@nmnmcc/ability 0.3.0 → 1.0.1

package/dist/Policy.js

@@ -1,29 +1,167 @@
 import { __exportAll } from "./_virtual/_rolldown/runtime.js";
-import { TypeId as TypeId$1, all as all$1, any as any$1, ceiling as ceiling$1, decide as decide$1, decideSync as decideSync$1, define as define$1, empty as empty$1, explain as explain$1, firstOf as firstOf$1, isPolicy as isPolicy$1, permittedFields as permittedFields$1, residual as residual$1, rules as rules$1, schema as schema$1 } from "./internal/policy.js";
+import { domainOf, fieldPaths, hasGetter, hasPath, isPlainField, kindOf } from "./Resource.js";
+import { always as always$1, and, andAll, builder, evaluate, fields, hasPredicate, isAst, never as never$1, not, orAll, partial, provideContext as provideContext$1, satisfiable, schema as schema$1, simplifier, simplify, toJsonValue } from "./Condition.js";
+import { Allow, Deny, NotApplicable } from "./Decision.js";
+import { descriptorOf } from "./Domain.js";
+import { builder as builder$1, domainOf as domainOf$1, isRule, make, matchesInside, matchesTarget } from "./Rule.js";
+import * as Arr from "effect/Array";
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import * as Data from "effect/Data";
+import { dual } from "effect/Function";
+import * as HashMap from "effect/HashMap";
+import * as HashSet from "effect/HashSet";
+import { hasProperty } from "effect/Predicate";
+import * as SchemaIssue from "effect/SchemaIssue";
+import * as SchemaTransformation from "effect/SchemaTransformation";
+import * as Chunk from "effect/Chunk";
+import * as Ref from "effect/Ref";
 // src/Policy.ts
 var Policy_exports = /* @__PURE__ */ __exportAll({
-	TypeId: () => TypeId,
 	all: () => all,
 	any: () => any,
 	ceiling: () => ceiling,
+	coverage: () => coverage,
 	decide: () => decide,
 	decideSync: () => decideSync,
 	define: () => define,
 	empty: () => empty,
 	explain: () => explain,
 	firstOf: () => firstOf,
+	fitsKind: () => fitsKind,
 	isPolicy: () => isPolicy,
 	permittedFields: () => permittedFields,
+	provideContext: () => provideContext,
 	residual: () => residual,
+	residuals: () => residuals,
 	rules: () => rules,
-	schema: () => schema
+	schema: () => schema,
+	scopeHasValue: () => scopeHasValue,
+	scopeIsEmpty: () => scopeIsEmpty
 });
+const nodes = Data.taggedEnum();
 /**
+* The most nodes that the JSON form of a policy may have. A tree may use one
+* child in many places, and the JSON form writes it out each time, so a small
+* tree may have a very large JSON form.
+*/
+const maxEncodedNodes = 1e5;
+/**
+* The number of nodes of the JSON form of a condition. A shared child counts
+* one time for each place, as the JSON form writes it out each time.
+*/
+const conditionSize = (ast, memo) => remember(memo, ast, () => {
+	switch (ast._tag) {
+		case "And":
+		case "Or": return Arr.reduce(ast.conditions, 1, (size, child) => size + conditionSize(child, memo));
+		case "Not": return 1 + conditionSize(ast.condition, memo);
+		default: return 1;
+	}
+});
+/**
+* The number of nodes of the JSON form of a tree, with the conditions of its
+* rules.
+*/
+const encodedSize = (node, memo = /* @__PURE__ */ new Map(), conditions = /* @__PURE__ */ new Map()) => remember(memo, node, () => {
+	switch (node._tag) {
+		case "Rules": return Arr.reduce(node.rules, 1, (size, value) => size + 1 + (value.when === void 0 ? 0 : conditionSize(value.when, conditions)));
+		case "All":
+		case "Any":
+		case "FirstOf": return Arr.reduce(node.policies, 1, (size, child) => size + encodedSize(child, memo, conditions));
+		case "Ceiling": return 1 + encodedSize(node.cap, memo, conditions) + encodedSize(node.policy, memo, conditions);
+	}
+});
+/** Gives the JSON form of a tree, when it is not too large. */
+const encodeTree = (node) => {
+	if (encodedSize(node) > maxEncodedNodes) throw new globalThis.Error(tooLargeMessage);
+	return encodeNode(node);
+};
+const tooLargeMessage = `The JSON form of this policy would have more than ${String(maxEncodedNodes)} nodes`;
+const encodeNode = (node) => {
+	switch (node._tag) {
+		case "Rules": return {
+			_tag: "Rules",
+			algorithm: node.algorithm,
+			rules: node.rules.map(({ domain: _domain, ...value }) => ({ ...value }))
+		};
+		case "All":
+		case "Any":
+		case "FirstOf": return {
+			_tag: node._tag,
+			policies: node.policies.map(encodeNode)
+		};
+		case "Ceiling": return {
+			_tag: "Ceiling",
+			cap: encodeNode(node.cap),
+			policy: encodeNode(node.policy)
+		};
+	}
+};
+/**
+* The tree of a policy as a value that `JSON.stringify` keeps with no loss.
+* See `Condition.toJsonValue`.
+*/
+const jsonNode = (node, meta) => {
+	const json = (child) => jsonNode(child, meta);
+	switch (node._tag) {
+		case "Rules": return {
+			...node,
+			rules: Arr.map(node.rules, (value) => ({
+				...value,
+				...value.when === void 0 ? {} : { when: toJsonValue(value.when) },
+				...value.meta === void 0 || meta === void 0 ? {} : { meta: Schema.encodeUnknownSync(meta)(value.meta) }
+			}))
+		};
+		case "All":
+		case "Any":
+		case "FirstOf": return {
+			...node,
+			policies: Arr.map(node.policies, json)
+		};
+		case "Ceiling": return {
+			...node,
+			cap: json(node.cap),
+			policy: json(node.policy)
+		};
+	}
+};
+/**
+* The class of every policy value. Two policies of one domain with the same
+* tree are equal. As JSON, a policy is its tree.
+*/
+var PolicyData = class extends Data.Class {
+	toJSON() {
+		return jsonNode(encodeTree(this.node), this.domain.meta);
+	}
+};
+/** The node of a policy, with no types, for the code below. */
+const nodeOf = (policy) => policy.node;
+const fromNode = (domain, node) => new PolicyData({
+	domain,
+	node
+});
+/**
+* Makes a policy from a list of rules.
+*
 * @stability stable
-* @category type IDs
+* @category constructors
 * @since 0.3.0
 */
-const TypeId = TypeId$1;
+const rules = (domain, values, options) => {
+	const node = nodes.Rules({
+		algorithm: options?.algorithm ?? "denyOverrides",
+		rules: Array.from(values)
+	});
+	if (!Arr.every(node.rules, isRule)) throw new globalThis.Error("A value in the list is not a rule");
+	if (Arr.some(node.rules, (value) => {
+		const origin = domainOf$1(value);
+		return origin !== void 0 && origin !== domain;
+	})) throw new globalThis.Error("A rule comes from the builder of another domain");
+	const issues = validate(domain, encodeNode(node));
+	if (issues.length > 0) throw new globalThis.Error(`A rule does not fit the domain: ${issues.map((issue) => issue.issue).join("; ")}`);
+	return fromNode(domain, node);
+};
 /**
 * Makes a policy from a generator function that gives rules. It is pure and it
 * gives its result at once.
@@ -31,9 +169,9 @@ const TypeId = TypeId$1;
 * @example
 * ```ts
 * const policy = Policy.define(App)(function* (_) {
-*   yield* _.allow("read", Bot)
-*   yield* _.allow(["update", "delete"], Bot, {
-*     when: ($) => $.eq("ownerUserId", $.principal("userId")),
+*   yield* _.allow("read", Document)
+*   yield* _.allow(["update", "delete"], Document, {
+*     when: ($) => $.eq("ownerId", $.principal("id")),
 *   })
 * })
 * ```
@@ -42,23 +180,50 @@ const TypeId = TypeId$1;
 * @category constructors
 * @since 0.3.0
 */
-const define = define$1;
+const define = (domain, options) => (body) => {
+	const iterator = body(builder$1(domain));
+	const collected = Arr.unfold(iterator.next(), (state) => state.done === true ? Option.none() : Option.some([state.value, iterator.next(state.value)]));
+	return rules(domain, collected, options);
+};
 /**
-* Makes a policy from a list of rules.
