@liveblocks/core 3.21.0-private1 → 3.21.0-private3

package/dist/index.cjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/version.ts
 var PKG_NAME = "@liveblocks/core";
-var PKG_VERSION = "3.21.0-private1";
+var PKG_VERSION = "3.21.0-private3";
 var PKG_FORMAT = "cjs";
 
 // src/dupe-detection.ts
@@ -1718,7 +1718,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -1756,7 +1756,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/metadata`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       options.metadata
@@ -1767,7 +1767,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/metadata`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       options.metadata
@@ -1779,7 +1779,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       {
@@ -1796,7 +1796,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       {
@@ -1812,7 +1812,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -1822,7 +1822,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       }),
       { emoji: options.emoji }
@@ -1834,7 +1834,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/comments/${options.commentId}/reactions/${options.emoji}`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -1844,7 +1844,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-resolved`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -1854,7 +1854,7 @@ function createApiClient({
       url`/v2/c/rooms/${options.roomId}/threads/${options.threadId}/mark-as-unresolved`,
       await authManager.getAuthValue({
         roomId: options.roomId,
-        resource: "comments",
+        resource: commentsResourceForVisibility(options.visibility),
         access: "write"
       })
     );
@@ -5207,9 +5207,6 @@ var Permission = {
   CommentsPrivateWrite: "comments:private:write",
   CommentsPrivateRead: "comments:private:read",
   CommentsPrivateNone: "comments:private:none",
-  CommentsPersonalWrite: "comments:personal:write",
-  CommentsPersonalRead: "comments:personal:read",
-  CommentsPersonalNone: "comments:personal:none",
   /**
    * Feeds
    */
@@ -5227,75 +5224,11 @@ var ACCESS_LEVEL_RANKS = {
   read: 1,
   write: 2
 };
-var BASE_PERMISSIONS_BY_ACCESS = {
-  read: [Permission.Read, Permission.RoomRead],
-  write: [Permission.Write, Permission.RoomWrite]
-};
-var NO_PERMISSION_MATRIX = {
-  room: "none",
-  storage: "none",
-  comments: "none",
-  "comments:public": "none",
-  "comments:private": "none",
-  "comments:personal": "none",
-  feeds: "none",
-  personal: "none"
-};
-var BASE_PERMISSION_RESOURCE = "room";
-var basePermissionScopes = /* @__PURE__ */ new Set([
-  Permission.Read,
-  Permission.Write,
-  Permission.RoomRead,
-  Permission.RoomWrite
-]);
-var ROOM_PERMISSION_RESOURCES = Object.freeze([
-  "storage",
-  "comments",
-  "comments:public",
-  "comments:private",
-  "comments:personal",
-  "feeds"
-]);
-var CHILD_ROOM_PERMISSION_RESOURCES = (() => {
-  const result = /* @__PURE__ */ new Map();
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    const childResourcePrefix = `${resource}:`;
-    result.set(
-      resource,
-      Object.freeze(
-        ROOM_PERMISSION_RESOURCES.filter((candidate) => {
-          if (!candidate.startsWith(childResourcePrefix)) {
-            return false;
-          }
-          return !candidate.slice(childResourcePrefix.length).includes(":");
-        })
-      )
-    );
-  }
-  return result;
-})();
-var LEAF_ROOM_PERMISSION_RESOURCES_BY_PARENT = (() => {
-  const result = /* @__PURE__ */ new Map();
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    result.set(resource, Object.freeze(getLeafResources(resource)));
-  }
-  return result;
-})();
-var PARENT_ROOM_PERMISSION_RESOURCES = (() => {
-  const result = /* @__PURE__ */ new Map();
-  for (const parentResource of ROOM_PERMISSION_RESOURCES) {
-    for (const childResource of childResourcesOf(parentResource)) {
-      result.set(childResource, parentResource);
-    }
-  }
-  return result;
-})();
-var LEAF_ROOM_PERMISSION_RESOURCES = Object.freeze(
-  ROOM_PERMISSION_RESOURCES.filter(
-    (resource) => childResourcesOf(resource).length === 0
-  )
-);
-var PERMISSIONS_BY_ROOM_RESOURCE = {
+var PERMISSIONS_BY_RESOURCE = {
+  room: {
+    read: [Permission.Read, Permission.RoomRead],
+    write: [Permission.Write, Permission.RoomWrite]
+  },
   storage: {
     write: [Permission.StorageWrite],
     read: [Permission.StorageRead],
@@ -5316,31 +5249,143 @@ var PERMISSIONS_BY_ROOM_RESOURCE = {
     read: [Permission.CommentsPrivateRead],
     none: [Permission.CommentsPrivateNone]
   },
-  "comments:personal": {
-    write: [Permission.CommentsPersonalWrite],
-    read: [Permission.CommentsPersonalRead],
-    none: [Permission.CommentsPersonalNone]
-  },
   feeds: {
     write: [Permission.FeedsWrite],
