npm - @liveblocks/core - Versions diffs - 3.20.0-perm6 → 3.20.0-perm8 - Mend

@liveblocks/core 3.20.0-perm6 → 3.20.0-perm8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

package/dist/index.d.cts CHANGED Viewed

@@ -110,28 +110,38 @@ type PermissionMatrix = {
     personal: AccessLevel;
 };
 type PermissionResources = keyof PermissionMatrix;
-type RoomPermissionGrant = {
-    resource: string;
-    scopes: readonly Permission[];
-};
-type RoomPermission = Permission[];
-type RoomPermissionInput = readonly Permission[];
-type RoomAccesses = Record<string, RoomPermission>;
-type RoomAccessesInput = Record<string, RoomPermissionInput>;
-type RoomAccessesUpdateInput = Record<string, RoomPermissionInput | null>;
-type RoomPermissionSources = {
-    defaultAccesses: readonly Permission[];
-    groupsAccesses: readonly (readonly Permission[])[];
-    userAccesses?: readonly Permission[] | undefined;
-};
-declare function permissionMatrixFromScopes(scopes: readonly string[]): PermissionMatrix;
+type RoomPermissions = Permission[];
+type RoomAccesses = Record<string, RoomPermissions>;
+type UpdateRoomAccesses = Record<string, RoomPermissions | null>;
+declare function permissionMatrixFromScopes(scopes: RoomPermissions): PermissionMatrix;
 declare function hasPermissionAccess(matrix: Partial<PermissionMatrix>, resource: PermissionResources, requiredAccess: RequiredAccessLevel): boolean;
-declare function normalizeRoomPermissionInput(input: RoomPermissionInput): RoomPermission;
-declare function normalizeRoomAccessesInput(input: RoomAccessesInput | undefined): RoomAccesses | undefined;
-declare function normalizeRoomAccessesUpdateInput(input: RoomAccessesUpdateInput | undefined): Record<string, RoomPermission | null> | undefined;
-declare function mergePermissionMatrices(sources: readonly PermissionMatrix[]): PermissionMatrix;
-declare function permissionMatrixToScopes(matrix: PermissionMatrix): RoomPermission;
-declare function mergeRoomPermissionScopes({ defaultAccesses, groupsAccesses, userAccesses, }: RoomPermissionSources): Permission[];
+declare function normalizeRoomPermissions(permissions: string[] | readonly string[]): RoomPermissions;
+declare function normalizeRoomAccesses(accesses: RoomAccesses | undefined): RoomAccesses | undefined;
+declare function normalizeUpdateRoomAccesses(accesses: UpdateRoomAccesses | undefined): UpdateRoomAccesses | undefined;
+declare function mergePermissionMatrices(matrices: PermissionMatrix[]): PermissionMatrix;
+declare function permissionMatrixToScopes(matrix: PermissionMatrix): RoomPermissions;
+/**
+ * Merges permission scopes from multiple sources, by priority: explicit user
+ * accesses override group accesses, which override the room defaults. Groups
+ * all share the same priority, so they are first merged together by taking
+ * the highest access level per feature (and base).
+ */
+declare function mergeRoomPermissionScopes({ defaultAccesses, groupsAccesses, userAccesses, }: {
+    defaultAccesses: RoomPermissions;
+    groupsAccesses: RoomPermissions[];
+    userAccesses: RoomPermissions;
+}): RoomPermissions;
+/**
+ * Validates a set of permissions:
+ * - every scope must be a known permission scope,
+ * - exactly one base permission is required (*:read, *:write, or the legacy
+ *   aliases room:read, room:write),
+ * - at most one scope per feature (storage, comments, feeds, ...),
+ * - room:presence:write is accepted as an extra legacy scope.
+ *
+ * Returns `true` when the set is valid, or an error message otherwise.
+ */
+declare function validatePermissionsSet(scopes: readonly string[]): true | string;
 type CustomAuthenticationResult = Relax<{
     token: string;
@@ -1754,7 +1764,7 @@ interface RoomHttpApi<TM extends BaseMetadata, CM extends BaseMetadata> {
         subscriptions: SubscriptionData[];
         requestedAt: Date;
         nextCursor: string | null;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     getThreadsSince(options: {
         roomId: string;
@@ -1774,7 +1784,7 @@ interface RoomHttpApi<TM extends BaseMetadata, CM extends BaseMetadata> {
             deleted: SubscriptionDeleteInfo[];
         };
         requestedAt: Date;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     searchComments(options: {
         roomId: string;
@@ -2024,7 +2034,7 @@ interface LiveblocksHttpApi<TM extends BaseMetadata, CM extends BaseMetadata> ex
         subscriptions: SubscriptionData[];
         nextCursor: string | null;
         requestedAt: Date;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     getUserThreadsSince_experimental(options: {
         since: Date;
@@ -2043,7 +2053,7 @@ interface LiveblocksHttpApi<TM extends BaseMetadata, CM extends BaseMetadata> ex
             deleted: SubscriptionDeleteInfo[];
         };
         requestedAt: Date;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     groupsStore: BatchStore<GroupData | undefined, string>;
     getGroup(groupId: string): Promise<GroupData | undefined>;
@@ -3852,7 +3862,7 @@ type Room<P extends JsonObject = DP, S extends LsonObject = DS, U extends BaseUs
         subscriptions: SubscriptionData[];
         requestedAt: Date;
         nextCursor: string | null;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     /**
      * Returns the updated and deleted threads and their associated inbox notifications and subscriptions since the requested date.
@@ -3876,7 +3886,7 @@ type Room<P extends JsonObject = DP, S extends LsonObject = DS, U extends BaseUs
             deleted: SubscriptionDeleteInfo[];
         };
         requestedAt: Date;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     /**
      * Returns a thread and the associated inbox notification and subscription if it exists.
