@liveblocks/core 3.21.0-private1 → 3.21.0-private2

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "3.21.0-private1";
+var PKG_VERSION = "3.21.0-private2";
 var PKG_FORMAT = "esm";
 
 // src/dupe-detection.ts
@@ -1718,7 +1718,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -1756,7 +1756,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/metadata`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       options.metadata
@@ -1767,7 +1767,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/metadata`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       options.metadata
@@ -1779,7 +1779,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       {
@@ -1796,7 +1796,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       {
@@ -1812,7 +1812,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -1822,7 +1822,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       { emoji: options.emoji }
@@ -1834,7 +1834,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions/${options.emoji}`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -1844,7 +1844,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-resolved`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -1854,7 +1854,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-unresolved`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -5207,9 +5207,6 @@ var Permission = {
   CommentsPrivateWrite: "comments:private:write",
   CommentsPrivateRead: "comments:private:read",
   CommentsPrivateNone: "comments:private:none",
-  CommentsPersonalWrite: "comments:personal:write",
-  CommentsPersonalRead: "comments:personal:read",
-  CommentsPersonalNone: "comments:personal:none",
   /**
    * Feeds
    */
@@ -5227,75 +5224,11 @@ var ACCESS_LEVEL_RANKS = {
   read: 1,
   write: 2
 };
-var BASE_PERMISSIONS_BY_ACCESS = {
-  read: [Permission.Read, Permission.RoomRead],
-  write: [Permission.Write, Permission.RoomWrite]
-};
-var NO_PERMISSION_MATRIX = {
-  room: "none",
-  storage: "none",
-  comments: "none",
-  "comments:public": "none",
-  "comments:private": "none",
-  "comments:personal": "none",
-  feeds: "none",
-  personal: "none"
-};
-var BASE_PERMISSION_RESOURCE = "room";
-var basePermissionScopes = /* @__PURE__ */ new Set([
-  Permission.Read,
-  Permission.Write,
-  Permission.RoomRead,
-  Permission.RoomWrite
-]);
-var ROOM_PERMISSION_RESOURCES = Object.freeze([
-  "storage",
-  "comments",
-  "comments:public",
-  "comments:private",
-  "comments:personal",
-  "feeds"
-]);
-var CHILD_ROOM_PERMISSION_RESOURCES = (() => {
-  const result = /* @__PURE__ */ new Map();
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    const childResourcePrefix = `${resource}:`;
-    result.set(
-      resource,
-      Object.freeze(
-        ROOM_PERMISSION_RESOURCES.filter((candidate) => {
-          if (!candidate.startsWith(childResourcePrefix)) {
-            return false;
-          }
-          return !candidate.slice(childResourcePrefix.length).includes(":");
-        })
-      )
-    );
-  }
-  return result;
-})();
-var LEAF_ROOM_PERMISSION_RESOURCES_BY_PARENT = (() => {
-  const result = /* @__PURE__ */ new Map();
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    result.set(resource, Object.freeze(getLeafResources(resource)));
-  }
-  return result;
-})();
-var PARENT_ROOM_PERMISSION_RESOURCES = (() => {
-  const result = /* @__PURE__ */ new Map();
-  for (const parentResource of ROOM_PERMISSION_RESOURCES) {
-    for (const childResource of childResourcesOf(parentResource)) {
-      result.set(childResource, parentResource);
-    }
-  }
-  return result;
-})();
-var LEAF_ROOM_PERMISSION_RESOURCES = Object.freeze(
-  ROOM_PERMISSION_RESOURCES.filter(
-    (resource) => childResourcesOf(resource).length === 0
-  )
-);
-var PERMISSIONS_BY_ROOM_RESOURCE = {
+var PERMISSIONS_BY_RESOURCE = {
