@liveblocks/core 3.20.0-rc1 → 3.20.1

package/dist/index.cjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "3.20.0-rc1";
+var PKG_VERSION = "3.20.1";
 var PKG_FORMAT = "cjs";
 
 // src/dupe-detection.ts
@@ -1570,7 +1570,6 @@ function isUrl(string) {
 function createApiClient({
   baseUrl,
   authManager,
-  currentUserId,
   fetchPolyfill
 }) {
   const httpClient = new HttpClient(baseUrl, fetchPolyfill);
@@ -1578,8 +1577,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/threads/delta`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       {
         since: options.since.toISOString()
@@ -1617,8 +1617,9 @@ function createApiClient({
       const result = await httpClient.get(
         url`/v2/c/rooms/${options.roomId}/threads`,
         await authManager.getAuthValue({
-          requestedScope: "comments:read",
-          roomId: options.roomId
+          roomId: options.roomId,
+          resource: "comments",
+          access: "read"
         }),
         {
           cursor: options.cursor,
@@ -1662,8 +1663,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/threads/comments/search`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       {
         text: options.query.text,
@@ -1684,8 +1686,9 @@ function createApiClient({
     const thread = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       {
         id: threadId,
@@ -1704,8 +1707,9 @@ function createApiClient({
     await httpClient.delete(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1713,8 +1717,9 @@ function createApiClient({
     const response = await httpClient.rawGet(
       url`/v2/c/rooms/${options.roomId}/thread-with-notification/${options.threadId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       })
     );
     if (response.ok) {
@@ -1740,8 +1745,9 @@ function createApiClient({
     return await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/metadata`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       options.metadata
     );
@@ -1750,8 +1756,9 @@ function createApiClient({
     return await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/metadata`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       options.metadata
     );
@@ -1761,8 +1768,9 @@ function createApiClient({
     const comment = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       {
         id: commentId,
@@ -1777,8 +1785,9 @@ function createApiClient({
     const comment = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       {
         body: options.body,
@@ -1792,8 +1801,9 @@ function createApiClient({
     await httpClient.delete(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1801,8 +1811,9 @@ function createApiClient({
     const reaction = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       }),
       { emoji: options.emoji }
     );
@@ -1812,8 +1823,9 @@ function createApiClient({
     await httpClient.delete(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions/${options.emoji}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1821,8 +1833,9 @@ function createApiClient({
     await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-resolved`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1830,8 +1843,9 @@ function createApiClient({
     await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-unresolved`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "write"
       })
     );
   }
@@ -1839,8 +1853,9 @@ function createApiClient({
     const subscription = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/subscribe`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       })
     );
     return convertToSubscriptionData(subscription);
@@ -1849,8 +1864,9 @@ function createApiClient({
     await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/unsubscribe`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       })
     );
   }
@@ -1906,8 +1922,9 @@ function createApiClient({
         async () => httpClient.putBlob(
           url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/upload/${encodeURIComponent(attachment.name)}`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "write"
           }),
           attachment.file,
           { fileSize: attachment.size },
@@ -1924,8 +1941,9 @@ function createApiClient({
         async () => httpClient.post(
           url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${encodeURIComponent(attachment.name)}`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "write"
           }),
           void 0,
           { signal: abortSignal },
@@ -1950,8 +1968,9 @@ function createApiClient({
                 async () => httpClient.putBlob(
                   url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${createMultiPartUpload.uploadId}/${String(partNumber)}`,
                   await authManager.getAuthValue({
-                    requestedScope: "comments:read",
-                    roomId
+                    roomId,
+                    resource: "comments",
+                    access: "write"
                   }),
                   part,
                   void 0,
@@ -1974,8 +1993,9 @@ function createApiClient({
         return httpClient.post(
           url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${uploadId}/complete`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "write"
           }),
           { parts: sortedUploadedParts },
           { signal: abortSignal }
@@ -1986,8 +2006,9 @@ function createApiClient({
             await httpClient.rawDelete(
               url`/v2/c/rooms/${roomId}/attachments/${attachment.id}/multipart/${uploadId}`,
               await authManager.getAuthValue({
-                requestedScope: "comments:read",
-                roomId
+                roomId,
+                resource: "comments",
+                access: "write"
               })
             );
           } catch (e8) {
@@ -2004,8 +2025,9 @@ function createApiClient({
         const { urls } = await httpClient.post(
           url`/v2/c/rooms/${roomId}/attachments/presigned-urls`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "read"
           }),
           { attachmentIds }
         );
@@ -2024,109 +2046,13 @@ function createApiClient({
     const batch2 = getOrCreateAttachmentUrlsStore(options.roomId).batch;
     return batch2.get(options.attachmentId);
   }
-  async function uploadChatAttachment(options) {
-    const { chatId, attachment, signal } = options;
-    const userId = currentUserId.get();
-    if (userId === void 0) {
-      throw new Error("Attachment upload requires an authenticated user.");
-    }
-    const ATTACHMENT_PART_SIZE = 5 * 1024 * 1024;
-    if (options.attachment.file.size <= ATTACHMENT_PART_SIZE) {
-      await httpClient.putBlob(
-        url`/v2/c/chats/${chatId}/attachments/${attachment.id}/upload/${encodeURIComponent(attachment.file.name)}`,
-        await authManager.getAuthValue({ requestedScope: "comments:read" }),
-        attachment.file,
-        { fileSize: attachment.file.size },
-        { signal }
-      );
-    } else {
-      const multipartUpload = await httpClient.post(
-        url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${encodeURIComponent(attachment.file.name)}`,
-        await authManager.getAuthValue({ requestedScope: "comments:read" }),
-        void 0,
-        { signal },
-        { fileSize: attachment.file.size }
-      );
-      try {
-        const uploadedParts = [];
-        const parts = [];
-        let start = 0;
-        while (start < attachment.file.size) {
-          const end = Math.min(
-            start + ATTACHMENT_PART_SIZE,
-            attachment.file.size
-          );
-          parts.push({
-            number: parts.length + 1,
-            part: attachment.file.slice(start, end)
-          });
-          start = end;
-        }
-        uploadedParts.push(
-          ...await Promise.all(
-            parts.map(async ({ number, part }) => {
-              return await httpClient.putBlob(
-                url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${multipartUpload.uploadId}/${String(number)}`,
-                await authManager.getAuthValue({
-                  requestedScope: "comments:read"
-                }),
-                part,
-                void 0,
-                { signal }
-              );
-            })
-          )
-        );
-        await httpClient.post(
-          url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${multipartUpload.uploadId}/complete`,
-          await authManager.getAuthValue({ requestedScope: "comments:read" }),
-          { parts: uploadedParts.sort((a, b) => a.number - b.number) },
-          { signal }
-        );
-      } catch (err) {
-        try {
-          await httpClient.delete(
-            url`/v2/c/chats/${chatId}/attachments/${attachment.id}/multipart/${multipartUpload.uploadId}`,
-            await authManager.getAuthValue({ requestedScope: "comments:read" })
-          );
-        } catch (e9) {
-        }
-        throw err;
-      }
-    }
-  }
-  const attachmentUrlsBatchStoresByChat = new DefaultMap((chatId) => {
-    const batch2 = new Batch(
-      async (batchedAttachmentIds) => {
-        const attachmentIds = batchedAttachmentIds.flat();
-        const { urls } = await httpClient.post(
-          url`/v2/c/chats/${chatId}/attachments/presigned-urls`,
-          await authManager.getAuthValue({
-            requestedScope: "comments:read"
-          }),
-          { attachmentIds }
-        );
-        return urls.map(
-          (url2) => _nullishCoalesce(url2, () => ( new Error("There was an error while getting this attachment's URL")))
-        );
-      },
-      { delay: 50 }
-    );
-    return createBatchStore(batch2);
-  });
-  function getOrCreateChatAttachmentUrlsStore(chatId) {
-    return attachmentUrlsBatchStoresByChat.getOrCreate(chatId);
-  }
-  function getChatAttachmentUrl(options) {
-    const batch2 = getOrCreateChatAttachmentUrlsStore(options.chatId).batch;
-    return batch2.get(options.attachmentId);
-  }
   async function getSubscriptionSettings(options) {
     return httpClient.get(
       url`/v2/c/rooms/${options.roomId}/subscription-settings`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       void 0,
       {
@@ -2138,8 +2064,9 @@ function createApiClient({
     return httpClient.post(
       url`/v2/c/rooms/${options.roomId}/subscription-settings`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "comments",
+        access: "read"
       }),
       options.settings
     );
@@ -2151,8 +2078,9 @@ function createApiClient({
         await httpClient.post(
           url`/v2/c/rooms/${roomId}/inbox-notifications/read`,
           await authManager.getAuthValue({
-            requestedScope: "comments:read",
-            roomId
+            roomId,
+            resource: "comments",
+            access: "read"
           }),
           { inboxNotificationIds }
         );
@@ -2172,8 +2100,9 @@ function createApiClient({
     await httpClient.rawPost(
       url`/v2/c/rooms/${options.roomId}/text-mentions`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "write"
       }),
       {
         userId: options.mention.kind === "user" ? options.mention.id : void 0,
@@ -2187,8 +2116,9 @@ function createApiClient({
     await httpClient.rawDelete(
       url`/v2/c/rooms/${options.roomId}/text-mentions/${options.mentionId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "write"
       })
     );
   }
@@ -2196,8 +2126,9 @@ function createApiClient({
     return httpClient.rawGet(
       url`/v2/c/rooms/${options.roomId}/y-version/${options.versionId}`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       })
     );
   }
@@ -2205,8 +2136,9 @@ function createApiClient({
     await httpClient.rawPost(
       url`/v2/c/rooms/${options.roomId}/version`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "write"
       })
     );
   }
@@ -2214,8 +2146,9 @@ function createApiClient({
     await httpClient.rawPost(
       url`/v2/c/rooms/${options.roomId}/text-metadata`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       }),
       {
         type: options.type,
@@ -2227,8 +2160,9 @@ function createApiClient({
     const result = await httpClient.post(
       url`/v2/c/rooms/${options.roomId}/ai/contextual-prompt`,
       await authManager.getAuthValue({
-        requestedScope: "room:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       }),
       {
         prompt: options.prompt,
@@ -2250,8 +2184,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/versions`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       })
     );
     return {
@@ -2268,8 +2203,9 @@ function createApiClient({
     const result = await httpClient.get(
       url`/v2/c/rooms/${options.roomId}/versions/delta`,
       await authManager.getAuthValue({
-        requestedScope: "comments:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       }),
       { since: options.since.toISOString() },
       { signal: options.signal }
@@ -2288,8 +2224,9 @@ function createApiClient({
     const result = await httpClient.rawGet(
       url`/v2/c/rooms/${options.roomId}/storage`,
       await authManager.getAuthValue({
-        requestedScope: "room:read",
-        roomId: options.roomId
+        roomId: options.roomId,
+        resource: "storage",
+        access: "read"
       })
     );
     return await result.json();
@@ -2302,7 +2239,7 @@ function createApiClient({
     }
     const json = await httpClient.get(
       url`/v2/c/inbox-notifications`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         cursor: _optionalChain([options, 'optionalAccess', _22 => _22.cursor]),
         limit: PAGE_SIZE,
@@ -2328,7 +2265,7 @@ function createApiClient({
     }
     const json = await httpClient.get(
       url`/v2/c/inbox-notifications/delta`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { since: options.since.toISOString(), query },
       { signal: options.signal }
     );
@@ -2357,7 +2294,7 @@ function createApiClient({
     }
     const { count } = await httpClient.get(
       url`/v2/c/inbox-notifications/count`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { query },
       { signal: _optionalChain([options, 'optionalAccess', _25 => _25.signal]) }
     );
@@ -2366,7 +2303,7 @@ function createApiClient({
   async function markAllInboxNotificationsAsRead() {
     await httpClient.post(
       url`/v2/c/inbox-notifications/read`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         inboxNotificationIds: "all"
       }
@@ -2375,7 +2312,7 @@ function createApiClient({
   async function markInboxNotificationsAsRead(inboxNotificationIds) {
     await httpClient.post(
       url`/v2/c/inbox-notifications/read`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         inboxNotificationIds
       }
@@ -2395,19 +2332,19 @@ function createApiClient({
   async function deleteAllInboxNotifications() {
     await httpClient.delete(
       url`/v2/c/inbox-notifications`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" })
+      await authManager.getAuthValue({ resource: "personal", access: "write" })
     );
   }
   async function deleteInboxNotification(inboxNotificationId) {
     await httpClient.delete(
       url`/v2/c/inbox-notifications/${inboxNotificationId}`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" })
+      await authManager.getAuthValue({ resource: "personal", access: "write" })
     );
   }
   async function getNotificationSettings(options) {
     return httpClient.get(
       url`/v2/c/notification-settings`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       void 0,
       { signal: _optionalChain([options, 'optionalAccess', _26 => _26.signal]) }
     );
@@ -2415,7 +2352,7 @@ function createApiClient({
   async function updateNotificationSettings(settings) {
     return httpClient.post(
       url`/v2/c/notification-settings`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       settings
     );
   }
@@ -2427,7 +2364,7 @@ function createApiClient({
     const PAGE_SIZE = 50;
     const json = await httpClient.get(
       url`/v2/c/threads`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       {
         cursor: _optionalChain([options, 'optionalAccess', _28 => _28.cursor]),
         query,
@@ -2448,7 +2385,7 @@ function createApiClient({
   async function getUserThreadsSince_experimental(options) {
     const json = await httpClient.get(
       url`/v2/c/threads/delta`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { since: options.since.toISOString() },
       { signal: options.signal }
     );
@@ -2477,7 +2414,8 @@ function createApiClient({
       const { groups: plainGroups } = await httpClient.post(
         url`/v2/c/groups/find`,
         await authManager.getAuthValue({
-          requestedScope: "comments:read"
+          resource: "personal",
+          access: "write"
         }),
         { groupIds }
       );
@@ -2496,7 +2434,7 @@ function createApiClient({
   async function getUrlMetadata(_url) {
     const { metadata } = await httpClient.get(
       url`/v2/c/urls/metadata`,
-      await authManager.getAuthValue({ requestedScope: "comments:read" }),
+      await authManager.getAuthValue({ resource: "personal", access: "write" }),
       { url: _url }
     );
     return metadata;
@@ -2536,10 +2474,6 @@ function createApiClient({
     getAttachmentUrl,
     uploadAttachment,
     getOrCreateAttachmentUrlsStore,
-    // User attachments
-    uploadChatAttachment,
-    getOrCreateChatAttachmentUrlsStore,
-    getChatAttachmentUrl,
     // Room storage
     streamStorage,
     // Notifications
@@ -2645,7 +2579,7 @@ var HttpClient = class {
     let body;
     try {
       body = await response.json();
-    } catch (e10) {
+    } catch (e9) {
       body = {};
     }
     return body;
@@ -3845,7 +3779,7 @@ var ManagedSocket = class {
   getStatus() {
     try {
       return toNewConnectionStatus(this.#machine);
-    } catch (e11) {
+    } catch (e10) {
       return "initial";
     }
   }
@@ -5233,22 +5167,327 @@ function createReceivingToolInvocation(invocationId, name, partialArgsText = "")
   };
 }
 
-// src/protocol/AuthToken.ts
-var Permission = /* @__PURE__ */ ((Permission2) => {
-  Permission2["Read"] = "room:read";
-  Permission2["Write"] = "room:write";
-  Permission2["PresenceWrite"] = "room:presence:write";
-  Permission2["CommentsWrite"] = "comments:write";
-  Permission2["CommentsRead"] = "comments:read";
-  Permission2["FeedsWrite"] = "feeds:write";
-  return Permission2;
-})(Permission || {});
-function canWriteStorage(scopes) {
-  return scopes.includes("room:write" /* Write */);
-}
-function canComment(scopes) {
-  return scopes.includes("comments:write" /* CommentsWrite */) || scopes.includes("room:write" /* Write */);
+// src/permissions.ts
+var Permission = {
+  /**
+   * Default permission for a room.
