@openclaw/matrix 2026.8.1-beta.3 → 2026.8.2

package/node_modules/matrix-js-sdk/src/pollingCachedValue.ts

@@ -0,0 +1,184 @@
+/*
+Copyright 2026 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { calculateRetryBackoff } from "./http-api/index.ts";
+import { type Logger } from "./logger.ts";
+import { sleep } from "./utils.ts";
+
+/**
+ * How to fetch and cache a given value, as passed to {@link PollingCachedValue}.
+ */
+export interface PollingCachedValueOptions<ValueType> {
+    /** The name of the cached value (for tracing/logs). */
+    name: string;
+    /** The logger to derive this value's child logger from. */
+    logger: Logger;
+    /** Fetches a fresh value. Rejections are retried according to the retry policy. */
+    fetch: () => Promise<ValueType>;
+    /**
+     * The default time-to-live before the value gets refreshed, overridable per run
+     * via {@link PollingCachedValue.start}.
+     * If undefined the value never expires; use {@link PollingCachedValue.refresh} to clear the cache.
+     */
+    ttlMillis?: number;
+    /** Called when a new value is cached. Use to emit changes if needed. */
+    onValueCached?: (value: ValueType) => void;
+    /**
+     * Determines whether a non-transient error should be cached.
+     * By default errors are not cached, i.e. the next attempt retries the fetch.
+     */
+    shouldCacheError?: (error: unknown) => boolean;
+}
+
+/**
+ * Defines a generic mechanism to fetch and cache a value, refreshing it periodically.
+ */
+export class PollingCachedValue<ValueType> {
+    private cached?: ValueType;
+    private fetchPromise?: Promise<ValueType>;
+    private ttlTimeoutHandle?: ReturnType<typeof setTimeout>;
+
+    private isStopped = false;
+    private ttlMillis?: number;
+
+    private readonly logger: Logger;
+
+    /**
+     * Build a generic mechanism allowing to fetch and cache a given value.
+     * @param opts - Describes what to fetch and how to cache it, see {@link PollingCachedValueOptions}.
+     */
+    public constructor(private readonly opts: PollingCachedValueOptions<ValueType>) {
+        this.ttlMillis = opts.ttlMillis;
+        this.logger = opts.logger.getChild(`PollingCachedValue<${opts.name}>`);
+    }
+
+    /**
+     * Gets the cached value if any.
+     */
+    public get(): ValueType | undefined {
+        return this.cached;
+    }
+
+    /**
+     * Ensures that the value was fetched once before getting the actual cached value.
+     */
+    public async wait(): Promise<ValueType | undefined> {
+        await this.doFetch();
+        return this.cached;
+    }
+
+    /**
+     * Call this as early as possible and when the value can already be fetched.
+     * @param ttlMillis - The time-to-live before the value gets refreshed, overriding the one
+     *     given at construction. If omitted the configured default is kept.
+     */
+    public start(ttlMillis?: number): void {
+        if (ttlMillis !== undefined) {
+            this.ttlMillis = ttlMillis;
+        }
+        this.isStopped = false;
+        // Request a fetch as soon as possible
+        this.doFetch().catch((err) => {
+            this.logger.debug("Cached value fetch on start did fail", err);
+        });
+    }
+    /**
+     * Call when the client is stopped, or when the cached value is no longer needed.
+     */
+    public stop(): void {
+        if (this.ttlTimeoutHandle) {
+            clearTimeout(this.ttlTimeoutHandle);
+        }
+        this.isStopped = true;
+    }
+
+    /**
+     * Force to refresh.
+     * @throws
+     */
+    public async refresh(): Promise<ValueType | undefined> {
+        await this.doFetch(true);
+        return this.cached;
+    }
+
+    /**
+     * Internal fetch method
+     * @param force - if set to true will force a fetch of the value even if a fetch is already in progress.
+     * @private
+     */
+    private async doFetch(force: boolean = false): Promise<void> {
+        if (this.fetchPromise && !force) {
+            await this.fetchPromise;
+            return;
+        }
+
+        this.fetchPromise = this.fetchWithRetryPolicy();
+
+        try {
+            this.cached = await this.fetchPromise;
+            if (this.isStopped) {
+                this.fetchPromise = undefined;
+                return;
+            }
+            this.logger.trace(`New cachedValue: ${this.cached}`);
+            this.opts.onValueCached?.(this.cached);
+            // The value is cached only for a given time.
+            if (this.ttlMillis) {
+                this.ttlTimeoutHandle = setTimeout(() => {
+                    this.fetchPromise = undefined;
+                    void this.doFetch();
+                }, this.ttlMillis);
+            }
+        } catch (error) {
+            this.logger.debug(`Error fetching server value for ${error}`);
+            if (this.isStopped) {
+                this.fetchPromise = undefined;
+                return;
+            }
+            if (!this.opts.shouldCacheError?.(error)) {
+                // clear the promise, i.e next tentative will retry to fetch
+                this.fetchPromise = undefined;
+            }
+            throw error;
+        }
+    }
+
+    /**
+     * Gracefully handle transient error retries, respect retry_after_millis for rate limits.
+     * @private
+     */
+    private async fetchWithRetryPolicy(): Promise<ValueType> {
+        let currentRetryCount = 0;
+        while (true) {
+            try {
+                return await this.opts.fetch();
+            } catch (e) {
+                this.logger.trace(`Failed to fetch retry: ${e}`);
+                if (this.isStopped) {
+                    throw e;
+                }
+                currentRetryCount++;
+                const backoff = calculateRetryBackoff(e, currentRetryCount, true);
+                if (backoff < 0) {
+                    // Max number of retries reached, or error is not retryable. rethrow the error
+                    throw e;
+                }
+                // wait for the specified time and then retry the request
+                await sleep(backoff);
+            }
+        }
+    }
+}