+  room: {
+    read: [Permission.Read, Permission.RoomRead],
+    write: [Permission.Write, Permission.RoomWrite]
+  },
   storage: {
     write: [Permission.StorageWrite],
     read: [Permission.StorageRead],
@@ -5316,31 +5249,134 @@ var PERMISSIONS_BY_ROOM_RESOURCE = {
     read: [Permission.CommentsPrivateRead],
     none: [Permission.CommentsPrivateNone]
   },
-  "comments:personal": {
-    write: [Permission.CommentsPersonalWrite],
-    read: [Permission.CommentsPersonalRead],
-    none: [Permission.CommentsPersonalNone]
-  },
   feeds: {
     write: [Permission.FeedsWrite],
     read: [Permission.FeedsRead],
     none: [Permission.FeedsNone]
   }
 };
+var NO_PERMISSION_MATRIX = {
+  room: "none",
+  storage: "none",
+  comments: "none",
+  "comments:public": "none",
+  "comments:private": "none",
+  feeds: "none",
+  personal: "none"
+};
+var BASE_PERMISSION_RESOURCE = "room";
+var ROOM_PERMISSION_RESOURCES = [
+  "storage",
+  "comments",
+  "comments:public",
+  "comments:private",
+  "feeds"
+];
+var COMMENT_VISIBILITY_RESOURCES = [
+  "comments:public",
+  "comments:private"
+];
+var basePermissionScopes = /* @__PURE__ */ new Set([
+  Permission.Read,
+  Permission.Write,
+  Permission.RoomRead,
+  Permission.RoomWrite
+]);
 var VALID_PERMISSIONS = new Set(Object.values(Permission));
+function isPermission(permission) {
+  return VALID_PERMISSIONS.has(permission);
+}
+function resolveResourceAccess(scopes, resource) {
+  const permissions = PERMISSIONS_BY_RESOURCE[resource];
+  let resourceAccess;
+  for (const access of ACCESS_LEVELS) {
+    const scopedPermissions = permissions[access];
+    if (scopedPermissions !== void 0 && scopedPermissions.some((permission) => scopes.includes(permission))) {
+      resourceAccess = access;
+    }
+  }
+  return resourceAccess;
+}
+function explicitPermissionMatrixFromScopes(scopes) {
+  const matrix = {};
+  const baseAccess = resolveResourceAccess(scopes, BASE_PERMISSION_RESOURCE);
+  if (baseAccess !== void 0) {
+    matrix.room = baseAccess;
+  }
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    const access = resolveResourceAccess(scopes, resource);
+    if (access !== void 0) {
+      matrix[resource] = access;
+    }
+  }
+  return matrix;
+}
+function permissionMatrixFromExplicitPermissions(explicitMatrix) {
+  const baseAccess = explicitMatrix.room;
+  if (baseAccess === void 0) {
+    return { ...NO_PERMISSION_MATRIX };
+  }
+  const commentsAccess = explicitMatrix.comments ?? baseAccess;
+  return {
+    room: baseAccess,
+    storage: explicitMatrix.storage ?? baseAccess,
+    comments: commentsAccess,
+    "comments:public": explicitMatrix["comments:public"] ?? commentsAccess,
+    "comments:private": explicitMatrix["comments:private"] ?? commentsAccess,
+    feeds: explicitMatrix.feeds ?? baseAccess,
+    personal: "write"
+  };
+}
+function permissionMatrixFromScopes(scopes) {
+  return permissionMatrixFromExplicitPermissions(
+    explicitPermissionMatrixFromScopes(scopes)
+  );
+}
+function hasPermissionAccess(matrix, resource, requiredAccess) {
+  const access = matrix[resource] ?? "none";
+  return ACCESS_LEVEL_RANKS[access] >= ACCESS_LEVEL_RANKS[requiredAccess];
+}
+function resolveRoomPermissionMatrix(permissions, roomId) {
+  const matchedPermissions = permissions.filter(
+    (entry) => roomPatternMatches(entry.pattern, roomId)
+  );
+  if (matchedPermissions.length === 0) {
+    return void 0;
+  }
+  const matrix = {};
+  const specificityByResource = {};
+  for (const entry of matchedPermissions) {
+    const explicitMatrix = explicitPermissionMatrixFromScopes(entry.scopes);
+    const specificity = roomPatternSpecificity(entry.pattern);
+    if (explicitMatrix.room !== void 0) {
