matrix-nodejs-homeserver 0.2.0 → 0.3.1

package/dist/api/rooms.js

@@ -1,13 +1,15 @@
 import { isObject } from "../core/json.js";
+import { M, UNSTABLE } from "../core/m.js";
 import { SUPPORTED_ROOM_VERSIONS, roomVersionFeatures, splitStateKey, toClientEvent } from "../core/events.js";
 import { MatrixError, errors } from "../core/errors.js";
 import { isValidAlias, isValidRoomId, isValidUserId, parseId } from "../core/ids.js";
 import { getState, membershipOf, ownerOfStateKey, powerLevels, roomCreators, userLevel } from "../core/authrules.js";
 import { validatePowerLevelContent } from "../core/rooms.js";
 import { assertNotSuspended } from "../core/auth.js";
+import { number, string, unknown } from "../vendor/zod/v4/classic/schemas.js";
 import { body, fail, lenient } from "../http/input.js";
+import { procedure } from "../http/procedure.js";
 import { matchesFilter, parseRoomEventFilter } from "./filters.js";
-import { z } from "zod";
 //#region src/api/rooms.ts
 const parseToken = (token) => {
 	if (token === null || token === "") return null;
@@ -90,7 +92,7 @@ async function backfillIfNeeded(hs, roomId) {
 		},
 		limit: 1
 	}))[0];
-	if (!first || first.type === "m.room.create") return false;
+	if (!first || first.type === M.ROOM.CREATE) return false;
 	const prevs = (first.json.prev_events ?? []).map((p) => Array.isArray(p) ? p[0] : p);
 	const known = await hs.rooms.getEvents(prevs);
 	if (prevs.every((p) => known.has(p))) return false;
@@ -223,16 +225,16 @@ async function inviteByThreepid(ctx, s, body) {
 	}
 	const state = await hs.rooms.currentState(roomId);
 	const profile = await hs.profile(s.userId);
-	const create = getState(state, "m.room.create", "");
+	const create = getState(state, M.ROOM.CREATE, "");
 	const invite = {
 		medium: body.medium,
 		address: body.address,
 		room_id: roomId,
 		sender: s.userId,
-		room_alias: getState(state, "m.room.canonical_alias", "")?.content?.alias,
-		room_avatar_url: getState(state, "m.room.avatar", "")?.content?.url,
-		room_join_rules: getState(state, "m.room.join_rules", "")?.content?.join_rule,
-		room_name: getState(state, "m.room.name", "")?.content?.name,
+		room_alias: getState(state, M.ROOM.CANONICAL_ALIAS, "")?.content?.alias,
+		room_avatar_url: getState(state, M.ROOM.AVATAR, "")?.content?.url,
+		room_join_rules: getState(state, M.ROOM.JOIN_RULES, "")?.content?.join_rule,
+		room_name: getState(state, M.ROOM.NAME, "")?.content?.name,
 		room_type: create?.content?.type,
 		sender_display_name: profile.displayname,
 		sender_avatar_url: profile.avatar_url
@@ -241,7 +243,7 @@ async function inviteByThreepid(ctx, s, body) {
 	const stored = await hs.identityServers.storeInvite(body.id_server, body.id_access_token, invite);
 	const [first] = stored.public_keys;
 	await hs.rooms.sendEvent(roomId, s.userId, {
-		type: "m.room.third_party_invite",
+		type: M.ROOM.THIRD_PARTY_INVITE,
 		state_key: stored.token,
 		content: {
 			display_name: stored.display_name,
@@ -256,11 +258,11 @@ async function ownEvent(hs, userId, eventId) {
 	return typeof eventId === "string" && (await hs.rooms.getPdu(eventId))?.sender === userId;
 }
 const membershipBody = body({
-	user_id: lenient(z.string()),
-	reason: lenient(z.string())
+	user_id: lenient(string()),
+	reason: lenient(string())
 });
 async function sendMembership(ctx, membership) {
-	const s = await ctx.auth();
+	const s = ctx.session;
 	const roomId = ctx.params.roomId;
 	if (membership !== "leave") await assertNotSuspended(ctx.hs, s, roomId);
 	const body = ctx.input;
@@ -306,13 +308,13 @@ async function sendMembership(ctx, membership) {
 	return {};
 }
 async function validateStateEvent(hs, roomId, type, content, stateKeyValue = "") {
-	if (type === "m.room.create") throw errors.badJson("The create event cannot be sent");
+	if (type === M.ROOM.CREATE) throw errors.badJson("The create event cannot be sent");
 	if (stateKeyValue.startsWith("@") && roomVersionFeatures(await hs.rooms.roomVersion(roomId)).ownedState && !ownerOfStateKey(stateKeyValue)) throw errors.badJson("Malformed user-owned state key");
-	if (type === "m.room.power_levels") {
+	if (type === M.ROOM.POWER_LEVELS) {
 		const version = await hs.rooms.roomVersion(roomId);
 		validatePowerLevelContent(content, roomCreators(await hs.rooms.currentState(roomId), version));
 	}
-	if (type === "m.room.canonical_alias") {
+	if (type === M.ROOM.CANONICAL_ALIAS) {
 		const aliases = [content.alias, ...Array.isArray(content.alt_aliases) ? content.alt_aliases : []].filter((a) => a !== void 0 && a !== null);
 		if (content.alt_aliases !== void 0 && !Array.isArray(content.alt_aliases)) throw new MatrixError(400, "M_INVALID_PARAM", "alt_aliases must be a list");
 		for (const alias of aliases) {
@@ -331,15 +333,15 @@ async function publicRoomChunk(hs, roomId) {
 	const chunk = {
 		room_id: roomId,
 		num_joined_members: (await hs.rooms.joinedMembers(roomId)).length,
-		world_readable: get("m.room.history_visibility")?.history_visibility === "world_readable",
-		guest_can_join: get("m.room.guest_access")?.guest_access === "can_join",
-		join_rule: get("m.room.join_rules")?.join_rule ?? "invite"
+		world_readable: get(M.ROOM.HISTORY_VISIBILITY)?.history_visibility === "world_readable",
+		guest_can_join: get(M.ROOM.GUEST_ACCESS)?.guest_access === "can_join",
+		join_rule: get(M.ROOM.JOIN_RULES)?.join_rule ?? "invite"
 	};
-	if (typeof get("m.room.name")?.name === "string") chunk.name = get("m.room.name").name;
-	if (typeof get("m.room.topic")?.topic === "string") chunk.topic = get("m.room.topic").topic;
-	if (typeof get("m.room.canonical_alias")?.alias === "string") chunk.canonical_alias = get("m.room.canonical_alias").alias;
-	if (typeof get("m.room.avatar")?.url === "string") chunk.avatar_url = get("m.room.avatar").url;
-	const roomType = get("m.room.create")?.type;
+	if (typeof get(M.ROOM.NAME)?.name === "string") chunk.name = get(M.ROOM.NAME).name;
+	if (typeof get(M.ROOM.TOPIC)?.topic === "string") chunk.topic = get(M.ROOM.TOPIC).topic;
+	if (typeof get(M.ROOM.CANONICAL_ALIAS)?.alias === "string") chunk.canonical_alias = get(M.ROOM.CANONICAL_ALIAS).alias;
+	if (typeof get(M.ROOM.AVATAR)?.url === "string") chunk.avatar_url = get(M.ROOM.AVATAR).url;
+	const roomType = get(M.ROOM.CREATE)?.type;
 	if (typeof roomType === "string") chunk.room_type = roomType;
 	return chunk;
 }
@@ -382,7 +384,7 @@ async function canDeleteAlias(hs, s, alias) {
 	if (!version) return false;
 	const state = await hs.rooms.currentState(alias.room_id);
 	const pl = powerLevels(state, version);
-	const needed = pl.events["m.room.canonical_alias"] ?? pl.state_default;
+	const needed = pl.events[M.ROOM.CANONICAL_ALIAS] ?? pl.state_default;
 	return membershipOf(state, s.userId) === "join" && userLevel(pl, s.userId) >= needed;
 }
 async function upgradeRoom(hs, s, roomId, newVersion, additionalCreators) {
@@ -390,11 +392,11 @@ async function upgradeRoom(hs, s, roomId, newVersion, additionalCreators) {
 	const version = await requireRoom(hs, roomId);
 	const state = await hs.rooms.requireJoined(roomId, s.userId);
 	const pl = powerLevels(state, version);
-	const tombstoneLevel = pl.events["m.room.tombstone"] ?? pl.state_default;
+	const tombstoneLevel = pl.events[M.ROOM.TOMBSTONE] ?? pl.state_default;
 	if (userLevel(pl, s.userId) < tombstoneLevel) throw errors.forbidden("You cannot upgrade this room");
-	const create = getState(state, "m.room.create");
+	const create = getState(state, M.ROOM.CREATE);
 	const creationContent = {};
-	for (const k of ["m.federate", "type"]) if (create.content[k] !== void 0) creationContent[k] = create.content[k];
+	for (const k of [M.FEDERATE, "type"]) if (create.content[k] !== void 0) creationContent[k] = create.content[k];
 	const toV12 = roomVersionFeatures(newVersion).v12;
 	if (toV12) {
 		creationContent.predecessor = { room_id: roomId };
@@ -414,26 +416,26 @@ async function upgradeRoom(hs, s, roomId, newVersion, additionalCreators) {
 		}))[0].event_id
 	};
 	const copyTypes = [
-		"m.room.server_acl",
-		"m.room.encryption",
-		"m.room.name",
-		"m.room.avatar",
-		"m.room.topic",
-		"m.room.guest_access",
-		"m.room.history_visibility",
-		"m.room.join_rules",
