event_name != 'merge_group'
               with:
                   labels: |

.github/workflows/sonarcloud.yml

@@ -27,7 +27,7 @@ jobs:
         steps:
             # We create the status here and then update it to success/failure in the `report` stage
             # This provides an easy link to this workflow_run from the PR before Sonarcloud is done.
-            - uses: guibranco/github-status-action-v2@66088c44e212a906c32a047529a213d81809ec1c
+            - uses: guibranco/github-status-action-v2@d469d49426f5a7b8a1fbcac20ad274d3e4892321
               with:
                   authToken: ${{ secrets.GITHUB_TOKEN }}
                   state: pending
@@ -87,7 +87,7 @@ jobs:
                   revision: ${{ github.event.workflow_run.head_sha }}
                   token: ${{ secrets.SONAR_TOKEN }}
 
-            - uses: guibranco/github-status-action-v2@66088c44e212a906c32a047529a213d81809ec1c
+            - uses: guibranco/github-status-action-v2@d469d49426f5a7b8a1fbcac20ad274d3e4892321
               if: always()
               with:
                   authToken: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/static_analysis.yml

@@ -44,6 +44,41 @@ jobs:
             - name: Run Linter
               run: "yarn run lint:js"
 
+    node_example_lint:
+        name: "Node.js example"
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+
+            - uses: actions/setup-node@v4
+              with:
+                  cache: "yarn"
+                  node-version-file: package.json
+
+            - name: Install Deps
+              run: "yarn install"
+
+            - name: Build Types
+              run: "yarn build:types"
+
+            - uses: actions/setup-node@v4
+              with:
+                  cache: "npm"
+                  node-version-file: "examples/node/package.json"
+                  # cache-dependency-path: '**/package-lock.json'
+
+            - name: Install Example Deps
+              run: "npm install"
+              working-directory: "examples/node"
+
+            - name: Check Syntax
+              run: "node --check app.js"
+              working-directory: "examples/node"
+
+            - name: Typecheck
+              run: "npx tsc"
+              working-directory: "examples/node"
+
     workflow_lint:
         name: "Workflow Lint"
         runs-on: ubuntu-24.04

.github/workflows/tests.yml

@@ -116,7 +116,7 @@ jobs:
         steps:
             - name: Skip SonarCloud on merge queues
               if: env.ENABLE_COVERAGE == 'false'
-              uses: guibranco/github-status-action-v2@66088c44e212a906c32a047529a213d81809ec1c
+              uses: guibranco/github-status-action-v2@d469d49426f5a7b8a1fbcac20ad274d3e4892321
               with:
                   authToken: ${{ secrets.GITHUB_TOKEN }}
                   state: success

CHANGELOG.md

@@ -1,3 +1,12 @@
+Changes in [35.1.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v35.1.0) (2024-12-18)
+==================================================================================================
+This release updates matrix-sdk-crypto-wasm to fix a bug which could prevent loading stored crypto state from storage.
+
+## 🐛 Bug Fixes
+
+* Upgrade matrix-sdk-crypto-wasm to 1.11.0 ([#4593](https://github.com/matrix-org/matrix-js-sdk/pull/4593)).
+
+
 Changes in [35.0.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v35.0.0) (2024-12-17)
 ==================================================================================================
 ## 🚨 BREAKING CHANGES

examples/node/app.js

@@ -94,20 +94,14 @@ rl.on("line", function (line) {
             );
         } else if (line.indexOf("/file ") === 0) {
             var filename = line.split(" ")[1].trim();
-            var stream = fs.createReadStream(filename);
-            matrixClient
-                .uploadContent({
-                    stream: stream,
-                    name: filename,
-                })
-                .then(function (url) {
-                    var content = {
-                        msgtype: MsgType.File,
-                        body: filename,
-                        url: JSON.parse(url).content_uri,
-                    };
-                    matrixClient.sendMessage(viewingRoom.roomId, content);
+            let buffer = fs.readFileSync("./your_file_name");
+            matrixClient.uploadContent(new Blob([buffer])).then(function (response) {
+                matrixClient.sendMessage(viewingRoom.roomId, {
+                    msgtype: MsgType.File,
+                    body: filename,
+                    url: response.content_uri,
                 });
+            });
         } else {
             matrixClient.sendTextMessage(viewingRoom.roomId, line).finally(function () {
                 printMessages();
@@ -167,7 +161,7 @@ matrixClient.on(RoomEvent.Timeline, function (event, room, toStartOfTimeline) {
     if (toStartOfTimeline) {
         return; // don't print paginated results
     }
-    if (!viewingRoom || viewingRoom.roomId !== room.roomId) {
+    if (!viewingRoom || viewingRoom.roomId !== room?.roomId) {
         return; // not viewing a room or viewing the wrong room.
     }
     printLine(event);
@@ -386,7 +380,7 @@ function print(str, formatter) {
         }
         console.log.apply(console.log, newArgs);
     } else {
-        console.log.apply(console.log, arguments);
+        console.log.apply(console.log, [...arguments]);
     }
 }
 

examples/node/package.json

@@ -9,5 +9,12 @@
     "dependencies": {
         "cli-color": "^1.0.0",
         "matrix-js-sdk": "^34.5.0"
+    },
+    "devDependencies": {
+        "@types/cli-color": "^2.0.6",
+        "typescript": "^5.6.2"
+    },
+    "engines": {
+        "node": ">=20.0.0"
     }
 }

examples/node/tsconfig.json

@@ -0,0 +1,14 @@
+{
+    "compilerOptions": {
+        "target": "es2022",
+        "module": "commonjs",
+        "esModuleInterop": true,
+        "noImplicitAny": false,
+        "noEmit": true,
+        "skipLibCheck": true,
+        "allowJs": true,
+        "checkJs": true,
+        "strict": true
+    },
+    "include": ["app.js"]
+}

package.json

@@ -1,6 +1,6 @@
 {
     "name": "matrix-js-sdk",
-    "version": "35.0.0",
+    "version": "36.0.0-rc.0",
     "description": "Matrix Client-Server SDK for Javascript",
     "engines": {
         "node": ">=20.0.0"
@@ -50,7 +50,7 @@
     ],
     "dependencies": {
         "@babel/runtime": "^7.12.5",
-        "@matrix-org/matrix-sdk-crypto-wasm": "^11.0.0",
+        "@matrix-org/matrix-sdk-crypto-wasm": "^12.1.0",
         "@matrix-org/olm": "3.2.15",
         "another-json": "^0.2.0",
         "bs58": "^6.0.0",
@@ -117,7 +117,7 @@
         "lint-staged": "^15.0.2",
         "matrix-mock-request": "^2.5.0",
         "node-fetch": "^2.7.0",
-        "prettier": "3.4.1",
+        "prettier": "3.4.2",
         "rimraf": "^6.0.0",
         "ts-node": "^10.9.2",
         "typedoc": "^0.27.0",

spec/integ/crypto/crypto.spec.ts

@@ -3121,6 +3121,32 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                 const mskId = await aliceClient.getCrypto()!.getCrossSigningKeyId(CrossSigningKey.Master)!;
                 expect(signatures![aliceClient.getUserId()!][`ed25519:${mskId}`]).toBeDefined();
             });
+
+            newBackendOnly("should upload existing megolm backup key to a new 4S store", async () => {
+                const backupKeyTo4SPromise = awaitMegolmBackupKeyUpload();
+
+                // we need these to set up the mocks but we don't actually care whether they
+                // resolve because we're not testing those things in this test.
+                awaitCrossSigningKeyUpload("master");
+                awaitCrossSigningKeyUpload("user_signing");
+                awaitCrossSigningKeyUpload("self_signing");
+                awaitSecretStorageKeyStoredInAccountData();
+
+                mockSetupCrossSigningRequests();
+                mockSetupMegolmBackupRequests("1");
+
+                await aliceClient.getCrypto()!.bootstrapCrossSigning({});
+                await aliceClient.getCrypto()!.resetKeyBackup();
+
+                await aliceClient.getCrypto()!.bootstrapSecretStorage({
+                    setupNewSecretStorage: true,
+                    createSecretStorageKey,
+                    setupNewKeyBackup: false,
+                });
+
+                await backupKeyTo4SPromise;
+                expect(accountDataAccumulator.accountDataEvents.get("m.megolm_backup.v1")).toBeDefined();
+            });
         });
 
         describe("Manage Key Backup", () => {
@@ -3142,7 +3168,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                     fetchMock.put(
                         "path:/_matrix/client/v3/room_keys/keys",
                         (url, request) => {
-                            const uploadPayload: KeyBackup = JSON.parse(request.body?.toString() ?? "{}");
+                            const uploadPayload: KeyBackup = JSON.parse((request.body as string) ?? "{}");
                             resolve(uploadPayload);
                             return {
                                 status: 200,
@@ -3209,7 +3235,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
                 fetchMock.post(
                     "path:/_matrix/client/v3/room_keys/version",
                     (url, request) => {
-                        const backupData: KeyBackupInfo = JSON.parse(request.body?.toString() ?? "{}");
+                        const backupData: KeyBackupInfo = JSON.parse((request.body as string) ?? "{}");
                         backupData.version = newVersion;
                         backupData.count = 0;
                         backupData.etag = "zer";

spec/integ/crypto/megolm-backup.spec.ts

@@ -91,7 +91,7 @@ function mockUploadEmitter(
                     },
                 };
             }
-            const uploadPayload: KeyBackup = JSON.parse(request.body?.toString() ?? "{}");
+            const uploadPayload: KeyBackup = JSON.parse((request.body as string) ?? "{}");
             let count = 0;
             for (const [roomId, value] of Object.entries(uploadPayload.rooms)) {
                 for (const sessionId of Object.keys(value.sessions)) {

spec/integ/matrix-client-syncing.spec.ts

@@ -50,6 +50,13 @@ import { THREAD_RELATION_TYPE } from "../../src/models/thread";
 import { IActionsObject } from "../../src/pushprocessor";
 import { KnownMembership } from "../../src/@types/membership";
 
+declare module "../../src/@types/event" {
+    interface AccountDataEvents {
+        a: {};
+        b: {};
+    }
+}
+
 describe("MatrixClient syncing", () => {
     const selfUserId = "@alice:localhost";
     const selfAccessToken = "aseukfgwef";

spec/integ/sliding-sync-sdk.spec.ts

@@ -45,6 +45,13 @@ import { emitPromise } from "../test-utils/test-utils";
 import { defer } from "../../src/utils";
 import { KnownMembership } from "../../src/@types/membership";
 
+declare module "../../src/@types/event" {
+    interface AccountDataEvents {
+        global_test: {};
+        tester: {};
+    }
+}
+
 describe("SlidingSyncSdk", () => {
     let client: MatrixClient | undefined;
     let httpBackend: MockHttpBackend | undefined;

spec/test-utils/mockEndpoints.ts

@@ -88,7 +88,7 @@ export function mockSetupMegolmBackupRequests(backupVersion: string): void {
     });
 
     fetchMock.post("path:/_matrix/client/v3/room_keys/version", (url, request) => {
-        const backupData: KeyBackupInfo = JSON.parse(request.body?.toString() ?? "{}");
+        const backupData: KeyBackupInfo = JSON.parse((request.body as string) ?? "{}");
         backupData.version = backupVersion;
         backupData.count = 0;
         backupData.etag = "zer";

spec/unit/crypto/secrets.spec.ts

@@ -30,6 +30,7 @@ import { ICurve25519AuthData } from "../../../src/crypto/keybackup";
 import { SecretStorageKeyDescription, SECRET_STORAGE_ALGORITHM_V1_AES } from "../../../src/secret-storage";
 import { decodeBase64 } from "../../../src/base64";
 import { CrossSigningKeyInfo } from "../../../src/crypto-api";
+import { SecretInfo } from "../../../src/secret-storage.ts";
 
 async function makeTestClient(
     userInfo: { userId: string; deviceId: string },
@@ -68,6 +69,12 @@ function sign<T extends IObject | ICurve25519AuthData>(
     };
 }
 
+declare module "../../../src/@types/event" {
+    interface SecretStorageAccountDataEvents {
+        foo: SecretInfo;
+    }
+}
+
 describe("Secrets", function () {
     if (!globalThis.Olm) {
         logger.warn("Not running megolm backup unit tests: libolm not present");

spec/unit/matrix-client.spec.ts

@@ -94,6 +94,12 @@ function convertQueryDictToMap(queryDict?: QueryDict): Map<string, string> {
     return new Map(Object.entries(queryDict).map(([k, v]) => [k, String(v)]));
 }
 
+declare module "../../src/@types/event" {
+    interface AccountDataEvents {
+        "im.vector.test": {};
+    }
+}
+
 type HttpLookup = {
     method: string;
     path: string;

spec/unit/matrixrtc/CallMembership.spec.ts

@@ -15,7 +15,8 @@ limitations under the License.
 */
 
 import { MatrixEvent } from "../../../src";
-import { CallMembership, CallMembershipDataLegacy, SessionMembershipData } from "../../../src/matrixrtc/CallMembership";
+import { CallMembership, SessionMembershipData, DEFAULT_EXPIRE_DURATION } from "../../../src/matrixrtc/CallMembership";
+import { membershipTemplate } from "./mocks";
 
 function makeMockEvent(originTs = 0): MatrixEvent {
     return {
@@ -25,91 +26,15 @@ function makeMockEvent(originTs = 0): MatrixEvent {
 }
 
 describe("CallMembership", () => {
-    describe("CallMembershipDataLegacy", () => {
-        const membershipTemplate: CallMembershipDataLegacy = {
-            call_id: "",
-            scope: "m.room",
-            application: "m.call",
-            device_id: "AAAAAAA",
-            expires: 5000,
-            membershipID: "bloop",
-            foci_active: [{ type: "livekit" }],
-        };
-        it("rejects membership with no expiry and no expires_ts", () => {
-            expect(() => {
-                new CallMembership(
-                    makeMockEvent(),
-                    Object.assign({}, membershipTemplate, { expires: undefined, expires_ts: undefined }),
-                );
-            }).toThrow();
-        });
-
-        it("rejects membership with no device_id", () => {
-            expect(() => {
-                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { device_id: undefined }));
-            }).toThrow();
-        });
-
-        it("rejects membership with no call_id", () => {
-            expect(() => {
-                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { call_id: undefined }));
-            }).toThrow();
-        });
-
-        it("allow membership with no scope", () => {
-            expect(() => {
-                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { scope: undefined }));
-            }).not.toThrow();
-        });
-        it("rejects with malformatted expires_ts", () => {
-            expect(() => {
-                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { expires_ts: "string" }));
-            }).toThrow();
-        });
-        it("rejects with malformatted expires", () => {
-            expect(() => {
-                new CallMembership(makeMockEvent(), Object.assign({}, membershipTemplate, { expires: "string" }));
-            }).toThrow();
-        });
-
-        it("uses event timestamp if no created_ts", () => {
-            const membership = new CallMembership(makeMockEvent(12345), membershipTemplate);
-            expect(membership.createdTs()).toEqual(12345);
-        });
-
-        it("uses created_ts if present", () => {
-            const membership = new CallMembership(
-                makeMockEvent(12345),
-                Object.assign({}, membershipTemplate, { created_ts: 67890 }),
-            );
-            expect(membership.createdTs()).toEqual(67890);
-        });
-
-        it("computes absolute expiry time based on expires", () => {
-            const membership = new CallMembership(makeMockEvent(1000), membershipTemplate);
-            expect(membership.getAbsoluteExpiry()).toEqual(5000 + 1000);
-        });
-
-        it("computes absolute expiry time based on expires_ts", () => {
-            const membership = new CallMembership(
-                makeMockEvent(1000),
-                Object.assign({}, membershipTemplate, { expires_ts: 6000 }),
-            );
-            expect(membership.getAbsoluteExpiry()).toEqual(5000 + 1000);
-        });
-
-        it("returns preferred foci", () => {
-            const fakeEvent = makeMockEvent();
-            const mockFocus = { type: "this_is_a_mock_focus" };
-            const membership = new CallMembership(
-                fakeEvent,
-                Object.assign({}, membershipTemplate, { foci_active: [mockFocus] }),
-            );
-            expect(membership.getPreferredFoci()).toEqual([mockFocus]);
-        });
-    });
-
     describe("SessionMembershipData", () => {
+        beforeEach(() => {
+            jest.useFakeTimers();
+        });
+
+        afterEach(() => {
+            jest.useRealTimers();
+        });
+
         const membershipTemplate: SessionMembershipData = {
             call_id: "",
             scope: "m.room",
@@ -152,9 +77,14 @@ describe("CallMembership", () => {
 
         it("considers memberships unexpired if local age low enough", () => {
             const fakeEvent = makeMockEvent(1000);
-            fakeEvent.getLocalAge = jest.fn().mockReturnValue(3000);
-            const membership = new CallMembership(fakeEvent, membershipTemplate);
-            expect(membership.isExpired()).toEqual(false);
+            fakeEvent.getTs = jest.fn().mockReturnValue(Date.now() - (DEFAULT_EXPIRE_DURATION - 1));
+            expect(new CallMembership(fakeEvent, membershipTemplate).isExpired()).toEqual(false);
+        });
+
+        it("considers memberships expired if local age large enough", () => {
+            const fakeEvent = makeMockEvent(1000);
+            fakeEvent.getTs = jest.fn().mockReturnValue(Date.now() - (DEFAULT_EXPIRE_DURATION + 1));
+            expect(new CallMembership(fakeEvent, membershipTemplate).isExpired()).toEqual(true);
         });
 
         it("returns preferred foci", () => {
@@ -171,15 +101,6 @@ describe("CallMembership", () => {
     describe("expiry calculation", () => {
         let fakeEvent: MatrixEvent;
         let membership: CallMembership;
-        const membershipTemplate: CallMembershipDataLegacy = {
-            call_id: "",
-            scope: "m.room",
-            application: "m.call",
-            device_id: "AAAAAAA",
-            expires: 5000,
-            membershipID: "bloop",
-            foci_active: [{ type: "livekit" }],
-        };
 
         beforeEach(() => {
             // server origin timestamp for this event is 1000
@@ -193,24 +114,10 @@ describe("CallMembership", () => {
             jest.useRealTimers();
         });
 
