@nmnmcc/ability 0.3.0 → 1.0.0

package/src/Policy.ts

@@ -25,35 +25,41 @@
  *   this kind?"
  * - {@link permittedFields}: the fields that the policy lets a request use.
  *
+ * Each of them also takes the request first and the policy later. In a `pipe`,
+ * the policy gives the domain. Outside a `pipe`, give the domain by hand, as
+ * in `Policy.decide<typeof App>(request)`. Without it the request has the type
+ * `never`, so TypeScript can still check it.
+ *
  * A policy without predicates can become JSON with {@link schema}.
  *
  * @stability stable
  * @since 0.3.0
  */
-import type * as Effect from "effect/Effect"
-import type * as Equal from "effect/Equal"
-import type * as Inspectable from "effect/Inspectable"
+// A policy keeps the error type and the service type of its predicates in the
+// public types. The code below works on the nodes with no types, where they
+// are `unknown`, so the language service check for `unknown` in an Effect is
+// off here.
+// @effect-diagnostics anyUnknownInErrorContext:off
+import type * as Context from "effect/Context"
+import * as Data from "effect/Data"
+import * as Arr from "effect/Array"
+import * as Chunk from "effect/Chunk"
+import * as Effect from "effect/Effect"
+import { dual } from "effect/Function"
+import * as HashMap from "effect/HashMap"
+import * as HashSet from "effect/HashSet"
+import * as Option from "effect/Option"
+import { hasProperty } from "effect/Predicate"
 import type * as Pipeable from "effect/Pipeable"
-import type * as Schema from "effect/Schema"
-import type * as Condition from "./Condition.ts"
-import type * as Decision from "./Decision.ts"
-import type * as Domain from "./Domain.ts"
-import * as internal from "./internal/policy.ts"
-import type * as Rule from "./Rule.ts"
-
-/**
- * @stability stable
- * @category type IDs
- * @since 0.3.0
- */
-export const TypeId: "~@nmnmcc/ability/Policy" = internal.TypeId
-
-/**
- * @stability stable
- * @category type IDs
- * @since 0.3.0
- */
-export type TypeId = typeof TypeId
+import * as Ref from "effect/Ref"
+import * as Schema from "effect/Schema"
+import * as SchemaIssue from "effect/SchemaIssue"
+import * as SchemaTransformation from "effect/SchemaTransformation"
+import * as Condition from "./Condition.ts"
+import * as Decision from "./Decision.ts"
+import * as Domain from "./Domain.ts"
+import * as Resource from "./Resource.ts"
+import * as Rule from "./Rule.ts"
 
 /**
  * @stability stable
@@ -124,6 +130,38 @@ export interface CeilingNode {
  */
 export type Node = RulesNode | AllNode | AnyNode | FirstOfNode | CeilingNode
 
+/**
+ * The tree of a policy with the types of its predicates and its domain `D`.
+ * Each rule and each child has the types too, and `"~Node"` is only in the types. A node made by
+ * hand does not have it. So the node of one policy, or a part of it, can not
+ * go into a policy with other types.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export type TypedNode<E = never, R = never, O = never, D = any> = (
+	| {
+			readonly _tag: "Rules"
+			readonly algorithm: Algorithm
+			// The rules may read different values, so a node keeps no one type of
+			// what they read. With `never`, a condition taken from a node fits no
+			// rule that reads a value or a principal.
+			readonly rules: ReadonlyArray<Rule.Rule<E, R, O, D, never>>
+	  }
+	| {
+			readonly _tag: "All" | "Any" | "FirstOf"
+			readonly policies: ReadonlyArray<TypedNode<E, R, O, D>>
+	  }
+	| {
+			readonly _tag: "Ceiling"
+			readonly cap: TypedNode<E, R, O, D>
+			readonly policy: TypedNode<E, R, O, D>
+	  }
+) & {
+	readonly "~Node": Condition.Variance<E, R, O>
+}
+
 /**
  * A policy for the domain `D`. `E`, `R` and `O` come from the conditions of
  * its rules. See `Condition.Condition`.
@@ -133,11 +171,15 @@ export type Node = RulesNode | AllNode | AnyNode | FirstOfNode | CeilingNode
  * @since 0.3.0
  */
 export interface Policy<D extends Domain.Any, E = never, R = never, O = never>
-	extends Equal.Equal, Inspectable.Inspectable, Pipeable.Pipeable {
-	readonly [TypeId]: TypeId
+	extends Pipeable.Pipeable {
 	readonly domain: D
-	readonly node: Node
-	readonly "~Policy"?: Condition.Variance<E, R, O>
+	readonly node: TypedNode<E, R, O, D>
+	readonly "~Policy": Condition.Variance<E, R, O>
+	/**
+	 * Only in the types. A policy reads the values and the principal of its
+	 * domain, so a policy of one domain is not a policy of a wider domain.
+	 */
+	readonly "~Domain": (domain: D) => D
 }
 
 /**
@@ -209,12 +251,53 @@ export type Target<D> = {
 	[K in Domain.Kind<D>]: {
 		readonly action: Domain.ActionOf<D, K>
 		readonly resource: Domain.ValueOf<D, K>
-		readonly field?: Condition.FieldPath<Domain.DataOf<D, K>>
+		readonly field?: Condition.FieldSelector<Domain.DataOf<D, K>>
+		/** A target has a resource value or a kind, never both. */
+		readonly kind?: never
+	}
+}[Domain.Kind<D>]
+
+/**
+ * A {@link Target} with no field. Each kind keeps its own actions.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type FieldlessTarget<D> = {
+	[K in Domain.Kind<D>]: {
+		readonly action: Domain.ActionOf<D, K>
+		readonly resource: Domain.ValueOf<D, K>
+		readonly kind?: never
 	}
 }[Domain.Kind<D>]
 
 /**
- * One act on one kind of resource, with no value.
+ * A scope: a part of a kind, as a condition on its values. It gets a builder
+ * with the types of the kind and of the principal, like the condition of a
+ * rule. A scope is plain data, so it can not have a predicate.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export type Scope<D, K extends string> = (
+	builder: Condition.Builder<
+		Domain.DataOf<D, K>,
+		Domain.ValueOf<D, K>,
+		Domain.Principal<D>
+	>,
+) => Condition.Condition<
+	never,
+	never,
+	never,
+	Condition.Reads<Domain.ValueOf<D, K>, Domain.Principal<D>>
+>
+
+/**
+ * One act on one kind of resource, with no value. With `within`, the target is
+ * only the values of the kind in the scope. Without it, the target is every
+ * value of the kind.
  *
  * @stability stable
  * @category models
@@ -224,7 +307,11 @@ export type KindTarget<D> = {
 	[K in Domain.Kind<D>]: {
 		readonly action: Domain.ActionOf<D, K>
 		readonly kind: K
-		readonly field?: Condition.FieldPath<Domain.DataOf<D, K>>
+		readonly field?: Condition.FieldSelector<Domain.DataOf<D, K>>
+		/** The part of the kind. See {@link Scope}. */
+		readonly within?: Scope<D, K>
+		/** A target has a resource value or a kind, never both. */
+		readonly resource?: never
 	}
 }[Domain.Kind<D>]
 
@@ -237,6 +324,17 @@ export type KindTarget<D> = {
  */
 export type Request<D> = Target<D> & { readonly principal: Domain.Principal<D> }
 
+/**
+ * A {@link Request} with no field.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type FieldlessRequest<D> = FieldlessTarget<D> & {
+	readonly principal: Domain.Principal<D>
+}
+
 /**
  * A request about a kind of resource, with no value.
  *
@@ -301,6 +399,216 @@ export interface Options {
 	readonly algorithm?: Algorithm
 }
 
+const nodes = Data.taggedEnum<Node>()
+
+/**
+ * The most nodes that the JSON form of a policy may have. A tree may use one
+ * child in many places, and the JSON form writes it out each time, so a small
+ * tree may have a very large JSON form.
+ */
+const maxEncodedNodes = 100_000
+
+/**
+ * The number of nodes of the JSON form of a condition. A shared child counts
+ * one time for each place, as the JSON form writes it out each time.
+ */
+const conditionSize = (ast: Ast, memo: Map<Ast, number>): number =>
+	remember(memo, ast, () => {
+		switch (ast._tag) {
+			case "And":
+			case "Or":
+				return Arr.reduce(
+					ast.conditions,
+					1,
+					(size, child) => size + conditionSize(child, memo),
+				)
+			case "Not":
+				return 1 + conditionSize(ast.condition, memo)
+			default:
+				return 1
+		}
+	})
+
+/**
+ * The number of nodes of the JSON form of a tree, with the conditions of its
+ * rules.
+ */
+const encodedSize = (
+	node: Node,
+	memo: Map<Node, number> = new Map(),
+	conditions: Map<Ast, number> = new Map(),
+): number =>
+	remember(memo, node, () => {
+		switch (node._tag) {
+			case "Rules":
+				return Arr.reduce(
+					node.rules,
+					1,
+					(size, value) =>
+						size +
+						1 +
+						(value.when === undefined
+							? 0
+							: conditionSize(value.when as Ast, conditions)),
+				)
+			case "All":
+			case "Any":
+			case "FirstOf":
+				return Arr.reduce(
+					node.policies,
+					1,
+					(size, child) => size + encodedSize(child, memo, conditions),
+				)
+			case "Ceiling":
+				return (
+					1 +
+					encodedSize(node.cap, memo, conditions) +
+					encodedSize(node.policy, memo, conditions)
+				)
+		}
+	})
+
+/** Gives the JSON form of a tree, when it is not too large. */
+const encodeTree = (node: Node): EncodedNode => {
+	if (encodedSize(node) > maxEncodedNodes) {
+		throw new globalThis.Error(tooLargeMessage)
+	}
+	return encodeNode(node)
+}
+
+const tooLargeMessage = `The JSON form of this policy would have more than ${String(maxEncodedNodes)} nodes`
+
+const encodeNode = (node: Node): EncodedNode => {
+	switch (node._tag) {
+		case "Rules":
+			return {
+				_tag: "Rules",
+				algorithm: node.algorithm,
+				// The domain of a rule is not in its JSON form.
+				rules: node.rules.map(
+					({ domain: _domain, ...value }) => ({ ...value }) as EncodedRule,
+				),
+			}
+		case "All":
+		case "Any":
+		case "FirstOf":
+			return { _tag: node._tag, policies: node.policies.map(encodeNode) }
+		case "Ceiling":
+			return {
+				_tag: "Ceiling",
+				cap: encodeNode(node.cap),
+				policy: encodeNode(node.policy),
+			}
+	}
+}
+
+/**
+ * The tree of a policy as a value that `JSON.stringify` keeps with no loss.
+ * See `Condition.toJsonValue`.
+ */
+const jsonNode = (node: EncodedNode, meta: Schema.Top | undefined): unknown => {
+	const json = (child: EncodedNode) => jsonNode(child, meta)
+	switch (node._tag) {
+		case "Rules":
+			return {
+				...node,
+				rules: Arr.map(node.rules, (value) => ({
+					...value,
+					...(value.when === undefined
+						? {}
+						: { when: Condition.toJsonValue(value.when as Ast) }),
+					// The `meta` of a rule is a decoded value. Its JSON form comes
+					// from the `meta` Schema of the domain, as in `schema`.
+					...(value.meta === undefined || meta === undefined
+						? {}
+						: {
+								meta: Schema.encodeUnknownSync(
+									meta as Schema.Codec<unknown, unknown>,
+								)(value.meta),
+							}),
+				})),
+			}
+		case "All":
+		case "Any":
+		case "FirstOf":
+			return { ...node, policies: Arr.map(node.policies, json) }
+		case "Ceiling":
+			return { ...node, cap: json(node.cap), policy: json(node.policy) }
+	}
+}
+
+/**
+ * The class of every policy value. Two policies of one domain with the same
+ * tree are equal. As JSON, a policy is its tree.
+ */
+class PolicyData extends Data.Class<{
+	readonly domain: Domain.Any
+	readonly node: Node
+}> {
+	toJSON(): unknown {
+		return jsonNode(encodeTree(this.node), this.domain.meta)
+	}
+}
+
+/** The node of a policy, with no types, for the code below. */
+const nodeOf = (policy: Any): Node => policy.node as Node
+
+const fromNode = (domain: Domain.Any, node: Node): any =>
+	new PolicyData({ domain, node })
+
+/**
+ * Makes a policy from a list of rules.
+ *
+ * @stability stable
+ * @category constructors
+ * @since 0.3.0
+ */
+export const rules: <
+	D extends Domain.Any,
+	Rules extends Rule.Rule<any, any, any, D, never>,
+>(
+	domain: D,
+	rules: Iterable<Rules>,
+	options?: Options,
+) => Policy<
+	D,
+	Rule.Error<Rules>,
+	Rule.Services<Rules>,
+	Rule.OpaqueOf<Rules>
+> = (domain, values, options) => {
+	const node = nodes.Rules({
+		algorithm: options?.algorithm ?? "denyOverrides",
+		rules: Array.from(values),
+	})
+	// A value that is not a rule, such as a copy of a rule made with a spread,
+	// may keep the type fields of another rule, and it does not work in a
+	// generator. It is a mistake in the code, so it is a defect.
+	if (!Arr.every(node.rules, Rule.isRule)) {
+		throw new globalThis.Error("A value in the list is not a rule")
+	}
+	// A rule from a builder of another domain is a mistake in the code, so it
+	// is a defect. Two domains may have the same types, so the types do not
+	// find it.
+	if (
+		Arr.some(node.rules, (value) => {
+			const origin = Rule.domainOf(value)
+			return origin !== undefined && origin !== domain
+		})
+	) {
+		throw new globalThis.Error(
+			"A rule comes from the builder of another domain",
+		)
+	}
+	// A rule from `Rule.make` keeps no domain, so its names are checked here.
+	const issues = validate(domain, encodeNode(node))
+	if (issues.length > 0) {
+		throw new globalThis.Error(
+			`A rule does not fit the domain: ${issues.map((issue) => issue.issue).join("; ")}`,
+		)
+	}
+	return fromNode(domain, node)
+}
+
 /**
  * Makes a policy from a generator function that gives rules. It is pure and it
  * gives its result at once.
@@ -319,27 +627,25 @@ export interface Options {
  * @category constructors
  * @since 0.3.0
  */
-export const define: <D extends Domain.Any>(
-	domain: D,
-	options?: Options,
-) => <Rules extends Rule.Any, A>(
-	body: (builder: Rule.Builder<D>) => Generator<Rules, A, unknown>,
-) => Policy<D, Rule.Error<Rules>, Rule.Services<Rules>, Rule.OpaqueOf<Rules>> =
-	internal.define as never
-
-/**
- * Makes a policy from a list of rules.
- *
- * @stability stable
- * @category constructors
- * @since 0.3.0
- */
-export const rules: <D extends Domain.Any, Rules extends Rule.Any>(
-	domain: D,
-	rules: Iterable<Rules>,
-	options?: Options,
-) => Policy<D, Rule.Error<Rules>, Rule.Services<Rules>, Rule.OpaqueOf<Rules>> =
-	internal.rules
+export const define =
+	<D extends Domain.Any>(domain: D, options?: Options) =>
+	<Rules extends Rule.Rule<any, any, any, D, never>, A>(
+		body: (builder: Rule.Builder<D>) => Generator<Rules, A, unknown>,
+	): Policy<
+		D,
+		Rule.Error<Rules>,
+		Rule.Services<Rules>,
+		Rule.OpaqueOf<Rules>
+	> => {
+		const iterator = body(Rule.builder(domain))
+		// Each rule goes back into the generator, as `yield*` gives it.
+		const collected = Arr.unfold(iterator.next(), (state) =>
+			state.done === true
+				? Option.none()
+				: Option.some([state.value, iterator.next(state.value)] as const),
+		)
+		return rules(domain, collected, options)
+	}
 
