@liveblocks/core 3.20.0-pre1 → 3.20.0

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "3.20.0-pre1";
+var PKG_VERSION = "3.20.0";
 var PKG_FORMAT = "esm";
 
 // src/dupe-detection.ts
@@ -701,6 +701,20 @@ var SortedList = class _SortedList {
   get length() {
     return this.#data.length;
   }
+  /**
+   * Whether the given value is present, by identity. O(log n) plus the length
+   * of any run of items that share its sort key (normally 1). Bisects on the
+   * value's own key, so it only finds values sitting at their sorted position,
+   * which is true for any item currently in the list.
+   */
+  includes(value) {
+    for (let i = bisectRight(this.#data, value, this.#lt) - 1; i >= 0 && !this.#lt(this.#data[i], value); i--) {
+      if (this.#data[i] === value) {
+        return true;
+      }
+    }
+    return false;
+  }
   *filter(predicate) {
     for (const item of this.#data) {
       if (predicate(item)) {
@@ -1556,7 +1570,6 @@ function isUrl(string) {
 function createApiClient({
   baseUrl,
   authManager,
-  currentUserId,
   fetchPolyfill
 }) {
   const httpClient = new HttpClient(baseUrl, fetchPolyfill);
@@ -1564,8 +1577,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/threads/delta`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       {
         since: options.since.toISOString()
@@ -1603,8 +1617,9 @@ function createApiClient({
       const result = await httpClient.get(
         url`/v2/c/rooms/${options.roomId}/threads`,
         await authManager.getAuthValue({
-          requestedScope: "comments:read",
-          roomId: options.roomId
+          roomId: options.roomId,
+          resource: "comments",
+          access: "read"
         }),
         {
           cursor: options.cursor,
@@ -1648,8 +1663,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/threads/comments/search`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       {
         text: options.query.text,
@@ -1670,8 +1686,9 @@ function createApiClient({
     const thread = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       {
         id: threadId,
@@ -1690,8 +1707,9 @@ function createApiClient({
     await httpClient.delete(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1699,8 +1717,9 @@ function createApiClient({
     const response = await httpClient.rawGet(
       url`/v2/c/rooms/${options.roomId}/thread-with-notification/${options.threadId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       })
     );
     if (response.ok) {
@@ -1726,8 +1745,9 @@ function createApiClient({
     return await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/metadata`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       options.metadata
     );
@@ -1736,8 +1756,9 @@ function createApiClient({
     return await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/metadata`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       options.metadata
     );
@@ -1747,8 +1768,9 @@ function createApiClient({
     const comment = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       {
         id: commentId,
@@ -1763,8 +1785,9 @@ function createApiClient({
     const comment = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       {
         body: options.body,
@@ -1778,8 +1801,9 @@ function createApiClient({
     await httpClient.delete(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1787,8 +1811,9 @@ function createApiClient({
     const reaction = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       { emoji: options.emoji }
     );
@@ -1798,8 +1823,9 @@ function createApiClient({
     await httpClient.delete(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions/${options.emoji}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1807,8 +1833,9 @@ function createApiClient({
     await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-resolved`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1816,8 +1843,9 @@ function createApiClient({
     await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-unresolved`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1825,8 +1853,9 @@ function createApiClient({
     const subscription = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/subscribe`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       })
     );
     return convertToSubscriptionData(subscription);
@@ -1835,8 +1864,9 @@ function createApiClient({
     await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/unsubscribe`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       })
     );
   }
@@ -1892,8 +1922,9 @@ function createApiClient({
         async () => httpClient.putBlob(
           url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/upload/${encodeURIComponent(attachment.name)}`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "write"
           }),
           attachment.file,
           { fileSize: attachment.size },
@@ -1910,8 +1941,9 @@ function createApiClient({
         async () => httpClient.post(
           url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${encodeURIComponent(attachment.name)}`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "write"
           }),
           void 0,
           { signal: abortSignal },
@@ -1936,8 +1968,9 @@ function createApiClient({
                 async () => httpClient.putBlob(
                   url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${createMultiPartUpload.uploadId}/${String(partNumber)}`,
                   await authManager.getAuthValue({
-                    requestedScope: "comments:read",
-                    roomId
+                    roomId,
+                    resource: "comments",
+                    access: "write"
                   }),
                   part,
                   void 0,
@@ -1960,8 +1993,9 @@ function createApiClient({
         return httpClient.post(
           url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${uploadId}/complete`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "write"
           }),
           { parts: sortedUploadedParts },
           { signal: abortSignal }
@@ -1972,8 +2006,9 @@ function createApiClient({
             await httpClient.rawDelete(
               url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${uploadId}`,
               await authManager.getAuthValue({
-                requestedScope: "comments:read",
-                roomId
+                roomId,
+                resource: "comments",
+                access: "write"
               })
             );
           } catch {
@@ -1990,8 +2025,9 @@ function createApiClient({
         const { urls } = await httpClient.post(
           url`/v2/c/rooms/${roomId}/attachments/presigned-urls`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "read"
           }),
           { attachmentIds }
         );
@@ -2010,109 +2046,13 @@ function createApiClient({
     const batch2 = getOrCreateAttachmentUrlsStore(options.roomId).batch;
     return batch2.get(options.attachmentId);
   }
-  async function uploadChatAttachment(options) {
-    const { chatId, attachment, signal } = options;
-    const userId = currentUserId.get();
-    if (userId === void 0) {
-      throw new Error("Attachment upload requires an authenticated user.");
-    }
-    const ATTACHMENT_PART_SIZE = 5 * 1024 * 1024;
-    if (options.attachment.file.size <= ATTACHMENT_PART_SIZE) {
-      await httpClient.putBlob(
-        url`/v2/c/chats/${chatId}/attachments/${attachment.id}/upload/${encodeURIComponent(attachment.file.name)}`,
-        await authManager.getAuthValue({ requestedScope: "comments:read" }),
-        attachment.file,
-        { fileSize: attachment.file.size },
-        { signal }
-      );
-    } else {
-      const multipartUpload = await httpClient.post(
-        url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${encodeURIComponent(attachment.file.name)}`,
-        await authManager.getAuthValue({ requestedScope: "comments:read" }),
-        void 0,
-        { signal },
-        { fileSize: attachment.file.size }
-      );
-      try {
-        const uploadedParts = [];
-        const parts = [];
-        let start = 0;
-        while (start < attachment.file.size) {
-          const end = Math.min(
-            start + ATTACHMENT_PART_SIZE,
-            attachment.file.size
-          );
-          parts.push({
-            number: parts.length + 1,
-            part: attachment.file.slice(start, end)
-          });
-          start = end;
-        }
-        uploadedParts.push(
-          ...await Promise.all(
-            parts.map(async ({ number, part }) => {
-              return await httpClient.putBlob(
-                url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${multipartUpload.uploadId}/${String(number)}`,
-                await authManager.getAuthValue({
-                  requestedScope: "comments:read"
-                }),
-                part,
-                void 0,
-                { signal }
-              );
-            })
-          )
-        );
-        await httpClient.post(
-          url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${multipartUpload.uploadId}/complete`,
-          await authManager.getAuthValue({ requestedScope: "comments:read" }),