     read: [Permission.FeedsRead],
     none: [Permission.FeedsNone]
   }
 };
+var NO_PERMISSION_MATRIX = {
+  room: "none",
+  storage: "none",
+  comments: "none",
+  "comments:public": "none",
+  "comments:private": "none",
+  feeds: "none",
+  personal: "none"
+};
+var BASE_PERMISSION_RESOURCE = "room";
+var ROOM_PERMISSION_RESOURCES = [
+  "storage",
+  "comments",
+  "comments:public",
+  "comments:private",
+  "feeds"
+];
+var COMMENT_VISIBILITY_RESOURCES = [
+  "comments:public",
+  "comments:private"
+];
+var basePermissionScopes = /* @__PURE__ */ new Set([
+  Permission.Read,
+  Permission.Write,
+  Permission.RoomRead,
+  Permission.RoomWrite
+]);
 var VALID_PERMISSIONS = new Set(Object.values(Permission));
+function isPermission(permission) {
+  return VALID_PERMISSIONS.has(permission);
+}
+function resolveResourceAccess(scopes, resource) {
+  const permissions = PERMISSIONS_BY_RESOURCE[resource];
+  let resourceAccess;
+  for (const access of ACCESS_LEVELS) {
+    const scopedPermissions = permissions[access];
+    if (scopedPermissions !== void 0 && scopedPermissions.some((permission) => scopes.includes(permission))) {
+      resourceAccess = access;
+    }
+  }
+  return resourceAccess;
+}
+function explicitPermissionMatrixFromScopes(scopes) {
+  const matrix = {};
+  const baseAccess = resolveResourceAccess(scopes, BASE_PERMISSION_RESOURCE);
+  if (baseAccess !== void 0) {
+    matrix.room = baseAccess;
+  }
+  for (const resource of ROOM_PERMISSION_RESOURCES) {
+    const access = resolveResourceAccess(scopes, resource);
+    if (access !== void 0) {
+      matrix[resource] = access;
+    }
+  }
+  return matrix;
+}
+function permissionMatrixFromExplicitPermissions(explicitMatrix) {
+  const baseAccess = explicitMatrix.room;
+  if (baseAccess === void 0) {
+    return { ...NO_PERMISSION_MATRIX };
+  }
+  const commentsAccess = _nullishCoalesce(explicitMatrix.comments, () => ( baseAccess));
+  return {
+    room: baseAccess,
+    storage: _nullishCoalesce(explicitMatrix.storage, () => ( baseAccess)),
+    comments: commentsAccess,
+    "comments:public": _nullishCoalesce(explicitMatrix["comments:public"], () => ( commentsAccess)),
+    "comments:private": _nullishCoalesce(explicitMatrix["comments:private"], () => ( commentsAccess)),
+    feeds: _nullishCoalesce(explicitMatrix.feeds, () => ( baseAccess)),
+    personal: "write"
+  };
+}
+function permissionMatrixFromScopes(scopes) {
+  return permissionMatrixFromExplicitPermissions(
+    explicitPermissionMatrixFromScopes(scopes)
+  );
+}
+function hasPermissionAccess(matrix, resource, requiredAccess) {
+  const requiredRank = ACCESS_LEVEL_RANKS[requiredAccess];
+  if (resource === "comments") {
+    const commentsRank = Math.max(
+      ACCESS_LEVEL_RANKS[_nullishCoalesce(matrix.comments, () => ( "none"))],
+      ACCESS_LEVEL_RANKS[_nullishCoalesce(matrix["comments:public"], () => ( "none"))],
+      ACCESS_LEVEL_RANKS[_nullishCoalesce(matrix["comments:private"], () => ( "none"))]
+    );
+    return commentsRank >= requiredRank;
+  }
+  const access = _nullishCoalesce(matrix[resource], () => ( "none"));
+  return ACCESS_LEVEL_RANKS[access] >= requiredRank;
+}
+function resolveRoomPermissionMatrix(permissions, roomId) {
+  const matchedPermissions = permissions.filter(
+    (entry) => roomPatternMatches(entry.pattern, roomId)
+  );
+  if (matchedPermissions.length === 0) {
+    return void 0;
+  }
+  const matrix = {};
+  const specificityByResource = {};
+  for (const entry of matchedPermissions) {
+    const explicitMatrix = explicitPermissionMatrixFromScopes(entry.scopes);
+    const specificity = roomPatternSpecificity(entry.pattern);
+    if (explicitMatrix.room !== void 0) {
+      matrix.room = strongestAccess(_nullishCoalesce(matrix.room, () => ( "none")), explicitMatrix.room);
+    }
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = explicitAccessForResource(explicitMatrix, resource);
+      if (access === void 0) {
+        continue;
+      }
+      const currentSpecificity = _nullishCoalesce(specificityByResource[resource], () => ( -1));
+      if (specificity > currentSpecificity) {
+        matrix[resource] = access;
+        specificityByResource[resource] = specificity;
+      } else if (specificity === currentSpecificity) {
+        matrix[resource] = strongestAccess(_nullishCoalesce(matrix[resource], () => ( "none")), access);
+      }
+    }
+  }
+  return permissionMatrixFromExplicitPermissions(matrix);
+}
 function normalizeRoomPermissions(permissions) {
   if (!Array.isArray(permissions)) {
     throw new Error("Permission list must be an array");
   }
   const result = [];
   for (const permission of permissions) {
-    const knownPermission = Object.values(Permission).find(