+* A policy with no rules. It is not applicable to any request.
 *
 * @stability stable
 * @category constructors
 * @since 0.3.0
 */
-const rules = rules$1;
+const empty = (domain) => rules(domain, []);
+const sameDomain = (policies) => {
+	if (!Arr.every(policies, isPolicy)) throw new globalThis.Error("A value in the list is not a policy");
+	const domain = policies[0].domain;
+	if (!Arr.every(policies, (policy) => policy.domain === domain)) throw new globalThis.Error("Policies from two domains can not be put together");
+	return domain;
+};
 /**
-* A policy with no rules. It is not applicable to any request.
-*
-* @stability stable
-* @category constructors
-* @since 0.3.0
+* The most levels in a policy tree. A walk over a tree calls itself for each
+* level, so a much deeper tree could fill the stack and stop a check.
+*/
+const maxDepth = 256;
+/** The number of levels of a policy tree. */
+const heightOf = (node, memo = /* @__PURE__ */ new Map()) => remember(memo, node, () => {
+	const height = (child) => heightOf(child, memo);
+	switch (node._tag) {
+		case "Rules": return 1;
+		case "All":
+		case "Any":
+		case "FirstOf": return 1 + Arr.reduce(node.policies, 0, (top, child) => Math.max(top, height(child)));
+		case "Ceiling": return 1 + Math.max(height(node.cap), height(node.policy));
+	}
+});
+/**
+* Makes a policy from a new node. Its children come from policies, so each
+* has at most `maxDepth` levels, and the walk of `heightOf` is safe.
 */
-const empty = empty$1;
+const fromCombined = (domain, node) => {
+	if (heightOf(node) > maxDepth) throw new globalThis.Error(`A policy tree may have at most ${maxDepth} levels`);
+	return fromNode(domain, node);
+};
+const combine = (tag) => (policies) => fromCombined(sameDomain(policies), nodes[tag]({ policies: policies.map(nodeOf) }));
 /**
 * Every policy must allow, and one deny is enough to deny. With some policies
 * not applicable and none that deny, the result is not applicable.
@@ -67,7 +232,7 @@ const empty = empty$1;
 * @category combinators
 * @since 0.3.0
 */
-const all = all$1;
+const all = combine("All");
 /**
 * One allow is enough. Without an allow, one deny gives a deny.
 *
@@ -75,7 +240,7 @@ const all = all$1;
 * @category combinators
 * @since 0.3.0
 */
-const any = any$1;
+const any = combine("Any");
 /**
 * The first policy that allows or denies gives the answer.
 *
@@ -83,7 +248,7 @@ const any = any$1;
 * @category combinators
 * @since 0.3.0
 */
-const firstOf = firstOf$1;
+const firstOf = combine("FirstOf");
 /**
 * Puts a limit on a policy. A deny from `cap` always wins. An allow from `cap`
 * does nothing.
@@ -92,7 +257,170 @@ const firstOf = firstOf$1;
 * @category combinators
 * @since 0.3.0
 */
-const ceiling = ceiling$1;
+const ceiling = dual(2, (policy, cap) => fromCombined(sameDomain([policy, cap]), nodes.Ceiling({
+	cap: nodeOf(cap),
+	policy: nodeOf(policy)
+})));
+/**
+* Gives the answer for a key from a memo, or works it out and keeps it. One
+* node may be a child of many nodes, so each walk over a tree keeps its work
+* on a node in a memo that the walk makes for itself. No memo lives longer
+* than one call.
+*
+* The memo is a native `Map`, because it must find a node by the node itself.
+* An Effect `HashMap` finds a key by `Equal`, and the nodes are Effect data,
+* so it would hash the whole structure of a node, and a shared child again for
+* each path to it.
+*/
+const remember = (memo, key, work) => {
+	if (memo.has(key)) return memo.get(key);
+	const result = work();
+	memo.set(key, result);
+	return result;
+};
+const provideNode = (node, context, memo = {
+	done: /* @__PURE__ */ new Map(),
+	predicates: /* @__PURE__ */ new Map()
+}) => !nodeHasPredicate(node, memo.predicates) ? node : remember(memo.done, node, () => provideOnce(node, context, memo));
+const provideOnce = (node, context, memo) => {
+	switch (node._tag) {
+		case "Rules": return nodes.Rules({
+			algorithm: node.algorithm,
+			rules: node.rules.map((value) => value.when === void 0 || !hasPredicate(value.when) ? value : make({
+				...value,
+				when: provideContext$1(value.when, context)
+			}))
+		});
+		case "All":
+		case "Any":
+		case "FirstOf": return nodes[node._tag]({ policies: Arr.map(node.policies, (child) => provideNode(child, context, memo)) });
+		case "Ceiling": return nodes.Ceiling({
+			cap: provideNode(node.cap, context, memo),
+			policy: provideNode(node.policy, context, memo)
+		});
+	}
+};
+/**
+* Gives the services in `context` to every predicate of a policy, so the
+* policy needs no services when it runs.
+*
+* @stability stable
+* @category services
+* @since 1.0.0
+*/
+const provideContext = dual(2, (policy, context) => fromNode(policy.domain, provideNode(nodeOf(policy), context)));
+const ruleApplies = (value, context, path) => {
+	if (!matchesTarget(value, context)) return Effect.succeed(false);
+	const test = value.when === void 0 ? Effect.succeed(true) : evaluate(value.when, context.input);
+	const trace = context.trace;
+	return trace === void 0 ? test : Effect.tap(test, (applies) => Ref.update(trace, Chunk.append({
+		path,
+		rule: value,
+		applies
+	})));
+};
+const fromRule = (value) => value._tag === "Allow" ? Allow({ rule: value }) : value.reason === void 0 ? Deny({ rule: value }) : Deny({
+	rule: value,
+	reason: value.reason
+});
+/** Gives the first rule that applies, in order. */
+const firstApplying = (candidates, context, path) => Effect.map(Effect.findFirst(candidates, ([value, index]) => ruleApplies(value, context, [...path, index])), Option.map(([value]) => value));
+/** Gives the first result that is found, and tests `next` only when none is. */
+const orElse = (first, next) => Effect.filterOrElse(first, Option.isSome, next);
+const decideRules = (node, context, path) => {
+	const indexed = Arr.map(node.rules, (value, index) => [value, index]);
+	const denies = Arr.filter(indexed, ([value]) => value._tag === "Deny");
+	const allows = Arr.filter(indexed, ([value]) => value._tag === "Allow");
+	const first = (candidates) => firstApplying(candidates, context, path);
+	const found = (() => {
+		switch (node.algorithm) {
+			case "denyOverrides": return orElse(first(denies), () => first(allows));
+			case "permitOverrides": return orElse(first(allows), () => first(denies));
+			case "firstApplicable": return first(indexed);
+			case "lastApplicable": return first(Arr.reverse(indexed));
+		}
+	})();
+	return Effect.map(found, Option.match({
+		onNone: () => NotApplicable,
+		onSome: fromRule
+	}));
+};
+const decideNode = (node, context, path) => {
+	if (usesPredicate(node, context)) return decideOnce(node, context, path);
+	const cached = context.decisions.get(node);
+	return cached !== void 0 ? Effect.succeed(cached) : Effect.tap(decideOnce(node, context, path), (decision) => Effect.sync(() => context.decisions.set(node, decision)));
+};
+/**
+* Decides the children in order. After each child, `step` stops with a
+* decision, or gives the state for the next child. After the last child,
+* `end` gives the decision. A child after a stop is not decided, so its
+* predicates do not run.