-          { parts: uploadedParts.sort((a, b) => a.number - b.number) },
-          { signal }
-        );
-      } catch (err) {
-        try {
-          await httpClient.delete(
-            url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${multipartUpload.uploadId}`,
-            await authManager.getAuthValue({ requestedScope: "comments:read" })
-          );
-        } catch {
-        }
-        throw err;
-      }
-    }
-  }
-  const attachmentUrlsBatchStoresByChat = new DefaultMap((chatId) => {
-    const batch2 = new Batch(
-      async (batchedAttachmentIds) => {
-        const attachmentIds = batchedAttachmentIds.flat();
-        const { urls } = await httpClient.post(
-          url`/v2/c/chats/${chatId}/attachments/presigned-urls`,
-          await authManager.getAuthValue({
-            requestedScope: "comments:read"
-          }),
-          { attachmentIds }
-        );
-        return urls.map(
-          (url2) => url2 ?? new Error("There was an error while getting this attachment's URL")
-        );
-      },
-      { delay: 50 }
-    );
-    return createBatchStore(batch2);
-  });
-  function getOrCreateChatAttachmentUrlsStore(chatId) {
-    return attachmentUrlsBatchStoresByChat.getOrCreate(chatId);
-  }
-  function getChatAttachmentUrl(options) {
-    const batch2 = getOrCreateChatAttachmentUrlsStore(options.chatId).batch;
-    return batch2.get(options.attachmentId);
-  }
   async function getSubscriptionSettings(options) {
     return httpClient.get(
       url`/v2/c/rooms/${options.roomId}/subscription-settings`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       void 0,
       {
@@ -2124,8 +2064,9 @@ function createApiClient({
     return httpClient.post(
       url`/v2/c/rooms/${options.roomId}/subscription-settings`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       options.settings
     );
@@ -2137,8 +2078,9 @@ function createApiClient({
         await httpClient.post(
           url`/v2/c/rooms/${roomId}/inbox-notifications/read`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "read"
           }),
           { inboxNotificationIds }
         );
@@ -2158,8 +2100,9 @@ function createApiClient({
     await httpClient.rawPost(
       url`/v2/c/rooms/${options.roomId}/text-mentions`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "write"
       }),
       {
         userId: options.mention.kind === "user" ? options.mention.id : void 0,
@@ -2173,8 +2116,9 @@ function createApiClient({
     await httpClient.rawDelete(
       url`/v2/c/rooms/${options.roomId}/text-mentions/${options.mentionId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "write"
       })
     );
   }
@@ -2182,8 +2126,9 @@ function createApiClient({
     return httpClient.rawGet(
       url`/v2/c/rooms/${options.roomId}/y-version/${options.versionId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       })
     );
   }
@@ -2191,8 +2136,9 @@ function createApiClient({
     await httpClient.rawPost(
       url`/v2/c/rooms/${options.roomId}/version`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "write"
       })
     );
   }
@@ -2200,8 +2146,9 @@ function createApiClient({
     await httpClient.rawPost(
       url`/v2/c/rooms/${options.roomId}/text-metadata`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       }),
       {
         type: options.type,
@@ -2213,8 +2160,9 @@ function createApiClient({
     const result = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/ai/contextual-prompt`,
       await authManager.getAuthValue({
-        requestedScope: "room:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       }),
       {
         prompt: options.prompt,
@@ -2236,8 +2184,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/versions`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       })
     );
     return {
@@ -2254,8 +2203,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/versions/delta`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       }),
       { since: options.since.toISOString() },
       { signal: options.signal }
@@ -2274,8 +2224,9 @@ function createApiClient({
     const result = await httpClient.rawGet(
       url`/v2/c/rooms/${options.roomId}/storage`,
       await authManager.getAuthValue({
-        requestedScope: "room:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       })
     );
     return await result.json();
@@ -2288,7 +2239,7 @@ function createApiClient({
     }
     const json = await httpClient.get(
       url`/v2/c/inbox-notifications`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         cursor: options?.cursor,
         limit: PAGE_SIZE,
@@ -2314,7 +2265,7 @@ function createApiClient({
     }
     const json = await httpClient.get(
       url`/v2/c/inbox-notifications/delta`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { since: options.since.toISOString(), query },
       { signal: options.signal }
     );
@@ -2343,7 +2294,7 @@ function createApiClient({
     }
     const { count } = await httpClient.get(
       url`/v2/c/inbox-notifications/count`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { query },
       { signal: options?.signal }
     );
@@ -2352,7 +2303,7 @@ function createApiClient({
   async function markAllInboxNotificationsAsRead() {
     await httpClient.post(
       url`/v2/c/inbox-notifications/read`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         inboxNotificationIds: "all"
       }
@@ -2361,7 +2312,7 @@ function createApiClient({
   async function markInboxNotificationsAsRead(inboxNotificationIds) {
     await httpClient.post(
       url`/v2/c/inbox-notifications/read`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         inboxNotificationIds
       }
@@ -2381,19 +2332,19 @@ function createApiClient({
   async function deleteAllInboxNotifications() {
     await httpClient.delete(
       url`/v2/c/inbox-notifications`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" })
+      await authManager.getAuthValue({ resource: "personal", access: "write" })
     );
   }
   async function deleteInboxNotification(inboxNotificationId) {
     await httpClient.delete(
       url`/v2/c/inbox-notifications/${inboxNotificationId}`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" })
+      await authManager.getAuthValue({ resource: "personal", access: "write" })
     );
   }
   async function getNotificationSettings(options) {
     return httpClient.get(
       url`/v2/c/notification-settings`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       void 0,
       { signal: options?.signal }
     );
@@ -2401,7 +2352,7 @@ function createApiClient({
   async function updateNotificationSettings(settings) {
     return httpClient.post(
       url`/v2/c/notification-settings`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       settings
     );
   }
@@ -2413,7 +2364,7 @@ function createApiClient({
     const PAGE_SIZE = 50;
     const json = await httpClient.get(
       url`/v2/c/threads`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         cursor: options?.cursor,
         query,
@@ -2434,7 +2385,7 @@ function createApiClient({
   async function getUserThreadsSince_experimental(options) {
     const json = await httpClient.get(
       url`/v2/c/threads/delta`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { since: options.since.toISOString() },
       { signal: options.signal }
     );
@@ -2463,7 +2414,8 @@ function createApiClient({
       const { groups: plainGroups } = await httpClient.post(
         url`/v2/c/groups/find`,
         await authManager.getAuthValue({
-          requestedScope: "comments:read"
+          resource: "personal",
+          access: "write"
         }),
         { groupIds }
       );
@@ -2482,7 +2434,7 @@ function createApiClient({
   async function getUrlMetadata(_url) {
     const { metadata } = await httpClient.get(
       url`/v2/c/urls/metadata`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { url: _url }
     );
     return metadata;
@@ -2522,10 +2474,6 @@ function createApiClient({
     getAttachmentUrl,
     uploadAttachment,
     getOrCreateAttachmentUrlsStore,
-    // User attachments
-    uploadChatAttachment,
-    getOrCreateChatAttachmentUrlsStore,
-    getChatAttachmentUrl,
     // Room storage
     streamStorage,
     // Notifications
@@ -5219,22 +5167,327 @@ function createReceivingToolInvocation(invocationId, name, partialArgsText = "")
   };
 }
 
-// src/protocol/AuthToken.ts
-var Permission = /* @__PURE__ */ ((Permission2) => {
-  Permission2["Read"] = "room:read";
-  Permission2["Write"] = "room:write";
-  Permission2["PresenceWrite"] = "room:presence:write";
-  Permission2["CommentsWrite"] = "comments:write";
-  Permission2["CommentsRead"] = "comments:read";
-  Permission2["FeedsWrite"] = "feeds:write";
-  return Permission2;
-})(Permission || {});
-function canWriteStorage(scopes) {
-  return scopes.includes("room:write" /* Write */);
-}
-function canComment(scopes) {
-  return scopes.includes("comments:write" /* CommentsWrite */) || scopes.includes("room:write" /* Write */);
+// src/permissions.ts
+var Permission = {
+  /**
+   * Default permission for a room.
+   */
+  Read: "*:read",
+  Write: "*:write",
+  /**
+   * Legacy aliases for default room permissions.