-      (value) => value === permission
-    );
-    if (knownPermission === void 0) {
+    if (!isPermission(permission)) {
       throw new Error(`Not a valid permission: ${permission}`);
     }
-    result.push(knownPermission);
+    result.push(permission);
   }
   return result;
 }
@@ -5366,90 +5411,28 @@ function normalizeUpdateRoomAccesses(accesses) {
     ])
   );
 }
-function validatePermissionsSet(scopes) {
-  const unknownScopes = scopes.filter((scope) => !VALID_PERMISSIONS.has(scope));
-  if (unknownScopes.length > 0) {
-    return `Unknown permission scope(s): ${unknownScopes.join(", ")}`;
-  }
-  const baseScopes = scopes.filter((scope) => basePermissionScopes.has(scope));
-  if (baseScopes.length !== 1) {
-    return `Permissions must include exactly one of ${Permission.Read}, ${Permission.Write} (or the legacy aliases ${Permission.RoomRead}, ${Permission.RoomWrite}), got ${baseScopes.length === 0 ? "none" : baseScopes.join(", ")}`;
-  }
-  const seenFeatures = /* @__PURE__ */ new Set();
-  for (const scope of scopes) {
-    if (basePermissionScopes.has(scope) || scope === Permission.LegacyRoomPresenceWrite) {
-      continue;
-    }
-    const feature = scope.split(":").slice(0, -1).join(":");
-    if (seenFeatures.has(feature)) {
-      return `Permissions can include at most one scope per feature, got multiple "${feature}" scopes`;
-    }
-    seenFeatures.add(feature);
-  }
-  return true;
-}
-function permissionMatrixFromScopes(scopes) {
-  return permissionMatrixFromResolvedScopes(resolvePermissionScopes(scopes));
-}
 function permissionMatrixToScopes(matrix) {
   const scopes = [];
   const baseAccess = matrix.room;
   if (baseAccess !== "none") {
     scopes.push(permissionForAccessLevel(BASE_PERMISSION_RESOURCE, baseAccess));
   }
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    if (parentResourceOf(resource) === void 0) {
-      pushResourcePermissions(scopes, matrix, resource, baseAccess);
-    }
+  if (matrix.storage !== baseAccess) {
+    scopes.push(permissionForAccessLevel("storage", matrix.storage));
   }
-  return scopes;
-}
-function hasPermissionAccess(matrix, resource, requiredAccess) {
-  const access = _nullishCoalesce(matrix[resource], () => ( "none"));
-  return ACCESS_LEVEL_RANKS[access] >= ACCESS_LEVEL_RANKS[requiredAccess];
-}
-function resolveRoomPermissionMatrix(permissions, roomId) {
-  const matchedPermissions = permissions.filter((entry) => {
-    if (entry.pattern.includes("*")) {
-      return roomId.startsWith(entry.pattern.replace("*", ""));
-    }
-    return entry.pattern === roomId;
-  });
-  if (matchedPermissions.length === 0) {
-    return void 0;
+  const commentsAccess = matrix.comments;
+  if (commentsAccess !== baseAccess) {
+    scopes.push(permissionForAccessLevel("comments", commentsAccess));
   }
-  let hasDefaultPermission = false;
-  let baseAccess = "none";
-  const leafAccesses = {};
-  const leafSpecificity = {};
-  for (const entry of matchedPermissions) {
-    const resolved = resolvePermissionScopes(entry.scopes);
-    const specificity = entry.pattern.replace("*", "").length;
-    if (resolved.baseAccess !== void 0) {
-      hasDefaultPermission = true;
-      baseAccess = strongestAccess(baseAccess, resolved.baseAccess);
-    }
-    for (const resource of LEAF_ROOM_PERMISSION_RESOURCES) {
-      if (resolved.leafAccesses[resource] === void 0) {
-        continue;
-      }
-      const access = resolveLeafAccessFromSource(resolved, resource);
-      const currentSpecificity = _nullishCoalesce(leafSpecificity[resource], () => ( -1));
-      if (specificity > currentSpecificity) {
-        leafAccesses[resource] = access;
-        leafSpecificity[resource] = specificity;
-      } else if (specificity === currentSpecificity) {
-        leafAccesses[resource] = strongestAccess(
-          _nullishCoalesce(leafAccesses[resource], () => ( "none")),
-          access
-        );
-      }
+  for (const resource of COMMENT_VISIBILITY_RESOURCES) {
+    if (matrix[resource] !== commentsAccess) {
+      scopes.push(permissionForAccessLevel(resource, matrix[resource]));
     }
   }
-  return permissionMatrixFromResolvedScopes({
-    baseAccess: hasDefaultPermission ? baseAccess : void 0,
-    leafAccesses
-  });
+  if (matrix.feeds !== baseAccess) {
+    scopes.push(permissionForAccessLevel("feeds", matrix.feeds));
+  }
+  return scopes;
 }
 function mergeRoomPermissionScopes({
   defaultAccesses,
@@ -5457,139 +5440,48 @@ function mergeRoomPermissionScopes({
   userAccesses
 }) {
   const sources = [
-    resolvePermissionScopes(defaultAccesses),
-    mergeResolvedScopesByHighestAccess(
-      groupsAccesses.map(resolvePermissionScopes)
+    explicitPermissionMatrixFromScopes(defaultAccesses),
+    mergeExplicitPermissionMatricesByHighestAccess(
