@neontechspace/fluxerly 1000.0.0-nightly.12

package/dist/internal/permission-requirements.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Permissions that Fluxer checks for SDK operations, behind details.requiredPermissions and the missing-permission hint.
+ * Invariant: Every entry comes from Fluxer's own permission check in fluxerapp/fluxer. Entries that name no other commit
+ * come from a95172bf88da26dd877255ceee139bf84e6799fa, and the forum tag and threads.* entries come from the commit
+ * 4749eb7f866ceba0c9622014a9824900d5be8172 that their comments name. Source references are relative to
+ * fluxer_api/src/api.
+ * An operation whose rejection the source does not tie to one set of permissions has no entry and keeps the generic hint.
+ * Channel-authenticated routes first check View Channel in channel/services/BaseChannelAuthService.ts:213 and reject
+ * it with MISSING_PERMISSIONS, so their entries include it.
+ * Implements [SDK contracts: Validation requirements](/docs/SDK-CONTRACTS.md#validation-requirements)
+ */
+import type { Operation } from "#sdk/errors";
+import type { PermissionName } from "#sdk/helpers";
+/**
+ * Where Fluxer reads a permission: In the channel, where permission overrides apply, community-wide from the bot's
+ * roles, or community-wide and again in the channel
+ */
+type PermissionScope = "channel" | "guild" | "guildAndChannel";
+/** What one operation needs, as Fluxer's permission checks state it */
+export interface PermissionRequirement {
+    /** Permissions that Fluxer checks on the operation's usual path */
+    readonly permissions: readonly PermissionName[];
+    readonly scope: PermissionScope;
+    /** Other checks behind the same rejection, such as role hierarchy or permissions that only some inputs need */
+    readonly also?: string;
+}
+/** Requirement of each operation whose permission checks the pinned source ties to one set */
+export declare const permissionRequirements: Readonly<Partial<Record<Operation, PermissionRequirement>>>;
+/** What Fluxer requires for an operation, or undefined when its permission checks are not tied to one set */
+export declare function permissionRequirement(operation: string): PermissionRequirement | undefined;
+/** The suggested fix for a missing-permission rejection of an operation with a known requirement */
+export declare function requiredPermissionsHint(requirement: PermissionRequirement): string;
+export {};
+//# sourceMappingURL=permission-requirements.d.ts.map

package/dist/internal/permission-requirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-requirements.d.ts","sourceRoot":"","sources":["../../src/internal/permission-requirements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD;;;GAGG;AACH,KAAK,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,iBAAiB,CAAA;AAE9D,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IAClC,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,+GAA+G;IAC/G,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACzB;AAaD,8FAA8F;AAC9F,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAsS9F,CAAA;AAED,6GAA6G;AAC7G,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAE1F;AAKD,oGAAoG;AACpG,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,qBAAqB,GAAG,MAAM,CAYlF"}

package/dist/internal/permission-requirements.js

@@ -0,0 +1,204 @@
+const requires = (scope, permissions, also) => Object.freeze({
+    permissions: Object.freeze([...permissions]),
+    scope,
+    ...(also === undefined ? {} : { also }),
+});
+const memberHierarchy = "Fluxer also requires the bot's highest role to be above the member's highest role, and never allows acting on the community owner";
+const ownPermissions = "the bot can allow, or stop denying, only permissions it has";
+/** Requirement of each operation whose permission checks the pinned source ties to one set */
+export const permissionRequirements = {
+    // channel/services/channel_data/ChannelOperationsService.ts:114
+    "channels.fetch": requires("channel", ["ViewChannel"]),
+    // webhook/ChannelFollowService.ts:181
+    "channels.fetchFollowerStats": requires("channel", ["ViewChannel"]),
+    // guild/services/GuildChannelService.ts:92, guild/services/channel/ChannelOperationsService.ts:83-97
+    "channels.create": requires("guild", ["ManageChannels"], "Setting permission overwrites also needs Manage Roles, and the bot can allow only permissions it has"),
+    // channel/services/channel_data/ChannelOperationsService.ts:164, 189, 219-258
+    "channels.edit": requires("channel", ["ViewChannel", "ManageChannels"], `Changing permission overwrites also needs Manage Roles, and ${ownPermissions}. Changing a voice region also needs Update RTC Region`),
+    // channel/services/channel_data/ChannelOperationsService.ts:418
+    "channels.delete": requires("channel", ["ViewChannel", "ManageChannels"]),
+    // guild/services/GuildChannelService.ts:115, guild/services/channel/ChannelOperationsService.ts:396-405
+    "channels.reorder": requires("guild", ["ManageChannels"], `Moving a channel with syncPermissionsOnMove also needs Manage Roles, and ${ownPermissions}`),
+    // channel/services/channel_data/ChannelOperationsService.ts:647-676
+    "channels.setPermissionOverwrite": requires("channel", ["ManageRoles"], `Also, ${ownPermissions}`),
+    // channel/services/channel_data/ChannelOperationsService.ts:719-738
+    "channels.removePermissionOverwrite": requires("channel", ["ManageRoles"], "Also, the bot can remove an overwrite only when it has every permission that overwrite denies"),
+    // webhook/ChannelFollowService.ts:77-100, webhook/WebhookService.ts:614-634
+    "channels.follow": requires("guildAndChannel", ["ViewChannel", "ManageWebhooks"], "Fluxer checks View Channel in both channels and Manage Webhooks in the destination"),
+    // Upstream 4749eb7f, channel/services/ChannelRequestService.ts:164-171, where the three tag routes in
+    // channel/controllers/ForumController.ts check Manage Channels before changing the channel's tags
+    "channels.createForumTag": requires("channel", ["ViewChannel", "ManageChannels"]),
+    "channels.editForumTag": requires("channel", ["ViewChannel", "ManageChannels"]),
+    "channels.deleteForumTag": requires("channel", ["ViewChannel", "ManageChannels"]),
+    // webhook/WebhookService.ts:197-204, 614-634
+    "webhooks.create": requires("guildAndChannel", ["ViewChannel", "ManageWebhooks"]),
+    // webhook/WebhookService.ts:177-184