 /**
  * A policy with no rules. It is not applicable to any request.
@@ -348,8 +654,8 @@ export const rules: <D extends Domain.Any, Rules extends Rule.Any>(
  * @category constructors
  * @since 0.3.0
  */
-export const empty: <D extends Domain.Any>(domain: D) => Policy<D> =
-	internal.empty
+export const empty = <D extends Domain.Any>(domain: D): Policy<D> =>
+	rules(domain, [])
 
 type Combined<D extends Domain.Any, Ps extends ReadonlyArray<Any>> = Policy<
 	D,
@@ -358,6 +664,69 @@ type Combined<D extends Domain.Any, Ps extends ReadonlyArray<Any>> = Policy<
 	OpaqueOf<Ps[number]>
 >
 
+const sameDomain = (policies: ReadonlyArray<Any>): Domain.Any => {
+	// A copy of a policy made with a spread may keep the type fields of another
+	// policy. Only a policy value goes into a tree.
+	if (!Arr.every(policies, isPolicy)) {
+		throw new globalThis.Error("A value in the list is not a policy")
+	}
+	const domain = policies[0]!.domain
+	if (!Arr.every(policies, (policy) => policy.domain === domain)) {
+		throw new globalThis.Error(
+			"Policies from two domains can not be put together",
+		)
+	}
+	return domain
+}
+
+/**
+ * The most levels in a policy tree. A walk over a tree calls itself for each
+ * level, so a much deeper tree could fill the stack and stop a check.
+ */
+const maxDepth = 256
+
+/** The number of levels of a policy tree. */
+const heightOf = (node: Node, memo: Map<Node, number> = new Map()): number =>
+	remember(memo, node, () => {
+		const height = (child: Node) => heightOf(child, memo)
+		switch (node._tag) {
+			case "Rules":
+				return 1
+			case "All":
+			case "Any":
+			case "FirstOf":
+				return (
+					1 +
+					Arr.reduce(node.policies, 0, (top, child) =>
+						Math.max(top, height(child)),
+					)
+				)
+			case "Ceiling":
+				return 1 + Math.max(height(node.cap), height(node.policy))
+		}
+	})
+
+/**
+ * Makes a policy from a new node. Its children come from policies, so each
+ * has at most `maxDepth` levels, and the walk of `heightOf` is safe.
+ */
+const fromCombined = (domain: Domain.Any, node: Node): any => {
+	if (heightOf(node) > maxDepth) {
+		throw new globalThis.Error(
+			`A policy tree may have at most ${maxDepth} levels`,
+		)
+	}
+	return fromNode(domain, node)
+}
+
+const combine =
+	(tag: "All" | "Any" | "FirstOf") =>
+	(policies: ReadonlyArray<Any>): any =>
+		fromCombined(
+			sameDomain(policies),
+			nodes[tag]({ policies: policies.map(nodeOf) }),
+		)
+
 /**
  * Every policy must allow, and one deny is enough to deny. With some policies
  * not applicable and none that deny, the result is not applicable.
@@ -370,7 +739,7 @@ export const all: <
 	const Ps extends readonly [Policy<any, any, any, any>, ...Array<Any>],
 >(
 	policies: Ps,
-) => Combined<DomainOf<Ps[0]>, Ps> = internal.all
+) => Combined<DomainOf<Ps[0]>, Ps> = combine("All")
 
 /**
  * One allow is enough. Without an allow, one deny gives a deny.
@@ -383,7 +752,7 @@ export const any: <
 	const Ps extends readonly [Policy<any, any, any, any>, ...Array<Any>],
 >(
 	policies: Ps,
-) => Combined<DomainOf<Ps[0]>, Ps> = internal.any
+) => Combined<DomainOf<Ps[0]>, Ps> = combine("Any")
 
 /**
  * The first policy that allows or denies gives the answer.
@@ -396,7 +765,7 @@ export const firstOf: <
 	const Ps extends readonly [Policy<any, any, any, any>, ...Array<Any>],
 >(
 	policies: Ps,
-) => Combined<DomainOf<Ps[0]>, Ps> = internal.firstOf
+) => Combined<DomainOf<Ps[0]>, Ps> = combine("FirstOf")
 
