@liveblocks/core 3.20.0-rc1 → 3.20.0

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "3.20.0-rc1";
+var PKG_VERSION = "3.20.0";
 var PKG_FORMAT = "esm";
 
 // src/dupe-detection.ts
@@ -1570,7 +1570,6 @@ function isUrl(string) {
 function createApiClient({
   baseUrl,
   authManager,
-  currentUserId,
   fetchPolyfill
 }) {
   const httpClient = new HttpClient(baseUrl, fetchPolyfill);
@@ -1578,8 +1577,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/threads/delta`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       {
         since: options.since.toISOString()
@@ -1617,8 +1617,9 @@ function createApiClient({
       const result = await httpClient.get(
         url`/v2/c/rooms/${options.roomId}/threads`,
         await authManager.getAuthValue({
-          requestedScope: "comments:read",
-          roomId: options.roomId
+          roomId: options.roomId,
+          resource: "comments",
+          access: "read"
         }),
         {
           cursor: options.cursor,
@@ -1662,8 +1663,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/threads/comments/search`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       {
         text: options.query.text,
@@ -1684,8 +1686,9 @@ function createApiClient({
     const thread = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       {
         id: threadId,
@@ -1704,8 +1707,9 @@ function createApiClient({
     await httpClient.delete(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1713,8 +1717,9 @@ function createApiClient({
     const response = await httpClient.rawGet(
       url`/v2/c/rooms/${options.roomId}/thread-with-notification/${options.threadId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       })
     );
     if (response.ok) {
@@ -1740,8 +1745,9 @@ function createApiClient({
     return await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/metadata`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       options.metadata
     );
@@ -1750,8 +1756,9 @@ function createApiClient({
     return await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/metadata`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       options.metadata
     );
@@ -1761,8 +1768,9 @@ function createApiClient({
     const comment = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       {
         id: commentId,
@@ -1777,8 +1785,9 @@ function createApiClient({
     const comment = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       {
         body: options.body,
@@ -1792,8 +1801,9 @@ function createApiClient({
     await httpClient.delete(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1801,8 +1811,9 @@ function createApiClient({
     const reaction = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       { emoji: options.emoji }
     );
@@ -1812,8 +1823,9 @@ function createApiClient({
     await httpClient.delete(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions/${options.emoji}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1821,8 +1833,9 @@ function createApiClient({
     await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-resolved`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1830,8 +1843,9 @@ function createApiClient({
     await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-unresolved`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1839,8 +1853,9 @@ function createApiClient({
     const subscription = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/subscribe`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       })
     );
     return convertToSubscriptionData(subscription);
@@ -1849,8 +1864,9 @@ function createApiClient({
     await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/unsubscribe`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       })
     );
   }
@@ -1906,8 +1922,9 @@ function createApiClient({
         async () => httpClient.putBlob(
           url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/upload/${encodeURIComponent(attachment.name)}`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "write"
           }),
           attachment.file,
           { fileSize: attachment.size },
@@ -1924,8 +1941,9 @@ function createApiClient({
         async () => httpClient.post(
           url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${encodeURIComponent(attachment.name)}`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "write"
           }),
           void 0,
           { signal: abortSignal },
@@ -1950,8 +1968,9 @@ function createApiClient({
                 async () => httpClient.putBlob(
                   url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${createMultiPartUpload.uploadId}/${String(partNumber)}`,
                   await authManager.getAuthValue({
-                    requestedScope: "comments:read",
-                    roomId
+                    roomId,
+                    resource: "comments",
+                    access: "write"
                   }),
                   part,
                   void 0,
@@ -1974,8 +1993,9 @@ function createApiClient({
         return httpClient.post(
           url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${uploadId}/complete`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "write"
           }),
           { parts: sortedUploadedParts },
           { signal: abortSignal }
@@ -1986,8 +2006,9 @@ function createApiClient({
             await httpClient.rawDelete(
               url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${uploadId}`,
               await authManager.getAuthValue({
-                requestedScope: "comments:read",
-                roomId
+                roomId,
+                resource: "comments",
+                access: "write"
               })
             );
           } catch {
@@ -2004,8 +2025,9 @@ function createApiClient({
         const { urls } = await httpClient.post(
           url`/v2/c/rooms/${roomId}/attachments/presigned-urls`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "read"
           }),
           { attachmentIds }
         );
@@ -2024,109 +2046,13 @@ function createApiClient({
     const batch2 = getOrCreateAttachmentUrlsStore(options.roomId).batch;
     return batch2.get(options.attachmentId);
   }
-  async function uploadChatAttachment(options) {
-    const { chatId, attachment, signal } = options;
-    const userId = currentUserId.get();
-    if (userId === void 0) {
-      throw new Error("Attachment upload requires an authenticated user.");
-    }
-    const ATTACHMENT_PART_SIZE = 5 * 1024 * 1024;
-    if (options.attachment.file.size <= ATTACHMENT_PART_SIZE) {
-      await httpClient.putBlob(
-        url`/v2/c/chats/${chatId}/attachments/${attachment.id}/upload/${encodeURIComponent(attachment.file.name)}`,
-        await authManager.getAuthValue({ requestedScope: "comments:read" }),
-        attachment.file,
-        { fileSize: attachment.file.size },
-        { signal }
-      );
-    } else {
-      const multipartUpload = await httpClient.post(
-        url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${encodeURIComponent(attachment.file.name)}`,
-        await authManager.getAuthValue({ requestedScope: "comments:read" }),
-        void 0,
-        { signal },
-        { fileSize: attachment.file.size }
-      );
-      try {
-        const uploadedParts = [];
-        const parts = [];
-        let start = 0;
-        while (start < attachment.file.size) {
-          const end = Math.min(
-            start + ATTACHMENT_PART_SIZE,
-            attachment.file.size
-          );
-          parts.push({
-            number: parts.length + 1,
-            part: attachment.file.slice(start, end)
-          });
-          start = end;
-        }
-        uploadedParts.push(
-          ...await Promise.all(
-            parts.map(async ({ number, part }) => {
-              return await httpClient.putBlob(
-                url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${multipartUpload.uploadId}/${String(number)}`,
-                await authManager.getAuthValue({
-                  requestedScope: "comments:read"
-                }),
-                part,
-                void 0,
-                { signal }
-              );
-            })
-          )
-        );
-        await httpClient.post(
-          url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${multipartUpload.uploadId}/complete`,
-          await authManager.getAuthValue({ requestedScope: "comments:read" }),
-          { parts: uploadedParts.sort((a, b) => a.number - b.number) },
-          { signal }
-        );
-      } catch (err) {
-        try {
-          await httpClient.delete(
-            url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${multipartUpload.uploadId}`,
-            await authManager.getAuthValue({ requestedScope: "comments:read" })