+    "webhooks.fetchForChannel": requires("guildAndChannel", ["ViewChannel", "ManageWebhooks"]),
+    // webhook/WebhookService.ts:163-164
+    "webhooks.fetchForGuild": requires("guild", ["ManageWebhooks"]),
+    // webhook/WebhookService.ts:154-155, 506-518
+    "webhooks.fetch": requires("guildAndChannel", ["ViewChannel", "ManageWebhooks"]),
+    // webhook/WebhookService.ts:241-275
+    "webhooks.edit": requires("guildAndChannel", ["ViewChannel", "ManageWebhooks"], "Moving the webhook to another channel also needs them in that channel"),
+    // webhook/WebhookService.ts:362-365
+    "webhooks.delete": requires("guildAndChannel", ["ViewChannel", "ManageWebhooks"]),
+    // invite/InviteService.ts:151, 189-198
+    "invites.create": requires("channel", ["ViewChannel", "CreateInstantInvite"]),
+    // invite/InviteService.ts:117-129
+    "invites.fetchForChannel": requires("guildAndChannel", ["ViewChannel", "ManageChannels"], "For a group direct message, only its owner can list them"),
+    // invite/InviteService.ts:135-139
+    "invites.fetchForGuild": requires("guild", ["ManageGuild"]),
+    // invite/InviteService.ts:364-392
+    "invites.delete": requires("guild", ["ManageGuild"], "Deleting an invite the bot created needs no Manage Guild. For a group direct message invite, only the group owner can delete it"),
+    // guild/services/content/EmojiService.ts:102. Editing and deleting need Create Expressions for the bot's own
+    // emoji and Manage Expressions otherwise, so they have no entry
+    "emojis.create": requires("guild", ["CreateExpressions"]),
+    // guild/services/content/EmojiService.ts:219
+    "emojis.createMany": requires("guild", ["CreateExpressions"]),
+    // guild/services/content/EmojiService.ts:164
+    "emojis.clone": requires("guild", ["CreateExpressions"]),
+    // guild/services/content/StickerService.ts:118
+    "stickers.create": requires("guild", ["CreateExpressions"]),
+    // guild/services/content/StickerService.ts:238
+    "stickers.createMany": requires("guild", ["CreateExpressions"]),
+    // guild/services/content/StickerService.ts:178
+    "stickers.clone": requires("guild", ["CreateExpressions"]),
+    // guild/services/data/GuildOperationsService.ts:462
+    "guilds.edit": requires("guild", ["ManageGuild"]),
+    // guild/services/data/GuildVanityService.ts:34
+    "guilds.fetchVanityUrl": requires("guild", ["ManageGuild"]),
+    // guild/services/data/GuildVanityService.ts:61
+    "guilds.editVanityUrl": requires("guild", ["ManageGuild"]),
+    // guild/services/GuildService.ts:306-318
+    "auditLogs.fetchPage": requires("guild", ["ViewAuditLog"]),
+    // guild/controllers/GuildDiscoveryController.ts:163
+    "discovery.apply": requires("guild", ["ManageGuild"]),
+    // guild/controllers/GuildDiscoveryController.ts:198
+    "discovery.edit": requires("guild", ["ManageGuild"]),
+    // guild/controllers/GuildDiscoveryController.ts:228
+    "discovery.withdraw": requires("guild", ["ManageGuild"]),
+    // guild/controllers/GuildDiscoveryController.ts:252
+    "discovery.fetchStatus": requires("guild", ["ManageGuild"]),
+    // guild/services/member/GuildMemberOperationsService.ts:395-401
+    "members.kick": requires("guild", ["KickMembers"], memberHierarchy),
+    // guild/services/GuildModerationService.ts:83-92
+    "members.ban": requires("guild", ["BanMembers"], memberHierarchy),
+    // guild/services/GuildModerationService.ts:184
+    "members.unban": requires("guild", ["BanMembers"]),
+    // guild/services/GuildModerationService.ts:170
+    "members.fetchBans": requires("guild", ["BanMembers"]),
+    // guild/services/member/GuildMemberOperationsService.ts:577-586
+    "members.timeout": requires("guild", ["ModerateMembers"], `${memberHierarchy}, the bot itself or a member with Administrator`),
+    "members.clearTimeout": requires("guild", ["ModerateMembers"], `${memberHierarchy}, the bot itself or a member with Administrator`),
+    // guild/services/member/GuildMemberOperationsService.ts:289-291
+    "members.setNickname": requires("guild", ["ManageNicknames"], memberHierarchy),
+    // guild/services/member/GuildMemberOperationsService.ts:880-887
+    "members.setMute": requires("guild", ["MuteMembers"], memberHierarchy),
+    // guild/services/member/GuildMemberOperationsService.ts:880-891
+    "members.setDeaf": requires("guild", ["DeafenMembers"], memberHierarchy),
+    // guild/services/member/GuildMemberOperationsService.ts:880-917
+    "members.move": requires("guild", ["MoveMembers"], `${memberHierarchy}. The bot and the member also need Connect in the destination channel`),
+    // guild/services/member/GuildMemberOperationsService.ts:880-896
+    "members.disconnect": requires("guild", ["MoveMembers"], memberHierarchy),
+    // guild/services/member/GuildMemberValidationService.ts:50-62
+    "members.setRoles": requires("guild", ["ManageRoles"], "Fluxer also requires the bot's highest role to be above every role it adds or removes"),
+    // guild/services/member/GuildMemberValidationService.ts:84-89
+    "members.addRole": requires("guild", ["ManageRoles"], "Fluxer also requires the bot's highest role to be above the role"),
+    "members.removeRole": requires("guild", ["ManageRoles"], "Fluxer also requires the bot's highest role to be above the role"),
+    // guild/services/GuildRoleService.ts:121, 180-185
+    "roles.create": requires("guild", ["ManageRoles"], "Also, the bot can grant only permissions it has"),
+    // guild/services/GuildRoleService.ts:202-222
+    "roles.edit": requires("guild", ["ManageRoles"], "Fluxer also requires the bot's highest role to be above the role, and the bot can grant only permissions it has"),
+    // guild/services/GuildRoleService.ts:265-274
+    "roles.delete": requires("guild", ["ManageRoles"], "Fluxer also requires the bot's highest role to be above the role"),
+    // guild/services/GuildRoleService.ts:317, 612-624
+    "roles.reorder": requires("guild", ["ManageRoles"], "Also, the bot can move only roles below its highest role"),
+    // guild/services/GuildRoleService.ts:354, 372-389
+    "roles.setHoistPositions": requires("guild", ["ManageRoles"], "Also, the bot can change only roles below its highest role"),
+    // guild/services/GuildRoleService.ts:432
+    "roles.resetHoistPositions": requires("guild", ["ManageRoles"]),
+    // channel/services/message/MessageSendService.ts:268-291, 679-682, channel/services/AttachmentUploadService.ts:491.