+*/
+const walkChildren = (children, context, path, start, step, end) => {
+	const go = (index, state) => index === children.length ? Effect.succeed(end(state)) : Effect.flatMap(decideNode(children[index], context, [...path, index]), (decision) => {
+		const next = step(state, decision);
+		return next._tag === "Stop" ? Effect.succeed(next.decision) : go(index + 1, next.state);
+	});
+	return go(0, start);
+};
+const stop = (decision) => ({
+	_tag: "Stop",
+	decision
+});
+const next = (state) => ({
+	_tag: "Next",
+	state
+});
+const decideOnce = (node, context, path) => {
+	switch (node._tag) {
+		case "Rules": return decideRules(node, context, path);
+		case "All": return walkChildren(node.policies, context, path, {
+			firstAllow: Option.none(),
+			allAllow: node.policies.length > 0
+		}, (state, decision) => decision._tag === "Deny" ? stop(decision) : next({
+			firstAllow: Option.orElse(state.firstAllow, () => decision._tag === "Allow" ? Option.some(decision) : Option.none()),
+			allAllow: state.allAllow && decision._tag === "Allow"
+		}), (state) => state.allAllow ? Option.getOrElse(state.firstAllow, () => NotApplicable) : NotApplicable);
+		case "Any": return walkChildren(node.policies, context, path, Option.none(), (firstDeny, decision) => decision._tag === "Allow" ? stop(decision) : next(Option.orElse(firstDeny, () => decision._tag === "Deny" ? Option.some(decision) : Option.none())), (firstDeny) => Option.getOrElse(firstDeny, () => NotApplicable));
+		case "FirstOf": return walkChildren(node.policies, context, path, void 0, (_, decision) => decision._tag === "NotApplicable" ? next(void 0) : stop(decision), () => NotApplicable);
+		case "Ceiling": return Effect.filterOrElse(decideNode(node.cap, context, [...path, 0]), (capped) => capped._tag === "Deny", () => decideNode(node.policy, context, [...path, 1]));
+	}
+};
+/**
+* Tests if a request fits its kind: the action is an action of the kind, and
+* the field, if there is one, is a field of the kind. The types check this,
+* but a value with a union type, or a value from outside, may get past them.
+* A rule for every action (`"*"`) must not cover an action that the kind does
+* not have, so such a request is not applicable.
+*
+* @stability stable
+* @category predicates
+* @since 1.0.0
+*/
+const fitsKind = (descriptor, request) => descriptor.actions.includes(request.action) && (request.field === void 0 || descriptor.fieldPaths.includes(request.field) || hasPath(descriptor.schema, request.field) || hasGetter(descriptor.schema, request.field));
+const makeContext = (domain, request, trace) => {
+	const kind = kindOf(request.resource);
+	const descriptor = kind === void 0 ? void 0 : descriptorOf(domain, kind);
+	if (kind === void 0 || descriptor === void 0 || !fitsKind(descriptor, request)) return;
+	return {
+		action: request.action,
+		kind,
+		field: request.field,
+		input: {
+			value: request.resource,
+			principal: request.principal,
+			path: descriptor.path
+		},
+		descriptor,
+		trace,
+		predicates: /* @__PURE__ */ new Map(),
+		decisions: /* @__PURE__ */ new Map()
+	};
+};
+const decideAny = (policy, request) => Effect.suspend(() => {
+	const context = makeContext(policy.domain, request, void 0);
+	return context === void 0 ? Effect.succeed(NotApplicable) : decideNode(nodeOf(policy), context, []);
+});
 /**
 * Gives the decision of a policy for a request.
 *
@@ -100,7 +428,7 @@ const ceiling = ceiling$1;
 * @category evaluation
 * @since 0.3.0
 */
-const decide = decide$1;
+const decide = dual(2, decideAny);
 /**
 * Gives the decision of a policy with no predicates, at once.
 *
@@ -108,47 +436,883 @@ const decide = decide$1;
 * @category evaluation
 * @since 0.3.0
 */
-const decideSync = decideSync$1;
+const decideSync = dual(2, (policy, request) => Effect.runSync(decideAny(policy, request)));
 /**
 * Gives the decision of a policy and the rules that were tested to make it.
 *
+* One node may be a child of many nodes. A node with no predicate that the
+* request may use gives the same decision each time, so its rules are tested,
+* and are in the steps, only the first time. So a small tree with many shared
+* nodes gives a short list of steps.
+*
 * @stability stable
 * @category evaluation
 * @since 0.3.0
 */
-const explain = explain$1;
+const explain = dual(2, (policy, request) => Effect.gen(function* () {
+	const trace = yield* Ref.make(Chunk.empty());
+	const context = makeContext(policy.domain, request, trace);
+	if (context === void 0) return {
+		decision: NotApplicable,
+		steps: []
+	};
+	return {
+		decision: yield* decideNode(nodeOf(policy), context, []),
+		steps: Chunk.toReadonlyArray(yield* Ref.get(trace))
+	};
+}));
+/**
+* Tests if a deny rule of the request names a part inside `field`.
+*/
+const deniesInside = (node, target, field, seen = /* @__PURE__ */ new Set()) => {
+	if (seen.has(node)) return false;
+	seen.add(node);
+	switch (node._tag) {
+		case "Rules": return node.rules.some((value) => value._tag === "Deny" && value.fields !== void 0 && value.fields.some((pattern) => matchesInside(pattern, field)) && (value.actions.includes("*") || value.actions.includes(target.action)) && (value.resources.includes("*") || value.resources.includes(target.kind)));
+		case "All":
+		case "Any":
+		case "FirstOf": return node.policies.some((child) => deniesInside(child, target, field, seen));
+		case "Ceiling": return deniesInside(node.cap, target, field, seen) || deniesInside(node.policy, target, field, seen);
+	}
+};
+/**
+* Gives the fields of a resource value that the policy lets a request use. It
+* tests each field of the resource Schema, with dots for nested fields.
+*
+* A field that holds more than one value, such as a record, is left out when a
+* deny rule names a part of it. The list can not name that part, and the whole
+* field would show it.
+*
+* @stability stable
+* @category evaluation
+* @since 0.3.0
+*/
+const permittedFields = dual(2, (policy, request) => {
+	const kind = kindOf(request.resource);
+	const descriptor = kind === void 0 ? void 0 : descriptorOf(policy.domain, kind);
+	if (descriptor === void 0) return Effect.succeed([]);
+	return Effect.filter(descriptor.fieldPaths, (field) => Effect.map(decideAny(policy, {
+		...request,
+		field
+	}), (result) => result._tag === "Allow" && !(descriptor.openPaths.includes(field) && deniesInside(nodeOf(policy), {
+		...request,
+		kind: descriptor.kind
+	}, field))));
+});
+const always = always$1;
+const never = never$1;
+/**
+* The most nodes that a residual condition may have. A policy tree may use a
+* condition of a child two times, in its allow condition and in its deny
+* condition, so a small policy may give a very large condition. Past this
+* size, `residual` throws an error.
+*/
+const maxResidualSize = 1e4;
+/**
+* The most levels that a residual condition may have. The rules of an ordered
+* algorithm, such as `firstApplicable`, give one level for each run of rules
+* with one tag. A walk over a condition calls itself for each level, so a much
+* deeper condition could fill the stack. Past this depth, `residual` throws an
+* error.
+*/
+const maxResidualDepth = 500;
+/**
+* A residual condition is too large. See {@link maxResidualSize} and
+* {@link maxResidualDepth}.
+*/
+var TooLarge = class {};
+const makeBuild = () => {
+	const simplify = simplifier();
+	const sizes = /* @__PURE__ */ new Map();
+	/** Gives the number of nodes in a condition, as JSON would have them. */
+	const sizeOf = (ast) => remember(sizes, ast, () => {
+		switch (ast._tag) {
+			case "And":
+			case "Or": return Arr.reduce(ast.conditions, 1, (size, child) => size + sizeOf(child));
+			case "Not": return 1 + sizeOf(ast.condition);
+			default: return 1;
+		}
+	});
+	const depths = /* @__PURE__ */ new Map();
+	/**
+	* Gives the number of levels in a condition. Each child went through
+	* `limit`, so this walk is not deeper than `maxResidualDepth`.