@@ -5769,4 +5779,4 @@ type EnsureJson<T> = T extends Json ? T : T extends Array<infer I> ? (EnsureJson
     [K in keyof T as EnsureJson<T[K]> extends never ? never : K]: EnsureJson<T[K]>;
 };
-export { type AccessLevel, type ActivityData, type AiAssistantContentPart, type AiAssistantMessage, type AiChat, type AiChatMessage, type AiChatsQuery, type AiKnowledgeRetrievalPart, type AiKnowledgeSource, type AiOpaqueToolDefinition, type AiOpaqueToolInvocationProps, type AiReasoningPart, type AiRetrievalPart, type AiSourcesPart, type AiTextPart, type AiToolDefinition, type AiToolExecuteCallback, type AiToolExecuteContext, type AiToolInvocationPart, type AiToolInvocationProps, type AiToolTypePack, type AiUrlSource, type AiUserMessage, type AiWebRetrievalPart, type AsyncError, type AsyncLoading, type AsyncResult, type AsyncSuccess, type Awaitable, type BaseActivitiesData, type BaseAuthResult, type BaseGroupInfo, type BaseMetadata, type BaseRoomInfo, type BaseUserMeta, type Brand, type BroadcastEventClientMsg, type BroadcastOptions, type BroadcastedEventServerMsg, type ChildStorageNode, type Client, type ClientMsg, ClientMsgCode, type ClientOptions, type ClientWireOp, type CommentAttachment, type CommentBody, type CommentBodyBlockElement, type CommentBodyElement, type CommentBodyInlineElement, type CommentBodyLink, type CommentBodyLinkElementArgs, type CommentBodyMention, type CommentBodyMentionElementArgs, type CommentBodyParagraph, type CommentBodyParagraphElementArgs, type CommentBodyText, type CommentBodyTextElementArgs, type CommentData, type CommentDataPlain, type CommentLocalAttachment, type CommentMixedAttachment, type CommentReaction, type CommentUserReaction, type CommentUserReactionPlain, type CommentsEventServerMsg, type CompactChildNode, type CompactListNode, type CompactMapNode, type CompactNode, type CompactObjectNode, type CompactRegisterNode, type CompactRootNode, type ContextualPromptContext, type ContextualPromptResponse, type CopilotId, CrdtType, type CreateListOp, type CreateManagedPoolOptions, type CreateMapOp, type CreateObjectOp, type CreateOp, type CreateRegisterOp, type Cursor, type CustomAuthenticationResult, type DAD, type DCM, type DE, type DFM, type DFMD, type DGI, type DP, type DRI, type DS, type DTM, type DU, DefaultMap, type Delegates, type DeleteCrdtOp, type DeleteObjectKeyOp, Deque, DerivedSignal, DevToolsTreeNode as DevTools, protocol as DevToolsMsg, type DistributiveOmit, type EnsureJson, type EnterOptions, type EventSource, type Feed, type FeedCreateMetadata, type FeedDeletedServerMsg, type FeedFetchMetadataFilter, type FeedMessage, type FeedMessagesAddedServerMsg, type FeedMessagesDeletedServerMsg, type FeedMessagesListServerMsg, type FeedMessagesUpdatedServerMsg, type FeedRequestError, FeedRequestErrorCode, type FeedRequestFailedServerMsg, type FeedUpdateMetadata, type FeedsAddedServerMsg, type FeedsEventServerMsg, type FeedsListServerMsg, type FeedsUpdatedServerMsg, type FetchStorageClientMsg, type FetchYDocClientMsg, type GetThreadsOptions, type GroupData, type GroupDataPlain, type GroupMemberData, type GroupMentionData, type GroupScopes, type HasOpId, type History, type HistoryVersion, HttpError, type ISODateString, type ISignal, type IUserInfo, type IWebSocket, type IWebSocketCloseEvent, type IWebSocketEvent, type IWebSocketInstance, type IWebSocketMessageEvent, type IYjsProvider, type IgnoredOp, type Immutable, type InboxNotificationCustomData, type InboxNotificationCustomDataPlain, type InboxNotificationData, type InboxNotificationDataPlain, type InboxNotificationDeleteInfo, type InboxNotificationTextMentionData, type InboxNotificationTextMentionDataPlain, type InboxNotificationThreadData, type InboxNotificationThreadDataPlain, type InferFromSchema, type Json, type JsonArray, type JsonObject, type JsonScalar, type KDAD, type LayerKey, type ListStorageNode, LiveList, type LiveListUpdate, LiveMap, type LiveMapUpdate, type LiveNode, LiveObject, type LiveObjectUpdate, type LiveStructure, LiveblocksError, type LiveblocksErrorContext, type LostConnectionEvent, type Lson, type LsonObject, MENTION_CHARACTER, type ManagedPool, type MapStorageNode, type MentionData, type MessageId, MutableSignal, type NoInfr, type NodeMap, type NodeStream, type NotificationChannel, type NotificationChannelSettings, type NotificationKind, type NotificationSettings, type NotificationSettingsPlain, type ObjectStorageNode, type Observable, type Op, OpCode, type OpaqueClient, type OpaqueRoom, type OptionalTupleUnless, type OthersEvent, type ParentToChildNodeMap, type PartialNotificationSettings, type PartialUnless, type Patchable, Permission, type PermissionMatrix, type PermissionResources, type PlainLson, type PlainLsonFields, type PlainLsonList, type PlainLsonMap, type PlainLsonObject, type Poller, type PrivateClientApi, type PrivateRoomApi, Promise_withResolvers, type QueryMetadata, type QueryParams, type ReadonlyJson, type ReadonlyJsonObject, type RegisterStorageNode, type RejectedStorageOpServerMsg, type Relax, type RenderableToolResultResponse, type RequiredAccessLevel, type Resolve, type ResolveGroupsInfoArgs, type ResolveMentionSuggestionsArgs, type ResolveRoomsInfoArgs, type ResolveUsersArgs, type Room, type RoomAccesses, type RoomAccessesInput, type RoomAccessesUpdateInput, type RoomEventMessage, type RoomPermission, type RoomPermissionGrant, type RoomPermissionInput, type RoomPermissionSources, type RoomStateServerMsg, type RoomSubscriptionSettings, type RootStorageNode, type SearchCommentsResult, type SerializedChild, type SerializedCrdt, type SerializedList, type SerializedMap, type SerializedObject, type SerializedRegister, type SerializedRootObject, type ServerMsg, ServerMsgCode, type ServerWireOp, type SetParentKeyOp, Signal, type SignalType, SortedList, type Status, type StorageChunkServerMsg, type StorageNode, type StorageStatus, type StorageUpdate, type StringifyCommentBodyElements, type StringifyCommentBodyOptions, type SubscriptionData, type SubscriptionDataPlain, type SubscriptionDeleteInfo, type SubscriptionDeleteInfoPlain, type SubscriptionKey, type SyncConfig, type SyncMode, type SyncSource, type SyncStatus, TextEditorType, type ThreadData, type ThreadDataPlain, type ThreadDataWithDeleteInfo, type ThreadDeleteInfo, type ToJson, type ToolResultResponse, type URLSafeString, type UnsubscribeCallback, type UpdateObjectOp, type UpdatePresenceClientMsg, type UpdatePresenceServerMsg, type UpdateStorageClientMsg, type UpdateStorageServerMsg, type UpdateYDocClientMsg, type UploadAttachmentOptions, type UrlMetadata, type User, type UserJoinServerMsg, type UserLeftServerMsg, type UserMentionData, type UserRoomSubscriptionSettings, type UserSubscriptionData, type UserSubscriptionDataPlain, WebsocketCloseCodes, type WithNavigation, type WithOptional, type WithRequired, type YDocUpdateServerMsg, type YjsSyncStatus, asPos, assert, assertNever, autoRetry, b64decode, batch, checkBounds, chunk, cloneLson, compactNodesToNodeStream, compactObject, fancyConsole as console, convertToCommentData, convertToCommentUserReaction, convertToGroupData, convertToInboxNotificationData, convertToSubscriptionData, convertToThreadData, convertToUserSubscriptionData, createClient, createCommentAttachmentId, createCommentId, createInboxNotificationId, createManagedPool, createNotificationSettings, createThreadId, deepLiveify, defineAiTool, deprecate, deprecateIf, detectDupes, entries, errorIf, findLastIndex, freeze, generateUrl, getMentionsFromCommentBody, getSubscriptionKey, hasPermissionAccess, html, htmlSafe, isCommentBodyLink, isCommentBodyMention, isCommentBodyText, isJsonArray, isJsonObject, isJsonScalar, isListStorageNode, isLiveNode, isMapStorageNode, isNotificationChannelEnabled, isNumberOperator, isObjectStorageNode, isPlainObject, isRegisterStorageNode, isRootStorageNode, isStartsWithOperator, isUrl, kInternal, keys, makeAbortController, makeEventSource, makePoller, makePosition, mapValues, memoizeOnSuccess, mergePermissionMatrices, mergeRoomPermissionScopes, nanoid, nn, nodeStreamToCompactNodes, normalizeRoomAccessesInput, normalizeRoomAccessesUpdateInput, normalizeRoomPermissionInput, objectToQuery, patchNotificationSettings, permissionMatrixFromScopes, permissionMatrixToScopes, raise, resolveMentionsInCommentBody, sanitizeUrl, shallow, shallow2, stableStringify, stringifyCommentBody, throwUsageError, toPlainLson, tryParseJson, url, urljoin, wait, warnOnce, warnOnceIf, withTimeout };