+    // Every send, reply, forward and direct message reports this operation, and direct messages never check these
+    send: requires("channel", ["ViewChannel", "SendMessages"], "Embeds also need Embed Links, files need Attach Files, and a forward needs View Channel in its source channel"),
+    // channel/services/MessageInteractionService.ts:75-76
+    typing: requires("channel", ["ViewChannel", "SendMessages"]),
+    // channel/services/message/MessageRetrievalService.ts:76
+    fetch: requires("channel", ["ViewChannel"]),
+    fetchHistory: requires("channel", ["ViewChannel"]),
+    // channel/services/message/MessageEditService.ts:71-93
+    edit: requires("channel", ["ViewChannel"], "Adding embeds also needs Embed Links, and adding files needs Attach Files"),
+    // channel/services/message/MessageDeleteService.ts:67-77, channel/services/message/MessageValidationService.ts:249-255
+    delete: requires("channel", ["ViewChannel", "ManageMessages"], "Deleting the bot's own message needs no Manage Messages, and Fluxer does not allow deleting some system messages"),
+    // channel/services/message/MessageDeleteService.ts:179-184
+    deleteMany: requires("channel", ["ViewChannel", "ManageMessages"]),
+    // channel/services/AttachmentUploadService.ts:357-369
+    deleteAttachment: requires("channel", ["ViewChannel"], "Also, Fluxer lets only the message's author remove its attachments"),
+    // channel/controllers/MessageController.ts:478
+    deleteOwnMessages: requires("channel", ["ViewChannel"]),
+    // channel/services/message/MessageCrosspostService.ts:70-92
+    publish: requires("channel", ["ViewChannel", "SendMessages"], "Publishing another author's message also needs Manage Messages"),
+    // channel/services/MessageInteractionService.ts:115, channel/services/interaction/MessagePinService.ts:155
+    pin: requires("channel", ["ViewChannel", "PinMessages"]),
+    // channel/services/MessageInteractionService.ts:136, channel/services/interaction/MessagePinService.ts:206
+    unpin: requires("channel", ["ViewChannel", "PinMessages"]),
+    // channel/services/MessageInteractionService.ts:98
+    fetchPins: requires("channel", ["ViewChannel"]),
+    // channel/services/MessageInteractionService.ts:162
+    fetchReactionUsers: requires("channel", ["ViewChannel"]),
+    // channel/services/MessageInteractionService.ts:180, channel/services/interaction/MessageReactionService.ts:208-209, 431-433
+    addReaction: requires("channel", ["ViewChannel", "AddReactions"], "Adding to an existing reaction needs no Add Reactions, and a new reaction with a custom emoji also needs Use External Emojis"),
+    // channel/services/MessageInteractionService.ts:227, channel/services/interaction/MessageReactionService.ts:276-278
+    removeReaction: requires("channel", ["ViewChannel"]),
+    // channel/services/interaction/MessageReactionService.ts:276-278, 363-376
+    removeUserReaction: requires("channel", ["ViewChannel", "ManageMessages"], "Fluxer allows it only in community channels"),
+    // channel/services/MessageInteractionService.ts:260, channel/services/interaction/MessageReactionService.ts:316
+    clearReaction: requires("channel", ["ViewChannel", "ManageMessages"]),
+    // channel/services/MessageInteractionService.ts:273, channel/services/interaction/MessageReactionService.ts:347
+    clearReactions: requires("channel", ["ViewChannel", "ManageMessages"]),
+    // The threads.* entries come from fluxerapp/fluxer commit 4749eb7f866ceba0c9622014a9824900d5be8172, where paths
+    // starting with packages/ are relative to the repository root. Fluxer reads a thread's permissions in its parent
+    // channel, and a thread it cannot view fails with MISSING_ACCESS instead, so thread-targeted entries leave out
+    // View Channel. Join, leave, fetchActive and member reads have no entry because none of their checks fails with
+    // MISSING_PERMISSIONS.
