@nmnmcc/ability 1.0.1 → 2.0.1

package/dist/Policy.js

@@ -1,167 +1,70 @@
 import { __exportAll } from "./_virtual/_rolldown/runtime.js";
-import { domainOf, fieldPaths, hasGetter, hasPath, isPlainField, kindOf } from "./Resource.js";
-import { always as always$1, and, andAll, builder, evaluate, fields, hasPredicate, isAst, never as never$1, not, orAll, partial, provideContext as provideContext$1, satisfiable, schema as schema$1, simplifier, simplify, toJsonValue } from "./Condition.js";
-import { Allow, Deny, NotApplicable } from "./Decision.js";
-import { descriptorOf } from "./Domain.js";
-import { builder as builder$1, domainOf as domainOf$1, isRule, make, matchesInside, matchesTarget } from "./Rule.js";
-import * as Arr from "effect/Array";
-import * as Effect from "effect/Effect";
-import * as Option from "effect/Option";
-import * as Schema from "effect/Schema";
-import * as Data from "effect/Data";
-import { dual } from "effect/Function";
-import * as HashMap from "effect/HashMap";
-import * as HashSet from "effect/HashSet";
-import { hasProperty } from "effect/Predicate";
-import * as SchemaIssue from "effect/SchemaIssue";
-import * as SchemaTransformation from "effect/SchemaTransformation";
-import * as Chunk from "effect/Chunk";
-import * as Ref from "effect/Ref";
+import { builder as builder$1, makePlain } from "./internal/rule.js";
+import { PolicyError as PolicyError$1, ceiling as ceiling$1, combine, define as define$1, provideContext as provideContext$1, schema as schema$1 } from "./internal/policy.js";
+import { decideAny, decideSync as decideSync$1, explain as explain$1, permittedFields as permittedFields$1 } from "./internal/decide.js";
+import { coverageAny, residual as residual$1 } from "./internal/analysis.js";
 // src/Policy.ts
 var Policy_exports = /* @__PURE__ */ __exportAll({
+	PolicyError: () => PolicyError,
 	all: () => all,
 	any: () => any,
+	builder: () => builder,
 	ceiling: () => ceiling,
 	coverage: () => coverage,
 	decide: () => decide,
 	decideSync: () => decideSync,
 	define: () => define,
-	empty: () => empty,
 	explain: () => explain,
 	firstOf: () => firstOf,
-	fitsKind: () => fitsKind,
-	isPolicy: () => isPolicy,
 	permittedFields: () => permittedFields,
 	provideContext: () => provideContext,
 	residual: () => residual,
-	residuals: () => residuals,
-	rules: () => rules,
-	schema: () => schema,
-	scopeHasValue: () => scopeHasValue,
-	scopeIsEmpty: () => scopeIsEmpty
+	rule: () => rule,
+	schema: () => schema
 });
-const nodes = Data.taggedEnum();
 /**
-* The most nodes that the JSON form of a policy may have. A tree may use one
-* child in many places, and the JSON form writes it out each time, so a small
-* tree may have a very large JSON form.
-*/
-const maxEncodedNodes = 1e5;
-/**
-* The number of nodes of the JSON form of a condition. A shared child counts
-* one time for each place, as the JSON form writes it out each time.
-*/
-const conditionSize = (ast, memo) => remember(memo, ast, () => {
-	switch (ast._tag) {
-		case "And":
-		case "Or": return Arr.reduce(ast.conditions, 1, (size, child) => size + conditionSize(child, memo));
-		case "Not": return 1 + conditionSize(ast.condition, memo);
-		default: return 1;
-	}
-});
-/**
-* The number of nodes of the JSON form of a tree, with the conditions of its
-* rules.