+      groupsAccesses.map(explicitPermissionMatrixFromScopes)
     ),
-    resolvePermissionScopes(userAccesses)
+    explicitPermissionMatrixFromScopes(userAccesses)
   ];
-  const merged = {
-    leafAccesses: {}
-  };
+  const merged = {};
   for (const source of sources) {
-    if (source.baseAccess !== void 0) {
-      merged.baseAccess = source.baseAccess;
+    if (source.room !== void 0) {
+      merged.room = source.room;
     }
-    for (const resource of LEAF_ROOM_PERMISSION_RESOURCES) {
-      const sourceAccess = source.leafAccesses[resource];
-      if (sourceAccess === void 0) {
-        continue;
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = explicitAccessForResource(source, resource);
+      if (access !== void 0) {
+        merged[resource] = access;
       }
-      merged.leafAccesses[resource] = sourceAccess;
     }
   }
-  return permissionMatrixToScopes(permissionMatrixFromResolvedScopes(merged));
-}
-function resolvePermissionScopes(scopes) {
-  const baseAccess = resolveAccess(scopes, BASE_PERMISSIONS_BY_ACCESS);
-  const leafAccesses = {};
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    const access = resolveResourceAccess(scopes, resource);
-    if (access !== void 0) {
-      for (const leafResource of leafResourcesOf(resource)) {
-        leafAccesses[leafResource] = access;
-      }
-    }
-  }
-  return { baseAccess, leafAccesses };
-}
-function resolveResourceAccess(scopes, resource) {
-  return resolveAccess(scopes, PERMISSIONS_BY_ROOM_RESOURCE[resource]);
-}
-function resolveAccess(scopes, permissions) {
-  let resourceAccess;
-  for (const access of ACCESS_LEVELS) {
-    const scopedPermissions = permissions[access];
-    if (scopedPermissions !== void 0 && scopedPermissions.some((permission) => scopes.includes(permission))) {
-      resourceAccess = access;
-    }
-  }
-  return resourceAccess;
-}
-function permissionMatrixFromResolvedScopes(resolved) {
-  if (resolved.baseAccess === void 0) {
-    return { ...NO_PERMISSION_MATRIX };
-  }
-  const matrix = {
-    ...NO_PERMISSION_MATRIX,
-    [BASE_PERMISSION_RESOURCE]: resolved.baseAccess,
-    personal: "write"
-  };
-  for (const resource of LEAF_ROOM_PERMISSION_RESOURCES) {
-    matrix[resource] = resolveLeafAccessFromSource(resolved, resource);
-  }
-  for (const resource of ROOM_PERMISSION_RESOURCES) {
-    if (childResourcesOf(resource).length > 0) {
-      let strongest = "none";
-      for (const leafResource of leafResourcesOf(resource)) {
-        strongest = strongestAccess(strongest, matrix[leafResource]);
-      }
-      matrix[resource] = strongest;
-    }
-  }
-  return matrix;
-}
-function resolveLeafAccessFromSource(source, resource) {
-  const access = source.leafAccesses[resource];
-  if (access !== void 0) {
-    return access;
-  }
-  return _nullishCoalesce(source.baseAccess, () => ( "none"));
-}
-function pushResourcePermissions(scopes, matrix, resource, baseAccess) {
-  const childResources = childResourcesOf(resource);
-  if (childResources.length === 0) {
-    const access = matrix[resource];
-    if (access !== baseAccess) {
-      scopes.push(permissionForAccessLevel(resource, access));
-    }
-    return;
-  }
-  const leafResources = leafResourcesOf(resource);
-  let sharedAccess;
-  let allLeavesShareAccess = true;
-  for (const leafResource of leafResources) {
-    const access = matrix[leafResource];
-    sharedAccess ??= access;
-    if (access !== sharedAccess) {
-      allLeavesShareAccess = false;
-      break;
-    }
-  }
-  if (sharedAccess !== void 0 && sharedAccess !== baseAccess && allLeavesShareAccess) {
-    scopes.push(permissionForAccessLevel(resource, sharedAccess));
-    return;
-  }
-  for (const childResource of childResources) {
-    pushResourcePermissions(scopes, matrix, childResource, baseAccess);
-  }
+  return permissionMatrixToScopes(
+    permissionMatrixFromExplicitPermissions(merged)
+  );
 }
-function mergeResolvedScopesByHighestAccess(sources) {
-  const merged = {
-    leafAccesses: {}
-  };
+function mergeExplicitPermissionMatricesByHighestAccess(sources) {
+  const merged = {};
   for (const source of sources) {
-    if (source.baseAccess !== void 0) {
-      merged.baseAccess = strongestAccess(
-        _nullishCoalesce(merged.baseAccess, () => ( "none")),
-        source.baseAccess
-      );
+    if (source.room !== void 0) {
+      merged.room = strongestAccess(_nullishCoalesce(merged.room, () => ( "none")), source.room);
     }
-    for (const resource of LEAF_ROOM_PERMISSION_RESOURCES) {
-      const sourceAccess = source.leafAccesses[resource];
-      if (sourceAccess === void 0) {
-        continue;
+    for (const resource of ROOM_PERMISSION_RESOURCES) {
+      const access = explicitAccessForResource(source, resource);
