matrix-nodejs-homeserver 0.0.0-stage → 0.3.1

package/dist/api/rooms.js

@@ -0,0 +1,1487 @@
+import { isObject } from "../core/json.js";
+import { M, UNSTABLE } from "../core/m.js";
+import { SUPPORTED_ROOM_VERSIONS, roomVersionFeatures, splitStateKey, toClientEvent } from "../core/events.js";
+import { MatrixError, errors } from "../core/errors.js";
+import { isValidAlias, isValidRoomId, isValidUserId, parseId } from "../core/ids.js";
+import { getState, membershipOf, ownerOfStateKey, powerLevels, roomCreators, userLevel } from "../core/authrules.js";
+import { validatePowerLevelContent } from "../core/rooms.js";
+import { assertNotSuspended } from "../core/auth.js";
+import { number, string, unknown } from "../vendor/zod/v4/classic/schemas.js";
+import { body, fail, lenient } from "../http/input.js";
+import { procedure } from "../http/procedure.js";
+import { matchesFilter, parseRoomEventFilter } from "./filters.js";
+//#region src/api/rooms.ts
+const parseToken = (token) => {
+	if (token === null || token === "") return null;
+	const m = /^[st]?(\d+)/.exec(token);
+	if (!m) throw errors.invalidParam("Invalid pagination token");
+	return Number(m[1]);
+};
+const viewerOf = (s) => ({
+	userId: s.userId,
+	deviceId: s.deviceId
+});
+async function requireRoom(hs, roomId) {
+	if (!isValidRoomId(roomId)) throw errors.invalidParam("Invalid room ID");
+	const version = await hs.rooms.roomVersion(roomId);
+	if (!version) throw errors.forbidden("Room not found or you are not a member");
+	return version;
+}
+/**
+* State visible to the user: current state when joined (or world readable),
+* otherwise the state at the moment they left.
+*/
+async function visibleState(hs, roomId, userId) {
+	await requireRoom(hs, roomId);
+	const { joined, worldReadable, membership } = await hs.rooms.canPeek(roomId, userId);
+	if (joined || worldReadable) return hs.rooms.currentState(roomId);
+	if ((await hs.db.findOne("memberships", [{
+		field: "room_id",
+		value: roomId
+	}, {
+		field: "user_id",
+		value: userId
+	}]))?.forgotten) throw errors.forbidden("You have forgotten this room");
+	if (membership === "leave" || membership === "ban") {
+		const ev = await hs.rooms.membershipEvent(roomId, userId);
+		if (ev && ev.pdu.sender !== void 0) {
+			if (ev.pdu.unsigned?.prev_content?.membership === "join" || membership === "ban") return hs.rooms.stateAtSnapshot(ev.snapshot);
+		}
+	}
+	throw errors.forbidden("You are not a member of this room");
+}
+/** A gap event reached by backwards pagination (in the page, or anywhere older when the page ran out). */
+async function findGapBefore(hs, roomId, events, end) {
+	if (!hs.federation.enabled) return null;
+	const inPage = events.find((e) => e.gap);
+	if (inPage) return inPage;
+	if (end !== null) return null;
+	const rows = await hs.db.findMany("events", {
+		where: [{
+			field: "room_id",
+			value: roomId
+		}, {
+			field: "gap",
+			value: true
+		}],
+		limit: 1
+	});
+	return rows[0] ? hs.rooms.rowToStored(rows[0]) : null;
+}
+/** Backfill the history behind a gap event, then clear its gap flag. */
+async function backfillGap(hs, roomId, gapEvent) {
+	const fetched = await hs.federation.backfill(roomId, [gapEvent.pdu.event_id], 100);
+	await hs.db.update("events", [{
+		field: "event_id",
+		value: gapEvent.pdu.event_id
+	}], { gap: false });
+	hs.rooms.forgetEventCache(gapEvent.pdu.event_id);
+	return fetched > 0;
+}
+/** Backfill from other servers when our oldest event has unknown predecessors. Returns whether anything was fetched. */
+async function backfillIfNeeded(hs, roomId) {
+	if (!hs.federation.enabled) return false;
+	const first = (await hs.db.findMany("events", {
+		where: [{
+			field: "room_id",
+			value: roomId
+		}],
+		sortBy: {
+			field: "stream",
+			direction: "asc"
+		},
+		limit: 1
+	}))[0];
+	if (!first || first.type === M.ROOM.CREATE) return false;
+	const prevs = (first.json.prev_events ?? []).map((p) => Array.isArray(p) ? p[0] : p);
+	const known = await hs.rooms.getEvents(prevs);
+	if (prevs.every((p) => known.has(p))) return false;
+	return await hs.federation.backfill(roomId, [first.event_id], 50) > 0;
+}
+function parsePageToken(raw) {
+	if (raw === null || raw === "") return null;
+	const topo = /^t(-?\d+)_(-?\d+)$/.exec(raw);
+	if (topo) return {
+		depth: Number(topo[1]),
+		stream: Number(topo[2])
+	};
+	const stream = /^s?(-?\d+)/.exec(raw);
+	if (stream) return {
+		depth: null,
+		stream: Number(stream[1])
+	};
+	throw errors.invalidParam("Invalid pagination token");
+}
+const topoToken = (ev) => `t${ev.pdu.depth}_${ev.stream}`;
+/** Topological comparison of (depth, stream) pairs. */
+const cmp = (a, b) => a.depth - b.depth || a.stream - b.stream;
+/**
+* Fetch room events in topological order (as /messages requires), applying history
+* visibility and filters, until `limit` events are found.
+*/
+async function paginate(hs, userId, roomId, opts) {
+	const back = opts.dir === "b";
+	const out = [];
+	let cursor = opts.from && opts.from.depth !== null ? {
+		depth: opts.from.depth,
+		stream: opts.from.stream
+	} : null;
+	const streamBound = opts.from && opts.from.depth === null ? opts.from.stream : null;
+	const batch = Math.max(opts.limit * 2, 50);
+	const beyond = (pos) => {
+		if (!opts.to) return false;
+		if (opts.to.depth === null) return back ? pos.stream <= opts.to.stream : pos.stream > opts.to.stream;
+		const c = cmp(pos, {
+			depth: opts.to.depth,
+			stream: opts.to.stream
+		});
+		return back ? c <= 0 : c > 0;
+	};
+	for (;;) {
+		const where = [{
+			field: "room_id",
+			value: roomId
+		}];
+		if (cursor) where.push({
+			field: "depth",
+			operator: back ? "lte" : "gte",
+			value: cursor.depth
+		});
+		if (streamBound !== null) where.push({
+			field: "stream",
+			operator: back ? "lte" : "gt",
+			value: streamBound
+		});
+		let rows = await hs.db.findMany("events", {
+			where,
+			sortBy: {
+				field: "depth",
+				direction: back ? "desc" : "asc"
+			},
+			limit: batch
+		});
+		const full = rows.length === batch;
+		if (full) {
+			const edge = rows[rows.length - 1].depth;
+			rows = rows.filter((r) => r.depth !== edge);
+			rows.push(...await hs.db.findMany("events", { where: [...where, {
+				field: "depth",
+				value: edge
+			}] }));
+		}
+		const stored = rows.map((r) => hs.rooms.rowToStored(r)).map((ev) => ({
+			ev,
+			pos: {
+				depth: ev.pdu.depth,
+				stream: ev.stream
+			}
+		})).filter(({ pos }) => !cursor || (back ? cmp(pos, cursor) < 0 : cmp(pos, cursor) > 0)).sort((a, b) => back ? cmp(b.pos, a.pos) : cmp(a.pos, b.pos));
+		if (stored.length === 0) return {
+			events: out,
+			end: null
+		};
+		const visible = await hs.rooms.filterVisible(userId, roomId, stored.map((x) => x.ev));
+		const visibleById = new Map(visible.map((v) => [v.pdu.event_id, v]));
+		for (const { ev: raw, pos } of stored) {
+			if (beyond(pos)) return {
+				events: out,
+				end: null
+			};
+			cursor = pos;
+			const ev = visibleById.get(raw.pdu.event_id);
+			if (!ev || !matchesFilter(opts.filter, ev.pdu)) continue;
+			out.push(ev);
+			if (out.length >= opts.limit) return {
+				events: out,
+				end: `t${pos.depth}_${pos.stream}`
+			};
+		}
+		if (!full) return {
+			events: out,
+			end: null
+		};
+	}
+}
+/**
+* Invite by email address or phone number (spec "Third-party invites"): invite the Matrix user the
+* identity server knows for it, or store the invite there and emit an m.room.third_party_invite.