+   */
+  Read: "*:read",
+  Write: "*:write",
+  /**
+   * Legacy aliases for default room permissions.
+   */
+  RoomWrite: "room:write",
+  RoomRead: "room:read",
+  /**
+   * Storage
+   */
+  StorageRead: "storage:read",
+  StorageWrite: "storage:write",
+  StorageNone: "storage:none",
+  /**
+   * Comments
+   */
+  CommentsWrite: "comments:write",
+  CommentsRead: "comments:read",
+  CommentsNone: "comments:none",
+  /**
+   * Feeds
+   */
+  FeedsRead: "feeds:read",
+  FeedsWrite: "feeds:write",
+  FeedsNone: "feeds:none",
+  /**
+   * Legacy
+   */
+  LegacyRoomPresenceWrite: "room:presence:write"
+};
+var ACCESS_LEVELS = ["none", "read", "write"];
+var basePermissionScopes = /* @__PURE__ */ new Set([
+  Permission.Read,
+  Permission.Write,
+  Permission.RoomRead,
+  Permission.RoomWrite
+]);
+var ACCESS_LEVEL_RANKS = {
+  none: 0,
+  read: 1,
+  write: 2
+};
+var PERMISSIONS_BY_RESOURCE = {
+  room: {
+    read: [Permission.Read, Permission.RoomRead],
+    write: [Permission.Write, Permission.RoomWrite]
+  },
+  personal: {
+    write: []
+  },
+  storage: {
+    write: [Permission.StorageWrite],
+    read: [Permission.StorageRead],
+    none: [Permission.StorageNone]
+  },
+  comments: {
+    write: [Permission.CommentsWrite],
+    read: [Permission.CommentsRead],
+    none: [Permission.CommentsNone]
+  },
+  feeds: {
+    write: [Permission.FeedsWrite],
+    read: [Permission.FeedsRead],
+    none: [Permission.FeedsNone]
+  }
+};
+var NO_PERMISSION_MATRIX = {
+  room: "none",
+  storage: "none",
+  comments: "none",
+  feeds: "none",
+  personal: "none"
+};
+var BASE_PERMISSION_RESOURCE = "room";
+var ROOM_PERMISSION_RESOURCES = [
+  "storage",
+  "comments",
+  "feeds"
+];
+var VALID_PERMISSIONS = new Set(Object.values(Permission));
+function isPermission(permission) {
+  return VALID_PERMISSIONS.has(permission);
+}
+function resolveResourceAccess(scopes, resource) {
+  const permissions = PERMISSIONS_BY_RESOURCE[resource];
+  let resourceAccess;
+  for (const access of ACCESS_LEVELS) {
+    const scopedPermissions = permissions[access];
+    if (scopedPermissions !== void 0 && scopedPermissions.some((permission) => scopes.includes(permission))) {
+      resourceAccess = access;
+    }
+  }
+  return resourceAccess;
+}
+function permissionMatrixFromResolvedScopes(resolved) {
+  if (!resolved.hasDefaultPermission) {
+    return { ...NO_PERMISSION_MATRIX };
+  }
+  const matrix = {
+    ...NO_PERMISSION_MATRIX,
+    [BASE_PERMISSION_RESOURCE]: resolved.baseAccess,
+    personal: "write"
+  };
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    matrix[resource] = _nullishCoalesce(resolved.matrix[resource], () => ( resolved.baseAccess));
+  }
+  return matrix;
+}
+function permissionMatrixFromScopes(scopes) {
+  return permissionMatrixFromResolvedScopes(resolvePermissionScopes(scopes));
+}
+function resolvePermissionScopes(scopes) {
+  const hasDefaultPermission = scopes.includes(Permission.Write) || scopes.includes(Permission.Read) || scopes.includes(Permission.RoomWrite) || scopes.includes(Permission.RoomRead);
+  const baseAccess = scopes.includes(Permission.Write) || scopes.includes(Permission.RoomWrite) ? "write" : scopes.includes(Permission.Read) || scopes.includes(Permission.RoomRead) ? "read" : "none";
+  const matrix = {};
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    const access = resolveResourceAccess(scopes, resource);
+    if (access !== void 0) {
+      matrix[resource] = access;
+    }
+  }
+  return { hasDefaultPermission, baseAccess, matrix };
+}
+function hasPermissionAccess(matrix, resource, requiredAccess) {
+  const access = _nullishCoalesce(matrix[resource], () => ( "none"));
+  return ACCESS_LEVEL_RANKS[access] >= ACCESS_LEVEL_RANKS[requiredAccess];
 }
+function resolveRoomPermissionMatrix(permissions, roomId) {
+  const matchedPermissions = permissions.filter(
+    (entry) => roomPatternMatches(entry.pattern, roomId)
+  );
+  if (matchedPermissions.length === 0) {
+    return void 0;
+  }
+  let hasDefaultPermission = false;
+  let baseAccess = "none";
+  const explicitMatrix = {};
+  const explicitSpecificity = {};
+  for (const entry of matchedPermissions) {
+    const resolved = resolvePermissionScopes(entry.scopes);
+    const specificity = roomPatternSpecificity(entry.pattern);
+    if (resolved.hasDefaultPermission) {
+      hasDefaultPermission = true;
+      baseAccess = strongestAccess(baseAccess, resolved.baseAccess);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = resolved.matrix[resource];
+      if (access !== void 0) {
+        const currentSpecificity = _nullishCoalesce(explicitSpecificity[resource], () => ( -1));
+        if (specificity > currentSpecificity) {
+          explicitMatrix[resource] = access;
+          explicitSpecificity[resource] = specificity;
+        } else if (specificity === currentSpecificity) {
+          explicitMatrix[resource] = strongestAccess(
+            _nullishCoalesce(explicitMatrix[resource], () => ( "none")),
+            access
+          );
+        }
+      }
+    }
+  }
+  return permissionMatrixFromResolvedScopes({
+    hasDefaultPermission,
+    baseAccess,
+    matrix: explicitMatrix
+  });
+}
+function normalizeRoomPermissions(permissions) {
+  if (!Array.isArray(permissions)) {
+    throw new Error("Permission list must be an array");
+  }
+  const result = [];
+  for (const permission of permissions) {
+    if (!isPermission(permission)) {
+      throw new Error(`Not a valid permission: ${permission}`);
+    }
+    result.push(permission);
+  }
+  return result;
+}
+function normalizeRoomAccesses(accesses) {
+  if (accesses === void 0) {
+    return void 0;
+  }
+  return Object.fromEntries(
+    Object.entries(accesses).map(([id, permissions]) => [
+      id,
+      normalizeRoomPermissions(permissions)
+    ])
+  );
+}
+function normalizeUpdateRoomAccesses(accesses) {
+  if (accesses === void 0) {
+    return void 0;
+  }
+  return Object.fromEntries(
+    Object.entries(accesses).map(([id, permissions]) => [
+      id,
+      permissions === null ? null : normalizeRoomPermissions(permissions)
+    ])
+  );
+}
+function permissionMatrixToScopes(matrix) {
+  const scopes = [];
+  const baseAccess = matrix.room;
+  if (baseAccess !== "none") {
+    scopes.push(permissionForAccessLevel(BASE_PERMISSION_RESOURCE, baseAccess));
+  }
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    const access = matrix[resource];
+    if (access !== baseAccess) {
+      scopes.push(permissionForAccessLevel(resource, access));
+    }
+  }
+  return scopes;
+}
+function mergeRoomPermissionScopes({
+  defaultAccesses,
+  groupsAccesses,
+  userAccesses
+}) {
+  const sources = [
+    resolvePermissionScopes(defaultAccesses),
+    mergeResolvedScopesByHighestAccess(
+      groupsAccesses.map(resolvePermissionScopes)
+    ),
+    resolvePermissionScopes(userAccesses)
+  ];
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = source.baseAccess;
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = access;
+      }
+    }
+  }
+  return permissionMatrixToScopes(permissionMatrixFromResolvedScopes(merged));
+}
+function mergeResolvedScopesByHighestAccess(sources) {
+  const merged = {
+    hasDefaultPermission: false,
+    baseAccess: "none",
+    matrix: {}
+  };
+  for (const source of sources) {
+    if (source.hasDefaultPermission) {
+      merged.hasDefaultPermission = true;
+      merged.baseAccess = strongestAccess(merged.baseAccess, source.baseAccess);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = source.matrix[resource];
+      if (access !== void 0) {
+        merged.matrix[resource] = strongestAccess(
+          _nullishCoalesce(merged.matrix[resource], () => ( "none")),
+          access
+        );
+      }
+    }
+  }
+  return merged;
+}
+function permissionForAccessLevel(resource, access, field = resource) {
+  const levels = PERMISSIONS_BY_RESOURCE[resource];
+  const permissions = levels[access];
+  if (permissions === void 0 || permissions.length === 0) {
+    throw new Error(
+      `Invalid permission level for ${field}: ${_nullishCoalesce(JSON.stringify(access), () => ( String(access)))}`
+    );
+  }
+  return permissions[0];
+}
+function strongestAccess(left, right) {
+  return ACCESS_LEVEL_RANKS[right] > ACCESS_LEVEL_RANKS[left] ? right : left;
+}
+function roomPatternMatches(pattern, roomId) {
+  if (pattern.includes("*")) {
+    return roomId.startsWith(pattern.replace("*", ""));
+  }
+  return pattern === roomId;
+}
+function roomPatternSpecificity(pattern) {
+  return pattern.replace("*", "").length;
+}
+function validatePermissionsSet(scopes) {
+  const unknownScopes = scopes.filter((scope) => !VALID_PERMISSIONS.has(scope));
+  if (unknownScopes.length > 0) {
+    return `Unknown permission scope(s): ${unknownScopes.join(", ")}`;
+  }
+  const baseScopes = scopes.filter((scope) => basePermissionScopes.has(scope));
+  if (baseScopes.length !== 1) {
+    return `Permissions must include exactly one of ${Permission.Read}, ${Permission.Write} (or the legacy aliases ${Permission.RoomRead}, ${Permission.RoomWrite}), got ${baseScopes.length === 0 ? "none" : baseScopes.join(", ")}`;
+  }
+  const seenFeatures = /* @__PURE__ */ new Set();
+  for (const scope of scopes) {
+    if (basePermissionScopes.has(scope) || scope === Permission.LegacyRoomPresenceWrite) {
+      continue;
+    }
+    const feature = scope.slice(0, scope.indexOf(":"));
+    if (seenFeatures.has(feature)) {
+      return `Permissions can include at most one scope per feature, got multiple "${feature}" scopes`;
+    }
+    seenFeatures.add(feature);
+  }
+  return true;
+}
+
+// src/protocol/AuthToken.ts
 function isValidAuthTokenPayload(data) {
   return isPlainObject(data) && (data.k === "acc" /* ACCESS_TOKEN */ || data.k === "id" /* ID_TOKEN */);
 }
@@ -5287,47 +5526,22 @@ function createAuthManager(authOptions, onAuthenticate) {
   const authentication = prepareAuthentication(authOptions);
   const seenTokens = /* @__PURE__ */ new Set();
   const tokens = [];
-  const expiryTimes = [];
   const requestPromises = /* @__PURE__ */ new Map();
   function reset() {
     seenTokens.clear();
     tokens.length = 0;
-    expiryTimes.length = 0;
     requestPromises.clear();
   }
-  function hasCorrespondingScopes(requestedScope, scopes) {
-    if (requestedScope === "comments:read") {
-      return scopes.includes("comments:read" /* CommentsRead */) || scopes.includes("comments:write" /* CommentsWrite */) || scopes.includes("room:read" /* Read */) || scopes.includes("room:write" /* Write */);
-    } else if (requestedScope === "room:read") {
-      return scopes.includes("room:read" /* Read */) || scopes.includes("room:write" /* Write */);
-    }
-    return false;
-  }
   function getCachedToken(requestOptions) {
     const now2 = Math.ceil(Date.now() / 1e3);
     for (let i = tokens.length - 1; i >= 0; i--) {
-      const token = tokens[i];
-      const expiresAt = expiryTimes[i];
-      if (expiresAt <= now2) {
+      const cachedToken = tokens[i];
+      if (cachedToken.expiresAt <= now2) {
         tokens.splice(i, 1);
-        expiryTimes.splice(i, 1);
         continue;
       }
-      if (token.parsed.k === "id" /* ID_TOKEN */) {
-        return token;
-      } else if (token.parsed.k === "acc" /* ACCESS_TOKEN */) {
-        if (!requestOptions.roomId && Object.entries(token.parsed.perms).length === 0) {
-          return token;
-        }
-        for (const [resource, scopes] of Object.entries(token.parsed.perms)) {
-          if (!requestOptions.roomId) {
-            if (resource.includes("*") && hasCorrespondingScopes(requestOptions.requestedScope, scopes)) {
-              return token;
-            }
-          } else if (resource.includes("*") && requestOptions.roomId.startsWith(resource.replace("*", "")) || requestOptions.roomId === resource && hasCorrespondingScopes(requestOptions.requestedScope, scopes)) {
-            return token;
-          }
-        }
+      if (cachedTokenSatisfiesRequest(cachedToken, requestOptions)) {
+        return cachedToken.token;
       }
     }
     return void 0;
@@ -5345,11 +5559,15 @@ function createAuthManager(authOptions, onAuthenticate) {
       });
       const parsed = parseAuthToken(response.token);
       if (seenTokens.has(parsed.raw)) {
+        const cachedToken = getCachedToken(options);
+        if (_optionalChain([cachedToken, 'optionalAccess', _109 => _109.raw]) === parsed.raw) {
+          return cachedToken;
+        }
         throw new StopRetrying(
           "The same Liveblocks auth token was issued from the backend before. Caching Liveblocks tokens is not supported."
