matrix-js-sdk 42.3.0 → 42.4.0

package/lib/common-crypto/CryptoBackend.d.ts

@@ -86,40 +86,59 @@ export interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {
      */
     markRoomAsPendingKeyBundle(roomId: string, inviterId: string): Promise<void>;
 }
-/** The methods which crypto implementations should expose to the Sync api
+/**
+ * The parts of a sync response which are relevant to encryption, as passed to
+ * {@link SyncCryptoCallbacks.processSyncChanges}.
  *
  * @internal
  */
-export interface SyncCryptoCallbacks {
+export interface SyncCryptoChanges {
+    /** The to-device events from the sync response (`to_device.events`), or an empty list if there were none. */
+    toDeviceEvents: IToDeviceEvent[];
+    /** The `device_lists` field from the sync response, if any. */
+    deviceLists?: IDeviceLists;
     /**
-     * Called by the /sync loop whenever there are incoming to-device messages.
-     *
-     * The implementation may preprocess the received messages (eg, decrypt them) and return an
-     * updated list of messages for dispatch to the rest of the system.
-     *
-     * Note that, unlike {@link ClientEvent.ToDeviceEvent} events, this is called on the raw to-device
-     * messages, rather than the results of any decryption attempts.
-     *
-     * @param events - the received to-device messages
-     * @returns A list of preprocessed to-device messages. This will not map 1:1 to the input list, as some messages may be invalid or
-     * failed to decrypt, and so will be omitted from the output list.
+     * The `device_one_time_keys_count` field from the sync response, if any.
      *
+     * The meaning of an algorithm missing from the map (or of an absent field) depends on {@link useMsc4186}: in
+     * sync v2 it means that there are no one-time keys of that algorithm on the server; in sliding sync it means that
+     * the count is unchanged since the previous response.
      */
-    preprocessToDeviceMessages(events: IToDeviceEvent[]): Promise<ReceivedToDeviceMessage[]>;
+    oneTimeKeysCounts?: Record<string, number>;
     /**
-     * Called by the /sync loop when one time key counts and unused fallback key details are received.
-     *
-     * @param oneTimeKeysCounts - the received one time key counts
-     * @param unusedFallbackKeys - the received unused fallback keys
+     * The `device_unused_fallback_key_types` field from the sync response, or `undefined` if the response did not
+     * include it (which means that the server does not support fallback keys).
      */
-    processKeyCounts(oneTimeKeysCounts?: Record<string, number>, unusedFallbackKeys?: string[]): Promise<void>;
+    unusedFallbackKeys?: string[];
     /**
-     * Handle the notification from /sync that device lists have
-     * been changed.
+     * Whether to interpret the response with MSC4186 (simplified sliding sync) semantics rather than sync v2. This
+     * selects the meaning of missing one-time key counts: see {@link oneTimeKeysCounts}. Defaults to `false`.
+     */
+    useMsc4186?: boolean;
+}
+/** The methods which crypto implementations should expose to the Sync api
+ *
+ * @internal
+ */
+export interface SyncCryptoCallbacks {
+    /**
+     * Called by the sync loop once per sync response, with the parts of the response which are relevant to
+     * encryption: to-device messages, device list changes, one-time key counts and unused fallback key types.
+     *
+     * All of this data must be passed together, in a single call per sync response, because the OlmMachine
+     * interprets it as the complete E2EE state from a sync response. In particular, per the sync v2 specification,
+     * an absent `device_one_time_keys_count` means that there are no one-time keys on the server, so calling this
+     * without the counts from the response would trigger a spurious one-time key upload. (Sliding sync responses
+     * omit the count when it is unchanged; {@link SyncCryptoChanges.useMsc4186} selects that interpretation.)
+     *
+     * This must be called before the room events in the sync response are processed, so that any room keys received
+     * in to-device messages are available when decrypting room events.
      *
-     * @param deviceLists - device_lists field from /sync
+     * @param changes - the E2EE-relevant parts of the sync response
+     * @returns A list of processed to-device messages. This will not map 1:1 to the input list, as some messages may
+     *    be invalid or fail to decrypt, and so will be omitted from the output list.
      */
-    processDeviceLists(deviceLists: IDeviceLists): Promise<void>;
+    processSyncChanges(changes: SyncCryptoChanges): Promise<ReceivedToDeviceMessage[]>;
     /**
      * Called by the /sync loop whenever an m.room.encryption event is received.
      *

package/lib/common-crypto/CryptoBackend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CryptoBackend.d.ts","sourceRoot":"","sources":["../../src/common-crypto/CryptoBackend.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC7G,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,aAAc,SAAQ,mBAAmB,EAAE,SAAS;IACjE;;;;;;;;OAQG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;OAEG;IACH,IAAI,IAAI,IAAI,CAAC;IAEb;;;;;;;;;OASG;IACH,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEjE;;;;OAIG;IACH,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7F;;;;;;;OAOG;IACH,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAQpH;;;OAGG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExE;;;;;;;OAOG;IACH,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChF;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;;;;;;;;;;OAaG;IACH,0BAA0B,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAEzF;;;;;OAKG;IACH,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3G;;;;;OAKG;IACH,kBAAkB,CAAC,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;;;;OAMG;IACH,eAAe,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAEtD;;;;;;OAMG;IACH,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAClC;;OAEG;IACH,UAAU,EAAE,WAAW,CAAC;IACxB;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,MAAM,EAAE,CAAC;IACxC;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAEhC;;;;;;;OAOG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAE9F;;;;OAIG;IACH,IAAI,IAAI,IAAI,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,qBAAa,eAAgB,SAAQ,KAAK;aAIlB,IAAI,EAAE,qBAAqB;IAH/C,SAAgB,cAAc,EAAE,MAAM,CAAC;IAEvC,YACoB,IAAI,EAAE,qBAAqB,EAC3C,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,EAK3C;CACJ"}
+{"version":3,"file":"CryptoBackend.d.ts","sourceRoot":"","sources":["../../src/common-crypto/CryptoBackend.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC7G,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,aAAc,SAAQ,mBAAmB,EAAE,SAAS;IACjE;;;;;;;;OAQG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;OAEG;IACH,IAAI,IAAI,IAAI,CAAC;IAEb;;;;;;;;;OASG;IACH,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D;;;;;OAKG;IACH,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEjE;;;;OAIG;IACH,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7F;;;;;;;OAOG;IACH,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAQpH;;;OAGG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExE;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExE;;;;;;;OAOG;IACH,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChF;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAC9B,6GAA6G;IAC7G,cAAc,EAAE,cAAc,EAAE,CAAC;IAEjC,+DAA+D;IAC/D,WAAW,CAAC,EAAE,YAAY,CAAC;IAE3B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAEnF;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;;;;;OAMG;IACH,eAAe,CAAC,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAEtD;;;;;;OAMG;IACH,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAClC;;OAEG;IACH,UAAU,EAAE,WAAW,CAAC;IACxB;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,MAAM,EAAE,CAAC;IACxC;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAEhC;;;;;;;OAOG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAE9F;;;;OAIG;IACH,IAAI,IAAI,IAAI,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,qBAAa,eAAgB,SAAQ,KAAK;aAIlB,IAAI,EAAE,qBAAqB;IAH/C,SAAgB,cAAc,EAAE,MAAM,CAAC;IAEvC,YACoB,IAAI,EAAE,qBAAqB,EAC3C,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,EAK3C;CACJ"}

package/lib/common-crypto/CryptoBackend.js

@@ -21,6 +21,13 @@ limitations under the License.