+*/
+async function inviteByThreepid(ctx, s, body) {
+	const hs = ctx.hs;
+	const roomId = ctx.params.roomId;
+	for (const k of [
+		"id_server",
+		"id_access_token",
+		"medium",
+		"address"
+	]) if (typeof body[k] !== "string") throw errors.missingParam(`Missing ${k}`);
+	await requireRoom(hs, roomId);
+	await hs.rooms.requireJoined(roomId, s.userId);
+	const mxid = await hs.identityServers.lookup(body.id_server, body.id_access_token, body.medium, body.address);
+	if (mxid) {
+		if (await hs.rooms.membership(roomId, mxid) === "ban") throw errors.forbidden("User is banned");
+		await hs.rooms.invite(roomId, s.userId, mxid);
+		return {};
+	}
+	const state = await hs.rooms.currentState(roomId);
+	const profile = await hs.profile(s.userId);
+	const create = getState(state, M.ROOM.CREATE, "");
+	const invite = {
+		medium: body.medium,
+		address: body.address,
+		room_id: roomId,
+		sender: s.userId,
+		room_alias: getState(state, M.ROOM.CANONICAL_ALIAS, "")?.content?.alias,
+		room_avatar_url: getState(state, M.ROOM.AVATAR, "")?.content?.url,
+		room_join_rules: getState(state, M.ROOM.JOIN_RULES, "")?.content?.join_rule,
+		room_name: getState(state, M.ROOM.NAME, "")?.content?.name,
+		room_type: create?.content?.type,
+		sender_display_name: profile.displayname,
+		sender_avatar_url: profile.avatar_url
+	};
+	for (const k of Object.keys(invite)) if (invite[k] === void 0 || invite[k] === null) delete invite[k];
+	const stored = await hs.identityServers.storeInvite(body.id_server, body.id_access_token, invite);
+	const [first] = stored.public_keys;
+	await hs.rooms.sendEvent(roomId, s.userId, {
+		type: M.ROOM.THIRD_PARTY_INVITE,
+		state_key: stored.token,
+		content: {
+			display_name: stored.display_name,
+			key_validity_url: first?.key_validity_url,
+			public_key: first?.public_key,
+			public_keys: stored.public_keys
+		}
+	});
+	return {};
+}
+async function ownEvent(hs, userId, eventId) {
+	return typeof eventId === "string" && (await hs.rooms.getPdu(eventId))?.sender === userId;
+}
+const membershipBody = body({
+	user_id: lenient(string()),
+	reason: lenient(string())
+});
+async function sendMembership(ctx, membership) {
+	const s = ctx.session;
+	const roomId = ctx.params.roomId;
+	if (membership !== "leave") await assertNotSuspended(ctx.hs, s, roomId);
+	const body = ctx.input;
+	const hs = ctx.hs;
+	const reason = body.reason;
+	if (membership === "leave") {
+		const row = await hs.db.findOne("memberships", [{
+			field: "room_id",
+			value: roomId
+		}, {
+			field: "user_id",
+			value: s.userId
+		}]);
+		if (!await hs.rooms.exists(roomId) && !row) throw errors.notFound("Room not found");
+		const current = await hs.rooms.serverIsJoined(roomId) ? await hs.rooms.membership(roomId, s.userId) : row?.membership ?? "leave";
+		if (current === "leave") return {};
+		if (current === "ban") throw errors.forbidden("You are banned from this room");
+		if (current === "invite" && await hs.admin.isNoticeRoom(roomId)) throw new MatrixError(403, "M_CANNOT_LEAVE_SERVER_NOTICE_ROOM", "Server notice invites cannot be rejected");
+		await hs.rooms.setMembership(roomId, s.userId, s.userId, "leave", reason);
+		return {};
+	}
+	if (!body.user_id || !isValidUserId(body.user_id)) throw errors.invalidParam("Invalid user_id");
+	const target = body.user_id;
+	await requireRoom(hs, roomId);
+	if (membership === "unban") {
+		if (await hs.rooms.membership(roomId, target) !== "ban") throw errors.forbidden("User is not banned");
+		await hs.rooms.setMembership(roomId, s.userId, target, "leave", reason);
+	} else if (membership === "kick") {
+		const current = await hs.rooms.membership(roomId, target);
+		if (current === "leave" || current === "ban") throw errors.forbidden("User is not in the room");
+		await hs.rooms.setMembership(roomId, s.userId, target, "leave", reason);
+	} else await hs.rooms.setMembership(roomId, s.userId, target, "ban", reason);
+	await hs.audit.record({
+		action: membership === "kick" ? "member_kick" : membership === "ban" ? "member_ban" : "member_unban",
+		actor: s.userId,
+		target: body.user_id,
+		ip: ctx.ip,
+		details: {
+			room_id: roomId,
+			reason
+		}
+	});
+	return {};
+}
+async function validateStateEvent(hs, roomId, type, content, stateKeyValue = "") {
+	if (type === M.ROOM.CREATE) throw errors.badJson("The create event cannot be sent");
+	if (stateKeyValue.startsWith("@") && roomVersionFeatures(await hs.rooms.roomVersion(roomId)).ownedState && !ownerOfStateKey(stateKeyValue)) throw errors.badJson("Malformed user-owned state key");
+	if (type === M.ROOM.POWER_LEVELS) {
+		const version = await hs.rooms.roomVersion(roomId);
+		validatePowerLevelContent(content, roomCreators(await hs.rooms.currentState(roomId), version));
+	}
+	if (type === M.ROOM.CANONICAL_ALIAS) {
+		const aliases = [content.alias, ...Array.isArray(content.alt_aliases) ? content.alt_aliases : []].filter((a) => a !== void 0 && a !== null);
+		if (content.alt_aliases !== void 0 && !Array.isArray(content.alt_aliases)) throw new MatrixError(400, "M_INVALID_PARAM", "alt_aliases must be a list");
+		for (const alias of aliases) {
+			if (!isValidAlias(alias)) throw new MatrixError(400, "M_INVALID_PARAM", "Invalid alias");
+			const row = await hs.db.findOne("room_aliases", [{
+				field: "alias",
+				value: alias
+			}]);
+			if (!row || row.room_id !== roomId) throw new MatrixError(400, "M_BAD_ALIAS", `Alias ${alias} does not point to this room`);
+		}
+	}
+}
+async function publicRoomChunk(hs, roomId) {
+	const state = await hs.rooms.currentState(roomId);
+	const get = (t) => getState(state, t)?.content;
+	const chunk = {
+		room_id: roomId,
+		num_joined_members: (await hs.rooms.joinedMembers(roomId)).length,
+		world_readable: get(M.ROOM.HISTORY_VISIBILITY)?.history_visibility === "world_readable",
+		guest_can_join: get(M.ROOM.GUEST_ACCESS)?.guest_access === "can_join",
+		join_rule: get(M.ROOM.JOIN_RULES)?.join_rule ?? "invite"
+	};
+	if (typeof get(M.ROOM.NAME)?.name === "string") chunk.name = get(M.ROOM.NAME).name;
+	if (typeof get(M.ROOM.TOPIC)?.topic === "string") chunk.topic = get(M.ROOM.TOPIC).topic;
+	if (typeof get(M.ROOM.CANONICAL_ALIAS)?.alias === "string") chunk.canonical_alias = get(M.ROOM.CANONICAL_ALIAS).alias;
+	if (typeof get(M.ROOM.AVATAR)?.url === "string") chunk.avatar_url = get(M.ROOM.AVATAR).url;
+	const roomType = get(M.ROOM.CREATE)?.type;
+	if (typeof roomType === "string") chunk.room_type = roomType;
+	return chunk;
+}
+async function publicRooms(ctx, body) {
+	const hs = ctx.hs;
+	const limit = Number(body.limit ?? ctx.query.get("limit") ?? 0) || void 0;
+	const since = body.since ?? ctx.query.get("since");
+	const offset = since ? Number.parseInt(String(since).replace(/^o/, ""), 10) || 0 : 0;
+	const term = isObject(body.filter) && typeof body.filter.generic_search_term === "string" ? body.filter.generic_search_term.toLowerCase() : null;