 /**
  * Puts a limit on a policy. A deny from `cap` always wins. An allow from `cap`
@@ -414,7 +783,408 @@ export const ceiling: {
 		policy: Policy<D, E, R, O>,
 		cap: Policy<D, E2, R2, O2>,
 	): Policy<D, E | E2, R | R2, O | O2>
-} = internal.ceiling
+} = dual(2, (policy: Any, cap: Any): any =>
+	fromCombined(
+		sameDomain([policy, cap]),
+		nodes.Ceiling({ cap: nodeOf(cap), policy: nodeOf(policy) }),
+	),
+)
+
+/**
+ * Gives the answer for a key from a memo, or works it out and keeps it. One
+ * node may be a child of many nodes, so each walk over a tree keeps its work
+ * on a node in a memo that the walk makes for itself. No memo lives longer
+ * than one call.
+ *
+ * The memo is a native `Map`, because it must find a node by the node itself.
+ * An Effect `HashMap` finds a key by `Equal`, and the nodes are Effect data,
+ * so it would hash the whole structure of a node, and a shared child again for
+ * each path to it.
+ */
+const remember = <K, A>(memo: Map<K, A>, key: K, work: () => A): A => {
+	// A result may be `undefined`, as the result of a fold may be, so the test
+	// asks for the key.
+	if (memo.has(key)) {
+		return memo.get(key) as A
+	}
+	const result = work()
+	memo.set(key, result)
+	return result
+}
+
+/** The memos of one walk over a policy tree. */
+interface TreeMemo {
+	readonly done: Map<Node, Node>
+	readonly predicates: Map<Node, boolean>
+}
+
+const provideNode = (
+	node: Node,
+	context: Context.Context<never>,
+	memo: TreeMemo = { done: new Map(), predicates: new Map() },
+): Node =>
+	// A node with no predicate needs no services, and it stays the same node.
+	// One node may be a child of many nodes, and it gives one new node.
+	!nodeHasPredicate(node, memo.predicates)
+		? node
+		: remember(memo.done, node, () => provideOnce(node, context, memo))
+
+const provideOnce = (
+	node: Node,
+	context: Context.Context<never>,
+	memo: TreeMemo,
+): Node => {
+	switch (node._tag) {
+		case "Rules":
+			return nodes.Rules({
+				algorithm: node.algorithm,
+				rules: node.rules.map((value) =>
+					value.when === undefined || !Condition.hasPredicate(value.when)
+						? value
+						: Rule.make({
+								...value,
+								when: Condition.provideContext(value.when, context as never),
+							}),
+				),
+			})
+		case "All":
+		case "Any":
+		case "FirstOf":
+			return nodes[node._tag]({
+				policies: Arr.map(node.policies, (child) =>
+					provideNode(child, context, memo),
+				),
+			})
+		case "Ceiling":
+			return nodes.Ceiling({
+				cap: provideNode(node.cap, context, memo),
+				policy: provideNode(node.policy, context, memo),
+			})
+	}
+}
+
+/**
+ * Gives the services in `context` to every predicate of a policy, so the
+ * policy needs no services when it runs.
+ *
+ * @stability stable
+ * @category services
+ * @since 1.0.0
+ */
+export const provideContext: {
+	<R>(
+		context: Context.Context<R>,
+	): <D extends Domain.Any, E, O>(
+		policy: Policy<D, E, R, O>,
+	) => Policy<D, E, never, O>
+	<D extends Domain.Any, E, R, O>(
+		policy: Policy<D, E, R, O>,
+		context: Context.Context<R>,
+	): Policy<D, E, never, O>
+} = dual(2, (policy: Any, context: Context.Context<never>): any =>
+	fromNode(policy.domain, provideNode(nodeOf(policy), context)),
+)
+
+// Decisions
+
+interface DecideContext {
+	readonly action: string
+	readonly kind: string
+	readonly field: string | undefined
+	readonly input: Condition.Input
+	/** The resource of the kind, for the fields that a rule may grant. */
+	readonly descriptor: Resource.Descriptor
+	/** The rules that were tested, for {@link explain}. */
+	readonly trace: Ref.Ref<Chunk.Chunk<Step>> | undefined
+	readonly predicates: Map<Node, boolean>
+	/**
+	 * The decisions of nodes with no predicates. One node may be a child of
+	 * many nodes, and its decision is the same each time, so it is made only
+	 * one time. A tree with shared nodes may have very many paths.
+	 */
+	readonly decisions: Map<Node, Decision.Decision>
+}
+
+const ruleApplies = (
+	value: Rule.Any,
+	context: DecideContext,
+	path: ReadonlyArray<number>,
+): Effect.Effect<boolean, unknown, unknown> => {
+	if (!Rule.matchesTarget(value, context)) {
+		return Effect.succeed(false)
+	}
+	const test =
+		value.when === undefined
+			? Effect.succeed(true)
+			: // A rule of a node keeps no type of what it reads. The decision gives
+				// it the value and the principal of the request.
+				Condition.evaluate(value.when as Condition.Any, context.input)
+	const trace = context.trace
+	return trace === undefined
+		? test
+		: Effect.tap(test, (applies) =>
+				// A chunk adds a step with no copy of the steps before.
+				Ref.update(trace, Chunk.append({ path, rule: value, applies })),
+			)
+}
+
+const fromRule = (value: Rule.Any): Decision.Decision =>
+	value._tag === "Allow"
+		? Decision.Allow({ rule: value })
+		: value.reason === undefined
+			? Decision.Deny({ rule: value })
+			: Decision.Deny({ rule: value, reason: value.reason })
+
+/** Gives the first rule that applies, in order. */
+const firstApplying = (
+	candidates: ReadonlyArray<readonly [Rule.Any, number]>,
+	context: DecideContext,
+	path: ReadonlyArray<number>,
+): Effect.Effect<Option.Option<Rule.Any>, unknown, unknown> =>
+	Effect.map(
+		Effect.findFirst(candidates, ([value, index]) =>
+			ruleApplies(value, context, [...path, index]),
+		),
+		Option.map(([value]) => value),
+	)
+
+/** Gives the first result that is found, and tests `next` only when none is. */
+const orElse = <A, E, R>(
+	first: Effect.Effect<Option.Option<A>, E, R>,
+	next: () => Effect.Effect<Option.Option<A>, E, R>,
+): Effect.Effect<Option.Option<A>, E, R> =>
+	Effect.filterOrElse(first, Option.isSome, next)
+
+const decideRules = (
+	node: RulesNode,
+	context: DecideContext,
+	path: ReadonlyArray<number>,
+): Effect.Effect<Decision.Decision, unknown, unknown> => {
+	const indexed = Arr.map(node.rules, (value, index) => [value, index] as const)
+	const denies = Arr.filter(indexed, ([value]) => value._tag === "Deny")
+	const allows = Arr.filter(indexed, ([value]) => value._tag === "Allow")
+	const first = (candidates: ReadonlyArray<readonly [Rule.Any, number]>) =>
+		firstApplying(candidates, context, path)
+	const found = (() => {
+		switch (node.algorithm) {
+			case "denyOverrides":
+				return orElse(first(denies), () => first(allows))
+			case "permitOverrides":
+				return orElse(first(allows), () => first(denies))
+			case "firstApplicable":
+				return first(indexed)
+			case "lastApplicable":
+				return first(Arr.reverse(indexed))
+		}
+	})()
+	return Effect.map(
+		found,
+		Option.match({ onNone: () => Decision.NotApplicable, onSome: fromRule }),
+	)
+}
+
+const decideNode = (
+	node: Node,
+	context: DecideContext,
+	path: ReadonlyArray<number>,
+): Effect.Effect<Decision.Decision, unknown, unknown> => {
+	// A predicate that the request may use must run each time. A predicate of
+	// a rule for another action, kind or field never runs, so the decision may
+	// be kept. A trace keeps the steps of a node only the first time, so a
+	// shared tree does not give a step for each path to a node.
+	if (usesPredicate(node, context)) {
+		return decideOnce(node, context, path)
+	}
+	const cached = context.decisions.get(node)
+	return cached !== undefined
+		? Effect.succeed(cached)
+		: Effect.tap(decideOnce(node, context, path), (decision) =>
+				Effect.sync(() => context.decisions.set(node, decision)),
+			)
+}
+
+/** The next step of a walk over children: stop with a decision, or go on. */
+type WalkStep<S> =
+	| { readonly _tag: "Stop"; readonly decision: Decision.Decision }
+	| { readonly _tag: "Next"; readonly state: S }
+
+/**
+ * Decides the children in order. After each child, `step` stops with a
+ * decision, or gives the state for the next child. After the last child,
+ * `end` gives the decision. A child after a stop is not decided, so its
+ * predicates do not run.
+ */
+const walkChildren = <S>(
+	children: ReadonlyArray<Node>,
+	context: DecideContext,
+	path: ReadonlyArray<number>,
+	start: S,
+	step: (state: S, decision: Decision.Decision) => WalkStep<S>,
+	end: (state: S) => Decision.Decision,
+): Effect.Effect<Decision.Decision, unknown, unknown> => {
+	const go = (
+		index: number,
+		state: S,
+	): Effect.Effect<Decision.Decision, unknown, unknown> =>
+		index === children.length
+			? Effect.succeed(end(state))
+			: Effect.flatMap(
+					decideNode(children[index]!, context, [...path, index]),
+					(decision) => {
+						const next = step(state, decision)
+						return next._tag === "Stop"
+							? Effect.succeed(next.decision)
+							: go(index + 1, next.state)
+					},
+				)
+	return go(0, start)
+}
+
+const stop = (decision: Decision.Decision): WalkStep<never> => ({
+	_tag: "Stop",
+	decision,
+})
+
+const next = <S>(state: S): WalkStep<S> => ({ _tag: "Next", state })
+
+const decideOnce = (
+	node: Node,
+	context: DecideContext,
+	path: ReadonlyArray<number>,
+): Effect.Effect<Decision.Decision, unknown, unknown> => {
+	switch (node._tag) {
+		case "Rules":
+			return decideRules(node, context, path)
+		case "All":
+			// One deny is enough to deny. Every child must allow.
+			return walkChildren(
+				node.policies,
+				context,
+				path,
+				{
+					firstAllow: Option.none<Decision.Decision>(),
+					allAllow: node.policies.length > 0,
+				},
+				(state, decision) =>
+					decision._tag === "Deny"
+						? stop(decision)
+						: next({
+								firstAllow: Option.orElse(state.firstAllow, () =>
+									decision._tag === "Allow"
+										? Option.some(decision)
+										: Option.none(),
+								),
+								allAllow: state.allAllow && decision._tag === "Allow",
+							}),
+				(state) =>
+					state.allAllow
+						? Option.getOrElse(state.firstAllow, () => Decision.NotApplicable)
+						: Decision.NotApplicable,
+			)
+		case "Any":
+			// One allow is enough. Without one, the first deny denies.
+			return walkChildren(
+				node.policies,
+				context,
+				path,
+				Option.none<Decision.Decision>(),
+				(firstDeny, decision) =>
+					decision._tag === "Allow"
+						? stop(decision)
+						: next(
+								Option.orElse(firstDeny, () =>
+									decision._tag === "Deny"
+										? Option.some(decision)
+										: Option.none(),
+								),
+							),
+				(firstDeny) =>
+					Option.getOrElse(firstDeny, () => Decision.NotApplicable),
+			)
+		case "FirstOf":
+			return walkChildren(
+				node.policies,
+				context,
+				path,
+				undefined,
+				(_, decision) =>
+					decision._tag === "NotApplicable" ? next(undefined) : stop(decision),
+				() => Decision.NotApplicable,
+			)
+		case "Ceiling":
+			// A deny of the cap wins. Else the policy decides.
+			return Effect.filterOrElse(
+				decideNode(node.cap, context, [...path, 0]),
+				(capped) => capped._tag === "Deny",
+				() => decideNode(node.policy, context, [...path, 1]),
+			)
+	}
+}
+
+/**
+ * Tests if a request fits its kind: the action is an action of the kind, and
+ * the field, if there is one, is a field of the kind. The types check this,
+ * but a value with a union type, or a value from outside, may get past them.
+ * A rule for every action (`"*"`) must not cover an action that the kind does
+ * not have, so such a request is not applicable.
+ *
+ * @stability stable
+ * @category predicates
+ * @since 1.0.0
+ */
+export const fitsKind = (
+	descriptor: Resource.Descriptor,
+	request: { readonly action: string; readonly field?: string | undefined },
+): boolean =>
+	descriptor.actions.includes(request.action) &&
+	(request.field === undefined ||
+		descriptor.fieldPaths.includes(request.field) ||
+		Resource.hasPath(descriptor.schema, request.field) ||
+		Resource.hasGetter(descriptor.schema, request.field))
+
+const makeContext = (
+	domain: Domain.Any,
+	request: AnyRequest,
+	trace: Ref.Ref<Chunk.Chunk<Step>> | undefined,
+): DecideContext | undefined => {
+	const kind = Resource.kindOf(request.resource)
+	const descriptor =
+		kind === undefined ? undefined : Domain.descriptorOf(domain, kind)
+	if (
+		kind === undefined ||
+		descriptor === undefined ||
+		!fitsKind(descriptor, request)
+	) {
+		return undefined
+	}
+	return {
+		action: request.action,
+		kind,
+		field: request.field,
+		input: {
+			value: request.resource,
+			principal: request.principal,
+			path: descriptor.path,
+		},
+		descriptor,
+		trace,
+		predicates: new Map(),
+		decisions: new Map(),
+	}
+}
+
+const decideAny = (
+	policy: Any,
+	request: AnyRequest,
+): Effect.Effect<Decision.Decision, unknown, unknown> =>
+	// Each run of the Effect needs its own store of decisions, because the
+	// resource value may change between two runs.
+	Effect.suspend(() => {
+		const context = makeContext(policy.domain, request, undefined)
+		return context === undefined
+			? Effect.succeed(Decision.NotApplicable)
+			: decideNode(nodeOf(policy), context, [])
+	})
 
 /**
  * Gives the decision of a policy for a request.
@@ -424,7 +1194,7 @@ export const ceiling: {
  * @since 0.3.0
  */
 export const decide: {
-	<D extends Domain.Any>(
+	<D extends Domain.Any = never>(
 		request: Request<D>,
 	): <E, R, O>(
 		policy: Policy<D, E, R, O>,
@@ -433,7 +1203,7 @@ export const decide: {
 		policy: Policy<D, E, R, O>,
 		request: Request<NoInfer<D>>,
 	): Effect.Effect<Decision.Decision, E, R>
-} = internal.decide as never
+} = dual(2, decideAny) as never
 
 /**
  * Gives the decision of a policy with no predicates, at once.
@@ -443,31 +1213,715 @@ export const decide: {
  * @since 0.3.0
  */
 export const decideSync: {
-	<D extends Domain.Any>(
+	<D extends Domain.Any = never>(
 		request: Request<D>,
 	): (policy: Policy<D>) => Decision.Decision
 	<D extends Domain.Any>(
 		policy: Policy<D>,
 		request: Request<NoInfer<D>>,
 	): Decision.Decision
-} = internal.decideSync
+} = dual(2, (policy: Any, request: AnyRequest): Decision.Decision =>
+	Effect.runSync(
+		// The public type of `decideSync` takes only policies with no
+		// predicates, so this Effect has no error and needs no services.
+		// @effect-diagnostics-next-line unsafeEffectTypeAssertion:off
+		decideAny(policy, request) as Effect.Effect<Decision.Decision>,
+	),
+)
 