-        it("converts expiry time into local clock", () => {
-            // our clock would have been at 2000 at the creation time (our clock at event receive time - age)
-            // (ie. the local clock is 1 second ahead of the servers' clocks)
-            fakeEvent.localTimestamp = 2000;
-
-            // for simplicity's sake, we say that the event's age is zero
-            fakeEvent.getLocalAge = jest.fn().mockReturnValue(0);
-
-            // for sanity's sake, make sure the server-relative expiry time is what we expect
-            expect(membership.getAbsoluteExpiry()).toEqual(6000);
-            // therefore the expiry time converted to our clock should be 1 second later
-            expect(membership.getLocalExpiry()).toEqual(7000);
-        });
-
         it("calculates time until expiry", () => {
             jest.setSystemTime(2000);
             // should be using absolute expiry time
-            expect(membership.getMsUntilExpiry()).toEqual(4000);
+            expect(membership.getMsUntilExpiry()).toEqual(DEFAULT_EXPIRE_DURATION - 1000);
         });
     });
 });

spec/unit/matrixrtc/MatrixRTCSession.spec.ts

@@ -14,27 +14,13 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { encodeBase64, EventTimeline, EventType, MatrixClient, MatrixError, MatrixEvent, Room } from "../../../src";
+import { encodeBase64, EventType, MatrixClient, MatrixError, MatrixEvent, Room } from "../../../src";
 import { KnownMembership } from "../../../src/@types/membership";
-import {
-    CallMembershipData,
-    CallMembershipDataLegacy,
-    SessionMembershipData,
-} from "../../../src/matrixrtc/CallMembership";
+import { SessionMembershipData, DEFAULT_EXPIRE_DURATION } from "../../../src/matrixrtc/CallMembership";
 import { MatrixRTCSession, MatrixRTCSessionEvent } from "../../../src/matrixrtc/MatrixRTCSession";
 import { EncryptionKeysEventContent } from "../../../src/matrixrtc/types";
 import { randomString } from "../../../src/randomstring";
-import { makeMockRoom, makeMockRoomState, mockRTCEvent } from "./mocks";
-
-const membershipTemplate: CallMembershipData = {
-    call_id: "",
-    scope: "m.room",
-    application: "m.call",
-    device_id: "AAAAAAA",
-    expires: 60 * 60 * 1000,
-    membershipID: "bloop",
-    foci_active: [{ type: "livekit", livekit_service_url: "https://lk.url" }],
-};
+import { makeMockRoom, makeMockRoomState, membershipTemplate } from "./mocks";
 
 const mockFocus = { type: "mock" };
 
@@ -59,7 +45,7 @@ describe("MatrixRTCSession", () => {
 
     describe("roomSessionForRoom", () => {
         it("creates a room-scoped session from room state", () => {
-            const mockRoom = makeMockRoom([membershipTemplate]);
+            const mockRoom = makeMockRoom(membershipTemplate);
 
             sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
             expect(sess?.memberships.length).toEqual(1);
@@ -67,7 +53,6 @@ describe("MatrixRTCSession", () => {
             expect(sess?.memberships[0].scope).toEqual("m.room");
             expect(sess?.memberships[0].application).toEqual("m.call");
             expect(sess?.memberships[0].deviceId).toEqual("AAAAAAA");
-            expect(sess?.memberships[0].membershipID).toEqual("bloop");
             expect(sess?.memberships[0].isExpired()).toEqual(false);
             expect(sess?.callId).toEqual("");
         });
@@ -87,7 +72,7 @@ describe("MatrixRTCSession", () => {
         });
 
         it("ignores memberships events of members not in the room", () => {
-            const mockRoom = makeMockRoom([membershipTemplate]);
+            const mockRoom = makeMockRoom(membershipTemplate);
             mockRoom.hasMembershipState = (state) => state === KnownMembership.Join;
             sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
             expect(sess?.memberships.length).toEqual(0);
@@ -181,14 +166,6 @@ describe("MatrixRTCSession", () => {
             expect(sess.memberships).toHaveLength(0);
         });
 
-        it("ignores memberships with no expires_ts", () => {
-            const expiredMembership = Object.assign({}, membershipTemplate);
-            (expiredMembership.expires as number | undefined) = undefined;
-            const mockRoom = makeMockRoom([expiredMembership]);
-            sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
-            expect(sess.memberships).toHaveLength(0);
-        });
-
         it("ignores memberships with no device_id", () => {
             const testMembership = Object.assign({}, membershipTemplate);
             (testMembership.device_id as string | undefined) = undefined;
@@ -224,23 +201,7 @@ describe("MatrixRTCSession", () => {
 
     describe("updateCallMembershipEvent", () => {
         const mockFocus = { type: "livekit", livekit_service_url: "https://test.org" };
-        const joinSessionConfig = { useLegacyMemberEvents: false };
-
-        const legacyMembershipData: CallMembershipDataLegacy = {
-            call_id: "",
-            scope: "m.room",
-            application: "m.call",
-            device_id: "AAAAAAA_legacy",
-            expires: 60 * 60 * 1000,
-            membershipID: "bloop",
-            foci_active: [mockFocus],
-        };
-
-        const expiredLegacyMembershipData: CallMembershipDataLegacy = {
-            ...legacyMembershipData,
-            device_id: "AAAAAAA_legacy_expired",
-            expires: 0,
-        };
+        const joinSessionConfig = {};
 
         const sessionMembershipData: SessionMembershipData = {
             call_id: "",
@@ -273,39 +234,22 @@ describe("MatrixRTCSession", () => {
             client._unstable_sendDelayedStateEvent = sendDelayedStateMock;
         });
 
-        async function testSession(
-            membershipData: CallMembershipData[] | SessionMembershipData,
-            shouldUseLegacy: boolean,
-        ): Promise<void> {
+        async function testSession(membershipData: SessionMembershipData): Promise<void> {
             sess = MatrixRTCSession.roomSessionForRoom(client, makeMockRoom(membershipData));
 
-            const makeNewLegacyMembershipsMock = jest.spyOn(sess as any, "makeNewLegacyMemberships");
             const makeNewMembershipMock = jest.spyOn(sess as any, "makeNewMembership");
 
             sess.joinRoomSession([mockFocus], mockFocus, joinSessionConfig);
             await Promise.race([sentStateEvent, new Promise((resolve) => setTimeout(resolve, 500))]);
 
-            expect(makeNewLegacyMembershipsMock).toHaveBeenCalledTimes(shouldUseLegacy ? 1 : 0);
-            expect(makeNewMembershipMock).toHaveBeenCalledTimes(shouldUseLegacy ? 0 : 1);
+            expect(makeNewMembershipMock).toHaveBeenCalledTimes(1);
 
             await Promise.race([sentDelayedState, new Promise((resolve) => setTimeout(resolve, 500))]);
-            expect(client._unstable_sendDelayedStateEvent).toHaveBeenCalledTimes(shouldUseLegacy ? 0 : 1);
+            expect(client._unstable_sendDelayedStateEvent).toHaveBeenCalledTimes(1);
         }
 
-        it("uses legacy events if there are any active legacy calls", async () => {
-            await testSession([expiredLegacyMembershipData, legacyMembershipData, sessionMembershipData], true);
-        });
-
-        it('uses legacy events if a non-legacy call is in a "memberships" array', async () => {
-            await testSession([sessionMembershipData], true);
-        });
-
-        it("uses non-legacy events if all legacy calls are expired", async () => {
-            await testSession([expiredLegacyMembershipData], false);
-        });
-
-        it("uses non-legacy events if there are only non-legacy calls", async () => {
-            await testSession(sessionMembershipData, false);
+        it("sends events", async () => {
+            await testSession(sessionMembershipData);
         });
     });
 
@@ -326,7 +270,11 @@ describe("MatrixRTCSession", () => {
     });
 
     describe("getsActiveFocus", () => {
-        const activeFociConfig = { type: "livekit", livekit_service_url: "https://active.url" };
+        const firstPreferredFocus = {
+            type: "livekit",
+            livekit_service_url: "https://active.url",
+            livekit_alias: "!active:active.url",
+        };
         it("gets the correct active focus with oldest_membership", () => {
             jest.useFakeTimers();
             jest.setSystemTime(3000);
@@ -334,7 +282,7 @@ describe("MatrixRTCSession", () => {
                 Object.assign({}, membershipTemplate, {
                     device_id: "foo",
                     created_ts: 500,
-                    foci_active: [activeFociConfig],
+                    foci_preferred: [firstPreferredFocus],
                 }),
                 Object.assign({}, membershipTemplate, { device_id: "old", created_ts: 1000 }),
                 Object.assign({}, membershipTemplate, { device_id: "bar", created_ts: 2000 }),
@@ -346,15 +294,15 @@ describe("MatrixRTCSession", () => {
                 type: "livekit",
                 focus_selection: "oldest_membership",
             });
-            expect(sess.getActiveFocus()).toBe(activeFociConfig);
+            expect(sess.getActiveFocus()).toBe(firstPreferredFocus);
             jest.useRealTimers();
         });
-        it("does not provide focus if the selction method is unknown", () => {
+        it("does not provide focus if the selection method is unknown", () => {
             const mockRoom = makeMockRoom([
                 Object.assign({}, membershipTemplate, {
                     device_id: "foo",
                     created_ts: 500,
-                    foci_active: [activeFociConfig],
+                    foci_preferred: [firstPreferredFocus],
                 }),
                 Object.assign({}, membershipTemplate, { device_id: "old", created_ts: 1000 }),
                 Object.assign({}, membershipTemplate, { device_id: "bar", created_ts: 2000 }),
@@ -368,25 +316,6 @@ describe("MatrixRTCSession", () => {
             });
             expect(sess.getActiveFocus()).toBe(undefined);
         });
-        it("gets the correct active focus legacy", () => {
-            jest.useFakeTimers();
-            jest.setSystemTime(3000);
-            const mockRoom = makeMockRoom([
-                Object.assign({}, membershipTemplate, {
-                    device_id: "foo",
-                    created_ts: 500,
-                    foci_active: [activeFociConfig],
-                }),
-                Object.assign({}, membershipTemplate, { device_id: "old", created_ts: 1000 }),
-                Object.assign({}, membershipTemplate, { device_id: "bar", created_ts: 2000 }),
-            ]);
-
-            sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
-
-            sess.joinRoomSession([{ type: "livekit", livekit_service_url: "htts://test.org" }]);
-            expect(sess.getActiveFocus()).toBe(activeFociConfig);
-            jest.useRealTimers();
-        });
     });
 
     describe("joining", () => {
@@ -448,24 +377,28 @@ describe("MatrixRTCSession", () => {
                 mockRoom!.roomId,
                 EventType.GroupCallMemberPrefix,
                 {
-                    memberships: [
-                        {
-                            application: "m.call",
-                            scope: "m.room",
-                            call_id: "",
-                            device_id: "AAAAAAA",
-                            expires: 3600000,
-                            expires_ts: Date.now() + 3600000,
-                            foci_active: [mockFocus],
-
-                            membershipID: expect.stringMatching(".*"),
-                        },
-                    ],
+                    application: "m.call",
+                    scope: "m.room",
+                    call_id: "",
+                    device_id: "AAAAAAA",
+                    expires: DEFAULT_EXPIRE_DURATION,
+                    foci_preferred: [mockFocus],
+                    focus_active: {
+                        focus_selection: "oldest_membership",
+                        type: "livekit",
+                    },
                 },
-                "@alice:example.org",
+                "_@alice:example.org_AAAAAAA",
             );
             await Promise.race([sentDelayedState, new Promise((resolve) => realSetTimeout(resolve, 500))]);
-            expect(client._unstable_sendDelayedStateEvent).toHaveBeenCalledTimes(0);
+            // Because we actually want to send the state
+            expect(client.sendStateEvent).toHaveBeenCalledTimes(1);
+            // For checking if the delayed event is still there or got removed while sending the state.
+            expect(client._unstable_updateDelayedEvent).toHaveBeenCalledTimes(1);
+            // For scheduling the delayed event
+            expect(client._unstable_sendDelayedStateEvent).toHaveBeenCalledTimes(1);
+            // This returns no error so we do not check if we reschedule the event again. this is done in another test.
+
             jest.useRealTimers();
         });
 
@@ -478,28 +411,26 @@ describe("MatrixRTCSession", () => {
                 mockRoom!.roomId,
                 EventType.GroupCallMemberPrefix,
                 {
-                    memberships: [
-                        {
-                            application: "m.call",
-                            scope: "m.room",
-                            call_id: "",
-                            device_id: "AAAAAAA",
-                            expires: 60000,
-                            expires_ts: Date.now() + 60000,
-                            foci_active: [mockFocus],
-
-                            membershipID: expect.stringMatching(".*"),
-                        },
-                    ],
+                    application: "m.call",
+                    scope: "m.room",
+                    call_id: "",
+                    device_id: "AAAAAAA",
+                    expires: 60000,
+                    foci_preferred: [mockFocus],
+                    focus_active: {
+                        focus_selection: "oldest_membership",
+                        type: "livekit",
+                    },
                 },
-                "@alice:example.org",
+
+                "_@alice:example.org_AAAAAAA",
             );
             await Promise.race([sentDelayedState, new Promise((resolve) => realSetTimeout(resolve, 500))]);
-            expect(client._unstable_sendDelayedStateEvent).toHaveBeenCalledTimes(0);
+            expect(client._unstable_sendDelayedStateEvent).toHaveBeenCalledTimes(1);
             jest.useRealTimers();
         });
 
-        describe("non-legacy calls", () => {
+        describe("calls", () => {
             const activeFocusConfig = { type: "livekit", livekit_service_url: "https://active.url" };
             const activeFocus = { type: "livekit", focus_selection: "oldest_membership" };
 
@@ -557,7 +488,6 @@ describe("MatrixRTCSession", () => {
                 });
 
                 sess!.joinRoomSession([activeFocusConfig], activeFocus, {
-                    useLegacyMemberEvents: false,
                     membershipServerSideExpiryTimeout: 9000,
                 });
 
@@ -579,6 +509,7 @@ describe("MatrixRTCSession", () => {
                         application: "m.call",
                         scope: "m.room",
                         call_id: "",
+                        expires: 14400000,
                         device_id: "AAAAAAA",
                         foci_preferred: [activeFocusConfig],
                         focus_active: activeFocus,
@@ -598,7 +529,7 @@ describe("MatrixRTCSession", () => {
                 jest.useRealTimers();
             }
 
-            it("sends a membership event with session payload when joining a non-legacy call", async () => {
+            it("sends a membership event with session payload when joining a call", async () => {
                 await testJoin(false);
             });
 
@@ -607,91 +538,19 @@ describe("MatrixRTCSession", () => {
             });
         });
 
-        it("does nothing if join called when already joined", () => {
+        it("does nothing if join called when already joined", async () => {
             sess!.joinRoomSession([mockFocus], mockFocus);
-
+            await sentStateEvent;
             expect(client.sendStateEvent).toHaveBeenCalledTimes(1);
 
             sess!.joinRoomSession([mockFocus], mockFocus);
             expect(client.sendStateEvent).toHaveBeenCalledTimes(1);
         });
-
-        it("renews membership event before expiry time", async () => {
-            jest.useFakeTimers();
-            let resolveFn: ((_roomId: string, _type: string, val: Record<string, any>) => void) | undefined;
-
-            const eventSentPromise = new Promise<Record<string, any>>((r) => {
-                resolveFn = (_roomId: string, _type: string, val: Record<string, any>) => {
-                    r(val);
-                };
-            });
-            try {
-                const sendStateEventMock = jest.fn().mockImplementation(resolveFn);
-                client.sendStateEvent = sendStateEventMock;
-
-                sess!.joinRoomSession([mockFocus], mockFocus);
-
-                const eventContent = await eventSentPromise;
-
-                jest.setSystemTime(1000);
-                const event = mockRTCEvent(eventContent.memberships, mockRoom.roomId);
-                const getState = mockRoom.getLiveTimeline().getState(EventTimeline.FORWARDS)!;
-                getState.getStateEvents = jest.fn().mockReturnValue(event);
-                getState.events = new Map([
-                    [
-                        event.getType(),
-                        {
-                            size: () => true,
-                            has: (_stateKey: string) => true,
-                            get: (_stateKey: string) => event,
-                            values: () => [event],
-                        } as unknown as Map<string, MatrixEvent>,
-                    ],
-                ]);
-
-                const eventReSentPromise = new Promise<Record<string, any>>((r) => {
-                    resolveFn = (_roomId: string, _type: string, val: Record<string, any>) => {
-                        r(val);
-                    };
-                });
-
-                sendStateEventMock.mockReset().mockImplementation(resolveFn);
-
-                // definitely should have renewed by 1 second before the expiry!
-                const timeElapsed = 60 * 60 * 1000 - 1000;
-                jest.setSystemTime(Date.now() + timeElapsed);
-                jest.advanceTimersByTime(timeElapsed);
-                await eventReSentPromise;
-
-                expect(sendStateEventMock).toHaveBeenCalledWith(
-                    mockRoom.roomId,
-                    EventType.GroupCallMemberPrefix,
-                    {
-                        memberships: [
-                            {
-                                application: "m.call",
-                                scope: "m.room",
-                                call_id: "",
-                                device_id: "AAAAAAA",
-                                expires: 3600000 * 2,
-                                expires_ts: 1000 + 3600000 * 2,
-                                foci_active: [mockFocus],
-                                created_ts: 1000,
-                                membershipID: expect.stringMatching(".*"),
-                            },
-                        ],
-                    },
-                    "@alice:example.org",
-                );
-            } finally {
-                jest.useRealTimers();
-            }
-        });
     });
 
     describe("onMembershipsChanged", () => {
         it("does not emit if no membership changes", () => {
-            const mockRoom = makeMockRoom([membershipTemplate]);
+            const mockRoom = makeMockRoom(membershipTemplate);
             sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
 
             const onMembershipsChanged = jest.fn();
@@ -702,7 +561,7 @@ describe("MatrixRTCSession", () => {
         });
 
         it("emits on membership changes", () => {
-            const mockRoom = makeMockRoom([membershipTemplate]);
+            const mockRoom = makeMockRoom(membershipTemplate);
             sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
 
             const onMembershipsChanged = jest.fn();
@@ -714,26 +573,28 @@ describe("MatrixRTCSession", () => {
             expect(onMembershipsChanged).toHaveBeenCalled();
         });
 
-        it("emits an event at the time a membership event expires", () => {
-            jest.useFakeTimers();
-            try {
-                const membership = Object.assign({}, membershipTemplate);
-                const mockRoom = makeMockRoom([membership]);
+        // TODO: re-enable this test when expiry is implemented
+        // eslint-disable-next-line jest/no-commented-out-tests
+        // it("emits an event at the time a membership event expires", () => {
+        //     jest.useFakeTimers();
+        //     try {
+        //         const membership = Object.assign({}, membershipTemplate);
+        //         const mockRoom = makeMockRoom([membership]);
 
-                sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
-                const membershipObject = sess.memberships[0];
+        //         sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
+        //         const membershipObject = sess.memberships[0];
 
-                const onMembershipsChanged = jest.fn();
-                sess.on(MatrixRTCSessionEvent.MembershipsChanged, onMembershipsChanged);
+        //         const onMembershipsChanged = jest.fn();
+        //         sess.on(MatrixRTCSessionEvent.MembershipsChanged, onMembershipsChanged);
 
-                jest.advanceTimersByTime(61 * 1000 * 1000);
+        //         jest.advanceTimersByTime(61 * 1000 * 1000);
 
-                expect(onMembershipsChanged).toHaveBeenCalledWith([membershipObject], []);
-                expect(sess?.memberships.length).toEqual(0);
-            } finally {
-                jest.useRealTimers();
-            }
-        });
+        //         expect(onMembershipsChanged).toHaveBeenCalledWith([membershipObject], []);
+        //         expect(sess?.memberships.length).toEqual(0);
+        //     } finally {
+        //         jest.useRealTimers();
+        //     }
+        // });
     });
 
     describe("key management", () => {
@@ -805,9 +666,13 @@ describe("MatrixRTCSession", () => {
                 }
             });
 