+	const roomTypes = isObject(body.filter) && Array.isArray(body.filter.room_types) ? body.filter.room_types : null;
+	const rooms = await hs.db.findMany("rooms", {
+		where: [{
+			field: "is_public",
+			value: true
+		}],
+		sortBy: {
+			field: "created_ts",
+			direction: "asc"
+		}
+	});
+	let chunks = await Promise.all(rooms.map((r) => publicRoomChunk(hs, r.room_id)));
+	if (term) chunks = chunks.filter((c) => [
+		c.name,
+		c.topic,
+		c.canonical_alias
+	].some((v) => typeof v === "string" && v.toLowerCase().includes(term)));
+	if (roomTypes) chunks = chunks.filter((c) => roomTypes.includes(c.room_type ?? null));
+	chunks.sort((a, b) => b.num_joined_members - a.num_joined_members);
+	const out = {
+		chunk: limit ? chunks.slice(offset, offset + limit) : chunks.slice(offset),
+		total_room_count_estimate: chunks.length
+	};
+	if (limit && offset + limit < chunks.length) out.next_batch = `o${offset + limit}`;
+	if (offset > 0) out.prev_batch = `o${Math.max(0, offset - (limit ?? 0))}`;
+	return out;
+}
+async function canDeleteAlias(hs, s, alias) {
+	if (alias.creator === s.userId || s.isAdmin) return true;
+	const version = await hs.rooms.roomVersion(alias.room_id);
+	if (!version) return false;
+	const state = await hs.rooms.currentState(alias.room_id);
+	const pl = powerLevels(state, version);
+	const needed = pl.events[M.ROOM.CANONICAL_ALIAS] ?? pl.state_default;
+	return membershipOf(state, s.userId) === "join" && userLevel(pl, s.userId) >= needed;
+}
+async function upgradeRoom(hs, s, roomId, newVersion, additionalCreators) {
+	if (!SUPPORTED_ROOM_VERSIONS.includes(newVersion)) throw errors.unsupportedRoomVersion();
+	const version = await requireRoom(hs, roomId);
+	const state = await hs.rooms.requireJoined(roomId, s.userId);
+	const pl = powerLevels(state, version);
+	const tombstoneLevel = pl.events[M.ROOM.TOMBSTONE] ?? pl.state_default;
+	if (userLevel(pl, s.userId) < tombstoneLevel) throw errors.forbidden("You cannot upgrade this room");
+	const create = getState(state, M.ROOM.CREATE);
+	const creationContent = {};
+	for (const k of [M.FEDERATE, "type"]) if (create.content[k] !== void 0) creationContent[k] = create.content[k];
+	const toV12 = roomVersionFeatures(newVersion).v12;
+	if (toV12) {
+		creationContent.predecessor = { room_id: roomId };
+		if (additionalCreators !== void 0) creationContent.additional_creators = additionalCreators;
+	} else creationContent.predecessor = {
+		room_id: roomId,
+		event_id: (await hs.db.findMany("events", {
+			where: [{
+				field: "room_id",
+				value: roomId
+			}],
+			sortBy: {
+				field: "stream",
+				direction: "desc"
+			},
+			limit: 1
+		}))[0].event_id
+	};
+	const copyTypes = [
+		M.ROOM.SERVER_ACL,
+		M.ROOM.ENCRYPTION,
+		M.ROOM.NAME,
+		M.ROOM.AVATAR,
+		M.ROOM.TOPIC,
+		M.ROOM.GUEST_ACCESS,
+		M.ROOM.HISTORY_VISIBILITY,
+		M.ROOM.JOIN_RULES,
+		M.ROOM.POWER_LEVELS
+	];
+	const initialState = [];
+	for (const t of copyTypes) {
+		const ev = getState(state, t);
+		if (ev && t !== M.ROOM.POWER_LEVELS) initialState.push({
+			type: t,
+			state_key: "",
+			content: ev.content
+		});
+	}
+	let oldPl = structuredClone(getState(state, M.ROOM.POWER_LEVELS)?.content ?? {});
+	const isPublic = (await hs.db.findOne("rooms", [{
+		field: "room_id",
+		value: roomId
+	}]))?.is_public;
+	let override;
+	if (toV12) {
+		const creators = /* @__PURE__ */ new Set([s.userId, ...Array.isArray(additionalCreators) ? additionalCreators : []]);
+		const users = { ...oldPl.users };
+		for (const u of creators) delete users[u];
+		oldPl = {
+			...oldPl,
+			users
+		};
+		override = oldPl;
+	} else {
+		const level = userLevel(pl, s.userId);
+		override = {
+			...oldPl,
+			users: {
+				...oldPl.users,
+				[s.userId]: Number.isFinite(level) ? Math.max(level, 100) : 100
+			}
+		};
+	}
+	const { room_id: newRoomId } = await hs.rooms.createRoom(s.userId, {
+		room_version: newVersion,
+		creation_content: creationContent,
+		initial_state: initialState,
+		power_level_content_override: override,
+		preset: "private_chat",
+		visibility: isPublic ? "public" : "private"
+	});
+	if (getState(state, M.ROOM.POWER_LEVELS) && !toV12) try {
+		await hs.rooms.sendEvent(newRoomId, s.userId, {
+			type: M.ROOM.POWER_LEVELS,
+			state_key: "",
+			content: oldPl
+		});
+	} catch {}
+	const aliases = await hs.db.findMany("room_aliases", { where: [{
+		field: "room_id",
+		value: roomId
+	}] });
+	for (const a of aliases) await hs.db.update("room_aliases", [{
+		field: "alias",
+		value: a.alias
+	}], { room_id: newRoomId });
+	const canonical = getState(state, M.ROOM.CANONICAL_ALIAS);
+	if (canonical && Object.keys(canonical.content).length) {
+		await hs.rooms.sendEvent(roomId, s.userId, {
+			type: M.ROOM.CANONICAL_ALIAS,
+			state_key: "",
+			content: {}
+		}).catch(() => {});
+		await hs.rooms.sendEvent(newRoomId, s.userId, {
+			type: M.ROOM.CANONICAL_ALIAS,
+			state_key: "",
+			content: canonical.content
+		}).catch(() => {});
+	}
+	if (isPublic) await hs.db.update("rooms", [{
+		field: "room_id",
+		value: roomId
+	}], { is_public: false });
+	await hs.rooms.sendEvent(roomId, s.userId, {
+		type: M.ROOM.TOMBSTONE,
+		state_key: "",
+		content: {
+			body: "This room has been replaced",
+			replacement_room: newRoomId
+		}
+	});
+	const restricted = {
+		...oldPl,
+		events_default: Math.max(50, oldPl.events_default ?? 0),
+		invite: Math.max(50, oldPl.invite ?? 0)
+	};
+	await hs.rooms.sendEvent(roomId, s.userId, {
+		type: M.ROOM.POWER_LEVELS,
+		state_key: "",
+		content: restricted
+	}).catch(() => {});
+	return newRoomId;
+}
+function registerRoomRoutes(r) {
+	r.client("POST", "/createRoom", procedure({
+		auth: "user",
+		input: body({}),
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (s.isGuest) throw errors.forbidden("Guests cannot create rooms");
+			await assertNotSuspended(ctx.hs, s);
+			await ctx.rateLimit("createRoom");
+			const created = await ctx.hs.rooms.createRoom(s.userId, ctx.input);
+			await ctx.hs.audit.record({
+				action: "room_create",
+				actor: s.userId,
+				target: created.room_id,
+				ip: ctx.ip
+			});
+			return created;
+		}
+	}));
+	r.client("GET", "/joined_rooms", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			return { joined_rooms: await ctx.hs.rooms.roomsForUser(s.userId) };
+		}
+	}));
+	const joinBody = body({
+		reason: lenient(string()),
+		third_party_signed: unknown().optional()
+	});
+	const join = async (ctx, idOrAlias) => {
+		const s = ctx.session;
+		const body = ctx.input;
+		const { roomId, servers: resolvedServers } = await ctx.hs.rooms.resolveRoom(idOrAlias);
+		await assertNotSuspended(ctx.hs, s, roomId);
+		const { reason, membership, join_authorised_via_users_server, third_party_signed, ...custom } = body;
+		const servers = [
+			...ctx.query.getAll("via"),
+			...ctx.query.getAll("server_name"),
+			...resolvedServers
+		];
+		if (isObject(third_party_signed)) {
+			const signed = third_party_signed;