+export { type AccessLevel, type ActivityData, type AiAssistantContentPart, type AiAssistantMessage, type AiChat, type AiChatMessage, type AiChatsQuery, type AiKnowledgeRetrievalPart, type AiKnowledgeSource, type AiOpaqueToolDefinition, type AiOpaqueToolInvocationProps, type AiReasoningPart, type AiRetrievalPart, type AiSourcesPart, type AiTextPart, type AiToolDefinition, type AiToolExecuteCallback, type AiToolExecuteContext, type AiToolInvocationPart, type AiToolInvocationProps, type AiToolTypePack, type AiUrlSource, type AiUserMessage, type AiWebRetrievalPart, type AsyncError, type AsyncLoading, type AsyncResult, type AsyncSuccess, type Awaitable, type BaseActivitiesData, type BaseAuthResult, type BaseGroupInfo, type BaseMetadata, type BaseRoomInfo, type BaseUserMeta, type Brand, type BroadcastEventClientMsg, type BroadcastOptions, type BroadcastedEventServerMsg, type ChildStorageNode, type Client, type ClientMsg, ClientMsgCode, type ClientOptions, type ClientWireOp, type CommentAttachment, type CommentBody, type CommentBodyBlockElement, type CommentBodyElement, type CommentBodyInlineElement, type CommentBodyLink, type CommentBodyLinkElementArgs, type CommentBodyMention, type CommentBodyMentionElementArgs, type CommentBodyParagraph, type CommentBodyParagraphElementArgs, type CommentBodyText, type CommentBodyTextElementArgs, type CommentData, type CommentDataPlain, type CommentLocalAttachment, type CommentMixedAttachment, type CommentReaction, type CommentUserReaction, type CommentUserReactionPlain, type CommentsEventServerMsg, type CompactChildNode, type CompactListNode, type CompactMapNode, type CompactNode, type CompactObjectNode, type CompactRegisterNode, type CompactRootNode, type ContextualPromptContext, type ContextualPromptResponse, type CopilotId, CrdtType, type CreateListOp, type CreateManagedPoolOptions, type CreateMapOp, type CreateObjectOp, type CreateOp, type CreateRegisterOp, type Cursor, type CustomAuthenticationResult, type DAD, type DCM, type DE, type DFM, type DFMD, type DGI, type DP, type DRI, type DS, type DTM, type DU, DefaultMap, type Delegates, type DeleteCrdtOp, type DeleteObjectKeyOp, Deque, DerivedSignal, DevToolsTreeNode as DevTools, protocol as DevToolsMsg, type DistributiveOmit, type EnsureJson, type EnterOptions, type EventSource, type Feed, type FeedCreateMetadata, type FeedDeletedServerMsg, type FeedFetchMetadataFilter, type FeedMessage, type FeedMessagesAddedServerMsg, type FeedMessagesDeletedServerMsg, type FeedMessagesListServerMsg, type FeedMessagesUpdatedServerMsg, type FeedRequestError, FeedRequestErrorCode, type FeedRequestFailedServerMsg, type FeedUpdateMetadata, type FeedsAddedServerMsg, type FeedsEventServerMsg, type FeedsListServerMsg, type FeedsUpdatedServerMsg, type FetchStorageClientMsg, type FetchYDocClientMsg, type GetThreadsOptions, type GroupData, type GroupDataPlain, type GroupMemberData, type GroupMentionData, type GroupScopes, type HasOpId, type History, type HistoryVersion, HttpError, type ISODateString, type ISignal, type IUserInfo, type IWebSocket, type IWebSocketCloseEvent, type IWebSocketEvent, type IWebSocketInstance, type IWebSocketMessageEvent, type IYjsProvider, type IgnoredOp, type Immutable, type InboxNotificationCustomData, type InboxNotificationCustomDataPlain, type InboxNotificationData, type InboxNotificationDataPlain, type InboxNotificationDeleteInfo, type InboxNotificationTextMentionData, type InboxNotificationTextMentionDataPlain, type InboxNotificationThreadData, type InboxNotificationThreadDataPlain, type InferFromSchema, type Json, type JsonArray, type JsonObject, type JsonScalar, type KDAD, type LayerKey, type ListStorageNode, LiveList, type LiveListUpdate, LiveMap, type LiveMapUpdate, type LiveNode, LiveObject, type LiveObjectUpdate, type LiveStructure, LiveblocksError, type LiveblocksErrorContext, type LostConnectionEvent, type Lson, type LsonObject, MENTION_CHARACTER, type ManagedPool, type MapStorageNode, type MentionData, type MessageId, MutableSignal, type NoInfr, type NodeMap, type NodeStream, type NotificationChannel, type NotificationChannelSettings, type NotificationKind, type NotificationSettings, type NotificationSettingsPlain, type ObjectStorageNode, type Observable, type Op, OpCode, type OpaqueClient, type OpaqueRoom, type OptionalTupleUnless, type OthersEvent, type ParentToChildNodeMap, type PartialNotificationSettings, type PartialUnless, type Patchable, Permission, type PermissionMatrix, type PermissionResources, type PlainLson, type PlainLsonFields, type PlainLsonList, type PlainLsonMap, type PlainLsonObject, type Poller, type PrivateClientApi, type PrivateRoomApi, Promise_withResolvers, type QueryMetadata, type QueryParams, type ReadonlyJson, type ReadonlyJsonObject, type RegisterStorageNode, type RejectedStorageOpServerMsg, type Relax, type RenderableToolResultResponse, type RequiredAccessLevel, type Resolve, type ResolveGroupsInfoArgs, type ResolveMentionSuggestionsArgs, type ResolveRoomsInfoArgs, type ResolveUsersArgs, type Room, type RoomAccesses, type RoomEventMessage, type RoomPermissions, type RoomStateServerMsg, type RoomSubscriptionSettings, type RootStorageNode, type SearchCommentsResult, type SerializedChild, type SerializedCrdt, type SerializedList, type SerializedMap, type SerializedObject, type SerializedRegister, type SerializedRootObject, type ServerMsg, ServerMsgCode, type ServerWireOp, type SetParentKeyOp, Signal, type SignalType, SortedList, type Status, type StorageChunkServerMsg, type StorageNode, type StorageStatus, type StorageUpdate, type StringifyCommentBodyElements, type StringifyCommentBodyOptions, type SubscriptionData, type SubscriptionDataPlain, type SubscriptionDeleteInfo, type SubscriptionDeleteInfoPlain, type SubscriptionKey, type SyncConfig, type SyncMode, type SyncSource, type SyncStatus, TextEditorType, type ThreadData, type ThreadDataPlain, type ThreadDataWithDeleteInfo, type ThreadDeleteInfo, type ToJson, type ToolResultResponse, type URLSafeString, type UnsubscribeCallback, type UpdateObjectOp, type UpdatePresenceClientMsg, type UpdatePresenceServerMsg, type UpdateRoomAccesses, type UpdateStorageClientMsg, type UpdateStorageServerMsg, type UpdateYDocClientMsg, type UploadAttachmentOptions, type UrlMetadata, type User, type UserJoinServerMsg, type UserLeftServerMsg, type UserMentionData, type UserRoomSubscriptionSettings, type