+   */
+  RoomWrite: "room:write",
+  RoomRead: "room:read",
+  /**
+   * Storage
+   */
+  StorageRead: "storage:read",
+  StorageWrite: "storage:write",
+  StorageNone: "storage:none",
+  /**
+   * Comments
+   */
+  CommentsWrite: "comments:write",
+  CommentsRead: "comments:read",
+  CommentsNone: "comments:none",
+  /**
+   * Feeds
+   */
+  FeedsRead: "feeds:read",
+  FeedsWrite: "feeds:write",
+  FeedsNone: "feeds:none",
+  /**
+   * Legacy
+   */
+  LegacyRoomPresenceWrite: "room:presence:write"
+};
+var ACCESS_LEVELS = ["none", "read", "write"];
+var basePermissionScopes = /* @__PURE__ */ new Set([
+  Permission.Read,
+  Permission.Write,
+  Permission.RoomRead,
+  Permission.RoomWrite
+]);
+var ACCESS_LEVEL_RANKS = {
+  none: 0,
+  read: 1,
+  write: 2
+};
+var PERMISSIONS_BY_RESOURCE = {
+  room: {
+    read: [Permission.Read, Permission.RoomRead],
+    write: [Permission.Write, Permission.RoomWrite]
+  },
+  personal: {
+    write: []
+  },
+  storage: {
+    write: [Permission.StorageWrite],
+    read: [Permission.StorageRead],
+    none: [Permission.StorageNone]
+  },
+  comments: {
+    write: [Permission.CommentsWrite],
+    read: [Permission.CommentsRead],
+    none: [Permission.CommentsNone]
+  },
+  feeds: {
+    write: [Permission.FeedsWrite],
+    read: [Permission.FeedsRead],
+    none: [Permission.FeedsNone]
+  }
+};
+var NO_PERMISSION_MATRIX = {
+  room: "none",
+  storage: "none",
+  comments: "none",
+  feeds: "none",
+  personal: "none"
+};
+var BASE_PERMISSION_RESOURCE = "room";
+var ROOM_PERMISSION_RESOURCES = [
+  "storage",
+  "comments",
+  "feeds"
+];
+var VALID_PERMISSIONS = new Set(Object.values(Permission));
+function isPermission(permission) {
+  return VALID_PERMISSIONS.has(permission);
+}
+function resolveResourceAccess(scopes, resource) {
+  const permissions = PERMISSIONS_BY_RESOURCE[resource];
+  let resourceAccess;
+  for (const access of ACCESS_LEVELS) {
+    const scopedPermissions = permissions[access];
+    if (scopedPermissions !== void 0 && scopedPermissions.some((permission) => scopes.includes(permission))) {
+      resourceAccess = access;
+    }
+  }
+  return resourceAccess;
+}
+function permissionMatrixFromResolvedScopes(resolved) {
+  if (!resolved.hasDefaultPermission) {
+    return { ...NO_PERMISSION_MATRIX };
+  }
+  const matrix = {
+    ...NO_PERMISSION_MATRIX,
+    [BASE_PERMISSION_RESOURCE]: resolved.baseAccess,
+    personal: "write"
+  };
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    matrix[resource] = resolved.matrix[resource] ?? resolved.baseAccess;
+  }
+  return matrix;
+}
+function permissionMatrixFromScopes(scopes) {
+  return permissionMatrixFromResolvedScopes(resolvePermissionScopes(scopes));
+}
+function resolvePermissionScopes(scopes) {
+  const hasDefaultPermission = scopes.includes(Permission.Write) || scopes.includes(Permission.Read) || scopes.includes(Permission.RoomWrite) || scopes.includes(Permission.RoomRead);
+  const baseAccess = scopes.includes(Permission.Write) || scopes.includes(Permission.RoomWrite) ? "write" : scopes.includes(Permission.Read) || scopes.includes(Permission.RoomRead) ? "read" : "none";
+  const matrix = {};
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    const access = resolveResourceAccess(scopes, resource);
+    if (access !== void 0) {
+      matrix[resource] = access;
+    }
+  }
+  return { hasDefaultPermission, baseAccess, matrix };
+}
+function hasPermissionAccess(matrix, resource, requiredAccess) {
+  const access = matrix[resource] ?? "none";
+  return ACCESS_LEVEL_RANKS[access] >= ACCESS_LEVEL_RANKS[requiredAccess];
+}
+function resolveRoomPermissionMatrix(permissions, roomId) {
+  const matchedPermissions = permissions.filter(
+    (entry) => roomPatternMatches(entry.pattern, roomId)
+  );
+  if (matchedPermissions.length === 0) {
+    return void 0;
+  }
+  let hasDefaultPermission = false;
+  let baseAccess = "none";
+  const explicitMatrix = {};
+  const explicitSpecificity = {};
+  for (const entry of matchedPermissions) {
+    const resolved = resolvePermissionScopes(entry.scopes);
+    const specificity = roomPatternSpecificity(entry.pattern);
+    if (resolved.hasDefaultPermission) {
+      hasDefaultPermission = true;
+      baseAccess = strongestAccess(baseAccess, resolved.baseAccess);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = resolved.matrix[resource];
+      if (access !== void 0) {
+        const currentSpecificity = explicitSpecificity[resource] ?? -1;
+        if (specificity > currentSpecificity) {
+          explicitMatrix[resource] = access;
+          explicitSpecificity[resource] = specificity;
+        } else if (specificity === currentSpecificity) {
+          explicitMatrix[resource] = strongestAccess(
+            explicitMatrix[resource] ?? "none",
+            access
+          );
+        }
+      }
+    }
+  }
+  return permissionMatrixFromResolvedScopes({
+    hasDefaultPermission,
+    baseAccess,
+    matrix: explicitMatrix
+  });
+}
+function normalizeRoomPermissions(permissions) {
+  if (!Array.isArray(permissions)) {
+    throw new Error("Permission list must be an array");
+  }
+  const result = [];
+  for (const permission of permissions) {
+    if (!isPermission(permission)) {
+      throw new Error(`Not a valid permission: ${permission}`);
+    }
+    result.push(permission);
+  }
+  return result;
+}
+function normalizeRoomAccesses(accesses) {
+  if (accesses === void 0) {
+    return void 0;
+  }
+  return Object.fromEntries(
+    Object.entries(accesses).map(([id, permissions]) => [
+      id,
+      normalizeRoomPermissions(permissions)
+    ])
+  );
+}
+function normalizeUpdateRoomAccesses(accesses) {
+  if (accesses === void 0) {
+    return void 0;
+  }
+  return Object.fromEntries(
+    Object.entries(accesses).map(([id, permissions]) => [
+      id,
+      permissions === null ? null : normalizeRoomPermissions(permissions)
+    ])
+  );
+}
+function permissionMatrixToScopes(matrix) {
+  const scopes = [];
+  const baseAccess = matrix.room;
+  if (baseAccess !== "none") {
+    scopes.push(permissionForAccessLevel(BASE_PERMISSION_RESOURCE, baseAccess));
+  }
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    const access = matrix[resource];
+    if (access !== baseAccess) {
+      scopes.push(permissionForAccessLevel(resource, access));
+    }
+  }
+  return scopes;
+}
+function mergeRoomPermissionScopes({
+  defaultAccesses,
+  groupsAccesses,
+  userAccesses
+}) {
+  const sources = [
+    resolvePermissionScopes(defaultAccesses),
+    mergeResolvedScopesByHighestAccess(
+      groupsAccesses.map(resolvePermissionScopes)
+    ),
+    resolvePermissionScopes(userAccesses)
+  ];
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = source.baseAccess;
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = access;
+      }
+    }
+  }
+  return permissionMatrixToScopes(permissionMatrixFromResolvedScopes(merged));
+}
+function mergeResolvedScopesByHighestAccess(sources) {
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = strongestAccess(merged.baseAccess, source.baseAccess);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = strongestAccess(
+          merged.matrix[resource] ?? "none",
+          access
+        );
+      }
+    }
+  }
+  return merged;
+}
+function permissionForAccessLevel(resource, access, field = resource) {
+  const levels = PERMISSIONS_BY_RESOURCE[resource];
+  const permissions = levels[access];
+  if (permissions === void 0 || permissions.length === 0) {
+    throw new Error(
+      `Invalid permission level for ${field}: ${JSON.stringify(access) ?? String(access)}`
+    );
+  }
+  return permissions[0];
+}
+function strongestAccess(left, right) {
+  return ACCESS_LEVEL_RANKS[right] > ACCESS_LEVEL_RANKS[left] ? right : left;
+}
+function roomPatternMatches(pattern, roomId) {
+  if (pattern.includes("*")) {