+			if (typeof signed.sender !== "string" || signed.mxid !== s.userId || typeof signed.token !== "string") throw errors.badJson("Invalid third_party_signed");
+			const sender = signed.sender;
+			const proof = signed;
+			if (await ctx.hs.rooms.membership(roomId, s.userId) !== "invite") {
+				const event = {
+					type: M.ROOM.MEMBER,
+					room_id: roomId,
+					sender,
+					state_key: s.userId,
+					content: {
+						membership: "invite",
+						third_party_invite: { signed: proof }
+					}
+				};
+				if (ctx.hs.isLocalUser(sender)) {
+					const pending = getState(await ctx.hs.rooms.currentState(roomId), M.ROOM.THIRD_PARTY_INVITE, signed.token);
+					if (!pending || pending.sender !== sender) throw errors.forbidden("No such third-party invite");
+					await ctx.hs.rooms.invite(roomId, sender, s.userId, { thirdPartyInvite: {
+						display_name: pending.content?.display_name ?? "",
+						signed: proof
+					} });
+				} else await ctx.hs.federation.client.request(sender.slice(sender.indexOf(":") + 1), "PUT", `/_matrix/federation/v1/exchange_third_party_invite/${encodeURIComponent(roomId)}`, { body: event });
+			}
+		}
+		await ctx.hs.rooms.join(s.userId, roomId, {
+			reason,
+			content: custom,
+			servers
+		});
+		return { room_id: roomId };
+	};
+	r.client("POST", "/rooms/:roomId/join", procedure({
+		auth: "user",
+		rateLimit: "join",
+		input: joinBody,
+		handler: (ctx) => join(ctx, ctx.params.roomId)
+	}));
+	r.client("POST", "/join/:roomIdOrAlias", procedure({
+		auth: "user",
+		rateLimit: "join",
+		input: joinBody,
+		handler: (ctx) => join(ctx, ctx.params.roomIdOrAlias)
+	}));
+	r.client("POST", "/knock/:roomIdOrAlias", procedure({
+		auth: "user",
+		input: body({ reason: lenient(string()) }),
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			const { roomId, servers } = await ctx.hs.rooms.resolveRoom(ctx.params.roomIdOrAlias);
+			await assertNotSuspended(ctx.hs, s, roomId);
+			const via = [
+				...ctx.query.getAll("via"),
+				...ctx.query.getAll("server_name"),
+				...servers
+			];
+			await ctx.hs.rooms.setMembership(roomId, s.userId, s.userId, "knock", body.reason, via);
+			return { room_id: roomId };
+		}
+	}));
+	const inviteBody = body({
+		user_id: lenient(string()),
+		reason: lenient(string())
+	});
+	r.client("POST", "/rooms/:roomId/invite", procedure({
+		auth: "user",
+		input: inviteBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			await assertNotSuspended(ctx.hs, s, ctx.params.roomId);
+			await ctx.rateLimit("invite");
+			if (body.id_server !== void 0 || body.medium !== void 0) return inviteByThreepid(ctx, s, body);
+			if (!body.user_id || !isValidUserId(body.user_id)) throw errors.invalidParam("Invalid user_id");
+			await requireRoom(ctx.hs, ctx.params.roomId);
+			const current = await ctx.hs.rooms.membership(ctx.params.roomId, body.user_id);
+			if (current === "ban") throw errors.forbidden("User is banned");
+			if (current === "join") throw errors.forbidden("User is already joined");
+			await ctx.hs.rooms.invite(ctx.params.roomId, s.userId, body.user_id, { reason: body.reason });
+			return {};
+		}
+	}));
+	r.client("POST", "/rooms/:roomId/leave", procedure({
+		auth: "user",
+		input: membershipBody,
+		handler: (ctx) => sendMembership(ctx, "leave")
+	}));
+	r.client("POST", "/rooms/:roomId/kick", procedure({
+		auth: "user",
+		input: membershipBody,
+		handler: (ctx) => sendMembership(ctx, "kick")
+	}));
+	r.client("POST", "/rooms/:roomId/ban", procedure({
+		auth: "user",
+		input: membershipBody,
+		handler: (ctx) => sendMembership(ctx, "ban")
+	}));
+	r.client("POST", "/rooms/:roomId/unban", procedure({
+		auth: "user",
+		input: membershipBody,
+		handler: (ctx) => sendMembership(ctx, "unban")
+	}));
+	r.client("POST", "/rooms/:roomId/forget", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const row = await hs.db.findOne("memberships", [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}, {
+				field: "user_id",
+				value: s.userId
+			}]);
+			if (!row) throw errors.notFound("Not a member of this room");
+			if (row.membership === "join" || row.membership === "invite" || row.membership === "knock") throw errors.unknown("You must leave the room before forgetting it");
+			await hs.db.update("memberships", [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}, {
+				field: "user_id",
+				value: s.userId
+			}], { forgotten: true });
+			return {};
+		}
+	}));
+	r.client("PUT", "/rooms/:roomId/send/:eventType/:txnId", procedure({
+		auth: "user",
+		rateLimit: "message",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const content = await ctx.json();
+			await requireRoom(ctx.hs, ctx.params.roomId);
+			if (!(s.suspended && ctx.params.eventType === M.ROOM.REDACTION && await ownEvent(ctx.hs, s.userId, content?.redacts))) await assertNotSuspended(ctx.hs, s, ctx.params.roomId);
+			const delay = ctx.query.get(UNSTABLE.ORG.MATRIX.MSC4140.DELAY);
+			if (delay !== null) return { delay_id: await ctx.hs.delayedEvents.schedule({
+				userId: s.userId,
+				deviceId: s.deviceId,
+				roomId: ctx.params.roomId,
+				type: ctx.params.eventType,
+				content,
+				delayMs: Number(delay),
+				txnId: ctx.params.txnId
+			}) };
+			const ts = s.appservice && ctx.query.get("ts") ? Number(ctx.query.get("ts")) : void 0;
+			return { event_id: await ctx.hs.rooms.sendEvent(ctx.params.roomId, s.userId, {
+				type: ctx.params.eventType,
+				content
+			}, {
+				txnId: ctx.params.txnId,
+				deviceId: s.deviceId || void 0,
+				ts
+			}) };
+		}
+	}));
+	const putState = async (ctx) => {
+		const s = await ctx.auth();
+		const content = await ctx.json();
+		const roomId = ctx.params.roomId;
+		await requireRoom(ctx.hs, roomId);
+		const type = ctx.params.eventType;
+		const key = ctx.params.stateKey ?? "";
+		if (!(type === M.ROOM.MEMBER && key === s.userId && content?.membership === "leave")) await assertNotSuspended(ctx.hs, s, roomId);
+		await validateStateEvent(ctx.hs, roomId, type, content, key);
+		const delay = ctx.query.get(UNSTABLE.ORG.MATRIX.MSC4140.DELAY);
+		if (delay !== null) return { delay_id: await ctx.hs.delayedEvents.schedule({
+			userId: s.userId,
+			deviceId: s.deviceId,
+			roomId,
+			type,
+			stateKey: key,
+			content,
+			delayMs: Number(delay)
+		}) };
+		const current = getState(await ctx.hs.rooms.currentState(roomId), type, key);
+		if (current && current.sender === s.userId && JSON.stringify(current.content) === JSON.stringify(content)) return { event_id: current.event_id };
+		const ts = s.appservice && ctx.query.get("ts") ? Number(ctx.query.get("ts")) : void 0;
+		return { event_id: await ctx.hs.rooms.sendEvent(roomId, s.userId, {
+			type,
+			state_key: key,
+			content
+		}, { ts }) };
+	};
+	r.client("PUT", "/rooms/:roomId/state/:eventType", procedure({ handler: putState }));
+	r.client("PUT", "/rooms/:roomId/state/:eventType/:stateKey", procedure({ handler: putState }));