+	*/
+	const depthOf = (ast) => remember(depths, ast, () => {
+		switch (ast._tag) {
+			case "And":
+			case "Or": return 1 + Arr.reduce(ast.conditions, 0, (top, child) => Math.max(top, depthOf(child)));
+			case "Not": return 1 + depthOf(ast.condition);
+			default: return 1;
+		}
+	});
+	const limit = (ast) => {
+		if (sizeOf(ast) > maxResidualSize || depthOf(ast) > maxResidualDepth) throw new TooLarge();
+		return ast;
+	};
+	return {
+		and: (values) => limit(simplify(andAll(values))),
+		or: (values) => limit(simplify(orAll(values))),
+		not: (value) => limit(simplify(not(value)))
+	};
+};
+const ruleCondition = (value, context) => !matchesTarget(value, context) ? never : value.when === void 0 ? always : partial(value.when, context.input);
+/**
+* Gives the conditions for "the first rule that applies is an allow rule" and
+* "the first rule that applies is a deny rule".
+*/
+const firstApplicableResidual = (values, context) => {
+	const { and, not, or } = context.build;
+	const runs = Arr.isReadonlyArrayNonEmpty(values) ? Arr.groupWith(values, (a, b) => a._tag === b._tag) : [];
+	return Arr.reduceRight(runs, {
+		allow: never,
+		deny: never
+	}, (rest, run) => {
+		const applies = or(Arr.map(run, (value) => ruleCondition(value, context)));
+		return run[0]._tag === "Allow" ? {
+			allow: or([applies, rest.allow]),
+			deny: and([not(applies), rest.deny])
+		} : {
+			allow: and([not(applies), rest.allow]),
+			deny: or([applies, rest.deny])
+		};
+	});
+};
+const residualNode = (node, context) => remember(context.pairs, node, () => residualOnce(node, context));
+const residualOnce = (node, context) => {
+	const { and, not, or } = context.build;
+	switch (node._tag) {
+		case "Rules": switch (node.algorithm) {
+			case "denyOverrides": {
+				const deny = or(node.rules.filter((value) => value._tag === "Deny").map((value) => ruleCondition(value, context)));
+				return {
+					allow: and([not(deny), or(node.rules.filter((value) => value._tag === "Allow").map((value) => ruleCondition(value, context)))]),
+					deny
+				};
+			}
+			case "permitOverrides": {
+				const allow = or(node.rules.filter((value) => value._tag === "Allow").map((value) => ruleCondition(value, context)));
+				return {
+					allow,
+					deny: and([not(allow), or(node.rules.filter((value) => value._tag === "Deny").map((value) => ruleCondition(value, context)))])
+				};
+			}
+			case "firstApplicable": return firstApplicableResidual(node.rules, context);
+			case "lastApplicable": return firstApplicableResidual(node.rules.slice().reverse(), context);
+		}
+		case "All": {
+			if (node.policies.length === 0) return {
+				allow: never,
+				deny: never
+			};
+			const pairs = node.policies.map((child) => residualNode(child, context));
+			const deny = or(pairs.map((pair) => pair.deny));
+			return {
+				allow: and([...pairs.map((pair) => pair.allow), not(deny)]),
+				deny
+			};
+		}
+		case "Any": {
+			const pairs = node.policies.map((child) => residualNode(child, context));
+			const allow = or(pairs.map((pair) => pair.allow));
+			return {
+				allow,
+				deny: and([not(allow), or(pairs.map((pair) => pair.deny))])
+			};
+		}
+		case "FirstOf": return Arr.reduceRight(node.policies, {
+			allow: never,
+			deny: never
+		}, (rest, child) => {
+			const pair = residualNode(child, context);
+			return {
+				allow: or([pair.allow, and([not(pair.deny), rest.allow])]),
+				deny: or([pair.deny, and([not(pair.allow), rest.deny])])
+			};
+		});
+		case "Ceiling": {
+			const cap = residualNode(node.cap, context);
+			const inner = residualNode(node.policy, context);
+			return {
+				allow: and([not(cap.deny), inner.allow]),
+				deny: or([cap.deny, inner.deny])
+			};
+		}
+	}
+};
+/** The name of the predicate of a residual condition that runs `decide`. */
+const policyPredicate = "policy";
+/** Tests if a rule of a policy tree has a predicate. */
+const nodeHasPredicate = (node, memo = /* @__PURE__ */ new Map()) => remember(memo, node, () => {
+	const test = (child) => nodeHasPredicate(child, memo);
+	switch (node._tag) {
+		case "Rules": return Arr.some(node.rules, (value) => value.when !== void 0 && hasPredicate(value.when));
+		case "All":
+		case "Any":
+		case "FirstOf": return Arr.some(node.policies, test);
+		case "Ceiling": return test(node.cap) || test(node.policy);
+	}
+});
+const usesPredicate = (node, context) => remember(context.predicates, node, () => usesPredicateOnce(node, context));
+const usesPredicateOnce = (node, context) => {
+	switch (node._tag) {
+		case "Rules": return node.rules.some((value) => value.when !== void 0 && hasPredicate(value.when) && matchesTarget(value, context));
+		case "All":
+		case "Any":
+		case "FirstOf": return node.policies.some((child) => usesPredicate(child, context));
+		case "Ceiling": return usesPredicate(node.cap, context) || usesPredicate(node.policy, context);
+	}
+};
+const isScopeValue = (operand) => operand._tag === "Principal" || operand.value === null || typeof operand.value === "string" || typeof operand.value === "number" || typeof operand.value === "boolean";
+/**
+* Gives the problem of a scope that is not plain data, or `undefined` when it
+* is plain data. A predicate, or a value that a condition can not hold, such
+* as `undefined` from a route parameter, is a defect: such a scope could make
+* a check pass on the wrong values. A shared node is tested one time.
+*/
+const scopeProblem = (ast, memo = /* @__PURE__ */ new Map()) => remember(memo, ast, () => {
+	switch (ast._tag) {
+		case "Predicate": return "can not have a predicate";
+		case "Compare": return isScopeValue(ast.value) ? null : `has a value for "${ast.field}" that is not a scalar`;
+		case "In": return Arr.every(ast.values, isScopeValue) ? null : `has a value for "${ast.field}" that is not a scalar`;
+		case "Under": return Arr.every(ast.prefix, isScopeValue) ? null : "has a path part that is not a scalar";
+		case "And":
+		case "Or": return Option.getOrNull(Arr.findFirst(Arr.map(ast.conditions, (child) => scopeProblem(child, memo)), (problem) => problem !== void 0)) ?? null;
+		case "Not": return scopeProblem(ast.condition, memo) ?? null;
+		default: return null;
+	}
+}) ?? void 0;
+/**
+* Gives the condition of a scope, with the principal and the path in it.
+* With no scope, it is `True`.
+*/
+/**
+* The fields that a scope reads, before it is made smaller. A smaller scope
+* may leave out a read that fails, such as a getter.