         );
       }
-      _optionalChain([onAuthenticate, 'optionalCall', _109 => _109(parsed.parsed)]);
+      _optionalChain([onAuthenticate, 'optionalCall', _110 => _110(parsed.parsed)]);
       return parsed;
     }
     if (authentication.type === "custom") {
@@ -5357,7 +5575,7 @@ function createAuthManager(authOptions, onAuthenticate) {
       if (response && typeof response === "object") {
         if (typeof response.token === "string") {
           const parsed = parseAuthToken(response.token);
-          _optionalChain([onAuthenticate, 'optionalCall', _110 => _110(parsed.parsed)]);
+          _optionalChain([onAuthenticate, 'optionalCall', _111 => _111(parsed.parsed)]);
           return parsed;
         } else if (typeof response.error === "string") {
           const reason = `Authentication failed: ${"reason" in response && typeof response.reason === "string" ? response.reason : "Forbidden"}`;
@@ -5385,11 +5603,12 @@ function createAuthManager(authOptions, onAuthenticate) {
       return { type: "secret", token: cachedToken };
     }
     let currentPromise;
-    if (requestOptions.roomId) {
-      currentPromise = requestPromises.get(requestOptions.roomId);
+    const requestKey = getAuthRequestKey(requestOptions);
+    if (requestKey !== void 0) {
+      currentPromise = requestPromises.get(requestKey);
       if (currentPromise === void 0) {
         currentPromise = makeAuthRequest(requestOptions);
-        requestPromises.set(requestOptions.roomId, currentPromise);
+        requestPromises.set(requestKey, currentPromise);
       }
     } else {
       currentPromise = requestPromises.get("liveblocks-user-token");
@@ -5403,12 +5622,12 @@ function createAuthManager(authOptions, onAuthenticate) {
       const BUFFER = 30;
       const expiresAt = Math.floor(Date.now() / 1e3) + (token.parsed.exp - token.parsed.iat) - BUFFER;
       seenTokens.add(token.raw);
-      tokens.push(token);
-      expiryTimes.push(expiresAt);
+      const cachedToken2 = makeCachedToken(token, expiresAt);
+      tokens.push(cachedToken2);
       return { type: "secret", token };
     } finally {
-      if (requestOptions.roomId) {
-        requestPromises.delete(requestOptions.roomId);
+      if (requestKey !== void 0) {
+        requestPromises.delete(requestKey);
       } else {
         requestPromises.delete("liveblocks-user-token");
       }
@@ -5419,6 +5638,43 @@ function createAuthManager(authOptions, onAuthenticate) {
     getAuthValue
   };
 }
+function getAuthRequestKey(request) {
+  if (request.roomId === void 0) {
+    return void 0;
+  }
+  return `${request.roomId}:${request.resource}:${request.access}`;
+}
+function makeCachedToken(token, expiresAt) {
+  if (token.parsed.k === "acc" /* ACCESS_TOKEN */) {
+    return {
+      token,
+      expiresAt,
+      permissions: Object.entries(token.parsed.perms).map(
+        ([pattern, scopes]) => ({
+          pattern,
+          scopes: normalizeRoomPermissions(scopes)
+        })
+      )
+    };
+  }
+  return { token, expiresAt };
+}
+function cachedTokenSatisfiesRequest(cachedToken, request) {
+  if (cachedToken.token.parsed.k === "id" /* ID_TOKEN */) {
+    return true;
+  }
+  if (request.resource === "personal") {
+    return true;
+  }
+  if (request.roomId === void 0) {
+    return false;
+  }
+  const matrix = resolveRoomPermissionMatrix(
+    _nullishCoalesce(cachedToken.permissions, () => ( [])),
+    request.roomId
+  );
+  return matrix !== void 0 && hasPermissionAccess(matrix, request.resource, request.access);
+}
 function prepareAuthentication(authOptions) {
   const { publicApiKey, authEndpoint } = authOptions;
   if (authEndpoint !== void 0 && publicApiKey !== void 0) {
@@ -5784,6 +6040,9 @@ var UnacknowledgedOps = class {
   #createOpsByPosition = /* @__PURE__ */ new Map();
   // parentId -> (opId -> Create op)
   #createOpsByParent = /* @__PURE__ */ new Map();
+  // opIds of pending ops that were in flight when a connection died, so the
+  // server may already have processed them. See isPossiblyStored().
+  #possiblyStoredOpIds = /* @__PURE__ */ new Set();
   #posKey(parentId, parentKey) {
     return `${parentId}
 ${parentKey}`;
@@ -5823,15 +6082,16 @@ ${parentKey}`;
       return;
     }
     this.#byOpId.delete(opId);
+    this.#possiblyStoredOpIds.delete(opId);
     if (isCreateOp(op)) {
       const posKey = this.#posKey(op.parentId, op.parentKey);
       const atPosition = this.#createOpsByPosition.get(posKey);
-      _optionalChain([atPosition, 'optionalAccess', _111 => _111.delete, 'call', _112 => _112(opId)]);
+      _optionalChain([atPosition, 'optionalAccess', _112 => _112.delete, 'call', _113 => _113(opId)]);
       if (atPosition !== void 0 && atPosition.size === 0) {
         this.#createOpsByPosition.delete(posKey);
       }
       const inParent = this.#createOpsByParent.get(op.parentId);
-      _optionalChain([inParent, 'optionalAccess', _113 => _113.delete, 'call', _114 => _114(opId)]);
+      _optionalChain([inParent, 'optionalAccess', _114 => _114.delete, 'call', _115 => _115(opId)]);
       if (inParent !== void 0 && inParent.size === 0) {
         this.#createOpsByParent.delete(op.parentId);
       }
@@ -5843,19 +6103,32 @@ ${parentKey}`;
    * Empty if none.
    */
   getByParentIdAndKey(parentId, parentKey) {
-    return _nullishCoalesce(_optionalChain([this, 'access', _115 => _115.#createOpsByPosition, 'access', _116 => _116.get, 'call', _117 => _117(this.#posKey(parentId, parentKey)), 'optionalAccess', _118 => _118.values, 'call', _119 => _119()]), () => ( []));
+    return _nullishCoalesce(_optionalChain([this, 'access', _116 => _116.#createOpsByPosition, 'access', _117 => _117.get, 'call', _118 => _118(this.#posKey(parentId, parentKey)), 'optionalAccess', _119 => _119.values, 'call', _120 => _120()]), () => ( []));
   }
   /**
    * The still-unacknowledged Create ops with the given `parentId` (across all
    * positions), in dispatch order. O(1) lookup. Empty if none.
    */
   getByParentId(parentId) {
-    return _nullishCoalesce(_optionalChain([this, 'access', _120 => _120.#createOpsByParent, 'access', _121 => _121.get, 'call', _122 => _122(parentId), 'optionalAccess', _123 => _123.values, 'call', _124 => _124()]), () => ( []));
+    return _nullishCoalesce(_optionalChain([this, 'access', _121 => _121.#createOpsByParent, 'access', _122 => _122.get, 'call', _123 => _123(parentId), 'optionalAccess', _124 => _124.values, 'call', _125 => _125()]), () => ( []));
   }
   /** All still-unacknowledged ops, in dispatch order. */
   values() {
     return this.#byOpId.values();
   }
+  isPossiblyStored(opId) {
+    return this.#possiblyStoredOpIds.has(opId);
+  }
+  /**
+   * Mark every currently pending op as possibly stored on the server. Called
+   * when the connection dies: all of these ops were in flight, and their
+   * (possibly lost) acks would have been the only way to know their fate.
+   */
+  markAllAsPossiblyStored() {
+    for (const opId of this.#byOpId.keys()) {
+      this.#possiblyStoredOpIds.add(opId);
+    }
+  }
 };
 
 // src/crdts/AbstractCrdt.ts
@@ -5878,7 +6151,7 @@ function createManagedPool(roomId, options) {
     generateId: () => `${getCurrentConnectionId()}:${clock++}`,
     generateOpId: () => `${getCurrentConnectionId()}:${opClock++}`,
     dispatch(ops, reverse, storageUpdates) {
-      _optionalChain([onDispatch, 'optionalCall', _125 => _125(ops, reverse, storageUpdates)]);
+      _optionalChain([onDispatch, 'optionalCall', _126 => _126(ops, reverse, storageUpdates)]);
     },
     assertStorageIsWritable: () => {
       if (!isStorageWritable()) {
@@ -6452,7 +6725,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
     }
     return result.modified.updates[0];
   }
-  #applyRemoteInsert(op, fromSnapshot) {
+  #applyRemoteInsert(op) {
     if (this._pool === void 0) {
       throw new Error("Can't attach child if managed pool is not present");
     }
@@ -6462,7 +6735,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
       this.#shiftItemPosition(existingItemIndex, key);
     }
     const { newItem, newIndex } = this.#createAttachItemAndSort(op, key);
-    const bumpDeltas = fromSnapshot ? [] : this.#bumpUnackedPushesAbove(key);
+    const bumpDeltas = this.#bumpUnackedPushesAbove(key);
     return {
       modified: makeUpdate(this, [
         insertDelta(newIndex, newItem),
@@ -6477,6 +6750,13 @@ var LiveList = class _LiveList extends AbstractCrdt {
    * the single source of truth, so an item drops out the instant its op is
    * acked, with no per-instance membership to leak. Yielded in push order.
    *
+   * Excludes ops that may already be stored on the server (they were in
+   * flight when a connection died, so their fate is unknown): the bump
+   * prediction assumes the server has not processed the op yet, which is only
+   * guaranteed for ops sent on the current connection. For these excluded
+   * ops, the server's (re-)ack states the authoritative position; predicting
+   * locally could produce a wrong position that no ack would correct.