-          );
-        } catch {
-        }
-        throw err;
-      }
-    }
-  }
-  const attachmentUrlsBatchStoresByChat = new DefaultMap((chatId) => {
-    const batch2 = new Batch(
-      async (batchedAttachmentIds) => {
-        const attachmentIds = batchedAttachmentIds.flat();
-        const { urls } = await httpClient.post(
-          url`/v2/c/chats/${chatId}/attachments/presigned-urls`,
-          await authManager.getAuthValue({
-            requestedScope: "comments:read"
-          }),
-          { attachmentIds }
-        );
-        return urls.map(
-          (url2) => url2 ?? new Error("There was an error while getting this attachment's URL")
-        );
-      },
-      { delay: 50 }
-    );
-    return createBatchStore(batch2);
-  });
-  function getOrCreateChatAttachmentUrlsStore(chatId) {
-    return attachmentUrlsBatchStoresByChat.getOrCreate(chatId);
-  }
-  function getChatAttachmentUrl(options) {
-    const batch2 = getOrCreateChatAttachmentUrlsStore(options.chatId).batch;
-    return batch2.get(options.attachmentId);
-  }
   async function getSubscriptionSettings(options) {
     return httpClient.get(
       url`/v2/c/rooms/${options.roomId}/subscription-settings`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       void 0,
       {
@@ -2138,8 +2064,9 @@ function createApiClient({
     return httpClient.post(
       url`/v2/c/rooms/${options.roomId}/subscription-settings`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       options.settings
     );
@@ -2151,8 +2078,9 @@ function createApiClient({
         await httpClient.post(
           url`/v2/c/rooms/${roomId}/inbox-notifications/read`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "read"
           }),
           { inboxNotificationIds }
         );
@@ -2172,8 +2100,9 @@ function createApiClient({
     await httpClient.rawPost(
       url`/v2/c/rooms/${options.roomId}/text-mentions`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "write"
       }),
       {
         userId: options.mention.kind === "user" ? options.mention.id : void 0,
@@ -2187,8 +2116,9 @@ function createApiClient({
     await httpClient.rawDelete(
       url`/v2/c/rooms/${options.roomId}/text-mentions/${options.mentionId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "write"
       })
     );
   }
@@ -2196,8 +2126,9 @@ function createApiClient({
     return httpClient.rawGet(
       url`/v2/c/rooms/${options.roomId}/y-version/${options.versionId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       })
     );
   }
@@ -2205,8 +2136,9 @@ function createApiClient({
     await httpClient.rawPost(
       url`/v2/c/rooms/${options.roomId}/version`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "write"
       })
     );
   }
@@ -2214,8 +2146,9 @@ function createApiClient({
     await httpClient.rawPost(
       url`/v2/c/rooms/${options.roomId}/text-metadata`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       }),
       {
         type: options.type,
@@ -2227,8 +2160,9 @@ function createApiClient({
     const result = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/ai/contextual-prompt`,
       await authManager.getAuthValue({
-        requestedScope: "room:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       }),
       {
         prompt: options.prompt,
@@ -2250,8 +2184,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/versions`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       })
     );
     return {
@@ -2268,8 +2203,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/versions/delta`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       }),
       { since: options.since.toISOString() },
       { signal: options.signal }
@@ -2288,8 +2224,9 @@ function createApiClient({
     const result = await httpClient.rawGet(
       url`/v2/c/rooms/${options.roomId}/storage`,
       await authManager.getAuthValue({
-        requestedScope: "room:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       })
     );
     return await result.json();
@@ -2302,7 +2239,7 @@ function createApiClient({
     }
     const json = await httpClient.get(
       url`/v2/c/inbox-notifications`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         cursor: options?.cursor,
         limit: PAGE_SIZE,
@@ -2328,7 +2265,7 @@ function createApiClient({
     }
     const json = await httpClient.get(
       url`/v2/c/inbox-notifications/delta`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { since: options.since.toISOString(), query },
       { signal: options.signal }
     );
@@ -2357,7 +2294,7 @@ function createApiClient({
     }
     const { count } = await httpClient.get(
       url`/v2/c/inbox-notifications/count`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { query },
       { signal: options?.signal }
     );
@@ -2366,7 +2303,7 @@ function createApiClient({
   async function markAllInboxNotificationsAsRead() {
     await httpClient.post(
       url`/v2/c/inbox-notifications/read`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         inboxNotificationIds: "all"
       }
@@ -2375,7 +2312,7 @@ function createApiClient({
   async function markInboxNotificationsAsRead(inboxNotificationIds) {
     await httpClient.post(
       url`/v2/c/inbox-notifications/read`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         inboxNotificationIds
       }
@@ -2395,19 +2332,19 @@ function createApiClient({
   async function deleteAllInboxNotifications() {
     await httpClient.delete(
       url`/v2/c/inbox-notifications`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" })
+      await authManager.getAuthValue({ resource: "personal", access: "write" })
     );
   }
   async function deleteInboxNotification(inboxNotificationId) {
     await httpClient.delete(
       url`/v2/c/inbox-notifications/${inboxNotificationId}`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" })
+      await authManager.getAuthValue({ resource: "personal", access: "write" })
     );
   }
   async function getNotificationSettings(options) {
     return httpClient.get(
       url`/v2/c/notification-settings`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       void 0,
       { signal: options?.signal }
     );
@@ -2415,7 +2352,7 @@ function createApiClient({
   async function updateNotificationSettings(settings) {
     return httpClient.post(
       url`/v2/c/notification-settings`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       settings
     );
   }
@@ -2427,7 +2364,7 @@ function createApiClient({
     const PAGE_SIZE = 50;
     const json = await httpClient.get(
       url`/v2/c/threads`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         cursor: options?.cursor,
         query,
@@ -2448,7 +2385,7 @@ function createApiClient({
   async function getUserThreadsSince_experimental(options) {
     const json = await httpClient.get(
       url`/v2/c/threads/delta`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { since: options.since.toISOString() },
       { signal: options.signal }
     );
@@ -2477,7 +2414,8 @@ function createApiClient({
       const { groups: plainGroups } = await httpClient.post(
         url`/v2/c/groups/find`,
         await authManager.getAuthValue({
-          requestedScope: "comments:read"
+          resource: "personal",
+          access: "write"
         }),
         { groupIds }
       );
@@ -2496,7 +2434,7 @@ function createApiClient({
   async function getUrlMetadata(_url) {
     const { metadata } = await httpClient.get(
       url`/v2/c/urls/metadata`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { url: _url }
     );
     return metadata;
@@ -2536,10 +2474,6 @@ function createApiClient({
     getAttachmentUrl,
     uploadAttachment,
     getOrCreateAttachmentUrlsStore,
-    // User attachments
-    uploadChatAttachment,
-    getOrCreateChatAttachmentUrlsStore,
-    getChatAttachmentUrl,
     // Room storage
     streamStorage,
     // Notifications
@@ -5233,22 +5167,327 @@ function createReceivingToolInvocation(invocationId, name, partialArgsText = "")
   };
 }
 
-// src/protocol/AuthToken.ts
-var Permission = /* @__PURE__ */ ((Permission2) => {
-  Permission2["Read"] = "room:read";
-  Permission2["Write"] = "room:write";
-  Permission2["PresenceWrite"] = "room:presence:write";
-  Permission2["CommentsWrite"] = "comments:write";
-  Permission2["CommentsRead"] = "comments:read";
-  Permission2["FeedsWrite"] = "feeds:write";
-  return Permission2;
-})(Permission || {});
-function canWriteStorage(scopes) {
-  return scopes.includes("room:write" /* Write */);
-}
-function canComment(scopes) {
-  return scopes.includes("comments:write" /* CommentsWrite */) || scopes.includes("room:write" /* Write */);
+// src/permissions.ts
+var Permission = {
+  /**
+   * Default permission for a room.