+*/
+const scopeFields = (within) => within === void 0 ? [] : fields(within(builder()));
+const scopeOf = (within, input) => {
+	if (within === void 0) return always;
+	const ast = within(builder());
+	const problem = scopeProblem(ast);
+	if (problem !== void 0) throw new globalThis.Error(`A scope ${problem}`);
+	return partial(ast, input);
+};
+const residualsAny = (policy, request) => scopedResiduals(policy, request);
+const scopedResiduals = (policy, request) => {
+	const descriptor = descriptorOf(policy.domain, request.kind);
+	if (descriptor === void 0 || !fitsKind(descriptor, request)) return {
+		scope: never,
+		allow: never,
+		deny: never,
+		schema: void 0
+	};
+	if (scopeReadsGetter(request, descriptor)) throw new globalThis.Error("The scope of this request reads a getter, so it has no residual condition");
+	const input = {
+		principal: request.principal,
+		path: descriptor.path
+	};
+	const scope = scopeOf(request.within, input);
+	const build = makeBuild();
+	const and = build.and;
+	const inScope = (pair) => ({
+		scope,
+		allow: and([scope, pair.allow]),
+		deny: and([scope, pair.deny]),
+		schema: descriptor.schema
+	});
+	if (scope._tag === "False") return inScope({
+		allow: never,
+		deny: never
+	});
+	const context = {
+		action: request.action,
+		kind: request.kind,
+		field: request.field,
+		input,
+		descriptor,
+		pairs: /* @__PURE__ */ new Map(),
+		predicates: /* @__PURE__ */ new Map(),
+		build
+	};
+	if (!usesPredicate(nodeOf(policy), context)) {
+		if (readsGetter(policy, request, descriptor)) throw new globalThis.Error("A rule of this request reads a getter, so it has no residual condition");
+		try {
+			return inScope(residualNode(nodeOf(policy), context));
+		} catch (error) {
+			if (error instanceof TooLarge) throw new globalThis.Error(`The residual condition of this request would have more than ${String(maxResidualSize)} nodes or ${String(maxResidualDepth)} levels`);
+			throw error;
+		}
+	}
+	const decision = (value) => decideNode(policy.node, {
+		action: request.action,
+		kind: request.kind,
+		field: request.field,
+		input: {
+			value,
+			principal: request.principal,
+			path: descriptor.path
+		},
+		descriptor,
+		trace: void 0,
+		predicates: /* @__PURE__ */ new Map(),
+		decisions: /* @__PURE__ */ new Map()
+	}, []);
+	const test = (tag) => builder().predicate(policyPredicate, (value) => kindOf(value) === request.kind ? Effect.map(decision(value), (result) => result._tag === tag) : Effect.succeed(false));
+	return inScope({
+		allow: test("Allow"),
+		deny: test("Deny")
+	});
+};
 /**
 * Gives the condition on resource values for which the policy allows a
 * request. It has no principal fields and no `Under` nodes, so you can give it
 * to `Condition.fold`. It is `True` when the policy allows every value of the
 * kind, and `False` when it allows none.
 *
-* Predicates stay in the condition. They take the principal with them.
+* With a scope (`within`), the condition is the scope and the residual
+* together, so it is false for every value outside the scope. Give the policy
+* first to use a scope. The condition comes from its parts, with no search. To
+* know if it allows all of the scope or none of it, use {@link coverage}.
+*
+* When a rule that the request may use has a predicate, the condition is one
+* predicate with the name `"policy"`. It runs the whole policy for each value,
+* so its answers and its failures are the same as those of {@link decide}. It
+* takes the principal with it. Give it resource values with their `_tag`. It
+* is false for a value of another kind.
+*
+* A policy tree may use the condition of a child two times, so a small policy
+* may give a very large condition. When the condition would have more than
+* 10000 nodes or 500 levels, this function throws an error. In an
+* `Authorizer`, the error is
+* a defect, so the check fails.
 *
 * @stability stable
 * @category evaluation
 * @since 0.3.0
 */
-const residual = residual$1;
+const residual = dual(2, (policy, request) => residualsAny(policy, request).allow);
 /**
-* Gives the fields of a resource value that the policy lets a request use. It
-* tests each field of the resource Schema, with dots for nested fields.
+* Gives both residual conditions of a request: the values that the policy
+* allows, and the values that it denies. A value in neither is not
+* applicable. See {@link residual}.
 *
 * @stability stable
 * @category evaluation
-* @since 0.3.0
+* @since 1.0.0
 */
-const permittedFields = permittedFields$1;
+const residuals = dual(2, residualsAny);
+const coverages = Data.taggedEnum();
 /**
-* The Schema of the policies of a domain with no predicates. Decoding checks
-* every kind, action, field and principal field against the domain, and the
-* `meta` of each rule against the `meta` Schema of the domain.
+* Tests if a rule that the request may use, or its scope, reads a getter of
+* a class, in any branch of a union.
+*/
+const readsGetter = (policy, request, descriptor) => scopeReadsGetter(request, descriptor) || !readsOnly(nodeOf(policy), targetOf(request, descriptor), (field) => !readsGetterAt(descriptor.schema, field), /* @__PURE__ */ new Map());
+/**
+* Tests if a read of a field may read a getter of a class: at the field, or
+* at a field on the way to it, in any branch of a union.
+*/
+const readsGetterAt = (schema, field) => {
+	const parts = field.split(".");
+	return Arr.some(Arr.range(1, parts.length), (count) => hasGetter(schema, parts.slice(0, count).join(".")));
+};
+/**
+* Tests if the scope of a request reads a getter of a class. A scope is made
+* smaller in each residual, also next to a predicate that runs `decide`, so
+* such a scope has no residual.
+*/
+const scopeReadsGetter = (request, descriptor) => !Arr.every(scopeFields(request.within), (field) => !readsGetterAt(descriptor.schema, field));
+/**
+* Tests if a request has no residual: its scope reads a getter, or it has a
+* plain residual and a rule that it may use reads a getter. A residual with
+* a predicate runs `decide`, so the reads of its rules stay.
+*/
+const hasNoResidual = (policy, request, descriptor) => scopeReadsGetter(request, descriptor) || !usesPredicate(nodeOf(policy), targetOf(request, descriptor)) && readsGetter(policy, request, descriptor);
+/** The parts of a request that tell which rules it may use. */
+const targetOf = (request, descriptor) => ({
+	action: request.action,
+	kind: request.kind,
+	field: request.field,
+	descriptor,
+	predicates: /* @__PURE__ */ new Map()
+});
+/**
+* Tests if each field that a rule that the request may use reads passes
+* `test`. It looks at the conditions before they are made smaller. A smaller
+* condition may leave out a field, but a read of that field, such as a
+* getter, may fail when `decide` runs. A shared node is visited one time.
+*/
+const readsOnly = (node, target, test, memo) => remember(memo, node, () => {
+	switch (node._tag) {
+		case "Rules": return Arr.every(node.rules, (value) => value.when === void 0 || !matchesTarget(value, target) || Arr.every(fields(value.when), test));
+		case "All":
+		case "Any":
+		case "FirstOf": return Arr.every(node.policies, (child) => readsOnly(child, target, test, memo));
+		case "Ceiling": return readsOnly(node.cap, target, test, memo) && readsOnly(node.policy, target, test, memo);
+	}
+});
+const coverageAny = (policy, request) => {
+	const descriptor = descriptorOf(policy.domain, request.kind);
+	if (descriptor !== void 0 && hasNoResidual(policy, request, descriptor)) return coverages.Unknown({
+		condition: never,
+		reason: "schema"
+	});
+	const scoped = scopedResiduals(policy, request);
+	const allowed = scoped.allow;
+	if (descriptor !== void 0) {
+		const plain = (field) => isPlainField(descriptor.schema, field);
+		if (readsGetter(policy, request, descriptor) || !Arr.every(scopeFields(request.within), plain) || !readsOnly(nodeOf(policy), targetOf(request, descriptor), plain, /* @__PURE__ */ new Map())) return coverages.Unknown({
+			condition: allowed,
+			reason: "schema"
+		});
+	}
+	const options = { schema: scoped.schema };
+	const some = allowed._tag === "False" ? void 0 : satisfiable(allowed, options);
+	if (some === void 0 || some._tag === "Unsatisfiable") return coverages.None({ condition: never });
+	if (some._tag === "Unknown") return coverages.Unknown({
+		condition: allowed,
+		reason: some.reason
+	});
+	const refused = simplify(and(scoped.scope, not(allowed)));
+	const missing = refused._tag === "False" ? void 0 : satisfiable(refused, options);
+	if (missing === void 0 || missing._tag === "Unsatisfiable") return coverages.All({ condition: scoped.scope });
+	if (missing._tag === "Unknown") return coverages.Unknown({
+		condition: allowed,
+		reason: missing.reason
+	});
+	return coverages.Some({
+		condition: allowed,
+		allowed: some.example,
+		refused: missing.example
+	});
+};
+/**
+* Tests if the scope of a request has a value of the Schema of its kind. The
+* answer is `true` only when the search finds such a value. When the search
+* can not say, the answer is `false`. So a "yes" from it is safe to act on,
+* as for the question "may the decider answer for this scope?".