+    return roomId.startsWith(pattern.replace("*", ""));
+  }
+  return pattern === roomId;
+}
+function roomPatternSpecificity(pattern) {
+  return pattern.replace("*", "").length;
+}
+function validatePermissionsSet(scopes) {
+  const unknownScopes = scopes.filter((scope) => !VALID_PERMISSIONS.has(scope));
+  if (unknownScopes.length > 0) {
+    return `Unknown permission scope(s): ${unknownScopes.join(", ")}`;
+  }
+  const baseScopes = scopes.filter((scope) => basePermissionScopes.has(scope));
+  if (baseScopes.length !== 1) {
+    return `Permissions must include exactly one of ${Permission.Read}, ${Permission.Write} (or the legacy aliases ${Permission.RoomRead}, ${Permission.RoomWrite}), got ${baseScopes.length === 0 ? "none" : baseScopes.join(", ")}`;
+  }
+  const seenFeatures = /* @__PURE__ */ new Set();
+  for (const scope of scopes) {
+    if (basePermissionScopes.has(scope) || scope === Permission.LegacyRoomPresenceWrite) {
+      continue;
+    }
+    const feature = scope.slice(0, scope.indexOf(":"));
+    if (seenFeatures.has(feature)) {
+      return `Permissions can include at most one scope per feature, got multiple "${feature}" scopes`;
+    }
+    seenFeatures.add(feature);
+  }
+  return true;
 }
+
+// src/protocol/AuthToken.ts
 function isValidAuthTokenPayload(data) {
   return isPlainObject(data) && (data.k === "acc" /* ACCESS_TOKEN */ || data.k === "id" /* ID_TOKEN */);
 }
@@ -5273,47 +5526,22 @@ function createAuthManager(authOptions, onAuthenticate) {
   const authentication = prepareAuthentication(authOptions);
   const seenTokens = /* @__PURE__ */ new Set();
   const tokens = [];
-  const expiryTimes = [];
   const requestPromises = /* @__PURE__ */ new Map();
   function reset() {
     seenTokens.clear();
     tokens.length = 0;
-    expiryTimes.length = 0;
     requestPromises.clear();
   }
-  function hasCorrespondingScopes(requestedScope, scopes) {
-    if (requestedScope === "comments:read") {
-      return scopes.includes("comments:read" /* CommentsRead */) || scopes.includes("comments:write" /* CommentsWrite */) || scopes.includes("room:read" /* Read */) || scopes.includes("room:write" /* Write */);
-    } else if (requestedScope === "room:read") {
-      return scopes.includes("room:read" /* Read */) || scopes.includes("room:write" /* Write */);
-    }
-    return false;
-  }
   function getCachedToken(requestOptions) {
     const now2 = Math.ceil(Date.now() / 1e3);
     for (let i = tokens.length - 1; i >= 0; i--) {
-      const token = tokens[i];
-      const expiresAt = expiryTimes[i];
-      if (expiresAt <= now2) {
+      const cachedToken = tokens[i];
+      if (cachedToken.expiresAt <= now2) {
         tokens.splice(i, 1);
-        expiryTimes.splice(i, 1);
         continue;
       }
-      if (token.parsed.k === "id" /* ID_TOKEN */) {
-        return token;
-      } else if (token.parsed.k === "acc" /* ACCESS_TOKEN */) {
-        if (!requestOptions.roomId && Object.entries(token.parsed.perms).length === 0) {
-          return token;
-        }
-        for (const [resource, scopes] of Object.entries(token.parsed.perms)) {
-          if (!requestOptions.roomId) {
-            if (resource.includes("*") && hasCorrespondingScopes(requestOptions.requestedScope, scopes)) {
-              return token;
-            }
-          } else if (resource.includes("*") && requestOptions.roomId.startsWith(resource.replace("*", "")) || requestOptions.roomId === resource && hasCorrespondingScopes(requestOptions.requestedScope, scopes)) {
-            return token;
-          }
-        }
+      if (cachedTokenSatisfiesRequest(cachedToken, requestOptions)) {
+        return cachedToken.token;
       }
     }
     return void 0;
@@ -5331,6 +5559,10 @@ function createAuthManager(authOptions, onAuthenticate) {
       });
       const parsed = parseAuthToken(response.token);
       if (seenTokens.has(parsed.raw)) {
+        const cachedToken = getCachedToken(options);
+        if (cachedToken?.raw === parsed.raw) {
+          return cachedToken;
+        }
         throw new StopRetrying(
           "The same Liveblocks auth token was issued from the backend before. Caching Liveblocks tokens is not supported."
         );
@@ -5371,11 +5603,12 @@ function createAuthManager(authOptions, onAuthenticate) {
       return { type: "secret", token: cachedToken };
     }
     let currentPromise;
-    if (requestOptions.roomId) {
-      currentPromise = requestPromises.get(requestOptions.roomId);
+    const requestKey = getAuthRequestKey(requestOptions);
+    if (requestKey !== void 0) {
+      currentPromise = requestPromises.get(requestKey);
       if (currentPromise === void 0) {
         currentPromise = makeAuthRequest(requestOptions);
-        requestPromises.set(requestOptions.roomId, currentPromise);
+        requestPromises.set(requestKey, currentPromise);
       }
     } else {
       currentPromise = requestPromises.get("liveblocks-user-token");
@@ -5389,12 +5622,12 @@ function createAuthManager(authOptions, onAuthenticate) {
       const BUFFER = 30;
       const expiresAt = Math.floor(Date.now() / 1e3) + (token.parsed.exp - token.parsed.iat) - BUFFER;
       seenTokens.add(token.raw);
-      tokens.push(token);
-      expiryTimes.push(expiresAt);
+      const cachedToken2 = makeCachedToken(token, expiresAt);
+      tokens.push(cachedToken2);
       return { type: "secret", token };
     } finally {
-      if (requestOptions.roomId) {
-        requestPromises.delete(requestOptions.roomId);
+      if (requestKey !== void 0) {
+        requestPromises.delete(requestKey);
       } else {
         requestPromises.delete("liveblocks-user-token");
       }
@@ -5405,6 +5638,43 @@ function createAuthManager(authOptions, onAuthenticate) {
     getAuthValue
   };
 }
+function getAuthRequestKey(request) {
+  if (request.roomId === void 0) {
+    return void 0;
+  }
+  return `${request.roomId}:${request.resource}:${request.access}`;
+}
+function makeCachedToken(token, expiresAt) {
+  if (token.parsed.k === "acc" /* ACCESS_TOKEN */) {
+    return {
+      token,
+      expiresAt,
+      permissions: Object.entries(token.parsed.perms).map(
+        ([pattern, scopes]) => ({
+          pattern,
+          scopes: normalizeRoomPermissions(scopes)
+        })
+      )
+    };
+  }
+  return { token, expiresAt };
+}
+function cachedTokenSatisfiesRequest(cachedToken, request) {
+  if (cachedToken.token.parsed.k === "id" /* ID_TOKEN */) {
+    return true;
+  }
+  if (request.resource === "personal") {
+    return true;
+  }
+  if (request.roomId === void 0) {
+    return false;
+  }
+  const matrix = resolveRoomPermissionMatrix(
+    cachedToken.permissions ?? [],
+    request.roomId
+  );
+  return matrix !== void 0 && hasPermissionAccess(matrix, request.resource, request.access);
+}
 function prepareAuthentication(authOptions) {
   const { publicApiKey, authEndpoint } = authOptions;
   if (authEndpoint !== void 0 && publicApiKey !== void 0) {
@@ -5502,6 +5772,9 @@ var OpCode = Object.freeze({
 function isIgnoredOp(op) {
   return op.type === OpCode.DELETE_CRDT && op.id === "ACK";
 }
+function isCreateOp(op) {
+  return op.type === OpCode.CREATE_OBJECT || op.type === OpCode.CREATE_REGISTER || op.type === OpCode.CREATE_MAP || op.type === OpCode.CREATE_LIST;
+}
 
 // src/protocol/StorageNode.ts
 var CrdtType = Object.freeze({
@@ -5759,12 +6032,112 @@ function asPos(str) {
   return isPos(str) ? str : convertToPos(str);
 }
 
+// src/crdts/UnacknowledgedOps.ts
+var UnacknowledgedOps = class {
+  // opId -> op
+  #byOpId = /* @__PURE__ */ new Map();
+  // position -> (opId -> Create op)
+  #createOpsByPosition = /* @__PURE__ */ new Map();
+  // parentId -> (opId -> Create op)
+  #createOpsByParent = /* @__PURE__ */ new Map();
+  // opIds of pending ops that were in flight when a connection died, so the
+  // server may already have processed them. See isPossiblyStored().