+   */
+  Read: "*:read",
+  Write: "*:write",
+  /**
+   * Legacy aliases for default room permissions.
+   */
+  RoomWrite: "room:write",
+  RoomRead: "room:read",
+  /**
+   * Storage
+   */
+  StorageRead: "storage:read",
+  StorageWrite: "storage:write",
+  StorageNone: "storage:none",
+  /**
+   * Comments
+   */
+  CommentsWrite: "comments:write",
+  CommentsRead: "comments:read",
+  CommentsNone: "comments:none",
+  /**
+   * Feeds
+   */
+  FeedsRead: "feeds:read",
+  FeedsWrite: "feeds:write",
+  FeedsNone: "feeds:none",
+  /**
+   * Legacy
+   */
+  LegacyRoomPresenceWrite: "room:presence:write"
+};
+var ACCESS_LEVELS = ["none", "read", "write"];
+var basePermissionScopes = /* @__PURE__ */ new Set([
+  Permission.Read,
+  Permission.Write,
+  Permission.RoomRead,
+  Permission.RoomWrite
+]);
+var ACCESS_LEVEL_RANKS = {
+  none: 0,
+  read: 1,
+  write: 2
+};
+var PERMISSIONS_BY_RESOURCE = {
+  room: {
+    read: [Permission.Read, Permission.RoomRead],
+    write: [Permission.Write, Permission.RoomWrite]
+  },
+  personal: {
+    write: []
+  },
+  storage: {
+    write: [Permission.StorageWrite],
+    read: [Permission.StorageRead],
+    none: [Permission.StorageNone]
+  },
+  comments: {
+    write: [Permission.CommentsWrite],
+    read: [Permission.CommentsRead],
+    none: [Permission.CommentsNone]
+  },
+  feeds: {
+    write: [Permission.FeedsWrite],
+    read: [Permission.FeedsRead],
+    none: [Permission.FeedsNone]
+  }
+};
+var NO_PERMISSION_MATRIX = {
+  room: "none",
+  storage: "none",
+  comments: "none",
+  feeds: "none",
+  personal: "none"
+};
+var BASE_PERMISSION_RESOURCE = "room";
+var ROOM_PERMISSION_RESOURCES = [
+  "storage",
+  "comments",
+  "feeds"
+];
+var VALID_PERMISSIONS = new Set(Object.values(Permission));
+function isPermission(permission) {
+  return VALID_PERMISSIONS.has(permission);
+}
+function resolveResourceAccess(scopes, resource) {
+  const permissions = PERMISSIONS_BY_RESOURCE[resource];
+  let resourceAccess;
+  for (const access of ACCESS_LEVELS) {
+    const scopedPermissions = permissions[access];
+    if (scopedPermissions !== void 0 && scopedPermissions.some((permission) => scopes.includes(permission))) {
+      resourceAccess = access;
+    }
+  }
+  return resourceAccess;
 }
+function permissionMatrixFromResolvedScopes(resolved) {
+  if (!resolved.hasDefaultPermission) {
+    return { ...NO_PERMISSION_MATRIX };
+  }
+  const matrix = {
+    ...NO_PERMISSION_MATRIX,
+    [BASE_PERMISSION_RESOURCE]: resolved.baseAccess,
+    personal: "write"
+  };
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    matrix[resource] = resolved.matrix[resource] ?? resolved.baseAccess;
+  }
+  return matrix;
+}
+function permissionMatrixFromScopes(scopes) {
+  return permissionMatrixFromResolvedScopes(resolvePermissionScopes(scopes));
+}
+function resolvePermissionScopes(scopes) {
+  const hasDefaultPermission = scopes.includes(Permission.Write) || scopes.includes(Permission.Read) || scopes.includes(Permission.RoomWrite) || scopes.includes(Permission.RoomRead);
+  const baseAccess = scopes.includes(Permission.Write) || scopes.includes(Permission.RoomWrite) ? "write" : scopes.includes(Permission.Read) || scopes.includes(Permission.RoomRead) ? "read" : "none";
+  const matrix = {};
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    const access = resolveResourceAccess(scopes, resource);
+    if (access !== void 0) {
+      matrix[resource] = access;
+    }
+  }
+  return { hasDefaultPermission, baseAccess, matrix };
+}
+function hasPermissionAccess(matrix, resource, requiredAccess) {
+  const access = matrix[resource] ?? "none";
+  return ACCESS_LEVEL_RANKS[access] >= ACCESS_LEVEL_RANKS[requiredAccess];
+}
+function resolveRoomPermissionMatrix(permissions, roomId) {
+  const matchedPermissions = permissions.filter(
+    (entry) => roomPatternMatches(entry.pattern, roomId)
+  );
+  if (matchedPermissions.length === 0) {
+    return void 0;
+  }
+  let hasDefaultPermission = false;
+  let baseAccess = "none";
+  const explicitMatrix = {};
+  const explicitSpecificity = {};
+  for (const entry of matchedPermissions) {
+    const resolved = resolvePermissionScopes(entry.scopes);
+    const specificity = roomPatternSpecificity(entry.pattern);
+    if (resolved.hasDefaultPermission) {
+      hasDefaultPermission = true;
+      baseAccess = strongestAccess(baseAccess, resolved.baseAccess);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = resolved.matrix[resource];
+      if (access !== void 0) {
+        const currentSpecificity = explicitSpecificity[resource] ?? -1;
+        if (specificity > currentSpecificity) {
+          explicitMatrix[resource] = access;
+          explicitSpecificity[resource] = specificity;
+        } else if (specificity === currentSpecificity) {
+          explicitMatrix[resource] = strongestAccess(
+            explicitMatrix[resource] ?? "none",
+            access
+          );
+        }
+      }
+    }
+  }
+  return permissionMatrixFromResolvedScopes({
+    hasDefaultPermission,
+    baseAccess,
+    matrix: explicitMatrix
+  });
+}
+function normalizeRoomPermissions(permissions) {
+  if (!Array.isArray(permissions)) {
+    throw new Error("Permission list must be an array");
+  }
+  const result = [];
+  for (const permission of permissions) {
+    if (!isPermission(permission)) {