-		"m.room.power_levels"
+		M.ROOM.SERVER_ACL,
+		M.ROOM.ENCRYPTION,
+		M.ROOM.NAME,
+		M.ROOM.AVATAR,
+		M.ROOM.TOPIC,
+		M.ROOM.GUEST_ACCESS,
+		M.ROOM.HISTORY_VISIBILITY,
+		M.ROOM.JOIN_RULES,
+		M.ROOM.POWER_LEVELS
 	];
 	const initialState = [];
 	for (const t of copyTypes) {
 		const ev = getState(state, t);
-		if (ev && t !== "m.room.power_levels") initialState.push({
+		if (ev && t !== M.ROOM.POWER_LEVELS) initialState.push({
 			type: t,
 			state_key: "",
 			content: ev.content
 		});
 	}
-	let oldPl = structuredClone(getState(state, "m.room.power_levels")?.content ?? {});
+	let oldPl = structuredClone(getState(state, M.ROOM.POWER_LEVELS)?.content ?? {});
 	const isPublic = (await hs.db.findOne("rooms", [{
 		field: "room_id",
 		value: roomId
@@ -466,9 +468,9 @@ async function upgradeRoom(hs, s, roomId, newVersion, additionalCreators) {
 		preset: "private_chat",
 		visibility: isPublic ? "public" : "private"
 	});
-	if (getState(state, "m.room.power_levels") && !toV12) try {
+	if (getState(state, M.ROOM.POWER_LEVELS) && !toV12) try {
 		await hs.rooms.sendEvent(newRoomId, s.userId, {
-			type: "m.room.power_levels",
+			type: M.ROOM.POWER_LEVELS,
 			state_key: "",
 			content: oldPl
 		});
@@ -481,15 +483,15 @@ async function upgradeRoom(hs, s, roomId, newVersion, additionalCreators) {
 		field: "alias",
 		value: a.alias
 	}], { room_id: newRoomId });
-	const canonical = getState(state, "m.room.canonical_alias");
+	const canonical = getState(state, M.ROOM.CANONICAL_ALIAS);
 	if (canonical && Object.keys(canonical.content).length) {
 		await hs.rooms.sendEvent(roomId, s.userId, {
-			type: "m.room.canonical_alias",
+			type: M.ROOM.CANONICAL_ALIAS,
 			state_key: "",
 			content: {}
 		}).catch(() => {});
 		await hs.rooms.sendEvent(newRoomId, s.userId, {
-			type: "m.room.canonical_alias",
+			type: M.ROOM.CANONICAL_ALIAS,
 			state_key: "",
 			content: canonical.content
 		}).catch(() => {});
@@ -499,7 +501,7 @@ async function upgradeRoom(hs, s, roomId, newVersion, additionalCreators) {
 		value: roomId
 	}], { is_public: false });
 	await hs.rooms.sendEvent(roomId, s.userId, {
-		type: "m.room.tombstone",
+		type: M.ROOM.TOMBSTONE,
 		state_key: "",
 		content: {
 			body: "This room has been replaced",
@@ -512,38 +514,44 @@ async function upgradeRoom(hs, s, roomId, newVersion, additionalCreators) {
 		invite: Math.max(50, oldPl.invite ?? 0)
 	};
 	await hs.rooms.sendEvent(roomId, s.userId, {
-		type: "m.room.power_levels",
+		type: M.ROOM.POWER_LEVELS,
 		state_key: "",
 		content: restricted
 	}).catch(() => {});
 	return newRoomId;
 }
 function registerRoomRoutes(r) {
-	r.client("POST", "/createRoom", { input: body({}) }, async (ctx) => {
-		const s = await ctx.auth();
-		if (s.isGuest) throw errors.forbidden("Guests cannot create rooms");
-		await assertNotSuspended(ctx.hs, s);
-		await ctx.rateLimit("createRoom");
-		const created = await ctx.hs.rooms.createRoom(s.userId, ctx.input);
-		await ctx.hs.audit.record({
-			action: "room_create",
-			actor: s.userId,
-			target: created.room_id,
-			ip: ctx.ip
-		});
-		return created;
-	});
-	r.client("GET", "/joined_rooms", async (ctx) => {
-		const s = await ctx.auth();
-		return { joined_rooms: await ctx.hs.rooms.roomsForUser(s.userId) };
-	});
+	r.client("POST", "/createRoom", procedure({
+		auth: "user",
+		input: body({}),
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (s.isGuest) throw errors.forbidden("Guests cannot create rooms");
+			await assertNotSuspended(ctx.hs, s);
+			await ctx.rateLimit("createRoom");
+			const created = await ctx.hs.rooms.createRoom(s.userId, ctx.input);
+			await ctx.hs.audit.record({
+				action: "room_create",
+				actor: s.userId,
+				target: created.room_id,
+				ip: ctx.ip
+			});
+			return created;
+		}
+	}));
+	r.client("GET", "/joined_rooms", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			return { joined_rooms: await ctx.hs.rooms.roomsForUser(s.userId) };
+		}
+	}));
 	const joinBody = body({
-		reason: lenient(z.string()),
-		third_party_signed: z.unknown().optional()
+		reason: lenient(string()),
+		third_party_signed: unknown().optional()
 	});
 	const join = async (ctx, idOrAlias) => {
-		const s = await ctx.auth();
-		await ctx.rateLimit("join");
+		const s = ctx.session;
 		const body = ctx.input;
 		const { roomId, servers: resolvedServers } = await ctx.hs.rooms.resolveRoom(idOrAlias);
 		await assertNotSuspended(ctx.hs, s, roomId);
@@ -560,7 +568,7 @@ function registerRoomRoutes(r) {
 			const proof = signed;
 			if (await ctx.hs.rooms.membership(roomId, s.userId) !== "invite") {
 				const event = {
-					type: "m.room.member",
+					type: M.ROOM.MEMBER,
 					room_id: roomId,
 					sender,
 					state_key: s.userId,
@@ -570,7 +578,7 @@ function registerRoomRoutes(r) {
 					}
 				};
 				if (ctx.hs.isLocalUser(sender)) {
-					const pending = getState(await ctx.hs.rooms.currentState(roomId), "m.room.third_party_invite", signed.token);
+					const pending = getState(await ctx.hs.rooms.currentState(roomId), M.ROOM.THIRD_PARTY_INVITE, signed.token);
 					if (!pending || pending.sender !== sender) throw errors.forbidden("No such third-party invite");
 					await ctx.hs.rooms.invite(roomId, sender, s.userId, { thirdPartyInvite: {
 						display_name: pending.content?.display_name ?? "",
@@ -586,90 +594,130 @@ function registerRoomRoutes(r) {
 		});
 		return { room_id: roomId };
 	};
-	r.client("POST", "/rooms/:roomId/join", { input: joinBody }, (ctx) => join(ctx, ctx.params.roomId));
-	r.client("POST", "/join/:roomIdOrAlias", { input: joinBody }, (ctx) => join(ctx, ctx.params.roomIdOrAlias));
-	r.client("POST", "/knock/:roomIdOrAlias", { input: body({ reason: lenient(z.string()) }) }, async (ctx) => {
-		const s = await ctx.auth();
-		const body = ctx.input;
-		const { roomId, servers } = await ctx.hs.rooms.resolveRoom(ctx.params.roomIdOrAlias);
-		await assertNotSuspended(ctx.hs, s, roomId);
-		const via = [
-			...ctx.query.getAll("via"),
-			...ctx.query.getAll("server_name"),
-			...servers
-		];
-		await ctx.hs.rooms.setMembership(roomId, s.userId, s.userId, "knock", body.reason, via);
-		return { room_id: roomId };
-	});
+	r.client("POST", "/rooms/:roomId/join", procedure({
+		auth: "user",
+		rateLimit: "join",
+		input: joinBody,
+		handler: (ctx) => join(ctx, ctx.params.roomId)
+	}));
+	r.client("POST", "/join/:roomIdOrAlias", procedure({
+		auth: "user",
+		rateLimit: "join",
+		input: joinBody,
+		handler: (ctx) => join(ctx, ctx.params.roomIdOrAlias)
+	}));
+	r.client("POST", "/knock/:roomIdOrAlias", procedure({
+		auth: "user",
+		input: body({ reason: lenient(string()) }),
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			const { roomId, servers } = await ctx.hs.rooms.resolveRoom(ctx.params.roomIdOrAlias);
+			await assertNotSuspended(ctx.hs, s, roomId);
+			const via = [
+				...ctx.query.getAll("via"),
+				...ctx.query.getAll("server_name"),
+				...servers
+			];
+			await ctx.hs.rooms.setMembership(roomId, s.userId, s.userId, "knock", body.reason, via);
+			return { room_id: roomId };
+		}
+	}));
 	const inviteBody = body({
-		user_id: lenient(z.string()),
-		reason: lenient(z.string())
-	});
-	r.client("POST", "/rooms/:roomId/invite", { input: inviteBody }, async (ctx) => {
-		const s = await ctx.auth();
-		const body = ctx.input;
-		await assertNotSuspended(ctx.hs, s, ctx.params.roomId);
-		await ctx.rateLimit("invite");
-		if (body.id_server !== void 0 || body.medium !== void 0) return inviteByThreepid(ctx, s, body);
-		if (!body.user_id || !isValidUserId(body.user_id)) throw errors.invalidParam("Invalid user_id");
-		await requireRoom(ctx.hs, ctx.params.roomId);
-		const current = await ctx.hs.rooms.membership(ctx.params.roomId, body.user_id);
-		if (current === "ban") throw errors.forbidden("User is banned");
-		if (current === "join") throw errors.forbidden("User is already joined");
-		await ctx.hs.rooms.invite(ctx.params.roomId, s.userId, body.user_id, { reason: body.reason });
-		return {};
-	});
-	r.client("POST", "/rooms/:roomId/leave", { input: membershipBody }, (ctx) => sendMembership(ctx, "leave"));