 /**
  * Gives the decision of a policy and the rules that were tested to make it.
  *
+ * One node may be a child of many nodes. A node with no predicate that the
+ * request may use gives the same decision each time, so its rules are tested,
+ * and are in the steps, only the first time. So a small tree with many shared
+ * nodes gives a short list of steps.
+ *
  * @stability stable
  * @category evaluation
  * @since 0.3.0
  */
 export const explain: {
-	<D extends Domain.Any>(
+	<D extends Domain.Any = never>(
 		request: Request<D>,
 	): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<Explanation, E, R>
 	<D extends Domain.Any, E, R, O>(
 		policy: Policy<D, E, R, O>,
 		request: Request<NoInfer<D>>,
 	): Effect.Effect<Explanation, E, R>
-} = internal.explain as never
+} = dual(
+	2,
+	(
+		policy: Any,
+		request: AnyRequest,
+	): Effect.Effect<Explanation, unknown, unknown> =>
+		// Each run of the Effect needs its own trace, so the trace is made inside
+		// the Effect.
+		Effect.gen(function* () {
+			const trace = yield* Ref.make(Chunk.empty<Step>())
+			const context = makeContext(policy.domain, request, trace)
+			if (context === undefined) {
+				return { decision: Decision.NotApplicable, steps: [] }
+			}
+			const decision = yield* decideNode(nodeOf(policy), context, [])
+			return { decision, steps: Chunk.toReadonlyArray(yield* Ref.get(trace)) }
+		}),
+) as never
+
+/**
+ * Tests if a deny rule of the request names a part inside `field`.
+ */
+const deniesInside = (
+	node: Node,
+	target: { readonly action: string; readonly kind: string },
+	field: string,
+	// A native set: it must find a node by the node itself. See `remember`.
+	seen: Set<Node> = new Set(),
+): boolean => {
+	// One node may be a child of many nodes. It is tested one time.
+	if (seen.has(node)) {
+		return false
+	}
+	seen.add(node)
+	switch (node._tag) {
+		case "Rules":
+			return node.rules.some(
+				(value) =>
+					value._tag === "Deny" &&
+					value.fields !== undefined &&
+					value.fields.some((pattern) => Rule.matchesInside(pattern, field)) &&
+					(value.actions.includes("*") ||
+						value.actions.includes(target.action)) &&
+					(value.resources.includes("*") ||
+						value.resources.includes(target.kind)),
+			)
+		case "All":
+		case "Any":
+		case "FirstOf":
+			return node.policies.some((child) =>
+				deniesInside(child, target, field, seen),
+			)
+		case "Ceiling":
+			return (
+				deniesInside(node.cap, target, field, seen) ||
+				deniesInside(node.policy, target, field, seen)
+			)
+	}
+}
+
+/**
+ * Gives the fields of a resource value that the policy lets a request use. It
+ * tests each field of the resource Schema, with dots for nested fields.
+ *
+ * A field that holds more than one value, such as a record, is left out when a
+ * deny rule names a part of it. The list can not name that part, and the whole
+ * field would show it.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 0.3.0
+ */
+export const permittedFields: {
+	<D extends Domain.Any = never>(
+		request: FieldlessRequest<D>,
+	): <E, R, O>(
+		policy: Policy<D, E, R, O>,
+	) => Effect.Effect<ReadonlyArray<string>, E, R>
+	<D extends Domain.Any, E, R, O>(
+		policy: Policy<D, E, R, O>,
+		request: FieldlessRequest<NoInfer<D>>,
+	): Effect.Effect<ReadonlyArray<string>, E, R>
+} = dual(
+	2,
+	(
+		policy: Any,
+		request: Omit<AnyRequest, "field">,
+	): Effect.Effect<ReadonlyArray<string>, unknown, unknown> => {
+		const kind = Resource.kindOf(request.resource)
+		const descriptor: Resource.Descriptor | undefined =
+			kind === undefined ? undefined : Domain.descriptorOf(policy.domain, kind)
+		if (descriptor === undefined) {
+			return Effect.succeed([])
+		}
+		return Effect.filter(descriptor.fieldPaths, (field) =>
+			Effect.map(
+				decideAny(policy, { ...request, field }),
+				(result) =>
+					result._tag === "Allow" &&
+					!(
+						descriptor.openPaths.includes(field) &&
+						deniesInside(
+							nodeOf(policy),
+							{ ...request, kind: descriptor.kind },
+							field,
+						)
+					),
+			),
+		)
+	},
+) as never
+
+// Residual conditions
+
+type Ast = Condition.Ast
+
+/**
+ * The two residual conditions of a request. See {@link residuals}.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export interface Residuals<E = never, R = never, O = never, I = unknown> {
+	/** The condition on resource values for which the policy allows. */
+	readonly allow: Condition.Condition<E, R, O, I>
+	/** The condition on resource values for which the policy denies. */
+	readonly deny: Condition.Condition<E, R, O, I>
+}
+
+/**
+ * A request about a kind of resource, with no types.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export interface AnyKindRequest {
+	readonly principal: object
+	readonly action: string
+	readonly kind: string
+	readonly field?: string | undefined
+	/**
+	 * A scope needs the types of the domain for its builder. With the request
+	 * first, the domain is not known yet, so give the policy first.
+	 */
+	readonly within?: never
+}
+
+/**
+ * `unknown` when the request `Req` is a request of the type `T`, and `never`
+ * when it is not. With the request first and the policy later, the request is
+ * checked when the policy, and so the domain, is known. For a union, each
+ * member must be such a request.
+ */
+type Fits<Req, T> = [Req] extends [T] ? unknown : never
+
+/**
+ * What a residual condition reads: a value of the kind `K`. The principal is
+ * already in it. A residual is for one kind, so when `K` is a union of kinds,
+ * the value must be a value of each of them. No value is, so such a residual
+ * can not be evaluated on a value of the wrong kind.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 1.0.0
+ */
+export type ResidualReads<D, K> = Condition.Reads<
+	(
+		K extends unknown ? (value: Domain.ValueOf<D, K & string>) => void : never
+	) extends (value: infer V) => void
+		? V
+		: never,
+	unknown
+>
+
+const always: Ast = Condition.always
+const never: Ast = Condition.never
+
+/**
+ * The most nodes that a residual condition may have. A policy tree may use a
+ * condition of a child two times, in its allow condition and in its deny
+ * condition, so a small policy may give a very large condition. Past this
+ * size, `residual` throws an error.
+ */
+const maxResidualSize = 10_000
+
+/**
+ * The most levels that a residual condition may have. The rules of an ordered
+ * algorithm, such as `firstApplicable`, give one level for each run of rules
+ * with one tag. A walk over a condition calls itself for each level, so a much
+ * deeper condition could fill the stack. Past this depth, `residual` throws an
+ * error.
+ */
+const maxResidualDepth = 500
+
+/**
+ * A residual condition is too large. See {@link maxResidualSize} and
+ * {@link maxResidualDepth}.
+ */
+class TooLarge {}
+
+/**
+ * Makes conditions for one residual, with no types. Each step simplifies the
+ * condition, and it stops the work when the condition is too large. The
+ * steps keep their work for the parts they have seen, for this residual only.
+ */
+interface Build {
+	// A list goes in as an array, not as arguments: a call may take only so
+	// many arguments, and a policy may have more rules.
+	readonly and: (values: ReadonlyArray<Ast>) => Ast
+	readonly or: (values: ReadonlyArray<Ast>) => Ast
+	readonly not: (value: Ast) => Ast
+}
+
+const makeBuild = (): Build => {
+	const simplify = Condition.simplifier()
+	const sizes = new Map<Ast, number>()
+	/** Gives the number of nodes in a condition, as JSON would have them. */
+	const sizeOf = (ast: Ast): number =>
+		remember(sizes, ast, () => {
+			switch (ast._tag) {
+				case "And":
+				case "Or":
+					return Arr.reduce(
+						ast.conditions,
+						1,
+						(size, child) => size + sizeOf(child),
+					)
+				case "Not":
+					return 1 + sizeOf(ast.condition)
+				default:
+					return 1
+			}
+		})
+	const depths = new Map<Ast, number>()
+	/**
+	 * Gives the number of levels in a condition. Each child went through
+	 * `limit`, so this walk is not deeper than `maxResidualDepth`.
+	 */
+	const depthOf = (ast: Ast): number =>
+		remember(depths, ast, () => {
+			switch (ast._tag) {
+				case "And":
+				case "Or":
+					return (
+						1 +
+						Arr.reduce(ast.conditions, 0, (top, child) =>
+							Math.max(top, depthOf(child)),
+						)
+					)
+				case "Not":
+					return 1 + depthOf(ast.condition)
+				default:
+					return 1
+			}
+		})
+	const limit = (ast: Ast): Ast => {
+		if (sizeOf(ast) > maxResidualSize || depthOf(ast) > maxResidualDepth) {
+			throw new TooLarge()
+		}
+		return ast
+	}
+	// These steps work on nodes with no types, so they leave out the type
+	// field of a condition.
+	return {
+		and: (values) =>
+			limit(simplify(Condition.andAll(values as ReadonlyArray<never>))),
+		or: (values) =>
+			limit(simplify(Condition.orAll(values as ReadonlyArray<never>))),
+		not: (value) => limit(simplify(Condition.not(value as never))),
+	}
+}
+
+/** The two residual conditions of a node, with no types. */
+interface Pair {
+	readonly allow: Ast
+	readonly deny: Ast
+}
+
+interface ResidualContext {
+	readonly action: string
+	readonly kind: string
+	readonly field: string | undefined
+	readonly input: {
+		readonly principal: object
+		readonly path: Condition.Input["path"]
+	}
+	/** The resource of the kind, for the fields that a rule may grant. */
+	readonly descriptor: Resource.Descriptor
+	/**
+	 * The work done on each node. One node may be a child of many nodes, so
+	 * the work on it is done only one time.
+	 */
+	readonly pairs: Map<Node, Pair>
+	readonly predicates: Map<Node, boolean>
+	readonly build: Build
+}
+
+const ruleCondition = (value: Rule.Any, context: ResidualContext): Ast =>
+	!Rule.matchesTarget(value, context)
+		? never
+		: value.when === undefined
+			? always
+			: Condition.partial(value.when as Condition.Any, context.input)
+
+/**
+ * Gives the conditions for "the first rule that applies is an allow rule" and
+ * "the first rule that applies is a deny rule".
+ */
+const firstApplicableResidual = (
+	values: ReadonlyArray<Rule.Any>,
+	context: ResidualContext,
+): Pair => {
+	const { and, not, or } = context.build
+	// The rules go in runs of one tag, from the last run to the first. The
+	// conditions of a run go into one node at once. With one node for each
+	// rule, each step would flatten the whole condition again.
+	const runs = Arr.isReadonlyArrayNonEmpty(values)
+		? Arr.groupWith(values, (a, b) => a._tag === b._tag)
+		: []
+	return Arr.reduceRight(
+		runs,
+		{ allow: never, deny: never },
+		(rest: Pair, run): Pair => {
+			const applies = or(Arr.map(run, (value) => ruleCondition(value, context)))
+			return run[0]._tag === "Allow"
+				? {
+						allow: or([applies, rest.allow]),
+						deny: and([not(applies), rest.deny]),
+					}
+				: {
+						allow: and([not(applies), rest.allow]),
+						deny: or([applies, rest.deny]),
+					}
+		},
+	)
+}
+
+const residualNode = (node: Node, context: ResidualContext): Pair =>
+	remember(context.pairs, node, () => residualOnce(node, context))
+
+const residualOnce = (node: Node, context: ResidualContext): Pair => {
+	const { and, not, or } = context.build
+	switch (node._tag) {
+		case "Rules": {
+			switch (node.algorithm) {
+				case "denyOverrides": {
+					const deny = or(
+						node.rules
+							.filter((value) => value._tag === "Deny")
+							.map((value) => ruleCondition(value, context)),
+					)
+					const allow = and([
+						not(deny),
+						or(
+							node.rules
+								.filter((value) => value._tag === "Allow")
+								.map((value) => ruleCondition(value, context)),
+						),
+					])
+					return { allow, deny }
+				}
+				case "permitOverrides": {
+					const allow = or(
+						node.rules
+							.filter((value) => value._tag === "Allow")
+							.map((value) => ruleCondition(value, context)),
+					)
+					const deny = and([
+						not(allow),
+						or(
+							node.rules
+								.filter((value) => value._tag === "Deny")
+								.map((value) => ruleCondition(value, context)),
+						),
+					])
+					return { allow, deny }
+				}
+				case "firstApplicable":
+					return firstApplicableResidual(node.rules, context)
+				case "lastApplicable":
+					return firstApplicableResidual(node.rules.slice().reverse(), context)
+			}
+		}
+		// falls through: every algorithm returns above
+		case "All": {
+			if (node.policies.length === 0) {
+				return { allow: never, deny: never }
+			}
+			const pairs = node.policies.map((child) => residualNode(child, context))
+			const deny = or(pairs.map((pair) => pair.deny))
+			const allow = and([...pairs.map((pair) => pair.allow), not(deny)])
+			return { allow, deny }
+		}
+		case "Any": {
+			const pairs = node.policies.map((child) => residualNode(child, context))
+			const allow = or(pairs.map((pair) => pair.allow))
+			const deny = and([not(allow), or(pairs.map((pair) => pair.deny))])
+			return { allow, deny }
+		}
+		case "FirstOf": {
+			// The first child that gives an answer wins.
+			return Arr.reduceRight(
+				node.policies,
+				{ allow: never, deny: never },
+				(rest: Pair, child): Pair => {
+					const pair = residualNode(child, context)
+					return {
+						allow: or([pair.allow, and([not(pair.deny), rest.allow])]),
+						deny: or([pair.deny, and([not(pair.allow), rest.deny])]),
+					}
+				},
+			)
+		}
+		case "Ceiling": {
+			const cap = residualNode(node.cap, context)
+			const inner = residualNode(node.policy, context)
+			return {
+				allow: and([not(cap.deny), inner.allow]),
+				deny: or([cap.deny, inner.deny]),
+			}
+		}
+	}
+}
+
+/** The name of the predicate of a residual condition that runs `decide`. */
+const policyPredicate = "policy"
+
+/** Tests if a rule of a policy tree has a predicate. */
+const nodeHasPredicate = (
+	node: Node,
+	memo: Map<Node, boolean> = new Map(),
+): boolean =>
+	remember(memo, node, () => {
+		const test = (child: Node) => nodeHasPredicate(child, memo)
+		switch (node._tag) {
+			case "Rules":
+				return Arr.some(
+					node.rules,
+					(value) =>
+						value.when !== undefined && Condition.hasPredicate(value.when),
+				)
+			case "All":
+			case "Any":
+			case "FirstOf":
+				return Arr.some(node.policies, test)
+			case "Ceiling":
+				return test(node.cap) || test(node.policy)
+		}
+	})
+
+/** Tests if a rule that the request may use has a predicate. */
+/** What {@link usesPredicate} needs: the request and a memo. */
+interface PredicateContext {
+	readonly action: string
+	readonly kind: string
+	readonly field: string | undefined
+	readonly descriptor: Resource.Descriptor
+	readonly predicates: Map<Node, boolean>
+}
+
+const usesPredicate = (node: Node, context: PredicateContext): boolean =>
+	remember(context.predicates, node, () => usesPredicateOnce(node, context))
+
+const usesPredicateOnce = (node: Node, context: PredicateContext): boolean => {
+	switch (node._tag) {
+		case "Rules":
+			return node.rules.some(
+				(value) =>
+					value.when !== undefined &&
+					Condition.hasPredicate(value.when) &&
+					Rule.matchesTarget(value, context),
+			)
+		case "All":
+		case "Any":
+		case "FirstOf":
+			return node.policies.some((child) => usesPredicate(child, context))
+		case "Ceiling":
+			return (
+				usesPredicate(node.cap, context) || usesPredicate(node.policy, context)
+			)
+	}
+}
+
+const isScopeValue = (operand: Condition.Operand): boolean =>
+	operand._tag === "Principal" ||
+	operand.value === null ||
+	typeof operand.value === "string" ||
+	typeof operand.value === "number" ||
+	typeof operand.value === "boolean"
+
+/**
+ * Gives the problem of a scope that is not plain data, or `undefined` when it
+ * is plain data. A predicate, or a value that a condition can not hold, such
+ * as `undefined` from a route parameter, is a defect: such a scope could make
+ * a check pass on the wrong values. A shared node is tested one time.
+ */
+const scopeProblem = (
+	ast: Ast,
+	memo: Map<Ast, string | null> = new Map(),
+): string | undefined =>
+	remember(memo, ast, (): string | null => {
+		switch (ast._tag) {
+			case "Predicate":
+				return "can not have a predicate"
+			case "Compare":
+				return isScopeValue(ast.value)
+					? null
+					: `has a value for "${ast.field}" that is not a scalar`
+			case "In":
+				return Arr.every(ast.values, isScopeValue)
+					? null
+					: `has a value for "${ast.field}" that is not a scalar`
+			case "Under":
+				return Arr.every(ast.prefix, isScopeValue)
+					? null
+					: "has a path part that is not a scalar"
+			case "And":
+			case "Or":
+				return (
+					Option.getOrNull(
+						Arr.findFirst(
+							Arr.map(ast.conditions, (child) => scopeProblem(child, memo)),
+							(problem) => problem !== undefined,
+						),
+					) ?? null
+				)
+			case "Not":
+				return scopeProblem(ast.condition, memo) ?? null
+			default:
+				return null
+		}
+	}) ?? undefined
+
+/**
+ * Gives the condition of a scope, with the principal and the path in it.
+ * With no scope, it is `True`.
+ */
+/**
+ * The fields that a scope reads, before it is made smaller. A smaller scope
+ * may leave out a read that fails, such as a getter.
+ */
+const scopeFields = (within: unknown): ReadonlyArray<string> =>
+	within === undefined
+		? []
+		: Condition.fields(
+				(within as (builder: unknown) => Ast)(Condition.builder()),
+			)
+
+const scopeOf = (within: unknown, input: ResidualContext["input"]): Ast => {
+	if (within === undefined) {
+		return always
+	}
+	const ast = (within as (builder: unknown) => Ast)(Condition.builder())
+	const problem = scopeProblem(ast)
+	if (problem !== undefined) {
+		throw new globalThis.Error(`A scope ${problem}`)
+	}
+	return Condition.partial(ast as Condition.Condition, input)
+}
+
+/** A request about a kind with no types, with the scope of a target. */
+interface ScopedRequest {
+	readonly principal: object
+	readonly action: string
+	readonly kind: string
+	readonly field?: string | undefined
+	readonly within?: unknown
+}
+
+/** The scope of a request, and the residual conditions inside it. */
+interface Scoped extends Pair {
+	readonly scope: Ast
+	readonly schema: Schema.Top | undefined
+}
+
+const residualsAny = (policy: Any, request: ScopedRequest): Pair =>
+	scopedResiduals(policy, request)
+
+const scopedResiduals = (policy: Any, request: ScopedRequest): Scoped => {
+	const descriptor = Domain.descriptorOf(policy.domain, request.kind)
+	if (descriptor === undefined || !fitsKind(descriptor, request)) {
+		return { scope: never, allow: never, deny: never, schema: undefined }
+	}
+	// A scope is made smaller below, and that may leave out a read of a
+	// getter that fails. So such a scope has no residual.
+	if (scopeReadsGetter(request, descriptor)) {
+		throw new globalThis.Error(
+			"The scope of this request reads a getter, so it has no residual condition",
+		)
+	}
+	const input = { principal: request.principal, path: descriptor.path }
+	const scope = scopeOf(request.within, input)
+	const build = makeBuild()
+	const and = build.and
+	const inScope = (pair: Pair): Scoped => ({
+		scope,
+		allow: and([scope, pair.allow]),
+		deny: and([scope, pair.deny]),
+		schema: descriptor.schema,
+	})
+	if (scope._tag === "False") {
+		return inScope({ allow: never, deny: never })
+	}
+	const context: ResidualContext = {
+		action: request.action,
+		kind: request.kind,
+		field: request.field,
+		input,
+		descriptor,
+		pairs: new Map(),
+		predicates: new Map(),
+		build,
+	}
+	if (!usesPredicate(nodeOf(policy), context)) {
+		// A read of a getter may fail when `decide` runs, and a smaller
+		// condition may leave the read out. So a plain residual can not agree
+		// with `decide`, and there is none.
+		if (readsGetter(policy, request, descriptor)) {
+			throw new globalThis.Error(
+				"A rule of this request reads a getter, so it has no residual condition",
+			)
+		}
+		try {
+			return inScope(residualNode(nodeOf(policy), context))
+		} catch (error) {
+			// The type of the residual of a plain policy says that it has no
+			// predicate, so it can not be the predicate below. The policy is too
+			// large for a residual, and that is a defect.
+			if (error instanceof TooLarge) {
+				throw new globalThis.Error(
+					`The residual condition of this request would have more than ${String(maxResidualSize)} nodes or ${String(maxResidualDepth)} levels`,
+				)
+			}
+			throw error
+		}
+	}
+	// A predicate may fail, and it may give another answer each time it runs.
+	// A tree of `And` and `Or` nodes can not run the predicates in the same
+	// order and the same number of times as `decide`. So the residual is one
+	// predicate that runs `decide` for each value.
+	const decision = (value: object) =>
+		decideNode(
+			policy.node,
+			{
+				action: request.action,
+				kind: request.kind,
+				field: request.field,
+				input: {
+					value,
+					principal: request.principal,
+					path: descriptor.path,
+				},
+				descriptor,
+				trace: undefined,
+				predicates: new Map(),
+				decisions: new Map(),
+			},
+			[],
+		)
+	// A value of another kind is not a value that the residual is about, so
+	// the rules of this kind must not run on it.
+	const test = (tag: Decision.Decision["_tag"]): Ast =>
+		Condition.builder<any, any, any>().predicate(policyPredicate, (value) =>
+			Resource.kindOf(value) === request.kind
+				? Effect.map(decision(value), (result) => result._tag === tag)
+				: Effect.succeed(false),
+		)
+	// The scope comes first in each `And`, so the policy runs only on values
+	// in the scope.
+	return inScope({ allow: test("Allow"), deny: test("Deny") })
+}
 