UserSubscriptionData, type UserSubscriptionDataPlain, WebsocketCloseCodes, type WithNavigation, type WithOptional, type WithRequired, type YDocUpdateServerMsg, type YjsSyncStatus, asPos, assert, assertNever, autoRetry, b64decode, batch, checkBounds, chunk, cloneLson, compactNodesToNodeStream, compactObject, fancyConsole as console, convertToCommentData, convertToCommentUserReaction, convertToGroupData, convertToInboxNotificationData, convertToSubscriptionData, convertToThreadData, convertToUserSubscriptionData, createClient, createCommentAttachmentId, createCommentId, createInboxNotificationId, createManagedPool, createNotificationSettings, createThreadId, deepLiveify, defineAiTool, deprecate, deprecateIf, detectDupes, entries, errorIf, findLastIndex, freeze, generateUrl, getMentionsFromCommentBody, getSubscriptionKey, hasPermissionAccess, html, htmlSafe, isCommentBodyLink, isCommentBodyMention, isCommentBodyText, isJsonArray, isJsonObject, isJsonScalar, isListStorageNode, isLiveNode, isMapStorageNode, isNotificationChannelEnabled, isNumberOperator, isObjectStorageNode, isPlainObject, isRegisterStorageNode, isRootStorageNode, isStartsWithOperator, isUrl, kInternal, keys, makeAbortController, makeEventSource, makePoller, makePosition, mapValues, memoizeOnSuccess, mergePermissionMatrices, mergeRoomPermissionScopes, nanoid, nn, nodeStreamToCompactNodes, normalizeRoomAccesses, normalizeRoomPermissions, normalizeUpdateRoomAccesses, objectToQuery, patchNotificationSettings, permissionMatrixFromScopes, permissionMatrixToScopes, raise, resolveMentionsInCommentBody, sanitizeUrl, shallow, shallow2, stableStringify, stringifyCommentBody, throwUsageError, toPlainLson, tryParseJson, url, urljoin, validatePermissionsSet, wait, warnOnce, warnOnceIf, withTimeout };

package/dist/index.d.ts CHANGED Viewed

@@ -110,28 +110,38 @@ type PermissionMatrix = {
     personal: AccessLevel;
 };
 type PermissionResources = keyof PermissionMatrix;
-type RoomPermissionGrant = {
-    resource: string;
-    scopes: readonly Permission[];
-};
-type RoomPermission = Permission[];
-type RoomPermissionInput = readonly Permission[];
-type RoomAccesses = Record<string, RoomPermission>;
-type RoomAccessesInput = Record<string, RoomPermissionInput>;
-type RoomAccessesUpdateInput = Record<string, RoomPermissionInput | null>;
-type RoomPermissionSources = {
-    defaultAccesses: readonly Permission[];
-    groupsAccesses: readonly (readonly Permission[])[];
-    userAccesses?: readonly Permission[] | undefined;
-};
-declare function permissionMatrixFromScopes(scopes: readonly string[]): PermissionMatrix;
+type RoomPermissions = Permission[];
+type RoomAccesses = Record<string, RoomPermissions>;
+type UpdateRoomAccesses = Record<string, RoomPermissions | null>;
+declare function permissionMatrixFromScopes(scopes: RoomPermissions): PermissionMatrix;
 declare function hasPermissionAccess(matrix: Partial<PermissionMatrix>, resource: PermissionResources, requiredAccess: RequiredAccessLevel): boolean;
-declare function normalizeRoomPermissionInput(input: RoomPermissionInput): RoomPermission;
-declare function normalizeRoomAccessesInput(input: RoomAccessesInput | undefined): RoomAccesses | undefined;
-declare function normalizeRoomAccessesUpdateInput(input: RoomAccessesUpdateInput | undefined): Record<string, RoomPermission | null> | undefined;
-declare function mergePermissionMatrices(sources: readonly PermissionMatrix[]): PermissionMatrix;
-declare function permissionMatrixToScopes(matrix: PermissionMatrix): RoomPermission;
-declare function mergeRoomPermissionScopes({ defaultAccesses, groupsAccesses, userAccesses, }: RoomPermissionSources): Permission[];
+declare function normalizeRoomPermissions(permissions: string[] | readonly string[]): RoomPermissions;
+declare function normalizeRoomAccesses(accesses: RoomAccesses | undefined): RoomAccesses | undefined;
+declare function normalizeUpdateRoomAccesses(accesses: UpdateRoomAccesses | undefined): UpdateRoomAccesses | undefined;
+declare function mergePermissionMatrices(matrices: PermissionMatrix[]): PermissionMatrix;
+declare function permissionMatrixToScopes(matrix: PermissionMatrix): RoomPermissions;
+/**
+ * Merges permission scopes from multiple sources, by priority: explicit user
+ * accesses override group accesses, which override the room defaults. Groups
+ * all share the same priority, so they are first merged together by taking
+ * the highest access level per feature (and base).
+ */
+declare function mergeRoomPermissionScopes({ defaultAccesses, groupsAccesses, userAccesses, }: {
+    defaultAccesses: RoomPermissions;
+    groupsAccesses: RoomPermissions[];
+    userAccesses: RoomPermissions;
+}): RoomPermissions;
+/**
+ * Validates a set of permissions:
+ * - every scope must be a known permission scope,
+ * - exactly one base permission is required (*:read, *:write, or the legacy
+ *   aliases room:read, room:write),
+ * - at most one scope per feature (storage, comments, feeds, ...),
+ * - room:presence:write is accepted as an extra legacy scope.
+ *
+ * Returns `true` when the set is valid, or an error message otherwise.
+ */
+declare function validatePermissionsSet(scopes: readonly string[]): true | string;
 type CustomAuthenticationResult = Relax<{
     token: string;
@@ -1754,7 +1764,7 @@ interface RoomHttpApi<TM extends BaseMetadata, CM extends BaseMetadata> {
         subscriptions: SubscriptionData[];
         requestedAt: Date;
         nextCursor: string | null;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     getThreadsSince(options: {
         roomId: string;
@@ -1774,7 +1784,7 @@ interface RoomHttpApi<TM extends BaseMetadata, CM extends BaseMetadata> {
             deleted: SubscriptionDeleteInfo[];
         };
         requestedAt: Date;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     searchComments(options: {
         roomId: string;
@@ -2024,7 +2034,7 @@ interface LiveblocksHttpApi<TM extends BaseMetadata, CM extends BaseMetadata> ex
         subscriptions: SubscriptionData[];
         nextCursor: string | null;
         requestedAt: Date;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     getUserThreadsSince_experimental(options: {
         since: Date;
@@ -2043,7 +2053,7 @@ interface LiveblocksHttpApi<TM extends BaseMetadata, CM extends BaseMetadata> ex
             deleted: SubscriptionDeleteInfo[];
         };
         requestedAt: Date;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     groupsStore: BatchStore<GroupData | undefined, string>;
     getGroup(groupId: string): Promise<GroupData | undefined>;
@@ -3852,7 +3862,7 @@ type Room<P extends JsonObject = DP, S extends LsonObject = DS, U extends BaseUs
         subscriptions: SubscriptionData[];
         requestedAt: Date;
         nextCursor: string | null;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     /**
      * Returns the updated and deleted threads and their associated inbox notifications and subscriptions since the requested date.
@@ -3876,7 +3886,7 @@ type Room<P extends JsonObject = DP, S extends LsonObject = DS, U extends BaseUs
             deleted: SubscriptionDeleteInfo[];
         };
         requestedAt: Date;
-        permissionHints: Record<string, Permission[]>;
+        permissionHints: Record<string, RoomPermissions>;
     }>;
     /**
      * Returns a thread and the associated inbox notification and subscription if it exists.