-	r.client("POST", "/rooms/:roomId/kick", { input: membershipBody }, (ctx) => sendMembership(ctx, "kick"));
-	r.client("POST", "/rooms/:roomId/ban", { input: membershipBody }, (ctx) => sendMembership(ctx, "ban"));
-	r.client("POST", "/rooms/:roomId/unban", { input: membershipBody }, (ctx) => sendMembership(ctx, "unban"));
-	r.client("POST", "/rooms/:roomId/forget", async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const row = await hs.db.findOne("memberships", [{
-			field: "room_id",
-			value: ctx.params.roomId
-		}, {
-			field: "user_id",
-			value: s.userId
-		}]);
-		if (!row) throw errors.notFound("Not a member of this room");
-		if (row.membership === "join" || row.membership === "invite" || row.membership === "knock") throw errors.unknown("You must leave the room before forgetting it");
-		await hs.db.update("memberships", [{
-			field: "room_id",
-			value: ctx.params.roomId
-		}, {
-			field: "user_id",
-			value: s.userId
-		}], { forgotten: true });
-		return {};
-	});
-	r.client("PUT", "/rooms/:roomId/send/:eventType/:txnId", async (ctx) => {
-		const s = await ctx.auth();
-		await ctx.rateLimit("message");
-		const content = await ctx.json();
-		await requireRoom(ctx.hs, ctx.params.roomId);
-		if (!(s.suspended && ctx.params.eventType === "m.room.redaction" && await ownEvent(ctx.hs, s.userId, content?.redacts))) await assertNotSuspended(ctx.hs, s, ctx.params.roomId);
-		const delay = ctx.query.get("org.matrix.msc4140.delay");
-		if (delay !== null) return { delay_id: await ctx.hs.delayedEvents.schedule({
-			userId: s.userId,
-			deviceId: s.deviceId,
-			roomId: ctx.params.roomId,
-			type: ctx.params.eventType,
-			content,
-			delayMs: Number(delay),
-			txnId: ctx.params.txnId
-		}) };
-		const ts = s.appservice && ctx.query.get("ts") ? Number(ctx.query.get("ts")) : void 0;
-		return { event_id: await ctx.hs.rooms.sendEvent(ctx.params.roomId, s.userId, {
-			type: ctx.params.eventType,
-			content
-		}, {
-			txnId: ctx.params.txnId,
-			deviceId: s.deviceId || void 0,
-			ts
-		}) };
+		user_id: lenient(string()),
+		reason: lenient(string())
 	});
+	r.client("POST", "/rooms/:roomId/invite", procedure({
+		auth: "user",
+		input: inviteBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			await assertNotSuspended(ctx.hs, s, ctx.params.roomId);
+			await ctx.rateLimit("invite");
+			if (body.id_server !== void 0 || body.medium !== void 0) return inviteByThreepid(ctx, s, body);
+			if (!body.user_id || !isValidUserId(body.user_id)) throw errors.invalidParam("Invalid user_id");
+			await requireRoom(ctx.hs, ctx.params.roomId);
+			const current = await ctx.hs.rooms.membership(ctx.params.roomId, body.user_id);
+			if (current === "ban") throw errors.forbidden("User is banned");
+			if (current === "join") throw errors.forbidden("User is already joined");
+			await ctx.hs.rooms.invite(ctx.params.roomId, s.userId, body.user_id, { reason: body.reason });
+			return {};
+		}
+	}));
+	r.client("POST", "/rooms/:roomId/leave", procedure({
+		auth: "user",
+		input: membershipBody,
+		handler: (ctx) => sendMembership(ctx, "leave")
+	}));
+	r.client("POST", "/rooms/:roomId/kick", procedure({
+		auth: "user",
+		input: membershipBody,
+		handler: (ctx) => sendMembership(ctx, "kick")
+	}));
+	r.client("POST", "/rooms/:roomId/ban", procedure({
+		auth: "user",
+		input: membershipBody,
+		handler: (ctx) => sendMembership(ctx, "ban")
+	}));
+	r.client("POST", "/rooms/:roomId/unban", procedure({
+		auth: "user",
+		input: membershipBody,
+		handler: (ctx) => sendMembership(ctx, "unban")
+	}));
+	r.client("POST", "/rooms/:roomId/forget", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const row = await hs.db.findOne("memberships", [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}, {
+				field: "user_id",
+				value: s.userId
+			}]);
+			if (!row) throw errors.notFound("Not a member of this room");
+			if (row.membership === "join" || row.membership === "invite" || row.membership === "knock") throw errors.unknown("You must leave the room before forgetting it");
+			await hs.db.update("memberships", [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}, {
+				field: "user_id",
+				value: s.userId
+			}], { forgotten: true });
+			return {};
+		}
+	}));
+	r.client("PUT", "/rooms/:roomId/send/:eventType/:txnId", procedure({
+		auth: "user",
+		rateLimit: "message",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const content = await ctx.json();
+			await requireRoom(ctx.hs, ctx.params.roomId);
+			if (!(s.suspended && ctx.params.eventType === M.ROOM.REDACTION && await ownEvent(ctx.hs, s.userId, content?.redacts))) await assertNotSuspended(ctx.hs, s, ctx.params.roomId);
+			const delay = ctx.query.get(UNSTABLE.ORG.MATRIX.MSC4140.DELAY);
+			if (delay !== null) return { delay_id: await ctx.hs.delayedEvents.schedule({
+				userId: s.userId,
+				deviceId: s.deviceId,
+				roomId: ctx.params.roomId,
+				type: ctx.params.eventType,
+				content,
+				delayMs: Number(delay),
+				txnId: ctx.params.txnId
+			}) };
+			const ts = s.appservice && ctx.query.get("ts") ? Number(ctx.query.get("ts")) : void 0;
+			return { event_id: await ctx.hs.rooms.sendEvent(ctx.params.roomId, s.userId, {
+				type: ctx.params.eventType,
+				content
+			}, {
+				txnId: ctx.params.txnId,
+				deviceId: s.deviceId || void 0,
+				ts
+			}) };
+		}
+	}));
 	const putState = async (ctx) => {
 		const s = await ctx.auth();
 		const content = await ctx.json();
@@ -677,9 +725,9 @@ function registerRoomRoutes(r) {
 		await requireRoom(ctx.hs, roomId);
 		const type = ctx.params.eventType;
 		const key = ctx.params.stateKey ?? "";
-		if (!(type === "m.room.member" && key === s.userId && content?.membership === "leave")) await assertNotSuspended(ctx.hs, s, roomId);
+		if (!(type === M.ROOM.MEMBER && key === s.userId && content?.membership === "leave")) await assertNotSuspended(ctx.hs, s, roomId);
 		await validateStateEvent(ctx.hs, roomId, type, content, key);
-		const delay = ctx.query.get("org.matrix.msc4140.delay");
+		const delay = ctx.query.get(UNSTABLE.ORG.MATRIX.MSC4140.DELAY);
 		if (delay !== null) return { delay_id: await ctx.hs.delayedEvents.schedule({
 			userId: s.userId,
 			deviceId: s.deviceId,
@@ -698,8 +746,8 @@ function registerRoomRoutes(r) {
 			content
 		}, { ts }) };
 	};
-	r.client("PUT", "/rooms/:roomId/state/:eventType", putState);
-	r.client("PUT", "/rooms/:roomId/state/:eventType/:stateKey", putState);
+	r.client("PUT", "/rooms/:roomId/state/:eventType", procedure({ handler: putState }));
+	r.client("PUT", "/rooms/:roomId/state/:eventType/:stateKey", procedure({ handler: putState }));
 	const getStateEvent = async (ctx) => {
 		const s = await ctx.auth();
 		const state = await visibleState(ctx.hs, ctx.params.roomId, s.userId);
@@ -714,211 +762,235 @@ function registerRoomRoutes(r) {
 		});
 		return ev.content;
 	};
-	r.client("GET", "/rooms/:roomId/state/:eventType", getStateEvent);
-	r.client("GET", "/rooms/:roomId/state/:eventType/:stateKey", getStateEvent);
-	r.client("GET", "/rooms/:roomId/state", async (ctx) => {
-		const s = await ctx.auth();
-		return [...(await visibleState(ctx.hs, ctx.params.roomId, s.userId)).values()].map((ev) => toClientEvent(ev));
-	});
-	r.client("GET", "/rooms/:roomId/members", async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		await hs.partialState.waitForFullState(ctx.params.roomId, ctx.request.signal);
-		let state = await visibleState(hs, ctx.params.roomId, s.userId);
-		const at = parseToken(ctx.query.get("at"));
-		if (at !== null) {
-			const rows = await hs.db.findMany("events", {
-				where: [{
-					field: "room_id",
-					value: ctx.params.roomId
-				}, {
-					field: "stream",
-					operator: "lte",
-					value: at
-				}],
-				sortBy: {
-					field: "stream",
-					direction: "desc"
-				},
-				limit: 1
-			});
-			if (rows[0]) state = await hs.rooms.stateAtSnapshot(rows[0].state_snapshot);
-			else {
-				const first = await hs.db.findMany("events", {
+	r.client("GET", "/rooms/:roomId/state/:eventType", procedure({ handler: getStateEvent }));
+	r.client("GET", "/rooms/:roomId/state/:eventType/:stateKey", procedure({ handler: getStateEvent }));