+      throw new Error(`Not a valid permission: ${permission}`);
+    }
+    result.push(permission);
+  }
+  return result;
+}
+function normalizeRoomAccesses(accesses) {
+  if (accesses === void 0) {
+    return void 0;
+  }
+  return Object.fromEntries(
+    Object.entries(accesses).map(([id, permissions]) => [
+      id,
+      normalizeRoomPermissions(permissions)
+    ])
+  );
+}
+function normalizeUpdateRoomAccesses(accesses) {
+  if (accesses === void 0) {
+    return void 0;
+  }
+  return Object.fromEntries(
+    Object.entries(accesses).map(([id, permissions]) => [
+      id,
+      permissions === null ? null : normalizeRoomPermissions(permissions)
+    ])
+  );
+}
+function permissionMatrixToScopes(matrix) {
+  const scopes = [];
+  const baseAccess = matrix.room;
+  if (baseAccess !== "none") {
+    scopes.push(permissionForAccessLevel(BASE_PERMISSION_RESOURCE, baseAccess));
+  }
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    const access = matrix[resource];
+    if (access !== baseAccess) {
+      scopes.push(permissionForAccessLevel(resource, access));
+    }
+  }
+  return scopes;
+}
+function mergeRoomPermissionScopes({
+  defaultAccesses,
+  groupsAccesses,
+  userAccesses
+}) {
+  const sources = [
+    resolvePermissionScopes(defaultAccesses),
+    mergeResolvedScopesByHighestAccess(
+      groupsAccesses.map(resolvePermissionScopes)
+    ),
+    resolvePermissionScopes(userAccesses)
+  ];
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = source.baseAccess;
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = access;
+      }
+    }
+  }
+  return permissionMatrixToScopes(permissionMatrixFromResolvedScopes(merged));
+}
+function mergeResolvedScopesByHighestAccess(sources) {
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = strongestAccess(merged.baseAccess, source.baseAccess);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = strongestAccess(
+          merged.matrix[resource] ?? "none",
+          access
+        );
+      }
+    }
+  }
+  return merged;
+}
+function permissionForAccessLevel(resource, access, field = resource) {
+  const levels = PERMISSIONS_BY_RESOURCE[resource];
+  const permissions = levels[access];
+  if (permissions === void 0 || permissions.length === 0) {
+    throw new Error(
+      `Invalid permission level for ${field}: ${JSON.stringify(access) ?? String(access)}`
+    );
+  }
+  return permissions[0];
+}
+function strongestAccess(left, right) {
+  return ACCESS_LEVEL_RANKS[right] > ACCESS_LEVEL_RANKS[left] ? right : left;
+}
+function roomPatternMatches(pattern, roomId) {
+  if (pattern.includes("*")) {
+    return roomId.startsWith(pattern.replace("*", ""));
+  }
+  return pattern === roomId;
+}
+function roomPatternSpecificity(pattern) {
+  return pattern.replace("*", "").length;
+}
+function validatePermissionsSet(scopes) {
+  const unknownScopes = scopes.filter((scope) => !VALID_PERMISSIONS.has(scope));
+  if (unknownScopes.length > 0) {
+    return `Unknown permission scope(s): ${unknownScopes.join(", ")}`;
+  }
+  const baseScopes = scopes.filter((scope) => basePermissionScopes.has(scope));
+  if (baseScopes.length !== 1) {
+    return `Permissions must include exactly one of ${Permission.Read}, ${Permission.Write} (or the legacy aliases ${Permission.RoomRead}, ${Permission.RoomWrite}), got ${baseScopes.length === 0 ? "none" : baseScopes.join(", ")}`;
+  }
+  const seenFeatures = /* @__PURE__ */ new Set();
+  for (const scope of scopes) {
+    if (basePermissionScopes.has(scope) || scope === Permission.LegacyRoomPresenceWrite) {
+      continue;
+    }
+    const feature = scope.slice(0, scope.indexOf(":"));
+    if (seenFeatures.has(feature)) {
+      return `Permissions can include at most one scope per feature, got multiple "${feature}" scopes`;
+    }
+    seenFeatures.add(feature);
+  }
+  return true;
+}
+
+// src/protocol/AuthToken.ts
 function isValidAuthTokenPayload(data) {
   return isPlainObject(data) && (data.k === "acc" /* ACCESS_TOKEN */ || data.k === "id" /* ID_TOKEN */);
 }
@@ -5287,47 +5526,22 @@ function createAuthManager(authOptions, onAuthenticate) {
   const authentication = prepareAuthentication(authOptions);
   const seenTokens = /* @__PURE__ */ new Set();
   const tokens = [];
-  const expiryTimes = [];
   const requestPromises = /* @__PURE__ */ new Map();
   function reset() {
     seenTokens.clear();
     tokens.length = 0;
-    expiryTimes.length = 0;
     requestPromises.clear();
   }
-  function hasCorrespondingScopes(requestedScope, scopes) {
-    if (requestedScope === "comments:read") {
-      return scopes.includes("comments:read" /* CommentsRead */) || scopes.includes("comments:write" /* CommentsWrite */) || scopes.includes("room:read" /* Read */) || scopes.includes("room:write" /* Write */);
-    } else if (requestedScope === "room:read") {
-      return scopes.includes("room:read" /* Read */) || scopes.includes("room:write" /* Write */);
-    }
-    return false;
-  }
   function getCachedToken(requestOptions) {
     const now2 = Math.ceil(Date.now() / 1e3);
     for (let i = tokens.length - 1; i >= 0; i--) {
-      const token = tokens[i];
-      const expiresAt = expiryTimes[i];
-      if (expiresAt <= now2) {
+      const cachedToken = tokens[i];
+      if (cachedToken.expiresAt <= now2) {
         tokens.splice(i, 1);
-        expiryTimes.splice(i, 1);
         continue;
       }