  * @internal
  */
 
+/**
+ * The parts of a sync response which are relevant to encryption, as passed to
+ * {@link SyncCryptoCallbacks.processSyncChanges}.
+ *
+ * @internal
+ */
+
 /** The methods which crypto implementations should expose to the Sync api
  *
  * @internal

package/lib/common-crypto/CryptoBackend.js.map

@@ -1 +1 @@
-{"version":3,"file":"CryptoBackend.js","names":[],"sources":["../../src/common-crypto/CryptoBackend.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport type { IDeviceLists, IToDeviceEvent, ReceivedToDeviceMessage } from \"../sync-accumulator.ts\";\nimport { type IClearEvent, type MatrixEvent } from \"../models/event.ts\";\nimport { type Room } from \"../models/room.ts\";\nimport { type CryptoApi, type DecryptionFailureCode, type ImportRoomKeysOpts } from \"../crypto-api/index.ts\";\nimport { type KeyBackupInfo, type KeyBackupSession } from \"../crypto-api/keybackup.ts\";\nimport { type IMegolmSessionData } from \"../@types/crypto.ts\";\n\n/**\n * Common interface for the crypto implementations\n *\n * @internal\n */\nexport interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {\n    /**\n     * Whether sendMessage in a room with unknown and unverified devices\n     * should throw an error and not send the message. This has 'Global' for\n     * symmetry with setGlobalBlacklistUnverifiedDevices but there is currently\n     * no room-level equivalent for this setting.\n     *\n     * @remarks This has no effect in Rust Crypto; it exists only for the sake of\n     * the accessors in MatrixClient.\n     */\n    globalErrorOnUnknownDevices: boolean;\n\n    /**\n     * Shut down any background processes related to crypto\n     */\n    stop(): void;\n\n    /**\n     * Encrypt an event according to the configuration of the room.\n     *\n     * @param event -  event to be sent\n     *\n     * @param room - destination room.\n     *\n     * @returns Promise which resolves when the event has been\n     *     encrypted, or null if nothing was needed\n     */\n    encryptEvent(event: MatrixEvent, room: Room): Promise<void>;\n\n    /**\n     * Decrypt a received event\n     *\n     * @returns a promise which resolves once we have finished decrypting.\n     * Rejects with an error if there is a problem decrypting the event.\n     */\n    decryptEvent(event: MatrixEvent): Promise<EventDecryptionResult>;\n\n    /**\n     * Get a backup decryptor capable of decrypting megolm session data encrypted with the given backup information.\n     * @param backupInfo - The backup information\n     * @param privKey - The private decryption key.\n     */\n    getBackupDecryptor(backupInfo: KeyBackupInfo, privKey: Uint8Array): Promise<BackupDecryptor>;\n\n    /**\n     * Import a list of room keys restored from backup\n     *\n     * @param keys - a list of session export objects\n     * @param backupVersion - the version of the backup these keys came from.\n     * @param opts - options object\n     * @returns a promise which resolves once the keys have been imported\n     */\n    importBackedUpRoomKeys(keys: IMegolmSessionData[], backupVersion: string, opts?: ImportRoomKeysOpts): Promise<void>;\n\n    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n    //\n    // Room key history sharing (MSC4268)\n    //\n    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n    /**\n     * Share any shareable E2EE history in the given room with the given recipient,\n     * as per [MSC4268](https://github.com/matrix-org/matrix-spec-proposals/pull/4268)\n     */\n    shareRoomHistoryWithUser(roomId: string, userId: string): Promise<void>;\n\n    /**\n     * Having accepted an invite for the given room from the given user, attempt to\n     * find information about a room key bundle and, if found, download the\n     * bundle and import the room keys, as per {@link https://github.com/matrix-org/matrix-spec-proposals/pull/4268|MSC4268}.\n     *\n     * @param roomId - The room we were invited to, for which we want to check if a room\n     *   key bundle was received.\n     *\n     * @param inviter - The user who invited us to the room and is expected to have\n     *   sent the room key bundle.\n     *\n     * @returns `true` if the key bundle was successfuly downloaded and imported.\n     */\n    maybeAcceptKeyBundle(roomId: string, inviter: string): Promise<boolean>;\n\n    /**\n     * Mark a room as pending a key bundle under MSC4268. The backend will listen for room key bundle messages, and if\n     * it sees one matching the room specified, it will automatically import it as long as the message author's ID matches\n     * the inviter's ID.\n     *\n     * @param roomId - The room we were invited to, for which we did not receive a key bundle before accepting the invite.\n     * @param inviterId - The user who invited us to the room and is expected to send the room key bundle.\n     */\n    markRoomAsPendingKeyBundle(roomId: string, inviterId: string): Promise<void>;\n}\n\n/** The methods which crypto implementations should expose to the Sync api\n *\n * @internal\n */\nexport interface SyncCryptoCallbacks {\n    /**\n     * Called by the /sync loop whenever there are incoming to-device messages.\n     *\n     * The implementation may preprocess the received messages (eg, decrypt them) and return an\n     * updated list of messages for dispatch to the rest of the system.\n     *\n     * Note that, unlike {@link ClientEvent.ToDeviceEvent} events, this is called on the raw to-device\n     * messages, rather than the results of any decryption attempts.\n     *\n     * @param events - the received to-device messages\n     * @returns A list of preprocessed to-device messages. This will not map 1:1 to the input list, as some messages may be invalid or\n     * failed to decrypt, and so will be omitted from the output list.