Assembles every key this account holds for scope into a bundle for one
recipient and encrypts it, so somebody invited today can read what was
said before they arrived.
Nothing leaves the device. This produces ciphertext to upload and a
secret to hand back; shareHistoryBundle is the call that tells
anybody about it. Calling this and throwing the result away is free and
has no effect, which is deliberate: a product can build the bundle purely
to show HistoryBundle.shared and let a person decide.
The encryption is this library's, not yours. You upload bytes and pass
the secret back; you never implement Matrix's attachment encryption, and
the plaintext bundle never exists on your side of the boundary.
The three steps are ordered and the order is not negotiable. Build,
upload, then announce. Announcing a location nothing has been uploaded to
gives the recipient a URL that 404s and no second chance, because the
announcement is not repeated.
What this hands over cannot be taken back. A key the other device has
is a key it keeps: there is no revocation, no expiry, and no way to narrow
it afterwards. It is a person-level act, not a scope-level one -- it names
one recipient and gives them everything this account can decrypt in that
scope, from its beginning.
Assembles every key this account holds for
scopeinto a bundle for one recipient and encrypts it, so somebody invited today can read what was said before they arrived.Nothing leaves the device. This produces ciphertext to upload and a secret to hand back; shareHistoryBundle is the call that tells anybody about it. Calling this and throwing the result away is free and has no effect, which is deliberate: a product can build the bundle purely to show HistoryBundle.shared and let a person decide.
The encryption is this library's, not yours. You upload bytes and pass the secret back; you never implement Matrix's attachment encryption, and the plaintext bundle never exists on your side of the boundary.
The three steps are ordered and the order is not negotiable. Build, upload, then announce. Announcing a location nothing has been uploaded to gives the recipient a URL that 404s and no second chance, because the announcement is not repeated.
What this hands over cannot be taken back. A key the other device has is a key it keeps: there is no revocation, no expiry, and no way to narrow it afterwards. It is a person-level act, not a scope-level one -- it names one recipient and gives them everything this account can decrypt in that scope, from its beginning.