 *
 * @stability stable
-* @category schemas
-* @since 0.3.0
+* @category evaluation
+* @since 1.0.0
+*/
+const scopeHasValue = (policy, request) => {
+	const scoped = scopedResiduals(policy, request);
+	return satisfiable(scoped.scope, { schema: scoped.schema })._tag === "Satisfiable";
+};
+/**
+* Tests if the scope of a request has no value of the Schema of its kind. A
+* scope with a mistake, such as two values for one field, is empty. With no
+* scope, the answer is `false` when the kind has a value. When the search can
+* not say, the answer is `false`.
+*
+* @stability stable
+* @category evaluation
+* @since 1.0.0
 */
-const schema = schema$1;
+const scopeIsEmpty = (policy, request) => {
+	const scoped = scopedResiduals(policy, request);
+	return satisfiable(scoped.scope, { schema: scoped.schema })._tag === "Unsatisfiable";
+};
+/**
+* Tells how much of a scope the policy allows: all of it, none of it, or some
+* of it. See {@link Coverage}. With no scope (`within`), the scope is every
+* value of the kind.
+*
+* The answer comes from {@link Condition.satisfiable} with the Schema of the
+* resource, so it is exact for the values of the Schema. When a condition
+* tests a field that is not a plain scalar (see `Resource.isPlainField`),
+* such as a field with a check other than a finite or integer check, the
+* answer is `Unknown`, and a check on the kind says no.
+*
+* `Some` means that some value of the Schema is allowed. It does not mean that
+* such a value is in your database. To know that, run `condition` as a query.
+*
+* @stability stable
+* @category evaluation
+* @since 1.0.0
+*/
+const coverage = dual(2, coverageAny);
+const AlgorithmSchema = Schema.Literals([
+	"denyOverrides",
+	"permitOverrides",
+	"firstApplicable",
+	"lastApplicable"
+]);
+const encodedRuleSchema = (meta) => Schema.Struct({
+	_tag: Schema.Literals(["Allow", "Deny"]),
+	actions: Schema.Array(Schema.String),
+	resources: Schema.Array(Schema.String),
+	when: Schema.optionalKey(schema$1),
+	fields: Schema.String.pipe(Schema.Array, Schema.optionalKey),
+	reason: Schema.optionalKey(Schema.String),
+	id: Schema.optionalKey(Schema.String),
+	meta: Schema.optionalKey(meta ?? Schema.Never)
+});
+/**
+* The most levels of objects and arrays in the JSON form of a policy. The
+* Schema of a policy calls itself for each level, so a much deeper input
+* could fill the stack before the checks of the policy run. A policy tree of
+* `maxDepth` levels with deep conditions stays well below this.
+*/
+const maxJsonDepth = 1e3;
+/**
+* The most objects and arrays in the JSON form of an input, with a shared one
+* counted for each place. The decoder writes out a shared one each time, so
+* an input with few objects may give a very large tree.
+*/
+const maxInputNodes = 1e6;
+/**
+* Measures a value, or gives `undefined` when it is higher than `levels`. A
+* shared object is measured one time. The walk stops at that height, so it
+* does not fill the stack itself. The memo is a native `Map`, because it
+* must find an object by the object itself.
+*/
+const measure = (input, levels, memo) => {
+	if (typeof input !== "object" || input === null) return {
+		size: 0,
+		height: 0
+	};
+	const cached = memo.get(input);
+	if (cached !== void 0 && ("failed" in cached ? levels <= cached.failed : true)) return "failed" in cached || cached.height > levels ? void 0 : cached;
+	const result = levels === 0 || !isPlainData(input) ? void 0 : Arr.reduce(Object.values(input), {
+		size: 1,
+		height: 1
+	}, (total, child) => {
+		const measured = total === void 0 ? void 0 : measure(child, levels - 1, memo);
+		return total === void 0 || measured === void 0 ? void 0 : {
+			size: total.size + measured.size,
+			height: Math.max(total.height, 1 + measured.height)
+		};
+	});
+	memo.set(input, result ?? { failed: levels });
+	return result;
+};
+/**
+* Tests if each own key of an object is a plain data key that a loop over the
+* keys sees. The `length` of an array is the one key that is not seen. The
+* decoder reads keys of the prototypes too, so a prototype other than the
+* one of a plain object or an array may have only methods, as the prototype
+* of a class has.
+*/
+const isPlainData = (input) => Arr.every(Reflect.ownKeys(input), (key) => {
+	const property = Object.getOwnPropertyDescriptor(input, key);
+	return property !== void 0 && "value" in property && (property.enumerable === true || Array.isArray(input) && key === "length");
+}) && hasOnlyMethods(Object.getPrototypeOf(input));
+/** Tests if the prototypes from `prototype` up have only methods. */
+const hasOnlyMethods = (prototype) => prototype === null || prototype === Object.prototype || prototype === Array.prototype || typeof prototype === "object" && Arr.every(Reflect.ownKeys(prototype), (key) => {
+	const property = Object.getOwnPropertyDescriptor(prototype, key);
+	return typeof key === "symbol" || key === "constructor" || property !== void 0 && "value" in property && typeof property.value === "function";
+}) && hasOnlyMethods(Object.getPrototypeOf(prototype));
+/** Tests if a value is low and small enough to decode. */
+const fitsLimits = (input) => {
+	const measured = measure(input, maxJsonDepth, /* @__PURE__ */ new Map());
+	return measured === void 0 ? `A policy may have at most ${String(maxJsonDepth)} levels of JSON` : measured.size > maxInputNodes ? `A policy may have at most ${String(maxInputNodes)} objects and arrays in JSON` : true;
+};
+const encodedNodeSchema = (meta) => {
+	const self = Schema.Union([
+		Schema.TaggedStruct("Rules", {
+			algorithm: AlgorithmSchema,
+			rules: Schema.Array(encodedRuleSchema(meta))
+		}),
+		Schema.TaggedStruct("All", { policies: Schema.Array(Schema.suspend(() => self)) }),
+		Schema.TaggedStruct("Any", { policies: Schema.Array(Schema.suspend(() => self)) }),
+		Schema.TaggedStruct("FirstOf", { policies: Schema.Array(Schema.suspend(() => self)) }),
+		Schema.TaggedStruct("Ceiling", {
+			cap: Schema.suspend(() => self),
+			policy: Schema.suspend(() => self)
+		})
+	]);
+	return self;
+};
+const principalRefs = (ast) => Array.from(refsIn(ast, /* @__PURE__ */ new Map()));
+/** The principal fields of a node. A shared node is visited one time. */
+const refsIn = (node, memo) => remember(memo, node, () => {
+	const refs = (operands) => HashSet.fromIterable(Arr.flatMap(operands, (operand) => operand._tag === "Principal" ? [operand.path] : []));
+	switch (node._tag) {
+		case "Compare": return refs([node.value]);
+		case "In": return refs(node.values);
+		case "Under": return refs(node.prefix);
+		case "And":
+		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, refsIn(child, memo)));
+		case "Not": return refsIn(node.condition, memo);
+		default: return HashSet.empty();
+	}
+});
+const literalTests = (node) => Arr.map(Array.from(literalTestsIn(node, /* @__PURE__ */ new Map())), (text) => {
+	const [field, value] = JSON.parse(text);
+	return [field, hasProperty(value, "number") ? Number(value.number) : value];
+});
+/**
+* The JSON text of a test. JSON has no `Infinity`, `-Infinity` or `NaN`, so
+* such a number goes in as its text.
+*/
+const literalText = (field, value) => JSON.stringify([field, typeof value === "number" && !Number.isFinite(value) ? { number: String(value) } : value]);
+/**
+* The tests of fields with fixed values in a node, each as the JSON text of a
+* {@link LiteralTest}. A set of texts keeps each test one time, so a node
+* with many shared parts gives a small set. A shared node is visited one time.
+*/
+const literalTestsIn = (node, memo) => remember(memo, node, () => {
+	const tests = (field, operands) => HashSet.fromIterable(Arr.flatMap(operands, (operand) => operand._tag === "Literal" ? [literalText(field, operand.value)] : []));
+	switch (node._tag) {
+		case "Compare": return tests(node.field, [node.value]);
+		case "In": return tests(node.field, node.values);
+		case "And":
+		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, literalTestsIn(child, memo)));
+		case "Not": return literalTestsIn(node.condition, memo);
+		default: return HashSet.empty();
+	}
+});
+const principalTests = (node) => Arr.map(Array.from(principalTestsIn(node, /* @__PURE__ */ new Map())), (text) => JSON.parse(text));
+/**
+* The tests of fields with principal fields in a node, each as the JSON text
+* of a {@link PrincipalTest}. See {@link literalTestsIn}.