\n     *\n     */\n    preprocessToDeviceMessages(events: IToDeviceEvent[]): Promise<ReceivedToDeviceMessage[]>;\n\n    /**\n     * Called by the /sync loop when one time key counts and unused fallback key details are received.\n     *\n     * @param oneTimeKeysCounts - the received one time key counts\n     * @param unusedFallbackKeys - the received unused fallback keys\n     */\n    processKeyCounts(oneTimeKeysCounts?: Record<string, number>, unusedFallbackKeys?: string[]): Promise<void>;\n\n    /**\n     * Handle the notification from /sync that device lists have\n     * been changed.\n     *\n     * @param deviceLists - device_lists field from /sync\n     */\n    processDeviceLists(deviceLists: IDeviceLists): Promise<void>;\n\n    /**\n     * Called by the /sync loop whenever an m.room.encryption event is received.\n     *\n     * This is called before RoomStateEvents are emitted for any of the events in the /sync\n     * response (even if the other events technically happened first). This works around a problem\n     * if the client uses a RoomStateEvent (typically a membership event) as a trigger to send a message\n     * in a new room (or one where encryption has been newly enabled): that would otherwise leave the\n     * crypto layer confused because it expects crypto to be set up, but it has not yet been.\n     *\n     * @param room - in which the event was received\n     * @param event - encryption event to be processed\n     */\n    onCryptoEvent(room: Room, event: MatrixEvent): Promise<void>;\n\n    /**\n     * Called by the /sync loop after each /sync response is processed.\n     *\n     * Used to complete batch processing, or to initiate background processes\n     *\n     * @param syncState - information about the completed sync.\n     */\n    onSyncCompleted(syncState: OnSyncCompletedData): void;\n\n    /**\n     * Mark all tracked users' device lists as dirty.\n     *\n     * This method will cause additional `/keys/query` requests on the server, so should be used only\n     * when the client has desynced tracking device list deltas from the server.\n     * In MSC4186: Simplified Sliding Sync, this can happen when the server expires the connection.\n     */\n    markAllTrackedUsersAsDirty(): Promise<void>;\n}\n\n/**\n * @internal\n */\nexport interface OnSyncCompletedData {\n    /**\n     * The 'next_batch' result from /sync, which will become the 'since' token for the next call to /sync.\n     */\n    nextSyncToken?: string;\n\n    /**\n     * True if we are working our way through a backlog of events after connecting.\n     */\n    catchingUp?: boolean;\n}\n\n/**\n * The result of a (successful) call to {@link CryptoBackend.decryptEvent}\n */\nexport interface EventDecryptionResult {\n    /**\n     * The plaintext payload for the event (typically containing <tt>type</tt> and <tt>content</tt> fields).\n     */\n    clearEvent: IClearEvent;\n    /**\n     * No longer used.\n     * See {@link MatrixEvent#getForwardingCurve25519KeyChain}.\n     * @deprecated\n     */\n    forwardingCurve25519KeyChain?: string[];\n    /**\n     * Key owned by the sender of this event.  See {@link MatrixEvent#getSenderKey}.\n     */\n    senderCurve25519Key?: string;\n    /**\n     * ed25519 key claimed by the sender of this event. See {@link MatrixEvent#getClaimedEd25519Key}.\n     */\n    claimedEd25519Key?: string;\n\n    /**\n     * If another user forwarded the key to this message\n     * (eg via [MSC4268](https://github.com/matrix-org/matrix-spec-proposals/pull/4268)),\n     * the ID of that user.\n     */\n    keyForwardedBy?: string;\n}\n\n/**\n * Responsible for decrypting megolm session data retrieved from a remote backup.\n * The result of {@link CryptoBackend#getBackupDecryptor}.\n */\nexport interface BackupDecryptor {\n    /**\n     * Whether keys retrieved from this backup can be trusted.\n     *\n     * Depending on the backup algorithm, keys retrieved from the backup can be trusted or not.\n     * If false, keys retrieved from the backup  must be considered unsafe (authenticity cannot be guaranteed).\n     * It could be by design (deniability) or for some technical reason (eg asymmetric encryption).\n     */\n    readonly sourceTrusted: boolean;\n\n    /**\n     *\n     * Decrypt megolm session data retrieved from backup.\n     *\n     * @param ciphertexts - a Record of sessionId to session data.\n     *\n     * @returns An array of decrypted `IMegolmSessionData`\n     */\n    decryptSessions(ciphertexts: Record<string, KeyBackupSession>): Promise<IMegolmSessionData[]>;\n\n    /**\n     * Free any resources held by this decryptor.\n     *\n     * Should be called once the decryptor is no longer needed.\n     */\n    free(): void;\n}\n\n/**\n * Exception thrown when decryption fails\n *\n * @param code - Reason code for the failure.\n *\n * @param msg - user-visible message describing the problem\n *\n * @param details - key/value pairs reported in the logs but not shown\n *   to the user.