package/node_modules/matrix-js-sdk/src/pushprocessor.ts

@@ -294,7 +294,7 @@ export class PushProcessor {
         // These lines are mostly to make the tests happy. We shouldn't run into these
         // properties missing in practice.
         if (!newRules) newRules = {} as IPushRules;
-        if (!newRules.global) newRules.global = {} as PushRuleSet;
+        if (!newRules.global) newRules.global = {};
         if (!newRules.global.override) newRules.global.override = [];
         if (!newRules.global.underride) newRules.global.underride = [];
 
@@ -349,7 +349,7 @@ export class PushProcessor {
         // These lines are mostly to make the tests happy. We shouldn't run into these
         // properties missing in practice.
         if (!newRules) newRules = {} as IPushRules;
-        if (!newRules.global) newRules.global = {} as PushRuleSet;
+        if (!newRules.global) newRules.global = {};
         if (!newRules.global.override) newRules.global.override = [];
         if (!newRules.global.room) newRules.global.room = [];
         if (!newRules.global.sender) newRules.global.sender = [];
@@ -846,7 +846,7 @@ export class PushProcessor {
             for (const kind of RULEKINDS_IN_ORDER) {
                 if (this.client.pushRules[scope][kind] === undefined) continue;
 
-                for (const rule of this.client.pushRules[scope][kind]!) {
+                for (const rule of this.client.pushRules[scope][kind]) {
                     if (rule.rule_id === ruleId) return { rule, kind };
                 }
             }

package/node_modules/matrix-js-sdk/src/realtime-callbacks.ts

@@ -140,7 +140,6 @@ function runCallbacks(): void {
 
     // get the list of things to call
     const callbacksToRun: Callback[] = [];
-    // eslint-disable-next-line
     while (true) {
         const first = callbackList[0];
         if (!first || first.runAt > timestamp) {