 /**
  * Gives the condition on resource values for which the policy allows a
@@ -475,41 +1929,354 @@ export const explain: {
  * to `Condition.fold`. It is `True` when the policy allows every value of the
  * kind, and `False` when it allows none.
  *
- * Predicates stay in the condition. They take the principal with them.
+ * With a scope (`within`), the condition is the scope and the residual
+ * together, so it is false for every value outside the scope. Give the policy
+ * first to use a scope. The condition comes from its parts, with no search. To
+ * know if it allows all of the scope or none of it, use {@link coverage}.
+ *
+ * When a rule that the request may use has a predicate, the condition is one
+ * predicate with the name `"policy"`. It runs the whole policy for each value,
+ * so its answers and its failures are the same as those of {@link decide}. It
+ * takes the principal with it. Give it resource values with their `_tag`. It
+ * is false for a value of another kind.
+ *
+ * A policy tree may use the condition of a child two times, so a small policy
+ * may give a very large condition. When the condition would have more than
+ * 10000 nodes or 500 levels, this function throws an error. In an
+ * `Authorizer`, the error is
+ * a defect, so the check fails.
  *
  * @stability stable
  * @category evaluation
  * @since 0.3.0
  */
 export const residual: {
-	<D extends Domain.Any>(
-		request: KindRequest<D>,
-	): <E, R, O>(policy: Policy<D, E, R, O>) => Condition.Condition<E, R, O>
-	<D extends Domain.Any, E, R, O>(
+	<const Req extends AnyKindRequest>(
+		request: Req,
+	): <D extends Domain.Any, E, R, O>(
+		policy: Policy<D, E, R, O> & Fits<Req, KindRequest<D>>,
+	) => Condition.Condition<E, R, O, ResidualReads<D, Req["kind"]>>
+	<D extends Domain.Any, E, R, O, const Req extends KindRequest<NoInfer<D>>>(
 		policy: Policy<D, E, R, O>,
-		request: KindRequest<NoInfer<D>>,
-	): Condition.Condition<E, R, O>
-} = internal.residual as never
+		request: Req,
+	): Condition.Condition<E, R, O, ResidualReads<D, Req["kind"]>>
+} = dual(
+	2,
+	(policy: Any, request: KindRequest<Domain.Any>): Ast =>
+		residualsAny(policy, request).allow,
+) as never
 
 /**
- * Gives the fields of a resource value that the policy lets a request use. It
- * tests each field of the resource Schema, with dots for nested fields.
+ * Gives both residual conditions of a request: the values that the policy
+ * allows, and the values that it denies. A value in neither is not
+ * applicable. See {@link residual}.
  *
  * @stability stable
  * @category evaluation
- * @since 0.3.0
+ * @since 1.0.0
  */
-export const permittedFields: {
-	<D extends Domain.Any>(
-		request: Omit<Request<D>, "field">,
-	): <E, R, O>(
+export const residuals: {
+	<const Req extends AnyKindRequest>(
+		request: Req,
+	): <D extends Domain.Any, E, R, O>(
+		policy: Policy<D, E, R, O> & Fits<Req, KindRequest<D>>,
+	) => Residuals<E, R, O, ResidualReads<D, Req["kind"]>>
+	<D extends Domain.Any, E, R, O, const Req extends KindRequest<NoInfer<D>>>(
 		policy: Policy<D, E, R, O>,
-	) => Effect.Effect<ReadonlyArray<string>, E, R>
-	<D extends Domain.Any, E, R, O>(
+		request: Req,
+	): Residuals<E, R, O, ResidualReads<D, Req["kind"]>>
+} = dual(2, residualsAny) as never
+
+/**
+ * How much of a scope a policy allows. In each case, `condition` is the exact
+ * condition on the values in the scope that the policy allows: give it to
+ * `Condition.fold` for a list query.
+ * - `All`: the policy allows every value in the scope. `condition` is the
+ *   scope (`True` with no scope).
+ * - `None`: the policy allows no value in the scope. `condition` is `False`.
+ *   An empty scope is `None` too, so a check on a scope that has a mistake,
+ *   such as a principal field with no value, never passes.
+ * - `Some`: the policy allows some values in the scope and not others.
+ *   `allowed` is an example of a value that it allows, and `refused` of a
+ *   value in the scope that it does not allow.
+ * - `Unknown`: the answer needs a predicate, or the search went past its
+ *   budget.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export type Coverage<
+	E = never,
+	R = never,
+	O = never,
+	I = unknown,
+> = Data.TaggedEnum<{
+	All: { readonly condition: Condition.Condition<E, R, O, I> }
+	None: { readonly condition: Condition.Condition<E, R, O, I> }
+	Some: {
+		readonly condition: Condition.Condition<E, R, O, I>
+		readonly allowed: Condition.Example
+		readonly refused: Condition.Example
+	}
+	Unknown: {
+		readonly condition: Condition.Condition<E, R, O, I>
+		readonly reason: "predicate" | "budget" | "schema"
+	}
+}>
+
+/** A {@link Coverage} with no types. */
+type AnyCoverage = Data.TaggedEnum<{
+	All: { readonly condition: Ast }
+	None: { readonly condition: Ast }
+	Some: {
+		readonly condition: Ast
+		readonly allowed: Condition.Example
+		readonly refused: Condition.Example
+	}
+	Unknown: {
+		readonly condition: Ast
+		readonly reason: "predicate" | "budget" | "schema"
+	}
+}>
+
+const coverages = Data.taggedEnum<AnyCoverage>()
+
+/**
+ * Tests if a rule that the request may use, or its scope, reads a getter of
+ * a class, in any branch of a union.
+ */
+const readsGetter = (
+	policy: Any,
+	request: ScopedRequest,
+	descriptor: Resource.Descriptor,
+): boolean =>
+	scopeReadsGetter(request, descriptor) ||
+	!readsOnly(
+		nodeOf(policy),
+		targetOf(request, descriptor),
+		(field) => !readsGetterAt(descriptor.schema, field),
+		new Map(),
+	)
+
+/**
+ * Tests if a read of a field may read a getter of a class: at the field, or
+ * at a field on the way to it, in any branch of a union.
+ */
+const readsGetterAt = (schema: Schema.Top, field: string): boolean => {
+	const parts = field.split(".")
+	return Arr.some(Arr.range(1, parts.length), (count) =>
+		Resource.hasGetter(schema, parts.slice(0, count).join(".")),
+	)
+}
+
+/**
+ * Tests if the scope of a request reads a getter of a class. A scope is made
+ * smaller in each residual, also next to a predicate that runs `decide`, so
+ * such a scope has no residual.
+ */
+const scopeReadsGetter = (
+	request: ScopedRequest,
+	descriptor: Resource.Descriptor,
+): boolean =>
+	!Arr.every(
+		scopeFields(request.within),
+		(field) => !readsGetterAt(descriptor.schema, field),
+	)
+
+/**
+ * Tests if a request has no residual: its scope reads a getter, or it has a
+ * plain residual and a rule that it may use reads a getter. A residual with
+ * a predicate runs `decide`, so the reads of its rules stay.
+ */
+const hasNoResidual = (
+	policy: Any,
+	request: ScopedRequest,
+	descriptor: Resource.Descriptor,
+): boolean =>
+	scopeReadsGetter(request, descriptor) ||
+	(!usesPredicate(nodeOf(policy), targetOf(request, descriptor)) &&
+		readsGetter(policy, request, descriptor))
+
+/** The parts of a request that tell which rules it may use. */
+const targetOf = (
+	request: ScopedRequest,
+	descriptor: Resource.Descriptor,
+): PredicateContext => ({
+	action: request.action,
+	kind: request.kind,
+	field: request.field,
+	descriptor,
+	predicates: new Map(),
+})
+
+/**
+ * Tests if each field that a rule that the request may use reads passes
+ * `test`. It looks at the conditions before they are made smaller. A smaller
+ * condition may leave out a field, but a read of that field, such as a
+ * getter, may fail when `decide` runs. A shared node is visited one time.
+ */
+const readsOnly = (
+	node: Node,
+	target: PredicateContext,
+	test: (field: string) => boolean,
+	memo: Map<Node, boolean>,
+): boolean =>
+	remember(memo, node, () => {
+		switch (node._tag) {
+			case "Rules":
+				return Arr.every(
+					node.rules,
+					(value) =>
+						value.when === undefined ||
+						!Rule.matchesTarget(value, target) ||
+						Arr.every(Condition.fields(value.when as Ast), test),
+				)
+			case "All":
+			case "Any":
+			case "FirstOf":
+				return Arr.every(node.policies, (child) =>
+					readsOnly(child, target, test, memo),
+				)
+			case "Ceiling":
+				return (
+					readsOnly(node.cap, target, test, memo) &&
+					readsOnly(node.policy, target, test, memo)
+				)
+		}
+	})
+
+const coverageAny = (policy: Any, request: ScopedRequest): AnyCoverage => {
+	const descriptor = Domain.descriptorOf(policy.domain, request.kind)
+	// A request with no residual has the condition `False`.
+	if (descriptor !== undefined && hasNoResidual(policy, request, descriptor)) {
+		return coverages.Unknown({ condition: never, reason: "schema" })
+	}
+	const scoped = scopedResiduals(policy, request)
+	const allowed = scoped.allow
+	// Each field that a rule or the scope reads must be plain, also a field
+	// that a smaller condition leaves out. The condition is the residual.
+	if (descriptor !== undefined) {
+		const plain = (field: string) =>
+			Resource.isPlainField(descriptor.schema, field)
+		if (
+			readsGetter(policy, request, descriptor) ||
+			!Arr.every(scopeFields(request.within), plain) ||
+			!readsOnly(
+				nodeOf(policy),
+				targetOf(request, descriptor),
+				plain,
+				new Map(),
+			)
+		) {
+			return coverages.Unknown({ condition: allowed, reason: "schema" })
+		}
+	}
+
+	const options = { schema: scoped.schema }
+	const some =
+		allowed._tag === "False"
+			? undefined
+			: Condition.satisfiable(allowed as Condition.Condition, options)
+	if (some === undefined || some._tag === "Unsatisfiable") {
+		return coverages.None({ condition: never })
+	}
+	if (some._tag === "Unknown") {
+		return coverages.Unknown({ condition: allowed, reason: some.reason })
+	}
+	// Only two nodes more than `allowed`, so it needs no size limit.
+	const refused: Ast = Condition.simplify(
+		Condition.and(
+			scoped.scope as Condition.Condition,
+			Condition.not(allowed as Condition.Condition),
+		),
+	)
+	const missing =
+		refused._tag === "False"
+			? undefined
+			: Condition.satisfiable(refused as Condition.Condition, options)
+	if (missing === undefined || missing._tag === "Unsatisfiable") {
+		return coverages.All({ condition: scoped.scope })
+	}
+	if (missing._tag === "Unknown") {
+		return coverages.Unknown({ condition: allowed, reason: missing.reason })
+	}
+	return coverages.Some({
+		condition: allowed,
+		allowed: some.example,
+		refused: missing.example,
+	})
+}
+
+/**
+ * Tests if the scope of a request has a value of the Schema of its kind. The
+ * answer is `true` only when the search finds such a value. When the search
+ * can not say, the answer is `false`. So a "yes" from it is safe to act on,
+ * as for the question "may the decider answer for this scope?".
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 1.0.0
+ */
+export const scopeHasValue = (policy: Any, request: ScopedRequest): boolean => {
+	const scoped = scopedResiduals(policy, request)
+	return (
+		Condition.satisfiable(scoped.scope as Condition.Any, {
+			schema: scoped.schema,
+		})._tag === "Satisfiable"
+	)
+}
+
+/**
+ * Tests if the scope of a request has no value of the Schema of its kind. A
+ * scope with a mistake, such as two values for one field, is empty. With no
+ * scope, the answer is `false` when the kind has a value. When the search can
+ * not say, the answer is `false`.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 1.0.0
+ */
+export const scopeIsEmpty = (policy: Any, request: ScopedRequest): boolean => {
+	const scoped = scopedResiduals(policy, request)
+	return (
+		Condition.satisfiable(scoped.scope as Condition.Any, {
+			schema: scoped.schema,
+		})._tag === "Unsatisfiable"
+	)
+}
+
+/**
+ * Tells how much of a scope the policy allows: all of it, none of it, or some
+ * of it. See {@link Coverage}. With no scope (`within`), the scope is every
+ * value of the kind.
+ *
+ * The answer comes from {@link Condition.satisfiable} with the Schema of the
+ * resource, so it is exact for the values of the Schema. When a condition
+ * tests a field that is not a plain scalar (see `Resource.isPlainField`),
+ * such as a field with a check other than a finite or integer check, the
+ * answer is `Unknown`, and a check on the kind says no.
+ *
+ * `Some` means that some value of the Schema is allowed. It does not mean that
+ * such a value is in your database. To know that, run `condition` as a query.
+ *
+ * @stability stable
+ * @category evaluation
+ * @since 1.0.0
+ */
+export const coverage: {
+	<const Req extends AnyKindRequest>(
+		request: Req,
+	): <D extends Domain.Any, E, R, O>(
+		policy: Policy<D, E, R, O> & Fits<Req, KindRequest<D>>,
+	) => Coverage<E, R, O, ResidualReads<D, Req["kind"]>>
+	<D extends Domain.Any, E, R, O, const Req extends KindRequest<NoInfer<D>>>(
 		policy: Policy<D, E, R, O>,
-		request: Omit<Request<NoInfer<D>>, "field">,
-	): Effect.Effect<ReadonlyArray<string>, E, R>
-} = internal.permittedFields as never
+		request: Req,
+	): Coverage<E, R, O, ResidualReads<D, Req["kind"]>>
+} = dual(2, coverageAny) as never
+
+// Schema
 