\n */\nexport class DecryptionError extends Error {\n    public readonly detailedString: string;\n\n    public constructor(\n        public readonly code: DecryptionFailureCode,\n        msg: string,\n        details?: Record<string, string | Error>,\n    ) {\n        super(msg);\n        this.name = \"DecryptionError\";\n        this.detailedString = detailedStringForDecryptionError(this, details);\n    }\n}\n\nfunction detailedStringForDecryptionError(err: DecryptionError, details?: Record<string, string | Error>): string {\n    let result = err.name + \"[msg: \" + err.message;\n\n    if (details) {\n        result +=\n            \", \" +\n            Object.keys(details)\n                .map((k) => k + \": \" + details[k])\n                .join(\", \");\n    }\n\n    result += \"]\";\n\n    return result;\n}\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;;AA6FA;AACA;AACA;AACA;;AAmEA;AACA;AACA;;AAaA;AACA;AACA;;AA6BA;AACA;AACA;AACA;;AA6BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM,eAAe,SAAS,KAAK,CAAC;EAGhC,WAAW,CACE,IAA2B,EAC3C,GAAW,EACX,OAAwC,EAC1C;IACE,KAAK,CAAC,GAAG,CAAC;IAAC;IAAA,KAJK,IAA2B,GAA3B,IAA2B;IAK3C,IAAI,CAAC,IAAI,GAAG,iBAAiB;IAC7B,IAAI,CAAC,cAAc,GAAG,gCAAgC,CAAC,IAAI,EAAE,OAAO,CAAC;EACzE;AACJ;AAEA,SAAS,gCAAgC,CAAC,GAAoB,EAAE,OAAwC,EAAU;EAC9G,IAAI,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,QAAQ,GAAG,GAAG,CAAC,OAAO;EAE9C,IAAI,OAAO,EAAE;IACT,MAAM,IACF,IAAI,GACJ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,GAAG,CAAE,CAAC,IAAK,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CACjC,IAAI,CAAC,IAAI,CAAC;EACvB;EAEA,MAAM,IAAI,GAAG;EAEb,OAAO,MAAM;AACjB","ignoreList":[]}
+{"version":3,"file":"CryptoBackend.js","names":[],"sources":["../../src/common-crypto/CryptoBackend.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\nimport type { IDeviceLists, IToDeviceEvent, ReceivedToDeviceMessage } from \"../sync-accumulator.ts\";\nimport { type IClearEvent, type MatrixEvent } from \"../models/event.ts\";\nimport { type Room } from \"../models/room.ts\";\nimport { type CryptoApi, type DecryptionFailureCode, type ImportRoomKeysOpts } from \"../crypto-api/index.ts\";\nimport { type KeyBackupInfo, type KeyBackupSession } from \"../crypto-api/keybackup.ts\";\nimport { type IMegolmSessionData } from \"../@types/crypto.ts\";\n\n/**\n * Common interface for the crypto implementations\n *\n * @internal\n */\nexport interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {\n    /**\n     * Whether sendMessage in a room with unknown and unverified devices\n     * should throw an error and not send the message. This has 'Global' for\n     * symmetry with setGlobalBlacklistUnverifiedDevices but there is currently\n     * no room-level equivalent for this setting.\n     *\n     * @remarks This has no effect in Rust Crypto; it exists only for the sake of\n     * the accessors in MatrixClient.\n     */\n    globalErrorOnUnknownDevices: boolean;\n\n    /**\n     * Shut down any background processes related to crypto\n     */\n    stop(): void;\n\n    /**\n     * Encrypt an event according to the configuration of the room.\n     *\n     * @param event -  event to be sent\n     *\n     * @param room - destination room.\n     *\n     * @returns Promise which resolves when the event has been\n     *     encrypted, or null if nothing was needed\n     */\n    encryptEvent(event: MatrixEvent, room: Room): Promise<void>;\n\n    /**\n     * Decrypt a received event\n     *\n     * @returns a promise which resolves once we have finished decrypting.\n     * Rejects with an error if there is a problem decrypting the event.\n     */\n    decryptEvent(event: MatrixEvent): Promise<EventDecryptionResult>;\n\n    /**\n     * Get a backup decryptor capable of decrypting megolm session data encrypted with the given backup information.\n     * @param backupInfo - The backup information\n     * @param privKey - The private decryption key.\n     */\n    getBackupDecryptor(backupInfo: KeyBackupInfo, privKey: Uint8Array): Promise<BackupDecryptor>;\n\n    /**\n     * Import a list of room keys restored from backup\n     *\n     * @param keys - a list of session export objects\n     * @param backupVersion - the version of the backup these keys came from.\n     * @param opts - options object\n     * @returns a promise which resolves once the keys have been imported\n     */\n    importBackedUpRoomKeys(keys: IMegolmSessionData[], backupVersion: string, opts?: ImportRoomKeysOpts): Promise<void>;\n\n    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n    //\n    // Room key history sharing (MSC4268)\n    //\n    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n    /**\n     * Share any shareable E2EE history in the given room with the given recipient,\n     * as per [MSC4268](https://github.com/matrix-org/matrix-spec-proposals/pull/4268)\n     */\n    shareRoomHistoryWithUser(roomId: string, userId: string): Promise<void>;\n\n    /**\n     * Having accepted an invite for the given room from the given user, attempt to\n     * find information about a room key bundle and, if found, download the\n     * bundle and import the room keys, as per {@link https://github.com/matrix-org/matrix-spec-proposals/pull/4268|MSC4268}.\n     *\n     * @param roomId - The room we were invited to, for which we want to check if a room\n     *   key bundle was received.\n     *\n     * @param inviter - The user who invited us to the room and is expected to have\n     *   sent the room key bundle.\n     *\n     * @returns `true` if the key bundle was successfuly downloaded and imported.\n     */\n    maybeAcceptKeyBundle(roomId: string, inviter: string): Promise<boolean>;\n\n    /**\n     * Mark a room as pending a key bundle under MSC4268. The backend will listen for room key bundle messages, and if\n     * it sees one matching the room specified, it will automatically import it as long as the message author's ID matches\n     * the inviter's ID.\n     *\n     * @param roomId - The room we were invited to, for which we did not receive a key bundle before accepting the invite.\n     * @param inviterId - The user who invited us to the room and is expected to send the room key bundle.\n     */\n    markRoomAsPendingKeyBundle(roomId: string, inviterId: string): Promise<void>;\n}\n\n/**\n * The parts of a sync response which are relevant to encryption, as passed to\n * {@link SyncCryptoCallbacks.processSyncChanges}.