+*/
+const principalTestsIn = (node, memo) => remember(memo, node, () => {
+	const tests = (field, operands) => HashSet.fromIterable(Arr.flatMap(operands, (operand) => operand._tag === "Principal" ? [JSON.stringify([field, operand.path])] : []));
+	switch (node._tag) {
+		case "Compare": return tests(node.field, [node.value]);
+		case "In": return tests(node.field, node.values);
+		case "And":
+		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, principalTestsIn(child, memo)));
+		case "Not": return principalTestsIn(node.condition, memo);
+		default: return HashSet.empty();
+	}
+});
+/**
+* Tests if a node has a fixed value that is not a {@link Condition.Scalar},
+* such as `undefined`. A shared node is visited one time.
+*/
+const hasBadLiteralIn = (node, memo) => remember(memo, node, () => {
+	const bad = (operands) => Arr.some(operands, (operand) => operand._tag === "Literal" && operand.value !== null && typeof operand.value !== "string" && typeof operand.value !== "number" && typeof operand.value !== "boolean");
+	switch (node._tag) {
+		case "Compare": return bad([node.value]);
+		case "In": return bad(node.values);
+		case "Under": return bad(node.prefix);
+		case "And":
+		case "Or": return Arr.some(node.conditions, (child) => hasBadLiteralIn(child, memo));
+		case "Not": return hasBadLiteralIn(node.condition, memo);
+		default: return false;
+	}
+});
+/**
+* The principal fields in the prefixes of `Under` nodes, each as the JSON text
+* of the place in the prefix and the path of the field. See
+* {@link literalTestsIn}.
+*/
+/**
+* The fixed values in the prefixes of `Under` nodes, each as the JSON text of
+* the place in the prefix, the value, and the fixed strings of the whole
+* prefix. A number that JSON can not hold is left out: it fits no field
+* that a path names. See {@link underRefsIn}.
+*/
+const underLiteralsIn = (node, memo) => remember(memo, node, () => {
+	switch (node._tag) {
+		case "Under": {
+			const strings = Arr.map(node.prefix, (operand) => operand._tag === "Literal" && typeof operand.value === "string" ? operand.value : null);
+			return HashSet.fromIterable(Arr.flatMap(node.prefix, (operand, index) => operand._tag === "Literal" && (operand.value === null || typeof operand.value === "string" || typeof operand.value === "boolean" || Number.isFinite(operand.value)) ? [JSON.stringify([
+				index,
+				operand.value,
+				strings
+			])] : []));
+		}
+		case "And":
+		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, underLiteralsIn(child, memo)));
+		case "Not": return underLiteralsIn(node.condition, memo);
+		default: return HashSet.empty();
+	}
+});
+const underLiterals = (node) => Arr.map(Array.from(underLiteralsIn(node, /* @__PURE__ */ new Map())), (text) => JSON.parse(text));
+const underRefsIn = (node, memo) => remember(memo, node, () => {
+	switch (node._tag) {
+		case "Under": {
+			const strings = Arr.map(node.prefix, (operand) => operand._tag === "Literal" && typeof operand.value === "string" ? operand.value : null);
+			return HashSet.fromIterable(Arr.flatMap(node.prefix, (operand, index) => operand._tag === "Principal" ? [JSON.stringify([
+				index,
+				operand.path,
+				strings
+			])] : []));
+		}
+		case "And":
+		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, underRefsIn(child, memo)));
+		case "Not": return underRefsIn(node.condition, memo);
+		default: return HashSet.empty();
+	}
+});
+const underRefs = (node) => Arr.map(Array.from(underRefsIn(node, /* @__PURE__ */ new Map())), (text) => JSON.parse(text));
+/**
+* Tests if the path of a resource may start with a prefix: it is as long as
+* the prefix, and each fixed string of the prefix is the string of the path
+* at its place, when the path has a string there.
+*/
+const mayStartWith = (descriptor, strings) => (descriptor.path?.length ?? 0) >= strings.length && Arr.every(strings, (string, index) => {
+	const segment = descriptor.path?.[index];
+	return string === null || typeof segment !== "string" || segment === string;
+});
+/**
+* Tests if a principal field may hold the part of a path at `index`: a string
+* of the path, or a value of the field that the path names there.
+*/
+const fitsPathPart = (descriptor, index, principal) => {
+	const segment = descriptor.path?.[index];
+	return segment === void 0 ? false : typeof segment === "string" ? fitsDomain(principal, segment) : domainsMeet(domainOf(descriptor.schema, segment.field), principal);
+};
+/**
+* The fields of ordered tests (`lt`, `lte`, `gt`, `gte`) in a node, each as
+* the JSON text of the field and the operand. See {@link literalTestsIn}.
+*/
+const orderedTestsIn = (node, memo) => remember(memo, node, () => {
+	switch (node._tag) {
+		case "Compare": return node.op === "eq" || node.op === "ne" ? HashSet.empty() : HashSet.make(JSON.stringify([node.field, node.value._tag === "Literal" ? {
+			_tag: "Literal",
+			type: typeof node.value.value
+		} : node.value]));
+		case "And":
+		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, orderedTestsIn(child, memo)));
+		case "Not": return orderedTestsIn(node.condition, memo);
+		default: return HashSet.empty();
+	}
+});
+const orderedTests = (node) => Arr.map(Array.from(orderedTestsIn(node, /* @__PURE__ */ new Map())), (text) => JSON.parse(text));
+/**
+* Tests if a field may hold a value with an order: a number or a string. An
+* ordered test is false for any other value.
+*/
+const isOrdered = (domain) => domain.string || domain.number !== "none" || Arr.some(domain.literals, (value) => typeof value === "string" || typeof value === "number");
+/**
+* Tests if two fields may hold values of one ordered type: two strings or two
+* numbers. An ordered test of two values of other types is false.
+*/
+const orderedMeet = (left, right) => {
+	const strings = (domain) => domain.string || Arr.some(domain.literals, (value) => typeof value === "string");
+	const numbers = (domain) => domain.number !== "none" || Arr.some(domain.literals, (value) => typeof value === "number");
+	return strings(left) && strings(right) || numbers(left) && numbers(right);
+};
+/**
+* Tests if two fields may hold one value: a value of one type, or a single
+* value that the other field may hold.
+*/
+const domainsMeet = (left, right) => left.string && right.string || left.boolean && right.boolean || left.number !== "none" && right.number !== "none" || Arr.some(left.literals, (value) => fitsDomain(right, value)) || Arr.some(right.literals, (value) => fitsDomain(left, value));
+/**
+* Tests if a field with this domain may hold a value of the type of `value`.
+* `null` always fits: a test with `null` is a test that the field is missing.
+*/
+const fitsDomain = (domain, value) => value === null || domain.literals.includes(value) || typeof value === "string" && domain.string || typeof value === "boolean" && domain.boolean || typeof value === "number" && domain.number !== "none";
+/**
+* Checks the names in an encoded policy against the domain. It gives one
+* message for each problem.