-      if (token.parsed.k === "id" /* ID_TOKEN */) {
-        return token;
-      } else if (token.parsed.k === "acc" /* ACCESS_TOKEN */) {
-        if (!requestOptions.roomId && Object.entries(token.parsed.perms).length === 0) {
-          return token;
-        }
-        for (const [resource, scopes] of Object.entries(token.parsed.perms)) {
-          if (!requestOptions.roomId) {
-            if (resource.includes("*") && hasCorrespondingScopes(requestOptions.requestedScope, scopes)) {
-              return token;
-            }
-          } else if (resource.includes("*") && requestOptions.roomId.startsWith(resource.replace("*", "")) || requestOptions.roomId === resource && hasCorrespondingScopes(requestOptions.requestedScope, scopes)) {
-            return token;
-          }
-        }
+      if (cachedTokenSatisfiesRequest(cachedToken, requestOptions)) {
+        return cachedToken.token;
       }
     }
     return void 0;
@@ -5345,6 +5559,10 @@ function createAuthManager(authOptions, onAuthenticate) {
       });
       const parsed = parseAuthToken(response.token);
       if (seenTokens.has(parsed.raw)) {
+        const cachedToken = getCachedToken(options);
+        if (cachedToken?.raw === parsed.raw) {
+          return cachedToken;
+        }
         throw new StopRetrying(
           "The same Liveblocks auth token was issued from the backend before. Caching Liveblocks tokens is not supported."
         );
@@ -5385,11 +5603,12 @@ function createAuthManager(authOptions, onAuthenticate) {
       return { type: "secret", token: cachedToken };
     }
     let currentPromise;
-    if (requestOptions.roomId) {
-      currentPromise = requestPromises.get(requestOptions.roomId);
+    const requestKey = getAuthRequestKey(requestOptions);
+    if (requestKey !== void 0) {
+      currentPromise = requestPromises.get(requestKey);
       if (currentPromise === void 0) {
         currentPromise = makeAuthRequest(requestOptions);
-        requestPromises.set(requestOptions.roomId, currentPromise);
+        requestPromises.set(requestKey, currentPromise);
       }
     } else {
       currentPromise = requestPromises.get("liveblocks-user-token");
@@ -5403,12 +5622,12 @@ function createAuthManager(authOptions, onAuthenticate) {
       const BUFFER = 30;
       const expiresAt = Math.floor(Date.now() / 1e3) + (token.parsed.exp - token.parsed.iat) - BUFFER;
       seenTokens.add(token.raw);
-      tokens.push(token);
-      expiryTimes.push(expiresAt);
+      const cachedToken2 = makeCachedToken(token, expiresAt);
+      tokens.push(cachedToken2);
       return { type: "secret", token };
     } finally {
-      if (requestOptions.roomId) {
-        requestPromises.delete(requestOptions.roomId);
+      if (requestKey !== void 0) {
+        requestPromises.delete(requestKey);
       } else {
         requestPromises.delete("liveblocks-user-token");
       }
@@ -5419,6 +5638,43 @@ function createAuthManager(authOptions, onAuthenticate) {
     getAuthValue
   };
 }
+function getAuthRequestKey(request) {
+  if (request.roomId === void 0) {
+    return void 0;
+  }
+  return `${request.roomId}:${request.resource}:${request.access}`;
+}
+function makeCachedToken(token, expiresAt) {
+  if (token.parsed.k === "acc" /* ACCESS_TOKEN */) {
+    return {
+      token,
+      expiresAt,
+      permissions: Object.entries(token.parsed.perms).map(
+        ([pattern, scopes]) => ({
+          pattern,
+          scopes: normalizeRoomPermissions(scopes)
+        })
+      )
+    };
+  }
+  return { token, expiresAt };
+}
+function cachedTokenSatisfiesRequest(cachedToken, request) {
+  if (cachedToken.token.parsed.k === "id" /* ID_TOKEN */) {
+    return true;
+  }
+  if (request.resource === "personal") {
+    return true;
+  }
+  if (request.roomId === void 0) {
+    return false;
+  }
+  const matrix = resolveRoomPermissionMatrix(
+    cachedToken.permissions ?? [],
+    request.roomId
+  );
+  return matrix !== void 0 && hasPermissionAccess(matrix, request.resource, request.access);
+}
 function prepareAuthentication(authOptions) {
   const { publicApiKey, authEndpoint } = authOptions;
   if (authEndpoint !== void 0 && publicApiKey !== void 0) {
@@ -5784,6 +6040,9 @@ var UnacknowledgedOps = class {
   #createOpsByPosition = /* @__PURE__ */ new Map();
   // parentId -> (opId -> Create op)
   #createOpsByParent = /* @__PURE__ */ new Map();
+  // opIds of pending ops that were in flight when a connection died, so the
+  // server may already have processed them. See isPossiblyStored().
+  #possiblyStoredOpIds = /* @__PURE__ */ new Set();
   #posKey(parentId, parentKey) {
     return `${parentId}
 ${parentKey}`;
@@ -5823,6 +6082,7 @@ ${parentKey}`;
       return;
     }
     this.#byOpId.delete(opId);
+    this.#possiblyStoredOpIds.delete(opId);
     if (isCreateOp(op)) {
       const posKey = this.#posKey(op.parentId, op.parentKey);
       const atPosition = this.#createOpsByPosition.get(posKey);
@@ -5856,6 +6116,19 @@ ${parentKey}`;
   values() {
     return this.#byOpId.values();
   }
+  isPossiblyStored(opId) {
+    return this.#possiblyStoredOpIds.has(opId);
+  }
+  /**
+   * Mark every currently pending op as possibly stored on the server. Called
+   * when the connection dies: all of these ops were in flight, and their
+   * (possibly lost) acks would have been the only way to know their fate.