+	const getStateEvent = async (ctx) => {
+		const s = await ctx.auth();
+		const state = await visibleState(ctx.hs, ctx.params.roomId, s.userId);
+		const ev = getState(state, ctx.params.eventType, ctx.params.stateKey ?? "");
+		if (!ev) throw errors.notFound("State event not found");
+		if (ctx.query.get("format") === "event") return ctx.hs.rooms.formatEvent({
+			pdu: ev,
+			stream: 0,
+			snapshot: 0,
+			txnId: null,
+			txnToken: null
+		});
+		return ev.content;
+	};
+	r.client("GET", "/rooms/:roomId/state/:eventType", procedure({ handler: getStateEvent }));
+	r.client("GET", "/rooms/:roomId/state/:eventType/:stateKey", procedure({ handler: getStateEvent }));
+	r.client("GET", "/rooms/:roomId/state", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			return [...(await visibleState(ctx.hs, ctx.params.roomId, s.userId)).values()].map((ev) => toClientEvent(ev));
+		}
+	}));
+	r.client("GET", "/rooms/:roomId/members", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			await hs.partialState.waitForFullState(ctx.params.roomId, ctx.request.signal);
+			let state = await visibleState(hs, ctx.params.roomId, s.userId);
+			const at = parseToken(ctx.query.get("at"));
+			if (at !== null) {
+				const rows = await hs.db.findMany("events", {
+					where: [{
+						field: "room_id",
+						value: ctx.params.roomId
+					}, {
+						field: "stream",
+						operator: "lte",
+						value: at
+					}],
+					sortBy: {
+						field: "stream",
+						direction: "desc"
+					},
+					limit: 1
+				});
+				if (rows[0]) state = await hs.rooms.stateAtSnapshot(rows[0].state_snapshot);
+				else {
+					const first = await hs.db.findMany("events", {
+						where: [{
+							field: "room_id",
+							value: ctx.params.roomId
+						}],
+						sortBy: {
+							field: "stream",
+							direction: "asc"
+						},
+						limit: 2
+					});
+					if (first.length) state = await hs.rooms.stateAtSnapshot(first[first.length - 1].state_snapshot);
+				}
+			}
+			const membership = ctx.query.get("membership");
+			const notMembership = ctx.query.get("not_membership");
+			const chunk = [];
+			for (const [k, ev] of state) {
+				if (splitStateKey(k)[0] !== M.ROOM.MEMBER) continue;
+				const m = ev.content?.membership;
+				if (membership && m !== membership) continue;
+				if (notMembership && m === notMembership) continue;
+				chunk.push(toClientEvent(ev));
+			}
+			return { chunk };
+		}
+	}));
+	r.client("GET", "/rooms/:roomId/joined_members", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			await requireRoom(ctx.hs, ctx.params.roomId);
+			await ctx.hs.partialState.waitForFullState(ctx.params.roomId, ctx.request.signal);
+			const { joined: isJoined, worldReadable } = await ctx.hs.rooms.canPeek(ctx.params.roomId, s.userId);
+			if (!isJoined && !worldReadable) throw errors.forbidden("You are not joined to this room");
+			const state = await ctx.hs.rooms.currentState(ctx.params.roomId);
+			const joined = {};
+			for (const [k, ev] of state) {
+				const [type, key] = splitStateKey(k);
+				if (type !== M.ROOM.MEMBER || ev.content?.membership !== "join") continue;
+				joined[key] = {
+					display_name: ev.content.displayname ?? null,
+					avatar_url: ev.content.avatar_url ?? null
+				};
+			}
+			return { joined };
+		}
+	}));
+	r.client("GET", "/rooms/:roomId/messages", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const roomId = ctx.params.roomId;
+			await visibleState(hs, roomId, s.userId);
+			const dir = ctx.query.get("dir") ?? "b";
+			if (dir !== "b" && dir !== "f") throw errors.invalidParam("dir must be 'b' or 'f'");
+			const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 1), 1e3);
+			const filter = parseRoomEventFilter(ctx);
+			const fromRaw = ctx.query.get("from");
+			const from = parsePageToken(fromRaw) ?? (dir === "b" ? {
+				depth: null,
+				stream: await hs.streams.position()
+			} : null);
+			const to = parsePageToken(ctx.query.get("to"));
+			let { events, end } = await paginate(hs, s.userId, roomId, {
+				from,
+				to,
+				dir,
+				limit: filter?.limit ?? limit,
+				filter
+			});
+			for (let attempt = 0; attempt < 3 && dir === "b"; attempt++) {
+				const gapEvent = await findGapBefore(hs, roomId, events, end);
+				if (!(gapEvent ? await backfillGap(hs, roomId, gapEvent) : end === null && events.length < (filter?.limit ?? limit) && await backfillIfNeeded(hs, roomId))) break;
+				({events, end} = await paginate(hs, s.userId, roomId, {
+					from,
+					to,
+					dir,
+					limit: filter?.limit ?? limit,
+					filter
+				}));
+			}
+			const out = {
+				chunk: events.map((e) => hs.rooms.formatEvent(e, viewerOf(s))),
+				start: fromRaw ?? (from ? from.depth === null ? `s${from.stream}` : `t${from.depth}_${from.stream}` : "t0_0")
+			};
+			if (end !== null) out.end = end;
+			else if (events.length) out.end = topoToken(events[events.length - 1]);
+			if (filter?.lazy_load_members) {
+				const current = await hs.rooms.currentState(roomId);
+				out.state = [...new Set(events.map((e) => e.pdu.sender))].map((u) => getState(current, M.ROOM.MEMBER, u)).filter(Boolean).map((e) => toClientEvent(e));
+			}
+			return out;
+		}
+	}));
+	r.client("GET", "/rooms/:roomId/event/:eventId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			await requireRoom(hs, ctx.params.roomId);
+			const ev = await hs.rooms.getEvent(ctx.params.eventId);
+			if (!ev || ev.pdu.room_id !== ctx.params.roomId) throw errors.notFound("Event not found");
+			if ((await hs.rooms.filterVisible(s.userId, ctx.params.roomId, [ev])).length === 0) throw errors.notFound("Event not found");
+			return hs.rooms.formatEvent(ev, viewerOf(s));
+		}
+	}));
+	r.client("GET", "/rooms/:roomId/context/:eventId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const roomId = ctx.params.roomId;
+			await requireRoom(hs, roomId);
+			const ev = await hs.rooms.getEvent(ctx.params.eventId);
+			if (!ev || ev.pdu.room_id !== roomId || (await hs.rooms.filterVisible(s.userId, roomId, [ev])).length === 0) throw errors.notFound("Event not found");
+			const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 0), 100);
+			const filter = parseRoomEventFilter(ctx);
+			const here = {
+				depth: ev.pdu.depth,
+				stream: ev.stream
+			};
+			const before = await paginate(hs, s.userId, roomId, {
+				from: here,
+				to: null,
+				dir: "b",
+				limit: Math.floor(limit / 2) || (limit ? 1 : 0),
+				filter
+			});
+			const after = await paginate(hs, s.userId, roomId, {
+				from: here,
+				to: null,
+				dir: "f",
+				limit: Math.ceil(limit / 2),
+				filter
+			});
+			const beforeEvents = limit ? before.events : [];
+			const afterEvents = limit ? after.events : [];
+			const state = await hs.rooms.stateAtSnapshot(ev.snapshot);
+			return {
+				event: hs.rooms.formatEvent(ev, viewerOf(s)),
+				events_before: beforeEvents.map((e) => hs.rooms.formatEvent(e, viewerOf(s))),