+    // channel/services/BaseChannelAuthService.ts:248, channel/services/thread/ThreadCreationService.ts:378,
+    // packages/constants/src/ThreadPermissionUtils.ts:214-231
+    "threads.create": requires("channel", ["ViewChannel", "CreatePublicThreads"], "A private thread needs Create Private Threads instead"),
+    // channel/services/BaseChannelAuthService.ts:248, channel/services/thread/ThreadCreationService.ts:120, 378,
+    // packages/constants/src/ThreadPermissionUtils.ts:222-225
+    "threads.createFromMessage": requires("channel", ["ViewChannel", "CreatePublicThreads", "ReadMessageHistory"]),
+    // channel/services/BaseChannelAuthService.ts:248, channel/services/thread/ThreadCreationService.ts:228, 236,
+    // channel/services/message/MessageSendService.ts:254-298
+    "threads.createPost": requires("channel", ["ViewChannel", "SendMessages"], "Embeds in the first message also need Embed Links, and files need Attach Files"),
+    // channel/services/thread/ThreadModifyService.ts:137, packages/constants/src/ThreadPermissionUtils.ts:124-158
+    "threads.edit": requires("channel", ["ManageThreads"], "The thread's creator needs it only to unlock the thread or change rateLimitPerUser, pinned or moderated tags, and every change in a locked thread needs it"),
+    // channel/services/BaseChannelAuthService.ts:248, channel/services/thread/ThreadListService.ts:144,
+    // packages/constants/src/ThreadPermissionUtils.ts:233-241
+    "threads.fetchArchived": requires("channel", ["ViewChannel", "ReadMessageHistory"], "Listing private archived threads also needs Manage Threads"),
+    // channel/services/BaseChannelAuthService.ts:248, channel/services/thread/ThreadForumService.ts:217
+    "threads.search": requires("channel", ["ViewChannel", "ReadMessageHistory"]),
+    // channel/services/thread/ThreadMemberService.ts:80, packages/constants/src/ThreadPermissionUtils.ts:179-193
+    "threads.addMember": requires("channel", ["SendMessagesInThreads"], "Adding to a private thread that is not invitable also needs Manage Threads, unless the added member has it"),
+    // channel/services/thread/ThreadMemberService.ts:105, packages/constants/src/ThreadPermissionUtils.ts:195-201
+    "threads.removeMember": requires("channel", ["ManageThreads"], "The creator of a private thread can remove its members without it"),
+};
+/** What Fluxer requires for an operation, or undefined when its permission checks are not tied to one set */
+export function permissionRequirement(operation) {
+    return Object.hasOwn(permissionRequirements, operation) ? permissionRequirements[operation] : undefined;
+}
+/** Readable name of a permission, such as Manage Channels for ManageChannels */
+const permissionLabel = (name) => name.replace(/([a-z])([A-Z])/g, "$1 $2");
+/** The suggested fix for a missing-permission rejection of an operation with a known requirement */
+export function requiredPermissionsHint(requirement) {
+    const labels = requirement.permissions.map(permissionLabel);
+    const list = labels.length === 1 ? labels[0] : `${labels.slice(0, -1).join(", ")} and ${labels.at(-1)}`;
+    const them = labels.length === 1 ? "it" : "them";
+    const where = {
+        channel: `Grant ${them} to the bot's role in the community settings or the channel's permission overrides`,
+        guild: `Grant ${them} to the bot's role in the community settings`,
+        guildAndChannel: `Grant ${them} to the bot's role in the community settings, and check that the channel's permission overrides do not deny ${them}`,
+    }[requirement.scope];
+    return [`The bot needs ${list} for this operation`, where, requirement.also]
+        .filter((part) => part !== undefined)
+        .join(". ");
+}
+//# sourceMappingURL=permission-requirements.js.map

package/dist/internal/permission-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-requirements.js","sourceRoot":"","sources":["../../src/internal/permission-requirements.ts"],"names":[],"mappings":"AA6BA,MAAM,QAAQ,GAAG,CAAC,KAAsB,EAAE,WAAsC,EAAE,IAAa,EAAE,EAAE,CAC/F,MAAM,CAAC,MAAM,CAAC;IACV,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;IAC5C,KAAK;IACL,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;CAC1C,CAAiC,CAAA;AAEtC,MAAM,eAAe,GACjB,mIAAmI,CAAA;AACvI,MAAM,cAAc,GAAG,6DAA6D,CAAA;AAEpF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,sBAAsB,GAAgE;IAC/F,gEAAgE;IAChE,gBAAgB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC;IACtD,sCAAsC;IACtC,6BAA6B,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC;IACnE,qGAAqG;IACrG,iBAAiB,EAAE,QAAQ,CACvB,OAAO,EACP,CAAC,gBAAgB,CAAC,EAClB,sGAAsG,CACzG;IACD,8EAA8E;IAC9E,eAAe,EAAE,QAAQ,CACrB,SAAS,EACT,CAAC,aAAa,EAAE,gBAAgB,CAAC,EACjC,+DAA+D,cAAc,wDAAwD,CACxI;IACD,gEAAgE;IAChE,iBAAiB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACzE,wGAAwG;IACxG,kBAAkB,EAAE,QAAQ,CACxB,OAAO,EACP,CAAC,gBAAgB,CAAC,EAClB,4EAA4E,cAAc,EAAE,CAC/F;IACD,oEAAoE;IACpE,iCAAiC,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClG,oEAAoE;IACpE,oCAAoC,EAAE,QAAQ,CAC1C,SAAS,EACT,CAAC,aAAa,CAAC,EACf,+FAA+F,CAClG;IACD,4EAA4E;IAC5E,iBAAiB,EAAE,QAAQ,CACvB,iBAAiB,EACjB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EACjC,oFAAoF,CACvF;IACD,sGAAsG;IACtG,kGAAkG;IAClG,yBAAyB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACjF,uBAAuB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC/E,yBAAyB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACjF,6CAA6C;IAC7C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACjF,oCAAoC;IACpC,0BAA0B,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC1F,oCAAoC;IACpC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC/D,6CAA6C;IAC7C,gBAAgB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAChF,oCAAoC;IACpC,eAAe,EAAE,QAAQ,CACrB,iBAAiB,EACjB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EACjC,uEAAuE,CAC1E;IACD,oCAAoC;IACpC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACjF,uCAAuC;IACvC,gBAAgB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAC7E,kCAAkC;IAClC,yBAAyB,EAAE,QAAQ,CAC/B,iBAAiB,EACjB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EACjC,0DAA0D,CAC7D;IACD,kCAAkC;IAClC,uBAAuB