+   */
+  markAllAsPossiblyStored() {
+    for (const opId of this.#byOpId.keys()) {
+      this.#possiblyStoredOpIds.add(opId);
+    }
+  }
 };
 
 // src/crdts/AbstractCrdt.ts
@@ -6452,7 +6725,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
     }
     return result.modified.updates[0];
   }
-  #applyRemoteInsert(op, fromSnapshot) {
+  #applyRemoteInsert(op) {
     if (this._pool === void 0) {
       throw new Error("Can't attach child if managed pool is not present");
     }
@@ -6462,7 +6735,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
       this.#shiftItemPosition(existingItemIndex, key);
     }
     const { newItem, newIndex } = this.#createAttachItemAndSort(op, key);
-    const bumpDeltas = fromSnapshot ? [] : this.#bumpUnackedPushesAbove(key);
+    const bumpDeltas = this.#bumpUnackedPushesAbove(key);
     return {
       modified: makeUpdate(this, [
         insertDelta(newIndex, newItem),
@@ -6477,6 +6750,13 @@ var LiveList = class _LiveList extends AbstractCrdt {
    * the single source of truth, so an item drops out the instant its op is
    * acked, with no per-instance membership to leak. Yielded in push order.
    *
+   * Excludes ops that may already be stored on the server (they were in
+   * flight when a connection died, so their fate is unknown): the bump
+   * prediction assumes the server has not processed the op yet, which is only
+   * guaranteed for ops sent on the current connection. For these excluded
+   * ops, the server's (re-)ack states the authoritative position; predicting
+   * locally could produce a wrong position that no ack would correct.
+   *
    * Restricted to items currently in `#items`: a pushed node whose op is still
    * pending may have been pulled out of the list (e.g. implicitly deleted by a
    * remote set, or removed by an undo) while still living in the pool, and such
@@ -6490,6 +6770,9 @@ var LiveList = class _LiveList extends AbstractCrdt {
       if (op.intent !== "push") {
         continue;
       }
+      if (this._pool.unacknowledgedOps.isPossiblyStored(op.opId)) {
+        continue;
+      }
       const node = this._pool.getNode(op.id);
       if (node !== void 0 && this.#items.includes(node)) {
         yield node;
@@ -6654,7 +6937,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
     }
   }
   /** @internal */
-  _attachChild(op, source, fromSnapshot = false) {
+  _attachChild(op, source) {
     if (this._pool === void 0) {
       throw new Error("Can't attach child if managed pool is not present");
     }
@@ -6669,7 +6952,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
       }
     } else {
       if (source === 1 /* THEIRS */) {
-        result = this.#applyRemoteInsert(op, fromSnapshot);
+        result = this.#applyRemoteInsert(op);
       } else if (source === 2 /* OURS */) {
         result = this.#applyInsertAck(op);
       } else {
@@ -7928,6 +8211,7 @@ var LiveObject = class _LiveObject extends AbstractCrdt {
       const id = nn(this._id);
       const parentKey = nn(child._parentKey);
       const reverse = child._toOps(id, parentKey);
+      const deletedItem = liveNodeToLson(child);
       for (const [key, value] of this.#synced) {
         if (value === child) {
           this.#synced.delete(key);
@@ -7939,7 +8223,7 @@ var LiveObject = class _LiveObject extends AbstractCrdt {
         node: this,
         type: "LiveObject",
         updates: {
-          [parentKey]: { type: "delete" }
+          [parentKey]: { type: "delete", deletedItem }
         }
       };
       return { modified: storageUpdate, reverse };
@@ -8541,23 +8825,68 @@ function dumpPool(pool) {
     (r) => `  ${r.id}  parent=${r.parentId}  key=${r.key || "\u2014"}  ${r.value}`
   ).join("\n");
 }
-function getTreesDiffOperations(currentItems, newItems) {
+function isJsonEq(a, b) {
+  if (a === b) {
+    return true;
+  }
+  if (typeof a !== "object" || a === null || typeof b !== "object" || b === null) {
+    return false;
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
+      return false;
+    }
+    for (let i = 0; i < a.length; i++) {
+      if (!isJsonEq(a[i], b[i])) {
+        return false;
+      }
+    }
+    return true;
+  }
+  const aKeys = Object.keys(a);
+  if (aKeys.length !== Object.keys(b).length) {
+    return false;
+  }
+  for (const key of aKeys) {
+    if (!isJsonEq(a[key], b[key])) {
+      return false;
+    }
+  }
+  return true;
+}
+function diffNodeMap(prev, next) {
   const ops = [];
-  currentItems.forEach((_, id) => {
-    if (!newItems.get(id)) {
+  prev.forEach((_, id) => {
+    if (!next.get(id)) {
       ops.push({ type: OpCode.DELETE_CRDT, id });
     }
   });
-  newItems.forEach((crdt, id) => {
-    const currentCrdt = currentItems.get(id);
+  next.forEach((crdt, id) => {
+    const currentCrdt = prev.get(id);
     if (currentCrdt) {
       if (crdt.type === CrdtType.OBJECT) {
-        if (currentCrdt.type !== CrdtType.OBJECT || stringifyOrLog(crdt.data) !== stringifyOrLog(currentCrdt.data)) {
-          ops.push({
-            type: OpCode.UPDATE_OBJECT,
-            id,
-            data: crdt.data
-          });
+        if (currentCrdt.type !== CrdtType.OBJECT) {
+          ops.push({ type: OpCode.UPDATE_OBJECT, id, data: crdt.data });
+        } else {
+          const changed = /* @__PURE__ */ new Map();
+          for (const key of Object.keys(crdt.data)) {
+            const value = crdt.data[key];
+            if (value !== void 0 && !isJsonEq(value, currentCrdt.data[key])) {
+              changed.set(key, value);
+            }
+          }
+          if (changed.size > 0) {
+            ops.push({
+              type: OpCode.UPDATE_OBJECT,
+              id,
+              data: Object.fromEntries(changed)
+            });
+          }
+          for (const key of Object.keys(currentCrdt.data)) {
+            if (!(key in crdt.data)) {
+              ops.push({ type: OpCode.DELETE_OBJECT_KEY, id, key });
+            }
+          }
         }
       }
       if (crdt.parentKey !== currentCrdt.parentKey) {
@@ -8780,7 +9109,7 @@ function partialSyncConnection(room) {
   });
 }
 function partialSyncStorage(room) {
-  const root = room.getStorageSnapshot();
+  const root = room.getStorageOrNull();
   if (root) {
     sendToPanel({
       msg: "room::sync::partial",
@@ -8810,7 +9139,7 @@ function partialSyncOthers(room) {
   }
 }
 function fullSync(room) {
-  const root = room.getStorageSnapshot();
+  const root = room.getStorageOrNull();
   const me = room[kInternal].getSelf_forDevTools();
   const others = room[kInternal].getOthers_forDevTools();
   room.fetchYDoc("");
@@ -9235,15 +9564,15 @@ var ClientMsgCode = Object.freeze({
 
 // src/refs/ManagedOthers.ts
 function makeUser(conn, presence) {
-  const { connectionId, id, info } = conn;
-  const canWrite = canWriteStorage(conn.scopes);
+  const { connectionId, id, info, access } = conn;
+  const { canWrite, canComment } = access;
   return freeze(
     compactObject({
       connectionId,
       id,
       info,
       canWrite,
-      canComment: canComment(conn.scopes),
+      canComment,
       isReadOnly: !canWrite,
       // Deprecated, kept for backward-compatibility
       presence
@@ -9314,7 +9643,7 @@ var ManagedOthers = class {
    * Records a known connection. This records the connection ID and the
    * associated metadata.