+      if (access !== void 0) {
+        merged[resource] = strongestAccess(_nullishCoalesce(merged[resource], () => ( "none")), access);
       }
-      merged.leafAccesses[resource] = strongestAccess(
-        _nullishCoalesce(merged.leafAccesses[resource], () => ( "none")),
-        sourceAccess
-      );
     }
   }
   return merged;
 }
+function explicitAccessForResource(source, resource) {
+  return _nullishCoalesce(source[resource], () => ( (isCommentVisibilityResource(resource) ? source.comments : void 0)));
+}
 function permissionForAccessLevel(resource, access, field = resource) {
-  const permissions = resource === "room" ? BASE_PERMISSIONS_BY_ACCESS[access] : resource === "personal" ? void 0 : PERMISSIONS_BY_ROOM_RESOURCE[resource][access];
+  const permissions = PERMISSIONS_BY_RESOURCE[resource][access];
   const permission = _optionalChain([permissions, 'optionalAccess', _109 => _109[0]]);
   if (permission !== void 0) {
     return permission;
@@ -5601,21 +5493,43 @@ function permissionForAccessLevel(resource, access, field = resource) {
 function strongestAccess(left, right) {
   return ACCESS_LEVEL_RANKS[right] > ACCESS_LEVEL_RANKS[left] ? right : left;
 }
-function leafResourcesOf(resource) {
-  return _nullishCoalesce(LEAF_ROOM_PERMISSION_RESOURCES_BY_PARENT.get(resource), () => ( []));
-}
-function childResourcesOf(resource) {
-  return _nullishCoalesce(CHILD_ROOM_PERMISSION_RESOURCES.get(resource), () => ( []));
+function roomPatternMatches(pattern, roomId) {
+  if (pattern.includes("*")) {
+    return roomId.startsWith(pattern.replace("*", ""));
+  }
+  return pattern === roomId;
 }
-function parentResourceOf(resource) {
-  return PARENT_ROOM_PERMISSION_RESOURCES.get(resource);
+function roomPatternSpecificity(pattern) {
+  return pattern.replace("*", "").length;
 }
-function getLeafResources(resource) {
-  const childResources = childResourcesOf(resource);
-  if (childResources.length === 0) {
-    return [resource];
+function validatePermissionsSet(scopes) {
+  const unknownScopes = scopes.filter((scope) => !VALID_PERMISSIONS.has(scope));
+  if (unknownScopes.length > 0) {
+    return `Unknown permission scope(s): ${unknownScopes.join(", ")}`;
+  }
+  const baseScopes = scopes.filter((scope) => basePermissionScopes.has(scope));
+  if (baseScopes.length !== 1) {
+    return `Permissions must include exactly one of ${Permission.Read}, ${Permission.Write} (or the legacy aliases ${Permission.RoomRead}, ${Permission.RoomWrite}), got ${baseScopes.length === 0 ? "none" : baseScopes.join(", ")}`;
   }
-  return childResources.flatMap(getLeafResources);
+  const seenFeatures = /* @__PURE__ */ new Set();
+  for (const scope of scopes) {
+    if (basePermissionScopes.has(scope) || scope === Permission.LegacyRoomPresenceWrite) {
+      continue;
+    }
+    const feature = permissionFeature(scope);
+    if (seenFeatures.has(feature)) {
+      return `Permissions can include at most one scope per feature, got multiple "${feature}" scopes`;
+    }
+    seenFeatures.add(feature);
+  }
+  return true;
+}
+function permissionFeature(scope) {
+  const accessSeparatorIndex = scope.lastIndexOf(":");
+  return accessSeparatorIndex === -1 ? scope : scope.slice(0, accessSeparatorIndex);
+}
+function isCommentVisibilityResource(resource) {
+  return resource.startsWith("comments:");
 }
 
 // src/protocol/AuthToken.ts
@@ -5804,7 +5718,10 @@ function cachedTokenSatisfiesRequest(cachedToken, request) {
     _nullishCoalesce(cachedToken.permissions, () => ( [])),
     request.roomId
   );
-  return matrix !== void 0 && hasPermissionAccess(matrix, request.resource, request.access);
+  if (matrix === void 0) {
+    return false;
+  }
+  return hasPermissionAccess(matrix, request.resource, request.access);
 }
 function prepareAuthentication(authOptions) {
   const { publicApiKey, authEndpoint } = authOptions;
@@ -8662,7 +8579,7 @@ var LiveObject = (_class2 = class _LiveObject extends AbstractCrdt {
         const preciseSize = new TextEncoder().encode(jsonString).length;
         if (preciseSize > MAX_LIVE_OBJECT_SIZE) {
           throw new Error(
-            `LiveObject size exceeded limit: ${preciseSize} bytes > ${MAX_LIVE_OBJECT_SIZE} bytes. See https://liveblocks.io/docs/platform/limits#Liveblocks-Storage-limits`
+            `LiveObject size exceeded limit: ${preciseSize} bytes > ${MAX_LIVE_OBJECT_SIZE} bytes. See https://liveblocks.io/docs/pricing/limits#Other-limits`
           );
         }
       }
@@ -11605,6 +11522,7 @@ function createRoom(options, config) {
         yjsProviderDidChange: context.yjsProviderDidChange.observable,
         // send metadata when using a text editor
         reportTextEditor,