+				events_after: afterEvents.map((e) => hs.rooms.formatEvent(e, viewerOf(s))),
+				start: topoToken(beforeEvents.length ? beforeEvents[beforeEvents.length - 1] : ev),
+				end: topoToken(afterEvents.length ? afterEvents[afterEvents.length - 1] : ev),
+				state: [...state.values()].map((e) => toClientEvent(e))
+			};
+		}
+	}));
+	r.client("PUT", "/rooms/:roomId/redact/:eventId/:txnId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = await ctx.json();
+			const roomId = ctx.params.roomId;
+			await requireRoom(ctx.hs, roomId);
+			if (!await ownEvent(ctx.hs, s.userId, ctx.params.eventId)) await assertNotSuspended(ctx.hs, s, roomId);
+			await ctx.hs.rooms.checkRedactionAllowed(roomId, s.userId, ctx.params.eventId);
+			const content = {};
+			if (typeof body.reason === "string") content.reason = body.reason;
+			return { event_id: await ctx.hs.rooms.sendEvent(roomId, s.userId, {
+				type: M.ROOM.REDACTION,
+				content,
+				redacts: ctx.params.eventId
+			}, {
+				txnId: ctx.params.txnId,
+				deviceId: s.deviceId
+			}) };
+		}
+	}));
+	r.client("PUT", "/rooms/:roomId/typing/:userId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot set typing for another user");
+			const body = await ctx.json();
+			if (typeof body.typing !== "boolean") throw errors.badJson("typing must be a boolean");
+			await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
+			await ctx.hs.typing.setTyping(ctx.params.roomId, s.userId, body.typing, Number(body.timeout) || 3e4);
+			return {};
+		}
+	}));
+	const RECEIPT_TYPES = [
+		M.READ._,
+		M.READ.PRIVATE,
+		M.FULLY_READ
+	];
+	const setReceipt = async (hs, s, roomId, type, eventId, threadId) => {
+		if (type === M.FULLY_READ) {
+			await hs.streams.write((stream) => hs.db.upsert("account_data", {
+				user_id: s.userId,
+				room_id: roomId,
+				type: M.FULLY_READ,
+				content: { event_id: eventId },
+				stream
+			}));
+			hs.notifier.notify([s.userId]);
+			return;
+		}
+		const ev = await hs.rooms.getEvent(eventId);
+		if (!ev || ev.pdu.room_id !== roomId) throw errors.notFound("Event not found");
+		await hs.streams.write((stream) => hs.db.upsert("receipts", {
+			room_id: roomId,
+			user_id: s.userId,
+			receipt_type: type,
+			thread_id: threadId ?? "",
+			event_id: eventId,
+			ts: Date.now(),
+			stream
+		}));
+		hs.notifier.notify(type === M.READ.PRIVATE ? [s.userId] : await hs.rooms.joinedMembers(roomId));
+		await hs.federation.onReceipt(roomId, s.userId, type, eventId, Date.now(), threadId ?? "").catch(() => {});
+	};
+	const receiptBody = body({ thread_id: string(fail("M_INVALID_PARAM", "Invalid thread_id")).min(1, "M_INVALID_PARAM: Invalid thread_id").optional() });
+	r.client("POST", "/rooms/:roomId/receipt/:receiptType/:eventId", procedure({
+		auth: "user",
+		input: receiptBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (!RECEIPT_TYPES.includes(ctx.params.receiptType)) throw errors.invalidParam("Unknown receipt type");
+			const body = ctx.input;
+			await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
+			await setReceipt(ctx.hs, s, ctx.params.roomId, ctx.params.receiptType, ctx.params.eventId, body.thread_id);
+			return {};
+		}
+	}));
+	r.client("POST", "/rooms/:roomId/read_markers", procedure({
+		auth: "user",
+		input: body({}),
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
+			for (const type of RECEIPT_TYPES) {
+				const eventId = body[type];
+				if (typeof eventId === "string") await setReceipt(ctx.hs, s, ctx.params.roomId, type, eventId);
+			}
+			return {};
+		}
+	}));
+	r.client("GET", "/directory/room/:alias", procedure({ handler: async (ctx) => {
+		if (!isValidAlias(ctx.params.alias)) throw errors.invalidParam("Invalid alias");
+		const { roomId, servers } = await ctx.hs.rooms.resolveRoom(ctx.params.alias);
+		const inRoom = await ctx.hs.rooms.exists(roomId) ? [...await ctx.hs.federation.roomDestinations(roomId, await ctx.hs.rooms.currentState(roomId))] : [];
+		return {
+			room_id: roomId,
+			servers: [.../* @__PURE__ */ new Set([...servers, ...inRoom])]
+		};
+	} }));
+	r.client("PUT", "/directory/room/:alias", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = await ctx.json();
+			const alias = ctx.params.alias;
+			if (!isValidAlias(alias) || /\s/.test(alias)) throw errors.invalidParam("Invalid alias");
+			if (parseId(alias, "#").server !== ctx.hs.serverName) throw errors.invalidParam("Alias must be on this server");
+			if (!isValidRoomId(body.room_id)) throw errors.invalidParam("Invalid room_id");
+			if (!await ctx.hs.rooms.exists(body.room_id)) throw errors.notFound("Room not found");
+			const owner = ctx.hs.appservices.exclusiveAliasOwner(alias);
+			if (owner && s.appservice !== owner) throw errors.exclusive("This alias is reserved by an application service");
+			if (await ctx.hs.db.findOne("room_aliases", [{
+				field: "alias",
+				value: alias
+			}])) throw new MatrixError(409, "M_UNKNOWN", "Room alias already exists");
+			await ctx.hs.db.create("room_aliases", {
+				alias,
+				room_id: body.room_id,
+				creator: s.userId
+			});
+			return {};
+		}
+	}));
+	r.client("DELETE", "/directory/room/:alias", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const row = await ctx.hs.db.findOne("room_aliases", [{
+				field: "alias",
+				value: ctx.params.alias
+			}]);
+			if (!row) throw errors.notFound("Room alias not found");
+			if (!await canDeleteAlias(ctx.hs, s, row)) throw errors.forbidden("You may not delete this alias");
+			await ctx.hs.db.delete("room_aliases", [{
+				field: "alias",
+				value: ctx.params.alias
+			}]);
+			const canonical = getState(await ctx.hs.rooms.currentState(row.room_id), M.ROOM.CANONICAL_ALIAS);
+			if (canonical) {
+				const content = { ...canonical.content };
+				let changed = false;
+				if (content.alias === ctx.params.alias) {
+					delete content.alias;
+					changed = true;
+				}
+				if (Array.isArray(content.alt_aliases) && content.alt_aliases.includes(ctx.params.alias)) {
+					content.alt_aliases = content.alt_aliases.filter((a) => a !== ctx.params.alias);
+					changed = true;
+				}
+				if (changed) await ctx.hs.rooms.sendEvent(row.room_id, s.userId, {
+					type: M.ROOM.CANONICAL_ALIAS,
+					state_key: "",
+					content
+				}).catch(() => {});
+			}
+			return {};
+		}
+	}));
+	r.client("GET", "/rooms/:roomId/aliases", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			await visibleState(ctx.hs, ctx.params.roomId, s.userId);
+			return { aliases: (await ctx.hs.db.findMany("room_aliases", { where: [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}] })).map((r) => r.alias) };
+		}
+	}));
+	r.client("GET", "/directory/list/room/:roomId", procedure({ handler: async (ctx) => {
+		const row = await ctx.hs.db.findOne("rooms", [{
+			field: "room_id",
+			value: ctx.params.roomId
+		}]);
+		if (!row) throw errors.notFound("Room not found");
+		return { visibility: row.is_public ? "public" : "private" };
+	} }));