\n *\n * @internal\n */\nexport interface SyncCryptoChanges {\n    /** The to-device events from the sync response (`to_device.events`), or an empty list if there were none. */\n    toDeviceEvents: IToDeviceEvent[];\n\n    /** The `device_lists` field from the sync response, if any. */\n    deviceLists?: IDeviceLists;\n\n    /**\n     * The `device_one_time_keys_count` field from the sync response, if any.\n     *\n     * The meaning of an algorithm missing from the map (or of an absent field) depends on {@link useMsc4186}: in\n     * sync v2 it means that there are no one-time keys of that algorithm on the server; in sliding sync it means that\n     * the count is unchanged since the previous response.\n     */\n    oneTimeKeysCounts?: Record<string, number>;\n\n    /**\n     * The `device_unused_fallback_key_types` field from the sync response, or `undefined` if the response did not\n     * include it (which means that the server does not support fallback keys).\n     */\n    unusedFallbackKeys?: string[];\n\n    /**\n     * Whether to interpret the response with MSC4186 (simplified sliding sync) semantics rather than sync v2. This\n     * selects the meaning of missing one-time key counts: see {@link oneTimeKeysCounts}. Defaults to `false`.\n     */\n    useMsc4186?: boolean;\n}\n\n/** The methods which crypto implementations should expose to the Sync api\n *\n * @internal\n */\nexport interface SyncCryptoCallbacks {\n    /**\n     * Called by the sync loop once per sync response, with the parts of the response which are relevant to\n     * encryption: to-device messages, device list changes, one-time key counts and unused fallback key types.\n     *\n     * All of this data must be passed together, in a single call per sync response, because the OlmMachine\n     * interprets it as the complete E2EE state from a sync response. In particular, per the sync v2 specification,\n     * an absent `device_one_time_keys_count` means that there are no one-time keys on the server, so calling this\n     * without the counts from the response would trigger a spurious one-time key upload. (Sliding sync responses\n     * omit the count when it is unchanged; {@link SyncCryptoChanges.useMsc4186} selects that interpretation.)\n     *\n     * This must be called before the room events in the sync response are processed, so that any room keys received\n     * in to-device messages are available when decrypting room events.\n     *\n     * @param changes - the E2EE-relevant parts of the sync response\n     * @returns A list of processed to-device messages. This will not map 1:1 to the input list, as some messages may\n     *    be invalid or fail to decrypt, and so will be omitted from the output list.\n     */\n    processSyncChanges(changes: SyncCryptoChanges): Promise<ReceivedToDeviceMessage[]>;\n\n    /**\n     * Called by the /sync loop whenever an m.room.encryption event is received.\n     *\n     * This is called before RoomStateEvents are emitted for any of the events in the /sync\n     * response (even if the other events technically happened first). This works around a problem\n     * if the client uses a RoomStateEvent (typically a membership event) as a trigger to send a message\n     * in a new room (or one where encryption has been newly enabled): that would otherwise leave the\n     * crypto layer confused because it expects crypto to be set up, but it has not yet been.\n     *\n     * @param room - in which the event was received\n     * @param event - encryption event to be processed\n     */\n    onCryptoEvent(room: Room, event: MatrixEvent): Promise<void>;\n\n    /**\n     * Called by the /sync loop after each /sync response is processed.\n     *\n     * Used to complete batch processing, or to initiate background processes\n     *\n     * @param syncState - information about the completed sync.\n     */\n    onSyncCompleted(syncState: OnSyncCompletedData): void;\n\n    /**\n     * Mark all tracked users' device lists as dirty.\n     *\n     * This method will cause additional `/keys/query` requests on the server, so should be used only\n     * when the client has desynced tracking device list deltas from the server.\n     * In MSC4186: Simplified Sliding Sync, this can happen when the server expires the connection.\n     */\n    markAllTrackedUsersAsDirty(): Promise<void>;\n}\n\n/**\n * @internal\n */\nexport interface OnSyncCompletedData {\n    /**\n     * The 'next_batch' result from /sync, which will become the 'since' token for the next call to /sync.\n     */\n    nextSyncToken?: string;\n\n    /**\n     * True if we are working our way through a backlog of events after connecting.\n     */\n    catchingUp?: boolean;\n}\n\n/**\n * The result of a (successful) call to {@link CryptoBackend.decryptEvent}\n */\nexport interface EventDecryptionResult {\n    /**\n     * The plaintext payload for the event (typically containing <tt>type</tt> and <tt>content</tt> fields).\n     */\n    clearEvent: IClearEvent;\n    /**\n     * No longer used.\n     * See {@link MatrixEvent#getForwardingCurve25519KeyChain}.\n     * @deprecated\n     */\n    forwardingCurve25519KeyChain?: string[];\n    /**\n     * Key owned by the sender of this event.  See {@link MatrixEvent#getSenderKey}.\n     */\n    senderCurve25519Key?: string;\n    /**\n     * ed25519 key claimed by the sender of this event. See {@link MatrixEvent#getClaimedEd25519Key}.\n     */\n    claimedEd25519Key?: string;\n\n    /**\n     * If another user forwarded the key to this message\n     * (eg via [MSC4268](https://github.com/matrix-org/matrix-spec-proposals/pull/4268)),\n     * the ID of that user.\n     */\n    keyForwardedBy?: string;\n}\n\n/**\n * Responsible for decrypting megolm session data retrieved from a remote backup.\n * The result of {@link CryptoBackend#getBackupDecryptor}.