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IAC3D,kCAAkC;IAClC,gBAAgB,EAAE,QAAQ,CACtB,OAAO,EACP,CAAC,aAAa,CAAC,EACf,iIAAiI,CACpI;IACD,6GAA6G;IAC7G,gEAAgE;IAChE,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;IACzD,6CAA6C;IAC7C,mBAAmB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC7D,6CAA6C;IAC7C,cAAc,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;IACxD,+CAA+C;IAC/C,iBAAiB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC3D,+CAA+C;IAC/C,qBAAqB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC/D,+CAA+C;IAC/C,gBAAgB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC1D,oDAAoD;IACpD,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IACjD,+CAA+C;IAC/C,uBAAuB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IAC3D,+CAA+C;IAC/C,sBAAsB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IAC1D,yCAAyC;IACzC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;IAC1D,oDAAoD;IACpD,iBAAiB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IACrD,oDAAoD;IACpD,gBAAgB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IACpD,oDAAoD;IACpD,oBAAoB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IACxD,oDAAoD;IACpD,uBAAuB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IAC3D,gEAAgE;IAChE,cAAc,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;IACnE,iDAAiD;IACjD,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC;IACjE,+CAA+C;IAC/C,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IAClD,+CAA+C;IAC/C,mBAAmB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IACtD,gEAAgE;IAChE,iBAAiB,EAAE,QAAQ,CACvB,OAAO,EACP,CAAC,iBAAiB,CAAC,EACnB,GAAG,eAAe,iDAAiD,CACtE;IACD,sBAAsB,EAAE,QAAQ,CAC5B,OAAO,EACP,CAAC,iBAAiB,CAAC,EACnB,GAAG,eAAe,iDAAiD,CACtE;IACD,gEAAgE;IAChE,qBAAqB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC;IAC9E,gEAAgE;IAChE,iBAAiB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;IACtE,gEAAgE;IAChE,iBAAiB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IACxE,gEAAgE;IAChE,cAAc,EAAE,QAAQ,CACpB,OAAO,EACP,CAAC,aAAa,CAAC,EACf,GAAG,eAAe,uEAAuE,CAC5F;IACD,gEAAgE;IAChE,oBAAoB,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,eAAe,CAAC;IACzE,8DAA8D;IAC9D,kBAAkB,EAAE,QAAQ,CACxB,OAAO,EACP,CAAC,aAAa,CAAC,EACf,uFAAuF,CAC1F;IACD,8DAA8D;IAC9D,iBAAiB,EAAE,QAAQ,CACvB,OAAO,EACP,CAAC,aAAa,CAAC,EACf,kEAAkE,CACrE;IACD,oBAAoB,EAAE,QAAQ,CAC1B,OAAO,EACP,CAAC,aAAa,CAAC,EACf,kEAAkE,CACrE;IACD,kDAAkD;IAClD,cAAc,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,iDAAiD,CAAC;IACrG,6CAA6C;IAC7C,YAAY,EAAE,QAAQ,CAClB,OAAO,EACP,CAAC,aAAa,CAAC,EACf,iHAAiH,CACpH;IACD,6CAA6C;IAC7C,cAAc,EAAE,QAAQ,CACpB,OAAO,EACP,CAAC,aAAa,CAAC,EACf,kEAAkE,CACrE;IACD,kDAAkD;IAClD,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,0DAA0D,CAAC;IAC/G,kDAAkD;IAClD,yBAAyB,EAAE,QAAQ,CAC/B,OAAO,EACP,CAAC,aAAa,CAAC,EACf,4DAA4D,CAC/D;IACD,yCAAyC;IACzC,2BAA2B,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC;IAC/D,oHAAoH;IACpH,8GAA8G;IAC9G,IAAI,EAAE,QAAQ,CACV,SAAS,EACT,CAAC,aAAa,EAAE,cAAc,CAAC,EAC/B,+GAA+G,CAClH;IACD,sDAAsD;IACtD,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC5D,yDAAyD;IACzD,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC;IAC3C,YAAY,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC;IAClD,uDAAuD;IACvD,IAAI,EAAE,QAAQ,CACV,SAAS,EACT,CAAC,aAAa,CAAC,EACf,2EAA2E,CAC9E;IACD,uHAAuH;IACvH,MAAM,EAAE,QAAQ,CACZ,SAAS,EACT,CAAC,aAAa,EAAE,gBAAgB,CAAC,EACjC,kHAAkH,CACrH;IACD,2DAA2D;IAC3D,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAClE,sDAAsD;IACtD,gBAAgB,EAAE,QAAQ,CACtB,SAAS,EACT,CAAC,aAAa,CAAC,EACf,oEAAoE,CACvE;IACD,+CAA+C;IAC/C,iBAAiB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC;IACvD,4DAA4D;IAC5D,OAAO,EAAE,QAAQ,CACb,SAAS,EACT,CAAC,aAAa,EAAE,cAAc,CAAC,EAC/B,gEAAgE,CACnE;IACD,2GAA2G;IAC3G,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACxD,2GAA2G;IAC3G,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IAC1D,mDAAmD;IACnD,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC;IAC/C,oDAAoD;IACpD,kBAAkB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC;IACxD,6HAA6H;IAC7H,WAAW,EAAE,QAAQ,CACjB,SAAS,EACT,CAAC,aAAa,EAAE,cAAc,CAAC,EAC/B,8HAA8H,CACjI;IACD,oHAAoH;IACpH,cAAc,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,CAAC,CAAC;IACpD,0EAA0E;IAC1E,kBAAkB,EAAE,QAAQ,CACxB,SAAS,EACT,CAAC,aAAa,EAAE,gBAAgB,CAAC,EACjC,6CAA6C,CAChD;IACD,gHAAgH;IAChH,aAAa,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACrE,gHAAgH;IAChH,cAAc,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IACtE,gHAAgH;IAChH,iHAAiH;IACjH,+GAA+G;IAC/G,gHAAgH;IAChH,uBAAuB;IACvB,wGAAwG;IACxG,0DAA0D;IAC1D,gBAAgB,EAAE,QAAQ,CACtB,SAAS,EACT,CAAC,aAAa,EAAE,qBAAqB,CAAC,EACtC,uDAAuD,CAC1D;IACD,6GAA6G;IAC7G,0DAA0D;IAC1D,2BAA2B,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAC9G,6GAA6G;IAC7G,yDAAyD;IACzD,oBAAoB,EAAE,QAAQ,CAC1B,SAAS,EACT,CAAC,aAAa,EAAE,cAAc,CAAC,EAC/B,gFAAgF,CACnF;IACD,8GAA8G;IAC9G,cAAc,EAAE,QAAQ,CACpB,SAAS,EACT,CAAC,eAAe,CAAC,EACjB,4JAA4J,CAC/J;IACD,oGAAoG;IACpG,0DAA0D;IAC1D,uBAAuB,EAAE,QAAQ,CAC7B,SAAS,EACT,CAAC,aAAa,EAAE,oBAAoB,CAAC,EACrC,4DAA4D,CAC/D;IACD,oGAAoG;IACpG,gBAAgB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IAC5E,6GAA6G;IAC7G,mBAAmB,EAAE,QAAQ,CACzB,SAAS,EACT,CAAC,uBAAuB,CAAC,EACzB,4GAA4G,CAC/G;IACD,8GAA8G;IAC9G,sBAAsB,EAAE,QAAQ,CAC5B,SAAS,EACT,CAAC,eAAe,CAAC,EACjB,mEAAmE,CACtE;CACJ,CAAA;AAED,6GAA6G;AAC7G,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,SAAsB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACxH,CAAC;AAED,gFAAgF;AAChF,MAAM,eAAe,GAAG,CAAC,IAAoB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;AAE1F,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CAAC,WAAkC;IACtE,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;IAChD,MAAM,KAAK,GAAG;QACV,OAAO,EAAE,SAAS,IAAI,oFAAoF;QAC1G,KAAK,EAAE,SAAS,IAAI,8CAA8C;QAClE,eAAe,EAAE,SAAS,IAAI,+GAA+G,IAAI,EAAE;KACtJ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACpB,OAAO,CAAC,iBAAiB,IAAI,qBAAqB,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC;SACvE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACpC,IAAI,CAAC,IAAI,CAAC,CAAA;AACnB,CAAC"}

package/dist/internal/permissions.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Permission calculation from explicit guild, member, role and channel data.