package/node_modules/matrix-js-sdk/src/receipt-accumulator.ts

@@ -17,7 +17,6 @@ limitations under the License.
 import { type IMinimalEvent } from "./sync-accumulator.ts";
 import { EventType } from "./@types/event.ts";
 import { isSupportedReceiptType, MapWithDefault, recursiveMapToObject } from "./utils.ts";
-import { type IContent } from "./models/event.ts";
 import { type ReceiptContent, type ReceiptType } from "./@types/read_receipts.ts";
 
 interface AccumulatedReceipt {
@@ -162,7 +161,7 @@ export class ReceiptAccumulator {
             room_id: roomId,
             content: {
                 // $event_id: { "m.read": { $user_id: $json } }
-            } as IContent,
+            },
         };
 
         const receiptEventContent: MapWithDefault<

package/node_modules/matrix-js-sdk/src/rendezvous/MSC4108SignInWithQR.ts

@@ -35,8 +35,7 @@ import {
     startDeviceAuthorization,
     type ValidatedAuthMetadata,
     waitForDeviceAuthorization,
-    type OidcClientConfig,
-} from "../oidc/index.ts";
+} from "../oauth/index.ts";
 import { type CryptoApi } from "../crypto-api/index.ts";
 
 /**
@@ -113,7 +112,7 @@ interface SecretsPayload extends MSC4108Payload, Awaited<ReturnType<NonNullable<
 
 /**
  * Prototype of the unstable [MSC4108](https://github.com/matrix-org/matrix-spec-proposals/pull/4108)
- * sign in with QR + OIDC flow.
+ * sign in with QR + OAuth2 flow.
  * @experimental Note that this is UNSTABLE and may have breaking changes without notice.
  */
 export class MSC4108SignInWithQR {
@@ -182,7 +181,7 @@ export class MSC4108SignInWithQR {
     }
 
     /**
-     * The first step in the OIDC QR login process.
+     * The first step in the OAuth2 QR login process.
      * To be called after the QR code has been rendered or scanned.
      * The scanning device has to discover the homeserver details, if they scanned the code then they already have it.
      * If the new device is the one rendering the QR code then it has to wait be sent the homeserver details via the rendezvous channel.
@@ -198,14 +197,14 @@ export class MSC4108SignInWithQR {
                 // MSC4108-Flow: ExistingScanned - take homeserver from QR code which should already be set
             } else {
                 // MSC4108-Flow: NewScanned -send protocols message
-                let oidcClientConfig: OidcClientConfig | undefined;
+                let authMetadata: ValidatedAuthMetadata | undefined;
                 try {
-                    oidcClientConfig = await this.client!.getAuthMetadata();
+                    authMetadata = await this.client!.getAuthMetadata();
                 } catch (e) {
-                    logger.error("Failed to discover OIDC metadata", e);
+                    logger.error("Failed to discover OAuth2 metadata", e);
                 }
 
-                if (oidcClientConfig?.grant_types_supported.includes(OAuthGrantType.DeviceAuthorization)) {
+                if (authMetadata?.grant_types_supported.includes(OAuthGrantType.DeviceAuthorization)) {
                     await this.send<ProtocolsPayload>({
                         type: PayloadType.Protocols,
                         protocols: ["device_authorization_grant"],
@@ -250,9 +249,9 @@ export class MSC4108SignInWithQR {
     }
 
     /**
-     * The second & third step in the OIDC QR login process.
+     * The second & third step in the OAuth2 QR login process.
      * To be called after `negotiateProtocols` for the existing device.
-     * To be called after OIDC negotiation for the new device.
+     * To be called after OAuth2 negotiation for the new device.
      *
      * @param input - Required for the new device to start the device authorization grant, not required for the existing device reciprocating the login
      */
@@ -362,7 +361,7 @@ export class MSC4108SignInWithQR {
     }
 