+  #possiblyStoredOpIds = /* @__PURE__ */ new Set();
+  #posKey(parentId, parentKey) {
+    return `${parentId}
+${parentKey}`;
+  }
+  get size() {
+    return this.#byOpId.size;
+  }
+  /**
+   * Mark the given Op as still unacknowledged.
+   */
+  add(op) {
+    this.#byOpId.set(op.opId, op);
+    if (isCreateOp(op)) {
+      const posKey = this.#posKey(op.parentId, op.parentKey);
+      let atPosition = this.#createOpsByPosition.get(posKey);
+      if (atPosition === void 0) {
+        atPosition = /* @__PURE__ */ new Map();
+        this.#createOpsByPosition.set(posKey, atPosition);
+      }
+      atPosition.set(op.opId, op);
+      let inParent = this.#createOpsByParent.get(op.parentId);
+      if (inParent === void 0) {
+        inParent = /* @__PURE__ */ new Map();
+        this.#createOpsByParent.set(op.parentId, inParent);
+      }
+      inParent.set(op.opId, op);
+    }
+  }
+  /**
+   * Drop the op with the given opId from the set, because the server has
+   * acknowledged it (confirmed our own op, or signalled it was seen but
+   * ignored).
+   */
+  delete(opId) {
+    const op = this.#byOpId.get(opId);
+    if (op === void 0) {
+      return;
+    }
+    this.#byOpId.delete(opId);
+    this.#possiblyStoredOpIds.delete(opId);
+    if (isCreateOp(op)) {
+      const posKey = this.#posKey(op.parentId, op.parentKey);
+      const atPosition = this.#createOpsByPosition.get(posKey);
+      atPosition?.delete(opId);
+      if (atPosition !== void 0 && atPosition.size === 0) {
+        this.#createOpsByPosition.delete(posKey);
+      }
+      const inParent = this.#createOpsByParent.get(op.parentId);
+      inParent?.delete(opId);
+      if (inParent !== void 0 && inParent.size === 0) {
+        this.#createOpsByParent.delete(op.parentId);
+      }
+    }
+  }
+  /**
+   * The still-unacknowledged Create ops with the given `parentId` and
+   * `parentKey` (targeting one exact position), in dispatch order. O(1) lookup.
+   * Empty if none.
+   */
+  getByParentIdAndKey(parentId, parentKey) {
+    return this.#createOpsByPosition.get(this.#posKey(parentId, parentKey))?.values() ?? [];
+  }
+  /**
+   * The still-unacknowledged Create ops with the given `parentId` (across all
+   * positions), in dispatch order. O(1) lookup. Empty if none.
+   */
+  getByParentId(parentId) {
+    return this.#createOpsByParent.get(parentId)?.values() ?? [];
+  }
+  /** All still-unacknowledged ops, in dispatch order. */
+  values() {
+    return this.#byOpId.values();
+  }
+  isPossiblyStored(opId) {
+    return this.#possiblyStoredOpIds.has(opId);
+  }
+  /**
+   * Mark every currently pending op as possibly stored on the server. Called
+   * when the connection dies: all of these ops were in flight, and their
+   * (possibly lost) acks would have been the only way to know their fate.
+   */
+  markAllAsPossiblyStored() {
+    for (const opId of this.#byOpId.keys()) {
+      this.#possiblyStoredOpIds.add(opId);
+    }
+  }
+};
+
 // src/crdts/AbstractCrdt.ts
 function createManagedPool(roomId, options) {
   const {
     getCurrentConnectionId,
     onDispatch,
-    isStorageWritable = () => true
+    isStorageWritable = () => true,
+    unacknowledgedOps = new UnacknowledgedOps()
   } = options;
   let clock = 0;
   let opClock = 0;
@@ -5786,7 +6159,8 @@ function createManagedPool(roomId, options) {
           "Cannot write to storage with a read only user, please ensure the user has write permissions"
         );
       }
-    }
+    },
+    unacknowledgedOps
   };
 }
 function crdtAsLiveNode(value) {
@@ -6068,11 +6442,9 @@ function childNodeLt(a, b) {
 var LiveList = class _LiveList extends AbstractCrdt {
   #items;
   #implicitlyDeletedItems;
-  #unacknowledgedSets;
   constructor(items) {
     super();
     this.#implicitlyDeletedItems = /* @__PURE__ */ new WeakSet();
-    this.#unacknowledgedSets = /* @__PURE__ */ new Map();
     const nodes = [];
     let lastPos;
     for (const item of items) {
@@ -6102,12 +6474,13 @@ var LiveList = class _LiveList extends AbstractCrdt {
   }
   /**
    * @internal
-   * This function assumes that the resulting ops will be sent to the server if they have an 'opId'
-   * so we mutate _unacknowledgedSets to avoid potential flickering
-   * https://github.com/liveblocks/liveblocks/pull/1177
+   * Serializes this list (and its children) into Create ops. Each child's
+   * create is tagged with the "set" intent (in the loop below) so that a list
+   * created and immediately mutated doesn't transiently re-show its initial
+   * items (flicker, https://github.com/liveblocks/liveblocks/pull/1177).
    *
-   * This is quite unintuitive and should disappear as soon as
-   * we introduce an explicit LiveList.Set operation
+   * This is quite unintuitive and should disappear as soon as we introduce an
+   * explicit LiveList.Set operation.
    */
   _toOps(parentId, parentKey) {
     if (this._id === void 0) {
@@ -6123,7 +6496,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
     ops.push(op);
     for (const item of this.#items) {
       const parentKey2 = item._getParentKeyOrThrow();
-      const childOps = addIntentToOpTree(
+      const childOps = addIntentToRootOp(
         item._toOps(this._id, parentKey2),
         "set"
       );
@@ -6167,6 +6540,28 @@ var LiveList = class _LiveList extends AbstractCrdt {
       (item) => item._getParentKeyOrThrow() === position
     );
   }
+  /**
+   * The opId of this list's still-unacknowledged "set" op at the given position,
+   * or undefined if none. Derived from the room's unacknowledgedOps (the single
+   * source of truth) rather than tracked in a per-instance map. The pool's
+   * position index already scopes to this list's (parentId, position); the last
+   * match wins, matching the original last-write-wins map semantics.
+   */
+  #unacknowledgedSetOpIdAt(position) {
+    if (this._pool === void 0 || this._id === void 0) {
+      return void 0;
+    }
+    let opId;
+    for (const op of this._pool.unacknowledgedOps.getByParentIdAndKey(
+      this._id,
+      position
+    )) {
+      if (op.intent === "set") {
+        opId = op.opId;
+      }
+    }
+    return opId;
+  }
   /** @internal */
   _attach(id, pool) {
     super._attach(id, pool);
@@ -6247,13 +6642,9 @@ var LiveList = class _LiveList extends AbstractCrdt {
     if (deletedDelta) {
       delta.push(deletedDelta);
     }
-    const unacknowledgedOpId = this.#unacknowledgedSets.get(op.parentKey);
-    if (unacknowledgedOpId !== void 0) {
-      if (unacknowledgedOpId !== op.opId) {
-        return delta.length === 0 ? { modified: false } : { modified: makeUpdate(this, delta), reverse: [] };
-      } else {
-        this.#unacknowledgedSets.delete(op.parentKey);
-      }
+    const unacknowledgedOpId = this.#unacknowledgedSetOpIdAt(op.parentKey);
+    if (unacknowledgedOpId !== void 0 && unacknowledgedOpId !== op.opId) {
+      return delta.length === 0 ? { modified: false } : { modified: makeUpdate(this, delta), reverse: [] };
     }
     const indexOfItemWithSamePosition = this._indexOfPosition(op.parentKey);
     const existingItem = this.#items.find((item) => item._id === op.id);
@@ -6344,11 +6735,92 @@ var LiveList = class _LiveList extends AbstractCrdt {
       this.#shiftItemPosition(existingItemIndex, key);
     }
     const { newItem, newIndex } = this.#createAttachItemAndSort(op, key);
+    const bumpDeltas = this.#bumpUnackedPushesAbove(key);
     return {
-      modified: makeUpdate(this, [insertDelta(newIndex, newItem)]),
+      modified: makeUpdate(this, [
+        insertDelta(newIndex, newItem),
+        ...bumpDeltas
+      ]),
       reverse: []
     };
   }
+  /**
+   * This list's own still-unacknowledged pushed items (their `intent: "push"`
+   * Create op is still pending in the room's unacknowledgedOps). Derived from
+   * the single source of truth, so an item drops out the instant its op is
+   * acked, with no per-instance membership to leak. Yielded in push order.