-*/
-const encodedSize = (node, memo = /* @__PURE__ */ new Map(), conditions = /* @__PURE__ */ new Map()) => remember(memo, node, () => {
-	switch (node._tag) {
-		case "Rules": return Arr.reduce(node.rules, 1, (size, value) => size + 1 + (value.when === void 0 ? 0 : conditionSize(value.when, conditions)));
-		case "All":
-		case "Any":
-		case "FirstOf": return Arr.reduce(node.policies, 1, (size, child) => size + encodedSize(child, memo, conditions));
-		case "Ceiling": return 1 + encodedSize(node.cap, memo, conditions) + encodedSize(node.policy, memo, conditions);
-	}
-});
-/** Gives the JSON form of a tree, when it is not too large. */
-const encodeTree = (node) => {
-	if (encodedSize(node) > maxEncodedNodes) throw new globalThis.Error(tooLargeMessage);
-	return encodeNode(node);
-};
-const tooLargeMessage = `The JSON form of this policy would have more than ${String(maxEncodedNodes)} nodes`;
-const encodeNode = (node) => {
-	switch (node._tag) {
-		case "Rules": return {
-			_tag: "Rules",
-			algorithm: node.algorithm,
-			rules: node.rules.map(({ domain: _domain, ...value }) => ({ ...value }))
-		};
-		case "All":
-		case "Any":
-		case "FirstOf": return {
-			_tag: node._tag,
-			policies: node.policies.map(encodeNode)
-		};
-		case "Ceiling": return {
-			_tag: "Ceiling",
-			cap: encodeNode(node.cap),
-			policy: encodeNode(node.policy)
-		};
-	}
-};
-/**
-* The tree of a policy as a value that `JSON.stringify` keeps with no loss.
-* See `Condition.toJsonValue`.
+* Makes rules with the types of a domain. `Policy.define` gives one to its
+* generator. Use this one to make rules outside of a generator.
+*
+* @example
+* ```ts
+* const _ = Policy.builder(App)
+* const rule = _.allow("read", Document, {
+*   when: ($) => $.eq("ownerId", $.principal("id")),
+* })
+* ```
+*
+* @stability stable
+* @category constructors
+* @since 2.0.0
 */
-const jsonNode = (node, meta) => {
-	const json = (child) => jsonNode(child, meta);
-	switch (node._tag) {
-		case "Rules": return {
-			...node,
-			rules: Arr.map(node.rules, (value) => ({
-				...value,
-				...value.when === void 0 ? {} : { when: toJsonValue(value.when) },
-				...value.meta === void 0 || meta === void 0 ? {} : { meta: Schema.encodeUnknownSync(meta)(value.meta) }
-			}))
-		};
-		case "All":
-		case "Any":
-		case "FirstOf": return {
-			...node,
-			policies: Arr.map(node.policies, json)
-		};
-		case "Ceiling": return {
-			...node,
-			cap: json(node.cap),
-			policy: json(node.policy)
-		};
-	}
-};
+const builder = (domain) => builder$1(domain);
 /**
-* The class of every policy value. Two policies of one domain with the same
-* tree are equal. As JSON, a policy is its tree.
+* Makes a rule from its data, with no types. It does not check the data
+* against a domain: a policy does that when the rule goes into it. Use
+* {@link builder} for rules with types, or {@link schema} for rules from JSON.
+*
+* The condition may not have a predicate. A policy checks the fields of a
+* condition against the resources of its rule, but it can not check what
+* the code of a predicate reads. A rule from the builder keeps that in its
+* types; this one could give a predicate of one kind to another kind.
+*
+* @stability stable
+* @category constructors
+* @since 2.0.0
 */
-var PolicyData = class extends Data.Class {
-	toJSON() {
-		return jsonNode(encodeTree(this.node), this.domain.meta);
-	}
-};
-/** The node of a policy, with no types, for the code below. */
-const nodeOf = (policy) => policy.node;
-const fromNode = (domain, node) => new PolicyData({
-	domain,
-	node
-});
+const rule = makePlain;
 /**
-* Makes a policy from a list of rules.
+* The error when a rule does not fit its domain: it names a kind, an action,
+* a field or a field of the principal that the domain does not have, or it
+* tests a field with a value that the field can not hold. It has one issue
+* for each problem, with its path, and a suggestion when a name has a mistake.