+      matrix.room = strongestAccess(matrix.room ?? "none", explicitMatrix.room);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = explicitAccessForResource(explicitMatrix, resource);
+      if (access === void 0) {
+        continue;
+      }
+      const currentSpecificity = specificityByResource[resource] ?? -1;
+      if (specificity > currentSpecificity) {
+        matrix[resource] = access;
+        specificityByResource[resource] = specificity;
+      } else if (specificity === currentSpecificity) {
+        matrix[resource] = strongestAccess(matrix[resource] ?? "none", access);
+      }
+    }
+  }
+  return permissionMatrixFromExplicitPermissions(matrix);
+}
 function normalizeRoomPermissions(permissions) {
   if (!Array.isArray(permissions)) {
     throw new Error("Permission list must be an array");
   }
   const result = [];
   for (const permission of permissions) {
-    const knownPermission = Object.values(Permission).find(
-      (value) => value === permission
-    );
-    if (knownPermission === void 0) {
+    if (!isPermission(permission)) {
       throw new Error(`Not a valid permission: ${permission}`);
     }
-    result.push(knownPermission);
+    result.push(permission);
   }
   return result;
 }
@@ -5366,90 +5402,28 @@ function normalizeUpdateRoomAccesses(accesses) {
     ])
   );
 }
-function validatePermissionsSet(scopes) {
-  const unknownScopes = scopes.filter((scope) => !VALID_PERMISSIONS.has(scope));
-  if (unknownScopes.length > 0) {
-    return `Unknown permission scope(s): ${unknownScopes.join(", ")}`;
-  }
-  const baseScopes = scopes.filter((scope) => basePermissionScopes.has(scope));
-  if (baseScopes.length !== 1) {
-    return `Permissions must include exactly one of ${Permission.Read}, ${Permission.Write} (or the legacy aliases ${Permission.RoomRead}, ${Permission.RoomWrite}), got ${baseScopes.length === 0 ? "none" : baseScopes.join(", ")}`;
-  }
-  const seenFeatures = /* @__PURE__ */ new Set();
-  for (const scope of scopes) {
-    if (basePermissionScopes.has(scope) || scope === Permission.LegacyRoomPresenceWrite) {
-      continue;
-    }
-    const feature = scope.split(":").slice(0, -1).join(":");
-    if (seenFeatures.has(feature)) {
-      return `Permissions can include at most one scope per feature, got multiple "${feature}" scopes`;
-    }
-    seenFeatures.add(feature);
-  }
-  return true;
-}
-function permissionMatrixFromScopes(scopes) {
-  return permissionMatrixFromResolvedScopes(resolvePermissionScopes(scopes));
-}
 function permissionMatrixToScopes(matrix) {
   const scopes = [];
   const baseAccess = matrix.room;
   if (baseAccess !== "none") {
     scopes.push(permissionForAccessLevel(BASE_PERMISSION_RESOURCE, baseAccess));
   }
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    if (parentResourceOf(resource) === void 0) {
-      pushResourcePermissions(scopes, matrix, resource, baseAccess);
-    }
+  if (matrix.storage !== baseAccess) {
+    scopes.push(permissionForAccessLevel("storage", matrix.storage));
   }
-  return scopes;
-}
-function hasPermissionAccess(matrix, resource, requiredAccess) {
-  const access = matrix[resource] ?? "none";
-  return ACCESS_LEVEL_RANKS[access] >= ACCESS_LEVEL_RANKS[requiredAccess];
-}
-function resolveRoomPermissionMatrix(permissions, roomId) {
-  const matchedPermissions = permissions.filter((entry) => {
-    if (entry.pattern.includes("*")) {
-      return roomId.startsWith(entry.pattern.replace("*", ""));
-    }
-    return entry.pattern === roomId;
-  });
-  if (matchedPermissions.length === 0) {
-    return void 0;
+  const commentsAccess = matrix.comments;
+  if (commentsAccess !== baseAccess) {
+    scopes.push(permissionForAccessLevel("comments", commentsAccess));
   }
-  let hasDefaultPermission = false;
-  let baseAccess = "none";
-  const leafAccesses = {};
-  const leafSpecificity = {};