-            it("does not send key if join called when already joined", () => {
+            it("does not send key if join called when already joined", async () => {
+                const sentStateEvent = new Promise((resolve) => {
+                    sendStateEventMock = jest.fn(resolve);
+                });
+                client.sendStateEvent = sendStateEventMock;
                 sess!.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
-
+                await sentStateEvent;
                 expect(client.sendStateEvent).toHaveBeenCalledTimes(1);
                 expect(client.sendEvent).toHaveBeenCalledTimes(1);
                 expect(sess!.statistics.counters.roomEventEncryptionKeysSent).toEqual(1);
@@ -1016,89 +881,6 @@ describe("MatrixRTCSession", () => {
                 }
             });
 
-            it("re-sends key if a member changes membership ID", async () => {
-                jest.useFakeTimers();
-                try {
-                    const keysSentPromise1 = new Promise((resolve) => {
-                        sendEventMock.mockImplementation(resolve);
-                    });
-
-                    const member1 = membershipTemplate;
-                    const member2 = {
-                        ...membershipTemplate,
-                        device_id: "BBBBBBB",
-                    };
-
-                    const mockRoom = makeMockRoom([member1, member2]);
-                    mockRoom.getLiveTimeline().getState = jest
-                        .fn()
-                        .mockReturnValue(makeMockRoomState([member1, member2], mockRoom.roomId));
-
-                    sess = MatrixRTCSession.roomSessionForRoom(client, mockRoom);
-                    sess.joinRoomSession([mockFocus], mockFocus, { manageMediaKeys: true });
-
-                    await keysSentPromise1;
-
-                    // make sure an encryption key was sent
-                    expect(sendEventMock).toHaveBeenCalledWith(
-                        expect.stringMatching(".*"),
-                        "io.element.call.encryption_keys",
-                        {
-                            call_id: "",
-                            device_id: "AAAAAAA",
-                            keys: [
-                                {
-                                    index: 0,
-                                    key: expect.stringMatching(".*"),
-                                },
-                            ],
-                            sent_ts: Date.now(),
-                        },
-                    );
-                    expect(sess!.statistics.counters.roomEventEncryptionKeysSent).toEqual(1);
-
-                    sendEventMock.mockClear();
-
-                    // this should be a no-op:
-                    sess.onMembershipUpdate();
-                    expect(sendEventMock).toHaveBeenCalledTimes(0);
-
-                    // advance time to avoid key throttling
-                    jest.advanceTimersByTime(10000);
-
-                    // update membership ID
-                    member2.membershipID = "newID";
-
-                    const keysSentPromise2 = new Promise((resolve) => {
-                        sendEventMock.mockImplementation(resolve);
-                    });
-
-                    // this should re-send the key
-                    sess.onMembershipUpdate();
-
-                    await keysSentPromise2;
-
-                    expect(sendEventMock).toHaveBeenCalledWith(
-                        expect.stringMatching(".*"),
-                        "io.element.call.encryption_keys",
-                        {
-                            call_id: "",
-                            device_id: "AAAAAAA",
-                            keys: [
-                                {
-                                    index: 0,
-                                    key: expect.stringMatching(".*"),
-                                },
-                            ],
-                            sent_ts: Date.now(),
-                        },
-                    );
-                    expect(sess!.statistics.counters.roomEventEncryptionKeysSent).toEqual(2);
-                } finally {
-                    jest.useRealTimers();
-                }
-            });
-
             it("re-sends key if a member changes created_ts", async () => {
                 jest.useFakeTimers();
                 jest.setSystemTime(1000);
@@ -1240,7 +1022,7 @@ describe("MatrixRTCSession", () => {
             it("wraps key index around to 0 when it reaches the maximum", async () => {
                 // this should give us keys with index [0...255, 0, 1]
                 const membersToTest = 258;
-                const members: CallMembershipData[] = [];
+                const members: SessionMembershipData[] = [];
                 for (let i = 0; i < membersToTest; i++) {
                     members.push(Object.assign({}, membershipTemplate, { device_id: `DEVICE${i}` }));
                 }

spec/unit/matrixrtc/MatrixRTCSessionManager.spec.ts

@@ -14,6 +14,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+import { Mock } from "jest-mock";
+
 import {
     ClientEvent,
     EventTimeline,
@@ -24,19 +26,8 @@ import {
     RoomEvent,
 } from "../../../src";
 import { RoomStateEvent } from "../../../src/models/room-state";
-import { CallMembershipData } from "../../../src/matrixrtc/CallMembership";
 import { MatrixRTCSessionManagerEvents } from "../../../src/matrixrtc/MatrixRTCSessionManager";
-import { makeMockRoom } from "./mocks";
-
-const membershipTemplate: CallMembershipData = {
-    call_id: "",
-    scope: "m.room",
-    application: "m.call",
-    device_id: "AAAAAAA",
-    expires: 60 * 60 * 1000,
-    membershipID: "bloop",
-    foci_active: [{ type: "test" }],
-};
+import { makeMockRoom, makeMockRoomState, membershipTemplate } from "./mocks";
 
 describe("MatrixRTCSessionManager", () => {
     let client: MatrixClient;
@@ -69,16 +60,15 @@ describe("MatrixRTCSessionManager", () => {
     it("Fires event when session ends", () => {
         const onEnded = jest.fn();
         client.matrixRTC.on(MatrixRTCSessionManagerEvents.SessionEnded, onEnded);
-
-        const memberships = [membershipTemplate];
-
-        const room1 = makeMockRoom(memberships);
+        const room1 = makeMockRoom(membershipTemplate);
         jest.spyOn(client, "getRooms").mockReturnValue([room1]);
         jest.spyOn(client, "getRoom").mockReturnValue(room1);
 
         client.emit(ClientEvent.Room, room1);
 
-        memberships.splice(0, 1);
+        (room1.getLiveTimeline as Mock).mockReturnValue({
+            getState: jest.fn().mockReturnValue(makeMockRoomState([{}], room1.roomId)),
+        });
 
         const roomState = room1.getLiveTimeline().getState(EventTimeline.FORWARDS)!;
         const membEvent = roomState.getStateEvents("")[0];

spec/unit/matrixrtc/mocks.ts

@@ -15,16 +15,36 @@ limitations under the License.
 */
 
 import { EventType, MatrixEvent, Room } from "../../../src";
-import { CallMembershipData, SessionMembershipData } from "../../../src/matrixrtc/CallMembership";
+import { SessionMembershipData } from "../../../src/matrixrtc/CallMembership";
 import { randomString } from "../../../src/randomstring";
 
-type MembershipData = CallMembershipData[] | SessionMembershipData;
+type MembershipData = SessionMembershipData[] | SessionMembershipData | {};
+
+export const membershipTemplate: SessionMembershipData = {
+    application: "m.call",
+    call_id: "",
+    device_id: "AAAAAAA",
+    scope: "m.room",
+    focus_active: { type: "livekit", livekit_service_url: "https://lk.url" },
+    foci_preferred: [
+        {
+            livekit_alias: "!alias:something.org",
+            livekit_service_url: "https://livekit-jwt.something.io",
+            type: "livekit",
+        },
+        {
+            livekit_alias: "!alias:something.org",
+            livekit_service_url: "https://livekit-jwt.something.dev",
+            type: "livekit",
+        },
+    ],
+};
 
 export function makeMockRoom(membershipData: MembershipData): Room {
     const roomId = randomString(8);
     // Caching roomState here so it does not get recreated when calling `getLiveTimeline.getState()`
     const roomState = makeMockRoomState(membershipData, roomId);
-    return {
+    const room = {
         roomId: roomId,
         hasMembershipState: jest.fn().mockReturnValue(true),
         getLiveTimeline: jest.fn().mockReturnValue({
@@ -32,41 +52,46 @@ export function makeMockRoom(membershipData: MembershipData): Room {
         }),
         getVersion: jest.fn().mockReturnValue("default"),
     } as unknown as Room;
+    return room;
 }
 
 export function makeMockRoomState(membershipData: MembershipData, roomId: string) {
-    const event = mockRTCEvent(membershipData, roomId);
+    const events = Array.isArray(membershipData)
+        ? membershipData.map((m) => mockRTCEvent(m, roomId))
+        : [mockRTCEvent(membershipData, roomId)];
+    const keysAndEvents = events.map((e) => {
+        const data = e.getContent() as SessionMembershipData;
+        return [`_${e.sender?.userId}_${data.device_id}`];
+    });
+
     return {
         on: jest.fn(),
         off: jest.fn(),
         getStateEvents: (_: string, stateKey: string) => {
-            if (stateKey !== undefined) return event;
-            return [event];
+            if (stateKey !== undefined) return keysAndEvents.find(([k]) => k === stateKey)?.[1];
+            return events;
         },
-        events: new Map([
-            [
-                event.getType(),
-                {
-                    size: () => true,
-                    has: (_stateKey: string) => true,
-                    get: (_stateKey: string) => event,
-                    values: () => [event],
-                },
-            ],
-        ]),
+        events:
+            events.length === 0
+                ? new Map()
+                : new Map([
+                      [
+                          EventType.GroupCallMemberPrefix,
+                          {
+                              size: () => true,
+                              has: (stateKey: string) => keysAndEvents.find(([k]) => k === stateKey),
+                              get: (stateKey: string) => keysAndEvents.find(([k]) => k === stateKey)?.[1],
+                              values: () => events,
+                          },
+                      ],
+                  ]),
     };
 }
 
 export function mockRTCEvent(membershipData: MembershipData, roomId: string): MatrixEvent {
     return {
         getType: jest.fn().mockReturnValue(EventType.GroupCallMemberPrefix),
-        getContent: jest.fn().mockReturnValue(
-            !Array.isArray(membershipData)
-                ? membershipData
-                : {
-                      memberships: membershipData,
-                  },
-        ),
+        getContent: jest.fn().mockReturnValue(membershipData),
         getSender: jest.fn().mockReturnValue("@mock:user.example"),
         getTs: jest.fn().mockReturnValue(Date.now()),
         getRoomId: jest.fn().mockReturnValue(roomId),

spec/unit/oidc/validate.spec.ts

@@ -170,6 +170,23 @@ describe("validateIdToken()", () => {
         expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid audience"));
     });
 
+    it("should not throw when audience is an array that includes clientId", () => {
+        mocked(jwtDecode).mockReturnValue({
+            ...validDecodedIdToken,
+            aud: [clientId],
+        });
+        expect(() => validateIdToken(idToken, issuer, clientId, nonce)).not.toThrow();
+    });
+
+    it("should throw when audience is an array that does not include clientId", () => {
+        mocked(jwtDecode).mockReturnValue({
+            ...validDecodedIdToken,
+            aud: [`${clientId},uiop`, "asdf"],
+        });
+        expect(() => validateIdToken(idToken, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
+        expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid audience"));
+    });
+
     it("should throw when nonce does not match", () => {
         mocked(jwtDecode).mockReturnValue({
             ...validDecodedIdToken,

spec/unit/rust-crypto/rust-crypto.spec.ts

@@ -30,6 +30,7 @@ import fetchMock from "fetch-mock-jest";
 import { RustCrypto } from "../../../src/rust-crypto/rust-crypto";
 import { initRustCrypto } from "../../../src/rust-crypto";
 import {
+    AccountDataEvents,
     Device,
     DeviceVerification,
     encodeBase64,
@@ -727,6 +728,119 @@ describe("RustCrypto", () => {
         expect(resetKeyBackup.mock.calls).toHaveLength(2);
     });
 
+    describe("upload existing key backup key to new 4S store", () => {
+        const secretStorageCallbacks = {
+            getSecretStorageKey: async (keys: any, name: string) => {
+                return [[...Object.keys(keys.keys)][0], new Uint8Array(32)];
+            },
+        } as SecretStorageCallbacks;
+        let secretStorage: ServerSideSecretStorageImpl;
+
+        let backupAuthData: any;
+        let backupAlg: string;
+
+        const fetchMock = {
+            authedRequest: jest.fn().mockImplementation((method, path, query, body) => {
+                if (path === "/room_keys/version") {
+                    if (method === "POST") {
+                        backupAuthData = body["auth_data"];
+                        backupAlg = body["algorithm"];
+                        return Promise.resolve({ version: "1", algorithm: backupAlg, auth_data: backupAuthData });
+                    } else if (method === "GET" && backupAuthData) {
+                        return Promise.resolve({ version: "1", algorithm: backupAlg, auth_data: backupAuthData });
+                    }
+                }
+                return Promise.resolve({});
+            }),
+        };
+
+        beforeEach(() => {
+            backupAuthData = undefined;
+            backupAlg = "";
+
+            secretStorage = new ServerSideSecretStorageImpl(new DummyAccountDataClient(), secretStorageCallbacks);
+        });
+
+        it("bootstrapSecretStorage saves megolm backup key if already cached", async () => {
+            const rustCrypto = await makeTestRustCrypto(
+                fetchMock as unknown as MatrixHttpApi<any>,
+                testData.TEST_USER_ID,
+                undefined,
+                secretStorage,
+            );
+
+            async function createSecretStorageKey() {
+                return {
+                    keyInfo: {} as AddSecretStorageKeyOpts,
+                    privateKey: new Uint8Array(32),
+                };
+            }
+
+            await rustCrypto.resetKeyBackup();
+
+            const storeSpy = jest.spyOn(secretStorage, "store");
+
+            await rustCrypto.bootstrapSecretStorage({
+                createSecretStorageKey,
+                setupNewSecretStorage: true,
+                setupNewKeyBackup: false,
+            });
+
+            expect(storeSpy).toHaveBeenCalledWith("m.megolm_backup.v1", expect.anything());
+        });
+
+        it("bootstrapSecretStorage doesn't try to save megolm backup key not in cache", async () => {
+            const mockOlmMachine = {
+                isBackupEnabled: jest.fn().mockResolvedValue(false),
+                sign: jest.fn().mockResolvedValue({
+                    asJSON: jest.fn().mockReturnValue("{}"),
+                }),
+                saveBackupDecryptionKey: jest.fn(),
+                crossSigningStatus: jest.fn().mockResolvedValue({
+                    hasMaster: true,
+                    hasSelfSigning: true,
+                    hasUserSigning: true,
+                }),
+                exportCrossSigningKeys: jest.fn().mockResolvedValue({
+                    masterKey: "sosecret",
+                    userSigningKey: "secrets",
+                    self_signing_key: "ssshhh",
+                }),
+                getBackupKeys: jest.fn().mockResolvedValue({}),
+                verifyBackup: jest.fn().mockResolvedValue({ trusted: jest.fn().mockReturnValue(false) }),
+            } as unknown as OlmMachine;
+
+            const rustCrypto = new RustCrypto(
+                logger,
+                mockOlmMachine,
+                fetchMock as unknown as MatrixHttpApi<any>,
+                TEST_USER,
+                TEST_DEVICE_ID,
+                secretStorage,
+                {} as CryptoCallbacks,
+            );
+
+            async function createSecretStorageKey() {
+                return {
+                    keyInfo: {} as AddSecretStorageKeyOpts,
+                    privateKey: new Uint8Array(32),
+                };
+            }
+
+            await rustCrypto.resetKeyBackup();
+
+            const storeSpy = jest.spyOn(secretStorage, "store");
+
+            await rustCrypto.bootstrapSecretStorage({
+                createSecretStorageKey,
+                setupNewSecretStorage: true,
+                setupNewKeyBackup: false,
+            });
+
+            expect(storeSpy).not.toHaveBeenCalledWith("m.megolm_backup.v1", expect.anything());
+        });
+    });
+
     it("isSecretStorageReady", async () => {
         const mockSecretStorage = {
             getDefaultKeyId: jest.fn().mockResolvedValue(null),
@@ -1811,11 +1925,13 @@ class DummyAccountDataClient
         super();
     }
 
-    public async getAccountDataFromServer<T extends Record<string, any>>(eventType: string): Promise<T | null> {
+    public async getAccountDataFromServer<K extends keyof AccountDataEvents>(
+        eventType: K,
+    ): Promise<AccountDataEvents[K] | null> {
         const ret = this.storage.get(eventType);
 
         if (eventType) {
-            return ret as T;
+            return ret;
         } else {
             return null;
         }

spec/unit/rust-crypto/secret-storage.spec.ts

@@ -19,6 +19,18 @@ import {
     secretStorageContainsCrossSigningKeys,
 } from "../../../src/rust-crypto/secret-storage";
 import { ServerSideSecretStorage } from "../../../src/secret-storage";
+import { SecretInfo } from "../../../src/secret-storage.ts";
+
+declare module "../../../src/@types/event" {
+    interface SecretStorageAccountDataEvents {
+        secretA: SecretInfo;
+        secretB: SecretInfo;
+        secretC: SecretInfo;
+        secretD: SecretInfo;
+        secretE: SecretInfo;
+        Unknown: SecretInfo;
+    }
+}
 
 describe("secret-storage", () => {
     describe("secretStorageContainsCrossSigningKeys", () => {

spec/unit/secret-storage.spec.ts

@@ -27,6 +27,14 @@ import {
     trimTrailingEquals,
 } from "../../src/secret-storage";
 import { randomString } from "../../src/randomstring";
+import { SecretInfo } from "../../src/secret-storage.ts";
+import { AccountDataEvents } from "../../src";
+
+declare module "../../src/@types/event" {
+    interface SecretStorageAccountDataEvents {
+        mysecret: SecretInfo;
+    }
+}
 
 describe("ServerSideSecretStorageImpl", function () {
     describe(".addKey", function () {
@@ -117,9 +125,11 @@ describe("ServerSideSecretStorageImpl", function () {
             const secretStorage = new ServerSideSecretStorageImpl(accountDataAdapter, {});
 
             const storedKey = { iv: "iv", mac: "mac" } as SecretStorageKeyDescriptionAesV1;
-            async function mockGetAccountData<T extends Record<string, any>>(eventType: string): Promise<T | null> {
+            async function mockGetAccountData<K extends keyof AccountDataEvents>(
+                eventType: string,
+            ): Promise<AccountDataEvents[K] | null> {
                 if (eventType === "m.secret_storage.key.my_key") {
-                    return storedKey as unknown as T;
+                    return storedKey as any;
                 } else {
                     throw new Error(`unexpected eventType ${eventType}`);
                 }
@@ -135,11 +145,13 @@ describe("ServerSideSecretStorageImpl", function () {
             const secretStorage = new ServerSideSecretStorageImpl(accountDataAdapter, {});
 
             const storedKey = { iv: "iv", mac: "mac" } as SecretStorageKeyDescriptionAesV1;
-            async function mockGetAccountData<T extends Record<string, any>>(eventType: string): Promise<T | null> {
+            async function mockGetAccountData<K extends keyof AccountDataEvents>(
+                eventType: string,
+            ): Promise<AccountDataEvents[K] | null> {
                 if (eventType === "m.secret_storage.default_key") {
-                    return { key: "default_key_id" } as unknown as T;
+                    return { key: "default_key_id" } as any;
                 } else if (eventType === "m.secret_storage.key.default_key_id") {
-                    return storedKey as unknown as T;
+                    return storedKey as any;
                 } else {
                     throw new Error(`unexpected eventType ${eventType}`);
                 }
@@ -236,9 +248,11 @@ describe("ServerSideSecretStorageImpl", function () {
 