+        getPermissionMatrix: () => _optionalChain([context, 'access', _277 => _277.dynamicSessionInfoSig, 'access', _278 => _278.get, 'call', _279 => _279(), 'optionalAccess', _280 => _280.permissionMatrix]),
         // create a text mention when using a text editor
         createTextMention,
         // delete a text mention when using a text editor
@@ -11659,7 +11577,7 @@ ${dumpPool(
           source.dispose();
         }
         eventHub.roomWillDestroy.notify();
-        _optionalChain([context, 'access', _277 => _277.yjsProvider, 'optionalAccess', _278 => _278.off, 'call', _279 => _279("status", yjsStatusDidChange)]);
+        _optionalChain([context, 'access', _281 => _281.yjsProvider, 'optionalAccess', _282 => _282.off, 'call', _283 => _283("status", yjsStatusDidChange)]);
         syncSourceForStorage.destroy();
         syncSourceForYjs.destroy();
         uninstallBgTabSpy();
@@ -11821,7 +11739,7 @@ function makeClassicSubscribeFn(roomId, events, errorEvents) {
     }
     if (isLiveNode(first)) {
       const node = first;
-      if (_optionalChain([options, 'optionalAccess', _280 => _280.isDeep])) {
+      if (_optionalChain([options, 'optionalAccess', _284 => _284.isDeep])) {
         const storageCallback = second;
         return subscribeToLiveStructureDeeply(node, storageCallback);
       } else {
@@ -11911,8 +11829,8 @@ function createClient(options) {
   const authManager = createAuthManager(options, (token) => {
     currentUserId.set(() => token.uid);
   });
-  const fetchPolyfill = _optionalChain([clientOptions, 'access', _281 => _281.polyfills, 'optionalAccess', _282 => _282.fetch]) || /* istanbul ignore next */
-  _optionalChain([globalThis, 'access', _283 => _283.fetch, 'optionalAccess', _284 => _284.bind, 'call', _285 => _285(globalThis)]);
+  const fetchPolyfill = _optionalChain([clientOptions, 'access', _285 => _285.polyfills, 'optionalAccess', _286 => _286.fetch]) || /* istanbul ignore next */
+  _optionalChain([globalThis, 'access', _287 => _287.fetch, 'optionalAccess', _288 => _288.bind, 'call', _289 => _289(globalThis)]);
   const httpClient = createApiClient({
     baseUrl,
     fetchPolyfill,
@@ -11929,7 +11847,7 @@ function createClient(options) {
     delegates: {
       createSocket: makeCreateSocketDelegateForAi(
         baseUrl,
-        _optionalChain([clientOptions, 'access', _286 => _286.polyfills, 'optionalAccess', _287 => _287.WebSocket])
+        _optionalChain([clientOptions, 'access', _290 => _290.polyfills, 'optionalAccess', _291 => _291.WebSocket])
       ),
       authenticate: async () => {
         const resp = await authManager.getAuthValue({
@@ -12000,7 +11918,7 @@ function createClient(options) {
           createSocket: makeCreateSocketDelegateForRoom(
             roomId,
             baseUrl,
-            _optionalChain([clientOptions, 'access', _288 => _288.polyfills, 'optionalAccess', _289 => _289.WebSocket])
+            _optionalChain([clientOptions, 'access', _292 => _292.polyfills, 'optionalAccess', _293 => _293.WebSocket])
           ),
           authenticate: makeAuthDelegateForRoom(roomId, authManager)
         })),
@@ -12022,7 +11940,7 @@ function createClient(options) {
     const shouldConnect = _nullishCoalesce(options2.autoConnect, () => ( true));
     if (shouldConnect) {
       if (typeof atob === "undefined") {
-        if (_optionalChain([clientOptions, 'access', _290 => _290.polyfills, 'optionalAccess', _291 => _291.atob]) === void 0) {
+        if (_optionalChain([clientOptions, 'access', _294 => _294.polyfills, 'optionalAccess', _295 => _295.atob]) === void 0) {
           throw new Error(
             "You need to polyfill atob to use the client in your environment. Please follow the instructions at https://liveblocks.io/docs/errors/liveblocks-client/atob-polyfill"
           );
@@ -12034,7 +11952,7 @@ function createClient(options) {
     return leaseRoom(newRoomDetails);
   }
   function getRoom(roomId) {
-    const room = _optionalChain([roomsById, 'access', _292 => _292.get, 'call', _293 => _293(roomId), 'optionalAccess', _294 => _294.room]);
+    const room = _optionalChain([roomsById, 'access', _296 => _296.get, 'call', _297 => _297(roomId), 'optionalAccess', _298 => _298.room]);
     return room ? room : null;
   }
   function logout() {
@@ -12050,7 +11968,7 @@ function createClient(options) {
   const batchedResolveUsers = new Batch(
     async (batchedUserIds) => {
       const userIds = batchedUserIds.flat();
-      const users = await _optionalChain([resolveUsers, 'optionalCall', _295 => _295({ userIds })]);
+      const users = await _optionalChain([resolveUsers, 'optionalCall', _299 => _299({ userIds })]);
       warnOnceIf(
         !resolveUsers,
         "Set the resolveUsers option in createClient to specify user info."