+	r.client("GET", "/rooms/:roomId/state", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			return [...(await visibleState(ctx.hs, ctx.params.roomId, s.userId)).values()].map((ev) => toClientEvent(ev));
+		}
+	}));
+	r.client("GET", "/rooms/:roomId/members", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			await hs.partialState.waitForFullState(ctx.params.roomId, ctx.request.signal);
+			let state = await visibleState(hs, ctx.params.roomId, s.userId);
+			const at = parseToken(ctx.query.get("at"));
+			if (at !== null) {
+				const rows = await hs.db.findMany("events", {
 					where: [{
 						field: "room_id",
 						value: ctx.params.roomId
+					}, {
+						field: "stream",
+						operator: "lte",
+						value: at
 					}],
 					sortBy: {
 						field: "stream",
-						direction: "asc"
+						direction: "desc"
 					},
-					limit: 2
+					limit: 1
 				});
-				if (first.length) state = await hs.rooms.stateAtSnapshot(first[first.length - 1].state_snapshot);
+				if (rows[0]) state = await hs.rooms.stateAtSnapshot(rows[0].state_snapshot);
+				else {
+					const first = await hs.db.findMany("events", {
+						where: [{
+							field: "room_id",
+							value: ctx.params.roomId
+						}],
+						sortBy: {
+							field: "stream",
+							direction: "asc"
+						},
+						limit: 2
+					});
+					if (first.length) state = await hs.rooms.stateAtSnapshot(first[first.length - 1].state_snapshot);
+				}
 			}
+			const membership = ctx.query.get("membership");
+			const notMembership = ctx.query.get("not_membership");
+			const chunk = [];
+			for (const [k, ev] of state) {
+				if (splitStateKey(k)[0] !== M.ROOM.MEMBER) continue;
+				const m = ev.content?.membership;
+				if (membership && m !== membership) continue;
+				if (notMembership && m === notMembership) continue;
+				chunk.push(toClientEvent(ev));
+			}
+			return { chunk };
 		}
-		const membership = ctx.query.get("membership");
-		const notMembership = ctx.query.get("not_membership");
-		const chunk = [];
-		for (const [k, ev] of state) {
-			if (splitStateKey(k)[0] !== "m.room.member") continue;
-			const m = ev.content?.membership;
-			if (membership && m !== membership) continue;
-			if (notMembership && m === notMembership) continue;
-			chunk.push(toClientEvent(ev));
-		}
-		return { chunk };
-	});
-	r.client("GET", "/rooms/:roomId/joined_members", async (ctx) => {
-		const s = await ctx.auth();
-		await requireRoom(ctx.hs, ctx.params.roomId);
-		await ctx.hs.partialState.waitForFullState(ctx.params.roomId, ctx.request.signal);
-		const { joined: isJoined, worldReadable } = await ctx.hs.rooms.canPeek(ctx.params.roomId, s.userId);
-		if (!isJoined && !worldReadable) throw errors.forbidden("You are not joined to this room");
-		const state = await ctx.hs.rooms.currentState(ctx.params.roomId);
-		const joined = {};
-		for (const [k, ev] of state) {
-			const [type, key] = splitStateKey(k);
-			if (type !== "m.room.member" || ev.content?.membership !== "join") continue;
-			joined[key] = {
-				display_name: ev.content.displayname ?? null,
-				avatar_url: ev.content.avatar_url ?? null
-			};
+	}));
+	r.client("GET", "/rooms/:roomId/joined_members", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			await requireRoom(ctx.hs, ctx.params.roomId);
+			await ctx.hs.partialState.waitForFullState(ctx.params.roomId, ctx.request.signal);
+			const { joined: isJoined, worldReadable } = await ctx.hs.rooms.canPeek(ctx.params.roomId, s.userId);
+			if (!isJoined && !worldReadable) throw errors.forbidden("You are not joined to this room");
+			const state = await ctx.hs.rooms.currentState(ctx.params.roomId);
+			const joined = {};
+			for (const [k, ev] of state) {
+				const [type, key] = splitStateKey(k);
+				if (type !== M.ROOM.MEMBER || ev.content?.membership !== "join") continue;
+				joined[key] = {
+					display_name: ev.content.displayname ?? null,
+					avatar_url: ev.content.avatar_url ?? null
+				};
+			}
+			return { joined };
 		}
-		return { joined };
-	});
-	r.client("GET", "/rooms/:roomId/messages", async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const roomId = ctx.params.roomId;
-		await visibleState(hs, roomId, s.userId);
-		const dir = ctx.query.get("dir") ?? "b";
-		if (dir !== "b" && dir !== "f") throw errors.invalidParam("dir must be 'b' or 'f'");
-		const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 1), 1e3);
-		const filter = parseRoomEventFilter(ctx);
-		const fromRaw = ctx.query.get("from");
-		const from = parsePageToken(fromRaw) ?? (dir === "b" ? {
-			depth: null,
-			stream: await hs.streams.position()
-		} : null);
-		const to = parsePageToken(ctx.query.get("to"));
-		let { events, end } = await paginate(hs, s.userId, roomId, {
-			from,
-			to,
-			dir,
-			limit: filter?.limit ?? limit,
-			filter
-		});
-		for (let attempt = 0; attempt < 3 && dir === "b"; attempt++) {
-			const gapEvent = await findGapBefore(hs, roomId, events, end);
-			if (!(gapEvent ? await backfillGap(hs, roomId, gapEvent) : end === null && events.length < (filter?.limit ?? limit) && await backfillIfNeeded(hs, roomId))) break;
-			({events, end} = await paginate(hs, s.userId, roomId, {
+	}));
+	r.client("GET", "/rooms/:roomId/messages", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const roomId = ctx.params.roomId;
+			await visibleState(hs, roomId, s.userId);
+			const dir = ctx.query.get("dir") ?? "b";
+			if (dir !== "b" && dir !== "f") throw errors.invalidParam("dir must be 'b' or 'f'");
+			const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 1), 1e3);
+			const filter = parseRoomEventFilter(ctx);
+			const fromRaw = ctx.query.get("from");
+			const from = parsePageToken(fromRaw) ?? (dir === "b" ? {
+				depth: null,
+				stream: await hs.streams.position()
+			} : null);
+			const to = parsePageToken(ctx.query.get("to"));
+			let { events, end } = await paginate(hs, s.userId, roomId, {
 				from,
 				to,
 				dir,
 				limit: filter?.limit ?? limit,
 				filter
-			}));
+			});
+			for (let attempt = 0; attempt < 3 && dir === "b"; attempt++) {
+				const gapEvent = await findGapBefore(hs, roomId, events, end);
+				if (!(gapEvent ? await backfillGap(hs, roomId, gapEvent) : end === null && events.length < (filter?.limit ?? limit) && await backfillIfNeeded(hs, roomId))) break;
+				({events, end} = await paginate(hs, s.userId, roomId, {
+					from,
+					to,
+					dir,
+					limit: filter?.limit ?? limit,
+					filter
+				}));
+			}
+			const out = {
+				chunk: events.map((e) => hs.rooms.formatEvent(e, viewerOf(s))),
+				start: fromRaw ?? (from ? from.depth === null ? `s${from.stream}` : `t${from.depth}_${from.stream}` : "t0_0")
+			};
+			if (end !== null) out.end = end;
+			else if (events.length) out.end = topoToken(events[events.length - 1]);
+			if (filter?.lazy_load_members) {
+				const current = await hs.rooms.currentState(roomId);
+				out.state = [...new Set(events.map((e) => e.pdu.sender))].map((u) => getState(current, M.ROOM.MEMBER, u)).filter(Boolean).map((e) => toClientEvent(e));
+			}
+			return out;
 		}
-		const out = {
-			chunk: events.map((e) => hs.rooms.formatEvent(e, viewerOf(s))),
-			start: fromRaw ?? (from ? from.depth === null ? `s${from.stream}` : `t${from.depth}_${from.stream}` : "t0_0")
-		};
-		if (end !== null) out.end = end;
-		else if (events.length) out.end = topoToken(events[events.length - 1]);
-		if (filter?.lazy_load_members) {
-			const current = await hs.rooms.currentState(roomId);
-			out.state = [...new Set(events.map((e) => e.pdu.sender))].map((u) => getState(current, "m.room.member", u)).filter(Boolean).map((e) => toClientEvent(e));
+	}));
+	r.client("GET", "/rooms/:roomId/event/:eventId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			await requireRoom(hs, ctx.params.roomId);
+			const ev = await hs.rooms.getEvent(ctx.params.eventId);
+			if (!ev || ev.pdu.room_id !== ctx.params.roomId) throw errors.notFound("Event not found");
+			if ((await hs.rooms.filterVisible(s.userId, ctx.params.roomId, [ev])).length === 0) throw errors.notFound("Event not found");
+			return hs.rooms.formatEvent(ev, viewerOf(s));
 		}
-		return out;
-	});