 *
 * @stability stable
-* @category constructors
-* @since 0.3.0
+* @category errors
+* @since 2.0.0
 */
-const rules = (domain, values, options) => {
-	const node = nodes.Rules({
-		algorithm: options?.algorithm ?? "denyOverrides",
-		rules: Array.from(values)
-	});
-	if (!Arr.every(node.rules, isRule)) throw new globalThis.Error("A value in the list is not a rule");
-	if (Arr.some(node.rules, (value) => {
-		const origin = domainOf$1(value);
-		return origin !== void 0 && origin !== domain;
-	})) throw new globalThis.Error("A rule comes from the builder of another domain");
-	const issues = validate(domain, encodeNode(node));
-	if (issues.length > 0) throw new globalThis.Error(`A rule does not fit the domain: ${issues.map((issue) => issue.issue).join("; ")}`);
-	return fromNode(domain, node);
-};
+const PolicyError = PolicyError$1;
 /**
 * Makes a policy from a generator function that gives rules. It is pure and it
 * gives its result at once.
@@ -180,50 +83,7 @@ const rules = (domain, values, options) => {
 * @category constructors
 * @since 0.3.0
 */
-const define = (domain, options) => (body) => {
-	const iterator = body(builder$1(domain));
-	const collected = Arr.unfold(iterator.next(), (state) => state.done === true ? Option.none() : Option.some([state.value, iterator.next(state.value)]));
-	return rules(domain, collected, options);
-};
-/**
-* A policy with no rules. It is not applicable to any request.
-*
-* @stability stable
-* @category constructors
-* @since 0.3.0
-*/
-const empty = (domain) => rules(domain, []);
-const sameDomain = (policies) => {
-	if (!Arr.every(policies, isPolicy)) throw new globalThis.Error("A value in the list is not a policy");
-	const domain = policies[0].domain;
-	if (!Arr.every(policies, (policy) => policy.domain === domain)) throw new globalThis.Error("Policies from two domains can not be put together");
-	return domain;
-};
-/**
-* The most levels in a policy tree. A walk over a tree calls itself for each
-* level, so a much deeper tree could fill the stack and stop a check.
-*/
-const maxDepth = 256;
-/** The number of levels of a policy tree. */
-const heightOf = (node, memo = /* @__PURE__ */ new Map()) => remember(memo, node, () => {
-	const height = (child) => heightOf(child, memo);
-	switch (node._tag) {
-		case "Rules": return 1;
-		case "All":
-		case "Any":
-		case "FirstOf": return 1 + Arr.reduce(node.policies, 0, (top, child) => Math.max(top, height(child)));
-		case "Ceiling": return 1 + Math.max(height(node.cap), height(node.policy));
-	}
-});
-/**
-* Makes a policy from a new node. Its children come from policies, so each
-* has at most `maxDepth` levels, and the walk of `heightOf` is safe.
-*/
-const fromCombined = (domain, node) => {
-	if (heightOf(node) > maxDepth) throw new globalThis.Error(`A policy tree may have at most ${maxDepth} levels`);
-	return fromNode(domain, node);
-};
-const combine = (tag) => (policies) => fromCombined(sameDomain(policies), nodes[tag]({ policies: policies.map(nodeOf) }));
+const define = define$1;
 /**
 * Every policy must allow, and one deny is enough to deny. With some policies
 * not applicable and none that deny, the result is not applicable.
@@ -257,49 +117,7 @@ const firstOf = combine("FirstOf");
 * @category combinators
 * @since 0.3.0
 */
-const ceiling = dual(2, (policy, cap) => fromCombined(sameDomain([policy, cap]), nodes.Ceiling({
-	cap: nodeOf(cap),
-	policy: nodeOf(policy)
-})));
-/**
-* Gives the answer for a key from a memo, or works it out and keeps it. One
-* node may be a child of many nodes, so each walk over a tree keeps its work
-* on a node in a memo that the walk makes for itself. No memo lives longer
-* than one call.
-*
-* The memo is a native `Map`, because it must find a node by the node itself.
-* An Effect `HashMap` finds a key by `Equal`, and the nodes are Effect data,
-* so it would hash the whole structure of a node, and a shared child again for
-* each path to it.