+   *
    * Restricted to items currently in `#items`: a pushed node whose op is still
    * pending may have been pulled out of the list (e.g. implicitly deleted by a
    * remote set, or removed by an undo) while still living in the pool, and such
@@ -6490,6 +6770,9 @@ var LiveList = class _LiveList extends AbstractCrdt {
       if (op.intent !== "push") {
         continue;
       }
+      if (this._pool.unacknowledgedOps.isPossiblyStored(op.opId)) {
+        continue;
+      }
       const node = this._pool.getNode(op.id);
       if (node !== void 0 && this.#items.includes(node)) {
         yield node;
@@ -6592,7 +6875,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
   #applyInsertUndoRedo(op) {
     const { id, parentKey: key } = op;
     const child = creationOpToLiveNode(op);
-    if (_optionalChain([this, 'access', _126 => _126._pool, 'optionalAccess', _127 => _127.getNode, 'call', _128 => _128(id)]) !== void 0) {
+    if (_optionalChain([this, 'access', _127 => _127._pool, 'optionalAccess', _128 => _128.getNode, 'call', _129 => _129(id)]) !== void 0) {
       return { modified: false };
     }
     child._attach(id, nn(this._pool));
@@ -6600,8 +6883,8 @@ var LiveList = class _LiveList extends AbstractCrdt {
     const existingItemIndex = this._indexOfPosition(key);
     let newKey = key;
     if (existingItemIndex !== -1) {
-      const before2 = _optionalChain([this, 'access', _129 => _129.#items, 'access', _130 => _130.at, 'call', _131 => _131(existingItemIndex), 'optionalAccess', _132 => _132._parentPos]);
-      const after2 = _optionalChain([this, 'access', _133 => _133.#items, 'access', _134 => _134.at, 'call', _135 => _135(existingItemIndex + 1), 'optionalAccess', _136 => _136._parentPos]);
+      const before2 = _optionalChain([this, 'access', _130 => _130.#items, 'access', _131 => _131.at, 'call', _132 => _132(existingItemIndex), 'optionalAccess', _133 => _133._parentPos]);
+      const after2 = _optionalChain([this, 'access', _134 => _134.#items, 'access', _135 => _135.at, 'call', _136 => _136(existingItemIndex + 1), 'optionalAccess', _137 => _137._parentPos]);
       newKey = makePosition(before2, after2);
       child._setParentLink(this, newKey);
     }
@@ -6615,7 +6898,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
   #applySetUndoRedo(op) {
     const { id, parentKey: key } = op;
     const child = creationOpToLiveNode(op);
-    if (_optionalChain([this, 'access', _137 => _137._pool, 'optionalAccess', _138 => _138.getNode, 'call', _139 => _139(id)]) !== void 0) {
+    if (_optionalChain([this, 'access', _138 => _138._pool, 'optionalAccess', _139 => _139.getNode, 'call', _140 => _140(id)]) !== void 0) {
       return { modified: false };
     }
     const indexOfItemWithSameKey = this._indexOfPosition(key);
@@ -6654,7 +6937,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
     }
   }
   /** @internal */
-  _attachChild(op, source, fromSnapshot = false) {
+  _attachChild(op, source) {
     if (this._pool === void 0) {
       throw new Error("Can't attach child if managed pool is not present");
     }
@@ -6669,7 +6952,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
       }
     } else {
       if (source === 1 /* THEIRS */) {
-        result = this.#applyRemoteInsert(op, fromSnapshot);
+        result = this.#applyRemoteInsert(op);
       } else if (source === 2 /* OURS */) {
         result = this.#applyInsertAck(op);
       } else {
@@ -6736,7 +7019,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
     } else {
       this.#updateItemPositionAt(
         existingItemIndex,
-        makePosition(newKey, _optionalChain([this, 'access', _140 => _140.#items, 'access', _141 => _141.at, 'call', _142 => _142(existingItemIndex + 1), 'optionalAccess', _143 => _143._parentPos]))
+        makePosition(newKey, _optionalChain([this, 'access', _141 => _141.#items, 'access', _142 => _142.at, 'call', _143 => _143(existingItemIndex + 1), 'optionalAccess', _144 => _144._parentPos]))
       );
       const previousIndex = this.#items.findIndex((item) => item === child);
       this.#updateItemPosition(child, newKey);
@@ -6763,7 +7046,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
           this,
           makePosition(
             newKey,
-            _optionalChain([this, 'access', _144 => _144.#items, 'access', _145 => _145.at, 'call', _146 => _146(existingItemIndex + 1), 'optionalAccess', _147 => _147._parentPos])
+            _optionalChain([this, 'access', _145 => _145.#items, 'access', _146 => _146.at, 'call', _147 => _147(existingItemIndex + 1), 'optionalAccess', _148 => _148._parentPos])
           )
         );
         this.#items.reposition(existingItem);
@@ -6787,7 +7070,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
           existingItemIndex,
           makePosition(
             newKey,
-            _optionalChain([this, 'access', _148 => _148.#items, 'access', _149 => _149.at, 'call', _150 => _150(existingItemIndex + 1), 'optionalAccess', _151 => _151._parentPos])
+            _optionalChain([this, 'access', _149 => _149.#items, 'access', _150 => _150.at, 'call', _151 => _151(existingItemIndex + 1), 'optionalAccess', _152 => _152._parentPos])
           )
         );
       }
@@ -6815,7 +7098,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
     if (existingItemIndex !== -1) {
       actualNewKey = makePosition(
         newKey,
-        _optionalChain([this, 'access', _152 => _152.#items, 'access', _153 => _153.at, 'call', _154 => _154(existingItemIndex + 1), 'optionalAccess', _155 => _155._parentPos])
+        _optionalChain([this, 'access', _153 => _153.#items, 'access', _154 => _154.at, 'call', _155 => _155(existingItemIndex + 1), 'optionalAccess', _156 => _156._parentPos])
       );
     }
     this.#updateItemPosition(child, actualNewKey);
@@ -6889,14 +7172,14 @@ var LiveList = class _LiveList extends AbstractCrdt {
    * instead of resolving its position against the client's stale view.
    */
   #injectAt(element, index, intent) {
-    _optionalChain([this, 'access', _156 => _156._pool, 'optionalAccess', _157 => _157.assertStorageIsWritable, 'call', _158 => _158()]);
+    _optionalChain([this, 'access', _157 => _157._pool, 'optionalAccess', _158 => _158.assertStorageIsWritable, 'call', _159 => _159()]);
     if (index < 0 || index > this.#items.length) {
       throw new Error(
         `Cannot insert list item at index "${index}". index should be between 0 and ${this.#items.length}`
       );
     }
-    const before2 = _optionalChain([this, 'access', _159 => _159.#items, 'access', _160 => _160.at, 'call', _161 => _161(index - 1), 'optionalAccess', _162 => _162._parentPos]);
-    const after2 = _optionalChain([this, 'access', _163 => _163.#items, 'access', _164 => _164.at, 'call', _165 => _165(index), 'optionalAccess', _166 => _166._parentPos]);
+    const before2 = _optionalChain([this, 'access', _160 => _160.#items, 'access', _161 => _161.at, 'call', _162 => _162(index - 1), 'optionalAccess', _163 => _163._parentPos]);
+    const after2 = _optionalChain([this, 'access', _164 => _164.#items, 'access', _165 => _165.at, 'call', _166 => _166(index), 'optionalAccess', _167 => _167._parentPos]);
     const position = makePosition(before2, after2);
     const value = lsonToLiveNode(element);
     value._setParentLink(this, position);
@@ -6920,7 +7203,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
    * @param targetIndex The index where the element should be after moving.
    */
   move(index, targetIndex) {
-    _optionalChain([this, 'access', _167 => _167._pool, 'optionalAccess', _168 => _168.assertStorageIsWritable, 'call', _169 => _169()]);
+    _optionalChain([this, 'access', _168 => _168._pool, 'optionalAccess', _169 => _169.assertStorageIsWritable, 'call', _170 => _170()]);
     if (targetIndex < 0) {
       throw new Error("targetIndex cannot be less than 0");
     }
@@ -6938,11 +7221,11 @@ var LiveList = class _LiveList extends AbstractCrdt {
     let beforePosition = null;
     let afterPosition = null;
     if (index < targetIndex) {
-      afterPosition = targetIndex === this.#items.length - 1 ? void 0 : _optionalChain([this, 'access', _170 => _170.#items, 'access', _171 => _171.at, 'call', _172 => _172(targetIndex + 1), 'optionalAccess', _173 => _173._parentPos]);
+      afterPosition = targetIndex === this.#items.length - 1 ? void 0 : _optionalChain([this, 'access', _171 => _171.#items, 'access', _172 => _172.at, 'call', _173 => _173(targetIndex + 1), 'optionalAccess', _174 => _174._parentPos]);
       beforePosition = this.#items.at(targetIndex)._parentPos;
     } else {
       afterPosition = this.#items.at(targetIndex)._parentPos;
-      beforePosition = targetIndex === 0 ? void 0 : _optionalChain([this, 'access', _174 => _174.#items, 'access', _175 => _175.at, 'call', _176 => _176(targetIndex - 1), 'optionalAccess', _177 => _177._parentPos]);
+      beforePosition = targetIndex === 0 ? void 0 : _optionalChain([this, 'access', _175 => _175.#items, 'access', _176 => _176.at, 'call', _177 => _177(targetIndex - 1), 'optionalAccess', _178 => _178._parentPos]);
     }
     const position = makePosition(beforePosition, afterPosition);
     const item = this.#items.at(index);
@@ -6977,7 +7260,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
    * @param index The index of the element to delete
    */
   delete(index) {
-    _optionalChain([this, 'access', _178 => _178._pool, 'optionalAccess', _179 => _179.assertStorageIsWritable, 'call', _180 => _180()]);
+    _optionalChain([this, 'access', _179 => _179._pool, 'optionalAccess', _180 => _180.assertStorageIsWritable, 'call', _181 => _181()]);
     if (index < 0 || index >= this.#items.length) {
       throw new Error(
         `Cannot delete list item at index "${index}". index should be between 0 and ${this.#items.length - 1}`
@@ -7010,7 +7293,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
     }
   }
   clear() {
-    _optionalChain([this, 'access', _181 => _181._pool, 'optionalAccess', _182 => _182.assertStorageIsWritable, 'call', _183 => _183()]);
+    _optionalChain([this, 'access', _182 => _182._pool, 'optionalAccess', _183 => _183.assertStorageIsWritable, 'call', _184 => _184()]);
     if (this._pool) {
       const ops = [];
       const reverseOps = [];
@@ -7044,7 +7327,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
     }
   }
   set(index, item) {
-    _optionalChain([this, 'access', _184 => _184._pool, 'optionalAccess', _185 => _185.assertStorageIsWritable, 'call', _186 => _186()]);
+    _optionalChain([this, 'access', _185 => _185._pool, 'optionalAccess', _186 => _186.assertStorageIsWritable, 'call', _187 => _187()]);
     if (index < 0 || index >= this.#items.length) {
       throw new Error(
         `Cannot set list item at index "${index}". index should be between 0 and ${this.#items.length - 1}`
@@ -7203,7 +7486,7 @@ var LiveList = class _LiveList extends AbstractCrdt {
   #shiftItemPosition(index, key) {
     const shiftedPosition = makePosition(
       key,
-      this.#items.length > index + 1 ? _optionalChain([this, 'access', _187 => _187.#items, 'access', _188 => _188.at, 'call', _189 => _189(index + 1), 'optionalAccess', _190 => _190._parentPos]) : void 0
+      this.#items.length > index + 1 ? _optionalChain([this, 'access', _188 => _188.#items, 'access', _189 => _189.at, 'call', _190 => _190(index + 1), 'optionalAccess', _191 => _191._parentPos]) : void 0
     );
     this.#updateItemPositionAt(index, shiftedPosition);
   }
@@ -7452,7 +7735,7 @@ var LiveMap = class _LiveMap extends AbstractCrdt {
    * @param value The value of the element to add. Should be serializable to JSON.
    */
   set(key, value) {
-    _optionalChain([this, 'access', _191 => _191._pool, 'optionalAccess', _192 => _192.assertStorageIsWritable, 'call', _193 => _193()]);
+    _optionalChain([this, 'access', _192 => _192._pool, 'optionalAccess', _193 => _193.assertStorageIsWritable, 'call', _194 => _194()]);
     const oldValue = this.#map.get(key);
     if (oldValue) {
       oldValue._detach();
@@ -7498,7 +7781,7 @@ var LiveMap = class _LiveMap extends AbstractCrdt {
    * @returns true if an element existed and has been removed, or false if the element does not exist.
    */
   delete(key) {
-    _optionalChain([this, 'access', _194 => _194._pool, 'optionalAccess', _195 => _195.assertStorageIsWritable, 'call', _196 => _196()]);
+    _optionalChain([this, 'access', _195 => _195._pool, 'optionalAccess', _196 => _196.assertStorageIsWritable, 'call', _197 => _197()]);
     const item = this.#map.get(key);
     if (item === void 0) {
       return false;
@@ -7928,6 +8211,7 @@ var LiveObject = (_class2 = class _LiveObject extends AbstractCrdt {
       const id = nn(this._id);
       const parentKey = nn(child._parentKey);
       const reverse = child._toOps(id, parentKey);
+      const deletedItem = liveNodeToLson(child);
       for (const [key, value] of this.#synced) {
         if (value === child) {
           this.#synced.delete(key);
@@ -7939,7 +8223,7 @@ var LiveObject = (_class2 = class _LiveObject extends AbstractCrdt {
         node: this,
         type: "LiveObject",
         updates: {
-          [parentKey]: { type: "delete" }
+          [parentKey]: { type: "delete", deletedItem }
         }
       };
       return { modified: storageUpdate, reverse };
@@ -8109,20 +8393,20 @@ var LiveObject = (_class2 = class _LiveObject extends AbstractCrdt {
    * Caveat: this method will not add changes to the undo/redo stack.
    */
   setLocal(key, value) {
-    _optionalChain([this, 'access', _197 => _197._pool, 'optionalAccess', _198 => _198.assertStorageIsWritable, 'call', _199 => _199()]);
+    _optionalChain([this, 'access', _198 => _198._pool, 'optionalAccess', _199 => _199.assertStorageIsWritable, 'call', _200 => _200()]);
     const deleteResult = this.#prepareDelete(key);
     this.#local.set(key, value);
     this.invalidate();
     if (this._pool !== void 0 && this._id !== void 0) {
-      const ops = _nullishCoalesce(_optionalChain([deleteResult, 'optionalAccess', _200 => _200[0]]), () => ( []));
-      const reverse = _nullishCoalesce(_optionalChain([deleteResult, 'optionalAccess', _201 => _201[1]]), () => ( []));
-      const storageUpdates = _nullishCoalesce(_optionalChain([deleteResult, 'optionalAccess', _202 => _202[2]]), () => ( /* @__PURE__ */ new Map()));
+      const ops = _nullishCoalesce(_optionalChain([deleteResult, 'optionalAccess', _201 => _201[0]]), () => ( []));
+      const reverse = _nullishCoalesce(_optionalChain([deleteResult, 'optionalAccess', _202 => _202[1]]), () => ( []));
+      const storageUpdates = _nullishCoalesce(_optionalChain([deleteResult, 'optionalAccess', _203 => _203[2]]), () => ( /* @__PURE__ */ new Map()));
       const existing = storageUpdates.get(this._id);
       storageUpdates.set(this._id, {
         node: this,
         type: "LiveObject",
         updates: {
-          ..._optionalChain([existing, 'optionalAccess', _203 => _203.updates]),
+          ..._optionalChain([existing, 'optionalAccess', _204 => _204.updates]),
           [key]: { type: "update" }
         }
       });
@@ -8142,7 +8426,7 @@ var LiveObject = (_class2 = class _LiveObject extends AbstractCrdt {
    * #synced or pool/id are unavailable. Does NOT dispatch.