 /**
  * The JSON form of a rule.
@@ -552,24 +2319,997 @@ export type EncodedNode =
 			readonly policy: EncodedNode
 	  }
 
+const AlgorithmSchema = Schema.Literals([
+	"denyOverrides",
+	"permitOverrides",
+	"firstApplicable",
+	"lastApplicable",
+])
+
+const encodedRuleSchema = (meta: Schema.Top | undefined) =>
+	Schema.Struct({
+		_tag: Schema.Literals(["Allow", "Deny"]),
+		actions: Schema.Array(Schema.String),
+		resources: Schema.Array(Schema.String),
+		when: Schema.optionalKey(Condition.schema),
+		fields: Schema.String.pipe(Schema.Array, Schema.optionalKey),
+		reason: Schema.optionalKey(Schema.String),
+		id: Schema.optionalKey(Schema.String),
+		meta: Schema.optionalKey(
+			(meta ?? Schema.Never) as Schema.Codec<unknown, unknown>,
+		),
+	})
+
 /**
- * The Schema of the policies of a domain with no predicates. Decoding checks
- * every kind, action, field and principal field against the domain, and the
- * `meta` of each rule against the `meta` Schema of the domain.
+ * The most levels of objects and arrays in the JSON form of a policy. The
+ * Schema of a policy calls itself for each level, so a much deeper input
+ * could fill the stack before the checks of the policy run. A policy tree of
+ * `maxDepth` levels with deep conditions stays well below this.
+ */
+const maxJsonDepth = 1000
+
+/**
+ * The most objects and arrays in the JSON form of an input, with a shared one
+ * counted for each place. The decoder writes out a shared one each time, so
+ * an input with few objects may give a very large tree.
+ */
+const maxInputNodes = 1_000_000
+
+/** The size and the height of a value, in objects and arrays. */
+interface Measure {
+	readonly size: number
+	readonly height: number
+}
+
+/**
+ * Measures a value, or gives `undefined` when it is higher than `levels`. A
+ * shared object is measured one time. The walk stops at that height, so it
+ * does not fill the stack itself. The memo is a native `Map`, because it
+ * must find an object by the object itself.
+ */
+const measure = (
+	input: unknown,
+	levels: number,
+	memo: Map<object, Measure | { readonly failed: number }>,
+): Measure | undefined => {
+	if (typeof input !== "object" || input === null) {
+		return { size: 0, height: 0 }
+	}
+	const cached = memo.get(input)
+	// A value that was too high for some levels is too high for fewer.
+	if (
+		cached !== undefined &&
+		("failed" in cached ? levels <= cached.failed : true)
+	) {
+		return "failed" in cached || cached.height > levels ? undefined : cached
+	}
+	// After the first child that is too high, the fold measures no more
+	// children. The walk has few frames for each level, so it does not fill
+	// the stack at the most levels.
+	// An input with a key that a loop over the keys does not see, or with a
+	// getter, may give the decoder more than the measure sees. Such an input
+	// is not plain data, so it fails.
+	const result =
+		levels === 0 || !isPlainData(input)
+			? undefined
+			: Arr.reduce(
+					Object.values(input),
+					{ size: 1, height: 1 } as Measure | undefined,
+					(total, child) => {
+						const measured =
+							total === undefined ? undefined : measure(child, levels - 1, memo)
+						return total === undefined || measured === undefined
+							? undefined
+							: {
+									size: total.size + measured.size,
+									height: Math.max(total.height, 1 + measured.height),
+								}
+					},
+				)
+	memo.set(input, result ?? { failed: levels })
+	return result
+}
+
+/**
+ * Tests if each own key of an object is a plain data key that a loop over the
+ * keys sees. The `length` of an array is the one key that is not seen. The
+ * decoder reads keys of the prototypes too, so a prototype other than the
+ * one of a plain object or an array may have only methods, as the prototype
+ * of a class has.
+ */
+const isPlainData = (input: object): boolean =>
+	Arr.every(Reflect.ownKeys(input), (key) => {
+		const property = Object.getOwnPropertyDescriptor(input, key)
+		return (
+			property !== undefined &&
+			"value" in property &&
+			(property.enumerable === true ||
+				(Array.isArray(input) && key === "length"))
+		)
+	}) && hasOnlyMethods(Object.getPrototypeOf(input))
+
+/** Tests if the prototypes from `prototype` up have only methods. */
+const hasOnlyMethods = (prototype: unknown): boolean =>
+	prototype === null ||
+	prototype === Object.prototype ||
+	prototype === Array.prototype ||
+	(typeof prototype === "object" &&
+		Arr.every(Reflect.ownKeys(prototype), (key) => {
+			const property = Object.getOwnPropertyDescriptor(prototype, key)
+			return (
+				typeof key === "symbol" ||
+				key === "constructor" ||
+				(property !== undefined &&
+					"value" in property &&
+					typeof property.value === "function")
+			)
+		}) &&
+		hasOnlyMethods(Object.getPrototypeOf(prototype)))
+
+/** Tests if a value is low and small enough to decode. */
+const fitsLimits = (input: unknown): string | true => {
+	const measured = measure(input, maxJsonDepth, new Map())
+	return measured === undefined
+		? `A policy may have at most ${String(maxJsonDepth)} levels of JSON`
+		: measured.size > maxInputNodes
+			? `A policy may have at most ${String(maxInputNodes)} objects and arrays in JSON`
+			: true
+}
+
+const encodedNodeSchema = (
+	meta: Schema.Top | undefined,
+): Schema.Codec<EncodedNode> => {
+	const self: Schema.Codec<EncodedNode> = Schema.Union([
+		Schema.TaggedStruct("Rules", {
+			algorithm: AlgorithmSchema,
+			rules: Schema.Array(encodedRuleSchema(meta)),
+		}),
+		Schema.TaggedStruct("All", {
+			policies: Schema.Array(Schema.suspend(() => self)),
+		}),
+		Schema.TaggedStruct("Any", {
+			policies: Schema.Array(Schema.suspend(() => self)),
+		}),
+		Schema.TaggedStruct("FirstOf", {
+			policies: Schema.Array(Schema.suspend(() => self)),
+		}),
+		Schema.TaggedStruct("Ceiling", {
+			cap: Schema.suspend(() => self),
+			policy: Schema.suspend(() => self),
+		}),
+	]) as never
+	return self
+}
+
+type ConditionNode = Condition.Encoded | Ast
+
+const principalRefs = (ast: ConditionNode): ReadonlyArray<string> =>
+	Array.from(refsIn(ast, new Map()))
+
+/** The principal fields of a node. A shared node is visited one time. */
+const refsIn = (
+	node: ConditionNode,
+	memo: Map<ConditionNode, HashSet.HashSet<string>>,
+): HashSet.HashSet<string> =>
+	remember(memo, node, () => {
+		const refs = (operands: ReadonlyArray<Condition.Operand>) =>
+			HashSet.fromIterable(
+				Arr.flatMap(operands, (operand) =>
+					operand._tag === "Principal" ? [operand.path] : [],
+				),
+			)
+		switch (node._tag) {
+			case "Compare":
+				return refs([node.value])
+			case "In":
+				return refs(node.values)
+			case "Under":
+				return refs(node.prefix)
+			case "And":
+			case "Or":
+				return Arr.reduce(
+					node.conditions as ReadonlyArray<ConditionNode>,
+					HashSet.empty<string>(),
+					(all, child) => HashSet.union(all, refsIn(child, memo)),
+				)
+			case "Not":
+				return refsIn(node.condition, memo)
+			default:
+				return HashSet.empty()
+		}
+	})
+
+interface Issue {
+	readonly path: ReadonlyArray<PropertyKey>
+	readonly issue: string
+}
+
+/** A test of a field with a fixed value, as in `eq("level", 3)`. */
+type LiteralTest = readonly [field: string, value: Condition.Scalar]
+
+const literalTests = (node: ConditionNode): ReadonlyArray<LiteralTest> =>
+	Arr.map(Array.from(literalTestsIn(node, new Map())), (text) => {
+		const [field, value] = JSON.parse(text) as readonly [string, unknown]
+		return [
+			field,
+			hasProperty(value, "number") ? Number(value.number) : value,
+		] as LiteralTest
+	})
+
+/**
+ * The JSON text of a test. JSON has no `Infinity`, `-Infinity` or `NaN`, so
+ * such a number goes in as its text.
+ */
+const literalText = (field: string, value: Condition.Scalar): string =>
+	JSON.stringify([
+		field,
+		typeof value === "number" && !Number.isFinite(value)
+			? { number: String(value) }
+			: value,
+	])
+
+/**
+ * The tests of fields with fixed values in a node, each as the JSON text of a
+ * {@link LiteralTest}. A set of texts keeps each test one time, so a node
+ * with many shared parts gives a small set. A shared node is visited one time.
+ */
+const literalTestsIn = (
+	node: ConditionNode,
+	memo: Map<ConditionNode, HashSet.HashSet<string>>,
+): HashSet.HashSet<string> =>
+	remember(memo, node, () => {
+		const tests = (
+			field: string,
+			operands: ReadonlyArray<Condition.Operand>,
+		): HashSet.HashSet<string> =>
+			HashSet.fromIterable(
+				Arr.flatMap(operands, (operand) =>
+					operand._tag === "Literal" ? [literalText(field, operand.value)] : [],
+				),
+			)
+		switch (node._tag) {
+			case "Compare":
+				return tests(node.field, [node.value])
+			case "In":
+				return tests(node.field, node.values)
+			case "And":
+			case "Or":
+				return Arr.reduce(
+					node.conditions as ReadonlyArray<ConditionNode>,
+					HashSet.empty<string>(),
+					(all, child) => HashSet.union(all, literalTestsIn(child, memo)),
+				)
+			case "Not":
+				return literalTestsIn(node.condition, memo)
+			default:
+				return HashSet.empty()
+		}
+	})
+
+/** A test of a field with a field of the principal, as in `eq("ownerId", $.principal("id"))`. */
+type PrincipalTest = readonly [field: string, ref: string]
+
+const principalTests = (node: ConditionNode): ReadonlyArray<PrincipalTest> =>
+	Arr.map(
+		Array.from(principalTestsIn(node, new Map())),
+		(text) => JSON.parse(text) as PrincipalTest,
+	)
+
+/**
+ * The tests of fields with principal fields in a node, each as the JSON text
+ * of a {@link PrincipalTest}. See {@link literalTestsIn}.
+ */
+const principalTestsIn = (
+	node: ConditionNode,
+	memo: Map<ConditionNode, HashSet.HashSet<string>>,
+): HashSet.HashSet<string> =>
+	remember(memo, node, () => {
+		const tests = (
+			field: string,
+			operands: ReadonlyArray<Condition.Operand>,
+		): HashSet.HashSet<string> =>
+			HashSet.fromIterable(
+				Arr.flatMap(operands, (operand) =>
+					operand._tag === "Principal"
+						? [JSON.stringify([field, operand.path])]
+						: [],
+				),
+			)
+		switch (node._tag) {
+			case "Compare":
+				return tests(node.field, [node.value])
+			case "In":
+				return tests(node.field, node.values)
+			case "And":
+			case "Or":
+				return Arr.reduce(
+					node.conditions as ReadonlyArray<ConditionNode>,
+					HashSet.empty<string>(),
+					(all, child) => HashSet.union(all, principalTestsIn(child, memo)),
+				)
+			case "Not":
+				return principalTestsIn(node.condition, memo)
+			default:
+				return HashSet.empty()
+		}
+	})
+
+/**
+ * Tests if a node has a fixed value that is not a {@link Condition.Scalar},
+ * such as `undefined`. A shared node is visited one time.
+ */
+const hasBadLiteralIn = (
+	node: ConditionNode,
+	memo: Map<ConditionNode, boolean>,
+): boolean =>
+	remember(memo, node, () => {
+		const bad = (operands: ReadonlyArray<Condition.Operand>) =>
+			Arr.some(
+				operands,
+				(operand) =>
+					operand._tag === "Literal" &&
+					operand.value !== null &&
+					typeof operand.value !== "string" &&
+					typeof operand.value !== "number" &&
+					typeof operand.value !== "boolean",
+			)
+		switch (node._tag) {
+			case "Compare":
+				return bad([node.value])
+			case "In":
+				return bad(node.values)
+			case "Under":
+				return bad(node.prefix)
+			case "And":
+			case "Or":
+				return Arr.some(
+					node.conditions as ReadonlyArray<ConditionNode>,
+					(child) => hasBadLiteralIn(child, memo),
+				)
+			case "Not":
+				return hasBadLiteralIn(node.condition, memo)
+			default:
+				return false
+		}
+	})
+
+/**
+ * The principal fields in the prefixes of `Under` nodes, each as the JSON text
+ * of the place in the prefix and the path of the field. See
+ * {@link literalTestsIn}.
+ */
+/**
+ * The fixed values in the prefixes of `Under` nodes, each as the JSON text of
+ * the place in the prefix, the value, and the fixed strings of the whole
+ * prefix. A number that JSON can not hold is left out: it fits no field
+ * that a path names. See {@link underRefsIn}.
+ */
+const underLiteralsIn = (
+	node: ConditionNode,
+	memo: Map<ConditionNode, HashSet.HashSet<string>>,
+): HashSet.HashSet<string> =>
+	remember(memo, node, () => {
+		switch (node._tag) {
+			case "Under": {
+				const strings = Arr.map(node.prefix, (operand) =>
+					operand._tag === "Literal" && typeof operand.value === "string"
+						? operand.value
+						: null,
+				)
+				return HashSet.fromIterable(
+					Arr.flatMap(node.prefix, (operand, index) =>
+						operand._tag === "Literal" &&
+						(operand.value === null ||
+							typeof operand.value === "string" ||
+							typeof operand.value === "boolean" ||
+							Number.isFinite(operand.value))
+							? [JSON.stringify([index, operand.value, strings])]
+							: [],
+					),
+				)
+			}
+			case "And":
+			case "Or":
+				return Arr.reduce(
+					node.conditions as ReadonlyArray<ConditionNode>,
+					HashSet.empty<string>(),
+					(all, child) => HashSet.union(all, underLiteralsIn(child, memo)),
+				)
+			case "Not":
+				return underLiteralsIn(node.condition, memo)
+			default:
+				return HashSet.empty()
+		}
+	})
+
+/** A fixed value in a path test. See {@link underLiteralsIn}. */
+type UnderLiteral = readonly [
+	index: number,
+	value: Condition.Scalar,
+	strings: ReadonlyArray<string | null>,
+]
+
+const underLiterals = (node: ConditionNode): ReadonlyArray<UnderLiteral> =>
+	Arr.map(
+		Array.from(underLiteralsIn(node, new Map())),
+		(text) => JSON.parse(text) as UnderLiteral,
+	)
+
+const underRefsIn = (
+	node: ConditionNode,
+	memo: Map<ConditionNode, HashSet.HashSet<string>>,
+): HashSet.HashSet<string> =>
+	remember(memo, node, () => {
+		switch (node._tag) {
+			case "Under": {
+				// The fixed strings of the prefix, so the check can leave out a
+				// resource whose path can not match them.
+				const strings = Arr.map(node.prefix, (operand) =>
+					operand._tag === "Literal" && typeof operand.value === "string"
+						? operand.value
+						: null,
+				)
+				return HashSet.fromIterable(
+					Arr.flatMap(node.prefix, (operand, index) =>
+						operand._tag === "Principal"
+							? [JSON.stringify([index, operand.path, strings])]
+							: [],
+					),
+				)
+			}
+			case "And":
+			case "Or":
+				return Arr.reduce(
+					node.conditions as ReadonlyArray<ConditionNode>,
+					HashSet.empty<string>(),
+					(all, child) => HashSet.union(all, underRefsIn(child, memo)),
+				)
+			case "Not":
+				return underRefsIn(node.condition, memo)
+			default:
+				return HashSet.empty()
+		}
+	})
+
+/**
+ * A principal field in a path test: its place in the prefix, its path, and
+ * the fixed strings of the whole prefix, or `null` for another part.
+ */
+type UnderRef = readonly [
+	index: number,
+	ref: string,
+	strings: ReadonlyArray<string | null>,
+]
+
+const underRefs = (node: ConditionNode): ReadonlyArray<UnderRef> =>
+	Arr.map(
+		Array.from(underRefsIn(node, new Map())),
+		(text) => JSON.parse(text) as UnderRef,
+	)
+
+/**
+ * Tests if the path of a resource may start with a prefix: it is as long as
+ * the prefix, and each fixed string of the prefix is the string of the path