+ * Invariant: Results are checks for the supplied data, never action authorization, and Fluxer stays authoritative.
+ * Implements [SDK contracts: Delivery, requests and caches](/docs/SDK-CONTRACTS.md#delivery-requests-and-caches)
+ */
+import * as Effect from "effect/Effect";
+import type { ChannelOperationFailure } from "#sdk/channels";
+import type { GuildOperationFailure, GuildOperationOptions } from "#sdk/guilds";
+import { GuildOperationError } from "#sdk/guilds";
+import type { PermissionInput, PermissionTarget } from "#sdk/permissions";
+import type { ClientOwner } from "./client.js";
+/**
+ * Calculates Fluxer's raw guild, explicit-channel or thread permission bitfield from one validated local snapshot.
+ * A thread is calculated in its parent channel, matching upstream threadViewPermissions in
+ * packages/constants/src/ThreadPermissionUtils.ts at 4749eb7f
+ */
+export declare function calculatePermissions(input: PermissionInput): Effect.Effect<bigint, GuildOperationError>;
+/**
+ * Fetches independent guild, member, role, and optional channel observations, then calculates their raw bitfield.
+ * A thread channel adds a read of its parent channel, whose permissions the thread takes
+ *
+ * This always reads remotely without consulting local caches. Its deadline covers the whole composition, but the
+ * resulting observations are not transactional and do not establish access, hierarchy, timeouts, or action success
+ */
+export declare function fetchPermissions(owner: Pick<ClientOwner, "guild" | "channel" | "logical"> & {
+    readonly defaultTimeoutMs?: number;
+}, target: PermissionTarget, options?: GuildOperationOptions): Effect.Effect<bigint, GuildOperationFailure | ChannelOperationFailure>;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/internal/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/internal/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC,OAAO,KAAK,EAAE,uBAAuB,EAAqC,MAAM,eAAe,CAAA;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAe,MAAM,aAAa,CAAA;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAgQ9C;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAQvG;AAuED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC5B,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC,GAAG;IAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,EAClG,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,qBAAqB,GAChC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,GAAG,uBAAuB,CAAC,CAoDxE"}

package/dist/internal/permissions.js

@@ -0,0 +1,314 @@
+/**
+ * Permission calculation from explicit guild, member, role and channel data.
+ * Invariant: Results are checks for the supplied data, never action authorization, and Fluxer stays authoritative.
+ * Implements [SDK contracts: Delivery, requests and caches](/docs/SDK-CONTRACTS.md#delivery-requests-and-caches)
+ */
+import * as Effect from "effect/Effect";
+import { isThreadChannel } from "#sdk/channels";
+import { GuildOperationError, Permissions } from "#sdk/guilds";
+import { composedStepFacts } from "#sdk/api-errors";
+import { channelFetch } from "./channels.js";
+import { guildFetch, memberFetch, roleList } from "./guilds.js";
+import { identifier, record } from "./decode/primitives.js";
+import { readCaller, suspendInput, suspendMarked } from "./defects.js";
+import { InputValidationFailure, inputValidationFailure, unsupportedKeyFailure } from "#sdk/input-validation";
+const allPermissions = (1n << 64n) - 1n;
+const administrator = 1n << 3n;
+const unsigned64 = (value) => typeof value === "bigint" && value >= 0n && value <= allPermissions;
+const inputFailure = (operation, failure) => new GuildOperationError({ operation, reason: "input", outcome: "notDispatched", inputValidation: failure.detail });
+const timeoutFailure = () => new GuildOperationError({ operation: "permissions.fetch", reason: "timeout", outcome: "notDispatched" });
+// Each validator reads a caller field once, so the validated value is the one calculated
+function validateMember(value, guildId) {
+    if (!record(value) || value.guildId !== guildId)
+        return undefined;
+    const userId = value.userId;
+    const roleInput = value.roleIds;
+    if (!identifier(userId) || !Array.isArray(roleInput))
+        return undefined;
+    const roleIds = [];
+    const seen = new Set();
+    for (const roleId of roleInput) {
+        if (!identifier(roleId) || roleId === guildId || seen.has(roleId))
+            return undefined;
+        seen.add(roleId);
+        roleIds.push(roleId);
+    }
+    return { guildId, userId, roleIds };
+}
+function validateRoles(value, guildId, member) {
+    if (!Array.isArray(value))
+        return undefined;
+    const roles = new Map();
+    for (const role of value) {
+        if (!record(role) || role.guildId !== guildId)
+            return undefined;
+        const id = role.id;
+        const permissions = role.permissions;
+        if (!identifier(id) || !unsigned64(permissions) || roles.has(id))
+            return undefined;
+        roles.set(id, { id, guildId, permissions });
+    }
+    if (!roles.has(guildId) || member.roleIds.some((roleId) => !roles.has(roleId)))
+        return undefined;
+    return roles;
+}
+function decodeOverwrite(value, seen) {
+    if (!record(value))
+        return undefined;
+    const id = value.id;
+    const type = value.type;
+    const allow = value.allow;
+    const deny = value.deny;
+    if (!identifier(id) || (type !== "role" && type !== "member") || !unsigned64(allow) || !unsigned64(deny))
+        return undefined;
+    const key = `${type}:${id}`;
+    if (seen.has(key))
+        return undefined;
+    seen.add(key);
+    return { id, type, allow, deny };
+}
+function validateChannel(value, guildId) {
+    if (!record(value) || value.guildId !== guildId)
+        return undefined;
+    const id = value.id;
+    if (!identifier(id) || !("permissionOverwrites" in value))
+        return undefined;
+    const overwrites = value.permissionOverwrites;