             // stub out getAccountData to return a key with an unknown algorithm
             const storedKey = { algorithm: "badalg" } as SecretStorageKeyDescriptionCommon;
-            async function mockGetAccountData<T extends Record<string, any>>(eventType: string): Promise<T | null> {
+            async function mockGetAccountData<K extends keyof AccountDataEvents>(
+                eventType: string,
+            ): Promise<AccountDataEvents[K] | null> {
                 if (eventType === "m.secret_storage.key.keyid") {
-                    return storedKey as unknown as T;
+                    return storedKey as any;
                 } else {
                     throw new Error(`unexpected eventType ${eventType}`);
                 }

src/@types/event.ts

@@ -35,11 +35,7 @@ import {
     SpaceChildEventContent,
     SpaceParentEventContent,
 } from "./state_events.ts";
-import {
-    ExperimentalGroupCallRoomMemberState,
-    IGroupCallRoomMemberState,
-    IGroupCallRoomState,
-} from "../webrtc/groupCall.ts";
+import { IGroupCallRoomMemberState, IGroupCallRoomState } from "../webrtc/groupCall.ts";
 import { MSC3089EventContent } from "../models/MSC3089Branch.ts";
 import { M_BEACON, M_BEACON_INFO, MBeaconEventContent, MBeaconInfoEventContent } from "./beacon.ts";
 import { XOR } from "./common.ts";
@@ -58,6 +54,10 @@ import {
 import { EncryptionKeysEventContent, ICallNotifyContent } from "../matrixrtc/types.ts";
 import { M_POLL_END, M_POLL_START, PollEndEventContent, PollStartEventContent } from "./polls.ts";
 import { SessionMembershipData } from "../matrixrtc/CallMembership.ts";
+import { LocalNotificationSettings } from "./local_notifications.ts";
+import { IPushRules } from "./PushRules.ts";
+import { SecretInfo, SecretStorageKeyDescription } from "../secret-storage.ts";
+import { POLICIES_ACCOUNT_EVENT_TYPE } from "../models/invites-ignorer-types.ts";
 
 export enum EventType {
     // Room state events
@@ -357,10 +357,7 @@ export interface StateEvents {
 
     // MSC3401
     [EventType.GroupCallPrefix]: IGroupCallRoomState;
-    [EventType.GroupCallMemberPrefix]: XOR<
-        XOR<IGroupCallRoomMemberState, ExperimentalGroupCallRoomMemberState>,
-        XOR<SessionMembershipData, {}>
-    >;
+    [EventType.GroupCallMemberPrefix]: XOR<IGroupCallRoomMemberState, XOR<SessionMembershipData, {}>>;
 
     // MSC3089
     [UNSTABLE_MSC3089_BRANCH.name]: MSC3089EventContent;
@@ -368,3 +365,33 @@ export interface StateEvents {
     // MSC3672
     [M_BEACON_INFO.name]: MBeaconInfoEventContent;
 }
+
+/**
+ * Mapped type from event type to content type for all specified global account_data events.
+ */
+export interface AccountDataEvents extends SecretStorageAccountDataEvents {
+    [EventType.PushRules]: IPushRules;
+    [EventType.Direct]: { [userId: string]: string[] };
+    [EventType.IgnoredUserList]: { [userId: string]: {} };
+    "m.secret_storage.default_key": { key: string };
+    "m.identity_server": { base_url: string | null };
+    [key: `${typeof LOCAL_NOTIFICATION_SETTINGS_PREFIX.name}.${string}`]: LocalNotificationSettings;
+    [key: `m.secret_storage.key.${string}`]: SecretStorageKeyDescription;
+
+    // Invites-ignorer events
+    [POLICIES_ACCOUNT_EVENT_TYPE.name]: { [key: string]: any };
+    [POLICIES_ACCOUNT_EVENT_TYPE.altName]: { [key: string]: any };
+}
+
+/**
+ * Mapped type from event type to content type for all specified global events encrypted by secret storage.
+ *
+ * See https://spec.matrix.org/v1.13/client-server-api/#msecret_storagev1aes-hmac-sha2-1
+ */
+export interface SecretStorageAccountDataEvents {
+    "m.megolm_backup.v1": SecretInfo;
+    "m.cross_signing.master": SecretInfo;
+    "m.cross_signing.self_signing": SecretInfo;
+    "m.cross_signing.user_signing": SecretInfo;
+    "org.matrix.msc3814": SecretInfo;
+}

src/client.ts

@@ -136,6 +136,7 @@ import {
     UpdateDelayedEventAction,
 } from "./@types/requests.ts";
 import {
+    AccountDataEvents,
     EventType,
     LOCAL_NOTIFICATION_SETTINGS_PREFIX,
     MSC3912_RELATION_BASED_REDACTIONS_PROP,
@@ -232,6 +233,7 @@ import {
 import { DeviceInfoMap } from "./crypto/DeviceList.ts";
 import {
     AddSecretStorageKeyOpts,
+    SecretStorageKey,
     SecretStorageKeyDescription,
     ServerSideSecretStorage,
     ServerSideSecretStorageImpl,
@@ -3070,7 +3072,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      *
      * @deprecated Use {@link MatrixClient#secretStorage} and {@link SecretStorage.ServerSideSecretStorage#isStored}.
      */
-    public isSecretStored(name: string): Promise<Record<string, SecretStorageKeyDescription> | null> {
+    public isSecretStored(name: SecretStorageKey): Promise<Record<string, SecretStorageKeyDescription> | null> {
         return this.secretStorage.isStored(name);
     }
 
@@ -4236,7 +4238,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns Promise which resolves: an empty object
      * @returns Rejects: with an error response.
      */
-    public setAccountData(eventType: EventType | string, content: IContent): Promise<{}> {
+    public setAccountData<K extends keyof AccountDataEvents>(
+        eventType: K,
+        content: AccountDataEvents[K] | Record<string, never>,
+    ): Promise<{}> {
         const path = utils.encodeUri("/user/$userId/account_data/$type", {
             $userId: this.credentials.userId!,
             $type: eventType,
@@ -4251,7 +4256,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @param eventType - The event type
      * @returns The contents of the given account data event
      */
-    public getAccountData(eventType: string): MatrixEvent | undefined {
+    public getAccountData<K extends keyof AccountDataEvents>(eventType: K): MatrixEvent | undefined {
         return this.store.getAccountData(eventType);
     }
 
@@ -4263,7 +4268,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns Promise which resolves: The contents of the given account data event.
      * @returns Rejects: with an error response.
      */
-    public async getAccountDataFromServer<T extends { [k: string]: any }>(eventType: string): Promise<T | null> {
+    public async getAccountDataFromServer<K extends keyof AccountDataEvents>(
+        eventType: K,
+    ): Promise<AccountDataEvents[K] | null> {
         if (this.isInitialSyncComplete()) {
             const event = this.store.getAccountData(eventType);
             if (!event) {
@@ -4271,7 +4278,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             }
             // The network version below returns just the content, so this branch
             // does the same to match.
-            return event.getContent<T>();
+            return event.getContent<AccountDataEvents[K]>();
         }
         const path = utils.encodeUri("/user/$userId/account_data/$type", {
             $userId: this.credentials.userId!,
@@ -4287,7 +4294,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         }
     }
 
-    public async deleteAccountData(eventType: string): Promise<void> {
+    public async deleteAccountData(eventType: keyof AccountDataEvents): Promise<void> {
         const msc3391DeleteAccountDataServerSupport = this.canSupport.get(Feature.AccountDataDeletion);
         // if deletion is not supported overwrite with empty content
         if (msc3391DeleteAccountDataServerSupport === ServerSupport.Unsupported) {
@@ -4310,7 +4317,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns The array of users that are ignored (empty if none)
      */
     public getIgnoredUsers(): string[] {
-        const event = this.getAccountData("m.ignored_user_list");
+        const event = this.getAccountData(EventType.IgnoredUserList);
         if (!event?.getContent()["ignored_users"]) return [];
         return Object.keys(event.getContent()["ignored_users"]);
     }
@@ -4326,7 +4333,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         userIds.forEach((u) => {
             content.ignored_users[u] = {};
         });
-        return this.setAccountData("m.ignored_user_list", content);
+        return this.setAccountData(EventType.IgnoredUserList, content);
     }
 
     /**
@@ -5065,7 +5072,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             if (this.canSupport.get(Feature.RelationBasedRedactions) === ServerSupport.Unsupported) {
                 throw new Error(
                     "Server does not support relation based redactions " +
-                        `roomId ${roomId} eventId ${eventId} txnId: ${txnId} threadId ${threadId}`,
+                        `roomId ${roomId} eventId ${eventId} txnId: ${txnId as string} threadId ${threadId}`,
                 );
             }
 
@@ -9264,7 +9271,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         deviceId: string,
         notificationSettings: LocalNotificationSettings,
     ): Promise<{}> {
-        const key = `${LOCAL_NOTIFICATION_SETTINGS_PREFIX.name}.${deviceId}`;
+        const key = `${LOCAL_NOTIFICATION_SETTINGS_PREFIX.name}.${deviceId}` as const;
         return this.setAccountData(key, notificationSettings);
     }
 

src/crypto-api/index.ts

@@ -20,7 +20,7 @@ import type { ToDeviceBatch, ToDevicePayload } from "../models/ToDeviceMessage.t
 import { Room } from "../models/room.ts";
 import { DeviceMap } from "../models/device.ts";
 import { UIAuthCallback } from "../interactive-auth.ts";
-import { PassphraseInfo, SecretStorageCallbacks, SecretStorageKeyDescription } from "../secret-storage.ts";
+import { PassphraseInfo, SecretStorageKeyDescription } from "../secret-storage.ts";
 import { VerificationRequest } from "./verification.ts";
 import {
     BackupTrustInfo,
@@ -268,9 +268,9 @@ export interface CryptoApi {
      * - is enabled on this account and trusted by this device
      * - has private keys either cached locally or stored in secret storage
      *
-     * If this function returns false, bootstrapCrossSigning() can be used
+     * If this function returns false, {@link bootstrapCrossSigning()} can be used
      * to fix things such that it returns true. That is to say, after
-     * bootstrapCrossSigning() completes successfully, this function should
+     * `bootstrapCrossSigning()` completes successfully, this function should
      * return true.
      *
      * @returns True if cross-signing is ready to be used on this device
@@ -317,9 +317,9 @@ export interface CryptoApi {
      * - is storing cross-signing private keys
      * - is storing session backup key (if enabled)
      *
-     * If this function returns false, bootstrapSecretStorage() can be used
+     * If this function returns false, {@link bootstrapSecretStorage()} can be used
      * to fix things such that it returns true. That is to say, after
-     * bootstrapSecretStorage() completes successfully, this function should
+     * `bootstrapSecretStorage()` completes successfully, this function should
      * return true.
      *
      * @returns True if secret storage is ready to be used on this device
@@ -327,17 +327,20 @@ export interface CryptoApi {
     isSecretStorageReady(): Promise<boolean>;
 
     /**
-     * Bootstrap the secret storage by creating a new secret storage key, add it in the secret storage and
-     * store the cross signing keys in the secret storage.
+     * Bootstrap [secret storage](https://spec.matrix.org/v1.12/client-server-api/#storage).
      *
-     * - Generate a new key {@link GeneratedSecretStorageKey} with `createSecretStorageKey`.
-     *   Only if `setupNewSecretStorage` is set or if there is no AES key in the secret storage
-     * - Store this key in the secret storage and set it as the default key.
-     * - Call `cryptoCallbacks.cacheSecretStorageKey` if provided.
-     * - Store the cross signing keys in the secret storage if
-     *      - the cross signing is ready
-     *      - a new key was created during the previous step
-     *      - or the secret storage already contains the cross signing keys
+     * - If secret storage is not already set up, or {@link CreateSecretStorageOpts.setupNewSecretStorage} is set:
+     *   * Calls {@link CreateSecretStorageOpts.createSecretStorageKey} to generate a new key.
+     *   * Stores the metadata of the new key in account data and sets it as the default secret storage key.
+     *   * Calls {@link CryptoCallbacks.cacheSecretStorageKey} if provided.
+     * - Stores the private cross signing keys in the secret storage if they are known, and they are not
+     *   already stored in secret storage.
+     * - If {@link CreateSecretStorageOpts.setupNewKeyBackup} is set, calls {@link CryptoApi.resetKeyBackup}; otherwise,
+     *   stores the key backup decryption key in secret storage if it is known, and it is not
+     *   already stored in secret storage.
+     *
+     * Note that there may be multiple accesses to secret storage during the course of this call, each of which will
+     * result in a call to {@link CryptoCallbacks.getSecretStorageKey}.
      *
      * @param opts - Options object.
      */
@@ -562,9 +565,10 @@ export interface CryptoApi {
      *
      * If there are existing backups they will be replaced.
      *
-     * The decryption key will be saved in Secret Storage (the {@link matrix.SecretStorage.SecretStorageCallbacks.getSecretStorageKey} Crypto
-     * callback will be called)
-     * and the backup engine will be started.
+     * If secret storage is set up, the new decryption key will be saved (the {@link CryptoCallbacks.getSecretStorageKey}
+     * callback will be called to obtain the secret storage key).
+     *
+     * The backup engine will be started using the new backup version (i.e., {@link checkKeyBackupAndEnable} is called).
      */
     resetKeyBackup(): Promise<void>;
 
@@ -995,15 +999,77 @@ export interface CrossSigningStatus {
 /**
  * Crypto callbacks provided by the application
  */
-export interface CryptoCallbacks extends SecretStorageCallbacks {
+export interface CryptoCallbacks {
+    /**
+     * Called to retrieve a secret storage encryption key.
+     *
+     * [Server-side secret storage](https://spec.matrix.org/v1.12/client-server-api/#key-storage)
+     * is, as the name implies, a mechanism for storing secrets which should be shared between
+     * clients on the server. For example, it is typically used for storing the
+     * [key backup decryption key](https://spec.matrix.org/v1.12/client-server-api/#decryption-key)
+     * and the private [cross-signing keys](https://spec.matrix.org/v1.12/client-server-api/#cross-signing).
+     *
+     * The secret storage mechanism encrypts the secrets before uploading them to the server using a
+     * secret storage key. The schema supports multiple keys, but in practice only one tends to be used
+     * at once; this is the "default secret storage key" and may be known as the "recovery key" (or, sometimes,
+     * the "security key").
+     *
+     * Secret storage can be set up by calling {@link CryptoApi.bootstrapSecretStorage}. Having done so, when
+     * the crypto stack needs to access secret storage (for example, when setting up a new device, or to
+     * store newly-generated secrets), it will use this callback (`getSecretStorageKey`).
+     *
+     * Note that the secret storage key may be needed several times in quick succession: it is recommended
+     * that applications use a temporary cache to avoid prompting the user multiple times for the key. See
+     * also {@link cacheSecretStorageKey} which is called when a new key is created.
+     *
+     * The helper method {@link deriveRecoveryKeyFromPassphrase} may be useful if the secret storage key
+     * was derived from a passphrase.
+     *
+     * @param opts - An options object.
+     *
+     * @param name - the name of the *secret* (NB: not the encryption key) being stored or retrieved.
+     *    When the item is stored in account data, it will have this `type`.
+     *
+     * @returns a pair [`keyId`, `privateKey`], where `keyId` is one of the keys from the `keys` parameter,
+     *    and `privateKey` is the raw private encryption key, as appropriate for the encryption algorithm.
+     *    (For `m.secret_storage.v1.aes-hmac-sha2`, it is the input to an HKDF as defined in the
+     *    [specification](https://spec.matrix.org/v1.6/client-server-api/#msecret_storagev1aes-hmac-sha2).)
+     *
+     *    Alternatively, if none of the keys are known, may return `null` — in which case the original
+     *     operation that requires access to a secret in secret storage may fail with an exception.
+     */
+    getSecretStorageKey?: (
+        opts: {
+            /**
+             * Details of the secret storage keys required: a map from the key ID
+             * (excluding the `m.secret_storage.key.` prefix) to details of the key.
+             *
+             * When storing a secret, `keys` will contain exactly one entry.
+             *
+             * For secret retrieval, `keys` may contain several entries, and the application can return
+             * any one of the requested keys. Unless your application specifically wants to offer the
+             * user the ability to have more than one secret storage key active at a time, it is recommended
+             * to call {@link matrix.SecretStorage.ServerSideSecretStorage.getDefaultKeyId | ServerSideSecretStorage.getDefaultKeyId}
+             * to figure out which is the current default key, and to return `null` if the default key is not listed in `keys`.
+             */
+            keys: Record<string, SecretStorageKeyDescription>;
+        },
+        name: string,
+    ) => Promise<[string, Uint8Array] | null>;
+
     /** @deprecated: unused with the Rust crypto stack. */
     getCrossSigningKey?: (keyType: string, pubKey: string) => Promise<Uint8Array | null>;
     /** @deprecated: unused with the Rust crypto stack. */
     saveCrossSigningKeys?: (keys: Record<string, Uint8Array>) => void;
     /** @deprecated: unused with the Rust crypto stack. */
     shouldUpgradeDeviceVerifications?: (users: Record<string, any>) => Promise<string[]>;
+
     /**
-     * Called by {@link CryptoApi#bootstrapSecretStorage}
+     * Called by {@link CryptoApi.bootstrapSecretStorage} when a new default secret storage key is created.
+     *
+     * Applications can use this to (temporarily) cache the secret storage key, for later return by
+     * {@link getSecretStorageKey}.
+     *
      * @param keyId - secret storage key id
      * @param keyInfo - secret storage key info
      * @param key - private key to store

src/crypto/CrossSigning.ts

@@ -184,7 +184,7 @@ export class CrossSigningInfo {
                 }
             }
         }
-        for (const type of ["self_signing", "user_signing"]) {
+        for (const type of ["self_signing", "user_signing"] as const) {
             intersect((await secretStorage.isStored(`m.cross_signing.${type}`)) || {});
         }
         return Object.keys(stored).length ? stored : null;

src/crypto/EncryptionSetup.ts

@@ -25,6 +25,7 @@ import { IKeyBackupInfo } from "./keybackup.ts";
 import { TypedEventEmitter } from "../models/typed-event-emitter.ts";
 import { AccountDataClient, SecretStorageKeyDescription } from "../secret-storage.ts";
 import { BootstrapCrossSigningOpts, CrossSigningKeyInfo } from "../crypto-api/index.ts";
+import { AccountDataEvents } from "../@types/event.ts";
 
 interface ICrossSigningKeys {
     authUpload: BootstrapCrossSigningOpts["authUploadDeviceSigningKeys"];
@@ -111,7 +112,10 @@ export class EncryptionSetupBuilder {
         userSignatures[deviceId] = signature;
     }
 
-    public async setAccountData(type: string, content: object): Promise<void> {
+    public async setAccountData<K extends keyof AccountDataEvents>(
+        type: K,
+        content: AccountDataEvents[K],
+    ): Promise<void> {
         await this.accountDataClientAdapter.setAccountData(type, content);
     }
 
@@ -160,7 +164,7 @@ export class EncryptionSetupOperation {
     /**
      */
     public constructor(
-        private readonly accountData: Map<string, object>,
+        private readonly accountData: Map<keyof AccountDataEvents, MatrixEvent>,
         private readonly crossSigningKeys?: ICrossSigningKeys,
         private readonly keyBackupInfo?: IKeyBackupInfo,
         private readonly keySignatures?: KeySignatures,
@@ -190,7 +194,7 @@ export class EncryptionSetupOperation {
         // set account data
         if (this.accountData) {
             for (const [type, content] of this.accountData) {
-                await baseApis.setAccountData(type, content);
+                await baseApis.setAccountData(type, content.getContent());
             }
         }
         // upload first cross-signing signatures with the new key
@@ -236,7 +240,7 @@ class AccountDataClientAdapter
     implements AccountDataClient
 {
     //
-    public readonly values = new Map<string, MatrixEvent>();
+    public readonly values = new Map<keyof AccountDataEvents, MatrixEvent>();
 