+   *
+   * Excludes ops that may already be stored on the server (they were in
+   * flight when a connection died, so their fate is unknown): the bump
+   * prediction assumes the server has not processed the op yet, which is only
+   * guaranteed for ops sent on the current connection. For these excluded
+   * ops, the server's (re-)ack states the authoritative position; predicting
+   * locally could produce a wrong position that no ack would correct.
+   *
+   * Restricted to items currently in `#items`: a pushed node whose op is still
+   * pending may have been pulled out of the list (e.g. implicitly deleted by a
+   * remote set, or removed by an undo) while still living in the pool, and such
+   * a node must not be repositioned.
+   */
+  *#unackedPushNodes() {
+    if (this._pool === void 0 || this._id === void 0) {
+      return;
+    }
+    for (const op of this._pool.unacknowledgedOps.getByParentId(this._id)) {
+      if (op.intent !== "push") {
+        continue;
+      }
+      if (this._pool.unacknowledgedOps.isPossiblyStored(op.opId)) {
+        continue;
+      }
+      const node = this._pool.getNode(op.id);
+      if (node !== void 0 && this.#items.includes(node)) {
+        yield node;
+      }
+    }
+  }
+  /**
+   * Optimistic no-flip for pushed items. When a remote op lands at or below my
+   * still-unacked pushed items, those items must end up *after* it: FIFO plus
+   * the room's serial processing guarantee the remote was processed first, so
+   * my unacked pushes belong behind it. Re-chain the whole unacked-push block,
+   * in push order, to sit after the highest confirmed sibling, so it keeps
+   * rendering as a contiguous tail instead of getting interleaved. Local-only;
+   * the real acks overwrite these keys with the (identical) server keys.
+   */
+  #bumpUnackedPushesAbove(remoteKey) {
+    const pending = new Set(this.#unackedPushNodes());
+    if (pending.size === 0) {
+      return [];
+    }
+    let minPending;
+    for (const node of pending) {
+      const pos = node._parentPos;
+      if (minPending === void 0 || pos < minPending) {
+        minPending = pos;
+      }
+    }
+    if (remoteKey < nn(minPending)) {
+      return [];
+    }
+    let base;
+    for (const item of this.#items) {
+      if (!pending.has(item)) {
+        base = item._parentPos;
+      }
+    }
+    const deltas = [];
+    for (const node of pending) {
+      const previousIndex = this.#items.findIndex((item) => item === node);
+      base = makePosition(base);
+      this.#updateItemPosition(node, base);
+      const index = this.#items.findIndex((item) => item === node);
+      if (index !== previousIndex) {
+        deltas.push(moveDelta(previousIndex, index, node));
+      }
+    }
+    return deltas;
+  }
   #applyInsertAck(op) {
     const existingItem = this.#items.find((item) => item._id === op.id);
     const key = asPos(op.parentKey);
@@ -6429,7 +6901,6 @@ var LiveList = class _LiveList extends AbstractCrdt {
     if (this._pool?.getNode(id) !== void 0) {
       return { modified: false };
     }
-    this.#unacknowledgedSets.set(key, nn(op.opId));
     const indexOfItemWithSameKey = this._indexOfPosition(key);
     child._attach(id, nn(this._pool));
     child._setParentLink(this, key);
@@ -6439,7 +6910,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
       existingItem._detach();
       this.#items.remove(existingItem);
       this.#items.add(child);
-      const reverse = addIntentToOpTree(
+      const reverse = addIntentToRootOp(
         existingItem._toOps(nn(this._id), key),
         "set",
         op.id
@@ -6718,7 +7189,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
       value._attach(id, this._pool);
       const ops = value._toOpsWithOpId(this._id, position, this._pool);
       this._pool.dispatch(
-        intent === "push" ? addIntentToOpTree(ops, "push") : ops,
+        intent === "push" ? addIntentToRootOp(ops, "push") : ops,
         [{ type: OpCode.DELETE_CRDT, id }],
         /* @__PURE__ */ new Map([
           [this._id, makeUpdate(this, [insertDelta(index, value)])]
@@ -6876,13 +7347,12 @@ var LiveList = class _LiveList extends AbstractCrdt {
       value._attach(id, this._pool);
       const storageUpdates = /* @__PURE__ */ new Map();
       storageUpdates.set(this._id, makeUpdate(this, [setDelta(index, value)]));
-      const ops = addIntentToOpTree(
+      const ops = addIntentToRootOp(
         value._toOpsWithOpId(this._id, position, this._pool),
         "set",
         existingId
       );
-      this.#unacknowledgedSets.set(position, nn(ops[0].opId));
-      const reverseOps = addIntentToOpTree(
+      const reverseOps = addIntentToRootOp(
         existingItem._toOps(this._id, position),
         "set",
         id
@@ -7085,7 +7555,7 @@ function moveDelta(previousIndex, index, item) {
     previousIndex
   };
 }
-function addIntentToOpTree(ops, intent, deletedId) {
+function addIntentToRootOp(ops, intent, deletedId) {
   return ops.map((op, index) => {
     if (index === 0) {
       const firstOp = op;
@@ -7741,6 +8211,7 @@ var LiveObject = class _LiveObject extends AbstractCrdt {
       const id = nn(this._id);
       const parentKey = nn(child._parentKey);
       const reverse = child._toOps(id, parentKey);
+      const deletedItem = liveNodeToLson(child);
       for (const [key, value] of this.#synced) {
         if (value === child) {
           this.#synced.delete(key);
@@ -7752,7 +8223,7 @@ var LiveObject = class _LiveObject extends AbstractCrdt {
         node: this,
         type: "LiveObject",
         updates: {
-          [parentKey]: { type: "delete" }
+          [parentKey]: { type: "delete", deletedItem }
         }
       };
       return { modified: storageUpdate, reverse };
@@ -8329,23 +8800,93 @@ function lsonToLiveNode(value) {
     return new LiveRegister(value);
   }
 }
-function getTreesDiffOperations(currentItems, newItems) {
+function dumpPool(pool) {
+  const rows = Array.from(pool.nodes.values(), (node) => {
+    const parent = node.parent;
+    const parentId = parent.type === "HasParent" ? parent.node._id ?? "?" : parent.type === "Orphaned" ? "<orphaned>" : "-";
+    let value;
+    if (node instanceof LiveRegister) {
+      value = stringifyOrLog(node.data);
+    } else if (node instanceof LiveList) {
+      value = "<LiveList>";
+    } else if (node instanceof LiveMap) {
+      value = "<LiveMap>";
+    } else {
+      value = "<LiveObject>";
+    }
+    return { id: nn(node._id), parentId, key: node._parentKey ?? "", value };
+  });
+  rows.sort((a, b) => {
+    if (a.parentId !== b.parentId) return a.parentId < b.parentId ? -1 : 1;
+    if (a.key !== b.key) return a.key < b.key ? -1 : 1;
+    return 0;
+  });
+  return rows.map(
+    (r) => `  ${r.id}  parent=${r.parentId}  key=${r.key || "\u2014"}  ${r.value}`
+  ).join("\n");
+}
+function isJsonEq(a, b) {
+  if (a === b) {
+    return true;
+  }
+  if (typeof a !== "object" || a === null || typeof b !== "object" || b === null) {
+    return false;
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
+      return false;
+    }
+    for (let i = 0; i < a.length; i++) {
+      if (!isJsonEq(a[i], b[i])) {