@@ -5769,4 +5779,4 @@ type EnsureJson<T> = T extends Json ? T : T extends Array<infer I> ? (EnsureJson
     [K in keyof T as EnsureJson<T[K]> extends never ? never : K]: EnsureJson<T[K]>;
 };
-export { type AccessLevel, type ActivityData, type AiAssistantContentPart, type AiAssistantMessage, type AiChat, type AiChatMessage, type AiChatsQuery, type AiKnowledgeRetrievalPart, type AiKnowledgeSource, type AiOpaqueToolDefinition, type AiOpaqueToolInvocationProps, type AiReasoningPart, type AiRetrievalPart, type AiSourcesPart, type AiTextPart, type AiToolDefinition, type AiToolExecuteCallback, type AiToolExecuteContext, type AiToolInvocationPart, type AiToolInvocationProps, type AiToolTypePack, type AiUrlSource, type AiUserMessage, type AiWebRetrievalPart, type AsyncError, type AsyncLoading, type AsyncResult, type AsyncSuccess, type Awaitable, type BaseActivitiesData, type BaseAuthResult, type BaseGroupInfo, type BaseMetadata, type BaseRoomInfo, type BaseUserMeta, type Brand, type BroadcastEventClientMsg, type BroadcastOptions, type BroadcastedEventServerMsg, type ChildStorageNode, type Client, type ClientMsg, ClientMsgCode, type ClientOptions, type ClientWireOp, type CommentAttachment, type CommentBody, type CommentBodyBlockElement, type CommentBodyElement, type CommentBodyInlineElement, type CommentBodyLink, type CommentBodyLinkElementArgs, type CommentBodyMention, type CommentBodyMentionElementArgs, type CommentBodyParagraph, type CommentBodyParagraphElementArgs, type CommentBodyText, type CommentBodyTextElementArgs, type CommentData, type CommentDataPlain, type CommentLocalAttachment, type CommentMixedAttachment, type CommentReaction, type CommentUserReaction, type CommentUserReactionPlain, type CommentsEventServerMsg, type CompactChildNode, type CompactListNode, type CompactMapNode, type CompactNode, type CompactObjectNode, type CompactRegisterNode, type CompactRootNode, type ContextualPromptContext, type ContextualPromptResponse, type CopilotId, CrdtType, type CreateListOp, type CreateManagedPoolOptions, type CreateMapOp, type CreateObjectOp, type CreateOp, type CreateRegisterOp, type Cursor, type CustomAuthenticationResult, type DAD, type DCM, type DE, type DFM, type DFMD, type DGI, type DP, type DRI, type DS, type DTM, type DU, DefaultMap, type Delegates, type DeleteCrdtOp, type DeleteObjectKeyOp, Deque, DerivedSignal, DevToolsTreeNode as DevTools, protocol as DevToolsMsg, type DistributiveOmit, type EnsureJson, type EnterOptions, type EventSource, type Feed, type FeedCreateMetadata, type FeedDeletedServerMsg, type FeedFetchMetadataFilter, type FeedMessage, type FeedMessagesAddedServerMsg, type FeedMessagesDeletedServerMsg, type FeedMessagesListServerMsg, type FeedMessagesUpdatedServerMsg, type FeedRequestError, FeedRequestErrorCode, type FeedRequestFailedServerMsg, type FeedUpdateMetadata, type FeedsAddedServerMsg, type FeedsEventServerMsg, type FeedsListServerMsg, type FeedsUpdatedServerMsg, type FetchStorageClientMsg, type FetchYDocClientMsg, type GetThreadsOptions, type GroupData, type GroupDataPlain, type GroupMemberData, type GroupMentionData, type GroupScopes, type HasOpId, type History, type HistoryVersion, HttpError, type ISODateString, type ISignal, type IUserInfo, type IWebSocket, type IWebSocketCloseEvent, type IWebSocketEvent, type IWebSocketInstance, type IWebSocketMessageEvent, type IYjsProvider, type IgnoredOp, type Immutable, type InboxNotificationCustomData, type InboxNotificationCustomDataPlain, type InboxNotificationData, type InboxNotificationDataPlain, type InboxNotificationDeleteInfo, type InboxNotificationTextMentionData, type InboxNotificationTextMentionDataPlain, type InboxNotificationThreadData, type InboxNotificationThreadDataPlain, type InferFromSchema, type Json, type JsonArray, type JsonObject, type JsonScalar, type KDAD, type LayerKey, type ListStorageNode, LiveList, type LiveListUpdate, LiveMap, type LiveMapUpdate, type LiveNode, LiveObject, type LiveObjectUpdate, type LiveStructure, LiveblocksError, type LiveblocksErrorContext, type LostConnectionEvent, type Lson, type LsonObject, MENTION_CHARACTER, type ManagedPool, type MapStorageNode, type MentionData, type MessageId, MutableSignal, type NoInfr, type NodeMap, type NodeStream, type NotificationChannel, type NotificationChannelSettings, type NotificationKind, type NotificationSettings, type NotificationSettingsPlain, type ObjectStorageNode, type Observable, type Op, OpCode, type OpaqueClient, type OpaqueRoom, type OptionalTupleUnless, type OthersEvent, type ParentToChildNodeMap, type PartialNotificationSettings, type PartialUnless, type Patchable, Permission, type PermissionMatrix, type PermissionResources, type PlainLson, type PlainLsonFields, type PlainLsonList, type PlainLsonMap, type PlainLsonObject, type Poller, type PrivateClientApi, type PrivateRoomApi, Promise_withResolvers, type QueryMetadata, type QueryParams, type ReadonlyJson, type ReadonlyJsonObject, type RegisterStorageNode, type RejectedStorageOpServerMsg, type Relax, type RenderableToolResultResponse, type RequiredAccessLevel, type Resolve, type ResolveGroupsInfoArgs, type ResolveMentionSuggestionsArgs, type ResolveRoomsInfoArgs, type ResolveUsersArgs, type Room, type RoomAccesses, type RoomAccessesInput, type RoomAccessesUpdateInput, type RoomEventMessage, type RoomPermission, type RoomPermissionGrant, type RoomPermissionInput, type RoomPermissionSources, type RoomStateServerMsg, type RoomSubscriptionSettings, type RootStorageNode, type SearchCommentsResult, type SerializedChild, type SerializedCrdt, type SerializedList, type SerializedMap, type SerializedObject, type SerializedRegister, type SerializedRootObject, type ServerMsg, ServerMsgCode, type ServerWireOp, type SetParentKeyOp, Signal, type SignalType, SortedList, type Status, type StorageChunkServerMsg, type StorageNode, type StorageStatus, type StorageUpdate, type StringifyCommentBodyElements, type StringifyCommentBodyOptions, type SubscriptionData, type SubscriptionDataPlain, type SubscriptionDeleteInfo, type SubscriptionDeleteInfoPlain, type SubscriptionKey, type SyncConfig, type SyncMode, type SyncSource, type SyncStatus, TextEditorType, type ThreadData, type ThreadDataPlain, type ThreadDataWithDeleteInfo, type ThreadDeleteInfo, type ToJson, type ToolResultResponse, type URLSafeString, type UnsubscribeCallback, type UpdateObjectOp, type UpdatePresenceClientMsg, type UpdatePresenceServerMsg, type UpdateStorageClientMsg, type UpdateStorageServerMsg, type UpdateYDocClientMsg, type UploadAttachmentOptions, type UrlMetadata, type User, type UserJoinServerMsg, type UserLeftServerMsg, type UserMentionData, type UserRoomSubscriptionSettings, type UserSubscriptionData, type