+ * at its place, when the path has a string there.
+ */
+const mayStartWith = (
+	descriptor: Resource.Descriptor,
+	strings: ReadonlyArray<string | null>,
+): boolean =>
+	// A path shorter than the prefix never matches.
+	(descriptor.path?.length ?? 0) >= strings.length &&
+	Arr.every(strings, (string, index) => {
+		const segment = descriptor.path?.[index]
+		return string === null || typeof segment !== "string" || segment === string
+	})
+
+/**
+ * Tests if a principal field may hold the part of a path at `index`: a string
+ * of the path, or a value of the field that the path names there.
+ */
+const fitsPathPart = (
+	descriptor: Resource.Descriptor,
+	index: number,
+	principal: Resource.FieldDomain,
+): boolean => {
+	const segment = descriptor.path?.[index]
+	return segment === undefined
+		? false
+		: typeof segment === "string"
+			? fitsDomain(principal, segment)
+			: domainsMeet(
+					Resource.domainOf(descriptor.schema, segment.field),
+					principal,
+				)
+}
+
+/**
+ * The fields of ordered tests (`lt`, `lte`, `gt`, `gte`) in a node, each as
+ * the JSON text of the field and the operand. See {@link literalTestsIn}.
+ */
+const orderedTestsIn = (
+	node: ConditionNode,
+	memo: Map<ConditionNode, HashSet.HashSet<string>>,
+): HashSet.HashSet<string> =>
+	remember(memo, node, () => {
+		switch (node._tag) {
+			case "Compare":
+				return node.op === "eq" || node.op === "ne"
+					? HashSet.empty()
+					: HashSet.make(
+							JSON.stringify([
+								node.field,
+								// The type of a fixed value, not the value: JSON has no
+								// `Infinity`.
+								node.value._tag === "Literal"
+									? { _tag: "Literal", type: typeof node.value.value }
+									: node.value,
+							]),
+						)
+			case "And":
+			case "Or":
+				return Arr.reduce(
+					node.conditions as ReadonlyArray<ConditionNode>,
+					HashSet.empty<string>(),
+					(all, child) => HashSet.union(all, orderedTestsIn(child, memo)),
+				)
+			case "Not":
+				return orderedTestsIn(node.condition, memo)
+			default:
+				return HashSet.empty()
+		}
+	})
+
+/** The operand of an ordered test: the type of a fixed value, or a principal field. */
+type OrderedOperand =
+	| { readonly _tag: "Literal"; readonly type: string }
+	| { readonly _tag: "Principal"; readonly path: string }
+
+const orderedTests = (
+	node: ConditionNode,
+): ReadonlyArray<readonly [field: string, operand: OrderedOperand]> =>
+	Arr.map(
+		Array.from(orderedTestsIn(node, new Map())),
+		(text) =>
+			JSON.parse(text) as readonly [field: string, operand: OrderedOperand],
+	)
+
+/**
+ * Tests if a field may hold a value with an order: a number or a string. An
+ * ordered test is false for any other value.
+ */
+const isOrdered = (domain: Resource.FieldDomain): boolean =>
+	domain.string ||
+	domain.number !== "none" ||
+	Arr.some(
+		domain.literals,
+		(value) => typeof value === "string" || typeof value === "number",
+	)
+
+/**
+ * Tests if two fields may hold values of one ordered type: two strings or two
+ * numbers. An ordered test of two values of other types is false.
+ */
+const orderedMeet = (
+	left: Resource.FieldDomain,
+	right: Resource.FieldDomain,
+): boolean => {
+	const strings = (domain: Resource.FieldDomain) =>
+		domain.string ||
+		Arr.some(domain.literals, (value) => typeof value === "string")
+	const numbers = (domain: Resource.FieldDomain) =>
+		domain.number !== "none" ||
+		Arr.some(domain.literals, (value) => typeof value === "number")
+	return (strings(left) && strings(right)) || (numbers(left) && numbers(right))
+}
+
+/**
+ * Tests if two fields may hold one value: a value of one type, or a single
+ * value that the other field may hold.
+ */
+const domainsMeet = (
+	left: Resource.FieldDomain,
+	right: Resource.FieldDomain,
+): boolean =>
+	// A principal field that is `null` is a missing value, and a test with a
+	// missing value is false. A principal field that holds an object is not a
+	// scalar, and it is a missing value too. So only scalars can be shared.
+	(left.string && right.string) ||
+	(left.boolean && right.boolean) ||
+	(left.number !== "none" && right.number !== "none") ||
+	Arr.some(left.literals, (value) => fitsDomain(right, value)) ||
+	Arr.some(right.literals, (value) => fitsDomain(left, value))
+
+/**
+ * Tests if a field with this domain may hold a value of the type of `value`.
+ * `null` always fits: a test with `null` is a test that the field is missing.
+ */
+const fitsDomain = (
+	domain: Resource.FieldDomain,
+	value: Condition.Scalar,
+): boolean =>
+	value === null ||
+	domain.literals.includes(value) ||
+	(typeof value === "string" && domain.string) ||
+	(typeof value === "boolean" && domain.boolean) ||
+	(typeof value === "number" && domain.number !== "none")
+
+/**
+ * Checks the names in an encoded policy against the domain. It gives one
+ * message for each problem.
+ */
+const validate = (
+	domain: Domain.Any,
+	root: EncodedNode,
+): ReadonlyArray<Issue> => {
+	const principalPaths = domain.principal.pipe(
+		Resource.fieldPaths,
+		HashSet.fromIterable,
+	)
+	const ruleIssues = (
+		value: EncodedRule,
+		at: ReadonlyArray<PropertyKey>,
+	): ReadonlyArray<Issue> => {
+		const all = value.resources.includes("*")
+		// Each kind is checked one time, also when the list names it again. The
+		// order of the kinds does not change the issues, so a set is enough.
+		const named = Array.from(
+			HashSet.fromIterable(Arr.filter(value.resources, (kind) => kind !== "*")),
+		)
+		const descriptors = Arr.flatMap(named, (kind) => {
+			const descriptor = Domain.descriptorOf(domain, kind)
+			return descriptor === undefined ? [] : [descriptor]
+		})
+		const known = all
+			? Array.from(HashMap.values(domain.resources))
+			: descriptors
+		// The kinds of the rule with one of its actions. The rule never runs on
+		// another kind, so the types of its tests are checked only on these.
+		const applicable = Arr.filter(
+			descriptors,
+			(descriptor) =>
+				value.actions.includes("*") ||
+				Arr.some(value.actions, (action) =>
+					descriptor.actions.includes(action),
+				),
+		)
+		const usedFields = [
+			...Arr.filter(value.fields ?? [], (field) => !field.includes("*")),
+			...(value.when === undefined ? [] : Condition.fields(value.when as Ast)),
+		]
+		return [
+			...Arr.map(
+				Arr.filter(named, (kind) => !HashMap.has(domain.resources, kind)),
+				(kind): Issue => ({
+					path: [...at, "resources"],
+					issue: `There is no resource with the kind "${kind}"`,
+				}),
+			),
+			...Arr.map(
+				Arr.filter(
+					value.actions,
+					(action) =>
+						action !== "*" &&
+						!Arr.some(known, (descriptor) =>
+							descriptor.actions.includes(action),
+						),
+				),
+				(action): Issue => ({
+					path: [...at, "actions"],
+					issue: `The action "${action}" is not an action of these resources`,
+				}),
+			),
+			...Arr.map(
+				Arr.filter(
+					usedFields,
+					(field) =>
+						all ||
+						descriptors.length === 0 ||
+						!Arr.every(
+							descriptors,
+							(descriptor) =>
+								descriptor.fieldPaths.includes(field) ||
+								// A key of a record, or a field deep in a recursive
+								// Schema, or a getter of a nested class.
+								Resource.hasPath(descriptor.schema, field) ||
+								Resource.hasGetter(descriptor.schema, field),
+						),
+				),
+				(field): Issue => ({
+					path: at,
+					issue: `The field "${field}" is not a field of every resource of the rule`,
+				}),
+			),
+			...Arr.map(
+				Arr.filter(
+					value.when === undefined ? [] : principalRefs(value.when),
+					(ref) =>
+						!HashSet.has(principalPaths, ref) &&
+						!Resource.hasPath(domain.principal, ref) &&
+						!Resource.hasGetter(domain.principal, ref),
+				),
+				(ref): Issue => ({
+					path: [...at, "when"],
+					issue: `The principal has no field "${ref}"`,
+				}),
+			),
+			// A test with a value of another type than the field never matches.
+			// The types stop it in a typed rule, so here it is a mistake, and in
+			// a deny rule it would let values through.
+			...Arr.map(
+				Arr.filter(
+					value.when === undefined ? [] : literalTests(value.when),
+					([field, literal]) =>
+						Arr.some(
+							applicable,
+							(descriptor) =>
+								!fitsDomain(
+									Resource.domainOf(descriptor.schema, field),
+									literal,
+								),
+						),
+				),
+				([field, literal]): Issue => ({
+					path: [...at, "when"],
+					issue: `The field "${field}" can not hold the value ${JSON.stringify(literal)}`,
+				}),
+			),
+			...Arr.map(
+				Arr.filter(
+					value.when === undefined ? [] : principalTests(value.when),
+					([field, ref]) =>
+						Arr.some(
+							applicable,
+							(descriptor) =>
+								!domainsMeet(
+									Resource.domainOf(descriptor.schema, field),
+									Resource.domainOf(domain.principal, ref),
+								),
+						),
+				),
+				([field, ref]): Issue => ({
+					path: [...at, "when"],
+					issue: `The field "${field}" can not hold a value of the principal field "${ref}"`,
+				}),
+			),
+			// A condition with a node that is not known would be skipped when it
+			// runs, so it is not taken.
+			...(value.when !== undefined && !Condition.isAst(value.when)
+				? [
+						{
+							path: [...at, "when"],
+							issue: "The condition is not a whole condition tree",
+						} satisfies Issue,
+					]
+				: []),
+			// A fixed value such as `undefined` is not a value of a test. Its
+			// JSON text would be `null`, and the test would mean another thing.
+			...(value.when !== undefined && hasBadLiteralIn(value.when, new Map())
+				? [
+						{
+							path: [...at, "when"],
+							issue:
+								"A test has a fixed value that is not a string, a number, a boolean or null",
+						} satisfies Issue,
+					]
+				: []),
+			// A principal field in a path test must hold a value that the path
+			// may have at that place. Else the test is always false.
+			...Arr.map(
+				Arr.filter(
+					value.when === undefined ? [] : underRefs(value.when),
+					([index, ref, strings]) =>
+						// A rule for every resource may run on each of them that has a
+						// part of its path at this place.
+						Arr.some(
+							// The rule runs only on a kind with one of its actions, and
+							// the test can match only a path that starts with the fixed
+							// strings of the prefix.
+							Arr.filter(
+								all
+									? Arr.filter(
+											known,
+											(descriptor) =>
+												descriptor.path?.[index] !== undefined &&
+												(value.actions.includes("*") ||
+													Arr.some(value.actions, (action) =>
+														descriptor.actions.includes(action),
+													)),
+										)
+									: applicable,
+								(descriptor) => mayStartWith(descriptor, strings),
+							),
+							(descriptor) =>
+								!fitsPathPart(
+									descriptor,
+									index,
+									Resource.domainOf(domain.principal, ref),
+								),
+						),
+				),
+				([, ref]): Issue => ({
+					path: [...at, "when"],
+					issue: `The principal field "${ref}" can not hold a part of the path of the resource`,
+				}),
+			),
+			// A fixed value in a path test at the place of a field of the path
+			// must be a value of that field. Else the test is always false.
+			...Arr.map(
+				Arr.filter(
+					value.when === undefined ? [] : underLiterals(value.when),
+					([index, literal, strings]) =>
+						Arr.some(
+							Arr.filter(
+								all
+									? Arr.filter(
+											known,
+											(descriptor) =>
+												value.actions.includes("*") ||
+												Arr.some(value.actions, (action) =>
+													descriptor.actions.includes(action),
+												),
+										)
+									: applicable,
+								(descriptor) => mayStartWith(descriptor, strings),
+							),
+							(descriptor) => {
+								const segment = descriptor.path?.[index]
+								return (
+									segment !== undefined &&
+									typeof segment !== "string" &&
+									!fitsDomain(
+										Resource.domainOf(descriptor.schema, segment.field),
+										literal,
+									)
+								)
+							},
+						),
+				),
+				([index, literal]): Issue => ({
+					path: [...at, "when"],
+					issue: `The path part ${String(index)} can not hold the value ${JSON.stringify(literal)}`,
+				}),
+			),
+			// An ordered test compares numbers with numbers and strings with
+			// strings. With another value it is always false.
+			...Arr.map(
+				Arr.filter(
+					value.when === undefined ? [] : orderedTests(value.when),
+					([field, operand]) =>
+						(operand._tag === "Literal" &&
+							operand.type !== "string" &&
+							operand.type !== "number") ||
+						Arr.some(applicable, (descriptor) => {
+							const fieldDomain = Resource.domainOf(descriptor.schema, field)
+							// A principal field must share an ordered type with the
+							// field: a string and a number never compare.
+							return operand._tag === "Literal"
+								? !isOrdered(fieldDomain)
+								: !orderedMeet(
+										fieldDomain,
+										Resource.domainOf(domain.principal, operand.path),
+									)
+						}),
+				),
+				([field]): Issue => ({
+					path: [...at, "when"],
+					issue: `The field "${field}" has an ordered test with a value that has no order`,
+				}),
+			),
+		]
+	}
+	const issuesOf = (
+		node: EncodedNode,
+		path: ReadonlyArray<PropertyKey>,
+		level: number,
+	): ReadonlyArray<Issue> => {
+		if (level > maxDepth) {
+			return [
+				{ path, issue: `A policy tree may have at most ${maxDepth} levels` },
+			]
+		}
+		switch (node._tag) {
+			case "Rules":
+				return Arr.flatMap(node.rules, (value, index) =>
+					ruleIssues(value, [...path, "rules", index]),
+				)
+			case "All":
+			case "Any":
+			case "FirstOf":
+				return Arr.flatMap(node.policies, (child, index) =>
+					issuesOf(child, [...path, "policies", index], level + 1),
+				)
+			case "Ceiling":
+				return [
+					...issuesOf(node.cap, [...path, "cap"], level + 1),
+					...issuesOf(node.policy, [...path, "policy"], level + 1),
+				]
+		}
+	}
+	return issuesOf(root, [], 1)
+}
+
+/**
+ * Makes a policy tree from its JSON form. Each rule gets the domain of the
+ * Schema, as a rule from the builder of the domain has it.
+ */
+const decodeNode = (node: EncodedNode, domain: Domain.Any): Node => {
+	switch (node._tag) {
+		case "Rules":
+			return nodes.Rules({
+				algorithm: node.algorithm,
+				rules: node.rules.map((value) =>
+					Rule.make({ ...(value as Rule.Shape), domain }),
+				),
+			})
+		case "All":
+		case "Any":
+		case "FirstOf":
+			return nodes[node._tag]({
+				policies: node.policies.map((child) => decodeNode(child, domain)),
+			})
+		case "Ceiling":
+			return nodes.Ceiling({
+				cap: decodeNode(node.cap, domain),
+				policy: decodeNode(node.policy, domain),
+			})
+	}
+}
+
+/**
+ * Tests if a value is a policy.
  *
  * @stability stable
- * @category schemas
+ * @category guards
  * @since 0.3.0
  */
-export const schema: <D extends Domain.Any>(
-	domain: D,
-) => Schema.Codec<Policy<D>, EncodedNode> = internal.schema
+export const isPolicy = (u: unknown): u is Any => u instanceof PolicyData
 