+	r.client("PUT", "/directory/list/room/:roomId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = await ctx.json();
+			if (!["public", "private"].includes(body.visibility)) throw errors.invalidParam("Invalid visibility");
+			const version = await ctx.hs.rooms.roomVersion(ctx.params.roomId);
+			if (!version) throw errors.notFound("Room not found");
+			const state = await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
+			const pl = powerLevels(state, version);
+			if (!s.isAdmin && userLevel(pl, s.userId) < (pl.events[M.ROOM.CANONICAL_ALIAS] ?? pl.state_default)) throw errors.forbidden("Insufficient power level");
+			await ctx.hs.db.update("rooms", [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}], { is_public: body.visibility === "public" });
+			return {};
+		}
+	}));
+	const remoteOrLocal = async (ctx, body) => {
+		const server = ctx.query.get("server");
+		if (server && server !== ctx.hs.serverName) {
+			const query = { ...body };
+			if (ctx.query.get("limit")) query.limit = Number(ctx.query.get("limit"));
+			if (ctx.query.get("since")) query.since = ctx.query.get("since");
+			return ctx.hs.federation.queryPublicRooms(server, query);
+		}
+		return publicRooms(ctx, body);
+	};
+	r.client("GET", "/publicRooms", procedure({ handler: (ctx) => remoteOrLocal(ctx, {}) }));
+	r.client("POST", "/publicRooms", procedure({
+		auth: "user",
+		input: body({}),
+		handler: async (ctx) => {
+			return remoteOrLocal(ctx, ctx.input);
+		}
+	}));
+	const upgradeBody = body({
+		new_version: string(fail("M_BAD_JSON", "Missing new_version")),
+		additional_creators: unknown().optional()
+	});
+	r.client("POST", "/rooms/:roomId/upgrade", procedure({
+		auth: "user",
+		input: upgradeBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			return { replacement_room: await upgradeRoom(ctx.hs, s, ctx.params.roomId, body.new_version, body.additional_creators) };
+		}
+	}));
+	const reportBody = body({
+		score: number(fail("M_INVALID_PARAM", "score must be between -100 and 0")).int("M_INVALID_PARAM: score must be between -100 and 0").min(-100, "M_INVALID_PARAM: score must be between -100 and 0").max(0, "M_INVALID_PARAM: score must be between -100 and 0").optional(),
+		reason: string(fail("M_BAD_JSON", "reason must be a string")).optional()
+	});
+	const report = async (ctx) => {
+		const s = ctx.session;
+		const hs = ctx.hs;
+		const roomId = ctx.params.roomId;
+		await requireRoom(hs, roomId);
+		if (ctx.params.eventId) {
+			const ev = await hs.rooms.getEvent(ctx.params.eventId);
+			if (!ev || ev.pdu.room_id !== roomId || !(await hs.rooms.filterVisible(s.userId, roomId, [ev])).length) throw errors.notFound("Event not found");
+		} else if (await hs.rooms.membership(roomId, s.userId) !== "join") throw errors.notFound("Room not found");
+		const body = ctx.input;
+		const id = await hs.cluster.nextId("event_reports");
+		await hs.db.create("event_reports", {
+			id,
+			ts: Date.now(),
+			room_id: roomId,
+			event_id: ctx.params.eventId ?? null,
+			reporter: s.userId,
+			reason: body.reason ?? null,
+			score: body.score ?? null,
+			resolved: false
+		});
+		await hs.audit.record({
+			action: "event_report",
+			actor: s.userId,
+			target: ctx.params.eventId ?? roomId,
+			details: {
+				room_id: roomId,
+				report_id: id
+			}
+		});
+		if (hs.adminRoom) hs.adminRoom.say(`New report #${id} from ${s.userId} about ${ctx.params.eventId ?? "room"} in ${roomId}: ${body.reason ?? "(no reason)"}`).catch(() => {});
+		return {};
+	};
+	r.client("POST", "/users/:userId/report", procedure({
+		auth: "user",
+		input: body({ reason: string(fail("M_BAD_JSON", "reason must be a string")) }),
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const body = ctx.input;
+			const userId = ctx.params.userId;
+			if (!isValidUserId(userId)) throw errors.invalidParam("Invalid user ID");
+			if (hs.isLocalUser(userId) && !await hs.db.findOne("users", [{
+				field: "user_id",
+				value: userId
+			}])) throw errors.notFound("Unknown user");
+			const id = await hs.cluster.nextId("user_reports");
+			await hs.db.create("user_reports", {
+				id,
+				ts: Date.now(),
+				user_id: userId,
+				reporter: s.userId,
+				reason: body.reason,
+				resolved: false
+			});
+			await hs.audit.record({
+				action: "user_report",
+				actor: s.userId,
+				target: userId,
+				details: { report_id: id }
+			});
+			if (hs.adminRoom) hs.adminRoom.say(`New user report #${id} from ${s.userId} about ${userId}: ${body.reason || "(no reason)"}`).catch(() => {});
+			return {};
+		}
+	}));
+	r.client("GET", "/mutual_rooms", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const other = ctx.query.get("user_id");
+			if (other === null) throw errors.missingParam("Missing user_id");
+			if (!isValidUserId(other)) throw errors.invalidParam("Invalid user_id");
+			if (other === s.userId) throw errors.invalidParam("user_id must not be your own");
+			const theirs = new Set(await ctx.hs.rooms.roomsForUser(other));
+			const joined = (await ctx.hs.rooms.roomsForUser(s.userId)).filter((r) => theirs.has(r)).sort();
+			const from = ctx.query.get("from");
+			const start = from === null ? 0 : joined.findIndex((r) => r > from);
+			if (from !== null && !isValidRoomId(from)) throw errors.invalidParam("Invalid from token");
+			const page = start < 0 ? [] : joined.slice(start, start + 100);
+			const out = {
+				joined: page,
+				count: joined.length
+			};
+			if (start >= 0 && start + 100 < joined.length) out.next_batch = page[page.length - 1];
+			return out;
+		}
+	}), ["v1"]);
+	r.client("POST", "/rooms/:roomId/report/:eventId", procedure({
+		auth: "user",
+		input: reportBody,
+		handler: report
+	}));
+	r.client("POST", "/rooms/:roomId/report", procedure({
+		auth: "user",
+		input: reportBody,
+		handler: report
+	}));
+	r.client("GET", "/admin/whois/:userId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const userId = ctx.params.userId;
+			if (userId !== s.userId && !s.isAdmin) throw errors.forbidden("Only server admins can look up other users");
+			if (!ctx.hs.isLocalUser(userId)) throw errors.notFound("Unknown user");
+			const devices = await ctx.hs.db.findMany("devices", { where: [{
+				field: "user_id",
+				value: userId
+			}] });
+			const out = {};
+			for (const d of devices) out[d.device_id] = { sessions: [{ connections: d.last_seen_ip ? [{
+				ip: d.last_seen_ip,
+				last_seen: d.last_seen_ts
+			}] : [] }] };
+			return {
+				user_id: userId,
+				devices: out
+			};
+		}
+	}));
+	r.client("PUT", "/directory/list/appservice/:networkId/:roomId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			if (!ctx.session.appservice) throw errors.forbidden("Only application services may use this endpoint");
+			const body = await ctx.json();
+			if (!["public", "private"].includes(body.visibility)) throw errors.invalidParam("Invalid visibility");
+			if (!await ctx.hs.rooms.exists(ctx.params.roomId)) throw errors.notFound("Room not found");