-*/
-const remember = (memo, key, work) => {
-	if (memo.has(key)) return memo.get(key);
-	const result = work();
-	memo.set(key, result);
-	return result;
-};
-const provideNode = (node, context, memo = {
-	done: /* @__PURE__ */ new Map(),
-	predicates: /* @__PURE__ */ new Map()
-}) => !nodeHasPredicate(node, memo.predicates) ? node : remember(memo.done, node, () => provideOnce(node, context, memo));
-const provideOnce = (node, context, memo) => {
-	switch (node._tag) {
-		case "Rules": return nodes.Rules({
-			algorithm: node.algorithm,
-			rules: node.rules.map((value) => value.when === void 0 || !hasPredicate(value.when) ? value : make({
-				...value,
-				when: provideContext$1(value.when, context)
-			}))
-		});
-		case "All":
-		case "Any":
-		case "FirstOf": return nodes[node._tag]({ policies: Arr.map(node.policies, (child) => provideNode(child, context, memo)) });
-		case "Ceiling": return nodes.Ceiling({
-			cap: provideNode(node.cap, context, memo),
-			policy: provideNode(node.policy, context, memo)
-		});
-	}
-};
+const ceiling = ceiling$1;
 /**
 * Gives the services in `context` to every predicate of a policy, so the
 * policy needs no services when it runs.
@@ -308,119 +126,7 @@ const provideOnce = (node, context, memo) => {
 * @category services
 * @since 1.0.0
 */
-const provideContext = dual(2, (policy, context) => fromNode(policy.domain, provideNode(nodeOf(policy), context)));
-const ruleApplies = (value, context, path) => {
-	if (!matchesTarget(value, context)) return Effect.succeed(false);
-	const test = value.when === void 0 ? Effect.succeed(true) : evaluate(value.when, context.input);
-	const trace = context.trace;
-	return trace === void 0 ? test : Effect.tap(test, (applies) => Ref.update(trace, Chunk.append({
-		path,
-		rule: value,
-		applies
-	})));
-};
-const fromRule = (value) => value._tag === "Allow" ? Allow({ rule: value }) : value.reason === void 0 ? Deny({ rule: value }) : Deny({
-	rule: value,
-	reason: value.reason
-});
-/** Gives the first rule that applies, in order. */
-const firstApplying = (candidates, context, path) => Effect.map(Effect.findFirst(candidates, ([value, index]) => ruleApplies(value, context, [...path, index])), Option.map(([value]) => value));
-/** Gives the first result that is found, and tests `next` only when none is. */
-const orElse = (first, next) => Effect.filterOrElse(first, Option.isSome, next);
-const decideRules = (node, context, path) => {
-	const indexed = Arr.map(node.rules, (value, index) => [value, index]);
-	const denies = Arr.filter(indexed, ([value]) => value._tag === "Deny");
-	const allows = Arr.filter(indexed, ([value]) => value._tag === "Allow");
-	const first = (candidates) => firstApplying(candidates, context, path);
-	const found = (() => {
-		switch (node.algorithm) {
-			case "denyOverrides": return orElse(first(denies), () => first(allows));
-			case "permitOverrides": return orElse(first(allows), () => first(denies));
-			case "firstApplicable": return first(indexed);
-			case "lastApplicable": return first(Arr.reverse(indexed));
-		}
-	})();
-	return Effect.map(found, Option.match({
-		onNone: () => NotApplicable,
-		onSome: fromRule
-	}));
-};
-const decideNode = (node, context, path) => {
-	if (usesPredicate(node, context)) return decideOnce(node, context, path);
-	const cached = context.decisions.get(node);
-	return cached !== void 0 ? Effect.succeed(cached) : Effect.tap(decideOnce(node, context, path), (decision) => Effect.sync(() => context.decisions.set(node, decision)));
-};
-/**
-* Decides the children in order. After each child, `step` stops with a
-* decision, or gives the state for the next child. After the last child,
-* `end` gives the decision. A child after a stop is not decided, so its
-* predicates do not run.