+    if (!Array.isArray(overwrites))
+        return undefined;
+    const seen = new Set();
+    const decoded = [];
+    for (const overwrite of overwrites) {
+        const valid = decodeOverwrite(overwrite, seen);
+        if (!valid)
+            return undefined;
+        decoded.push(valid);
+    }
+    return { id, guildId, permissionOverwrites: decoded };
+}
+/** The parent channel ID of a thread in the guild, or undefined when the thread's guild or IDs are invalid */
+function threadParentId(value, guildId) {
+    if (!record(value) || value.guildId !== guildId || !identifier(value.id))
+        return undefined;
+    const parentId = value.parentId;
+    return identifier(parentId) ? parentId : undefined;
+}
+function validateChannels(channelInput, parentInput, guildId) {
+    if (channelInput === undefined || !isThreadChannel(channelInput)) {
+        if (parentInput !== undefined)
+            return inputValidationFailure("input.parentChannel", "relationship", "Permission parentChannel is supported only when channel is a thread");
+        if (channelInput === undefined)
+            return { channel: undefined, inThread: false };
+        const channel = validateChannel(channelInput, guildId);
+        if (!channel)
+            return inputValidationFailure("input.channel", "format", "Permission channel must match the guild and contain unique valid role or member overwrites");
+        return { channel, inThread: false };
+    }
+    // A thread has no overwrites of its own, so Fluxer calculates its permissions in the parent channel
+    const parentId = threadParentId(channelInput, guildId);
+    if (parentId === undefined)
+        return inputValidationFailure("input.channel", "format", "Permission thread must match the guild and contain decimal thread and parent channel IDs");
+    if (parentInput === undefined)
+        return inputValidationFailure("input.parentChannel", "required", "Permission parentChannel is required when channel is a thread, because a thread takes its parent's permissions");
+    const parent = validateChannel(parentInput, guildId);
+    if (!parent)
+        return inputValidationFailure("input.parentChannel", "format", "Permission parentChannel must match the guild and contain unique valid role or member overwrites");
+    if (parent.id !== parentId)
+        return inputValidationFailure("input.parentChannel", "relationship", "Permission parentChannel must be the channel that the thread's parentId names");
+    return { channel: parent, inThread: true };
+}
+function validateInput(value) {
+    if (!record(value))
+        return inputValidationFailure("input", "type", "Permission input must be an object");
+    const guildInput = value.guild;
+    if (!record(guildInput))
+        return inputValidationFailure("input.guild", "type", "Permission guild must be an object");
+    const guildId = guildInput.id;
+    if (!identifier(guildId))
+        return inputValidationFailure("input.guild.id", "format", "Permission guild ID must be a decimal string");
+    const ownerId = guildInput.ownerId;
+    if (!identifier(ownerId))
+        return inputValidationFailure("input.guild.ownerId", "format", "Permission guild owner ID must be a decimal string");
+    const guild = { id: guildId, ownerId };
+    const member = validateMember(value.member, guild.id);
+    if (!member)
+        return inputValidationFailure("input.member", "format", "Permission member must match the guild and contain a decimal user ID and unique non-default role IDs");
+    const roles = validateRoles(value.roles, guild.id, member);
+    if (!roles)
+        return inputValidationFailure("input.roles[]", "format", "Permission roles must be unique same-guild roles with unsigned 64-bit permissions and cover the member roles");
+    const channels = validateChannels(value.channel, value.parentChannel, guild.id);
+    if (channels instanceof InputValidationFailure)
+        return channels;
+    return { guild, member, roles, ...channels };
+}
+function applyOverwrite(permissions, overwrite) {
+    return (permissions & ~overwrite.deny) | overwrite.allow;
+}
+/** Fluxer's thread rule: SendMessages in a thread follows SendMessagesInThreads in its parent, whichever way it is set */
+function threadPermissions(parentPermissions) {
+    const withoutSend = parentPermissions & ~Permissions.SendMessages;
+    return (parentPermissions & Permissions.SendMessagesInThreads) === Permissions.SendMessagesInThreads
+        ? withoutSend | Permissions.SendMessages
+        : withoutSend;
+}
+function calculate(input) {
+    const { guild, member, roles, channel, inThread } = input;
+    if (member.userId === guild.ownerId)
+        return allPermissions;
+    let permissions = roles.get(guild.id).permissions;
+    for (const roleId of member.roleIds)
+        permissions |= roles.get(roleId).permissions;
+    if ((permissions & administrator) === administrator)
+        return allPermissions;
+    if (!channel)
+        return permissions;
+    const overwrites = channel.permissionOverwrites;
+    for (const overwrite of overwrites)
+        if (overwrite.type === "role" && overwrite.id === guild.id)
+            permissions = applyOverwrite(permissions, overwrite);
+    let roleAllow = 0n;
+    let roleDeny = 0n;
+    const memberRoles = new Set(member.roleIds);
+    for (const overwrite of overwrites)
+        if (overwrite.type === "role" && memberRoles.has(overwrite.id)) {
+            roleAllow |= overwrite.allow;
+            roleDeny |= overwrite.deny;
+        }
+    permissions = (permissions & ~roleDeny) | roleAllow;
+    for (const overwrite of overwrites)
+        if (overwrite.type === "member" && overwrite.id === member.userId)
+            permissions = applyOverwrite(permissions, overwrite);
+    return inThread ? threadPermissions(permissions) : permissions;
+}
+/**
+ * Calculates Fluxer's raw guild, explicit-channel or thread permission bitfield from one validated local snapshot.