-  for (const entry of matchedPermissions) {
-    const resolved = resolvePermissionScopes(entry.scopes);
-    const specificity = entry.pattern.replace("*", "").length;
-    if (resolved.baseAccess !== void 0) {
-      hasDefaultPermission = true;
-      baseAccess = strongestAccess(baseAccess, resolved.baseAccess);
-    }
-    for (const resource of LEAF_ROOM_PERMISSION_RESOURCES) {
-      if (resolved.leafAccesses[resource] === void 0) {
-        continue;
-      }
-      const access = resolveLeafAccessFromSource(resolved, resource);
-      const currentSpecificity = leafSpecificity[resource] ?? -1;
-      if (specificity > currentSpecificity) {
-        leafAccesses[resource] = access;
-        leafSpecificity[resource] = specificity;
-      } else if (specificity === currentSpecificity) {
-        leafAccesses[resource] = strongestAccess(
-          leafAccesses[resource] ?? "none",
-          access
-        );
-      }
+  for (const resource of COMMENT_VISIBILITY_RESOURCES) {
+    if (matrix[resource] !== commentsAccess) {
+      scopes.push(permissionForAccessLevel(resource, matrix[resource]));
     }
   }
-  return permissionMatrixFromResolvedScopes({
-    baseAccess: hasDefaultPermission ? baseAccess : void 0,
-    leafAccesses
-  });
+  if (matrix.feeds !== baseAccess) {
+    scopes.push(permissionForAccessLevel("feeds", matrix.feeds));
+  }
+  return scopes;
 }
 function mergeRoomPermissionScopes({
   defaultAccesses,
@@ -5457,139 +5431,48 @@ function mergeRoomPermissionScopes({
   userAccesses
 }) {
   const sources = [
-    resolvePermissionScopes(defaultAccesses),
-    mergeResolvedScopesByHighestAccess(
-      groupsAccesses.map(resolvePermissionScopes)
+    explicitPermissionMatrixFromScopes(defaultAccesses),
+    mergeExplicitPermissionMatricesByHighestAccess(
+      groupsAccesses.map(explicitPermissionMatrixFromScopes)
     ),
-    resolvePermissionScopes(userAccesses)
+    explicitPermissionMatrixFromScopes(userAccesses)
   ];
-  const merged = {
-    leafAccesses: {}
-  };
+  const merged = {};
   for (const source of sources) {
-    if (source.baseAccess !== void 0) {
-      merged.baseAccess = source.baseAccess;
+    if (source.room !== void 0) {
+      merged.room = source.room;
     }
-    for (const resource of LEAF_ROOM_PERMISSION_RESOURCES) {
-      const sourceAccess = source.leafAccesses[resource];
-      if (sourceAccess === void 0) {
-        continue;
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = explicitAccessForResource(source, resource);
+      if (access !== void 0) {
+        merged[resource] = access;
       }
-      merged.leafAccesses[resource] = sourceAccess;
     }
   }
-  return permissionMatrixToScopes(permissionMatrixFromResolvedScopes(merged));
-}
-function resolvePermissionScopes(scopes) {
-  const baseAccess = resolveAccess(scopes, BASE_PERMISSIONS_BY_ACCESS);
-  const leafAccesses = {};
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    const access = resolveResourceAccess(scopes, resource);
-    if (access !== void 0) {
-      for (const leafResource of leafResourcesOf(resource)) {
-        leafAccesses[leafResource] = access;
-      }
-    }
-  }
-  return { baseAccess, leafAccesses };
-}
-function resolveResourceAccess(scopes, resource) {
-  return resolveAccess(scopes, PERMISSIONS_BY_ROOM_RESOURCE[resource]);
-}
-function resolveAccess(scopes, permissions) {
-  let resourceAccess;
-  for (const access of ACCESS_LEVELS) {
-    const scopedPermissions = permissions[access];
-    if (scopedPermissions !== void 0 && scopedPermissions.some((permission) => scopes.includes(permission))) {
-      resourceAccess = access;
-    }
-  }
-  return resourceAccess;
-}
-function permissionMatrixFromResolvedScopes(resolved) {
-  if (resolved.baseAccess === void 0) {
-    return { ...NO_PERMISSION_MATRIX };
-  }