    */
   #prepareDelete(key) {
-    _optionalChain([this, 'access', _204 => _204._pool, 'optionalAccess', _205 => _205.assertStorageIsWritable, 'call', _206 => _206()]);
+    _optionalChain([this, 'access', _205 => _205._pool, 'optionalAccess', _206 => _206.assertStorageIsWritable, 'call', _207 => _207()]);
     const k = key;
     if (this.#local.has(k) && !this.#synced.has(k)) {
       const oldValue2 = this.#local.get(k);
@@ -8218,7 +8502,7 @@ var LiveObject = (_class2 = class _LiveObject extends AbstractCrdt {
     const result = this.#prepareDelete(key);
     if (result) {
       const [ops, reverse, storageUpdates] = result;
-      _optionalChain([this, 'access', _207 => _207._pool, 'optionalAccess', _208 => _208.dispatch, 'call', _209 => _209(ops, reverse, storageUpdates)]);
+      _optionalChain([this, 'access', _208 => _208._pool, 'optionalAccess', _209 => _209.dispatch, 'call', _210 => _210(ops, reverse, storageUpdates)]);
     }
   }
   /**
@@ -8226,7 +8510,7 @@ var LiveObject = (_class2 = class _LiveObject extends AbstractCrdt {
    * @param patch The object used to overrides properties
    */
   update(patch) {
-    _optionalChain([this, 'access', _210 => _210._pool, 'optionalAccess', _211 => _211.assertStorageIsWritable, 'call', _212 => _212()]);
+    _optionalChain([this, 'access', _211 => _211._pool, 'optionalAccess', _212 => _212.assertStorageIsWritable, 'call', _213 => _213()]);
     if (_LiveObject.detectLargeObjects) {
       const data = {};
       for (const [key, value] of this.#synced) {
@@ -8247,7 +8531,7 @@ var LiveObject = (_class2 = class _LiveObject extends AbstractCrdt {
         const preciseSize = new TextEncoder().encode(jsonString).length;
         if (preciseSize > MAX_LIVE_OBJECT_SIZE) {
           throw new Error(
-            `LiveObject size exceeded limit: ${preciseSize} bytes > ${MAX_LIVE_OBJECT_SIZE} bytes. See https://liveblocks.io/docs/platform/limits#Liveblocks-Storage-limits`
+            `LiveObject size exceeded limit: ${preciseSize} bytes > ${MAX_LIVE_OBJECT_SIZE} bytes. See https://liveblocks.io/docs/pricing/limits#Other-limits`
           );
         }
       }
@@ -8541,23 +8825,68 @@ function dumpPool(pool) {
     (r) => `  ${r.id}  parent=${r.parentId}  key=${r.key || "\u2014"}  ${r.value}`
   ).join("\n");
 }
-function getTreesDiffOperations(currentItems, newItems) {
+function isJsonEq(a, b) {
+  if (a === b) {
+    return true;
+  }
+  if (typeof a !== "object" || a === null || typeof b !== "object" || b === null) {
+    return false;
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
+      return false;
+    }
+    for (let i = 0; i < a.length; i++) {
+      if (!isJsonEq(a[i], b[i])) {
+        return false;
+      }
+    }
+    return true;
+  }
+  const aKeys = Object.keys(a);
+  if (aKeys.length !== Object.keys(b).length) {
+    return false;
+  }
+  for (const key of aKeys) {
+    if (!isJsonEq(a[key], b[key])) {
+      return false;
+    }
+  }
+  return true;
+}
+function diffNodeMap(prev, next) {
   const ops = [];
-  currentItems.forEach((_, id) => {
-    if (!newItems.get(id)) {
+  prev.forEach((_, id) => {
+    if (!next.get(id)) {
       ops.push({ type: OpCode.DELETE_CRDT, id });
     }
   });
-  newItems.forEach((crdt, id) => {
-    const currentCrdt = currentItems.get(id);
+  next.forEach((crdt, id) => {
+    const currentCrdt = prev.get(id);
     if (currentCrdt) {
       if (crdt.type === CrdtType.OBJECT) {
-        if (currentCrdt.type !== CrdtType.OBJECT || stringifyOrLog(crdt.data) !== stringifyOrLog(currentCrdt.data)) {
-          ops.push({
-            type: OpCode.UPDATE_OBJECT,
-            id,
-            data: crdt.data
-          });
+        if (currentCrdt.type !== CrdtType.OBJECT) {
+          ops.push({ type: OpCode.UPDATE_OBJECT, id, data: crdt.data });
+        } else {
+          const changed = /* @__PURE__ */ new Map();
+          for (const key of Object.keys(crdt.data)) {
+            const value = crdt.data[key];
+            if (value !== void 0 && !isJsonEq(value, currentCrdt.data[key])) {
+              changed.set(key, value);
+            }
+          }
+          if (changed.size > 0) {
+            ops.push({
+              type: OpCode.UPDATE_OBJECT,
+              id,
+              data: Object.fromEntries(changed)
+            });
+          }
+          for (const key of Object.keys(currentCrdt.data)) {
+            if (!(key in crdt.data)) {
+              ops.push({ type: OpCode.DELETE_OBJECT_KEY, id, key });
+            }
+          }
         }
       }
       if (crdt.parentKey !== currentCrdt.parentKey) {
@@ -8668,7 +8997,7 @@ function sendToPanel(message, options) {
     ...message,
     source: "liveblocks-devtools-client"
   };
-  if (!(_optionalChain([options, 'optionalAccess', _213 => _213.force]) || _bridgeActive)) {
+  if (!(_optionalChain([options, 'optionalAccess', _214 => _214.force]) || _bridgeActive)) {
     return;
   }
   window.postMessage(fullMsg, "*");
@@ -8676,7 +9005,7 @@ function sendToPanel(message, options) {
 var eventSource = makeEventSource();
 if (process.env.NODE_ENV !== "production" && typeof window !== "undefined") {
   window.addEventListener("message", (event) => {
-    if (event.source === window && _optionalChain([event, 'access', _214 => _214.data, 'optionalAccess', _215 => _215.source]) === "liveblocks-devtools-panel") {
+    if (event.source === window && _optionalChain([event, 'access', _215 => _215.data, 'optionalAccess', _216 => _216.source]) === "liveblocks-devtools-panel") {
       eventSource.notify(event.data);
     } else {
     }
@@ -8780,7 +9109,7 @@ function partialSyncConnection(room) {
   });
 }
 function partialSyncStorage(room) {
-  const root = room.getStorageSnapshot();
+  const root = room.getStorageOrNull();
   if (root) {
     sendToPanel({
       msg: "room::sync::partial",
@@ -8810,7 +9139,7 @@ function partialSyncOthers(room) {
   }
 }
 function fullSync(room) {
-  const root = room.getStorageSnapshot();
+  const root = room.getStorageOrNull();
   const me = room[kInternal].getSelf_forDevTools();
   const others = room[kInternal].getOthers_forDevTools();
   room.fetchYDoc("");
@@ -8818,7 +9147,7 @@ function fullSync(room) {
     msg: "room::sync::full",
     roomId: room.id,
     status: room.getStatus(),
-    storage: _nullishCoalesce(_optionalChain([root, 'optionalAccess', _216 => _216.toTreeNode, 'call', _217 => _217("root"), 'access', _218 => _218.payload]), () => ( null)),
+    storage: _nullishCoalesce(_optionalChain([root, 'optionalAccess', _217 => _217.toTreeNode, 'call', _218 => _218("root"), 'access', _219 => _219.payload]), () => ( null)),
     me,
     others
   });
@@ -9235,15 +9564,15 @@ var ClientMsgCode = Object.freeze({
 
 // src/refs/ManagedOthers.ts
 function makeUser(conn, presence) {
-  const { connectionId, id, info } = conn;
-  const canWrite = canWriteStorage(conn.scopes);
+  const { connectionId, id, info, access } = conn;
+  const { canWrite, canComment } = access;
   return freeze(
     compactObject({
       connectionId,
       id,
       info,
       canWrite,
-      canComment: canComment(conn.scopes),
+      canComment,
       isReadOnly: !canWrite,
       // Deprecated, kept for backward-compatibility
       presence
@@ -9314,7 +9643,7 @@ var ManagedOthers = class {
    * Records a known connection. This records the connection ID and the
    * associated metadata.
    */
-  setConnection(connectionId, metaUserId, metaUserInfo, scopes) {
+  setConnection(connectionId, metaUserId, metaUserInfo, access) {
     this.#internal.mutate((state) => {
       state.connections.set(
         connectionId,
@@ -9322,7 +9651,7 @@ var ManagedOthers = class {
           connectionId,
           id: metaUserId,
           info: metaUserInfo,
-          scopes
+          access
         })
       );
       if (!state.presences.has(connectionId)) {
@@ -9475,6 +9804,14 @@ function defaultMessageFromContext(context) {
 
 // src/room.ts
 var FEEDS_TIMEOUT = 5e3;
+function connectionAccessFromScopes(scopes) {
+  const roomPermissions = normalizeRoomPermissions(scopes);
+  const matrix = permissionMatrixFromScopes(roomPermissions);
+  return {
+    canWrite: hasPermissionAccess(matrix, "storage", "write"),
+    canComment: hasPermissionAccess(matrix, "comments", "write")
+  };
+}
 function makeIdFactory(connectionId) {
   let count = 0;
   return () => `${connectionId}:${count++}`;
@@ -9497,15 +9834,15 @@ function installBackgroundTabSpy() {
   const doc = typeof document !== "undefined" ? document : void 0;
   const inBackgroundSince = { current: null };
   function onVisibilityChange() {
-    if (_optionalChain([doc, 'optionalAccess', _219 => _219.visibilityState]) === "hidden") {
+    if (_optionalChain([doc, 'optionalAccess', _220 => _220.visibilityState]) === "hidden") {
       inBackgroundSince.current = _nullishCoalesce(inBackgroundSince.current, () => ( Date.now()));
     } else {
       inBackgroundSince.current = null;
     }
   }
-  _optionalChain([doc, 'optionalAccess', _220 => _220.addEventListener, 'call', _221 => _221("visibilitychange", onVisibilityChange)]);
+  _optionalChain([doc, 'optionalAccess', _221 => _221.addEventListener, 'call', _222 => _222("visibilitychange", onVisibilityChange)]);
   const unsub = () => {
-    _optionalChain([doc, 'optionalAccess', _222 => _222.removeEventListener, 'call', _223 => _223("visibilitychange", onVisibilityChange)]);
+    _optionalChain([doc, 'optionalAccess', _223 => _223.removeEventListener, 'call', _224 => _224("visibilitychange", onVisibilityChange)]);
   };
   return [inBackgroundSince, unsub];
 }
@@ -9526,6 +9863,19 @@ function makeNodeMapBuffer() {
     }
   };
 }
+function topLevelKeysOf(nodes) {
+  const keys2 = /* @__PURE__ */ new Set();
+  const root = nodes.get("root");
+  for (const key in _optionalChain([root, 'optionalAccess', _225 => _225.data])) {
+    keys2.add(key);
+  }
+  for (const node of nodes.values()) {
+    if (node.parentId === "root") {
+      keys2.add(node.parentKey);
+    }
+  }
+  return keys2;
+}
 function createRoom(options, config) {
   const roomId = config.roomId;
   const initialPresence = options.initialPresence;
@@ -9647,12 +9997,13 @@ function createRoom(options, config) {
       )
     };
     if (_getStorage$ !== null) {
-      refreshStorage({ flush: false });
+      refreshStorage();
     }
     flushNowOrSoon();
   }
   function onDidDisconnect() {
     clearTimeout(context.buffer.flushTimerID);
+    context.unacknowledgedOps.markAllAsPossiblyStored();
   }
   managedSocket.events.onMessage.subscribe(handleServerMessage);
   managedSocket.events.statusDidChange.subscribe(onStatusDidChange);
@@ -9698,8 +10049,8 @@ function createRoom(options, config) {
     }
   }
   function isStorageWritable() {
-    const scopes = _optionalChain([context, 'access', _224 => _224.dynamicSessionInfoSig, 'access', _225 => _225.get, 'call', _226 => _226(), 'optionalAccess', _227 => _227.scopes]);
-    return scopes !== void 0 ? canWriteStorage(scopes) : true;
+    const permissionMatrix = _optionalChain([context, 'access', _226 => _226.dynamicSessionInfoSig, 'access', _227 => _227.get, 'call', _228 => _228(), 'optionalAccess', _229 => _229.permissionMatrix]);
+    return permissionMatrix !== void 0 ? hasPermissionAccess(permissionMatrix, "storage", "write") : true;
   }
   const eventHub = {
     status: makeEventSource(),
@@ -9760,14 +10111,22 @@ function createRoom(options, config) {
       if (staticSession === null || dynamicSession === null) {
         return null;
       } else {
-        const canWrite = canWriteStorage(dynamicSession.scopes);
+        const canWrite = hasPermissionAccess(
+          dynamicSession.permissionMatrix,
+          "storage",
+          "write"
+        );
         return {
           connectionId: dynamicSession.actor,
           id: staticSession.userId,
           info: staticSession.userInfo,
           presence: myPresence,
           canWrite,