-	r.client("GET", "/rooms/:roomId/event/:eventId", async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		await requireRoom(hs, ctx.params.roomId);
-		const ev = await hs.rooms.getEvent(ctx.params.eventId);
-		if (!ev || ev.pdu.room_id !== ctx.params.roomId) throw errors.notFound("Event not found");
-		if ((await hs.rooms.filterVisible(s.userId, ctx.params.roomId, [ev])).length === 0) throw errors.notFound("Event not found");
-		return hs.rooms.formatEvent(ev, viewerOf(s));
-	});
-	r.client("GET", "/rooms/:roomId/context/:eventId", async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const roomId = ctx.params.roomId;
-		await requireRoom(hs, roomId);
-		const ev = await hs.rooms.getEvent(ctx.params.eventId);
-		if (!ev || ev.pdu.room_id !== roomId || (await hs.rooms.filterVisible(s.userId, roomId, [ev])).length === 0) throw errors.notFound("Event not found");
-		const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 0), 100);
-		const filter = parseRoomEventFilter(ctx);
-		const here = {
-			depth: ev.pdu.depth,
-			stream: ev.stream
-		};
-		const before = await paginate(hs, s.userId, roomId, {
-			from: here,
-			to: null,
-			dir: "b",
-			limit: Math.floor(limit / 2) || (limit ? 1 : 0),
-			filter
-		});
-		const after = await paginate(hs, s.userId, roomId, {
-			from: here,
-			to: null,
-			dir: "f",
-			limit: Math.ceil(limit / 2),
-			filter
-		});
-		const beforeEvents = limit ? before.events : [];
-		const afterEvents = limit ? after.events : [];
-		const state = await hs.rooms.stateAtSnapshot(ev.snapshot);
-		return {
-			event: hs.rooms.formatEvent(ev, viewerOf(s)),
-			events_before: beforeEvents.map((e) => hs.rooms.formatEvent(e, viewerOf(s))),
-			events_after: afterEvents.map((e) => hs.rooms.formatEvent(e, viewerOf(s))),
-			start: topoToken(beforeEvents.length ? beforeEvents[beforeEvents.length - 1] : ev),
-			end: topoToken(afterEvents.length ? afterEvents[afterEvents.length - 1] : ev),
-			state: [...state.values()].map((e) => toClientEvent(e))
-		};
-	});
-	r.client("PUT", "/rooms/:roomId/redact/:eventId/:txnId", async (ctx) => {
-		const s = await ctx.auth();
-		const body = await ctx.json();
-		const roomId = ctx.params.roomId;
-		await requireRoom(ctx.hs, roomId);
-		if (!await ownEvent(ctx.hs, s.userId, ctx.params.eventId)) await assertNotSuspended(ctx.hs, s, roomId);
-		await ctx.hs.rooms.checkRedactionAllowed(roomId, s.userId, ctx.params.eventId);
-		const content = {};
-		if (typeof body.reason === "string") content.reason = body.reason;
-		return { event_id: await ctx.hs.rooms.sendEvent(roomId, s.userId, {
-			type: "m.room.redaction",
-			content,
-			redacts: ctx.params.eventId
-		}, {
-			txnId: ctx.params.txnId,
-			deviceId: s.deviceId
-		}) };
-	});
-	r.client("PUT", "/rooms/:roomId/typing/:userId", async (ctx) => {
-		const s = await ctx.auth();
-		if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot set typing for another user");
-		const body = await ctx.json();
-		if (typeof body.typing !== "boolean") throw errors.badJson("typing must be a boolean");
-		await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
-		await ctx.hs.typing.setTyping(ctx.params.roomId, s.userId, body.typing, Number(body.timeout) || 3e4);
-		return {};
-	});
+	}));
+	r.client("GET", "/rooms/:roomId/context/:eventId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const roomId = ctx.params.roomId;
+			await requireRoom(hs, roomId);
+			const ev = await hs.rooms.getEvent(ctx.params.eventId);
+			if (!ev || ev.pdu.room_id !== roomId || (await hs.rooms.filterVisible(s.userId, roomId, [ev])).length === 0) throw errors.notFound("Event not found");
+			const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 0), 100);
+			const filter = parseRoomEventFilter(ctx);
+			const here = {
+				depth: ev.pdu.depth,
+				stream: ev.stream
+			};
+			const before = await paginate(hs, s.userId, roomId, {
+				from: here,
+				to: null,
+				dir: "b",
+				limit: Math.floor(limit / 2) || (limit ? 1 : 0),
+				filter
+			});
+			const after = await paginate(hs, s.userId, roomId, {
+				from: here,
+				to: null,
+				dir: "f",
+				limit: Math.ceil(limit / 2),
+				filter
+			});
+			const beforeEvents = limit ? before.events : [];
+			const afterEvents = limit ? after.events : [];
+			const state = await hs.rooms.stateAtSnapshot(ev.snapshot);
+			return {
+				event: hs.rooms.formatEvent(ev, viewerOf(s)),
+				events_before: beforeEvents.map((e) => hs.rooms.formatEvent(e, viewerOf(s))),
+				events_after: afterEvents.map((e) => hs.rooms.formatEvent(e, viewerOf(s))),
+				start: topoToken(beforeEvents.length ? beforeEvents[beforeEvents.length - 1] : ev),
+				end: topoToken(afterEvents.length ? afterEvents[afterEvents.length - 1] : ev),
+				state: [...state.values()].map((e) => toClientEvent(e))
+			};
+		}
+	}));
+	r.client("PUT", "/rooms/:roomId/redact/:eventId/:txnId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = await ctx.json();
+			const roomId = ctx.params.roomId;
+			await requireRoom(ctx.hs, roomId);
+			if (!await ownEvent(ctx.hs, s.userId, ctx.params.eventId)) await assertNotSuspended(ctx.hs, s, roomId);
+			await ctx.hs.rooms.checkRedactionAllowed(roomId, s.userId, ctx.params.eventId);
+			const content = {};
+			if (typeof body.reason === "string") content.reason = body.reason;
+			return { event_id: await ctx.hs.rooms.sendEvent(roomId, s.userId, {
+				type: M.ROOM.REDACTION,
+				content,
+				redacts: ctx.params.eventId
+			}, {
+				txnId: ctx.params.txnId,
+				deviceId: s.deviceId
+			}) };
+		}
+	}));
+	r.client("PUT", "/rooms/:roomId/typing/:userId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot set typing for another user");
+			const body = await ctx.json();
+			if (typeof body.typing !== "boolean") throw errors.badJson("typing must be a boolean");
+			await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
+			await ctx.hs.typing.setTyping(ctx.params.roomId, s.userId, body.typing, Number(body.timeout) || 3e4);
+			return {};
+		}
+	}));
 	const RECEIPT_TYPES = [
-		"m.read",
-		"m.read.private",
-		"m.fully_read"
+		M.READ._,
+		M.READ.PRIVATE,
+		M.FULLY_READ
 	];
 	const setReceipt = async (hs, s, roomId, type, eventId, threadId) => {
-		if (type === "m.fully_read") {
+		if (type === M.FULLY_READ) {
 			await hs.streams.write((stream) => hs.db.upsert("account_data", {
 				user_id: s.userId,
 				room_id: roomId,
-				type: "m.fully_read",
+				type: M.FULLY_READ,
 				content: { event_id: eventId },
 				stream
 			}));
@@ -936,29 +1008,37 @@ function registerRoomRoutes(r) {
 			ts: Date.now(),
 			stream
 		}));
-		hs.notifier.notify(type === "m.read.private" ? [s.userId] : await hs.rooms.joinedMembers(roomId));
+		hs.notifier.notify(type === M.READ.PRIVATE ? [s.userId] : await hs.rooms.joinedMembers(roomId));
 		await hs.federation.onReceipt(roomId, s.userId, type, eventId, Date.now(), threadId ?? "").catch(() => {});
 	};
-	const receiptBody = body({ thread_id: z.string(fail("M_INVALID_PARAM", "Invalid thread_id")).min(1, "M_INVALID_PARAM: Invalid thread_id").optional() });
-	r.client("POST", "/rooms/:roomId/receipt/:receiptType/:eventId", { input: receiptBody }, async (ctx) => {
-		const s = await ctx.auth();
-		if (!RECEIPT_TYPES.includes(ctx.params.receiptType)) throw errors.invalidParam("Unknown receipt type");
-		const body = ctx.input;
-		await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
-		await setReceipt(ctx.hs, s, ctx.params.roomId, ctx.params.receiptType, ctx.params.eventId, body.thread_id);
-		return {};
-	});
-	r.client("POST", "/rooms/:roomId/read_markers", { input: body({}) }, async (ctx) => {
-		const s = await ctx.auth();
-		const body = ctx.input;
-		await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
-		for (const type of RECEIPT_TYPES) {
-			const eventId = body[type];
-			if (typeof eventId === "string") await setReceipt(ctx.hs, s, ctx.params.roomId, type, eventId);
+	const receiptBody = body({ thread_id: string(fail("M_INVALID_PARAM", "Invalid thread_id")).min(1, "M_INVALID_PARAM: Invalid thread_id").optional() });
+	r.client("POST", "/rooms/:roomId/receipt/:receiptType/:eventId", procedure({
+		auth: "user",