-*/
-const walkChildren = (children, context, path, start, step, end) => {
-	const go = (index, state) => index === children.length ? Effect.succeed(end(state)) : Effect.flatMap(decideNode(children[index], context, [...path, index]), (decision) => {
-		const next = step(state, decision);
-		return next._tag === "Stop" ? Effect.succeed(next.decision) : go(index + 1, next.state);
-	});
-	return go(0, start);
-};
-const stop = (decision) => ({
-	_tag: "Stop",
-	decision
-});
-const next = (state) => ({
-	_tag: "Next",
-	state
-});
-const decideOnce = (node, context, path) => {
-	switch (node._tag) {
-		case "Rules": return decideRules(node, context, path);
-		case "All": return walkChildren(node.policies, context, path, {
-			firstAllow: Option.none(),
-			allAllow: node.policies.length > 0
-		}, (state, decision) => decision._tag === "Deny" ? stop(decision) : next({
-			firstAllow: Option.orElse(state.firstAllow, () => decision._tag === "Allow" ? Option.some(decision) : Option.none()),
-			allAllow: state.allAllow && decision._tag === "Allow"
-		}), (state) => state.allAllow ? Option.getOrElse(state.firstAllow, () => NotApplicable) : NotApplicable);
-		case "Any": return walkChildren(node.policies, context, path, Option.none(), (firstDeny, decision) => decision._tag === "Allow" ? stop(decision) : next(Option.orElse(firstDeny, () => decision._tag === "Deny" ? Option.some(decision) : Option.none())), (firstDeny) => Option.getOrElse(firstDeny, () => NotApplicable));
-		case "FirstOf": return walkChildren(node.policies, context, path, void 0, (_, decision) => decision._tag === "NotApplicable" ? next(void 0) : stop(decision), () => NotApplicable);
-		case "Ceiling": return Effect.filterOrElse(decideNode(node.cap, context, [...path, 0]), (capped) => capped._tag === "Deny", () => decideNode(node.policy, context, [...path, 1]));
-	}
-};
-/**
-* Tests if a request fits its kind: the action is an action of the kind, and
-* the field, if there is one, is a field of the kind. The types check this,
-* but a value with a union type, or a value from outside, may get past them.
-* A rule for every action (`"*"`) must not cover an action that the kind does
-* not have, so such a request is not applicable.
-*
-* @stability stable
-* @category predicates
-* @since 1.0.0
-*/
-const fitsKind = (descriptor, request) => descriptor.actions.includes(request.action) && (request.field === void 0 || descriptor.fieldPaths.includes(request.field) || hasPath(descriptor.schema, request.field) || hasGetter(descriptor.schema, request.field));
-const makeContext = (domain, request, trace) => {
-	const kind = kindOf(request.resource);
-	const descriptor = kind === void 0 ? void 0 : descriptorOf(domain, kind);
-	if (kind === void 0 || descriptor === void 0 || !fitsKind(descriptor, request)) return;
-	return {
-		action: request.action,
-		kind,
-		field: request.field,
-		input: {
-			value: request.resource,
-			principal: request.principal,
-			path: descriptor.path
-		},
-		descriptor,
-		trace,
-		predicates: /* @__PURE__ */ new Map(),
-		decisions: /* @__PURE__ */ new Map()
-	};
-};
-const decideAny = (policy, request) => Effect.suspend(() => {
-	const context = makeContext(policy.domain, request, void 0);
-	return context === void 0 ? Effect.succeed(NotApplicable) : decideNode(nodeOf(policy), context, []);
-});
+const provideContext = provideContext$1;
 /**
 * Gives the decision of a policy for a request.
 *
@@ -428,7 +134,7 @@ const decideAny = (policy, request) => Effect.suspend(() => {
 * @category evaluation
 * @since 0.3.0
 */
-const decide = dual(2, decideAny);
+const decide = decideAny;
 /**
 * Gives the decision of a policy with no predicates, at once.
 *
@@ -436,48 +142,22 @@ const decide = dual(2, decideAny);
 * @category evaluation
 * @since 0.3.0
 */
-const decideSync = dual(2, (policy, request) => Effect.runSync(decideAny(policy, request)));
+const decideSync = decideSync$1;
 /**
 * Gives the decision of a policy and the rules that were tested to make it.
 *
-* One node may be a child of many nodes. A node with no predicate that the
-* request may use gives the same decision each time, so its rules are tested,
-* and are in the steps, only the first time. So a small tree with many shared
-* nodes gives a short list of steps.
+* One node may be a child of many nodes. Its rules are tested, and are in the
+* steps, each time that the decision comes to it.