\n */\nexport interface BackupDecryptor {\n    /**\n     * Whether keys retrieved from this backup can be trusted.\n     *\n     * Depending on the backup algorithm, keys retrieved from the backup can be trusted or not.\n     * If false, keys retrieved from the backup  must be considered unsafe (authenticity cannot be guaranteed).\n     * It could be by design (deniability) or for some technical reason (eg asymmetric encryption).\n     */\n    readonly sourceTrusted: boolean;\n\n    /**\n     *\n     * Decrypt megolm session data retrieved from backup.\n     *\n     * @param ciphertexts - a Record of sessionId to session data.\n     *\n     * @returns An array of decrypted `IMegolmSessionData`\n     */\n    decryptSessions(ciphertexts: Record<string, KeyBackupSession>): Promise<IMegolmSessionData[]>;\n\n    /**\n     * Free any resources held by this decryptor.\n     *\n     * Should be called once the decryptor is no longer needed.\n     */\n    free(): void;\n}\n\n/**\n * Exception thrown when decryption fails\n *\n * @param code - Reason code for the failure.\n *\n * @param msg - user-visible message describing the problem\n *\n * @param details - key/value pairs reported in the logs but not shown\n *   to the user.\n */\nexport class DecryptionError extends Error {\n    public readonly detailedString: string;\n\n    public constructor(\n        public readonly code: DecryptionFailureCode,\n        msg: string,\n        details?: Record<string, string | Error>,\n    ) {\n        super(msg);\n        this.name = \"DecryptionError\";\n        this.detailedString = detailedStringForDecryptionError(this, details);\n    }\n}\n\nfunction detailedStringForDecryptionError(err: DecryptionError, details?: Record<string, string | Error>): string {\n    let result = err.name + \"[msg: \" + err.message;\n\n    if (details) {\n        result +=\n            \", \" +\n            Object.keys(details)\n                .map((k) => k + \": \" + details[k])\n                .join(\", \");\n    }\n\n    result += \"]\";\n\n    return result;\n}\n"],"mappings":";AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AASA;AACA;AACA;AACA;AACA;;AA6FA;AACA;AACA;AACA;AACA;AACA;;AA8BA;AACA;AACA;AACA;;AAsDA;AACA;AACA;;AAaA;AACA;AACA;;AA6BA;AACA;AACA;AACA;;AA6BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAM,eAAe,SAAS,KAAK,CAAC;EAGhC,WAAW,CACE,IAA2B,EAC3C,GAAW,EACX,OAAwC,EAC1C;IACE,KAAK,CAAC,GAAG,CAAC;IAAC;IAAA,KAJK,IAA2B,GAA3B,IAA2B;IAK3C,IAAI,CAAC,IAAI,GAAG,iBAAiB;IAC7B,IAAI,CAAC,cAAc,GAAG,gCAAgC,CAAC,IAAI,EAAE,OAAO,CAAC;EACzE;AACJ;AAEA,SAAS,gCAAgC,CAAC,GAAoB,EAAE,OAAwC,EAAU;EAC9G,IAAI,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,QAAQ,GAAG,GAAG,CAAC,OAAO;EAE9C,IAAI,OAAO,EAAE;IACT,MAAM,IACF,IAAI,GACJ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,GAAG,CAAE,CAAC,IAAK,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CACjC,IAAI,CAAC,IAAI,CAAC;EACvB;EAEA,MAAM,IAAI,GAAG;EAEb,OAAO,MAAM;AACjB","ignoreList":[]}

package/lib/embedded.d.ts

@@ -1,5 +1,5 @@
 import { type WidgetApi } from "matrix-widget-api";
-import { type Transport } from "./matrixrtc/index.ts";
+import { type LivekitDelegateDelayedLeaveRequest, type LivekitGetTokenRequest, type LivekitGetTokenResponse, type Transport } from "./matrixrtc/index.ts";
 import { MatrixEvent } from "./models/event.ts";
 import { type ISendEventResponse, type SendDelayedEventRequestOpts, type SendDelayedEventResponse, UpdateDelayedEventAction } from "./@types/requests.ts";
 import { type StateEvents } from "./@types/event.ts";
@@ -83,6 +83,19 @@ export interface ICapabilities {
      * @defaultValue false
      */
     rtcTransports?: boolean;
+    /**
+     * Whether this client needs to be able to obtain LiveKit SFU tokens through the host.
+     * @experimental Part of MSC4195 & MSC4533
+     * @defaultValue false
+     */
+    rtcLivekitGetToken?: boolean;
+    /**
+     * Whether this client needs to be able to hand delayed MatrixRTC leave events over to the
+     * homeserver through the host.
+     * @experimental Part of MSC4195 & MSC4533
+     * @defaultValue false
+     */
+    rtcLivekitDelegateDelayedLeave?: boolean;
 }
 export declare enum RoomWidgetClientEvent {
     PendingEventsChanged = "PendingEvent.pendingEventsChanged"
@@ -169,6 +182,27 @@ export declare class RoomWidgetClient extends MatrixClient {
      * advertises the `org.matrix.msc4515` API version (otherwise the request throws).
      */
     _unstable_getRTCTransports(): Promise<Transport[]>;
+    /**
+     * Requests a token to authenticate against a LiveKit SFU with.
+     *
+     * Overrides the homeserver-side {@link MatrixClient._unstable_getLivekitToken} (MSC4195): a widget
+     * cannot make authenticated homeserver calls itself, so we ask the host to make the call on our
+     * behalf over the widget API instead (MSC4533). Requires the `rtcLivekitGetToken` capability and a
+     * host that advertises the `org.matrix.msc4533` API version (otherwise the request throws).
+     *
+     * `server_name` defaults to our own homeserver, matching what the endpoint would do server-side.
+     */
+    _unstable_getLivekitToken(body: LivekitGetTokenRequest): Promise<LivekitGetTokenResponse>;
+    /**
+     * Hands over the management of a delayed MatrixRTC leave event to the homeserver.
+     *
+     * Overrides the homeserver-side {@link MatrixClient._unstable_delegateDelayedLeave} (MSC4195): a
+     * widget cannot make authenticated homeserver calls itself, so we ask the host to make the call on
+     * our behalf over the widget API instead (MSC4533). Requires the `rtcLivekitDelegateDelayedLeave`
+     * capability and a host that advertises the `org.matrix.msc4533` API version (otherwise the request
+     * throws).