UserSubscriptionDataPlain, WebsocketCloseCodes, type WithNavigation, type WithOptional, type WithRequired, type YDocUpdateServerMsg, type YjsSyncStatus, asPos, assert, assertNever, autoRetry, b64decode, batch, checkBounds, chunk, cloneLson, compactNodesToNodeStream, compactObject, fancyConsole as console, convertToCommentData, convertToCommentUserReaction, convertToGroupData, convertToInboxNotificationData, convertToSubscriptionData, convertToThreadData, convertToUserSubscriptionData, createClient, createCommentAttachmentId, createCommentId, createInboxNotificationId, createManagedPool, createNotificationSettings, createThreadId, deepLiveify, defineAiTool, deprecate, deprecateIf, detectDupes, entries, errorIf, findLastIndex, freeze, generateUrl, getMentionsFromCommentBody, getSubscriptionKey, hasPermissionAccess, html, htmlSafe, isCommentBodyLink, isCommentBodyMention, isCommentBodyText, isJsonArray, isJsonObject, isJsonScalar, isListStorageNode, isLiveNode, isMapStorageNode, isNotificationChannelEnabled, isNumberOperator, isObjectStorageNode, isPlainObject, isRegisterStorageNode, isRootStorageNode, isStartsWithOperator, isUrl, kInternal, keys, makeAbortController, makeEventSource, makePoller, makePosition, mapValues, memoizeOnSuccess, mergePermissionMatrices, mergeRoomPermissionScopes, nanoid, nn, nodeStreamToCompactNodes, normalizeRoomAccessesInput, normalizeRoomAccessesUpdateInput, normalizeRoomPermissionInput, objectToQuery, patchNotificationSettings, permissionMatrixFromScopes, permissionMatrixToScopes, raise, resolveMentionsInCommentBody, sanitizeUrl, shallow, shallow2, stableStringify, stringifyCommentBody, throwUsageError, toPlainLson, tryParseJson, url, urljoin, wait, warnOnce, warnOnceIf, withTimeout };
+export { type AccessLevel, type ActivityData, type AiAssistantContentPart, type AiAssistantMessage, type AiChat, type AiChatMessage, type AiChatsQuery, type AiKnowledgeRetrievalPart, type AiKnowledgeSource, type AiOpaqueToolDefinition, type AiOpaqueToolInvocationProps, type AiReasoningPart, type AiRetrievalPart, type AiSourcesPart, type AiTextPart, type AiToolDefinition, type AiToolExecuteCallback, type AiToolExecuteContext, type AiToolInvocationPart, type AiToolInvocationProps, type AiToolTypePack, type AiUrlSource, type AiUserMessage, type AiWebRetrievalPart, type AsyncError, type AsyncLoading, type AsyncResult, type AsyncSuccess, type Awaitable, type BaseActivitiesData, type BaseAuthResult, type BaseGroupInfo, type BaseMetadata, type BaseRoomInfo, type BaseUserMeta, type Brand, type BroadcastEventClientMsg, type BroadcastOptions, type BroadcastedEventServerMsg, type ChildStorageNode, type Client, type ClientMsg, ClientMsgCode, type ClientOptions, type ClientWireOp, type CommentAttachment, type CommentBody, type CommentBodyBlockElement, type CommentBodyElement, type CommentBodyInlineElement, type CommentBodyLink, type CommentBodyLinkElementArgs, type CommentBodyMention, type CommentBodyMentionElementArgs, type CommentBodyParagraph, type CommentBodyParagraphElementArgs, type CommentBodyText, type CommentBodyTextElementArgs, type CommentData, type CommentDataPlain, type CommentLocalAttachment, type CommentMixedAttachment, type CommentReaction, type CommentUserReaction, type CommentUserReactionPlain, type CommentsEventServerMsg, type CompactChildNode, type CompactListNode, type CompactMapNode, type CompactNode, type CompactObjectNode, type CompactRegisterNode, type CompactRootNode, type ContextualPromptContext, type ContextualPromptResponse, type CopilotId, CrdtType, type CreateListOp, type CreateManagedPoolOptions, type CreateMapOp, type CreateObjectOp, type CreateOp, type CreateRegisterOp, type Cursor, type CustomAuthenticationResult, type DAD, type DCM, type DE, type DFM, type DFMD, type DGI, type DP, type DRI, type DS, type DTM, type DU, DefaultMap, type Delegates, type DeleteCrdtOp, type DeleteObjectKeyOp, Deque, DerivedSignal, DevToolsTreeNode as DevTools, protocol as DevToolsMsg, type DistributiveOmit, type EnsureJson, type EnterOptions, type EventSource, type Feed, type FeedCreateMetadata, type FeedDeletedServerMsg, type FeedFetchMetadataFilter, type FeedMessage, type FeedMessagesAddedServerMsg, type FeedMessagesDeletedServerMsg, type FeedMessagesListServerMsg, type FeedMessagesUpdatedServerMsg, type FeedRequestError, FeedRequestErrorCode, type FeedRequestFailedServerMsg, type FeedUpdateMetadata, type FeedsAddedServerMsg, type FeedsEventServerMsg, type FeedsListServerMsg, type FeedsUpdatedServerMsg, type FetchStorageClientMsg, type FetchYDocClientMsg, type GetThreadsOptions, type GroupData, type GroupDataPlain, type GroupMemberData, type GroupMentionData, type GroupScopes, type HasOpId, type History, type HistoryVersion, HttpError, type ISODateString, type ISignal, type IUserInfo, type IWebSocket, type IWebSocketCloseEvent, type IWebSocketEvent, type IWebSocketInstance, type IWebSocketMessageEvent, type IYjsProvider, type IgnoredOp, type Immutable, type InboxNotificationCustomData, type InboxNotificationCustomDataPlain, type InboxNotificationData, type InboxNotificationDataPlain, type InboxNotificationDeleteInfo, type InboxNotificationTextMentionData, type InboxNotificationTextMentionDataPlain, type InboxNotificationThreadData, type InboxNotificationThreadDataPlain, type InferFromSchema, type Json, type JsonArray, type JsonObject, type JsonScalar, type KDAD, type LayerKey, type ListStorageNode, LiveList, type LiveListUpdate, LiveMap, type LiveMapUpdate, type LiveNode, LiveObject, type LiveObjectUpdate, type LiveStructure, LiveblocksError, type LiveblocksErrorContext, type LostConnectionEvent, type Lson, type LsonObject, MENTION_CHARACTER, type ManagedPool, type MapStorageNode, type MentionData, type MessageId, MutableSignal, type NoInfr, type NodeMap, type NodeStream, type NotificationChannel, type NotificationChannelSettings, type NotificationKind, type NotificationSettings, type NotificationSettingsPlain, type ObjectStorageNode, type Observable, type Op, OpCode, type OpaqueClient, type OpaqueRoom, type OptionalTupleUnless, type OthersEvent, type ParentToChildNodeMap, type PartialNotificationSettings, type PartialUnless, type Patchable, Permission, type PermissionMatrix, type PermissionResources, type PlainLson, type PlainLsonFields, type PlainLsonList, type PlainLsonMap, type PlainLsonObject, type Poller, type PrivateClientApi, type PrivateRoomApi, Promise_withResolvers, type QueryMetadata, type QueryParams, type ReadonlyJson, type ReadonlyJsonObject, type RegisterStorageNode, type RejectedStorageOpServerMsg, type Relax, type RenderableToolResultResponse, type RequiredAccessLevel, type Resolve, type ResolveGroupsInfoArgs, type ResolveMentionSuggestionsArgs, type