 *
 * @stability stable
 * @category evaluation
 * @since 0.3.0
 */
-const explain = dual(2, (policy, request) => Effect.gen(function* () {
-	const trace = yield* Ref.make(Chunk.empty());
-	const context = makeContext(policy.domain, request, trace);
-	if (context === void 0) return {
-		decision: NotApplicable,
-		steps: []
-	};
-	return {
-		decision: yield* decideNode(nodeOf(policy), context, []),
-		steps: Chunk.toReadonlyArray(yield* Ref.get(trace))
-	};
-}));
-/**
-* Tests if a deny rule of the request names a part inside `field`.
-*/
-const deniesInside = (node, target, field, seen = /* @__PURE__ */ new Set()) => {
-	if (seen.has(node)) return false;
-	seen.add(node);
-	switch (node._tag) {
-		case "Rules": return node.rules.some((value) => value._tag === "Deny" && value.fields !== void 0 && value.fields.some((pattern) => matchesInside(pattern, field)) && (value.actions.includes("*") || value.actions.includes(target.action)) && (value.resources.includes("*") || value.resources.includes(target.kind)));
-		case "All":
-		case "Any":
-		case "FirstOf": return node.policies.some((child) => deniesInside(child, target, field, seen));
-		case "Ceiling": return deniesInside(node.cap, target, field, seen) || deniesInside(node.policy, target, field, seen);
-	}
-};
+const explain = explain$1;
 /**
 * Gives the fields of a resource value that the policy lets a request use. It
-* tests each field of the resource Schema, with dots for nested fields.
+* tests each field that a list of fields shows: each scalar, record or array
+* of the resource Schema, with dots for nested fields.
 *
 * A field that holds more than one value, such as a record, is left out when a
 * deny rule names a part of it. The list can not name that part, and the whole
@@ -487,283 +167,7 @@ const deniesInside = (node, target, field, seen = /* @__PURE__ */ new Set()) =>
 * @category evaluation
 * @since 0.3.0
 */
-const permittedFields = dual(2, (policy, request) => {
-	const kind = kindOf(request.resource);
-	const descriptor = kind === void 0 ? void 0 : descriptorOf(policy.domain, kind);
-	if (descriptor === void 0) return Effect.succeed([]);
-	return Effect.filter(descriptor.fieldPaths, (field) => Effect.map(decideAny(policy, {
-		...request,
-		field
-	}), (result) => result._tag === "Allow" && !(descriptor.openPaths.includes(field) && deniesInside(nodeOf(policy), {
-		...request,
-		kind: descriptor.kind
-	}, field))));
-});
-const always = always$1;
-const never = never$1;
-/**
-* The most nodes that a residual condition may have. A policy tree may use a
-* condition of a child two times, in its allow condition and in its deny
-* condition, so a small policy may give a very large condition. Past this
-* size, `residual` throws an error.
-*/
-const maxResidualSize = 1e4;
-/**
-* The most levels that a residual condition may have. The rules of an ordered
-* algorithm, such as `firstApplicable`, give one level for each run of rules
-* with one tag. A walk over a condition calls itself for each level, so a much
-* deeper condition could fill the stack. Past this depth, `residual` throws an
-* error.
-*/
-const maxResidualDepth = 500;
-/**
-* A residual condition is too large. See {@link maxResidualSize} and
-* {@link maxResidualDepth}.
-*/
-var TooLarge = class {};
-const makeBuild = () => {
-	const simplify = simplifier();
-	const sizes = /* @__PURE__ */ new Map();
-	/** Gives the number of nodes in a condition, as JSON would have them. */
-	const sizeOf = (ast) => remember(sizes, ast, () => {
-		switch (ast._tag) {
-			case "And":
-			case "Or": return Arr.reduce(ast.conditions, 1, (size, child) => size + sizeOf(child));
-			case "Not": return 1 + sizeOf(ast.condition);
-			default: return 1;
-		}
-	});
-	const depths = /* @__PURE__ */ new Map();
-	/**
-	* Gives the number of levels in a condition. Each child went through
-	* `limit`, so this walk is not deeper than `maxResidualDepth`.