+		input: receiptBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (!RECEIPT_TYPES.includes(ctx.params.receiptType)) throw errors.invalidParam("Unknown receipt type");
+			const body = ctx.input;
+			await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
+			await setReceipt(ctx.hs, s, ctx.params.roomId, ctx.params.receiptType, ctx.params.eventId, body.thread_id);
+			return {};
 		}
-		return {};
-	});
-	r.client("GET", "/directory/room/:alias", async (ctx) => {
+	}));
+	r.client("POST", "/rooms/:roomId/read_markers", procedure({
+		auth: "user",
+		input: body({}),
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
+			for (const type of RECEIPT_TYPES) {
+				const eventId = body[type];
+				if (typeof eventId === "string") await setReceipt(ctx.hs, s, ctx.params.roomId, type, eventId);
+			}
+			return {};
+		}
+	}));
+	r.client("GET", "/directory/room/:alias", procedure({ handler: async (ctx) => {
 		if (!isValidAlias(ctx.params.alias)) throw errors.invalidParam("Invalid alias");
 		const { roomId, servers } = await ctx.hs.rooms.resolveRoom(ctx.params.alias);
 		const inRoom = await ctx.hs.rooms.exists(roomId) ? [...await ctx.hs.federation.roomDestinations(roomId, await ctx.hs.rooms.currentState(roomId))] : [];
@@ -966,91 +1046,103 @@ function registerRoomRoutes(r) {
 			room_id: roomId,
 			servers: [.../* @__PURE__ */ new Set([...servers, ...inRoom])]
 		};
-	});
-	r.client("PUT", "/directory/room/:alias", async (ctx) => {
-		const s = await ctx.auth();
-		const body = await ctx.json();
-		const alias = ctx.params.alias;
-		if (!isValidAlias(alias) || /\s/.test(alias)) throw errors.invalidParam("Invalid alias");
-		if (parseId(alias, "#").server !== ctx.hs.serverName) throw errors.invalidParam("Alias must be on this server");
-		if (!isValidRoomId(body.room_id)) throw errors.invalidParam("Invalid room_id");
-		if (!await ctx.hs.rooms.exists(body.room_id)) throw errors.notFound("Room not found");
-		const owner = ctx.hs.appservices.exclusiveAliasOwner(alias);
-		if (owner && s.appservice !== owner) throw errors.exclusive("This alias is reserved by an application service");
-		if (await ctx.hs.db.findOne("room_aliases", [{
-			field: "alias",
-			value: alias
-		}])) throw new MatrixError(409, "M_UNKNOWN", "Room alias already exists");
-		await ctx.hs.db.create("room_aliases", {
-			alias,
-			room_id: body.room_id,
-			creator: s.userId
-		});
-		return {};
-	});
-	r.client("DELETE", "/directory/room/:alias", async (ctx) => {
-		const s = await ctx.auth();
-		const row = await ctx.hs.db.findOne("room_aliases", [{
-			field: "alias",
-			value: ctx.params.alias
-		}]);
-		if (!row) throw errors.notFound("Room alias not found");
-		if (!await canDeleteAlias(ctx.hs, s, row)) throw errors.forbidden("You may not delete this alias");
-		await ctx.hs.db.delete("room_aliases", [{
-			field: "alias",
-			value: ctx.params.alias
-		}]);
-		const canonical = getState(await ctx.hs.rooms.currentState(row.room_id), "m.room.canonical_alias");
-		if (canonical) {
-			const content = { ...canonical.content };
-			let changed = false;
-			if (content.alias === ctx.params.alias) {
-				delete content.alias;
-				changed = true;
-			}
-			if (Array.isArray(content.alt_aliases) && content.alt_aliases.includes(ctx.params.alias)) {
-				content.alt_aliases = content.alt_aliases.filter((a) => a !== ctx.params.alias);
-				changed = true;
+	} }));
+	r.client("PUT", "/directory/room/:alias", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = await ctx.json();
+			const alias = ctx.params.alias;
+			if (!isValidAlias(alias) || /\s/.test(alias)) throw errors.invalidParam("Invalid alias");
+			if (parseId(alias, "#").server !== ctx.hs.serverName) throw errors.invalidParam("Alias must be on this server");
+			if (!isValidRoomId(body.room_id)) throw errors.invalidParam("Invalid room_id");
+			if (!await ctx.hs.rooms.exists(body.room_id)) throw errors.notFound("Room not found");
+			const owner = ctx.hs.appservices.exclusiveAliasOwner(alias);
+			if (owner && s.appservice !== owner) throw errors.exclusive("This alias is reserved by an application service");
+			if (await ctx.hs.db.findOne("room_aliases", [{
+				field: "alias",
+				value: alias
+			}])) throw new MatrixError(409, "M_UNKNOWN", "Room alias already exists");
+			await ctx.hs.db.create("room_aliases", {
+				alias,
+				room_id: body.room_id,
+				creator: s.userId
+			});
+			return {};
+		}
+	}));
+	r.client("DELETE", "/directory/room/:alias", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const row = await ctx.hs.db.findOne("room_aliases", [{
+				field: "alias",
+				value: ctx.params.alias
+			}]);
+			if (!row) throw errors.notFound("Room alias not found");
+			if (!await canDeleteAlias(ctx.hs, s, row)) throw errors.forbidden("You may not delete this alias");
+			await ctx.hs.db.delete("room_aliases", [{
+				field: "alias",
+				value: ctx.params.alias
+			}]);
+			const canonical = getState(await ctx.hs.rooms.currentState(row.room_id), M.ROOM.CANONICAL_ALIAS);
+			if (canonical) {
+				const content = { ...canonical.content };
+				let changed = false;
+				if (content.alias === ctx.params.alias) {
+					delete content.alias;
+					changed = true;
+				}
+				if (Array.isArray(content.alt_aliases) && content.alt_aliases.includes(ctx.params.alias)) {
+					content.alt_aliases = content.alt_aliases.filter((a) => a !== ctx.params.alias);
+					changed = true;
+				}
+				if (changed) await ctx.hs.rooms.sendEvent(row.room_id, s.userId, {
+					type: M.ROOM.CANONICAL_ALIAS,
+					state_key: "",
+					content
+				}).catch(() => {});
 			}
-			if (changed) await ctx.hs.rooms.sendEvent(row.room_id, s.userId, {
-				type: "m.room.canonical_alias",
-				state_key: "",
-				content
-			}).catch(() => {});
+			return {};
 		}
-		return {};
-	});
-	r.client("GET", "/rooms/:roomId/aliases", async (ctx) => {
-		const s = await ctx.auth();
-		await visibleState(ctx.hs, ctx.params.roomId, s.userId);
-		return { aliases: (await ctx.hs.db.findMany("room_aliases", { where: [{
-			field: "room_id",
-			value: ctx.params.roomId
-		}] })).map((r) => r.alias) };
-	});
-	r.client("GET", "/directory/list/room/:roomId", async (ctx) => {
+	}));
+	r.client("GET", "/rooms/:roomId/aliases", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			await visibleState(ctx.hs, ctx.params.roomId, s.userId);
+			return { aliases: (await ctx.hs.db.findMany("room_aliases", { where: [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}] })).map((r) => r.alias) };
+		}
+	}));
+	r.client("GET", "/directory/list/room/:roomId", procedure({ handler: async (ctx) => {
 		const row = await ctx.hs.db.findOne("rooms", [{
 			field: "room_id",
 			value: ctx.params.roomId
 		}]);
 		if (!row) throw errors.notFound("Room not found");
 		return { visibility: row.is_public ? "public" : "private" };
-	});
-	r.client("PUT", "/directory/list/room/:roomId", async (ctx) => {
-		const s = await ctx.auth();
-		const body = await ctx.json();
-		if (!["public", "private"].includes(body.visibility)) throw errors.invalidParam("Invalid visibility");
-		const version = await ctx.hs.rooms.roomVersion(ctx.params.roomId);
-		if (!version) throw errors.notFound("Room not found");
-		const state = await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
-		const pl = powerLevels(state, version);
-		if (!s.isAdmin && userLevel(pl, s.userId) < (pl.events["m.room.canonical_alias"] ?? pl.state_default)) throw errors.forbidden("Insufficient power level");
-		await ctx.hs.db.update("rooms", [{
-			field: "room_id",
-			value: ctx.params.roomId
-		}], { is_public: body.visibility === "public" });
-		return {};
-	});
+	} }));
+	r.client("PUT", "/directory/list/room/:roomId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = await ctx.json();
+			if (!["public", "private"].includes(body.visibility)) throw errors.invalidParam("Invalid visibility");
+			const version = await ctx.hs.rooms.roomVersion(ctx.params.roomId);
+			if (!version) throw errors.notFound("Room not found");
+			const state = await ctx.hs.rooms.requireJoined(ctx.params.roomId, s.userId);
+			const pl = powerLevels(state, version);
+			if (!s.isAdmin && userLevel(pl, s.userId) < (pl.events[M.ROOM.CANONICAL_ALIAS] ?? pl.state_default)) throw errors.forbidden("Insufficient power level");