ResolveRoomsInfoArgs, type ResolveUsersArgs, type Room, type RoomAccesses, type RoomEventMessage, type RoomPermissions, type RoomStateServerMsg, type RoomSubscriptionSettings, type RootStorageNode, type SearchCommentsResult, type SerializedChild, type SerializedCrdt, type SerializedList, type SerializedMap, type SerializedObject, type SerializedRegister, type SerializedRootObject, type ServerMsg, ServerMsgCode, type ServerWireOp, type SetParentKeyOp, Signal, type SignalType, SortedList, type Status, type StorageChunkServerMsg, type StorageNode, type StorageStatus, type StorageUpdate, type StringifyCommentBodyElements, type StringifyCommentBodyOptions, type SubscriptionData, type SubscriptionDataPlain, type SubscriptionDeleteInfo, type SubscriptionDeleteInfoPlain, type SubscriptionKey, type SyncConfig, type SyncMode, type SyncSource, type SyncStatus, TextEditorType, type ThreadData, type ThreadDataPlain, type ThreadDataWithDeleteInfo, type ThreadDeleteInfo, type ToJson, type ToolResultResponse, type URLSafeString, type UnsubscribeCallback, type UpdateObjectOp, type UpdatePresenceClientMsg, type UpdatePresenceServerMsg, type UpdateRoomAccesses, type UpdateStorageClientMsg, type UpdateStorageServerMsg, type UpdateYDocClientMsg, type UploadAttachmentOptions, type UrlMetadata, type User, type UserJoinServerMsg, type UserLeftServerMsg, type UserMentionData, type UserRoomSubscriptionSettings, type UserSubscriptionData, type UserSubscriptionDataPlain, WebsocketCloseCodes, type WithNavigation, type WithOptional, type WithRequired, type YDocUpdateServerMsg, type YjsSyncStatus, asPos, assert, assertNever, autoRetry, b64decode, batch, checkBounds, chunk, cloneLson, compactNodesToNodeStream, compactObject, fancyConsole as console, convertToCommentData, convertToCommentUserReaction, convertToGroupData, convertToInboxNotificationData, convertToSubscriptionData, convertToThreadData, convertToUserSubscriptionData, createClient, createCommentAttachmentId, createCommentId, createInboxNotificationId, createManagedPool, createNotificationSettings, createThreadId, deepLiveify, defineAiTool, deprecate, deprecateIf, detectDupes, entries, errorIf, findLastIndex, freeze, generateUrl, getMentionsFromCommentBody, getSubscriptionKey, hasPermissionAccess, html, htmlSafe, isCommentBodyLink, isCommentBodyMention, isCommentBodyText, isJsonArray, isJsonObject, isJsonScalar, isListStorageNode, isLiveNode, isMapStorageNode, isNotificationChannelEnabled, isNumberOperator, isObjectStorageNode, isPlainObject, isRegisterStorageNode, isRootStorageNode, isStartsWithOperator, isUrl, kInternal, keys, makeAbortController, makeEventSource, makePoller, makePosition, mapValues, memoizeOnSuccess, mergePermissionMatrices, mergeRoomPermissionScopes, nanoid, nn, nodeStreamToCompactNodes, normalizeRoomAccesses, normalizeRoomPermissions, normalizeUpdateRoomAccesses, objectToQuery, patchNotificationSettings, permissionMatrixFromScopes, permissionMatrixToScopes, raise, resolveMentionsInCommentBody, sanitizeUrl, shallow, shallow2, stableStringify, stringifyCommentBody, throwUsageError, toPlainLson, tryParseJson, url, urljoin, validatePermissionsSet, wait, warnOnce, warnOnceIf, withTimeout };

package/dist/index.js CHANGED Viewed

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "3.20.0-perm6";
+var PKG_VERSION = "3.20.0-perm8";
 var PKG_FORMAT = "esm";
 // src/dupe-detection.ts
@@ -5203,6 +5203,12 @@ var Permission = {
   LegacyRoomPresenceWrite: "room:presence:write"
 };
 var ACCESS_LEVELS = ["none", "read", "write"];
+var basePermissionScopes = /* @__PURE__ */ new Set([
+  Permission.Read,
+  Permission.Write,
+  Permission.RoomRead,
+  Permission.RoomWrite
+]);
 var ACCESS_LEVEL_RANKS = {
   none: 0,
   read: 1,
@@ -5246,6 +5252,9 @@ var ROOM_PERMISSION_RESOURCES = [
   "feeds"
 ];
 var VALID_PERMISSIONS = new Set(Object.values(Permission));
+function isPermission(permission) {
+  return VALID_PERMISSIONS.has(permission);
+}
 function resolveResourceAccess(scopes, resource) {
   const permissions = PERMISSIONS_BY_RESOURCE[resource];
   let resourceAccess;
@@ -5330,46 +5339,46 @@ function resolveRoomPermissionMatrix(permissions, roomId) {
     matrix: explicitMatrix
   });
 }
-function normalizeRoomPermissionInput(input) {
-  if (!Array.isArray(input)) {
+function normalizeRoomPermissions(permissions) {
+  if (!Array.isArray(permissions)) {
     throw new Error("Permission list must be an array");
   }
-  return input.map((permission) => {
-    if (!VALID_PERMISSIONS.has(permission)) {
+  return permissions.map((permission) => {
+    if (!isPermission(permission)) {
       throw new Error(`Not a valid permission: ${permission}`);
     }
     return permission;
   });
 }
-function normalizeRoomAccessesInput(input) {
-  if (input === void 0) {
+function normalizeRoomAccesses(accesses) {
+  if (accesses === void 0) {
     return void 0;
   }
   return Object.fromEntries(
-    Object.entries(input).map(([id, permissions]) => [
+    Object.entries(accesses).map(([id, permissions]) => [
       id,
-      normalizeRoomPermissionInput(permissions)
+      normalizeRoomPermissions(permissions)
     ])
   );
 }
-function normalizeRoomAccessesUpdateInput(input) {
-  if (input === void 0) {
+function normalizeUpdateRoomAccesses(accesses) {
+  if (accesses === void 0) {
     return void 0;
   }
   return Object.fromEntries(
-    Object.entries(input).map(([id, permissions]) => [
+    Object.entries(accesses).map(([id, permissions]) => [
       id,
-      permissions === null ? null : normalizeRoomPermissionInput(permissions)
+      permissions === null ? null : normalizeRoomPermissions(permissions)
     ])
   );
 }
-function mergePermissionMatrices(sources) {
+function mergePermissionMatrices(matrices) {
   return {
-    room: strongestMatrixAccess(sources, "room"),
-    storage: strongestMatrixAccess(sources, "storage"),
-    comments: strongestMatrixAccess(sources, "comments"),
-    feeds: strongestMatrixAccess(sources, "feeds"),
-    personal: strongestMatrixAccess(sources, "personal")
+    room: strongestMatrixAccess(matrices, "room"),
+    storage: strongestMatrixAccess(matrices, "storage"),
+    comments: strongestMatrixAccess(matrices, "comments"),
+    feeds: strongestMatrixAccess(matrices, "feeds"),
+    personal: strongestMatrixAccess(matrices, "personal")
   };
 }
 function permissionMatrixToScopes(matrix) {
@@ -5392,11 +5401,53 @@ function mergeRoomPermissionScopes({
   userAccesses
 }) {
   const sources = [
-    permissionMatrixFromScopes(defaultAccesses),
-    ...groupsAccesses.map((scopes) => permissionMatrixFromScopes(scopes)),
-    ...userAccesses !== void 0 ? [permissionMatrixFromScopes(userAccesses)] : []