-	*/
-	const depthOf = (ast) => remember(depths, ast, () => {
-		switch (ast._tag) {
-			case "And":
-			case "Or": return 1 + Arr.reduce(ast.conditions, 0, (top, child) => Math.max(top, depthOf(child)));
-			case "Not": return 1 + depthOf(ast.condition);
-			default: return 1;
-		}
-	});
-	const limit = (ast) => {
-		if (sizeOf(ast) > maxResidualSize || depthOf(ast) > maxResidualDepth) throw new TooLarge();
-		return ast;
-	};
-	return {
-		and: (values) => limit(simplify(andAll(values))),
-		or: (values) => limit(simplify(orAll(values))),
-		not: (value) => limit(simplify(not(value)))
-	};
-};
-const ruleCondition = (value, context) => !matchesTarget(value, context) ? never : value.when === void 0 ? always : partial(value.when, context.input);
-/**
-* Gives the conditions for "the first rule that applies is an allow rule" and
-* "the first rule that applies is a deny rule".
-*/
-const firstApplicableResidual = (values, context) => {
-	const { and, not, or } = context.build;
-	const runs = Arr.isReadonlyArrayNonEmpty(values) ? Arr.groupWith(values, (a, b) => a._tag === b._tag) : [];
-	return Arr.reduceRight(runs, {
-		allow: never,
-		deny: never
-	}, (rest, run) => {
-		const applies = or(Arr.map(run, (value) => ruleCondition(value, context)));
-		return run[0]._tag === "Allow" ? {
-			allow: or([applies, rest.allow]),
-			deny: and([not(applies), rest.deny])
-		} : {
-			allow: and([not(applies), rest.allow]),
-			deny: or([applies, rest.deny])
-		};
-	});
-};
-const residualNode = (node, context) => remember(context.pairs, node, () => residualOnce(node, context));
-const residualOnce = (node, context) => {
-	const { and, not, or } = context.build;
-	switch (node._tag) {
-		case "Rules": switch (node.algorithm) {
-			case "denyOverrides": {
-				const deny = or(node.rules.filter((value) => value._tag === "Deny").map((value) => ruleCondition(value, context)));
-				return {
-					allow: and([not(deny), or(node.rules.filter((value) => value._tag === "Allow").map((value) => ruleCondition(value, context)))]),
-					deny
-				};
-			}
-			case "permitOverrides": {
-				const allow = or(node.rules.filter((value) => value._tag === "Allow").map((value) => ruleCondition(value, context)));
-				return {
-					allow,
-					deny: and([not(allow), or(node.rules.filter((value) => value._tag === "Deny").map((value) => ruleCondition(value, context)))])
-				};
-			}
-			case "firstApplicable": return firstApplicableResidual(node.rules, context);
-			case "lastApplicable": return firstApplicableResidual(node.rules.slice().reverse(), context);
-		}
-		case "All": {
-			if (node.policies.length === 0) return {
-				allow: never,
-				deny: never
-			};
-			const pairs = node.policies.map((child) => residualNode(child, context));
-			const deny = or(pairs.map((pair) => pair.deny));
-			return {
-				allow: and([...pairs.map((pair) => pair.allow), not(deny)]),
-				deny
-			};
-		}
-		case "Any": {
-			const pairs = node.policies.map((child) => residualNode(child, context));
-			const allow = or(pairs.map((pair) => pair.allow));
-			return {
-				allow,
-				deny: and([not(allow), or(pairs.map((pair) => pair.deny))])
-			};
-		}
-		case "FirstOf": return Arr.reduceRight(node.policies, {
-			allow: never,
-			deny: never
-		}, (rest, child) => {
-			const pair = residualNode(child, context);
-			return {
-				allow: or([pair.allow, and([not(pair.deny), rest.allow])]),
-				deny: or([pair.deny, and([not(pair.allow), rest.deny])])
-			};
-		});
-		case "Ceiling": {
-			const cap = residualNode(node.cap, context);
-			const inner = residualNode(node.policy, context);
-			return {
-				allow: and([not(cap.deny), inner.allow]),
-				deny: or([cap.deny, inner.deny])
-			};
-		}
-	}
-};
-/** The name of the predicate of a residual condition that runs `decide`. */
-const policyPredicate = "policy";
-/** Tests if a rule of a policy tree has a predicate. */