     /**
      * @param existingValues - existing account data
@@ -248,33 +252,26 @@ class AccountDataClientAdapter
     /**
      * @returns the content of the account data
      */
-    public getAccountDataFromServer<T extends { [k: string]: any }>(type: string): Promise<T | null> {
+    public getAccountDataFromServer<K extends keyof AccountDataEvents>(type: K): Promise<AccountDataEvents[K] | null> {
         return Promise.resolve(this.getAccountData(type));
     }
 
     /**
      * @returns the content of the account data
      */
-    public getAccountData<T extends { [k: string]: any }>(type: string): T | null {
-        const modifiedValue = this.values.get(type);
-        if (modifiedValue) {
-            return modifiedValue as unknown as T;
-        }
-        const existingValue = this.existingValues.get(type);
-        if (existingValue) {
-            return existingValue.getContent<T>();
-        }
-        return null;
+    public getAccountData<K extends keyof AccountDataEvents>(type: K): AccountDataEvents[K] | null {
+        const event = this.values.get(type) ?? this.existingValues.get(type);
+        return event?.getContent<AccountDataEvents[K]>() ?? null;
     }
 
-    public setAccountData(type: string, content: any): Promise<{}> {
+    public setAccountData<K extends keyof AccountDataEvents>(type: K, content: AccountDataEvents[K]): Promise<{}> {
+        const event = new MatrixEvent({ type, content });
         const lastEvent = this.values.get(type);
-        this.values.set(type, content);
+        this.values.set(type, event);
         // ensure accountData is emitted on the next tick,
         // as SecretStorage listens for it while calling this method
         // and it seems to rely on this.
         return Promise.resolve().then(() => {
-            const event = new MatrixEvent({ type, content });
             this.emit(ClientEvent.AccountData, event, lastEvent);
             return {};
         });

src/crypto/SecretStorage.ts

@@ -25,12 +25,12 @@ import {
     AccountDataClient,
     ServerSideSecretStorage,
     ServerSideSecretStorageImpl,
+    SecretStorageKey,
 } from "../secret-storage.ts";
 import { ISecretRequest, SecretSharing } from "./SecretSharing.ts";
 
 /* re-exports for backwards compatibility */
 export type {
-    AccountDataClient as IAccountDataClient,
     SecretStorageKeyTuple,
     SecretStorageKeyObject,
     SECRET_STORAGE_ALGORITHM_V1_AES,
@@ -101,21 +101,21 @@ export class SecretStorage<B extends MatrixClient | undefined = MatrixClient> im
     /**
      * Store an encrypted secret on the server
      */
-    public store(name: string, secret: string, keys?: string[] | null): Promise<void> {
+    public store(name: SecretStorageKey, secret: string, keys?: string[] | null): Promise<void> {
         return this.storageImpl.store(name, secret, keys);
     }
 
     /**
      * Get a secret from storage.
      */
-    public get(name: string): Promise<string | undefined> {
+    public get(name: SecretStorageKey): Promise<string | undefined> {
         return this.storageImpl.get(name);
     }
 
     /**
      * Check if a secret is stored on the server.
      */
-    public async isStored(name: string): Promise<Record<string, SecretStorageKeyDescription> | null> {
+    public async isStored(name: SecretStorageKey): Promise<Record<string, SecretStorageKeyDescription> | null> {
         return this.storageImpl.isStored(name);
     }
 

src/crypto/index.ts

@@ -77,6 +77,7 @@ import {
     AddSecretStorageKeyOpts,
     calculateKeyCheck,
     SECRET_STORAGE_ALGORITHM_V1_AES,
+    SecretStorageKey,
     SecretStorageKeyDescription,
     SecretStorageKeyObject,
     SecretStorageKeyTuple,
@@ -1194,21 +1195,21 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     /**
      * @deprecated Use {@link MatrixClient#secretStorage} and {@link SecretStorage.ServerSideSecretStorage#store}.
      */
-    public storeSecret(name: string, secret: string, keys?: string[]): Promise<void> {
+    public storeSecret(name: SecretStorageKey, secret: string, keys?: string[]): Promise<void> {
         return this.secretStorage.store(name, secret, keys);
     }
 
     /**
      * @deprecated Use {@link MatrixClient#secretStorage} and {@link SecretStorage.ServerSideSecretStorage#get}.
      */
-    public getSecret(name: string): Promise<string | undefined> {
+    public getSecret(name: SecretStorageKey): Promise<string | undefined> {
         return this.secretStorage.get(name);
     }
 
     /**
      * @deprecated Use {@link MatrixClient#secretStorage} and {@link SecretStorage.ServerSideSecretStorage#isStored}.
      */
-    public isSecretStored(name: string): Promise<Record<string, SecretStorageKeyDescription> | null> {
+    public isSecretStored(name: SecretStorageKey): Promise<Record<string, SecretStorageKeyDescription> | null> {
         return this.secretStorage.isStored(name);
     }
 

src/crypto/store/indexeddb-crypto-store-backend.ts

@@ -776,7 +776,7 @@ export class Backend implements CryptoStore {
                 ev.preventDefault();
                 logger.log("Ignoring duplicate inbound group session: " + senderCurve25519Key + " / " + sessionId);
             } else {
-                abortWithException(txn, new Error("Failed to add inbound group session: " + addReq.error));
+                abortWithException(txn, new Error("Failed to add inbound group session: " + addReq.error?.name));
             }
         };
     }

src/http-api/utils.ts

@@ -180,8 +180,8 @@ export function calculateRetryBackoff(err: any, attempts: number, retryConnectio
         return -1;
     }
 
-    if (err.httpStatus && (err.httpStatus === 400 || err.httpStatus === 403 || err.httpStatus === 401)) {
-        // client error; no amount of retrying will save you now.
+    if (err.httpStatus && Math.floor(err.httpStatus / 100) === 4 && err.httpStatus !== 429) {
+        // client error; no amount of retrying will save you now (except for rate limiting which is handled below)
         return -1;
     }
 

src/matrixrtc/CallMembership.ts

@@ -14,35 +14,78 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { EitherAnd } from "matrix-events-sdk/lib/types";
-
 import { MatrixEvent } from "../matrix.ts";
 import { deepCompare } from "../utils.ts";
 import { Focus } from "./focus.ts";
 import { isLivekitFocusActive } from "./LivekitFocus.ts";
 
+/**
+ * The default duration in milliseconds that a membership is considered valid for.
+ * Ordinarily the client responsible for the session will update the membership before it expires.
+ * We use this duration as the fallback case where stale sessions are present for some reason.
+ */
+export const DEFAULT_EXPIRE_DURATION = 1000 * 60 * 60 * 4;
+
 type CallScope = "m.room" | "m.user";
-// Represents an entry in the memberships section of an m.call.member event as it is on the wire
-
-// There are two different data interfaces. One for the Legacy types and one compliant with MSC4143
-
-// MSC4143 (MatrixRTC) session membership data
 
+/**
+ * MSC4143 (MatrixRTC) session membership data.
+ * Represents an entry in the memberships section of an m.call.member event as it is on the wire.
+ **/
 export type SessionMembershipData = {
+    /**
+     * The RTC application defines the type of the RTC session.
+     */
     application: string;
+
+    /**
+     * The id of this session.
+     * A session can never span over multiple rooms so this id is to distinguish between
+     * multiple session in one room. A room wide session that is not associated with a user,
+     * and therefore immune to creation race conflicts, uses the `call_id: ""`.
+     */
     call_id: string;
+
+    /**
+     * The Matrix device ID of this session. A single user can have multiple sessions on different devices.
+     */
     device_id: string;
 
+    /**
+     * The focus selection system this user/membership is using.
+     */
     focus_active: Focus;
+
+    /**
+     * A list of possible foci this uses knows about. One of them might be used based on the focus_active
+     * selection system.
+     */
     foci_preferred: Focus[];
+
+    /**
+     * Optional field that contains the creation of the session. If it is undefined the creation
+     * is the `origin_server_ts` of the event itself. For updates to the event this property tracks
+     * the `origin_server_ts` of the initial join event.
+     *  - If it is undefined it can be interpreted as a "Join".
+     *  - If it is defined it can be interpreted as an "Update"
+     */
     created_ts?: number;
 
     // Application specific data
-    scope?: CallScope;
-};
 
-export const isSessionMembershipData = (data: CallMembershipData): data is SessionMembershipData =>
-    "focus_active" in data;
+    /**
+     * If the `application` = `"m.call"` this defines if it is a room or user owned call.
+     * There can always be one room scroped call but multiple user owned calls (breakout sessions)
+     */
+    scope?: CallScope;
+
+    /**
+     * Optionally we allow to define a delta to the `created_ts` that defines when the event is expired/invalid.
+     * This should be set to multiple hours. The only reason it exist is to deal with failed delayed events.
+     * (for example caused by a homeserver crashes)
+     **/
+    expires?: number;
+};
 
 const checkSessionsMembershipData = (data: any, errors: string[]): data is SessionMembershipData => {
     const prefix = "Malformed session membership event: ";
@@ -59,65 +102,20 @@ const checkSessionsMembershipData = (data: any, errors: string[]): data is Sessi
     return errors.length === 0;
 };
 
-// Legacy session membership data
-
-export type CallMembershipDataLegacy = {
-    application: string;
-    call_id: string;
-    scope: CallScope;
-    device_id: string;
-    membershipID: string;
-    created_ts?: number;
-    foci_active?: Focus[];
-} & EitherAnd<{ expires: number }, { expires_ts: number }>;
-
-export const isLegacyCallMembershipData = (data: CallMembershipData): data is CallMembershipDataLegacy =>
-    "membershipID" in data;
-
-const checkCallMembershipDataLegacy = (data: any, errors: string[]): data is CallMembershipDataLegacy => {
-    const prefix = "Malformed legacy rtc membership event: ";
-    if (!("expires" in data || "expires_ts" in data)) {
-        errors.push(prefix + "expires_ts or expires must be present");
-    }
-    if ("expires" in data) {
-        if (typeof data.expires !== "number") {
-            errors.push(prefix + "expires must be numeric");
-        }
-    }
-    if ("expires_ts" in data) {
-        if (typeof data.expires_ts !== "number") {
-            errors.push(prefix + "expires_ts must be numeric");
-        }
-    }
-
-    if (typeof data.device_id !== "string") errors.push(prefix + "device_id must be string");
-    if (typeof data.call_id !== "string") errors.push(prefix + "call_id must be string");
-    if (typeof data.application !== "string") errors.push(prefix + "application must be a string");
-    if (typeof data.membershipID !== "string") errors.push(prefix + "membershipID must be a string");
-    // optional elements
-    if (data.created_ts && typeof data.created_ts !== "number") errors.push(prefix + "created_ts must be number");
-    // application specific data (we first need to check if they exist)
-    if (data.scope && typeof data.scope !== "string") errors.push(prefix + "scope must be string");
-    return errors.length === 0;
-};
-
-export type CallMembershipData = CallMembershipDataLegacy | SessionMembershipData;
-
 export class CallMembership {
     public static equal(a: CallMembership, b: CallMembership): boolean {
         return deepCompare(a.membershipData, b.membershipData);
     }
-    private membershipData: CallMembershipData;
+    private membershipData: SessionMembershipData;
 
     public constructor(
         private parentEvent: MatrixEvent,
         data: any,
     ) {
         const sessionErrors: string[] = [];
-        const legacyErrors: string[] = [];
-        if (!checkSessionsMembershipData(data, sessionErrors) && !checkCallMembershipDataLegacy(data, legacyErrors)) {
+        if (!checkSessionsMembershipData(data, sessionErrors)) {
             throw Error(
-                `unknown CallMembership data. Does not match legacy call.member (${legacyErrors.join(" & ")}) events nor MSC4143 (${sessionErrors.join(" & ")})`,
+                `unknown CallMembership data. Does not match MSC4143 call.member (${sessionErrors.join(" & ")}) events this could be a legacy membership event: (${data})`,
             );
         } else {
             this.membershipData = data;
@@ -149,11 +147,10 @@ export class CallMembership {
     }
 
     public get membershipID(): string {
-        if (isLegacyCallMembershipData(this.membershipData)) return this.membershipData.membershipID;
         // the createdTs behaves equivalent to the membershipID.
         // we only need the field for the legacy member envents where we needed to update them
         // synapse ignores sending state events if they have the same content.
-        else return this.createdTs().toString();
+        return this.createdTs().toString();
     }
 
     public createdTs(): number {
@@ -161,87 +158,39 @@ export class CallMembership {
     }
 
     /**
-     * Gets the absolute expiry time of the membership if applicable to this membership type.
+     * Gets the absolute expiry timestamp of the membership.
      * @returns The absolute expiry time of the membership as a unix timestamp in milliseconds or undefined if not applicable
      */
-    public getAbsoluteExpiry(): number | undefined {
-        // if the membership is not a legacy membership, we assume it is MSC4143
-        if (!isLegacyCallMembershipData(this.membershipData)) return undefined;
-
-        if ("expires" in this.membershipData) {
-            // we know createdTs exists since we already do the isLegacyCallMembershipData check
-            return this.createdTs() + this.membershipData.expires;
-        } else {
-            // We know it exists because we checked for this in the constructor.
-            return this.membershipData.expires_ts;
-        }
-    }
-
-    /**
-     * Gets the expiry time of the event, converted into the device's local time.
-     * @deprecated This function has been observed returning bad data and is no longer used by MatrixRTC.
-     * @returns The local expiry time of the membership as a unix timestamp in milliseconds or undefined if not applicable
-     */
-    public getLocalExpiry(): number | undefined {
-        // if the membership is not a legacy membership, we assume it is MSC4143
-        if (!isLegacyCallMembershipData(this.membershipData)) return undefined;
-
-        if ("expires" in this.membershipData) {
-            // we know createdTs exists since we already do the isLegacyCallMembershipData check
-            const relativeCreationTime = this.parentEvent.getTs() - this.createdTs();
-
-            const localCreationTs = this.parentEvent.localTimestamp - relativeCreationTime;
-
-            return localCreationTs + this.membershipData.expires;
-        } else {
-            // With expires_ts we cannot convert to local time.
-            // TODO: Check the server timestamp and compute a diff to local time.
-            return this.membershipData.expires_ts;
-        }
+    public getAbsoluteExpiry(): number {
+        // TODO: calculate this from the MatrixRTCSession join configuration directly
+        return this.createdTs() + (this.membershipData.expires ?? DEFAULT_EXPIRE_DURATION);
     }
 
     /**
      * @returns The number of milliseconds until the membership expires or undefined if applicable
      */
-    public getMsUntilExpiry(): number | undefined {
-        if (isLegacyCallMembershipData(this.membershipData)) {
-            // Assume that local clock is sufficiently in sync with other clocks in the distributed system.
-            // We used to try and adjust for the local clock being skewed, but there are cases where this is not accurate.
-            // The current implementation allows for the local clock to be -infinity to +MatrixRTCSession.MEMBERSHIP_EXPIRY_TIME/2
-            return this.getAbsoluteExpiry()! - Date.now();
-        }
-
-        // Assumed to be MSC4143
-        return undefined;
+    public getMsUntilExpiry(): number {
+        // Assume that local clock is sufficiently in sync with other clocks in the distributed system.
+        // We used to try and adjust for the local clock being skewed, but there are cases where this is not accurate.
+        // The current implementation allows for the local clock to be -infinity to +MatrixRTCSession.MEMBERSHIP_EXPIRY_TIME/2
+        return this.getAbsoluteExpiry() - Date.now();
     }
 
     /**
      * @returns true if the membership has expired, otherwise false
      */
     public isExpired(): boolean {
-        if (isLegacyCallMembershipData(this.membershipData)) return this.getMsUntilExpiry()! <= 0;
-
-        // MSC4143 events expire by being updated. So if the event exists, its not expired.
-        return false;
+        return this.getMsUntilExpiry() <= 0;
     }
 
     public getPreferredFoci(): Focus[] {
-        // To support both, the new and the old MatrixRTC memberships have two cases based
-        // on the availablitiy of `foci_preferred`
-        if (isLegacyCallMembershipData(this.membershipData)) return this.membershipData.foci_active ?? [];
-
-        // MSC4143 style membership
         return this.membershipData.foci_preferred;
     }
 
     public getFocusSelection(): string | undefined {
-        if (isLegacyCallMembershipData(this.membershipData)) {
-            return "oldest_membership";
-        } else {
-            const focusActive = this.membershipData.focus_active;
-            if (isLivekitFocusActive(focusActive)) {
-                return focusActive.focus_selection;
-            }
+        const focusActive = this.membershipData.focus_active;
+        if (isLivekitFocusActive(focusActive)) {
+            return focusActive.focus_selection;
         }
     }
 }

src/matrixrtc/MatrixRTCSession.ts

@@ -21,23 +21,16 @@ import { Room } from "../models/room.ts";
 import { MatrixClient } from "../client.ts";
 import { EventType } from "../@types/event.ts";
 import { UpdateDelayedEventAction } from "../@types/requests.ts";
-import {
-    CallMembership,
-    CallMembershipData,
-    CallMembershipDataLegacy,
-    SessionMembershipData,
-    isLegacyCallMembershipData,
-} from "./CallMembership.ts";
+import { CallMembership, DEFAULT_EXPIRE_DURATION, SessionMembershipData } from "./CallMembership.ts";
 import { RoomStateEvent } from "../models/room-state.ts";
 import { Focus } from "./focus.ts";
-import { randomString, secureRandomBase64Url } from "../randomstring.ts";
+import { secureRandomBase64Url } from "../randomstring.ts";
 import { EncryptionKeysEventContent } from "./types.ts";
 import { decodeBase64, encodeUnpaddedBase64 } from "../base64.ts";
 import { KnownMembership } from "../@types/membership.ts";
 import { HTTPError, MatrixError, safeGetRetryAfterMs } from "../http-api/errors.ts";
 import { MatrixEvent } from "../models/event.ts";
 import { isLivekitFocusActive } from "./LivekitFocus.ts";
-import { ExperimentalGroupCallRoomMemberState } from "../webrtc/groupCall.ts";
 import { sleep } from "../utils.ts";
 
 const logger = rootLogger.getChild("MatrixRTCSession");
@@ -82,14 +75,6 @@ export interface JoinSessionConfig {
      */
     manageMediaKeys?: boolean;
 