@@ -12067,7 +11985,7 @@ function createClient(options) {
   const batchedResolveRoomsInfo = new Batch(
     async (batchedRoomIds) => {
       const roomIds = batchedRoomIds.flat();
-      const roomsInfo = await _optionalChain([resolveRoomsInfo, 'optionalCall', _296 => _296({ roomIds })]);
+      const roomsInfo = await _optionalChain([resolveRoomsInfo, 'optionalCall', _300 => _300({ roomIds })]);
       warnOnceIf(
         !resolveRoomsInfo,
         "Set the resolveRoomsInfo option in createClient to specify room info."
@@ -12084,7 +12002,7 @@ function createClient(options) {
   const batchedResolveGroupsInfo = new Batch(
     async (batchedGroupIds) => {
       const groupIds = batchedGroupIds.flat();
-      const groupsInfo = await _optionalChain([resolveGroupsInfo, 'optionalCall', _297 => _297({ groupIds })]);
+      const groupsInfo = await _optionalChain([resolveGroupsInfo, 'optionalCall', _301 => _301({ groupIds })]);
       warnOnceIf(
         !resolveGroupsInfo,
         "Set the resolveGroupsInfo option in createClient to specify group info."
@@ -12143,7 +12061,7 @@ function createClient(options) {
       }
     };
     const win = typeof window !== "undefined" ? window : void 0;
-    _optionalChain([win, 'optionalAccess', _298 => _298.addEventListener, 'call', _299 => _299("beforeunload", maybePreventClose)]);
+    _optionalChain([win, 'optionalAccess', _302 => _302.addEventListener, 'call', _303 => _303("beforeunload", maybePreventClose)]);
   }
   async function getNotificationSettings(options2) {
     const plainSettings = await httpClient.getNotificationSettings(options2);
@@ -12271,7 +12189,7 @@ var commentBodyElementsTypes = {
   mention: "inline"
 };
 function traverseCommentBody(body, elementOrVisitor, possiblyVisitor) {
-  if (!body || !_optionalChain([body, 'optionalAccess', _300 => _300.content])) {
+  if (!body || !_optionalChain([body, 'optionalAccess', _304 => _304.content])) {
     return;
   }
   const element = typeof elementOrVisitor === "string" ? elementOrVisitor : void 0;
@@ -12281,13 +12199,13 @@ function traverseCommentBody(body, elementOrVisitor, possiblyVisitor) {
   for (const block of body.content) {
     if (type === "all" || type === "block") {
       if (guard(block)) {
-        _optionalChain([visitor, 'optionalCall', _301 => _301(block)]);
+        _optionalChain([visitor, 'optionalCall', _305 => _305(block)]);
       }
     }
     if (type === "all" || type === "inline") {
       for (const inline of block.children) {
         if (guard(inline)) {
-          _optionalChain([visitor, 'optionalCall', _302 => _302(inline)]);
+          _optionalChain([visitor, 'optionalCall', _306 => _306(inline)]);
         }
       }
     }
@@ -12457,7 +12375,7 @@ var stringifyCommentBodyPlainElements = {
   text: ({ element }) => element.text,
   link: ({ element }) => _nullishCoalesce(element.text, () => ( element.url)),
   mention: ({ element, user, group }) => {
-    return `@${_nullishCoalesce(_nullishCoalesce(_optionalChain([user, 'optionalAccess', _303 => _303.name]), () => ( _optionalChain([group, 'optionalAccess', _304 => _304.name]))), () => ( element.id))}`;
+    return `@${_nullishCoalesce(_nullishCoalesce(_optionalChain([user, 'optionalAccess', _307 => _307.name]), () => ( _optionalChain([group, 'optionalAccess', _308 => _308.name]))), () => ( element.id))}`;
   }
 };
 var stringifyCommentBodyHtmlElements = {
@@ -12487,7 +12405,7 @@ var stringifyCommentBodyHtmlElements = {
     return html`<a href="${href}" target="_blank" rel="noopener noreferrer">${element.text ? html`${element.text}` : element.url}</a>`;
   },
   mention: ({ element, user, group }) => {
-    return html`<span data-mention>@${_optionalChain([user, 'optionalAccess', _305 => _305.name]) ? html`${_optionalChain([user, 'optionalAccess', _306 => _306.name])}` : _optionalChain([group, 'optionalAccess', _307 => _307.name]) ? html`${_optionalChain([group, 'optionalAccess', _308 => _308.name])}` : element.id}</span>`;
+    return html`<span data-mention>@${_optionalChain([user, 'optionalAccess', _309 => _309.name]) ? html`${_optionalChain([user, 'optionalAccess', _310 => _310.name])}` : _optionalChain([group, 'optionalAccess', _311 => _311.name]) ? html`${_optionalChain([group, 'optionalAccess', _312 => _312.name])}` : element.id}</span>`;