+			await ctx.hs.db.update("rooms", [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}], { is_public: body.visibility === "public" });
+			return {};
+		}
+	}));
+	const relVersions = ["v1", "v3"];
+	r.client("GET", "/rooms/:roomId/relations/:eventId", procedure({ handler: relations }), relVersions);
+	r.client("GET", "/rooms/:roomId/relations/:eventId/:relType", procedure({ handler: relations }), relVersions);
+	r.client("GET", "/rooms/:roomId/relations/:eventId/:relType/:eventType", procedure({ handler: relations }), relVersions);
+	r.client("GET", "/rooms/:roomId/threads", procedure({ handler: threads }), ["v1"]);
+	r.client("GET", "/rooms/:roomId/timestamp_to_event", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const roomId = ctx.params.roomId;
+			await visibleState(hs, roomId, s.userId);
+			const ts = Number(ctx.query.get("ts"));
+			const dir = ctx.query.get("dir");
+			if (!Number.isFinite(ts) || dir !== "f" && dir !== "b") throw errors.invalidParam("Invalid ts or dir");
+			let local = null;
+			const rows = await hs.db.findMany("events", { where: [{
+				field: "room_id",
+				value: roomId
+			}] });
+			rows.sort((a, b) => dir === "f" ? a.json.origin_server_ts - b.json.origin_server_ts || a.depth - b.depth || a.stream - b.stream : b.json.origin_server_ts - a.json.origin_server_ts || b.depth - a.depth || b.stream - a.stream);
+			for (const row of rows) {
+				const t = row.json.origin_server_ts;
+				if (!(dir === "f" ? t >= ts : t <= ts)) continue;
+				if ((await hs.rooms.filterVisible(s.userId, roomId, [hs.rooms.rowToStored(row)])).length) {
+					local = {
+						event_id: row.event_id,
+						origin_server_ts: t
+					};
+					break;
+				}
+			}
+			if (hs.federation.enabled) for (const server of hs.federation.serversInRoom(await hs.rooms.currentState(roomId))) try {
+				const remote = await hs.federation.client.request(server, "GET", `/_matrix/federation/v1/timestamp_to_event/${encodeURIComponent(roomId)}`, {
+					query: {
+						ts: String(ts),
+						dir
+					},
+					timeoutMs: 1e4
+				});
+				if (typeof remote.event_id !== "string" || typeof remote.origin_server_ts !== "number") continue;
+				if (!local || (dir === "f" ? remote.origin_server_ts < local.origin_server_ts : remote.origin_server_ts > local.origin_server_ts)) {
+					if (!await hs.rooms.getEvent(remote.event_id)) await hs.federation.backfill(roomId, [remote.event_id], 1).catch(() => 0);
+					local = {
+						event_id: remote.event_id,
+						origin_server_ts: remote.origin_server_ts
+					};
+				}
+				break;
+			} catch {}
+			if (!local) throw errors.notFound("No event found");
+			return local;
+		}
+	}), ["v1", "v3"]);
+}
+async function relations(ctx) {
+	const s = await ctx.auth();
+	const hs = ctx.hs;
+	const roomId = ctx.params.roomId;
+	await visibleState(hs, roomId, s.userId);
+	const parent = await hs.rooms.getEvent(ctx.params.eventId);
+	if (!parent || parent.pdu.room_id !== roomId) throw errors.notFound("Event not found");
+	const dir = ctx.query.get("dir") === "f" ? "f" : "b";
+	const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "50", 10) || 50, 1), 1e3);
+	const from = parseToken(ctx.query.get("from"));
+	const rows = await hs.db.findMany("events", {
+		where: [{
+			field: "room_id",
+			value: roomId
+		}, ...from !== null ? [{
+			field: "stream",
+			operator: dir === "b" ? "lte" : "gt",
+			value: from
+		}] : []],
+		sortBy: {
+			field: "stream",
+			direction: dir === "b" ? "desc" : "asc"
+		}
+	});
+	const matches = [];
+	let next = null;
+	for (const row of rows) {
+		const rel = row.json.content?.[M.RELATES_TO];
+		if (!isObject(rel) || rel.event_id !== ctx.params.eventId) continue;
+		if (ctx.params.relType && rel.rel_type !== ctx.params.relType) continue;
+		if (ctx.params.eventType && row.type !== ctx.params.eventType) continue;
+		const stored = hs.rooms.rowToStored(row);
+		if ((await hs.rooms.filterVisible(s.userId, roomId, [stored])).length === 0) continue;
+		if (matches.length >= limit) {
+			next = dir === "b" ? matches[matches.length - 1].stream - 1 : matches[matches.length - 1].stream;
+			break;
+		}
+		matches.push(stored);
+	}
+	const out = { chunk: matches.map((e) => hs.rooms.formatEvent(e, {
+		userId: s.userId,
+		deviceId: s.deviceId
+	})) };
+	if (next !== null) out.next_batch = `s${next}`;
+	return out;
+}
+/** `GET /rooms/{roomId}/threads`: thread roots, most recently active first. */
+async function threads(ctx) {
+	const s = await ctx.auth();
+	const hs = ctx.hs;
+	const roomId = ctx.params.roomId;
+	await visibleState(hs, roomId, s.userId);
+	const include = ctx.query.get("include") === "participated" ? "participated" : "all";
+	const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "50", 10) || 50, 1), 1e3);
+	const from = parseToken(ctx.query.get("from"));
+	const rows = await hs.db.findMany("events", {
+		where: [{
+			field: "room_id",
+			value: roomId
+		}],
+		sortBy: {
+			field: "stream",
+			direction: "desc"
+		}
+	});
+	const latest = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const rel = row.json.content?.[M.RELATES_TO];
+		if (!isObject(rel) || rel.rel_type !== M.THREAD || typeof rel.event_id !== "string") continue;
+		const entry = latest.get(rel.event_id) ?? {
+			stream: row.stream,
+			latestId: row.event_id,
+			count: 0,
+			participants: /* @__PURE__ */ new Set()
+		};
+		entry.participants.add(row.sender);
+		entry.count++;
+		latest.set(rel.event_id, entry);
+	}
+	const roots = [];
+	for (const [rootId, info] of latest) {
+		const root = await hs.rooms.getEvent(rootId);
+		if (!root || root.pdu.room_id !== roomId) continue;
+		if (include === "participated" && root.pdu.sender !== s.userId && !info.participants.has(s.userId)) continue;
+		if ((await hs.rooms.filterVisible(s.userId, roomId, [root])).length === 0) continue;
+		roots.push({
+			ev: root,
+			stream: info.stream
+		});
+	}
+	roots.sort((a, b) => b.stream - a.stream);
+	const page = roots.filter((r) => from === null || r.stream <= from);
+	const chunk = page.slice(0, limit);
+	const viewer = {
+		userId: s.userId,
+		deviceId: s.deviceId
+	};
+	const out = { chunk: await Promise.all(chunk.map(async (r) => {
+		const ev = hs.rooms.formatEvent(r.ev, viewer);
+		const info = latest.get(r.ev.pdu.event_id);
+		const latestEv = await hs.rooms.getEvent(info.latestId);
+		ev.unsigned = {
+			...ev.unsigned,
+			[M.RELATIONS]: {
+				...ev.unsigned?.[M.RELATIONS],
+				[M.THREAD]: {
+					latest_event: latestEv ? hs.rooms.formatEvent(latestEv, viewer) : void 0,
+					count: info.count,
+					current_user_participated: r.ev.pdu.sender === s.userId || info.participants.has(s.userId)
+				}
+			}
+		};
+		return ev;
+	})) };
+	if (page.length > limit) out.next_batch = `s${page[limit].stream}`;
+	return out;
+}
+//#endregion
+export { paginate, parsePageToken, parseToken, registerRoomRoutes, topoToken, visibleState };