-    /** Lets you configure how the events for the session are formatted.
-     *   - legacy: use one event with a membership array.
-     *   - MSC4143: use one event per membership (with only one membership per event)
-     * More details can be found in MSC4143 and by checking the types:
-     * `CallMembershipDataLegacy` and `SessionMembershipData`
-     */
-    useLegacyMemberEvents?: boolean;
-
     /**
      * The timeout (in milliseconds) after we joined the call, that our membership should expire
      * unless we have explicitly updated it.
@@ -161,11 +146,7 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
     private joinConfig?: JoinSessionConfig;
 
     private get membershipExpiryTimeout(): number {
-        return this.joinConfig?.membershipExpiryTimeout ?? 60 * 60 * 1000;
-    }
-
-    private get memberEventCheckPeriod(): number {
-        return this.joinConfig?.memberEventCheckPeriod ?? 2 * 60 * 1000;
+        return this.joinConfig?.membershipExpiryTimeout ?? DEFAULT_EXPIRE_DURATION;
     }
 
     private get callMemberEventRetryDelayMinimum(): number {
@@ -206,14 +187,6 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
         return this.joinConfig?.callMemberEventRetryJitter ?? 2_000;
     }
 
-    // An identifier for our membership of the call. This will allow us to easily recognise
-    // whether a membership was sent by this session or is stale from some other time.
-    // It also forces our membership events to be unique, because otherwise we could try
-    // to overwrite a membership from a previous session but it would do nothing because the
-    // event content would be identical. We need the origin_server_ts to update though, so
-    // forcing unique content fixes this.
-    private membershipId: string | undefined;
-
     private memberEventTimeout?: ReturnType<typeof setTimeout>;
     private expiryTimeout?: ReturnType<typeof setTimeout>;
     private keysEventUpdateTimeout?: ReturnType<typeof setTimeout>;
@@ -229,7 +202,6 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
     private needCallMembershipUpdate = false;
 
     private manageMediaKeys = false;
-    private useLegacyMemberEvents = true;
     // userId:deviceId => array of (key, timestamp)
     private encryptionKeys = new Map<string, Array<{ key: Uint8Array; timestamp: number }>>();
     private lastEncryptionKeyUpdateRequest?: number;
@@ -292,19 +264,14 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
             // Dont even bother about empty events (saves us from costly type/"key in" checks in bigger rooms)
             if (eventKeysCount === 0) continue;
 
-            let membershipContents: any[] = [];
+            const membershipContents: any[] = [];
 
             // We first decide if its a MSC4143 event (per device state key)
             if (eventKeysCount > 1 && "focus_active" in content) {
                 // We have a MSC4143 event membership event
                 membershipContents.push(content);
             } else if (eventKeysCount === 1 && "memberships" in content) {
-                // we have a legacy (one event for all devices) event
-                if (!Array.isArray(content["memberships"])) {
-                    logger.warn(`Malformed member event from ${memberEvent.getSender()}: memberships is not an array`);
-                    continue;
-                }
-                membershipContents = content["memberships"];
+                logger.warn(`Legacy event found. Those are ignored, they do not contribute to the MatrixRTC session`);
             }
 
             if (membershipContents.length === 0) continue;
@@ -416,8 +383,6 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
         this.joinConfig = joinConfig;
         this.relativeExpiry = this.membershipExpiryTimeout;
         this.manageMediaKeys = joinConfig?.manageMediaKeys ?? this.manageMediaKeys;
-        this.useLegacyMemberEvents = joinConfig?.useLegacyMemberEvents ?? this.useLegacyMemberEvents;
-        this.membershipId = randomString(5);
 
         logger.info(`Joining call session in room ${this.room.roomId} with manageMediaKeys=${this.manageMediaKeys}`);
         if (joinConfig?.manageMediaKeys) {
@@ -471,7 +436,6 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
         this.relativeExpiry = undefined;
         this.ownFocusActive = undefined;
         this.manageMediaKeys = false;
-        this.membershipId = undefined;
         this.emit(MatrixRTCSessionEvent.JoinStateChanged, false);
 
         if (timeout) {
@@ -492,9 +456,9 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
                 const oldestMembership = this.getOldestMembership();
                 return oldestMembership?.getPreferredFoci()[0];
             }
-        }
-        if (!this.ownFocusActive) {
-            // we use the legacy call.member events so default to oldest member
+        } else {
+            // We do not understand the membership format (could be legacy). We default to oldestMembership
+            // Once there are other methods this is a hard error!
             const oldestMembership = this.getOldestMembership();
             return oldestMembership?.getPreferredFoci()[0];
         }
@@ -928,37 +892,10 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
         this.lastMembershipFingerprints = new Set(
             this.memberships
                 .filter((m) => !this.isMyMembership(m))
-                .map((m) => `${getParticipantIdFromMembership(m)}:${m.membershipID}:${m.createdTs()}`),
+                .map((m) => `${getParticipantIdFromMembership(m)}:${m.createdTs()}`),
         );
     }
 
-    /**
-     * Constructs our own membership
-     * @param prevMembership - The previous value of our call membership, if any
-     */
-    private makeMyMembershipLegacy(deviceId: string, prevMembership?: CallMembership): CallMembershipDataLegacy {
-        if (this.relativeExpiry === undefined) {
-            throw new Error("Tried to create our own membership event when we're not joined!");
-        }
-        if (this.membershipId === undefined) {
-            throw new Error("Tried to create our own membership event when we have no membership ID!");
-        }
-        const createdTs = prevMembership?.createdTs();
-        return {
-            call_id: "",
-            scope: "m.room",
-            application: "m.call",
-            device_id: deviceId,
-            expires: this.relativeExpiry,
-            // TODO: Date.now() should be the origin_server_ts (now).
-            expires_ts: this.relativeExpiry + (createdTs ?? Date.now()),
-            // we use the fociPreferred since this is the list of foci.
-            // it is named wrong in the Legacy events.
-            foci_active: this.ownFociPreferred,
-            membershipID: this.membershipId,
-            ...(createdTs ? { created_ts: createdTs } : {}),
-        };
-    }
     /**
      * Constructs our own membership
      */
@@ -968,36 +905,12 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
             scope: "m.room",
             application: "m.call",
             device_id: deviceId,
+            expires: this.relativeExpiry,
             focus_active: { type: "livekit", focus_selection: "oldest_membership" },
             foci_preferred: this.ownFociPreferred ?? [],
         };
     }
 
-    /**
-     * Returns true if our membership event needs to be updated
-     */
-    private membershipEventNeedsUpdate(
-        myPrevMembershipData?: CallMembershipData,
-        myPrevMembership?: CallMembership,
-    ): boolean {
-        if (myPrevMembership && myPrevMembership.getMsUntilExpiry() === undefined) return false;
-
-        // Need to update if there's a membership for us but we're not joined (valid or otherwise)
-        if (!this.isJoined()) return !!myPrevMembershipData;
-
-        // ...or if we are joined, but there's no valid membership event
-        if (!myPrevMembership) return true;
-
-        const expiryTime = myPrevMembership.getMsUntilExpiry();
-        if (expiryTime !== undefined && expiryTime < this.membershipExpiryTimeout / 2) {
-            // ...or if the expiry time needs bumping
-            this.relativeExpiry! += this.membershipExpiryTimeout;
-            return true;
-        }
-
-        return false;
-    }
-
     private makeNewMembership(deviceId: string): SessionMembershipData | {} {
         // If we're joined, add our own
         if (this.isJoined()) {
@@ -1005,49 +918,6 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
         }
         return {};
     }
-    /**
-     * Makes a new membership list given the old list along with this user's previous membership event
-     * (if any) and this device's previous membership (if any)
-     */
-    private makeNewLegacyMemberships(
-        oldMemberships: CallMembershipData[],
-        localDeviceId: string,
-        myCallMemberEvent?: MatrixEvent,
-        myPrevMembership?: CallMembership,
-    ): ExperimentalGroupCallRoomMemberState {
-        const filterExpired = (m: CallMembershipData): boolean => {
-            let membershipObj;
-            try {
-                membershipObj = new CallMembership(myCallMemberEvent!, m);
-            } catch {
-                return false;
-            }
-
-            return !membershipObj.isExpired();
-        };
-
-        const transformMemberships = (m: CallMembershipData): CallMembershipData => {
-            if (m.created_ts === undefined) {
-                // we need to fill this in with the origin_server_ts from its original event
-                m.created_ts = myCallMemberEvent!.getTs();
-            }
-
-            return m;
-        };
-
-        // Filter our any invalid or expired memberships, and also our own - we'll add that back in next
-        let newMemberships = oldMemberships.filter(filterExpired).filter((m) => m.device_id !== localDeviceId);
-
-        // Fix up any memberships that need their created_ts adding
-        newMemberships = newMemberships.map(transformMemberships);
-
-        // If we're joined, add our own
-        if (this.isJoined()) {
-            newMemberships.push(this.makeMyMembershipLegacy(localDeviceId, myPrevMembership));
-        }
-
-        return { memberships: newMemberships };
-    }
 
     private triggerCallMembershipEventUpdate = async (): Promise<void> => {
         // TODO: Should this await on a shared promise?
@@ -1081,64 +951,14 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
         const localDeviceId = this.client.getDeviceId();
         if (!localUserId || !localDeviceId) throw new Error("User ID or device ID was null!");
 
-        const callMemberEvents = roomState.events.get(EventType.GroupCallMemberPrefix);
-        const legacy = this.stateEventsContainOngoingLegacySession(callMemberEvents);
-        let newContent: {} | ExperimentalGroupCallRoomMemberState | SessionMembershipData = {};
-        if (legacy) {
-            const myCallMemberEvent = callMemberEvents?.get(localUserId);
-            const content = myCallMemberEvent?.getContent() ?? {};
-            let myPrevMembership: CallMembership | undefined;
-            // We know its CallMembershipDataLegacy
-            const memberships: CallMembershipDataLegacy[] = Array.isArray(content["memberships"])
-                ? content["memberships"]
-                : [];
-            const myPrevMembershipData = memberships.find((m) => m.device_id === localDeviceId);
-            try {
-                if (
-                    myCallMemberEvent &&
-                    myPrevMembershipData &&
-                    isLegacyCallMembershipData(myPrevMembershipData) &&
-                    myPrevMembershipData.membershipID === this.membershipId
-                ) {
-                    myPrevMembership = new CallMembership(myCallMemberEvent, myPrevMembershipData);
-                }
-            } catch (e) {
-                // This would indicate a bug or something weird if our own call membership
-                // wasn't valid
-                logger.warn("Our previous call membership was invalid - this shouldn't happen.", e);
-            }
-            if (myPrevMembership) {
-                logger.debug(`${myPrevMembership.getMsUntilExpiry()} until our membership expires`);
-            }
-            if (!this.membershipEventNeedsUpdate(myPrevMembershipData, myPrevMembership)) {
-                // nothing to do - reschedule the check again
-                this.memberEventTimeout = setTimeout(
-                    this.triggerCallMembershipEventUpdate,
-                    this.memberEventCheckPeriod,
-                );
-                return;
-            }
-            newContent = this.makeNewLegacyMemberships(memberships, localDeviceId, myCallMemberEvent, myPrevMembership);
-        } else {
-            newContent = this.makeNewMembership(localDeviceId);
-        }
+        let newContent: {} | SessionMembershipData = {};
+        // TODO: implement expiry logic to MSC4143 events
+        // previously we checked here if the event is timed out and scheduled a check if not.
+        // maybe there is a better way.
+        newContent = this.makeNewMembership(localDeviceId);
 
         try {
-            if (legacy) {
-                await this.client.sendStateEvent(
-                    this.room.roomId,
-                    EventType.GroupCallMemberPrefix,
-                    newContent,
-                    localUserId,
-                );
-                if (this.isJoined()) {
-                    // check periodically to see if we need to refresh our member event
-                    this.memberEventTimeout = setTimeout(
-                        this.triggerCallMembershipEventUpdate,
-                        this.memberEventCheckPeriod,
-                    );
-                }
-            } else if (this.isJoined()) {
+            if (this.isJoined()) {
                 const stateKey = this.makeMembershipStateKey(localUserId, localDeviceId);
                 const prepareDelayedDisconnection = async (): Promise<void> => {
                     try {
@@ -1189,15 +1009,21 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
                             ),
                         );
                     } catch (e) {
-                        logger.warn("Failed to update delayed disconnection event, prepare it again:", e);
-                        this.disconnectDelayId = undefined;
-                        await prepareDelayedDisconnection();
+                        if (e instanceof MatrixError && e.errcode === "M_NOT_FOUND") {
+                            // If we get a M_NOT_FOUND we prepare a new delayed event.
+                            // In other error cases we do not want to prepare anything since we do not have the guarantee, that the
+                            // future is not still running.
+                            logger.warn("Failed to update delayed disconnection event, prepare it again:", e);
+                            this.disconnectDelayId = undefined;
+                            await prepareDelayedDisconnection();
+                        }
                     }
                 }
                 if (this.disconnectDelayId !== undefined) {
                     this.scheduleDelayDisconnection();
                 }
             } else {
+                // Not joined
                 let sentDelayedDisconnect = false;
                 if (this.disconnectDelayId !== undefined) {
                     try {
@@ -1250,29 +1076,6 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
         }
     };
 
-    private stateEventsContainOngoingLegacySession(callMemberEvents: Map<string, MatrixEvent> | undefined): boolean {
-        if (!callMemberEvents?.size) {
-            return this.useLegacyMemberEvents;
-        }
-
-        let containsAnyOngoingSession = false;
-        let containsUnknownOngoingSession = false;
-        for (const callMemberEvent of callMemberEvents.values()) {
-            const content = callMemberEvent.getContent();
-            if (Array.isArray(content["memberships"])) {
-                for (const membership of content.memberships) {
-                    if (!new CallMembership(callMemberEvent, membership).isExpired()) {
-                        return true;
-                    }
-                }
-            } else if (Object.keys(content).length > 0) {
-                containsAnyOngoingSession ||= true;
-                containsUnknownOngoingSession ||= !("focus_active" in content);
-            }
-        }
-        return containsAnyOngoingSession && !containsUnknownOngoingSession ? false : this.useLegacyMemberEvents;
-    }
-
     private makeMembershipStateKey(localUserId: string, localDeviceId: string): string {
         const stateKey = `${localUserId}_${localDeviceId}`;
         if (/^org\.matrix\.msc(3757|3779)\b/.exec(this.room.getVersion())) {

src/models/invites-ignorer-types.ts

@@ -0,0 +1,58 @@
+/*
+Copyright 2022 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { UnstableValue } from "matrix-events-sdk";
+
+/// The event type storing the user's individual policies.
+///
+/// Exported for testing purposes.
+export const POLICIES_ACCOUNT_EVENT_TYPE = new UnstableValue("m.policies", "org.matrix.msc3847.policies");
+
+/// The key within the user's individual policies storing the user's ignored invites.
+///
+/// Exported for testing purposes.
+export const IGNORE_INVITES_ACCOUNT_EVENT_KEY = new UnstableValue(
+    "m.ignore.invites",
+    "org.matrix.msc3847.ignore.invites",
+);
+
+/// The types of recommendations understood.
+export enum PolicyRecommendation {
+    Ban = "m.ban",
+}
+
+/**
+ * The various scopes for policies.
+ */
+export enum PolicyScope {
+    /**
+     * The policy deals with an individual user, e.g. reject invites
+     * from this user.
+     */
+    User = "m.policy.user",
+
+    /**
+     * The policy deals with a room, e.g. reject invites towards
+     * a specific room.
+     */
+    Room = "m.policy.room",
+
+    /**
+     * The policy deals with a server, e.g. reject invites from
+     * this server.
+     */
+    Server = "m.policy.server",
+}

src/models/invites-ignorer.ts

@@ -14,8 +14,6 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { UnstableValue } from "matrix-events-sdk";
-
 import { MatrixClient } from "../client.ts";
 import { IContent, MatrixEvent } from "./event.ts";
 import { EventTimeline } from "./event-timeline.ts";
@@ -23,47 +21,14 @@ import { Preset } from "../@types/partials.ts";
 import { globToRegexp } from "../utils.ts";
 import { Room } from "./room.ts";
 import { EventType, StateEvents } from "../@types/event.ts";
+import {
+    IGNORE_INVITES_ACCOUNT_EVENT_KEY,
+    POLICIES_ACCOUNT_EVENT_TYPE,
+    PolicyRecommendation,
+    PolicyScope,
+} from "./invites-ignorer-types.ts";
 
-/// The event type storing the user's individual policies.
-///
-/// Exported for testing purposes.
-export const POLICIES_ACCOUNT_EVENT_TYPE = new UnstableValue("m.policies", "org.matrix.msc3847.policies");
-
-/// The key within the user's individual policies storing the user's ignored invites.
-///
-/// Exported for testing purposes.
-export const IGNORE_INVITES_ACCOUNT_EVENT_KEY = new UnstableValue(
-    "m.ignore.invites",
-    "org.matrix.msc3847.ignore.invites",
-);
-
-/// The types of recommendations understood.
-export enum PolicyRecommendation {
-    Ban = "m.ban",
-}
-
-/**
- * The various scopes for policies.
- */
-export enum PolicyScope {
-    /**
-     * The policy deals with an individual user, e.g. reject invites
-     * from this user.
-     */
-    User = "m.policy.user",
-
-    /**
-     * The policy deals with a room, e.g. reject invites towards
-     * a specific room.
-     */
-    Room = "m.policy.room",
-
-    /**
-     * The policy deals with a server, e.g. reject invites from
-     * this server.
-     */
-    Server = "m.policy.server",
-}
+export { IGNORE_INVITES_ACCOUNT_EVENT_KEY, POLICIES_ACCOUNT_EVENT_TYPE, PolicyRecommendation, PolicyScope };
 
 const scopeToEventTypeMap: Record<PolicyScope, keyof StateEvents> = {
     [PolicyScope.User]: EventType.PolicyRuleUser,

src/oidc/validate.ts

@@ -179,7 +179,8 @@ export const validateIdToken = (
          * The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
          * EW: Don't accept tokens with other untrusted audiences
          * */
-        if (claims.aud !== clientId) {
+        const sanitisedAuds = typeof claims.aud === "string" ? [claims.aud] : claims.aud;
+        if (!sanitisedAuds.includes(clientId)) {
             throw new Error("Invalid audience");
         }
 

src/rust-crypto/rust-crypto.ts

@@ -71,7 +71,7 @@ import {
 import { deviceKeysToDeviceMap, rustDeviceToJsDevice } from "./device-converter.ts";
 import { IDownloadKeyResult, IQueryKeysRequest } from "../client.ts";
 import { Device, DeviceMap } from "../models/device.ts";
-import { SECRET_STORAGE_ALGORITHM_V1_AES, ServerSideSecretStorage } from "../secret-storage.ts";
+import { SECRET_STORAGE_ALGORITHM_V1_AES, SecretStorageKey, ServerSideSecretStorage } from "../secret-storage.ts";
 import { CrossSigningIdentity } from "./CrossSigningIdentity.ts";
 import { secretStorageCanAccessSecrets, secretStorageContainsCrossSigningKeys } from "./secret-storage.ts";
 import { isVerificationEvent, RustVerificationRequest, verificationMethodIdentifierToMethod } from "./verification.ts";
@@ -770,7 +770,7 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, CryptoEventH
      */
     public async isSecretStorageReady(): Promise<boolean> {
         // make sure that the cross-signing keys are stored
-        const secretsToCheck = [
+        const secretsToCheck: SecretStorageKey[] = [
             "m.cross_signing.master",
             "m.cross_signing.user_signing",
             "m.cross_signing.self_signing",
@@ -843,11 +843,42 @@ export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, CryptoEventH
             await this.secretStorage.store("m.cross_signing.self_signing", crossSigningPrivateKeys.self_signing_key);
         }
 