-          canComment: canComment(dynamicSession.scopes)
+          canComment: hasPermissionAccess(
+            dynamicSession.permissionMatrix,
+            "comments",
+            "write"
+          )
         };
       }
     }
@@ -9793,12 +10152,8 @@ function createRoom(options, config) {
       for (const [id, crdt] of context.pool.nodes) {
         currentItems.set(id, crdt._serialize());
       }
-      const ops = getTreesDiffOperations(currentItems, nodes);
-      const result = applyRemoteOps(
-        ops,
-        /* fromSnapshot */
-        true
-      );
+      const ops = diffNodeMap(currentItems, nodes);
+      const result = applyRemoteOps(ops);
       notify(result.updates);
     } else {
       context.root = LiveObject._fromItems(
@@ -9806,11 +10161,12 @@ function createRoom(options, config) {
         context.pool
       );
     }
-    const canWrite = _nullishCoalesce(_optionalChain([self, 'access', _228 => _228.get, 'call', _229 => _229(), 'optionalAccess', _230 => _230.canWrite]), () => ( true));
+    const canWrite = _nullishCoalesce(_optionalChain([self, 'access', _230 => _230.get, 'call', _231 => _231(), 'optionalAccess', _232 => _232.canWrite]), () => ( true));
+    const serverTopLevelKeys = topLevelKeysOf(nodes);
     const root = context.root;
     disableHistory(() => {
       for (const key in context.initialStorage) {
-        if (root.get(key) === void 0) {
+        if (!serverTopLevelKeys.has(key)) {
           if (canWrite) {
             root.set(key, cloneLson(context.initialStorage[key]));
           } else {
@@ -9880,16 +10236,15 @@ function createRoom(options, config) {
     );
     return { opsToEmit: opsWithOpIds, reverse, updates };
   }
-  function applyRemoteOps(ops, fromSnapshot = false) {
+  function applyRemoteOps(ops) {
     return applyOps(
       [],
       ops,
       /* isLocal */
-      false,
-      fromSnapshot
+      false
     );
   }
-  function applyOps(pframes, ops, isLocal, fromSnapshot = false) {
+  function applyOps(pframes, ops, isLocal) {
     const output = {
       reverse: new Deque(),
       storageUpdates: /* @__PURE__ */ new Map(),
@@ -9925,7 +10280,7 @@ function createRoom(options, config) {
       } else {
         source = 1 /* THEIRS */;
       }
-      const applyOpResult = applyOp(op, source, fromSnapshot);
+      const applyOpResult = applyOp(op, source);
       if (applyOpResult.modified) {
         const nodeId = applyOpResult.modified.node._id;
         if (!(nodeId && createdNodeIds.has(nodeId))) {
@@ -9951,7 +10306,7 @@ function createRoom(options, config) {
       }
     };
   }
-  function applyOp(op, source, fromSnapshot = false) {
+  function applyOp(op, source) {
     if (isIgnoredOp(op)) {
       return { modified: false };
     }
@@ -9990,7 +10345,7 @@ function createRoom(options, config) {
         if (parentNode === void 0) {
           return { modified: false };
         }
-        return parentNode._attachChild(op, source, fromSnapshot);
+        return parentNode._attachChild(op, source);
       }
     }
   }
@@ -10012,7 +10367,7 @@ function createRoom(options, config) {
     }
     context.myPresence.patch(patch);
     if (context.activeBatch) {
-      if (_optionalChain([options2, 'optionalAccess', _231 => _231.addToHistory])) {
+      if (_optionalChain([options2, 'optionalAccess', _233 => _233.addToHistory])) {
         context.activeBatch.reverseOps.pushLeft({
           type: "presence",
           data: oldValues
@@ -10021,7 +10376,7 @@ function createRoom(options, config) {
       context.activeBatch.updates.presence = true;
     } else {
       flushNowOrSoon();
-      if (_optionalChain([options2, 'optionalAccess', _232 => _232.addToHistory])) {
+      if (_optionalChain([options2, 'optionalAccess', _234 => _234.addToHistory])) {
         addToUndoStack([{ type: "presence", data: oldValues }]);
       }
       notify({ presence: true });
@@ -10061,7 +10416,9 @@ function createRoom(options, config) {
     context.dynamicSessionInfoSig.set({
       actor: message.actor,
       nonce: message.nonce,
-      scopes: message.scopes,
+      permissionMatrix: permissionMatrixFromScopes(
+        normalizeRoomPermissions(message.scopes)
+      ),
       meta: message.meta
     });
     context.idFactory = makeIdFactory(message.actor);
@@ -10082,7 +10439,7 @@ function createRoom(options, config) {
         connectionId,
         user.id,
         user.info,
-        user.scopes
+        connectionAccessFromScopes(user.scopes)
       );
     }
     return { type: "reset" };
@@ -10102,7 +10459,7 @@ function createRoom(options, config) {
       message.actor,
       message.id,
       message.info,
-      message.scopes
+      connectionAccessFromScopes(message.scopes)
     );
     context.buffer.messages.push({
       type: ClientMsgCode.UPDATE_PRESENCE,
@@ -10198,11 +10555,11 @@ function createRoom(options, config) {
           break;
         }
         case ServerMsgCode.STORAGE_CHUNK:
-          _optionalChain([stopwatch, 'optionalAccess', _233 => _233.lap, 'call', _234 => _234()]);
+          _optionalChain([stopwatch, 'optionalAccess', _235 => _235.lap, 'call', _236 => _236()]);
           nodeMapBuffer.append(compactNodesToNodeStream(message.nodes));
           break;
         case ServerMsgCode.STORAGE_STREAM_END: {
-          const timing = _optionalChain([stopwatch, 'optionalAccess', _235 => _235.stop, 'call', _236 => _236()]);
+          const timing = _optionalChain([stopwatch, 'optionalAccess', _237 => _237.stop, 'call', _238 => _238()]);
           if (timing) {
             const ms = (v) => `${v.toFixed(1)}ms`;
             const rest = timing.laps.slice(1);
@@ -10337,11 +10694,11 @@ function createRoom(options, config) {
           } else if (pendingFeedsRequests.has(requestId)) {
             const pending = pendingFeedsRequests.get(requestId);
             pendingFeedsRequests.delete(requestId);
-            _optionalChain([pending, 'optionalAccess', _237 => _237.reject, 'call', _238 => _238(err)]);
+            _optionalChain([pending, 'optionalAccess', _239 => _239.reject, 'call', _240 => _240(err)]);
           } else if (pendingFeedMessagesRequests.has(requestId)) {
             const pending = pendingFeedMessagesRequests.get(requestId);
             pendingFeedMessagesRequests.delete(requestId);
-            _optionalChain([pending, 'optionalAccess', _239 => _239.reject, 'call', _240 => _240(err)]);
+            _optionalChain([pending, 'optionalAccess', _241 => _241.reject, 'call', _242 => _242(err)]);
           }
           eventHub.feeds.notify(message);
           break;
@@ -10495,10 +10852,10 @@ function createRoom(options, config) {
       timeoutId,
       kind,
       feedId,
-      messageId: _optionalChain([options2, 'optionalAccess', _241 => _241.messageId]),
-      expectedClientMessageId: _optionalChain([options2, 'optionalAccess', _242 => _242.expectedClientMessageId])
+      messageId: _optionalChain([options2, 'optionalAccess', _243 => _243.messageId]),
+      expectedClientMessageId: _optionalChain([options2, 'optionalAccess', _244 => _244.expectedClientMessageId])
     });
-    if (kind === "add-message" && _optionalChain([options2, 'optionalAccess', _243 => _243.expectedClientMessageId]) === void 0) {
+    if (kind === "add-message" && _optionalChain([options2, 'optionalAccess', _245 => _245.expectedClientMessageId]) === void 0) {
       const q = _nullishCoalesce(pendingAddMessageFifoByFeed.get(feedId), () => ( []));
       q.push(requestId);
       pendingAddMessageFifoByFeed.set(feedId, q);
@@ -10549,10 +10906,10 @@ function createRoom(options, config) {
           }
           if (!matched) {
             const q = pendingAddMessageFifoByFeed.get(message.feedId);
-            const headId = _optionalChain([q, 'optionalAccess', _244 => _244[0]]);
+            const headId = _optionalChain([q, 'optionalAccess', _246 => _246[0]]);
             if (headId !== void 0) {
               const pending = pendingFeedMutations.get(headId);
-              if (_optionalChain([pending, 'optionalAccess', _245 => _245.kind]) === "add-message" && pending.expectedClientMessageId === void 0) {
+              if (_optionalChain([pending, 'optionalAccess', _247 => _247.kind]) === "add-message" && pending.expectedClientMessageId === void 0) {
                 settleFeedMutation(headId, "ok");
               }
             }
@@ -10588,33 +10945,22 @@ function createRoom(options, config) {
     const unacknowledgedOps2 = [...context.unacknowledgedOps.values()];
     createOrUpdateRootFromMessage(nodes);
     applyAndSendOfflineOps(unacknowledgedOps2);
-    _optionalChain([_resolveStoragePromise, 'optionalCall', _246 => _246()]);
+    _optionalChain([_resolveStoragePromise, 'optionalCall', _248 => _248()]);
     notifyStorageStatus();
     eventHub.storageDidLoad.notify();
   }
-  async function streamStorage() {
-    if (!managedSocket.authValue) return;
-    const nodes = new Map(
-      await httpClient.streamStorage({ roomId })
-    );
-    processInitialStorage(nodes);
-  }
-  function refreshStorage(options2) {
+  function refreshStorage() {
     const messages = context.buffer.messages;
-    if (config.unstable_streamData) {
-      void streamStorage();
-    } else if (!messages.some((msg) => msg.type === ClientMsgCode.FETCH_STORAGE)) {
+    if (!messages.some((msg) => msg.type === ClientMsgCode.FETCH_STORAGE)) {
       messages.push({ type: ClientMsgCode.FETCH_STORAGE });
       nodeMapBuffer.take();
-      _optionalChain([stopwatch, 'optionalAccess', _247 => _247.start, 'call', _248 => _248()]);
-    }
-    if (options2.flush) {
-      flushNowOrSoon();
+      _optionalChain([stopwatch, 'optionalAccess', _249 => _249.start, 'call', _250 => _250()]);
     }
   }
   function startLoadingStorage() {
     if (_getStorage$ === null) {
-      refreshStorage({ flush: true });
+      refreshStorage();
+      flushNowOrSoon();
       _getStorage$ = new Promise((resolve) => {
         _resolveStoragePromise = resolve;
       });
@@ -10622,7 +10968,7 @@ function createRoom(options, config) {
     }
     return _getStorage$;
   }
-  function getStorageSnapshot() {
+  function getStorageOrNull() {
     const root = context.root;
     if (root !== void 0) {
       return root;
@@ -10662,10 +11008,10 @@ function createRoom(options, config) {
     const message = {
       type: ClientMsgCode.FETCH_FEEDS,
       requestId,
-      cursor: _optionalChain([options2, 'optionalAccess', _249 => _249.cursor]),
-      since: _optionalChain([options2, 'optionalAccess', _250 => _250.since]),
-      limit: _optionalChain([options2, 'optionalAccess', _251 => _251.limit]),
-      metadata: _optionalChain([options2, 'optionalAccess', _252 => _252.metadata])
+      cursor: _optionalChain([options2, 'optionalAccess', _251 => _251.cursor]),
+      since: _optionalChain([options2, 'optionalAccess', _252 => _252.since]),
+      limit: _optionalChain([options2, 'optionalAccess', _253 => _253.limit]),
+      metadata: _optionalChain([options2, 'optionalAccess', _254 => _254.metadata])
     };
     context.buffer.messages.push(message);
     flushNowOrSoon();
@@ -10685,9 +11031,9 @@ function createRoom(options, config) {
       type: ClientMsgCode.FETCH_FEED_MESSAGES,
       requestId,
       feedId,
-      cursor: _optionalChain([options2, 'optionalAccess', _253 => _253.cursor]),
-      since: _optionalChain([options2, 'optionalAccess', _254 => _254.since]),
-      limit: _optionalChain([options2, 'optionalAccess', _255 => _255.limit])
+      cursor: _optionalChain([options2, 'optionalAccess', _255 => _255.cursor]),
+      since: _optionalChain([options2, 'optionalAccess', _256 => _256.since]),
+      limit: _optionalChain([options2, 'optionalAccess', _257 => _257.limit])
     };
     context.buffer.messages.push(message);
     flushNowOrSoon();
@@ -10706,8 +11052,8 @@ function createRoom(options, config) {
       type: ClientMsgCode.ADD_FEED,