-  const matrix = {
-    ...NO_PERMISSION_MATRIX,
-    [BASE_PERMISSION_RESOURCE]: resolved.baseAccess,
-    personal: "write"
-  };
-  for (const resource of LEAF_ROOM_PERMISSION_RESOURCES) {
-    matrix[resource] = resolveLeafAccessFromSource(resolved, resource);
-  }
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    if (childResourcesOf(resource).length > 0) {
-      let strongest = "none";
-      for (const leafResource of leafResourcesOf(resource)) {
-        strongest = strongestAccess(strongest, matrix[leafResource]);
-      }
-      matrix[resource] = strongest;
-    }
-  }
-  return matrix;
-}
-function resolveLeafAccessFromSource(source, resource) {
-  const access = source.leafAccesses[resource];
-  if (access !== void 0) {
-    return access;
-  }
-  return source.baseAccess ?? "none";
-}
-function pushResourcePermissions(scopes, matrix, resource, baseAccess) {
-  const childResources = childResourcesOf(resource);
-  if (childResources.length === 0) {
-    const access = matrix[resource];
-    if (access !== baseAccess) {
-      scopes.push(permissionForAccessLevel(resource, access));
-    }
-    return;
-  }
-  const leafResources = leafResourcesOf(resource);
-  let sharedAccess;
-  let allLeavesShareAccess = true;
-  for (const leafResource of leafResources) {
-    const access = matrix[leafResource];
-    sharedAccess ??= access;
-    if (access !== sharedAccess) {
-      allLeavesShareAccess = false;
-      break;
-    }
-  }
-  if (sharedAccess !== void 0 && sharedAccess !== baseAccess && allLeavesShareAccess) {
-    scopes.push(permissionForAccessLevel(resource, sharedAccess));
-    return;
-  }
-  for (const childResource of childResources) {
-    pushResourcePermissions(scopes, matrix, childResource, baseAccess);
-  }
+  return permissionMatrixToScopes(
+    permissionMatrixFromExplicitPermissions(merged)
+  );
 }
-function mergeResolvedScopesByHighestAccess(sources) {
-  const merged = {
-    leafAccesses: {}
-  };
+function mergeExplicitPermissionMatricesByHighestAccess(sources) {
+  const merged = {};
   for (const source of sources) {
-    if (source.baseAccess !== void 0) {
-      merged.baseAccess = strongestAccess(
-        merged.baseAccess ?? "none",
-        source.baseAccess
-      );
+    if (source.room !== void 0) {
+      merged.room = strongestAccess(merged.room ?? "none", source.room);
     }
-    for (const resource of LEAF_ROOM_PERMISSION_RESOURCES) {
-      const sourceAccess = source.leafAccesses[resource];
-      if (sourceAccess === void 0) {
-        continue;
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = explicitAccessForResource(source, resource);
+      if (access !== void 0) {
+        merged[resource] = strongestAccess(merged[resource] ?? "none", access);
       }
-      merged.leafAccesses[resource] = strongestAccess(
-        merged.leafAccesses[resource] ?? "none",
-        sourceAccess
-      );
     }
   }
   return merged;
 }
+function explicitAccessForResource(source, resource) {
+  return source[resource] ?? (isCommentVisibilityResource(resource) ? source.comments : void 0);
+}
 function permissionForAccessLevel(resource, access, field = resource) {
-  const permissions = resource === "room" ? BASE_PERMISSIONS_BY_ACCESS[access] : resource === "personal" ? void 0 : PERMISSIONS_BY_ROOM_RESOURCE[resource][access];
+  const permissions = PERMISSIONS_BY_RESOURCE[resource][access];
   const permission = permissions?.[0];
   if (permission !== void 0) {
     return permission;
@@ -5601,21 +5484,43 @@ function permissionForAccessLevel(resource, access, field = resource) {
 function strongestAccess(left, right) {
   return ACCESS_LEVEL_RANKS[right] > ACCESS_LEVEL_RANKS[left] ? right : left;
 }
-function leafResourcesOf(resource) {
-  return LEAF_ROOM_PERMISSION_RESOURCES_BY_PARENT.get(resource) ?? [];