     /**
-     * The fourth step in the OIDC QR login process.
+     * The fourth step in the OAuth2 QR login process.
      * The reciprocating device must perform step 5 for this method to resolve.
      * To be called after {@link deviceAuthorizationGrant} only on the new device.
      */
@@ -386,7 +385,7 @@ export class MSC4108SignInWithQR {
             );
         }
         if (payload.type === PayloadType.Failure) {
-            throw new RendezvousError("Failed", (payload as FailurePayload).reason);
+            throw new RendezvousError("Failed", payload.reason);
         }
         if (payload.type !== PayloadType.ProtocolAccepted) {
             throw new RendezvousError("Unexpected message received", MSC4108FailureReason.UnexpectedMessageReceived);
@@ -413,11 +412,10 @@ export class MSC4108SignInWithQR {
             } else if (res.error === "access_denied") {
                 reason = MSC4108FailureReason.UserCancelled;
             }
-            const payload: FailurePayload = {
+            await this.send({
                 type: PayloadType.Failure,
                 reason,
-            };
-            await this.send(payload);
+            } satisfies FailurePayload);
 
             throw new RendezvousError("Rejection from device authorization endpoint", reason);
         }
@@ -426,7 +424,7 @@ export class MSC4108SignInWithQR {
     }
 
     /**
-     * The fifth (and final) step in the OIDC QR login process.
+     * The fifth (and final) step in the OAuth2 QR login process.
      * To be called after the new device has completed authentication.
      */
     public async shareSecrets(): Promise<{ secrets?: Omit<SecretsPayload, "type"> }> {

package/node_modules/matrix-js-sdk/src/rendezvous/index.ts

@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-import { type MatrixClient, OAuthGrantType, type OidcClientConfig } from "../matrix.ts";
+import { type MatrixClient, OAuthGrantType, type ValidatedAuthMetadata } from "../matrix.ts";
 import { MSC4108FailureReason, type RendezvousFailureListener } from "./RendezvousFailureReason.ts";
 import { MSC4108SignInWithQR } from "./MSC4108SignInWithQR.ts";
 import { MSC4108RendezvousSession } from "./transports/MSC4108RendezvousSession.ts";
@@ -39,7 +39,7 @@ export * from "./channels/index.ts";
  * @returns true if the homeserver that the client is connected to supports a variant of sign-in with QR that we can use, false otherwise.
  */
 export async function isSignInWithQRAvailable(client: MatrixClient): Promise<boolean> {
-    let metadata: OidcClientConfig;
+    let metadata: ValidatedAuthMetadata;
     try {
         metadata = await client.getAuthMetadata();
     } catch (e) {

package/node_modules/matrix-js-sdk/src/rendezvous/transports/MSC4108RendezvousSession.ts

@@ -181,7 +181,6 @@ export class MSC4108RendezvousSession {
         if (!this.url) {
             throw new Error("Rendezvous not set up");
         }
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             if (this._cancelled) {
                 return undefined;

package/node_modules/matrix-js-sdk/src/rtcTransportsCachedValue.ts

@@ -0,0 +1,40 @@
+/*
+Copyright 2026 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { PollingCachedValue } from "./pollingCachedValue.ts";
+import { type Transport } from "./matrixrtc/index.ts";
+import { ClientEvent, type MatrixClient } from "./client.ts";
+import { type Logger } from "./logger.ts";
+import { MatrixError } from "./http-api/index.ts";
+
+const TRANSPORT_CACHE_TTL_MILLISECONDS = 1000 * 60 * 60 * 24; // 1 day
+
+/**
+ * Builds a cache for the rtc/transport discovery end-point of the given client.
+ */
+export function createRtcTransportsCachedValue(client: MatrixClient, logger: Logger): PollingCachedValue<Transport[]> {
+    return new PollingCachedValue({
+        name: "RTCTransports",
+        logger,
+        ttlMillis: TRANSPORT_CACHE_TTL_MILLISECONDS,
+        fetch: () => client._unstable_getRTCTransports(),
+        onValueCached: (transports) => client.emit(ClientEvent.RtcTransportsUpdated, transports),
+        // If the end point is not supported by the homeserver it will be a 404 error.
+        // This is a final error, it can be cached, no need to retry everytime.
+        // It will retry when ttl has expired.
+        shouldCacheError: (error) => error instanceof MatrixError && error.httpStatus === 404,
+    });
+}