+        return false;
+      }
+    }
+    return true;
+  }
+  const aKeys = Object.keys(a);
+  if (aKeys.length !== Object.keys(b).length) {
+    return false;
+  }
+  for (const key of aKeys) {
+    if (!isJsonEq(a[key], b[key])) {
+      return false;
+    }
+  }
+  return true;
+}
+function diffNodeMap(prev, next) {
   const ops = [];
-  currentItems.forEach((_, id) => {
-    if (!newItems.get(id)) {
+  prev.forEach((_, id) => {
+    if (!next.get(id)) {
       ops.push({ type: OpCode.DELETE_CRDT, id });
     }
   });
-  newItems.forEach((crdt, id) => {
-    const currentCrdt = currentItems.get(id);
+  next.forEach((crdt, id) => {
+    const currentCrdt = prev.get(id);
     if (currentCrdt) {
       if (crdt.type === CrdtType.OBJECT) {
-        if (currentCrdt.type !== CrdtType.OBJECT || stringifyOrLog(crdt.data) !== stringifyOrLog(currentCrdt.data)) {
-          ops.push({
-            type: OpCode.UPDATE_OBJECT,
-            id,
-            data: crdt.data
-          });
+        if (currentCrdt.type !== CrdtType.OBJECT) {
+          ops.push({ type: OpCode.UPDATE_OBJECT, id, data: crdt.data });
+        } else {
+          const changed = /* @__PURE__ */ new Map();
+          for (const key of Object.keys(crdt.data)) {
+            const value = crdt.data[key];
+            if (value !== void 0 && !isJsonEq(value, currentCrdt.data[key])) {
+              changed.set(key, value);
+            }
+          }
+          if (changed.size > 0) {
+            ops.push({
+              type: OpCode.UPDATE_OBJECT,
+              id,
+              data: Object.fromEntries(changed)
+            });
+          }
+          for (const key of Object.keys(currentCrdt.data)) {
+            if (!(key in crdt.data)) {
+              ops.push({ type: OpCode.DELETE_OBJECT_KEY, id, key });
+            }
+          }
         }
       }
       if (crdt.parentKey !== currentCrdt.parentKey) {
@@ -8568,7 +9109,7 @@ function partialSyncConnection(room) {
   });
 }
 function partialSyncStorage(room) {
-  const root = room.getStorageSnapshot();
+  const root = room.getStorageOrNull();
   if (root) {
     sendToPanel({
       msg: "room::sync::partial",
@@ -8598,7 +9139,7 @@ function partialSyncOthers(room) {
   }
 }
 function fullSync(room) {
-  const root = room.getStorageSnapshot();
+  const root = room.getStorageOrNull();
   const me = room[kInternal].getSelf_forDevTools();
   const others = room[kInternal].getOthers_forDevTools();
   room.fetchYDoc("");
@@ -9023,15 +9564,15 @@ var ClientMsgCode = Object.freeze({
 
 // src/refs/ManagedOthers.ts
 function makeUser(conn, presence) {
-  const { connectionId, id, info } = conn;
-  const canWrite = canWriteStorage(conn.scopes);
+  const { connectionId, id, info, access } = conn;
+  const { canWrite, canComment } = access;
   return freeze(
     compactObject({
       connectionId,
       id,
       info,
       canWrite,
-      canComment: canComment(conn.scopes),
+      canComment,
       isReadOnly: !canWrite,
       // Deprecated, kept for backward-compatibility
       presence
@@ -9102,7 +9643,7 @@ var ManagedOthers = class {
    * Records a known connection. This records the connection ID and the
    * associated metadata.
    */
-  setConnection(connectionId, metaUserId, metaUserInfo, scopes) {
+  setConnection(connectionId, metaUserId, metaUserInfo, access) {
     this.#internal.mutate((state) => {
       state.connections.set(
         connectionId,
@@ -9110,7 +9651,7 @@ var ManagedOthers = class {
           connectionId,
           id: metaUserId,
           info: metaUserInfo,
-          scopes
+          access
         })
       );
       if (!state.presences.has(connectionId)) {
@@ -9263,6 +9804,14 @@ function defaultMessageFromContext(context) {
 
 // src/room.ts
 var FEEDS_TIMEOUT = 5e3;
+function connectionAccessFromScopes(scopes) {
+  const roomPermissions = normalizeRoomPermissions(scopes);
+  const matrix = permissionMatrixFromScopes(roomPermissions);
+  return {
+    canWrite: hasPermissionAccess(matrix, "storage", "write"),
+    canComment: hasPermissionAccess(matrix, "comments", "write")
+  };
+}
 function makeIdFactory(connectionId) {
   let count = 0;
   return () => `${connectionId}:${count++}`;
@@ -9338,6 +9887,7 @@ function createRoom(options, config) {
     delegates,
     config.enableDebugLogging
   );
+  const unacknowledgedOps = new UnacknowledgedOps();
   const context = {
     buffer: {
       flushTimerID: void 0,
@@ -9365,14 +9915,15 @@ function createRoom(options, config) {
     pool: createManagedPool(roomId, {
       getCurrentConnectionId,
       onDispatch,
-      isStorageWritable
+      isStorageWritable,
+      unacknowledgedOps
     }),
     root: void 0,
     undoStack: [],
     redoStack: [],
     pausedHistory: null,
     activeBatch: null,
-    unacknowledgedOps: /* @__PURE__ */ new Map()
+    unacknowledgedOps
   };
   const nodeMapBuffer = makeNodeMapBuffer();
   const stopwatch = config.enableDebugLogging ? makeStopWatch() : void 0;
@@ -9433,12 +9984,13 @@ function createRoom(options, config) {
       )
     };
     if (_getStorage$ !== null) {
-      refreshStorage({ flush: false });
+      refreshStorage();
     }
     flushNowOrSoon();
   }
   function onDidDisconnect() {
     clearTimeout(context.buffer.flushTimerID);
+    context.unacknowledgedOps.markAllAsPossiblyStored();
   }
   managedSocket.events.onMessage.subscribe(handleServerMessage);
   managedSocket.events.statusDidChange.subscribe(onStatusDidChange);
@@ -9484,8 +10036,8 @@ function createRoom(options, config) {
     }
   }
   function isStorageWritable() {
-    const scopes = context.dynamicSessionInfoSig.get()?.scopes;
-    return scopes !== void 0 ? canWriteStorage(scopes) : true;
+    const permissionMatrix = context.dynamicSessionInfoSig.get()?.permissionMatrix;
+    return permissionMatrix !== void 0 ? hasPermissionAccess(permissionMatrix, "storage", "write") : true;
   }
   const eventHub = {
     status: makeEventSource(),
@@ -9546,14 +10098,22 @@ function createRoom(options, config) {
       if (staticSession === null || dynamicSession === null) {
         return null;
       } else {
-        const canWrite = canWriteStorage(dynamicSession.scopes);
+        const canWrite = hasPermissionAccess(
+          dynamicSession.permissionMatrix,
+          "storage",
+          "write"
+        );
         return {
           connectionId: dynamicSession.actor,
           id: staticSession.userId,
           info: staticSession.userInfo,
           presence: myPresence,
           canWrite,
-          canComment: canComment(dynamicSession.scopes)
+          canComment: hasPermissionAccess(
+            dynamicSession.permissionMatrix,
+            "comments",
+            "write"
+          )
         };
       }
     }
@@ -9579,7 +10139,7 @@ function createRoom(options, config) {
       for (const [id, crdt] of context.pool.nodes) {
         currentItems.set(id, crdt._serialize());
       }
-      const ops = getTreesDiffOperations(currentItems, nodes);
+      const ops = diffNodeMap(currentItems, nodes);
       const result = applyRemoteOps(ops);
       notify(result.updates);
     } else {