-}
-function childResourcesOf(resource) {
-  return CHILD_ROOM_PERMISSION_RESOURCES.get(resource) ?? [];
+function roomPatternMatches(pattern, roomId) {
+  if (pattern.includes("*")) {
+    return roomId.startsWith(pattern.replace("*", ""));
+  }
+  return pattern === roomId;
 }
-function parentResourceOf(resource) {
-  return PARENT_ROOM_PERMISSION_RESOURCES.get(resource);
+function roomPatternSpecificity(pattern) {
+  return pattern.replace("*", "").length;
 }
-function getLeafResources(resource) {
-  const childResources = childResourcesOf(resource);
-  if (childResources.length === 0) {
-    return [resource];
+function validatePermissionsSet(scopes) {
+  const unknownScopes = scopes.filter((scope) => !VALID_PERMISSIONS.has(scope));
+  if (unknownScopes.length > 0) {
+    return `Unknown permission scope(s): ${unknownScopes.join(", ")}`;
+  }
+  const baseScopes = scopes.filter((scope) => basePermissionScopes.has(scope));
+  if (baseScopes.length !== 1) {
+    return `Permissions must include exactly one of ${Permission.Read}, ${Permission.Write} (or the legacy aliases ${Permission.RoomRead}, ${Permission.RoomWrite}), got ${baseScopes.length === 0 ? "none" : baseScopes.join(", ")}`;
+  }
+  const seenFeatures = /* @__PURE__ */ new Set();
+  for (const scope of scopes) {
+    if (basePermissionScopes.has(scope) || scope === Permission.LegacyRoomPresenceWrite) {
+      continue;
+    }
+    const feature = permissionFeature(scope);
+    if (seenFeatures.has(feature)) {
+      return `Permissions can include at most one scope per feature, got multiple "${feature}" scopes`;
+    }
+    seenFeatures.add(feature);
   }
-  return childResources.flatMap(getLeafResources);
+  return true;
+}
+function permissionFeature(scope) {
+  const accessSeparatorIndex = scope.lastIndexOf(":");
+  return accessSeparatorIndex === -1 ? scope : scope.slice(0, accessSeparatorIndex);
+}
+function isCommentVisibilityResource(resource) {
+  return resource.startsWith("comments:");
 }
 
 // src/protocol/AuthToken.ts
@@ -5804,7 +5709,13 @@ function cachedTokenSatisfiesRequest(cachedToken, request) {
     cachedToken.permissions ?? [],
     request.roomId
   );
-  return matrix !== void 0 && hasPermissionAccess(matrix, request.resource, request.access);
+  if (matrix === void 0) {
+    return false;
+  }
+  if (request.resource === "comments" && request.access === "read") {
+    return hasPermissionAccess(matrix, "comments", "read") || hasPermissionAccess(matrix, "comments:public", "read") || hasPermissionAccess(matrix, "comments:private", "read");
+  }
+  return hasPermissionAccess(matrix, request.resource, request.access);
 }
 function prepareAuthentication(authOptions) {
   const { publicApiKey, authEndpoint } = authOptions;
@@ -8662,7 +8573,7 @@ var LiveObject = class _LiveObject extends AbstractCrdt {
         const preciseSize = new TextEncoder().encode(jsonString).length;
         if (preciseSize > MAX_LIVE_OBJECT_SIZE) {
           throw new Error(
-            `LiveObject size exceeded limit: ${preciseSize} bytes > ${MAX_LIVE_OBJECT_SIZE} bytes. See https://liveblocks.io/docs/platform/limits#Liveblocks-Storage-limits`
+            `LiveObject size exceeded limit: ${preciseSize} bytes > ${MAX_LIVE_OBJECT_SIZE} bytes. See https://liveblocks.io/docs/pricing/limits#Other-limits`
           );
         }
       }
@@ -11605,6 +11516,7 @@ function createRoom(options, config) {
         yjsProviderDidChange: context.yjsProviderDidChange.observable,
         // send metadata when using a text editor
         reportTextEditor,
+        getPermissionMatrix: () => context.dynamicSessionInfoSig.get()?.permissionMatrix,
         // create a text mention when using a text editor
         createTextMention,
         // delete a text mention when using a text editor