package/node_modules/matrix-js-sdk/src/rust-crypto/DehydratedDeviceManager.ts

@@ -36,11 +36,11 @@ interface DehydratedDeviceResp {
     };
 }
 /**
- * The response body of `POST /_matrix/client/unstable/org.matrix.msc3814.v1/dehydrated_device/events`.
+ * The response body of `GET /_matrix/client/unstable/org.matrix.msc3814.v1/dehydrated_device/{device_id}/events`.
  */
 interface DehydratedDeviceEventsResp {
     events: IToDeviceEvent[];
-    next_batch: string;
+    next_batch?: string;
 }
 
 /**
@@ -267,28 +267,29 @@ export class DehydratedDeviceManager extends TypedEventEmitter<DehydratedDevices
         const path = encodeUri("/dehydrated_device/$device_id/events", {
             $device_id: dehydratedDeviceResp.device_id,
         });
-        // eslint-disable-next-line no-constant-condition
-        while (true) {
+
+        do {
             const eventResp: DehydratedDeviceEventsResp = await this.http.authedRequest<DehydratedDeviceEventsResp>(
-                Method.Post,
+                Method.Get,
                 path,
+                nextBatch ? { from: nextBatch } : undefined,
                 undefined,
-                nextBatch ? { next_batch: nextBatch } : {},
                 {
                     prefix: UnstablePrefix,
                 },
             );
 
-            if (eventResp.events.length === 0) {
-                break;
-            }
             toDeviceCount += eventResp.events.length;
             nextBatch = eventResp.next_batch;
-            const roomKeyInfos = await rehydratedDevice.receiveEvents(JSON.stringify(eventResp.events));
-            roomKeyCount += roomKeyInfos.length;
 
-            this.emit(CryptoEvent.RehydrationProgress, roomKeyCount, toDeviceCount);
-        }
+            if (eventResp.events.length > 0) {
+                const roomKeyInfos = await rehydratedDevice.receiveEvents(JSON.stringify(eventResp.events));
+                roomKeyCount += roomKeyInfos.length;
+
+                this.emit(CryptoEvent.RehydrationProgress, roomKeyCount, toDeviceCount);
+            }
+        } while (nextBatch !== undefined);
+
         this.logger.info(`dehydration: received ${roomKeyCount} room keys from ${toDeviceCount} to-device events`);
         this.emit(CryptoEvent.RehydrationCompleted);
 

package/node_modules/matrix-js-sdk/src/rust-crypto/OutgoingRequestProcessor.ts

@@ -190,7 +190,6 @@ export class OutgoingRequestProcessor {
     ): Promise<string> {
         let currentRetryCount = 0;
 
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             try {
                 return await this.rawJsonRequest(method, path, queryParams, body);

package/node_modules/matrix-js-sdk/src/rust-crypto/PerSessionKeyBackupDownloader.ts

@@ -394,7 +394,7 @@ export class PerSessionKeyBackupDownloader {
     ): Promise<void> {
         const sessionsToImport: Record<string, KeyBackupSession> = { [sessionInfo.megolmSessionId]: data };
 
-        const keys = await configuration!.decryptor.decryptSessions(sessionsToImport);
+        const keys = await configuration.decryptor.decryptSessions(sessionsToImport);
         for (const k of keys) {
             k.room_id = sessionInfo.roomId;
         }