       requestId,
       feedId,
-      metadata: _optionalChain([options2, 'optionalAccess', _256 => _256.metadata]),
-      createdAt: _optionalChain([options2, 'optionalAccess', _257 => _257.createdAt])
+      metadata: _optionalChain([options2, 'optionalAccess', _258 => _258.metadata]),
+      createdAt: _optionalChain([options2, 'optionalAccess', _259 => _259.createdAt])
     };
     context.buffer.messages.push(message);
     flushNowOrSoon();
@@ -10741,15 +11087,15 @@ function createRoom(options, config) {
   function addFeedMessage(feedId, data, options2) {
     const requestId = nanoid();
     const promise = registerFeedMutation(requestId, "add-message", feedId, {
-      expectedClientMessageId: _optionalChain([options2, 'optionalAccess', _258 => _258.id])
+      expectedClientMessageId: _optionalChain([options2, 'optionalAccess', _260 => _260.id])
     });
     const message = {
       type: ClientMsgCode.ADD_FEED_MESSAGE,
       requestId,
       feedId,
       data,
-      id: _optionalChain([options2, 'optionalAccess', _259 => _259.id]),
-      createdAt: _optionalChain([options2, 'optionalAccess', _260 => _260.createdAt])
+      id: _optionalChain([options2, 'optionalAccess', _261 => _261.id]),
+      createdAt: _optionalChain([options2, 'optionalAccess', _262 => _262.createdAt])
     };
     context.buffer.messages.push(message);
     flushNowOrSoon();
@@ -10766,7 +11112,7 @@ function createRoom(options, config) {
       feedId,
       messageId,
       data,
-      updatedAt: _optionalChain([options2, 'optionalAccess', _261 => _261.updatedAt])
+      updatedAt: _optionalChain([options2, 'optionalAccess', _263 => _263.updatedAt])
     };
     context.buffer.messages.push(message);
     flushNowOrSoon();
@@ -10936,7 +11282,7 @@ function createRoom(options, config) {
     }
   }
   function isStorageReady() {
-    return getStorageSnapshot() !== null;
+    return getStorageOrNull() !== null;
   }
   async function waitUntilStorageReady() {
     while (!isStorageReady()) {
@@ -10973,8 +11319,8 @@ function createRoom(options, config) {
   async function getThreads(options2) {
     return httpClient.getThreads({
       roomId,
-      query: _optionalChain([options2, 'optionalAccess', _262 => _262.query]),
-      cursor: _optionalChain([options2, 'optionalAccess', _263 => _263.cursor])
+      query: _optionalChain([options2, 'optionalAccess', _264 => _264.query]),
+      cursor: _optionalChain([options2, 'optionalAccess', _265 => _265.cursor])
     });
   }
   async function getThread(threadId) {
@@ -11096,7 +11442,7 @@ function createRoom(options, config) {
   function getSubscriptionSettings(options2) {
     return httpClient.getSubscriptionSettings({
       roomId,
-      signal: _optionalChain([options2, 'optionalAccess', _264 => _264.signal])
+      signal: _optionalChain([options2, 'optionalAccess', _266 => _266.signal])
     });
   }
   function updateSubscriptionSettings(settings) {
@@ -11118,7 +11464,7 @@ function createRoom(options, config) {
     {
       [kInternal]: {
         get presenceBuffer() {
-          return deepClone(_nullishCoalesce(_optionalChain([context, 'access', _265 => _265.buffer, 'access', _266 => _266.presenceUpdates, 'optionalAccess', _267 => _267.data]), () => ( null)));
+          return deepClone(_nullishCoalesce(_optionalChain([context, 'access', _267 => _267.buffer, 'access', _268 => _268.presenceUpdates, 'optionalAccess', _269 => _269.data]), () => ( null)));
         },
         // prettier-ignore
         get undoStack() {
@@ -11133,9 +11479,9 @@ function createRoom(options, config) {
           return context.yjsProvider;
         },
         setYjsProvider(newProvider) {
-          _optionalChain([context, 'access', _268 => _268.yjsProvider, 'optionalAccess', _269 => _269.off, 'call', _270 => _270("status", yjsStatusDidChange)]);
+          _optionalChain([context, 'access', _270 => _270.yjsProvider, 'optionalAccess', _271 => _271.off, 'call', _272 => _272("status", yjsStatusDidChange)]);
           context.yjsProvider = newProvider;
-          _optionalChain([newProvider, 'optionalAccess', _271 => _271.on, 'call', _272 => _272("status", yjsStatusDidChange)]);
+          _optionalChain([newProvider, 'optionalAccess', _273 => _273.on, 'call', _274 => _274("status", yjsStatusDidChange)]);
           context.yjsProviderDidChange.notify();
         },
         yjsProviderDidChange: context.yjsProviderDidChange.observable,
@@ -11179,7 +11525,9 @@ function createRoom(options, config) {
       _dump: () => {
         const n = context.pool.nodes.size;
         return `Room "${roomId}" (${n} node${n === 1 ? "" : "s"}):
-${dumpPool(context.pool)}`;
+${dumpPool(
+          context.pool
+        )}`;
       },
       destroy: () => {
         pendingFeedsRequests.forEach(
@@ -11193,7 +11541,7 @@ ${dumpPool(context.pool)}`;
           source.dispose();
         }
         eventHub.roomWillDestroy.notify();
-        _optionalChain([context, 'access', _273 => _273.yjsProvider, 'optionalAccess', _274 => _274.off, 'call', _275 => _275("status", yjsStatusDidChange)]);
+        _optionalChain([context, 'access', _275 => _275.yjsProvider, 'optionalAccess', _276 => _276.off, 'call', _277 => _277("status", yjsStatusDidChange)]);
         syncSourceForStorage.destroy();
         syncSourceForYjs.destroy();
         uninstallBgTabSpy();
@@ -11226,7 +11574,9 @@ ${dumpPool(context.pool)}`;
       updateFeedMessage,
       deleteFeedMessage,
       getStorage,
-      getStorageSnapshot,
+      getStorageOrNull,
+      getStorageSnapshot: getStorageOrNull,
+      // Deprecated alias, will be removed in the future
       getStorageStatus,
       isPresenceReady,
       isStorageReady,
@@ -11353,7 +11703,7 @@ function makeClassicSubscribeFn(roomId, events, errorEvents) {
     }
     if (isLiveNode(first)) {
       const node = first;
-      if (_optionalChain([options, 'optionalAccess', _276 => _276.isDeep])) {
+      if (_optionalChain([options, 'optionalAccess', _278 => _278.isDeep])) {
         const storageCallback = second;
         return subscribeToLiveStructureDeeply(node, storageCallback);
       } else {
@@ -11372,7 +11722,11 @@ function isRoomEventName(value) {
 }
 function makeAuthDelegateForRoom(roomId, authManager) {
   return async () => {
-    return authManager.getAuthValue({ requestedScope: "room:read", roomId });
+    return authManager.getAuthValue({
+      roomId,
+      resource: "room",
+      access: "read"
+    });
   };
 }
 function makeCreateSocketDelegateForRoom(roomId, baseUrl, WebSocketPolyfill) {
@@ -11421,7 +11775,7 @@ function getBaseUrl(baseUrl) {
 function isLocalhost(url2) {
   try {
     return new URL(url2).hostname === "localhost";
-  } catch (e12) {
+  } catch (e11) {
     return false;
   }
 }
@@ -11439,12 +11793,11 @@ function createClient(options) {
   const authManager = createAuthManager(options, (token) => {
     currentUserId.set(() => token.uid);
   });
-  const fetchPolyfill = _optionalChain([clientOptions, 'access', _277 => _277.polyfills, 'optionalAccess', _278 => _278.fetch]) || /* istanbul ignore next */
-  _optionalChain([globalThis, 'access', _279 => _279.fetch, 'optionalAccess', _280 => _280.bind, 'call', _281 => _281(globalThis)]);
+  const fetchPolyfill = _optionalChain([clientOptions, 'access', _279 => _279.polyfills, 'optionalAccess', _280 => _280.fetch]) || /* istanbul ignore next */
+  _optionalChain([globalThis, 'access', _281 => _281.fetch, 'optionalAccess', _282 => _282.bind, 'call', _283 => _283(globalThis)]);
   const httpClient = createApiClient({
     baseUrl,
     fetchPolyfill,
-    currentUserId,
     authManager
   });
   const roomsById = /* @__PURE__ */ new Map();
@@ -11458,11 +11811,12 @@ function createClient(options) {
     delegates: {
       createSocket: makeCreateSocketDelegateForAi(
         baseUrl,
-        _optionalChain([clientOptions, 'access', _282 => _282.polyfills, 'optionalAccess', _283 => _283.WebSocket])
+        _optionalChain([clientOptions, 'access', _284 => _284.polyfills, 'optionalAccess', _285 => _285.WebSocket])
       ),
       authenticate: async () => {
         const resp = await authManager.getAuthValue({
-          requestedScope: "room:read"
+          resource: "personal",
+          access: "write"
         });
         if (resp.type === "public") {
           throw new StopRetrying(
@@ -11528,14 +11882,13 @@ function createClient(options) {
           createSocket: makeCreateSocketDelegateForRoom(
             roomId,
             baseUrl,
-            _optionalChain([clientOptions, 'access', _284 => _284.polyfills, 'optionalAccess', _285 => _285.WebSocket])
+            _optionalChain([clientOptions, 'access', _286 => _286.polyfills, 'optionalAccess', _287 => _287.WebSocket])
           ),
           authenticate: makeAuthDelegateForRoom(roomId, authManager)
         })),
         enableDebugLogging: clientOptions.enableDebugLogging,
         baseUrl,
         errorEventSource: liveblocksErrorSource,
-        unstable_streamData: !!clientOptions.unstable_streamData,
         roomHttpClient: httpClient,
         createSyncSource,
         badgeLocation: _nullishCoalesce(clientOptions.badgeLocation, () => ( "bottom-right"))
@@ -11551,7 +11904,7 @@ function createClient(options) {
     const shouldConnect = _nullishCoalesce(options2.autoConnect, () => ( true));
     if (shouldConnect) {
       if (typeof atob === "undefined") {
-        if (_optionalChain([clientOptions, 'access', _286 => _286.polyfills, 'optionalAccess', _287 => _287.atob]) === void 0) {
+        if (_optionalChain([clientOptions, 'access', _288 => _288.polyfills, 'optionalAccess', _289 => _289.atob]) === void 0) {
           throw new Error(
             "You need to polyfill atob to use the client in your environment. Please follow the instructions at https://liveblocks.io/docs/errors/liveblocks-client/atob-polyfill"
           );
@@ -11563,7 +11916,7 @@ function createClient(options) {
     return leaseRoom(newRoomDetails);
   }
   function getRoom(roomId) {
-    const room = _optionalChain([roomsById, 'access', _288 => _288.get, 'call', _289 => _289(roomId), 'optionalAccess', _290 => _290.room]);
+    const room = _optionalChain([roomsById, 'access', _290 => _290.get, 'call', _291 => _291(roomId), 'optionalAccess', _292 => _292.room]);
     return room ? room : null;
   }
   function logout() {
@@ -11579,7 +11932,7 @@ function createClient(options) {
   const batchedResolveUsers = new Batch(
     async (batchedUserIds) => {
       const userIds = batchedUserIds.flat();
-      const users = await _optionalChain([resolveUsers, 'optionalCall', _291 => _291({ userIds })]);
+      const users = await _optionalChain([resolveUsers, 'optionalCall', _293 => _293({ userIds })]);
       warnOnceIf(
         !resolveUsers,
         "Set the resolveUsers option in createClient to specify user info."
@@ -11596,7 +11949,7 @@ function createClient(options) {
   const batchedResolveRoomsInfo = new Batch(
     async (batchedRoomIds) => {
       const roomIds = batchedRoomIds.flat();
-      const roomsInfo = await _optionalChain([resolveRoomsInfo, 'optionalCall', _292 => _292({ roomIds })]);
+      const roomsInfo = await _optionalChain([resolveRoomsInfo, 'optionalCall', _294 => _294({ roomIds })]);
       warnOnceIf(
         !resolveRoomsInfo,
         "Set the resolveRoomsInfo option in createClient to specify room info."
@@ -11613,7 +11966,7 @@ function createClient(options) {
   const batchedResolveGroupsInfo = new Batch(
     async (batchedGroupIds) => {
       const groupIds = batchedGroupIds.flat();
-      const groupsInfo = await _optionalChain([resolveGroupsInfo, 'optionalCall', _293 => _293({ groupIds })]);
+      const groupsInfo = await _optionalChain([resolveGroupsInfo, 'optionalCall', _295 => _295({ groupIds })]);
       warnOnceIf(
         !resolveGroupsInfo,
         "Set the resolveGroupsInfo option in createClient to specify group info."