   }
 };
 var stringifyCommentBodyMarkdownElements = {
@@ -12517,20 +12435,20 @@ var stringifyCommentBodyMarkdownElements = {
     return markdown`[${_nullishCoalesce(element.text, () => ( element.url))}](${href})`;
   },
   mention: ({ element, user, group }) => {
-    return markdown`@${_nullishCoalesce(_nullishCoalesce(_optionalChain([user, 'optionalAccess', _309 => _309.name]), () => ( _optionalChain([group, 'optionalAccess', _310 => _310.name]))), () => ( element.id))}`;
+    return markdown`@${_nullishCoalesce(_nullishCoalesce(_optionalChain([user, 'optionalAccess', _313 => _313.name]), () => ( _optionalChain([group, 'optionalAccess', _314 => _314.name]))), () => ( element.id))}`;
   }
 };
 async function stringifyCommentBody(body, options) {
-  const format = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _311 => _311.format]), () => ( "plain"));
-  const separator = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _312 => _312.separator]), () => ( (format === "markdown" ? "\n\n" : "\n")));
+  const format = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _315 => _315.format]), () => ( "plain"));
+  const separator = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _316 => _316.separator]), () => ( (format === "markdown" ? "\n\n" : "\n")));
   const elements = {
     ...format === "html" ? stringifyCommentBodyHtmlElements : format === "markdown" ? stringifyCommentBodyMarkdownElements : stringifyCommentBodyPlainElements,
-    ..._optionalChain([options, 'optionalAccess', _313 => _313.elements])
+    ..._optionalChain([options, 'optionalAccess', _317 => _317.elements])
   };
   const { users: resolvedUsers, groups: resolvedGroupsInfo } = await resolveMentionsInCommentBody(
     body,
-    _optionalChain([options, 'optionalAccess', _314 => _314.resolveUsers]),
-    _optionalChain([options, 'optionalAccess', _315 => _315.resolveGroupsInfo])
+    _optionalChain([options, 'optionalAccess', _318 => _318.resolveUsers]),
+    _optionalChain([options, 'optionalAccess', _319 => _319.resolveGroupsInfo])
   );
   const blocks = body.content.flatMap((block, blockIndex) => {
     switch (block.type) {
@@ -12665,9 +12583,9 @@ function makePoller(callback, intervalMs, options) {
   const startTime = performance.now();
   const doc = typeof document !== "undefined" ? document : void 0;
   const win = typeof window !== "undefined" ? window : void 0;
-  const maxStaleTimeMs = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _316 => _316.maxStaleTimeMs]), () => ( Number.POSITIVE_INFINITY));
+  const maxStaleTimeMs = _nullishCoalesce(_optionalChain([options, 'optionalAccess', _320 => _320.maxStaleTimeMs]), () => ( Number.POSITIVE_INFINITY));
   const context = {
-    inForeground: _optionalChain([doc, 'optionalAccess', _317 => _317.visibilityState]) !== "hidden",
+    inForeground: _optionalChain([doc, 'optionalAccess', _321 => _321.visibilityState]) !== "hidden",
     lastSuccessfulPollAt: startTime,
     count: 0,
     backoff: 0
@@ -12748,11 +12666,11 @@ function makePoller(callback, intervalMs, options) {
     pollNowIfStale();
   }
   function onVisibilityChange() {
-    setInForeground(_optionalChain([doc, 'optionalAccess', _318 => _318.visibilityState]) !== "hidden");
+    setInForeground(_optionalChain([doc, 'optionalAccess', _322 => _322.visibilityState]) !== "hidden");
   }
-  _optionalChain([doc, 'optionalAccess', _319 => _319.addEventListener, 'call', _320 => _320("visibilitychange", onVisibilityChange)]);
-  _optionalChain([win, 'optionalAccess', _321 => _321.addEventListener, 'call', _322 => _322("online", onVisibilityChange)]);
-  _optionalChain([win, 'optionalAccess', _323 => _323.addEventListener, 'call', _324 => _324("focus", pollNowIfStale)]);
+  _optionalChain([doc, 'optionalAccess', _323 => _323.addEventListener, 'call', _324 => _324("visibilitychange", onVisibilityChange)]);
+  _optionalChain([win, 'optionalAccess', _325 => _325.addEventListener, 'call', _326 => _326("online", onVisibilityChange)]);
+  _optionalChain([win, 'optionalAccess', _327 => _327.addEventListener, 'call', _328 => _328("focus", pollNowIfStale)]);
   fsm.start();
   return {
     inc,