package/node_modules/matrix-js-sdk/src/rust-crypto/backup.ts

@@ -23,10 +23,10 @@ import {
     type KeyBackupCheck,
     type KeyBackupInfo,
     type KeyBackupSession,
-    type Curve25519SessionData,
     type KeyBackupRestoreOpts,
     type KeyBackupRestoreResult,
     type KeyBackupRoomSessions,
+    type NewKeyBackupInfo,
 } from "../crypto-api/keybackup.ts";
 import { type Logger } from "../logger.ts";
 import { ClientPrefix, type IHttpOpts, MatrixError, type MatrixHttpApi, Method } from "../http-api/index.ts";
@@ -41,7 +41,6 @@ import {
     CryptoEvent,
     ImportRoomKeyStage,
 } from "../crypto-api/index.ts";
-import { type AESEncryptedSecretStoragePayload } from "../@types/AESEncryptedSecretStoragePayload.ts";
 import { type IMegolmSessionData } from "../@types/crypto.ts";
 
 /** Authentification of the backup info, depends on algorithm */
@@ -325,11 +324,6 @@ export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents,
             return null;
         }
         this.checkedForBackup = true;
-
-        if (backupInfo && !backupInfo.version) {
-            this.logger.warn("active backup lacks a useful 'version'; ignoring it");
-            backupInfo = undefined;
-        }
         this.serverBackupInfo = backupInfo;
 
         const activeVersion = await this.getActiveBackupVersion();
@@ -356,34 +350,51 @@ export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents,
                 this.logger.debug("Key backup present on server but not trusted: not enabling key backup");
             }
         } else {
-            if (activeVersion === null) {
-                this.logger.debug(`Found usable key backup v${backupInfo.version}: enabling key backups`);
-                await this.enableKeyBackup(backupInfo);
-            } else if (activeVersion !== backupInfo.version) {
-                this.logger.debug(
-                    `On backup version ${activeVersion} but found version ${backupInfo.version}: switching.`,
-                );
-                // This will remove any pending backup request, remove the backup key and reset the backup state of each room key we have.
-                await this.disableKeyBackup();
-                // Enabling will now trigger re-upload of all the keys
-                await this.enableKeyBackup(backupInfo);
-            } else {
-                this.logger.debug(`Backup version ${backupInfo.version} still current`);
-            }
+            await this.enableOrSwitchKeyBackup(backupInfo, activeVersion);
         }
         return { backupInfo, trustInfo };
     }
 
+    /**
+     * Enable key backup upload for the given backup version, if it is not already.
+     *
+     * If backup is currently enabled for a different version, disables it first.
+     *
+     * Also emits one or more {@link CryptoEvent.KeyBackupStatus} events if the backup status changes.
+     *
+     * @param backupInfo - the desired backup version (and the encryption key).
+     * @param activeVersion - the current active backup version (or `null`, if none).
+     */
+    private async enableOrSwitchKeyBackup(backupInfo: KeyBackupInfo, activeVersion: string | null): Promise<void> {
+        if (activeVersion === null) {
+            this.logger.debug(`Found usable key backup v${backupInfo.version}: enabling key backups`);
+            await this.enableKeyBackup(backupInfo);
+        } else if (activeVersion !== backupInfo.version) {
+            this.logger.debug(`On backup version ${activeVersion} but found version ${backupInfo.version}: switching.`);
+            // This will remove any pending backup request, remove the backup upload key from the OlmMachine and reset
+            // the backup state of each room key we have.
+            await this.disableKeyBackup();
+            // Enabling will now trigger re-upload of all the keys
+            await this.enableKeyBackup(backupInfo);
+        } else {
+            this.logger.debug(`Backup version ${backupInfo.version} still current`);
+        }
+    }
+
+    /**
+     * Helper for {@link enableOrSwitchKeyBackup}.
+     *
+     * Enables key backup upload for the given backup version. Also emits
+     * a {@link CryptoEvent.KeyBackupStatus} event.
+     */
     private async enableKeyBackup(backupInfo: KeyBackupInfo): Promise<void> {
         // we know for certain it must be a Curve25519 key, because we have verified it and only Curve25519
         // keys can be verified.
-        //
-        // we also checked it has a valid `version`.
         await this.olmMachine.enableBackupV1(
             (backupInfo.auth_data as Curve25519AuthData).public_key,
-            backupInfo.version!,
+            backupInfo.version,
         );
-        this.activeBackupVersion = backupInfo.version!;
+        this.activeBackupVersion = backupInfo.version;
 
         this.emit(CryptoEvent.KeyBackupStatus, true);
 