+			await ctx.hs.db.update("rooms", [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}], { is_public: body.visibility === "public" });
+			return {};
+		}
+	}));
 	const remoteOrLocal = async (ctx, body) => {
 		const server = ctx.query.get("server");
 		if (server && server !== ctx.hs.serverName) {
@@ -1061,26 +1153,33 @@ function registerRoomRoutes(r) {
 		}
 		return publicRooms(ctx, body);
 	};
-	r.client("GET", "/publicRooms", (ctx) => remoteOrLocal(ctx, {}));
-	r.client("POST", "/publicRooms", { input: body({}) }, async (ctx) => {
-		await ctx.auth();
-		return remoteOrLocal(ctx, ctx.input);
-	});
+	r.client("GET", "/publicRooms", procedure({ handler: (ctx) => remoteOrLocal(ctx, {}) }));
+	r.client("POST", "/publicRooms", procedure({
+		auth: "user",
+		input: body({}),
+		handler: async (ctx) => {
+			return remoteOrLocal(ctx, ctx.input);
+		}
+	}));
 	const upgradeBody = body({
-		new_version: z.string(fail("M_BAD_JSON", "Missing new_version")),
-		additional_creators: z.unknown().optional()
-	});
-	r.client("POST", "/rooms/:roomId/upgrade", { input: upgradeBody }, async (ctx) => {
-		const s = await ctx.auth();
-		const body = ctx.input;
-		return { replacement_room: await upgradeRoom(ctx.hs, s, ctx.params.roomId, body.new_version, body.additional_creators) };
+		new_version: string(fail("M_BAD_JSON", "Missing new_version")),
+		additional_creators: unknown().optional()
 	});
+	r.client("POST", "/rooms/:roomId/upgrade", procedure({
+		auth: "user",
+		input: upgradeBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			return { replacement_room: await upgradeRoom(ctx.hs, s, ctx.params.roomId, body.new_version, body.additional_creators) };
+		}
+	}));
 	const reportBody = body({
-		score: z.number(fail("M_INVALID_PARAM", "score must be between -100 and 0")).int("M_INVALID_PARAM: score must be between -100 and 0").min(-100, "M_INVALID_PARAM: score must be between -100 and 0").max(0, "M_INVALID_PARAM: score must be between -100 and 0").optional(),
-		reason: z.string(fail("M_BAD_JSON", "reason must be a string")).optional()
+		score: number(fail("M_INVALID_PARAM", "score must be between -100 and 0")).int("M_INVALID_PARAM: score must be between -100 and 0").min(-100, "M_INVALID_PARAM: score must be between -100 and 0").max(0, "M_INVALID_PARAM: score must be between -100 and 0").optional(),
+		reason: string(fail("M_BAD_JSON", "reason must be a string")).optional()
 	});
 	const report = async (ctx) => {
-		const s = await ctx.auth();
+		const s = ctx.session;
 		const hs = ctx.hs;
 		const roomId = ctx.params.roomId;
 		await requireRoom(hs, roomId);
@@ -1112,136 +1211,160 @@ function registerRoomRoutes(r) {
 		if (hs.adminRoom) hs.adminRoom.say(`New report #${id} from ${s.userId} about ${ctx.params.eventId ?? "room"} in ${roomId}: ${body.reason ?? "(no reason)"}`).catch(() => {});
 		return {};
 	};
-	r.client("POST", "/users/:userId/report", { input: body({ reason: z.string(fail("M_BAD_JSON", "reason must be a string")) }) }, async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const body = ctx.input;
-		const userId = ctx.params.userId;
-		if (!isValidUserId(userId)) throw errors.invalidParam("Invalid user ID");
-		if (hs.isLocalUser(userId) && !await hs.db.findOne("users", [{
-			field: "user_id",
-			value: userId
-		}])) throw errors.notFound("Unknown user");
-		const id = await hs.cluster.nextId("user_reports");
-		await hs.db.create("user_reports", {
-			id,
-			ts: Date.now(),
-			user_id: userId,
-			reporter: s.userId,
-			reason: body.reason,
-			resolved: false
-		});
-		await hs.audit.record({
-			action: "user_report",
-			actor: s.userId,
-			target: userId,
-			details: { report_id: id }
-		});
-		if (hs.adminRoom) hs.adminRoom.say(`New user report #${id} from ${s.userId} about ${userId}: ${body.reason || "(no reason)"}`).catch(() => {});
-		return {};
-	});
-	r.client("GET", "/mutual_rooms", async (ctx) => {
-		const s = await ctx.auth();
-		const other = ctx.query.get("user_id");
-		if (other === null) throw errors.missingParam("Missing user_id");
-		if (!isValidUserId(other)) throw errors.invalidParam("Invalid user_id");
-		if (other === s.userId) throw errors.invalidParam("user_id must not be your own");
-		const theirs = new Set(await ctx.hs.rooms.roomsForUser(other));
-		const joined = (await ctx.hs.rooms.roomsForUser(s.userId)).filter((r) => theirs.has(r)).sort();
-		const from = ctx.query.get("from");
-		const start = from === null ? 0 : joined.findIndex((r) => r > from);
-		if (from !== null && !isValidRoomId(from)) throw errors.invalidParam("Invalid from token");
-		const page = start < 0 ? [] : joined.slice(start, start + 100);
-		const out = {
-			joined: page,
-			count: joined.length
-		};
-		if (start >= 0 && start + 100 < joined.length) out.next_batch = page[page.length - 1];
-		return out;
-	}, ["v1"]);
-	r.client("POST", "/rooms/:roomId/report/:eventId", { input: reportBody }, report);
-	r.client("POST", "/rooms/:roomId/report", { input: reportBody }, report);
-	r.client("GET", "/admin/whois/:userId", async (ctx) => {
-		const s = await ctx.auth();
-		const userId = ctx.params.userId;
-		if (userId !== s.userId && !s.isAdmin) throw errors.forbidden("Only server admins can look up other users");
-		if (!ctx.hs.isLocalUser(userId)) throw errors.notFound("Unknown user");
-		const devices = await ctx.hs.db.findMany("devices", { where: [{
-			field: "user_id",
-			value: userId
-		}] });
-		const out = {};
-		for (const d of devices) out[d.device_id] = { sessions: [{ connections: d.last_seen_ip ? [{
-			ip: d.last_seen_ip,
-			last_seen: d.last_seen_ts
-		}] : [] }] };
-		return {
-			user_id: userId,
-			devices: out
-		};
-	});
-	r.client("PUT", "/directory/list/appservice/:networkId/:roomId", async (ctx) => {
-		if (!(await ctx.auth()).appservice) throw errors.forbidden("Only application services may use this endpoint");
-		const body = await ctx.json();
-		if (!["public", "private"].includes(body.visibility)) throw errors.invalidParam("Invalid visibility");
-		if (!await ctx.hs.rooms.exists(ctx.params.roomId)) throw errors.notFound("Room not found");
-		await ctx.hs.db.update("rooms", [{
-			field: "room_id",
-			value: ctx.params.roomId
-		}], { is_public: body.visibility === "public" });
-		return {};
-	});
+	r.client("POST", "/users/:userId/report", procedure({
+		auth: "user",
+		input: body({ reason: string(fail("M_BAD_JSON", "reason must be a string")) }),
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const body = ctx.input;
+			const userId = ctx.params.userId;
+			if (!isValidUserId(userId)) throw errors.invalidParam("Invalid user ID");
+			if (hs.isLocalUser(userId) && !await hs.db.findOne("users", [{
+				field: "user_id",
+				value: userId
+			}])) throw errors.notFound("Unknown user");
+			const id = await hs.cluster.nextId("user_reports");
+			await hs.db.create("user_reports", {
+				id,
+				ts: Date.now(),
+				user_id: userId,
+				reporter: s.userId,
+				reason: body.reason,
+				resolved: false
+			});
+			await hs.audit.record({
+				action: "user_report",
+				actor: s.userId,
+				target: userId,
+				details: { report_id: id }
+			});
+			if (hs.adminRoom) hs.adminRoom.say(`New user report #${id} from ${s.userId} about ${userId}: ${body.reason || "(no reason)"}`).catch(() => {});
+			return {};
+		}
+	}));
+	r.client("GET", "/mutual_rooms", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const other = ctx.query.get("user_id");
+			if (other === null) throw errors.missingParam("Missing user_id");
+			if (!isValidUserId(other)) throw errors.invalidParam("Invalid user_id");
+			if (other === s.userId) throw errors.invalidParam("user_id must not be your own");
+			const theirs = new Set(await ctx.hs.rooms.roomsForUser(other));
+			const joined = (await ctx.hs.rooms.roomsForUser(s.userId)).filter((r) => theirs.has(r)).sort();
+			const from = ctx.query.get("from");
+			const start = from === null ? 0 : joined.findIndex((r) => r > from);
+			if (from !== null && !isValidRoomId(from)) throw errors.invalidParam("Invalid from token");
+			const page = start < 0 ? [] : joined.slice(start, start + 100);