+     */
+    _unstable_delegateDelayedLeave(body: LivekitDelegateDelayedLeaveRequest): Promise<EmptyObject>;
     queueToDevice({ eventType, batch }: ToDeviceBatch): Promise<void>;
     /**
      * Send an event to a specific list of devices via the widget API. Optionally encrypts the event.

package/lib/embedded.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embedded.d.ts","sourceRoot":"","sources":["../src/embedded.ts"],"names":[],"mappings":"AAgBA,OAAO,EACH,KAAK,SAAS,EAejB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAA4B,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EACH,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,wBAAwB,EAE3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EACH,YAAY,EAEZ,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAW,SAAS,EAAE,MAAM,WAAW,CAAC;AAI/C,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAkB,KAAK,SAAS,EAAwB,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,KAAK,WAAW,EAA4D,MAAM,aAAa,CAAC;AAEzG,UAAU,kBAAkB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC1B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEjC;;OAEG;IACH,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAEpC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,oBAAY,qBAAqB;IAC7B,oBAAoB,sCAAsC;CAC7D;AACD,MAAM,MAAM,eAAe,GAAG;IAAE,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AAE3F;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,YAAY;IAqB1C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAtB3B,OAAO,CAAC,IAAI,CAAC,CAAO;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgB;IAChD,OAAO,CAAC,SAAS,CAAC,CAAkB;IACpC,OAAO,CAAC,SAAS,CAA0B;IAE3C,OAAO,CAAC,wBAAwB,CAAgE;IAChG,OAAO,CAAC,YAAY,CAAmE;IAEvF;;;;;;;;;OASG;IACH,YACqB,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,aAAa,EAC3B,MAAM,EAAE,MAAM,EAC/B,IAAI,EAAE,uBAAuB,EAC7B,iBAAiB,EAAE,OAAO,EAoD7B;IAED,OAAO,CAAC,0BAA0B;IA8DrB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAElD;IAED,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiC;IACpD,WAAW,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgEnE;IAEM,UAAU,IAAI,IAAI,CAOxB;IAEY,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1D;IAED,UAAgB,mBAAmB,CAC/B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,EAClB,SAAS,CAAC,EAAE,SAAS,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B,UAAgB,mBAAmB,CAC/B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,2BAA2B,EACtC,SAAS,CAAC,EAAE,SAAS,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAyElB,cAAc,CACvB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,QAAQ,SAAK,GACd,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;IAED;;OAEG;IACU,+BAA+B,CAAC,CAAC,SAAS,MAAM,WAAW,EACpE,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,2BAA2B,EACtC,SAAS,EAAE,CAAC,EACZ,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EACvB,QAAQ,SAAK,GACd,OAAO,CAAC,wBAAwB,CAAC,CAmBnC;IAED,OAAO,CAAC,gCAAgC;IAOxC;;;;;;OAMG;IACU,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,WAAW,CAAC,CAoBjH;IAED;;OAEG;IACU,qCAAqC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAUxF;IAED;;OAEG;IACU,sCAAsC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAUzF;IAED;;OAEG;IACU,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAUtF;IAED;;OAEG;IACU,sBAAsB,CAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,EAC/C,OAAO,EAAE,eAAe,GACzB,OAAO,CAAC,IAAI,CAAC,CAUf;IAEY,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC,CAKrG;IAEY,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC,CAUnD;IAED;;;;;;;OAOG;IACmB,0BAA0B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAKvE;IAEY,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7E;IAED;;;;;;;;;;;;OAYG;IACU,wBAAwB,CACjC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,OAAO,EAClB,UAAU,EAAE,sBAAsB,GACnC,OAAO,CAAC,IAAI,CAAC,CAIf;IAIY,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAEhD;IAGM,YAAY,IAAI,SAAS,GAAG,IAAI,CAEtC;IAED,OAAO,CAAC,YAAY;YAMN,GAAG;IAIjB,OAAO,CAAC,UAAU,CAwChB;IAEF,OAAO,CAAC,OAAO,CAwCb;IAEF,OAAO,CAAC,UAAU,CAchB;IAEF,OAAO,CAAC,aAAa,CA6BnB;YAEY,gBAAgB;CAyBjC"}
+{"version":3,"file":"embedded.d.ts","sourceRoot":"","sources":["../src/embedded.ts"],"names":[],"mappings":"AAgBA,OAAO,EACH,KAAK,SAAS,EAejB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACH,KAAK,kCAAkC,EACvC,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,SAAS,EACjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAA4B,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EACH,KAAK,kBAAkB,EACvB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,wBAAwB,EAE3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EACH,YAAY,EAEZ,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAW,SAAS,EAAE,MAAM,WAAW,CAAC;AAI/C,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACvF,OAAO,EAAkB,KAAK,SAAS,EAAwB,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,KAAK,WAAW,EAA4D,MAAM,aAAa,CAAC;AAEzG,UAAU,kBAAkB;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC1B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEjC;;OAEG;IACH,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACjC;;OAEG;IACH,YAAY,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAEpC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;OAKG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;CAC5C;AAED,oBAAY,qBAAqB;IAC7B,oBAAoB,sCAAsC;CAC7D;AACD,MAAM,MAAM,eAAe,GAAG;IAAE,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,CAAC;AAE3F;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,YAAY;IAqB1C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAtB3B,OAAO,CAAC,IAAI,CAAC,CAAO;IACpB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgB;IAChD,OAAO,CAAC,SAAS,CAAC,CAAkB;IACpC,OAAO,CAAC,SAAS,CAA0B;IAE3C,OAAO,CAAC,wBAAwB,CAAgE;IAChG,OAAO,CAAC,YAAY,CAAmE;IAEvF;;;;;;;;;OASG;IACH,YACqB,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