    */
-  setConnection(connectionId, metaUserId, metaUserInfo, scopes) {
+  setConnection(connectionId, metaUserId, metaUserInfo, access) {
     this.#internal.mutate((state) => {
       state.connections.set(
         connectionId,
@@ -9322,7 +9651,7 @@ var ManagedOthers = class {
           connectionId,
           id: metaUserId,
           info: metaUserInfo,
-          scopes
+          access
         })
       );
       if (!state.presences.has(connectionId)) {
@@ -9475,6 +9804,14 @@ function defaultMessageFromContext(context) {
 
 // src/room.ts
 var FEEDS_TIMEOUT = 5e3;
+function connectionAccessFromScopes(scopes) {
+  const roomPermissions = normalizeRoomPermissions(scopes);
+  const matrix = permissionMatrixFromScopes(roomPermissions);
+  return {
+    canWrite: hasPermissionAccess(matrix, "storage", "write"),
+    canComment: hasPermissionAccess(matrix, "comments", "write")
+  };
+}
 function makeIdFactory(connectionId) {
   let count = 0;
   return () => `${connectionId}:${count++}`;
@@ -9647,12 +9984,13 @@ function createRoom(options, config) {
       )
     };
     if (_getStorage$ !== null) {
-      refreshStorage({ flush: false });
+      refreshStorage();
     }
     flushNowOrSoon();
   }
   function onDidDisconnect() {
     clearTimeout(context.buffer.flushTimerID);
+    context.unacknowledgedOps.markAllAsPossiblyStored();
   }
   managedSocket.events.onMessage.subscribe(handleServerMessage);
   managedSocket.events.statusDidChange.subscribe(onStatusDidChange);
@@ -9698,8 +10036,8 @@ function createRoom(options, config) {
     }
   }
   function isStorageWritable() {
-    const scopes = context.dynamicSessionInfoSig.get()?.scopes;
-    return scopes !== void 0 ? canWriteStorage(scopes) : true;
+    const permissionMatrix = context.dynamicSessionInfoSig.get()?.permissionMatrix;
+    return permissionMatrix !== void 0 ? hasPermissionAccess(permissionMatrix, "storage", "write") : true;
   }
   const eventHub = {
     status: makeEventSource(),
@@ -9760,14 +10098,22 @@ function createRoom(options, config) {
       if (staticSession === null || dynamicSession === null) {
         return null;
       } else {
-        const canWrite = canWriteStorage(dynamicSession.scopes);
+        const canWrite = hasPermissionAccess(
+          dynamicSession.permissionMatrix,
+          "storage",
+          "write"
+        );
         return {
           connectionId: dynamicSession.actor,
           id: staticSession.userId,
           info: staticSession.userInfo,
           presence: myPresence,
           canWrite,
-          canComment: canComment(dynamicSession.scopes)
+          canComment: hasPermissionAccess(
+            dynamicSession.permissionMatrix,
+            "comments",
+            "write"
+          )
         };
       }
     }
@@ -9793,12 +10139,8 @@ function createRoom(options, config) {
       for (const [id, crdt] of context.pool.nodes) {
         currentItems.set(id, crdt._serialize());
       }
-      const ops = getTreesDiffOperations(currentItems, nodes);
-      const result = applyRemoteOps(
-        ops,
-        /* fromSnapshot */
-        true
-      );
+      const ops = diffNodeMap(currentItems, nodes);
+      const result = applyRemoteOps(ops);
       notify(result.updates);
     } else {
       context.root = LiveObject._fromItems(
@@ -9880,16 +10222,15 @@ function createRoom(options, config) {
     );
     return { opsToEmit: opsWithOpIds, reverse, updates };
   }
-  function applyRemoteOps(ops, fromSnapshot = false) {
+  function applyRemoteOps(ops) {
     return applyOps(
       [],
       ops,
       /* isLocal */
-      false,
-      fromSnapshot
+      false
     );
   }
-  function applyOps(pframes, ops, isLocal, fromSnapshot = false) {
+  function applyOps(pframes, ops, isLocal) {
     const output = {
       reverse: new Deque(),
       storageUpdates: /* @__PURE__ */ new Map(),
@@ -9925,7 +10266,7 @@ function createRoom(options, config) {
       } else {
         source = 1 /* THEIRS */;
       }
-      const applyOpResult = applyOp(op, source, fromSnapshot);
+      const applyOpResult = applyOp(op, source);
       if (applyOpResult.modified) {
         const nodeId = applyOpResult.modified.node._id;
         if (!(nodeId && createdNodeIds.has(nodeId))) {
@@ -9951,7 +10292,7 @@ function createRoom(options, config) {
       }
     };
   }
-  function applyOp(op, source, fromSnapshot = false) {
+  function applyOp(op, source) {
     if (isIgnoredOp(op)) {
       return { modified: false };
     }
@@ -9990,7 +10331,7 @@ function createRoom(options, config) {
         if (parentNode === void 0) {
           return { modified: false };
         }
-        return parentNode._attachChild(op, source, fromSnapshot);
+        return parentNode._attachChild(op, source);
       }
     }
   }
@@ -10061,7 +10402,9 @@ function createRoom(options, config) {
     context.dynamicSessionInfoSig.set({
       actor: message.actor,
       nonce: message.nonce,
-      scopes: message.scopes,
+      permissionMatrix: permissionMatrixFromScopes(
+        normalizeRoomPermissions(message.scopes)
+      ),
       meta: message.meta
     });