@@ -11672,7 +12025,7 @@ function createClient(options) {
       }
     };
     const win = typeof window !== "undefined" ? window : void 0;
-    _optionalChain([win, 'optionalAccess', _294 => _294.addEventListener, 'call', _295 => _295("beforeunload", maybePreventClose)]);
+    _optionalChain([win, 'optionalAccess', _296 => _296.addEventListener, 'call', _297 => _297("beforeunload", maybePreventClose)]);
   }
   async function getNotificationSettings(options2) {
     const plainSettings = await httpClient.getNotificationSettings(options2);
@@ -11800,7 +12153,7 @@ var commentBodyElementsTypes = {
   mention: "inline"
 };
 function traverseCommentBody(body, elementOrVisitor, possiblyVisitor) {
-  if (!body || !_optionalChain([body, 'optionalAccess', _296 => _296.content])) {
+  if (!body || !_optionalChain([body, 'optionalAccess', _298 => _298.content])) {
     return;
   }
   const element = typeof elementOrVisitor === "string" ? elementOrVisitor : void 0;
@@ -11810,13 +12163,13 @@ function traverseCommentBody(body, elementOrVisitor, possiblyVisitor) {
   for (const block of body.content) {
     if (type === "all" || type === "block") {
       if (guard(block)) {
-        _optionalChain([visitor, 'optionalCall', _297 => _297(block)]);
+        _optionalChain([visitor, 'optionalCall', _299 => _299(block)]);
       }
     }
     if (type === "all" || type === "inline") {
       for (const inline of block.children) {
         if (guard(inline)) {
-          _optionalChain([visitor, 'optionalCall', _298 => _298(inline)]);
+          _optionalChain([visitor, 'optionalCall', _300 => _300(inline)]);
         }
       }
     }
@@ -11986,7 +12339,7 @@ var stringifyCommentBodyPlainElements = {
   text: ({ element }) => element.text,
   link: ({ element }) => _nullishCoalesce(element.text, () => ( element.url)),
   mention: ({ element, user, group }) => {
-    return `@${_nullishCoalesce(_nullishCoalesce(_optionalChain([user, 'optionalAccess', _299 => _299.name]), () => ( _optionalChain([group, 'optionalAccess', _300 => _300.name]))), () => ( element.id))}`;
+    return `@${_nullishCoalesce(_nullishCoalesce(_optionalChain([user, 'optionalAccess', _301 => _301.name]), () => ( _optionalChain([group, 'optionalAccess', _302 => _302.name]))), () => ( element.id))}`;
   }
 };
 var stringifyCommentBodyHtmlElements = {
@@ -12016,7 +12369,7 @@ var stringifyCommentBodyHtmlElements = {
     return html`<a href="${href}" target="_blank" rel="noopener noreferrer">${element.text ? html`${element.text}` : element.url}</a>`;
   },
   mention: ({ element, user, group }) => {
-    return html`<span data-mention>@${_optionalChain([user, 'optionalAccess', _301 => _301.name]) ? html`${_optionalChain([user, 'optionalAccess', _302 => _302.name])}` : _optionalChain([group, 'optionalAccess', _303 => _303.name]) ? html`${_optionalChain([group, 'optionalAccess', _304 => _304.name])}` : element.id}</span>`;
+    return html`<span data-mention>@${_optionalChain([user, 'optionalAccess', _303 => _303.name]) ? html`${_optionalChain([user, 'optionalAccess', _304 => _304.name])}` : _optionalChain([group, 'optionalAccess', _305 => _305.name]) ? html`${_optionalChain([group, 'optionalAccess', _306 => _306.name])}` : element.id}</span>`;
   }
 };
 var stringifyCommentBodyMarkdownElements = {
@@ -12046,20 +12399,20 @@ var stringifyCommentBodyMarkdownElements = {
     return markdown`[${_nullishCoalesce(element.text, () => ( element.url))}](${href})`;
   },
   mention: ({ element, user, group }) => {
-    return markdown`@${_nullishCoalesce(_nullishCoalesce(_optionalChain([user, 'optionalAccess', _305 => _305.name]), () => ( _optionalChain([group, 'optionalAccess', _306 => _306.name]))), () => ( element.id))}`;
+    return markdown`@${_nullishCoalesce(_nullishCoalesce(_optionalChain([user, 'optionalAccess', _307 => _307.name]), () => ( _optionalChain([group, 'optionalAccess', _308 => _308.name]))), () => ( element.id))}`;
   }
 };
 async function stringifyCommentBody(body, options) {
-  const format = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _307 => _307.format]), () => ( "plain"));
-  const separator = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _308 => _308.separator]), () => ( (format === "markdown" ? "\n\n" : "\n")));
+  const format = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _309 => _309.format]), () => ( "plain"));
+  const separator = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _310 => _310.separator]), () => ( (format === "markdown" ? "\n\n" : "\n")));
   const elements = {
     ...format === "html" ? stringifyCommentBodyHtmlElements : format === "markdown" ? stringifyCommentBodyMarkdownElements : stringifyCommentBodyPlainElements,
-    ..._optionalChain([options, 'optionalAccess', _309 => _309.elements])
+    ..._optionalChain([options, 'optionalAccess', _311 => _311.elements])
   };
   const { users: resolvedUsers, groups: resolvedGroupsInfo } = await resolveMentionsInCommentBody(
     body,
-    _optionalChain([options, 'optionalAccess', _310 => _310.resolveUsers]),
-    _optionalChain([options, 'optionalAccess', _311 => _311.resolveGroupsInfo])
+    _optionalChain([options, 'optionalAccess', _312 => _312.resolveUsers]),
+    _optionalChain([options, 'optionalAccess', _313 => _313.resolveGroupsInfo])
   );
   const blocks = body.content.flatMap((block, blockIndex) => {
     switch (block.type) {
@@ -12194,9 +12547,9 @@ function makePoller(callback, intervalMs, options) {
   const startTime = performance.now();
   const doc = typeof document !== "undefined" ? document : void 0;
   const win = typeof window !== "undefined" ? window : void 0;
-  const maxStaleTimeMs = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _312 => _312.maxStaleTimeMs]), () => ( Number.POSITIVE_INFINITY));
+  const maxStaleTimeMs = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _314 => _314.maxStaleTimeMs]), () => ( Number.POSITIVE_INFINITY));
   const context = {
-    inForeground: _optionalChain([doc, 'optionalAccess', _313 => _313.visibilityState]) !== "hidden",
+    inForeground: _optionalChain([doc, 'optionalAccess', _315 => _315.visibilityState]) !== "hidden",
     lastSuccessfulPollAt: startTime,
     count: 0,
     backoff: 0
@@ -12277,11 +12630,11 @@ function makePoller(callback, intervalMs, options) {
     pollNowIfStale();
   }
   function onVisibilityChange() {
-    setInForeground(_optionalChain([doc, 'optionalAccess', _314 => _314.visibilityState]) !== "hidden");
+    setInForeground(_optionalChain([doc, 'optionalAccess', _316 => _316.visibilityState]) !== "hidden");
   }
-  _optionalChain([doc, 'optionalAccess', _315 => _315.addEventListener, 'call', _316 => _316("visibilitychange", onVisibilityChange)]);
-  _optionalChain([win, 'optionalAccess', _317 => _317.addEventListener, 'call', _318 => _318("online", onVisibilityChange)]);
-  _optionalChain([win, 'optionalAccess', _319 => _319.addEventListener, 'call', _320 => _320("focus", pollNowIfStale)]);
+  _optionalChain([doc, 'optionalAccess', _317 => _317.addEventListener, 'call', _318 => _318("visibilitychange", onVisibilityChange)]);
+  _optionalChain([win, 'optionalAccess', _319 => _319.addEventListener, 'call', _320 => _320("online", onVisibilityChange)]);
+  _optionalChain([win, 'optionalAccess', _321 => _321.addEventListener, 'call', _322 => _322("focus", pollNowIfStale)]);
   fsm.start();
   return {
     inc,
@@ -12418,5 +12771,13 @@ detectDupes(PKG_NAME, PKG_VERSION, PKG_FORMAT);
 
 
 
-exports.ClientMsgCode = ClientMsgCode; exports.CrdtType = CrdtType; exports.DefaultMap = DefaultMap; exports.Deque = Deque; exports.DerivedSignal = DerivedSignal; exports.FeedRequestErrorCode = FeedRequestErrorCode; exports.HttpError = HttpError; exports.LiveList = LiveList; exports.LiveMap = LiveMap; exports.LiveObject = LiveObject; exports.LiveblocksError = LiveblocksError; exports.MENTION_CHARACTER = MENTION_CHARACTER; exports.MutableSignal = MutableSignal; exports.OpCode = OpCode; exports.Permission = Permission; exports.Promise_withResolvers = Promise_withResolvers; exports.ServerMsgCode = ServerMsgCode; exports.Signal = Signal; exports.SortedList = SortedList; exports.TextEditorType = TextEditorType; exports.WebsocketCloseCodes = WebsocketCloseCodes; exports.asPos = asPos; exports.assert = assert; exports.assertNever = assertNever; exports.autoRetry = autoRetry; exports.b64decode = b64decode; exports.batch = batch; exports.checkBounds = checkBounds; exports.chunk = chunk; exports.cloneLson = cloneLson; exports.compactNodesToNodeStream = compactNodesToNodeStream; exports.compactObject = compactObject; exports.console = fancy_console_exports; exports.convertToCommentData = convertToCommentData; exports.convertToCommentUserReaction = convertToCommentUserReaction; exports.convertToGroupData = convertToGroupData; exports.convertToInboxNotificationData = convertToInboxNotificationData; exports.convertToSubscriptionData = convertToSubscriptionData; exports.convertToThreadData = convertToThreadData; exports.convertToUserSubscriptionData = convertToUserSubscriptionData; exports.createClient = createClient; exports.createCommentAttachmentId = createCommentAttachmentId; exports.createCommentId = createCommentId; exports.createInboxNotificationId = createInboxNotificationId; exports.createManagedPool = createManagedPool; exports.createNotificationSettings = createNotificationSettings; exports.createThreadId = createThreadId; exports.defineAiTool = defineAiTool; exports.deprecate = deprecate; exports.deprecateIf = deprecateIf; exports.detectDupes = detectDupes; exports.entries = entries; exports.errorIf = errorIf; exports.findLastIndex = findLastIndex; exports.freeze = freeze; exports.generateUrl = generateUrl; exports.getMentionsFromCommentBody = getMentionsFromCommentBody; exports.getSubscriptionKey = getSubscriptionKey; exports.html = html; exports.htmlSafe = htmlSafe; exports.isCommentBodyLink = isCommentBodyLink; exports.isCommentBodyMention = isCommentBodyMention; exports.isCommentBodyText = isCommentBodyText; exports.isJsonArray = isJsonArray; exports.isJsonObject = isJsonObject; exports.isJsonScalar = isJsonScalar; exports.isListStorageNode = isListStorageNode; exports.isLiveNode = isLiveNode; exports.isMapStorageNode = isMapStorageNode; exports.isNotificationChannelEnabled = isNotificationChannelEnabled; exports.isNumberOperator = isNumberOperator; exports.isObjectStorageNode = isObjectStorageNode; exports.isPlainObject = isPlainObject; exports.isRegisterStorageNode = isRegisterStorageNode; exports.isRootStorageNode = isRootStorageNode; exports.isStartsWithOperator = isStartsWithOperator; exports.isUrl = isUrl; exports.kInternal = kInternal; exports.keys = keys; exports.makeAbortController = makeAbortController; exports.makeEventSource = makeEventSource; exports.makePoller = makePoller; exports.makePosition = makePosition; exports.mapValues = mapValues; exports.memoizeOnSuccess = memoizeOnSuccess; exports.nanoid = nanoid; exports.nn = nn; exports.nodeStreamToCompactNodes = nodeStreamToCompactNodes; exports.objectToQuery = objectToQuery; exports.patchNotificationSettings = patchNotificationSettings; exports.raise = raise; exports.resolveMentionsInCommentBody = resolveMentionsInCommentBody; exports.sanitizeUrl = sanitizeUrl; exports.shallow = shallow; exports.shallow2 = shallow2; exports.stableStringify = stableStringify; exports.stringifyCommentBody = stringifyCommentBody; exports.throwUsageError = throwUsageError; exports.toPlainLson = toPlainLson; exports.tryParseJson = tryParseJson; exports.url = url; exports.urljoin = urljoin; exports.wait = wait; exports.warnOnce = warnOnce; exports.warnOnceIf = warnOnceIf; exports.withTimeout = withTimeout;
+
+
+
+
+
+
+
+
+exports.ClientMsgCode = ClientMsgCode; exports.CrdtType = CrdtType; exports.DefaultMap = DefaultMap; exports.Deque = Deque; exports.DerivedSignal = DerivedSignal; exports.FeedRequestErrorCode = FeedRequestErrorCode; exports.HttpError = HttpError; exports.LiveList = LiveList; exports.LiveMap = LiveMap; exports.LiveObject = LiveObject; exports.LiveblocksError = LiveblocksError; exports.MENTION_CHARACTER = MENTION_CHARACTER; exports.MutableSignal = MutableSignal; exports.OpCode = OpCode; exports.Permission = Permission; exports.Promise_withResolvers = Promise_withResolvers; exports.ServerMsgCode = ServerMsgCode; exports.Signal = Signal; exports.SortedList = SortedList; exports.TextEditorType = TextEditorType; exports.WebsocketCloseCodes = WebsocketCloseCodes; exports.asPos = asPos; exports.assert = assert; exports.assertNever = assertNever; exports.autoRetry = autoRetry; exports.b64decode = b64decode; exports.batch = batch; exports.checkBounds = checkBounds; exports.chunk = chunk; exports.cloneLson = cloneLson; exports.compactNodesToNodeStream = compactNodesToNodeStream; exports.compactObject = compactObject; exports.console = fancy_console_exports; exports.convertToCommentData = convertToCommentData; exports.convertToCommentUserReaction = convertToCommentUserReaction; exports.convertToGroupData = convertToGroupData; exports.convertToInboxNotificationData = convertToInboxNotificationData; exports.convertToSubscriptionData = convertToSubscriptionData; exports.convertToThreadData = convertToThreadData; exports.convertToUserSubscriptionData = convertToUserSubscriptionData; exports.createClient = createClient; exports.createCommentAttachmentId = createCommentAttachmentId; exports.createCommentId = createCommentId; exports.createInboxNotificationId = createInboxNotificationId; exports.createManagedPool = createManagedPool; exports.createNotificationSettings = createNotificationSettings; exports.createThreadId = createThreadId; exports.deepLiveify = deepLiveify; exports.defineAiTool = defineAiTool; exports.deprecate = deprecate; exports.deprecateIf = deprecateIf; exports.detectDupes = detectDupes; exports.entries = entries; exports.errorIf = errorIf; exports.findLastIndex = findLastIndex; exports.freeze = freeze; exports.generateUrl = generateUrl; exports.getMentionsFromCommentBody = getMentionsFromCommentBody; exports.getSubscriptionKey = getSubscriptionKey; exports.hasPermissionAccess = hasPermissionAccess; exports.html = html; exports.htmlSafe = htmlSafe; exports.isCommentBodyLink = isCommentBodyLink; exports.isCommentBodyMention = isCommentBodyMention; exports.isCommentBodyText = isCommentBodyText; exports.isJsonArray = isJsonArray; exports.isJsonObject = isJsonObject; exports.isJsonScalar = isJsonScalar; exports.isListStorageNode = isListStorageNode; exports.isLiveNode = isLiveNode; exports.isMapStorageNode = isMapStorageNode; exports.isNotificationChannelEnabled = isNotificationChannelEnabled; exports.isNumberOperator = isNumberOperator; exports.isObjectStorageNode = isObjectStorageNode; exports.isPlainObject = isPlainObject; exports.isRegisterStorageNode = isRegisterStorageNode; exports.isRootStorageNode = isRootStorageNode; exports.isStartsWithOperator = isStartsWithOperator; exports.isUrl = isUrl; exports.kInternal = kInternal; exports.keys = keys; exports.makeAbortController = makeAbortController; exports.makeEventSource = makeEventSource; exports.makePoller = makePoller; exports.makePosition = makePosition; exports.mapValues = mapValues; exports.memoizeOnSuccess = memoizeOnSuccess; exports.mergeRoomPermissionScopes = mergeRoomPermissionScopes; exports.nanoid = nanoid; exports.nn = nn; exports.nodeStreamToCompactNodes = nodeStreamToCompactNodes; exports.normalizeRoomAccesses = normalizeRoomAccesses; exports.normalizeRoomPermissions = normalizeRoomPermissions; exports.normalizeUpdateRoomAccesses = normalizeUpdateRoomAccesses; exports.objectToQuery = objectToQuery; exports.patchNotificationSettings = patchNotificationSettings; exports.permissionMatrixFromScopes = permissionMatrixFromScopes; exports.raise = raise; exports.resolveMentionsInCommentBody = resolveMentionsInCommentBody; exports.sanitizeUrl = sanitizeUrl; exports.shallow = shallow; exports.shallow2 = shallow2; exports.stableStringify = stableStringify; exports.stringifyCommentBody = stringifyCommentBody; exports.throwUsageError = throwUsageError; exports.toPlainLson = toPlainLson; exports.tryParseJson = tryParseJson; exports.url = url; exports.urljoin = urljoin; exports.validatePermissionsSet = validatePermissionsSet; exports.wait = wait; exports.warnOnce = warnOnce; exports.warnOnceIf = warnOnceIf; exports.withTimeout = withTimeout;
 //# sourceMappingURL=index.cjs.map