@@ -9842,7 +10402,9 @@ function createRoom(options, config) {
     context.dynamicSessionInfoSig.set({
       actor: message.actor,
       nonce: message.nonce,
-      scopes: message.scopes,
+      permissionMatrix: permissionMatrixFromScopes(
+        normalizeRoomPermissions(message.scopes)
+      ),
       meta: message.meta
     });
     context.idFactory = makeIdFactory(message.actor);
@@ -9863,7 +10425,7 @@ function createRoom(options, config) {
         connectionId,
         user.id,
         user.info,
-        user.scopes
+        connectionAccessFromScopes(user.scopes)
       );
     }
     return { type: "reset" };
@@ -9883,7 +10445,7 @@ function createRoom(options, config) {
       message.actor,
       message.id,
       message.info,
-      message.scopes
+      connectionAccessFromScopes(message.scopes)
     );
     context.buffer.messages.push({
       type: ClientMsgCode.UPDATE_PRESENCE,
@@ -9911,12 +10473,11 @@ function createRoom(options, config) {
     }
   }
   function applyAndSendOfflineOps(unackedOps) {
-    if (unackedOps.size === 0) {
+    if (unackedOps.length === 0) {
       return;
     }
     const messages = [];
-    const inOps = Array.from(unackedOps.values());
-    const result = applyLocalOps(inOps);
+    const result = applyLocalOps(unackedOps);
     messages.push({
       type: ClientMsgCode.UPDATE_STORAGE,
       ops: result.opsToEmit
@@ -10140,7 +10701,7 @@ function createRoom(options, config) {
     const storageOps = context.buffer.storageOperations;
     if (storageOps.length > 0) {
       for (const op of storageOps) {
-        context.unacknowledgedOps.set(op.opId, op);
+        context.unacknowledgedOps.add(op);
       }
       notifyStorageStatus();
     }
@@ -10367,36 +10928,25 @@ function createRoom(options, config) {
     }
   }
   function processInitialStorage(nodes) {
-    const unacknowledgedOps = new Map(context.unacknowledgedOps);
+    const unacknowledgedOps2 = [...context.unacknowledgedOps.values()];
     createOrUpdateRootFromMessage(nodes);
-    applyAndSendOfflineOps(unacknowledgedOps);
+    applyAndSendOfflineOps(unacknowledgedOps2);
     _resolveStoragePromise?.();
     notifyStorageStatus();
     eventHub.storageDidLoad.notify();
   }
-  async function streamStorage() {
-    if (!managedSocket.authValue) return;
-    const nodes = new Map(
-      await httpClient.streamStorage({ roomId })
-    );
-    processInitialStorage(nodes);
-  }
-  function refreshStorage(options2) {
+  function refreshStorage() {
     const messages = context.buffer.messages;
-    if (config.unstable_streamData) {
-      void streamStorage();
-    } else if (!messages.some((msg) => msg.type === ClientMsgCode.FETCH_STORAGE)) {
+    if (!messages.some((msg) => msg.type === ClientMsgCode.FETCH_STORAGE)) {
       messages.push({ type: ClientMsgCode.FETCH_STORAGE });
       nodeMapBuffer.take();
       stopwatch?.start();
     }
-    if (options2.flush) {
-      flushNowOrSoon();
-    }
   }
   function startLoadingStorage() {
     if (_getStorage$ === null) {
-      refreshStorage({ flush: true });
+      refreshStorage();
+      flushNowOrSoon();
       _getStorage$ = new Promise((resolve) => {
         _resolveStoragePromise = resolve;
       });
@@ -10404,7 +10954,7 @@ function createRoom(options, config) {
     }
     return _getStorage$;
   }
-  function getStorageSnapshot() {
+  function getStorageOrNull() {
     const root = context.root;
     if (root !== void 0) {
       return root;
@@ -10718,7 +11268,7 @@ function createRoom(options, config) {
     }
   }
   function isStorageReady() {
-    return getStorageSnapshot() !== null;
+    return getStorageOrNull() !== null;
   }
   async function waitUntilStorageReady() {
     while (!isStorageReady()) {
@@ -10958,6 +11508,13 @@ function createRoom(options, config) {
       connect: () => managedSocket.connect(),
       reconnect: () => managedSocket.reconnect(),
       disconnect: () => managedSocket.disconnect(),
+      _dump: () => {
+        const n = context.pool.nodes.size;
+        return `Room "${roomId}" (${n} node${n === 1 ? "" : "s"}):
+${dumpPool(
+          context.pool
+        )}`;
+      },
       destroy: () => {
         pendingFeedsRequests.forEach(
           (request) => request.reject(new Error("Room destroyed"))
@@ -11003,7 +11560,9 @@ function createRoom(options, config) {
       updateFeedMessage,
       deleteFeedMessage,
       getStorage,
-      getStorageSnapshot,
+      getStorageOrNull,
+      getStorageSnapshot: getStorageOrNull,
+      // Deprecated alias, will be removed in the future
       getStorageStatus,
       isPresenceReady,
       isStorageReady,
@@ -11149,7 +11708,11 @@ function isRoomEventName(value) {
 }
 function makeAuthDelegateForRoom(roomId, authManager) {
   return async () => {
-    return authManager.getAuthValue({ requestedScope: "room:read", roomId });
+    return authManager.getAuthValue({
+      roomId,
+      resource: "room",
+      access: "read"
+    });
   };
 }
 function makeCreateSocketDelegateForRoom(roomId, baseUrl, WebSocketPolyfill) {
@@ -11221,7 +11784,6 @@ function createClient(options) {
   const httpClient = createApiClient({
     baseUrl,
     fetchPolyfill,
-    currentUserId,
     authManager
   });
   const roomsById = /* @__PURE__ */ new Map();
@@ -11239,7 +11801,8 @@ function createClient(options) {
       ),
       authenticate: async () => {
         const resp = await authManager.getAuthValue({
-          requestedScope: "room:read"
+          resource: "personal",
+          access: "write"
         });
         if (resp.type === "public") {
           throw new StopRetrying(
@@ -11312,7 +11875,6 @@ function createClient(options) {
         enableDebugLogging: clientOptions.enableDebugLogging,
         baseUrl,
         errorEventSource: liveblocksErrorSource,
-        unstable_streamData: !!clientOptions.unstable_streamData,
         roomHttpClient: httpClient,
         createSyncSource,
         badgeLocation: clientOptions.badgeLocation ?? "bottom-right"
@@ -11465,6 +12027,7 @@ function createClient(options) {
     {
       enterRoom,
       getRoom,
+      _dump: () => Array.from(roomsById.values(), ({ room }) => room._dump()).join("\n\n"),
       logout,
       // Public inbox notifications API
       getInboxNotifications: httpClient.getInboxNotifications,
@@ -12135,6 +12698,7 @@ export {
   createManagedPool,
   createNotificationSettings,
   createThreadId,
+  deepLiveify,
   defineAiTool,
   deprecate,
   deprecateIf,
@@ -12146,6 +12710,7 @@ export {
   generateUrl,
   getMentionsFromCommentBody,
   getSubscriptionKey,
+  hasPermissionAccess,
   html,
   htmlSafe,
   isCommentBodyLink,
@@ -12173,11 +12738,16 @@ export {
   makePosition,
   mapValues,
   memoizeOnSuccess,
+  mergeRoomPermissionScopes,
   nanoid,
   nn,
   nodeStreamToCompactNodes,
+  normalizeRoomAccesses,
+  normalizeRoomPermissions,
+  normalizeUpdateRoomAccesses,
   objectToQuery,
   patchNotificationSettings,
+  permissionMatrixFromScopes,
   raise,
   resolveMentionsInCommentBody,
   sanitizeUrl,
@@ -12190,6 +12760,7 @@ export {
   tryParseJson,
   url,
   urljoin,
+  validatePermissionsSet,
   wait,
   warnOnce,
   warnOnceIf,