 /**
- * Tests if a value is a policy.
+ * The Schema of the policies of a domain with no predicates. Decoding checks
+ * every kind, action, field and principal field against the domain, and the
+ * `meta` of each rule against the `meta` Schema of the domain.
  *
  * @stability stable
- * @category guards
+ * @category schemas
  * @since 0.3.0
  */
-export const isPolicy: (u: unknown) => u is Any = internal.isPolicy
+export const schema = <D extends Domain.Any>(
+	domain: D,
+): Schema.Codec<Policy<D>, EncodedNode> =>
+	// The input is any value until the checks of `encodedNodeSchema` run, so
+	// this guard says yes to every object.
+	Schema.declare(
+		(input): input is EncodedNode =>
+			typeof input === "object" && input !== null,
+	).pipe(
+		Schema.check(Schema.makeFilter(fitsLimits)),
+		Schema.decodeTo(
+			encodedNodeSchema(domain.meta),
+			SchemaTransformation.passthrough(),
+		),
+		Schema.check(Schema.makeFilter((node) => validate(domain, node))),
+		Schema.decodeTo(
+			// A policy with a predicate is not a plain policy, and it can not
+			// become JSON.
+			Schema.declare(
+				(u): u is Policy<D> =>
+					isPolicy(u) && u.domain === domain && !nodeHasPredicate(u.node),
+			),
+			SchemaTransformation.transformEffect({
+				decode: (node: EncodedNode) =>
+					Effect.succeed(fromNode(domain, decodeNode(node, domain))),
+				// A tree whose JSON form is too large fails as a Schema issue.
+				encode: (policy: Policy<D>, options) =>
+					encodedSize(policy.node) > maxEncodedNodes
+						? Effect.fail(
+								new SchemaIssue.InvalidValue(
+									{ message: tooLargeMessage },
+									policy,
+									options,
+								),
+							)
+						: Effect.succeed(encodeNode(policy.node)),
+			}),
+		),
+	)