     context.idFactory = makeIdFactory(message.actor);
@@ -10082,7 +10425,7 @@ function createRoom(options, config) {
         connectionId,
         user.id,
         user.info,
-        user.scopes
+        connectionAccessFromScopes(user.scopes)
       );
     }
     return { type: "reset" };
@@ -10102,7 +10445,7 @@ function createRoom(options, config) {
       message.actor,
       message.id,
       message.info,
-      message.scopes
+      connectionAccessFromScopes(message.scopes)
     );
     context.buffer.messages.push({
       type: ClientMsgCode.UPDATE_PRESENCE,
@@ -10592,29 +10935,18 @@ function createRoom(options, config) {
     notifyStorageStatus();
     eventHub.storageDidLoad.notify();
   }
-  async function streamStorage() {
-    if (!managedSocket.authValue) return;
-    const nodes = new Map(
-      await httpClient.streamStorage({ roomId })
-    );
-    processInitialStorage(nodes);
-  }
-  function refreshStorage(options2) {
+  function refreshStorage() {
     const messages = context.buffer.messages;
-    if (config.unstable_streamData) {
-      void streamStorage();
-    } else if (!messages.some((msg) => msg.type === ClientMsgCode.FETCH_STORAGE)) {
+    if (!messages.some((msg) => msg.type === ClientMsgCode.FETCH_STORAGE)) {
       messages.push({ type: ClientMsgCode.FETCH_STORAGE });
       nodeMapBuffer.take();
       stopwatch?.start();
     }
-    if (options2.flush) {
-      flushNowOrSoon();
-    }
   }
   function startLoadingStorage() {
     if (_getStorage$ === null) {
-      refreshStorage({ flush: true });
+      refreshStorage();
+      flushNowOrSoon();
       _getStorage$ = new Promise((resolve) => {
         _resolveStoragePromise = resolve;
       });
@@ -10622,7 +10954,7 @@ function createRoom(options, config) {
     }
     return _getStorage$;
   }
-  function getStorageSnapshot() {
+  function getStorageOrNull() {
     const root = context.root;
     if (root !== void 0) {
       return root;
@@ -10936,7 +11268,7 @@ function createRoom(options, config) {
     }
   }
   function isStorageReady() {
-    return getStorageSnapshot() !== null;
+    return getStorageOrNull() !== null;
   }
   async function waitUntilStorageReady() {
     while (!isStorageReady()) {
@@ -11179,7 +11511,9 @@ function createRoom(options, config) {
       _dump: () => {
         const n = context.pool.nodes.size;
         return `Room "${roomId}" (${n} node${n === 1 ? "" : "s"}):
-${dumpPool(context.pool)}`;
+${dumpPool(
+          context.pool
+        )}`;
       },
       destroy: () => {
         pendingFeedsRequests.forEach(
@@ -11226,7 +11560,9 @@ ${dumpPool(context.pool)}`;
       updateFeedMessage,
       deleteFeedMessage,
       getStorage,
-      getStorageSnapshot,
+      getStorageOrNull,
+      getStorageSnapshot: getStorageOrNull,
+      // Deprecated alias, will be removed in the future
       getStorageStatus,
       isPresenceReady,
       isStorageReady,
@@ -11372,7 +11708,11 @@ function isRoomEventName(value) {
 }
 function makeAuthDelegateForRoom(roomId, authManager) {
   return async () => {
-    return authManager.getAuthValue({ requestedScope: "room:read", roomId });
+    return authManager.getAuthValue({
+      roomId,
+      resource: "room",
+      access: "read"
+    });
   };
 }
 function makeCreateSocketDelegateForRoom(roomId, baseUrl, WebSocketPolyfill) {
@@ -11444,7 +11784,6 @@ function createClient(options) {
   const httpClient = createApiClient({
     baseUrl,
     fetchPolyfill,
-    currentUserId,
     authManager
   });
   const roomsById = /* @__PURE__ */ new Map();
@@ -11462,7 +11801,8 @@ function createClient(options) {
       ),
       authenticate: async () => {
         const resp = await authManager.getAuthValue({
-          requestedScope: "room:read"
+          resource: "personal",
+          access: "write"
         });
         if (resp.type === "public") {
           throw new StopRetrying(
@@ -11535,7 +11875,6 @@ function createClient(options) {
         enableDebugLogging: clientOptions.enableDebugLogging,
         baseUrl,
         errorEventSource: liveblocksErrorSource,
-        unstable_streamData: !!clientOptions.unstable_streamData,
         roomHttpClient: httpClient,
         createSyncSource,
         badgeLocation: clientOptions.badgeLocation ?? "bottom-right"
@@ -12359,6 +12698,7 @@ export {
   createManagedPool,
   createNotificationSettings,
   createThreadId,
+  deepLiveify,
   defineAiTool,
   deprecate,
   deprecateIf,
@@ -12370,6 +12710,7 @@ export {
   generateUrl,
   getMentionsFromCommentBody,
   getSubscriptionKey,
+  hasPermissionAccess,
   html,
   htmlSafe,
   isCommentBodyLink,
@@ -12397,11 +12738,16 @@ export {
   makePosition,
   mapValues,
   memoizeOnSuccess,
+  mergeRoomPermissionScopes,
   nanoid,
   nn,
   nodeStreamToCompactNodes,
+  normalizeRoomAccesses,
+  normalizeRoomPermissions,
+  normalizeUpdateRoomAccesses,
   objectToQuery,
   patchNotificationSettings,
+  permissionMatrixFromScopes,
   raise,
   resolveMentionsInCommentBody,
   sanitizeUrl,
@@ -12414,6 +12760,7 @@ export {
   tryParseJson,
   url,
   urljoin,
+  validatePermissionsSet,
   wait,
   warnOnce,
   warnOnceIf,