,aAAa,EAC3B,MAAM,EAAE,MAAM,EAC/B,IAAI,EAAE,uBAAuB,EAC7B,iBAAiB,EAAE,OAAO,EAoD7B;IAED,OAAO,CAAC,0BAA0B;IAoErB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAElD;IAED,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiC;IACpD,WAAW,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkEnE;IAEM,UAAU,IAAI,IAAI,CAOxB;IAEY,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1D;IAED,UAAgB,mBAAmB,CAC/B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,EAClB,SAAS,CAAC,EAAE,SAAS,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B,UAAgB,mBAAmB,CAC/B,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,2BAA2B,EACtC,SAAS,CAAC,EAAE,SAAS,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAyElB,cAAc,CACvB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,GAAG,EACZ,QAAQ,SAAK,GACd,OAAO,CAAC,kBAAkB,CAAC,CAQ7B;IAED;;OAEG;IACU,+BAA+B,CAAC,CAAC,SAAS,MAAM,WAAW,EACpE,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,2BAA2B,EACtC,SAAS,EAAE,CAAC,EACZ,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EACvB,QAAQ,SAAK,GACd,OAAO,CAAC,wBAAwB,CAAC,CAmBnC;IAED,OAAO,CAAC,gCAAgC;IAOxC;;;;;;OAMG;IACU,4BAA4B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,WAAW,CAAC,CAoBjH;IAED;;OAEG;IACU,qCAAqC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAUxF;IAED;;OAEG;IACU,sCAAsC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAUzF;IAED;;OAEG;IACU,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAUtF;IAED;;OAEG;IACU,sBAAsB,CAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,EAC/C,OAAO,EAAE,eAAe,GACzB,OAAO,CAAC,IAAI,CAAC,CAUf;IAEY,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC,CAKrG;IAEY,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC,CAUnD;IAED;;;;;;;OAOG;IACmB,0BAA0B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAKvE;IAED;;;;;;;;;OASG;IACmB,yBAAyB,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAO9G;IAED;;;;;;;;OAQG;IACmB,8BAA8B,CAChD,IAAI,EAAE,kCAAkC,GACzC,OAAO,CAAC,WAAW,CAAC,CAGtB;IAEY,aAAa,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7E;IAED;;;;;;;;;;;;OAYG;IACU,wBAAwB,CACjC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,OAAO,EAClB,UAAU,EAAE,sBAAsB,GACnC,OAAO,CAAC,IAAI,CAAC,CAIf;IAIY,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAEhD;IAGM,YAAY,IAAI,SAAS,GAAG,IAAI,CAEtC;IAED,OAAO,CAAC,YAAY;YAMN,GAAG;IAIjB,OAAO,CAAC,UAAU,CAwChB;IAEF,OAAO,CAAC,OAAO,CAwCb;IAEF,OAAO,CAAC,UAAU,CAchB;IAEF,OAAO,CAAC,aAAa,CA6BnB;YAEY,gBAAgB;CAyBjC"}

package/lib/embedded.js

@@ -260,6 +260,12 @@ export class RoomWidgetClient extends MatrixClient {
     if (capabilities.rtcTransports) {
       this.widgetApi.requestCapability(MatrixCapabilities.MSC4515RtcTransports);
     }
+    if (capabilities.rtcLivekitGetToken) {
+      this.widgetApi.requestCapability(MatrixCapabilities.MSC4533RtcLivekitGetToken);
+    }
+    if (capabilities.rtcLivekitDelegateDelayedLeave) {
+      this.widgetApi.requestCapability(MatrixCapabilities.MSC4533RtcLivekitDelegateDelayedLeave);
+    }
   }
   async supportUpdateState() {
     return (await this.widgetApi.getClientVersions()).includes(UnstableApiVersion.MSC2762_UPDATE_STATE);
@@ -313,7 +319,12 @@ export class RoomWidgetClient extends MatrixClient {
         });
       }) ?? []);
     }
-    this.cachedWellKnown.start(opts.clientWellKnownPollPeriod !== undefined ? 1000 * opts.clientWellKnownPollPeriod : undefined);
+
+    // Only poll the client well-known when a poll period was configured: leaving
+    // `clientWellKnownPollPeriod` undefined disables the lookups entirely.
+    if (opts.clientWellKnownPollPeriod !== undefined) {
+      this.cachedWellKnown.start(1000 * opts.clientWellKnownPollPeriod);
+    }
     this.setSyncState(SyncState.Syncing);
     logger.info("Finished initial sync");
     this.matrixRTC.start();
@@ -520,6 +531,43 @@ export class RoomWidgetClient extends MatrixClient {
     } = await this.widgetApi.getRtcTransports().catch(timeoutToConnectionError);
     return rtcTransports;
   }
+
+  /**
+   * Requests a token to authenticate against a LiveKit SFU with.
+   *
+   * Overrides the homeserver-side {@link MatrixClient._unstable_getLivekitToken} (MSC4195): a widget
+   * cannot make authenticated homeserver calls itself, so we ask the host to make the call on our
+   * behalf over the widget API instead (MSC4533). Requires the `rtcLivekitGetToken` capability and a
+   * host that advertises the `org.matrix.msc4533` API version (otherwise the request throws).
+   *
+   * `server_name` defaults to our own homeserver, matching what the endpoint would do server-side.
+   */
+  async _unstable_getLivekitToken(body) {
+    const serverName = body.server_name ?? this.getDomain();
+    if (serverName === null) throw new Error("Cannot determine the server name to request a token from");
+    const {
+      jwt
+    } = await this.widgetApi.getRtcLivekitToken(_objectSpread(_objectSpread({}, body), {}, {
+      server_name: serverName
+    })).catch(timeoutToConnectionError);
+    return {
+      jwt
+    };
+  }
+
+  /**
+   * Hands over the management of a delayed MatrixRTC leave event to the homeserver.
+   *
+   * Overrides the homeserver-side {@link MatrixClient._unstable_delegateDelayedLeave} (MSC4195): a
+   * widget cannot make authenticated homeserver calls itself, so we ask the host to make the call on
+   * our behalf over the widget API instead (MSC4533). Requires the `rtcLivekitDelegateDelayedLeave`
+   * capability and a host that advertises the `org.matrix.msc4533` API version (otherwise the request
+   * throws).
+   */
+  async _unstable_delegateDelayedLeave(body) {
+    await this.widgetApi.delegateRtcLivekitDelayedLeave(body).catch(timeoutToConnectionError);
+    return {};
+  }
   async queueToDevice({
     eventType,
     batch