+			const out = {
+				joined: page,
+				count: joined.length
+			};
+			if (start >= 0 && start + 100 < joined.length) out.next_batch = page[page.length - 1];
+			return out;
+		}
+	}), ["v1"]);
+	r.client("POST", "/rooms/:roomId/report/:eventId", procedure({
+		auth: "user",
+		input: reportBody,
+		handler: report
+	}));
+	r.client("POST", "/rooms/:roomId/report", procedure({
+		auth: "user",
+		input: reportBody,
+		handler: report
+	}));
+	r.client("GET", "/admin/whois/:userId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const userId = ctx.params.userId;
+			if (userId !== s.userId && !s.isAdmin) throw errors.forbidden("Only server admins can look up other users");
+			if (!ctx.hs.isLocalUser(userId)) throw errors.notFound("Unknown user");
+			const devices = await ctx.hs.db.findMany("devices", { where: [{
+				field: "user_id",
+				value: userId
+			}] });
+			const out = {};
+			for (const d of devices) out[d.device_id] = { sessions: [{ connections: d.last_seen_ip ? [{
+				ip: d.last_seen_ip,
+				last_seen: d.last_seen_ts
+			}] : [] }] };
+			return {
+				user_id: userId,
+				devices: out
+			};
+		}
+	}));
+	r.client("PUT", "/directory/list/appservice/:networkId/:roomId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			if (!ctx.session.appservice) throw errors.forbidden("Only application services may use this endpoint");
+			const body = await ctx.json();
+			if (!["public", "private"].includes(body.visibility)) throw errors.invalidParam("Invalid visibility");
+			if (!await ctx.hs.rooms.exists(ctx.params.roomId)) throw errors.notFound("Room not found");
+			await ctx.hs.db.update("rooms", [{
+				field: "room_id",
+				value: ctx.params.roomId
+			}], { is_public: body.visibility === "public" });
+			return {};
+		}
+	}));
 	const relVersions = ["v1", "v3"];
-	r.client("GET", "/rooms/:roomId/relations/:eventId", relations, relVersions);
-	r.client("GET", "/rooms/:roomId/relations/:eventId/:relType", relations, relVersions);
-	r.client("GET", "/rooms/:roomId/relations/:eventId/:relType/:eventType", relations, relVersions);
-	r.client("GET", "/rooms/:roomId/threads", threads, ["v1"]);
-	r.client("GET", "/rooms/:roomId/timestamp_to_event", async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const roomId = ctx.params.roomId;
-		await visibleState(hs, roomId, s.userId);
-		const ts = Number(ctx.query.get("ts"));
-		const dir = ctx.query.get("dir");
-		if (!Number.isFinite(ts) || dir !== "f" && dir !== "b") throw errors.invalidParam("Invalid ts or dir");
-		let local = null;
-		const rows = await hs.db.findMany("events", { where: [{
-			field: "room_id",
-			value: roomId
-		}] });
-		rows.sort((a, b) => dir === "f" ? a.json.origin_server_ts - b.json.origin_server_ts || a.depth - b.depth || a.stream - b.stream : b.json.origin_server_ts - a.json.origin_server_ts || b.depth - a.depth || b.stream - a.stream);
-		for (const row of rows) {
-			const t = row.json.origin_server_ts;
-			if (!(dir === "f" ? t >= ts : t <= ts)) continue;
-			if ((await hs.rooms.filterVisible(s.userId, roomId, [hs.rooms.rowToStored(row)])).length) {
-				local = {
-					event_id: row.event_id,
-					origin_server_ts: t
-				};
-				break;
+	r.client("GET", "/rooms/:roomId/relations/:eventId", procedure({ handler: relations }), relVersions);
+	r.client("GET", "/rooms/:roomId/relations/:eventId/:relType", procedure({ handler: relations }), relVersions);
+	r.client("GET", "/rooms/:roomId/relations/:eventId/:relType/:eventType", procedure({ handler: relations }), relVersions);
+	r.client("GET", "/rooms/:roomId/threads", procedure({ handler: threads }), ["v1"]);
+	r.client("GET", "/rooms/:roomId/timestamp_to_event", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const roomId = ctx.params.roomId;
+			await visibleState(hs, roomId, s.userId);
+			const ts = Number(ctx.query.get("ts"));
+			const dir = ctx.query.get("dir");
+			if (!Number.isFinite(ts) || dir !== "f" && dir !== "b") throw errors.invalidParam("Invalid ts or dir");
+			let local = null;
+			const rows = await hs.db.findMany("events", { where: [{
+				field: "room_id",
+				value: roomId
+			}] });
+			rows.sort((a, b) => dir === "f" ? a.json.origin_server_ts - b.json.origin_server_ts || a.depth - b.depth || a.stream - b.stream : b.json.origin_server_ts - a.json.origin_server_ts || b.depth - a.depth || b.stream - a.stream);
+			for (const row of rows) {
+				const t = row.json.origin_server_ts;
+				if (!(dir === "f" ? t >= ts : t <= ts)) continue;
+				if ((await hs.rooms.filterVisible(s.userId, roomId, [hs.rooms.rowToStored(row)])).length) {
+					local = {
+						event_id: row.event_id,
+						origin_server_ts: t
+					};
+					break;
+				}
 			}
+			if (hs.federation.enabled) for (const server of hs.federation.serversInRoom(await hs.rooms.currentState(roomId))) try {
+				const remote = await hs.federation.client.request(server, "GET", `/_matrix/federation/v1/timestamp_to_event/${encodeURIComponent(roomId)}`, {
+					query: {
+						ts: String(ts),
+						dir
+					},
+					timeoutMs: 1e4
+				});
+				if (typeof remote.event_id !== "string" || typeof remote.origin_server_ts !== "number") continue;
+				if (!local || (dir === "f" ? remote.origin_server_ts < local.origin_server_ts : remote.origin_server_ts > local.origin_server_ts)) {
+					if (!await hs.rooms.getEvent(remote.event_id)) await hs.federation.backfill(roomId, [remote.event_id], 1).catch(() => 0);
+					local = {
+						event_id: remote.event_id,
+						origin_server_ts: remote.origin_server_ts
+					};
+				}
+				break;
+			} catch {}
+			if (!local) throw errors.notFound("No event found");
+			return local;
 		}
-		if (hs.federation.enabled) for (const server of hs.federation.serversInRoom(await hs.rooms.currentState(roomId))) try {
-			const remote = await hs.federation.client.request(server, "GET", `/_matrix/federation/v1/timestamp_to_event/${encodeURIComponent(roomId)}`, {
-				query: {
-					ts: String(ts),
-					dir
-				},
-				timeoutMs: 1e4
-			});
-			if (typeof remote.event_id !== "string" || typeof remote.origin_server_ts !== "number") continue;
-			if (!local || (dir === "f" ? remote.origin_server_ts < local.origin_server_ts : remote.origin_server_ts > local.origin_server_ts)) {
-				if (!await hs.rooms.getEvent(remote.event_id)) await hs.federation.backfill(roomId, [remote.event_id], 1).catch(() => 0);
-				local = {
-					event_id: remote.event_id,
-					origin_server_ts: remote.origin_server_ts
-				};
-			}
-			break;
-		} catch {}
-		if (!local) throw errors.notFound("No event found");
-		return local;
-	}, ["v1", "v3"]);
+	}), ["v1", "v3"]);
 }
 async function relations(ctx) {
 	const s = await ctx.auth();
@@ -1270,7 +1393,7 @@ async function relations(ctx) {
 	const matches = [];
 	let next = null;
 	for (const row of rows) {
-		const rel = row.json.content?.["m.relates_to"];
+		const rel = row.json.content?.[M.RELATES_TO];
 		if (!isObject(rel) || rel.event_id !== ctx.params.eventId) continue;
 		if (ctx.params.relType && rel.rel_type !== ctx.params.relType) continue;
 		if (ctx.params.eventType && row.type !== ctx.params.eventType) continue;
@@ -1310,8 +1433,8 @@ async function threads(ctx) {
 	});
 	const latest = /* @__PURE__ */ new Map();
 	for (const row of rows) {
-		const rel = row.json.content?.["m.relates_to"];
-		if (!isObject(rel) || rel.rel_type !== "m.thread" || typeof rel.event_id !== "string") continue;
+		const rel = row.json.content?.[M.RELATES_TO];
+		if (!isObject(rel) || rel.rel_type !== M.THREAD || typeof rel.event_id !== "string") continue;
 		const entry = latest.get(rel.event_id) ?? {
 			stream: row.stream,
 			latestId: row.event_id,
@@ -1346,9 +1469,9 @@ async function threads(ctx) {
 		const latestEv = await hs.rooms.getEvent(info.latestId);
 		ev.unsigned = {
 			...ev.unsigned,
-			"m.relations": {
-				...ev.unsigned?.["m.relations"],
-				"m.thread": {
+			[M.RELATIONS]: {
+				...ev.unsigned?.[M.RELATIONS],
+				[M.THREAD]: {
 					latest_event: latestEv ? hs.rooms.formatEvent(latestEv, viewer) : void 0,
 					count: info.count,
 					current_user_participated: r.ev.pdu.sender === s.userId || info.participants.has(s.userId)