@@ -560,16 +571,24 @@ export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents,
     }
 
     /**
-     * Creates a new key backup by generating a new random private key.
+     * Creates a new key backup by generating a new random private key, and then enable key backup upload and download
+     * using the new backup version.
      *
      * If there is an existing backup server side it will be deleted and replaced
      * by the new one.
      *
+     * Saves the decryption key in the Rust SDK's CryptoStore.
+     *
      * @param signObject - Method that should sign the backup with existing device and
      * existing identity.
      * @returns a KeyBackupCreationInfo - All information related to the backup.
      */
     public async setupKeyBackup(signObject: (authData: AuthData) => Promise<void>): Promise<KeyBackupCreationInfo> {
+        // Wait for any active call to `checkKeyBackupAndEnable` to complete, to avoid racing with it
+        if (this.keyBackupCheckInProgress) {
+            await this.keyBackupCheckInProgress;
+        }
+
         // Clean up any existing backup
         await this.deleteAllKeyBackupVersions();
 
@@ -580,19 +599,36 @@ export class RustBackupManager extends TypedEventEmitter<RustBackupCryptoEvents,
 
         await signObject(authData);
 
+        const backupData: NewKeyBackupInfo = {
+            algorithm: pubKey.algorithm,
+            auth_data: authData,
+        };
+
         const res = await this.http.authedRequest<{ version: string }>(
             Method.Post,
             "/room_keys/version",
             undefined,
-            {
-                algorithm: pubKey.algorithm,
-                auth_data: authData,
-            },
+            backupData,
             {
                 prefix: ClientPrefix.V3,
             },
         );
 
+        // This backup was just created and signed locally, so use the creation response to make up a full
+        // `KeyBackupInfo` struct representing the new backup, instead of doing another discovery/trust check.
+        const backupInfo: KeyBackupInfo = {
+            algorithm: pubKey.algorithm,
+            auth_data: authData,
+            version: res.version,
+            count: 0,
+            etag: "", // we never actually use the etag, so we can just make up a value
+        };
+
+        // saveBackupDecryptionKey emits KeyBackupDecryptionKeyCached. Cache and
+        // enable the created backup first so listeners observe the new version.
+        this.serverBackupInfo = backupInfo;
+        this.checkedForBackup = true;
+        await this.enableOrSwitchKeyBackup(backupInfo, await this.getActiveBackupVersion());
         await this.saveBackupDecryptionKey(randomKey, res.version);
 
         return {
@@ -863,9 +899,7 @@ export class RustBackupDecryptor implements BackupDecryptor {
     /**
      * Implements {@link BackupDecryptor#decryptSessions}
      */
-    public async decryptSessions(
-        ciphertexts: Record<string, KeyBackupSession<Curve25519SessionData | AESEncryptedSecretStoragePayload>>,
-    ): Promise<IMegolmSessionData[]> {
+    public async decryptSessions(ciphertexts: Record<string, KeyBackupSession>): Promise<IMegolmSessionData[]> {
         const keys: IMegolmSessionData[] = [];
         for (const [sessionId, sessionData] of Object.entries(ciphertexts)) {
             try {

package/node_modules/matrix-js-sdk/src/rust-crypto/device-converter.ts

@@ -111,6 +111,7 @@ export function downloadDeviceToJsDevice(device: QueryDevice): Device {
 
     const signatures = new Map<string, Map<string, string>>();
     if (device.signatures) {
+        // oxlint-disable-next-line guard-for-in
         for (const userId in device.signatures) {
             signatures.set(userId, new Map(Object.entries(device.signatures[userId])));
         }