+    resolvePermissionScopes(defaultAccesses),
+    mergeResolvedScopesByHighestAccess(
+      groupsAccesses.map(resolvePermissionScopes)
+    ),
+    resolvePermissionScopes(userAccesses)
   ];
-  return permissionMatrixToScopes(mergePermissionMatrices(sources));
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = source.baseAccess;
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = access;
+      }
+    }
+  }
+  return permissionMatrixToScopes(permissionMatrixFromResolvedScopes(merged));
+}
+function mergeResolvedScopesByHighestAccess(sources) {
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = strongestAccess(merged.baseAccess, source.baseAccess);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = strongestAccess(
+          merged.matrix[resource] ?? "none",
+          access
+        );
+      }
+    }
+  }
+  return merged;
 }
 function permissionForAccessLevel(resource, access, field = resource) {
   const levels = PERMISSIONS_BY_RESOURCE[resource];
@@ -5408,9 +5459,9 @@ function permissionForAccessLevel(resource, access, field = resource) {
   }
   return permissions[0];
 }
-function strongestMatrixAccess(sources, resource) {
-  return sources.reduce(
-    (strongest, source) => strongestAccess(strongest, source[resource]),
+function strongestMatrixAccess(matrices, resource) {
+  return matrices.reduce(
+    (strongest, matrix) => strongestAccess(strongest, matrix[resource]),
     "none"
   );
 }
@@ -5426,6 +5477,28 @@ function resourceMatchesRoomId(resource, roomId) {
 function getResourceSpecificity(resource) {
   return resource.replace("*", "").length;
 }
+function validatePermissionsSet(scopes) {
+  const unknownScopes = scopes.filter((scope) => !VALID_PERMISSIONS.has(scope));
+  if (unknownScopes.length > 0) {
+    return `Unknown permission scope(s): ${unknownScopes.join(", ")}`;
+  }
+  const baseScopes = scopes.filter((scope) => basePermissionScopes.has(scope));
+  if (baseScopes.length !== 1) {
+    return `Permissions must include exactly one of ${Permission.Read}, ${Permission.Write} (or the legacy aliases ${Permission.RoomRead}, ${Permission.RoomWrite}), got ${baseScopes.length === 0 ? "none" : baseScopes.join(", ")}`;
+  }
+  const seenFeatures = /* @__PURE__ */ new Set();
+  for (const scope of scopes) {
+    if (basePermissionScopes.has(scope) || scope === Permission.LegacyRoomPresenceWrite) {
+      continue;
+    }
+    const feature = scope.slice(0, scope.indexOf(":"));
+    if (seenFeatures.has(feature)) {
+      return `Permissions can include at most one scope per feature, got multiple "${feature}" scopes`;
+    }
+    seenFeatures.add(feature);
+  }
+  return true;
+}
 // src/protocol/AuthToken.ts
 function isValidAuthTokenPayload(data) {
@@ -5593,7 +5666,7 @@ function makeCachedToken(token, expiresAt) {
 function getAuthTokenPermissionScopes(permissions) {
   return Object.entries(permissions).map(([resource, scopes]) => ({
     resource,
-    scopes
+    scopes: normalizeRoomPermissions(scopes)
   }));
 }
 function cachedTokenSatisfiesRequest(cachedToken, request) {
@@ -9501,23 +9574,15 @@ var ClientMsgCode = Object.freeze({
 // src/refs/ManagedOthers.ts
 function makeUser(conn, presence) {
-  const { connectionId, id, info } = conn;
-  const canWrite = hasPermissionAccess(
-    conn.permissionMatrix,
-    "storage",
-    "write"
-  );
+  const { connectionId, id, info, access } = conn;
+  const { canWrite, canComment } = access;
   return freeze(
     compactObject({
       connectionId,
       id,
       info,
       canWrite,
-      canComment: hasPermissionAccess(
-        conn.permissionMatrix,
-        "comments",
-        "write"
-      ),
+      canComment,
       isReadOnly: !canWrite,
       // Deprecated, kept for backward-compatibility
       presence
@@ -9588,7 +9653,7 @@ var ManagedOthers = class {
    * Records a known connection. This records the connection ID and the
    * associated metadata.
    */
-  setConnection(connectionId, metaUserId, metaUserInfo, scopes) {
+  setConnection(connectionId, metaUserId, metaUserInfo, access) {
     this.#internal.mutate((state) => {
       state.connections.set(
         connectionId,
@@ -9596,7 +9661,7 @@ var ManagedOthers = class {
           connectionId,
           id: metaUserId,
           info: metaUserInfo,
-          permissionMatrix: permissionMatrixFromScopes(scopes)
+          access
         })
       );
       if (!state.presences.has(connectionId)) {
@@ -9749,6 +9814,14 @@ function defaultMessageFromContext(context) {
 // src/room.ts
 var FEEDS_TIMEOUT = 5e3;
+function connectionAccessFromScopes(scopes) {
+  const roomPermissions = normalizeRoomPermissions(scopes);
+  const matrix = permissionMatrixFromScopes(roomPermissions);
+  return {
+    canWrite: hasPermissionAccess(matrix, "storage", "write"),
+    canComment: hasPermissionAccess(matrix, "comments", "write")
+  };
+}
 function makeIdFactory(connectionId) {
   let count = 0;
   return () => `${connectionId}:${count++}`;
@@ -10339,7 +10412,9 @@ function createRoom(options, config) {
     context.dynamicSessionInfoSig.set({
       actor: message.actor,
       nonce: message.nonce,
-      permissionMatrix: permissionMatrixFromScopes(message.scopes),
+      permissionMatrix: permissionMatrixFromScopes(
+        normalizeRoomPermissions(message.scopes)
+      ),
       meta: message.meta
     });
     context.idFactory = makeIdFactory(message.actor);
@@ -10360,7 +10435,7 @@ function createRoom(options, config) {
         connectionId,
         user.id,
         user.info,
-        user.scopes
+        connectionAccessFromScopes(user.scopes)
       );
     }
     return { type: "reset" };
@@ -10380,7 +10455,7 @@ function createRoom(options, config) {
       message.actor,
       message.id,
       message.info,
-      message.scopes
+      connectionAccessFromScopes(message.scopes)
     );
     context.buffer.messages.push({
       type: ClientMsgCode.UPDATE_PRESENCE,
@@ -11746,7 +11821,6 @@ function createClient(options) {
       ),
       authenticate: async () => {
         const resp = await authManager.getAuthValue({
-          // TODO: Should we have permissions for AI Copilots?
           resource: "personal",
           access: "write"
         });
@@ -12690,9 +12764,9 @@ export {
   nanoid,
   nn,
   nodeStreamToCompactNodes,
-  normalizeRoomAccessesInput,
-  normalizeRoomAccessesUpdateInput,
-  normalizeRoomPermissionInput,
+  normalizeRoomAccesses,
+  normalizeRoomPermissions,
+  normalizeUpdateRoomAccesses,
   objectToQuery,
   patchNotificationSettings,
   permissionMatrixFromScopes,
@@ -12709,6 +12783,7 @@ export {
   tryParseJson,
   url,
   urljoin,
+  validatePermissionsSet,
   wait,
   warnOnce,
   warnOnceIf,