-        if (setupNewKeyBackup) {
+        // likewise with the key backup key: if we have one, store it in secret storage (if it's not already there)
+        // also don't bother storing it if we're about to set up a new backup
+        if (!setupNewKeyBackup) {
+            await this.saveBackupKeyToStorage();
+        } else {
             await this.resetKeyBackup();
         }
     }
 
+    /**
+     * If we have a backup key for the current, trusted backup in cache,
+     * save it to secret storage.
+     */
+    private async saveBackupKeyToStorage(): Promise<void> {
+        const keyBackupInfo = await this.backupManager.getServerBackupInfo();
+        if (!keyBackupInfo || !keyBackupInfo.version) {
+            logger.info("Not saving backup key to secret storage: no backup info");
+            return;
+        }
+
+        const backupKeys: RustSdkCryptoJs.BackupKeys = await this.olmMachine.getBackupKeys();
+        if (!backupKeys.decryptionKey) {
+            logger.info("Not saving backup key to secret storage: no backup key");
+            return;
+        }
+
+        if (!decryptionKeyMatchesKeyBackupInfo(backupKeys.decryptionKey, keyBackupInfo)) {
+            logger.info("Not saving backup key to secret storage: decryption key does not match backup info");
+            return;
+        }
+
+        const backupKeyBase64 = backupKeys.decryptionKey.toBase64();
+
+        await this.secretStorage.store("m.megolm_backup.v1", backupKeyBase64);
+    }
+
     /**
      * Add the secretStorage key to the secret storage
      * - The secret storage key must have the `keyInfo` field filled

src/rust-crypto/secret-storage.ts

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { ServerSideSecretStorage } from "../secret-storage.ts";
+import { SecretStorageKey, ServerSideSecretStorage } from "../secret-storage.ts";
 
 /**
  * Check that the private cross signing keys (master, self signing, user signing) are stored in the secret storage and encrypted with the default secret storage key.
@@ -44,7 +44,7 @@ export async function secretStorageContainsCrossSigningKeys(secretStorage: Serve
  */
 export async function secretStorageCanAccessSecrets(
     secretStorage: ServerSideSecretStorage,
-    secretNames: string[],
+    secretNames: SecretStorageKey[],
 ): Promise<boolean> {
     const defaultKeyId = await secretStorage.getDefaultKeyId();
     if (!defaultKeyId) return false;

src/secret-storage.ts

@@ -28,6 +28,7 @@ import { logger } from "./logger.ts";
 import encryptAESSecretStorageItem from "./utils/encryptAESSecretStorageItem.ts";
 import decryptAESSecretStorageItem from "./utils/decryptAESSecretStorageItem.ts";
 import { AESEncryptedSecretStoragePayload } from "./@types/AESEncryptedSecretStoragePayload.ts";
+import { AccountDataEvents, SecretStorageAccountDataEvents } from "./@types/event.ts";
 
 export const SECRET_STORAGE_ALGORITHM_V1_AES = "m.secret_storage.v1.aes-hmac-sha2";
 
@@ -138,7 +139,7 @@ export interface AccountDataClient extends TypedEventEmitter<ClientEvent.Account
      * @param eventType - The type of account data
      * @returns The contents of the given account data event, or `null` if the event is not found
      */
-    getAccountDataFromServer: <T extends Record<string, any>>(eventType: string) => Promise<T | null>;
+    getAccountDataFromServer: <K extends keyof AccountDataEvents>(eventType: K) => Promise<AccountDataEvents[K] | null>;
 
     /**
      * Set account data event for the current user, with retries
@@ -147,7 +148,7 @@ export interface AccountDataClient extends TypedEventEmitter<ClientEvent.Account
      * @param content - the content object to be set
      * @returns an empty object
      */
-    setAccountData: (eventType: string, content: any) => Promise<{}>;
+    setAccountData: <K extends keyof AccountDataEvents>(eventType: K, content: AccountDataEvents[K]) => Promise<{}>;
 }
 
 /**
@@ -200,7 +201,17 @@ export interface SecretStorageCallbacks {
     ) => Promise<[string, Uint8Array] | null>;
 }
 
-interface SecretInfo {
+/**
+ * Account Data event types which can store secret-storage-encrypted information.
+ */
+export type SecretStorageKey = keyof SecretStorageAccountDataEvents;
+
+/**
+ * Account Data event content type for storing secret-storage-encrypted information.
+ *
+ * See https://spec.matrix.org/v1.13/client-server-api/#msecret_storagev1aes-hmac-sha2-1
+ */
+export interface SecretInfo {
     encrypted: {
         [keyId: string]: AESEncryptedSecretStoragePayload;
     };
@@ -293,7 +304,7 @@ export interface ServerSideSecretStorage {
      *     with, or null if it is not present or not encrypted with a trusted
      *     key
      */
-    isStored(name: string): Promise<Record<string, SecretStorageKeyDescriptionAesV1> | null>;
+    isStored(name: SecretStorageKey): Promise<Record<string, SecretStorageKeyDescriptionAesV1> | null>;
 
     /**
      * Get the current default key ID for encrypting secrets.
@@ -340,11 +351,9 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
      * @returns The default key ID or null if no default key ID is set
      */
     public async getDefaultKeyId(): Promise<string | null> {
-        const defaultKey = await this.accountDataAdapter.getAccountDataFromServer<{ key: string }>(
-            "m.secret_storage.default_key",
-        );
+        const defaultKey = await this.accountDataAdapter.getAccountDataFromServer("m.secret_storage.default_key");
         if (!defaultKey) return null;
-        return defaultKey.key;
+        return defaultKey.key ?? null;
     }
 
     /**
@@ -409,11 +418,7 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
         if (!keyId) {
             do {
                 keyId = randomString(32);
-            } while (
-                await this.accountDataAdapter.getAccountDataFromServer<SecretStorageKeyDescription>(
-                    `m.secret_storage.key.${keyId}`,
-                )
-            );
+            } while (await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`));
         }
 
         await this.accountDataAdapter.setAccountData(`m.secret_storage.key.${keyId}`, keyInfo);
@@ -441,9 +446,7 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
             return null;
         }
 
-        const keyInfo = await this.accountDataAdapter.getAccountDataFromServer<SecretStorageKeyDescriptionAesV1>(
-            "m.secret_storage.key." + keyId,
-        );
+        const keyInfo = await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`);
         return keyInfo ? [keyId, keyInfo] : null;
     }
 
@@ -492,7 +495,7 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
      * @param secret - The secret contents.
      * @param keys - The IDs of the keys to use to encrypt the secret, or null/undefined to use the default key.
      */
-    public async store(name: string, secret: string, keys?: string[] | null): Promise<void> {
+    public async store(name: SecretStorageKey, secret: string, keys?: string[] | null): Promise<void> {
         const encrypted: Record<string, AESEncryptedSecretStoragePayload> = {};
 
         if (!keys) {
@@ -509,9 +512,7 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
 
         for (const keyId of keys) {
             // get key information from key storage
-            const keyInfo = await this.accountDataAdapter.getAccountDataFromServer<SecretStorageKeyDescriptionAesV1>(
-                "m.secret_storage.key." + keyId,
-            );
+            const keyInfo = await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`);
             if (!keyInfo) {
                 throw new Error("Unknown key: " + keyId);
             }
@@ -542,8 +543,8 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
      * @returns the decrypted contents of the secret, or "undefined" if `name` is not found in
      *    the user's account data.
      */
-    public async get(name: string): Promise<string | undefined> {
-        const secretInfo = await this.accountDataAdapter.getAccountDataFromServer<SecretInfo>(name);
+    public async get(name: SecretStorageKey): Promise<string | undefined> {
+        const secretInfo = await this.accountDataAdapter.getAccountDataFromServer(name);
         if (!secretInfo) {
             return;
         }
@@ -555,9 +556,7 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
         const keys: Record<string, SecretStorageKeyDescriptionAesV1> = {};
         for (const keyId of Object.keys(secretInfo.encrypted)) {
             // get key information from key storage
-            const keyInfo = await this.accountDataAdapter.getAccountDataFromServer<SecretStorageKeyDescriptionAesV1>(
-                "m.secret_storage.key." + keyId,
-            );
+            const keyInfo = await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`);
             const encInfo = secretInfo.encrypted[keyId];
             // only use keys we understand the encryption algorithm of
             if (keyInfo?.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES) {
@@ -590,9 +589,9 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
      *     with, or null if it is not present or not encrypted with a trusted
      *     key
      */
-    public async isStored(name: string): Promise<Record<string, SecretStorageKeyDescriptionAesV1> | null> {
+    public async isStored(name: SecretStorageKey): Promise<Record<string, SecretStorageKeyDescriptionAesV1> | null> {
         // check if secret exists
-        const secretInfo = await this.accountDataAdapter.getAccountDataFromServer<SecretInfo>(name);
+        const secretInfo = await this.accountDataAdapter.getAccountDataFromServer(name);
         if (!secretInfo?.encrypted) return null;
 
         const ret: Record<string, SecretStorageKeyDescriptionAesV1> = {};
@@ -600,9 +599,7 @@ export class ServerSideSecretStorageImpl implements ServerSideSecretStorage {
         // filter secret encryption keys with supported algorithm
         for (const keyId of Object.keys(secretInfo.encrypted)) {
             // get key information from key storage
-            const keyInfo = await this.accountDataAdapter.getAccountDataFromServer<SecretStorageKeyDescriptionAesV1>(
-                "m.secret_storage.key." + keyId,
-            );
+            const keyInfo = await this.accountDataAdapter.getAccountDataFromServer(`m.secret_storage.key.${keyId}`);
             if (!keyInfo) continue;
             const encInfo = secretInfo.encrypted[keyId];
 

src/store/indexeddb-local-backend.ts

@@ -71,7 +71,7 @@ function selectQuery<T>(
     return new Promise((resolve, reject) => {
         const results: T[] = [];
         query.onerror = (): void => {
-            reject(new Error("Query failed: " + query.error));
+            reject(new Error("Query failed: " + query.error?.name));
         };
         // collect results
         query.onsuccess = (): void => {
@@ -360,7 +360,7 @@ export class LocalIndexedDBStoreBackend implements IIndexedDBBackend {
                 // in firefox, with indexedDB disabled, this fails with a
                 // DOMError. We treat this as non-fatal, so that we can still
                 // use the app.
-                logger.warn(`unable to delete js-sdk store indexeddb: ${req.error}`);
+                logger.warn(`unable to delete js-sdk store indexeddb: ${req.error?.name}`);
                 resolve();
             };
 

src/webrtc/groupCall.ts

@@ -35,7 +35,6 @@ import {
 import { SummaryStatsReportGatherer } from "./stats/summaryStatsReportGatherer.ts";
 import { CallFeedStatsReporter } from "./stats/callFeedStatsReporter.ts";
 import { KnownMembership } from "../@types/membership.ts";
-import { CallMembershipData } from "../matrixrtc/CallMembership.ts";
 
 export enum GroupCallIntent {
     Ring = "m.ring",
@@ -198,11 +197,6 @@ export interface IGroupCallRoomMemberState {
     "m.calls": IGroupCallRoomMemberCallState[];
 }
 
-// XXX: this hasn't made it into the MSC yet
-export interface ExperimentalGroupCallRoomMemberState {
-    memberships: CallMembershipData[];
-}
-
 export enum GroupCallState {
     LocalCallFeedUninitialized = "local_call_feed_uninitialized",
     InitializingLocalCallFeed = "initializing_local_call_feed",

yarn.lock

@@ -23,9 +23,9 @@
     "@jridgewell/trace-mapping" "^0.3.24"
 
 "@babel/cli@^7.12.10":
-  version "7.25.9"
-  resolved "https://registry.yarnpkg.com/@babel/cli/-/cli-7.25.9.tgz#51036166fd0e9cfb26eee1b9ddc264a0d6d5f843"
-  integrity sha512-I+02IfrTiSanpxJBlZQYb18qCxB6c2Ih371cVpfgIrPQrjAYkf45XxomTJOG8JBWX5GY35/+TmhCMdJ4ZPkL8Q==
+  version "7.26.4"
+  resolved "https://registry.yarnpkg.com/@babel/cli/-/cli-7.26.4.tgz#4101ff8ee5de8447a6c395397a97921056411d20"
+  integrity sha512-+mORf3ezU3p3qr+82WvJSnQNE1GAYeoCfEv4fik6B5/2cvKZ75AX8oawWQdXtM9MmndooQj15Jr9kelRFWsuRw==
   dependencies:
     "@jridgewell/trace-mapping" "^0.3.25"
     commander "^6.2.0"
@@ -1477,10 +1477,10 @@
     "@jridgewell/resolve-uri" "^3.1.0"
     "@jridgewell/sourcemap-codec" "^1.4.14"
 
-"@matrix-org/matrix-sdk-crypto-wasm@^11.0.0":
-  version "11.0.0"
-  resolved "https://registry.yarnpkg.com/@matrix-org/matrix-sdk-crypto-wasm/-/matrix-sdk-crypto-wasm-11.0.0.tgz#c49a1a0d1e367d3c00a2144a4ab23caee0b1eec2"
-  integrity sha512-a7NUH8Kjc8hwzNCPpkOGXoceFqWJiWvA8OskXeDrKyODJuDz4yKrZ/nvgaVRfQe45Ab5UC1ZXYqaME+ChlJuqg==
+"@matrix-org/matrix-sdk-crypto-wasm@^12.1.0":
+  version "12.1.0"
+  resolved "https://registry.yarnpkg.com/@matrix-org/matrix-sdk-crypto-wasm/-/matrix-sdk-crypto-wasm-12.1.0.tgz#2aef64eab2d30c0a1ace9c0fe876f53aa2949f14"
+  integrity sha512-NhJFu/8FOGjnW7mDssRUzaMSwXrYOcCqgAjZyAw9KQ9unNADKEi7KoIKe7GtrG2PWtm36y2bUf+hB8vhSY6Wdw==
 
 "@matrix-org/olm@3.2.15":
   version "3.2.15"
@@ -1803,9 +1803,9 @@
     undici-types "~5.26.4"
 
 "@types/node@18":
-  version "18.19.66"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-18.19.66.tgz#0937a47904ceba5994eedf5cf4b6d503d8d6136c"
-  integrity sha512-14HmtUdGxFUalGRfLLn9Gc1oNWvWh5zNbsyOLo5JV6WARSeN1QcEBKRnZm9QqNfrutgsl/hY4eJW63aZ44aBCg==
+  version "18.19.67"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-18.19.67.tgz#77c4b01641a1e3e1509aff7e10d39e4afd5ae06d"
+  integrity sha512-wI8uHusga+0ZugNp0Ol/3BqQfEcCCNfojtO6Oou9iVNGPTL6QNSdnUdqq85fRgIorLhLMuPIKpsN98QE9Nh+KQ==
   dependencies:
     undici-types "~5.26.4"
 
@@ -1857,29 +1857,29 @@
     "@types/yargs-parser" "*"
 
 "@typescript-eslint/eslint-plugin@^8.0.0":
-  version "8.16.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.16.0.tgz#ac56825bcdf3b392fc76a94b1315d4a162f201a6"
-  integrity sha512-5YTHKV8MYlyMI6BaEG7crQ9BhSc8RxzshOReKwZwRWN0+XvvTOm+L/UYLCYxFpfwYuAAqhxiq4yae0CMFwbL7Q==
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.18.0.tgz#0901933326aea4443b81df3f740ca7dfc45c7bea"
+  integrity sha512-NR2yS7qUqCL7AIxdJUQf2MKKNDVNaig/dEB0GBLU7D+ZdHgK1NoH/3wsgO3OnPVipn51tG3MAwaODEGil70WEw==
   dependencies:
     "@eslint-community/regexpp" "^4.10.0"
-    "@typescript-eslint/scope-manager" "8.16.0"
-    "@typescript-eslint/type-utils" "8.16.0"
-    "@typescript-eslint/utils" "8.16.0"
-    "@typescript-eslint/visitor-keys" "8.16.0"
+    "@typescript-eslint/scope-manager" "8.18.0"
+    "@typescript-eslint/type-utils" "8.18.0"
+    "@typescript-eslint/utils" "8.18.0"
+    "@typescript-eslint/visitor-keys" "8.18.0"
     graphemer "^1.4.0"
     ignore "^5.3.1"
     natural-compare "^1.4.0"
     ts-api-utils "^1.3.0"
 
 "@typescript-eslint/parser@^8.0.0":
-  version "8.16.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.16.0.tgz#ee5b2d6241c1ab3e2e53f03fd5a32d8e266d8e06"
-  integrity sha512-D7DbgGFtsqIPIFMPJwCad9Gfi/hC0PWErRRHFnaCWoEDYi5tQUDiJCTmGUbBiLzjqAck4KcXt9Ayj0CNlIrF+w==
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/parser/-/parser-8.18.0.tgz#a1c9456cbb6a089730bf1d3fc47946c5fb5fe67b"
+  integrity sha512-hgUZ3kTEpVzKaK3uNibExUYm6SKKOmTU2BOxBSvOYwtJEPdVQ70kZJpPjstlnhCHcuc2WGfSbpKlb/69ttyN5Q==
   dependencies:
-    "@typescript-eslint/scope-manager" "8.16.0"
-    "@typescript-eslint/types" "8.16.0"
-    "@typescript-eslint/typescript-estree" "8.16.0"
-    "@typescript-eslint/visitor-keys" "8.16.0"
+    "@typescript-eslint/scope-manager" "8.18.0"
+    "@typescript-eslint/types" "8.18.0"
+    "@typescript-eslint/typescript-estree" "8.18.0"
+    "@typescript-eslint/visitor-keys" "8.18.0"
     debug "^4.3.4"
 
 "@typescript-eslint/scope-manager@8.14.0":
@@ -1898,13 +1898,21 @@
     "@typescript-eslint/types" "8.16.0"
     "@typescript-eslint/visitor-keys" "8.16.0"
 
-"@typescript-eslint/type-utils@8.16.0":
-  version "8.16.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.16.0.tgz#585388735f7ac390f07c885845c3d185d1b64740"
-  integrity sha512-IqZHGG+g1XCWX9NyqnI/0CX5LL8/18awQqmkZSl2ynn8F76j579dByc0jhfVSnSnhf7zv76mKBQv9HQFKvDCgg==
+"@typescript-eslint/scope-manager@8.18.0":
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/scope-manager/-/scope-manager-8.18.0.tgz#30b040cb4557804a7e2bcc65cf8fdb630c96546f"
+  integrity sha512-PNGcHop0jkK2WVYGotk/hxj+UFLhXtGPiGtiaWgVBVP1jhMoMCHlTyJA+hEj4rszoSdLTK3fN4oOatrL0Cp+Xw==
   dependencies:
-    "@typescript-eslint/typescript-estree" "8.16.0"
-    "@typescript-eslint/utils" "8.16.0"
+    "@typescript-eslint/types" "8.18.0"
+    "@typescript-eslint/visitor-keys" "8.18.0"
+
+"@typescript-eslint/type-utils@8.18.0":
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/type-utils/-/type-utils-8.18.0.tgz#6f0d12cf923b6fd95ae4d877708c0adaad93c471"
+  integrity sha512-er224jRepVAVLnMF2Q7MZJCq5CsdH2oqjP4dT7K6ij09Kyd+R21r7UVJrF0buMVdZS5QRhDzpvzAxHxabQadow==
+  dependencies:
+    "@typescript-eslint/typescript-estree" "8.18.0"
+    "@typescript-eslint/utils" "8.18.0"
     debug "^4.3.4"
     ts-api-utils "^1.3.0"
 