+*/
+const validate = (domain, root) => {
+	const principalPaths = domain.principal.pipe(fieldPaths, HashSet.fromIterable);
+	const ruleIssues = (value, at) => {
+		const all = value.resources.includes("*");
+		const named = Array.from(HashSet.fromIterable(Arr.filter(value.resources, (kind) => kind !== "*")));
+		const descriptors = Arr.flatMap(named, (kind) => {
+			const descriptor = descriptorOf(domain, kind);
+			return descriptor === void 0 ? [] : [descriptor];
+		});
+		const known = all ? Array.from(HashMap.values(domain.resources)) : descriptors;
+		const applicable = Arr.filter(descriptors, (descriptor) => value.actions.includes("*") || Arr.some(value.actions, (action) => descriptor.actions.includes(action)));
+		const usedFields = [...Arr.filter(value.fields ?? [], (field) => !field.includes("*")), ...value.when === void 0 ? [] : fields(value.when)];
+		return [
+			...Arr.map(Arr.filter(named, (kind) => !HashMap.has(domain.resources, kind)), (kind) => ({
+				path: [...at, "resources"],
+				issue: `There is no resource with the kind "${kind}"`
+			})),
+			...Arr.map(Arr.filter(value.actions, (action) => action !== "*" && !Arr.some(known, (descriptor) => descriptor.actions.includes(action))), (action) => ({
+				path: [...at, "actions"],
+				issue: `The action "${action}" is not an action of these resources`
+			})),
+			...Arr.map(Arr.filter(usedFields, (field) => all || descriptors.length === 0 || !Arr.every(descriptors, (descriptor) => descriptor.fieldPaths.includes(field) || hasPath(descriptor.schema, field) || hasGetter(descriptor.schema, field))), (field) => ({
+				path: at,
+				issue: `The field "${field}" is not a field of every resource of the rule`
+			})),
+			...Arr.map(Arr.filter(value.when === void 0 ? [] : principalRefs(value.when), (ref) => !HashSet.has(principalPaths, ref) && !hasPath(domain.principal, ref) && !hasGetter(domain.principal, ref)), (ref) => ({
+				path: [...at, "when"],
+				issue: `The principal has no field "${ref}"`
+			})),
+			...Arr.map(Arr.filter(value.when === void 0 ? [] : literalTests(value.when), ([field, literal]) => Arr.some(applicable, (descriptor) => !fitsDomain(domainOf(descriptor.schema, field), literal))), ([field, literal]) => ({
+				path: [...at, "when"],
+				issue: `The field "${field}" can not hold the value ${JSON.stringify(literal)}`
+			})),
+			...Arr.map(Arr.filter(value.when === void 0 ? [] : principalTests(value.when), ([field, ref]) => Arr.some(applicable, (descriptor) => !domainsMeet(domainOf(descriptor.schema, field), domainOf(domain.principal, ref)))), ([field, ref]) => ({
+				path: [...at, "when"],
+				issue: `The field "${field}" can not hold a value of the principal field "${ref}"`
+			})),
+			...value.when !== void 0 && !isAst(value.when) ? [{
+				path: [...at, "when"],
+				issue: "The condition is not a whole condition tree"
+			}] : [],
+			...value.when !== void 0 && hasBadLiteralIn(value.when, /* @__PURE__ */ new Map()) ? [{
+				path: [...at, "when"],
+				issue: "A test has a fixed value that is not a string, a number, a boolean or null"
+			}] : [],
+			...Arr.map(Arr.filter(value.when === void 0 ? [] : underRefs(value.when), ([index, ref, strings]) => Arr.some(Arr.filter(all ? Arr.filter(known, (descriptor) => descriptor.path?.[index] !== void 0 && (value.actions.includes("*") || Arr.some(value.actions, (action) => descriptor.actions.includes(action)))) : applicable, (descriptor) => mayStartWith(descriptor, strings)), (descriptor) => !fitsPathPart(descriptor, index, domainOf(domain.principal, ref)))), ([, ref]) => ({
+				path: [...at, "when"],
+				issue: `The principal field "${ref}" can not hold a part of the path of the resource`
+			})),
+			...Arr.map(Arr.filter(value.when === void 0 ? [] : underLiterals(value.when), ([index, literal, strings]) => Arr.some(Arr.filter(all ? Arr.filter(known, (descriptor) => value.actions.includes("*") || Arr.some(value.actions, (action) => descriptor.actions.includes(action))) : applicable, (descriptor) => mayStartWith(descriptor, strings)), (descriptor) => {
+				const segment = descriptor.path?.[index];
+				return segment !== void 0 && typeof segment !== "string" && !fitsDomain(domainOf(descriptor.schema, segment.field), literal);
+			})), ([index, literal]) => ({
+				path: [...at, "when"],
+				issue: `The path part ${String(index)} can not hold the value ${JSON.stringify(literal)}`
+			})),
+			...Arr.map(Arr.filter(value.when === void 0 ? [] : orderedTests(value.when), ([field, operand]) => operand._tag === "Literal" && operand.type !== "string" && operand.type !== "number" || Arr.some(applicable, (descriptor) => {
+				const fieldDomain = domainOf(descriptor.schema, field);
+				return operand._tag === "Literal" ? !isOrdered(fieldDomain) : !orderedMeet(fieldDomain, domainOf(domain.principal, operand.path));
+			})), ([field]) => ({
+				path: [...at, "when"],
+				issue: `The field "${field}" has an ordered test with a value that has no order`
+			}))
+		];
+	};
+	const issuesOf = (node, path, level) => {
+		if (level > maxDepth) return [{
+			path,
+			issue: `A policy tree may have at most ${maxDepth} levels`
+		}];
+		switch (node._tag) {
+			case "Rules": return Arr.flatMap(node.rules, (value, index) => ruleIssues(value, [
+				...path,
+				"rules",
+				index
+			]));
+			case "All":
+			case "Any":
+			case "FirstOf": return Arr.flatMap(node.policies, (child, index) => issuesOf(child, [
+				...path,
+				"policies",
+				index
+			], level + 1));
+			case "Ceiling": return [...issuesOf(node.cap, [...path, "cap"], level + 1), ...issuesOf(node.policy, [...path, "policy"], level + 1)];
+		}
+	};
+	return issuesOf(root, [], 1);
+};
+/**
+* Makes a policy tree from its JSON form. Each rule gets the domain of the
+* Schema, as a rule from the builder of the domain has it.
+*/
+const decodeNode = (node, domain) => {
+	switch (node._tag) {
+		case "Rules": return nodes.Rules({
+			algorithm: node.algorithm,
+			rules: node.rules.map((value) => make({
+				...value,
+				domain
+			}))
+		});
+		case "All":
+		case "Any":
+		case "FirstOf": return nodes[node._tag]({ policies: node.policies.map((child) => decodeNode(child, domain)) });
+		case "Ceiling": return nodes.Ceiling({
+			cap: decodeNode(node.cap, domain),
+			policy: decodeNode(node.policy, domain)
+		});
+	}
+};
 /**
 * Tests if a value is a policy.
 *
@@ -156,7 +1320,20 @@ const schema = schema$1;
 * @category guards
 * @since 0.3.0
 */
-const isPolicy = isPolicy$1;
-export { Policy_exports, TypeId, all, any, ceiling, decide, decideSync, define, empty, explain, firstOf, isPolicy, permittedFields, residual, rules, schema };
+const isPolicy = (u) => u instanceof PolicyData;
+/**
+* The Schema of the policies of a domain with no predicates. Decoding checks
+* every kind, action, field and principal field against the domain, and the
+* `meta` of each rule against the `meta` Schema of the domain.
+*
+* @stability stable
+* @category schemas
+* @since 0.3.0
+*/
+const schema = (domain) => Schema.declare((input) => typeof input === "object" && input !== null).pipe(Schema.check(Schema.makeFilter(fitsLimits)), Schema.decodeTo(encodedNodeSchema(domain.meta), SchemaTransformation.passthrough()), Schema.check(Schema.makeFilter((node) => validate(domain, node))), Schema.decodeTo(Schema.declare((u) => isPolicy(u) && u.domain === domain && !nodeHasPredicate(u.node)), SchemaTransformation.transformEffect({
+	decode: (node) => Effect.succeed(fromNode(domain, decodeNode(node, domain))),
+	encode: (policy, options) => encodedSize(policy.node) > maxEncodedNodes ? Effect.fail(new SchemaIssue.InvalidValue({ message: tooLargeMessage }, policy, options)) : Effect.succeed(encodeNode(policy.node))
+})));
+export { Policy_exports, all, any, ceiling, coverage, decide, decideSync, define, empty, explain, firstOf, fitsKind, isPolicy, permittedFields, provideContext, residual, residuals, rules, schema, scopeHasValue, scopeIsEmpty };
 
 //# sourceMappingURL=Policy.js.map