+ * A thread is calculated in its parent channel, matching upstream threadViewPermissions in
+ * packages/constants/src/ThreadPermissionUtils.ts at 4749eb7f
+ */
+export function calculatePermissions(input) {
+    // Only reading the caller input is marked, so a fault in the calculation stays an SDK fault
+    return suspendMarked(() => {
+        const validated = readCaller(() => validateInput(input));
+        return validated instanceof InputValidationFailure
+            ? Effect.fail(inputFailure("permissions.calculate", validated))
+            : Effect.succeed(calculate(validated));
+    });
+}
+function validateTarget(value) {
+    if (!record(value))
+        return inputValidationFailure("target", "type", "Permission target must be an object");
+    const unsupported = unsupportedKeyFailure(value, ["guildId", "userId", "channelId"], "target", "the permission target");
+    if (unsupported)
+        return unsupported;
+    const guildId = value.guildId;
+    if (!identifier(guildId))
+        return inputValidationFailure("target.guildId", "format", "Guild IDs must be decimal strings");
+    const userId = value.userId;
+    if (!identifier(userId))
+        return inputValidationFailure("target.userId", "format", "User IDs must be decimal strings");
+    const channelId = value.channelId;
+    if (channelId !== undefined && !identifier(channelId))
+        return inputValidationFailure("target.channelId", "format", "Channel IDs must be decimal strings");
+    return { guildId, userId, channelId };
+}
+function validateOptions(value) {
+    if (value === undefined)
+        return {};
+    if (!record(value))
+        return inputValidationFailure("options", "type", "Permission fetch options must be an object");
+    const unsupported = unsupportedKeyFailure(value, ["timeoutMs", "signal"], "options", "the permission fetch options");
+    if (unsupported)
+        return unsupported;
+    const signal = value.signal;
+    if (signal !== undefined &&
+        (!record(signal) ||
+            typeof signal.aborted !== "boolean" ||
+            typeof signal.addEventListener !== "function" ||
+            typeof signal.removeEventListener !== "function"))
+        return inputValidationFailure("options.signal", "type", "Permission fetch signal must be an AbortSignal");
+    const timeoutMs = value.timeoutMs;
+    if (timeoutMs !== undefined &&
+        (typeof timeoutMs !== "number" ||
+            !Number.isSafeInteger(timeoutMs) ||
+            timeoutMs <= 0 ||
+            timeoutMs > 2_147_483_647))
+        return inputValidationFailure("options.timeoutMs", "range", "Permission fetch timeout must be an integer from 1 through 2,147,483,647 ms");
+    // Keep only the validated timeout: The requests use their own remaining deadlines
+    return timeoutMs === undefined ? {} : { timeoutMs };
+}
+function remainingOptions(deadline, now) {
+    const remaining = Math.floor(deadline - now());
+    return remaining > 0 ? { timeoutMs: remaining } : undefined;
+}
+function remoteCalculationFailure(error) {
+    return new GuildOperationError({
+        operation: "permissions.fetch",
+        reason: error.reason === "input" ? "response" : error.reason,
+        outcome: error.outcome,
+        status: error.status,
+        retryAfterMs: error.retryAfterMs,
+        apiError: error.apiError,
+        ...composedStepFacts(error),
+    });
+}
+/**
+ * Fetches independent guild, member, role, and optional channel observations, then calculates their raw bitfield.
+ * A thread channel adds a read of its parent channel, whose permissions the thread takes
+ *
+ * This always reads remotely without consulting local caches. Its deadline covers the whole composition, but the
+ * resulting observations are not transactional and do not establish access, hierarchy, timeouts, or action success
+ */
+export function fetchPermissions(owner, target, options) {
+    // Reading and validating the caller target and options is marked as application input
+    return suspendInput(() => {
+        const targetSnapshot = validateTarget(target);
+        if (targetSnapshot instanceof InputValidationFailure)
+            return Effect.fail(inputFailure("permissions.fetch", targetSnapshot));
+        const validatedOptions = validateOptions(options);
+        if (validatedOptions instanceof InputValidationFailure)
+            return Effect.fail(inputFailure("permissions.fetch", validatedOptions));
+        const timedOut = () => Effect.fail(timeoutFailure());
+        return Effect.gen(function* () {
+            const now = () => owner.logical.now();
+            const deadline = now() + (validatedOptions.timeoutMs ?? owner.defaultTimeoutMs ?? 30_000);
+            const requestOptions = () => remainingOptions(deadline, now);
+            const guildOptions = requestOptions();
+            if (!guildOptions)
+                return yield* timedOut();
+            const guild = yield* owner.guild("guilds.fetch", () => guildFetch(targetSnapshot.guildId), guildOptions);
+            const memberOptions = requestOptions();
+            if (!memberOptions)
+                return yield* timedOut();
+            const member = yield* owner.guild("members.fetch", () => memberFetch(targetSnapshot), memberOptions);
+            const roleOptions = requestOptions();
+            if (!roleOptions)
+                return yield* timedOut();
+            const roles = yield* owner.guild("roles.fetchAll", () => roleList(targetSnapshot.guildId), roleOptions);
+            let channel;
+            const channelId = targetSnapshot.channelId;
+            if (channelId !== undefined) {
+                const channelOptions = requestOptions();
+                if (!channelOptions)
+                    return yield* timedOut();
+                channel = yield* owner.channel("channels.fetch", () => channelFetch(channelId), channelOptions);
+            }
+            // A thread takes its permissions from its parent channel, read under the same deadline
+            let parentChannel;
+            if (isThreadChannel(channel)) {
+                const parentId = channel.parentId;
+                const parentOptions = requestOptions();
+                if (!parentOptions)
+                    return yield* timedOut();
+                parentChannel = yield* owner.channel("channels.fetch", () => channelFetch(parentId), parentOptions);
+            }
+            return yield* calculatePermissions({
+                guild,
+                member,
+                roles,
+                ...(channel === undefined ? {} : { channel }),
+                ...(parentChannel === undefined ? {} : { parentChannel }),
+            }).pipe(Effect.mapError(remoteCalculationFailure));
+        });
+    });
+}
+//# sourceMappingURL=permissions.js.map