@@ -1918,6 +1926,11 @@
   resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.16.0.tgz#49c92ae1b57942458ab83d9ec7ccab3005e64737"
   integrity sha512-NzrHj6thBAOSE4d9bsuRNMvk+BvaQvmY4dDglgkgGC0EW/tB3Kelnp3tAKH87GEwzoxgeQn9fNGRyFJM/xd+GQ==
 
+"@typescript-eslint/types@8.18.0":
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/types/-/types-8.18.0.tgz#3afcd30def8756bc78541268ea819a043221d5f3"
+  integrity sha512-FNYxgyTCAnFwTrzpBGq+zrnoTO4x0c1CKYY5MuUTzpScqmY5fmsh2o3+57lqdI3NZucBDCzDgdEbIaNfAjAHQA==
+
 "@typescript-eslint/typescript-estree@8.14.0":
   version "8.14.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.14.0.tgz#a7a3a5a53a6c09313e12fb4531d4ff582ee3c312"
@@ -1946,15 +1959,29 @@
     semver "^7.6.0"
     ts-api-utils "^1.3.0"
 
-"@typescript-eslint/utils@8.16.0", "@typescript-eslint/utils@^8.13.0":
-  version "8.16.0"
-  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.16.0.tgz#c71264c437157feaa97842809836254a6fc833c3"
-  integrity sha512-C1zRy/mOL8Pj157GiX4kaw7iyRLKfJXBR3L82hk5kS/GyHcOFmy4YUq/zfZti72I9wnuQtA/+xzft4wCC8PJdA==
+"@typescript-eslint/typescript-estree@8.18.0":
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.18.0.tgz#d8ca785799fbb9c700cdff1a79c046c3e633c7f9"
+  integrity sha512-rqQgFRu6yPkauz+ms3nQpohwejS8bvgbPyIDq13cgEDbkXt4LH4OkDMT0/fN1RUtzG8e8AKJyDBoocuQh8qNeg==
+  dependencies:
+    "@typescript-eslint/types" "8.18.0"
+    "@typescript-eslint/visitor-keys" "8.18.0"
+    debug "^4.3.4"
+    fast-glob "^3.3.2"
+    is-glob "^4.0.3"
+    minimatch "^9.0.4"
+    semver "^7.6.0"
+    ts-api-utils "^1.3.0"
+
+"@typescript-eslint/utils@8.18.0":
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.18.0.tgz#48f67205d42b65d895797bb7349d1be5c39a62f7"
+  integrity sha512-p6GLdY383i7h5b0Qrfbix3Vc3+J2k6QWw6UMUeY5JGfm3C5LbZ4QIZzJNoNOfgyRe0uuYKjvVOsO/jD4SJO+xg==
   dependencies:
     "@eslint-community/eslint-utils" "^4.4.0"
-    "@typescript-eslint/scope-manager" "8.16.0"
-    "@typescript-eslint/types" "8.16.0"
-    "@typescript-eslint/typescript-estree" "8.16.0"
+    "@typescript-eslint/scope-manager" "8.18.0"
+    "@typescript-eslint/types" "8.18.0"
+    "@typescript-eslint/typescript-estree" "8.18.0"
 
 "@typescript-eslint/utils@^6.0.0 || ^7.0.0 || ^8.0.0":
   version "8.14.0"
@@ -1966,6 +1993,16 @@
     "@typescript-eslint/types" "8.14.0"
     "@typescript-eslint/typescript-estree" "8.14.0"
 
+"@typescript-eslint/utils@^8.13.0":
+  version "8.16.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/utils/-/utils-8.16.0.tgz#c71264c437157feaa97842809836254a6fc833c3"
+  integrity sha512-C1zRy/mOL8Pj157GiX4kaw7iyRLKfJXBR3L82hk5kS/GyHcOFmy4YUq/zfZti72I9wnuQtA/+xzft4wCC8PJdA==
+  dependencies:
+    "@eslint-community/eslint-utils" "^4.4.0"
+    "@typescript-eslint/scope-manager" "8.16.0"
+    "@typescript-eslint/types" "8.16.0"
+    "@typescript-eslint/typescript-estree" "8.16.0"
+
 "@typescript-eslint/visitor-keys@8.14.0":
   version "8.14.0"
   resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.14.0.tgz#2418d5a54669af9658986ade4e6cfb7767d815ad"
@@ -1982,6 +2019,14 @@
     "@typescript-eslint/types" "8.16.0"
     eslint-visitor-keys "^4.2.0"
 
+"@typescript-eslint/visitor-keys@8.18.0":
+  version "8.18.0"
+  resolved "https://registry.yarnpkg.com/@typescript-eslint/visitor-keys/-/visitor-keys-8.18.0.tgz#7b6d33534fa808e33a19951907231ad2ea5c36dd"
+  integrity sha512-pCh/qEA8Lb1wVIqNvBke8UaRjJ6wrAWkJO5yyIbs8Yx6TNGYyfNjOo61tLv+WwLvoLPp4BQ8B7AHKijl8NGUfw==
+  dependencies:
+    "@typescript-eslint/types" "8.18.0"
+    eslint-visitor-keys "^4.2.0"
+
 "@ungap/structured-clone@^1.2.0":
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/@ungap/structured-clone/-/structured-clone-1.2.0.tgz#756641adb587851b5ccb3e095daf27ae581c8406"
@@ -2701,7 +2746,7 @@ data-view-byte-offset@^1.0.0:
     es-errors "^1.3.0"
     is-data-view "^1.0.1"
 
-debug@4, debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.2, debug@^4.3.4, debug@^4.3.5, debug@^4.3.6, debug@~4.3.6:
+debug@4, debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.2, debug@^4.3.6, debug@~4.3.6:
   version "4.3.7"
   resolved "https://registry.yarnpkg.com/debug/-/debug-4.3.7.tgz#87945b4151a011d76d95a198d7111c865c360a52"
   integrity sha512-Er2nc/H7RrMXZBFCEim6TCmMk02Z8vLC2Rbi1KEBggpo0fS6l0S1nnapwmIi3yW/+GOJap1Krg4w0Hg80oCqgQ==
@@ -2715,6 +2760,13 @@ debug@^3.2.7:
   dependencies:
     ms "^2.1.1"
 
+debug@^4.3.4, debug@^4.3.7:
+  version "4.4.0"
+  resolved "https://registry.yarnpkg.com/debug/-/debug-4.4.0.tgz#2b3f2aea2ffeb776477460267377dc8710faba8a"
+  integrity sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA==
+  dependencies:
+    ms "^2.1.3"
+
 decimal.js@^10.4.2:
   version "10.4.3"
   resolved "https://registry.yarnpkg.com/decimal.js/-/decimal.js-10.4.3.tgz#1044092884d245d1b7f65725fa4ad4c6f781cc23"
@@ -3032,18 +3084,18 @@ eslint-import-resolver-node@^0.3.9:
     resolve "^1.22.4"
 
 eslint-import-resolver-typescript@^3.5.1:
-  version "3.6.3"
-  resolved "https://registry.yarnpkg.com/eslint-import-resolver-typescript/-/eslint-import-resolver-typescript-3.6.3.tgz#bb8e388f6afc0f940ce5d2c5fd4a3d147f038d9e"
-  integrity sha512-ud9aw4szY9cCT1EWWdGv1L1XR6hh2PaRWif0j2QjQ0pgTY/69iw+W0Z4qZv5wHahOl8isEr+k/JnyAqNQkLkIA==
+  version "3.7.0"
+  resolved "https://registry.yarnpkg.com/eslint-import-resolver-typescript/-/eslint-import-resolver-typescript-3.7.0.tgz#e69925936a771a9cb2de418ccebc4cdf6c0818aa"
+  integrity sha512-Vrwyi8HHxY97K5ebydMtffsWAn1SCR9eol49eCd5fJS4O1WV7PaAjbcjmbfJJSMz/t4Mal212Uz/fQZrOB8mow==
   dependencies:
     "@nolyfill/is-core-module" "1.0.39"
-    debug "^4.3.5"
+    debug "^4.3.7"
     enhanced-resolve "^5.15.0"
-    eslint-module-utils "^2.8.1"
     fast-glob "^3.3.2"
     get-tsconfig "^4.7.5"
     is-bun-module "^1.0.2"
     is-glob "^4.0.3"
+    stable-hash "^0.0.4"
 
 eslint-module-utils@^2.12.0:
   version "2.12.0"
@@ -3052,13 +3104,6 @@ eslint-module-utils@^2.12.0:
   dependencies:
     debug "^3.2.7"
 
-eslint-module-utils@^2.8.1:
-  version "2.9.0"
-  resolved "https://registry.yarnpkg.com/eslint-module-utils/-/eslint-module-utils-2.9.0.tgz#95d4ac038a68cd3f63482659dffe0883900eb342"
-  integrity sha512-McVbYmwA3NEKwRQY5g4aWMdcZE5xZxV8i8l7CqJSrameuGSQJtSWaL/LxTEzSKKaCcOhlpDR8XEfYXWPrdo/ZQ==
-  dependencies:
-    debug "^3.2.7"
-
 eslint-plugin-es@^4.1.0:
   version "4.1.0"
   resolved "https://registry.yarnpkg.com/eslint-plugin-es/-/eslint-plugin-es-4.1.0.tgz#f0822f0c18a535a97c3e714e89f88586a7641ec9"
@@ -3615,9 +3660,9 @@ get-symbol-description@^1.0.2:
     get-intrinsic "^1.2.4"
 
 get-tsconfig@^4.7.5:
-  version "4.8.0"
-  resolved "https://registry.yarnpkg.com/get-tsconfig/-/get-tsconfig-4.8.0.tgz#125dc13a316f61650a12b20c97c11b8fd996fedd"
-  integrity sha512-Pgba6TExTZ0FJAn1qkJAjIeKoDJ3CsI2ChuLohJnZl/tTU8MVrq3b+2t5UOPfRa4RMsorClBjJALkJUMjG1PAw==
+  version "4.8.1"
+  resolved "https://registry.yarnpkg.com/get-tsconfig/-/get-tsconfig-4.8.1.tgz#8995eb391ae6e1638d251118c7b56de7eb425471"
+  integrity sha512-k9PN+cFBmaLWtVz29SkUoqU5O0slLuHJXt/2P+tMVFT+phsSGXGkp9t3rQIqdz0e+06EHNGs3oM6ZX1s2zHxRg==
   dependencies:
     resolve-pkg-maps "^1.0.0"
 
@@ -3904,9 +3949,9 @@ is-builtin-module@^3.2.1:
     builtin-modules "^3.3.0"
 
 is-bun-module@^1.0.2:
-  version "1.1.0"
-  resolved "https://registry.yarnpkg.com/is-bun-module/-/is-bun-module-1.1.0.tgz#a66b9830869437f6cdad440ba49ab6e4dc837269"
-  integrity sha512-4mTAVPlrXpaN3jtF0lsnPCMGnq4+qZjVIKq0HCpfcqf8OC1SM5oATCIAPM5V5FN05qp2NNnFndphmdZS9CV3hA==
+  version "1.3.0"
+  resolved "https://registry.yarnpkg.com/is-bun-module/-/is-bun-module-1.3.0.tgz#ea4d24fdebfcecc98e81bcbcb506827fee288760"
+  integrity sha512-DgXeu5UWI0IsMQundYb5UAOzm6G2eVnarJ0byP6Tm55iZNKceD59LNPA2L4VvsScTtHcw0yEkVwSf7PC+QoLSA==
   dependencies:
     semver "^7.6.3"
 
@@ -4557,9 +4602,9 @@ jest@^29.0.0:
     jest-cli "^29.7.0"
 
 jiti@^2.4.0:
-  version "2.4.0"
-  resolved "https://registry.yarnpkg.com/jiti/-/jiti-2.4.0.tgz#393d595fb6031a11d11171b5e4fc0b989ba3e053"
-  integrity sha512-H5UpaUI+aHOqZXlYOaFP/8AzKsg+guWu+Pr3Y8i7+Y3zr1aXAvCvTAQ1RxSc6oVD8R8c7brgNtTVP91E7upH/g==
+  version "2.4.1"
+  resolved "https://registry.yarnpkg.com/jiti/-/jiti-2.4.1.tgz#4de9766ccbfa941d9b6390d2b159a4b295a52e6b"
+  integrity sha512-yPBThwecp1wS9DmoA4x4KR2h3QoslacnDR8ypuFM962kI4/456Iy1oHx2RAgh4jfZNdn0bctsdadceiBUgpU1g==
 
 jju@~1.4.0:
   version "1.4.0"
@@ -4693,9 +4738,9 @@ kleur@^3.0.3:
   integrity sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==
 
 knip@^5.0.0:
-  version "5.38.1"
-  resolved "https://registry.yarnpkg.com/knip/-/knip-5.38.1.tgz#ff5a510fe43841a21a84748b3ed1d50069b2d814"
-  integrity sha512-qGQpVO9jhHDoJ/4O1paXQ8Y6XyqH3Xm6OTety/z5IouZBEvJuJoWp59iY9E82Dt0pz9BBmKLczliB4sbYMPr2g==
+  version "5.39.2"
+  resolved "https://registry.yarnpkg.com/knip/-/knip-5.39.2.tgz#1faacd8d8ef36b509b2f6e396cce85b645abb04e"
+  integrity sha512-BuvuWRllLWV/r2G4m9ggNH+DZ6gouP/dhtJPXVlMbWNF++w9/EfrF6k2g7YBKCwjzCC+PXmYtpH8S2t8RjnY4Q==
   dependencies:
     "@nodelib/fs.walk" "1.2.8"
     "@snyk/github-codeowners" "1.1.0"
@@ -5325,10 +5370,10 @@ prelude-ls@^1.2.1:
   resolved "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.2.1.tgz#debc6489d7a6e6b0e7611888cec880337d316396"
   integrity sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==
 
-prettier@3.4.1:
-  version "3.4.1"
-  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.4.1.tgz#e211d451d6452db0a291672ca9154bc8c2579f7b"
-  integrity sha512-G+YdqtITVZmOJje6QkXQWzl3fSfMxFwm1tjTyo9exhkmWSqC4Yhd1+lug++IlR2mvRVAxEDDWYkQdeSztajqgg==
+prettier@3.4.2:
+  version "3.4.2"
+  resolved "https://registry.yarnpkg.com/prettier/-/prettier-3.4.2.tgz#a5ce1fb522a588bf2b78ca44c6e6fe5aa5a2b13f"
+  integrity sha512-e9MewbtFo+Fevyuxn/4rrcDAaq0IYxPGLvObpQjiZBMAzB9IGmzlnG9RZy3FFas+eBMu2vA0CszMeduow5dIuQ==
 
 pretty-format@^28.1.3:
   version "28.1.3"
@@ -5826,6 +5871,11 @@ sprintf-js@~1.0.2:
   resolved "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.0.3.tgz#04e6926f662895354f3dd015203633b857297e2c"
   integrity sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==
 
+stable-hash@^0.0.4:
+  version "0.0.4"
+  resolved "https://registry.yarnpkg.com/stable-hash/-/stable-hash-0.0.4.tgz#55ae7dadc13e4b3faed13601587cec41859b42f7"
+  integrity sha512-LjdcbuBeLcdETCrPn9i8AYAZ1eCtu4ECAWtP7UleOiZ9LzVxRzzUZEoZ8zB24nhkQnDWyET0I+3sWokSDS3E7g==
+
 stack-utils@^2.0.3:
   version "2.0.6"
   resolved "https://registry.yarnpkg.com/stack-utils/-/stack-utils-2.0.6.tgz#aaf0748169c02fc33c8232abccf933f54a1cc34f"
@@ -5846,7 +5896,16 @@ string-length@^4.0.1:
     char-regex "^1.0.2"
     strip-ansi "^6.0.0"
 
-"string-width-cjs@npm:string-width@^4.2.0", string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
+"string-width-cjs@npm:string-width@^4.2.0":
+  version "4.2.3"
+  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
+  integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
+  dependencies:
+    emoji-regex "^8.0.0"
+    is-fullwidth-code-point "^3.0.0"
+    strip-ansi "^6.0.1"
+
+string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
   version "4.2.3"
   resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
   integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
@@ -6069,9 +6128,9 @@ tr46@~0.0.3:
   integrity sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==
 
 ts-api-utils@^1.3.0:
-  version "1.4.2"
-  resolved "https://registry.yarnpkg.com/ts-api-utils/-/ts-api-utils-1.4.2.tgz#a6a6dff26117ac7965624fc118525971edc6a82a"
-  integrity sha512-ZF5gQIQa/UmzfvxbHZI3JXN0/Jt+vnAfAviNRAMc491laiK6YCLpCW9ft8oaCRFOTxCZtUTE6XB0ZQAe3olntw==
+  version "1.4.3"
+  resolved "https://registry.yarnpkg.com/ts-api-utils/-/ts-api-utils-1.4.3.tgz#bfc2215fe6528fecab2b0fba570a2e8a4263b064"
+  integrity sha512-i3eMG77UTMD0hZhgRS562pv83RC6ukSAC2GMNWc+9dieh/+jDM5u5YG+NHX6VNDRHQcHwmsTHctP9LhbC3WxVw==
 
 ts-node@^10.9.2:
   version "10.9.2"
@@ -6445,7 +6504,16 @@ word-wrap@^1.2.5:
   resolved "https://registry.yarnpkg.com/word-wrap/-/word-wrap-1.2.5.tgz#d2c45c6dd4fbce621a66f136cbe328afd0410b34"
   integrity sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==
 
-"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0", wrap-ansi@^7.0.0:
+"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
+  integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
+  dependencies:
+    ansi-styles "^4.0.0"
+    string-width "^4.1.0"
+    strip-ansi "^6.0.0"
+
+wrap-ansi@^7.0.0:
   version "7.0.0"
   resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
   integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
@@ -6559,6 +6627,6 @@ zod-validation-error@^3.0.3:
   integrity sha512-ZOPR9SVY6Pb2qqO5XHt+MkkTRxGXb4EVtnjc9JpXUOtUB1T9Ru7mZOT361AN3MsetVe7R0a1KZshJDZdgp9miQ==
 
 zod@^3.22.4:
-  version "3.23.8"
-  resolved "https://registry.yarnpkg.com/zod/-/zod-3.23.8.tgz#e37b957b5d52079769fb8097099b592f0ef4067d"
-  integrity sha512-XBx9AXhXktjUqnepgTiE5flcKIYWi/rme0Eaj+5Y0lftuGBq+jyRu/md4WnuxqgP1ubdpNCsYEYPxrzVHD8d6g==
+  version "3.24.0"
+  resolved "https://registry.yarnpkg.com/zod/-/zod-3.24.0.tgz#babb32313f7c5f4a99812feee806d186b4f76bde"
+  integrity sha512-Hz+wiY8yD0VLA2k/+nsg2Abez674dDGTai33SwNvMPuf9uIrBC9eFgIMQxBBbHFxVXi8W+5nX9DcAh9YNSQm/w==