-const nodeHasPredicate = (node, memo = /* @__PURE__ */ new Map()) => remember(memo, node, () => {
-	const test = (child) => nodeHasPredicate(child, memo);
-	switch (node._tag) {
-		case "Rules": return Arr.some(node.rules, (value) => value.when !== void 0 && hasPredicate(value.when));
-		case "All":
-		case "Any":
-		case "FirstOf": return Arr.some(node.policies, test);
-		case "Ceiling": return test(node.cap) || test(node.policy);
-	}
-});
-const usesPredicate = (node, context) => remember(context.predicates, node, () => usesPredicateOnce(node, context));
-const usesPredicateOnce = (node, context) => {
-	switch (node._tag) {
-		case "Rules": return node.rules.some((value) => value.when !== void 0 && hasPredicate(value.when) && matchesTarget(value, context));
-		case "All":
-		case "Any":
-		case "FirstOf": return node.policies.some((child) => usesPredicate(child, context));
-		case "Ceiling": return usesPredicate(node.cap, context) || usesPredicate(node.policy, context);
-	}
-};
-const isScopeValue = (operand) => operand._tag === "Principal" || operand.value === null || typeof operand.value === "string" || typeof operand.value === "number" || typeof operand.value === "boolean";
-/**
-* Gives the problem of a scope that is not plain data, or `undefined` when it
-* is plain data. A predicate, or a value that a condition can not hold, such
-* as `undefined` from a route parameter, is a defect: such a scope could make
-* a check pass on the wrong values. A shared node is tested one time.
-*/
-const scopeProblem = (ast, memo = /* @__PURE__ */ new Map()) => remember(memo, ast, () => {
-	switch (ast._tag) {
-		case "Predicate": return "can not have a predicate";
-		case "Compare": return isScopeValue(ast.value) ? null : `has a value for "${ast.field}" that is not a scalar`;
-		case "In": return Arr.every(ast.values, isScopeValue) ? null : `has a value for "${ast.field}" that is not a scalar`;
-		case "Under": return Arr.every(ast.prefix, isScopeValue) ? null : "has a path part that is not a scalar";
-		case "And":
-		case "Or": return Option.getOrNull(Arr.findFirst(Arr.map(ast.conditions, (child) => scopeProblem(child, memo)), (problem) => problem !== void 0)) ?? null;
-		case "Not": return scopeProblem(ast.condition, memo) ?? null;
-		default: return null;
-	}
-}) ?? void 0;
-/**
-* Gives the condition of a scope, with the principal and the path in it.
-* With no scope, it is `True`.
-*/
-/**
-* The fields that a scope reads, before it is made smaller. A smaller scope
-* may leave out a read that fails, such as a getter.
-*/
-const scopeFields = (within) => within === void 0 ? [] : fields(within(builder()));
-const scopeOf = (within, input) => {
-	if (within === void 0) return always;
-	const ast = within(builder());
-	const problem = scopeProblem(ast);
-	if (problem !== void 0) throw new globalThis.Error(`A scope ${problem}`);
-	return partial(ast, input);
-};
-const residualsAny = (policy, request) => scopedResiduals(policy, request);
-const scopedResiduals = (policy, request) => {
-	const descriptor = descriptorOf(policy.domain, request.kind);
-	if (descriptor === void 0 || !fitsKind(descriptor, request)) return {
-		scope: never,
-		allow: never,
-		deny: never,
-		schema: void 0
-	};
-	if (scopeReadsGetter(request, descriptor)) throw new globalThis.Error("The scope of this request reads a getter, so it has no residual condition");
-	const input = {
-		principal: request.principal,
-		path: descriptor.path
-	};
-	const scope = scopeOf(request.within, input);
-	const build = makeBuild();
-	const and = build.and;
-	const inScope = (pair) => ({
-		scope,
-		allow: and([scope, pair.allow]),
-		deny: and([scope, pair.deny]),
-		schema: descriptor.schema
-	});
-	if (scope._tag === "False") return inScope({
-		allow: never,
-		deny: never
-	});
-	const context = {
-		action: request.action,
-		kind: request.kind,
-		field: request.field,
-		input,
-		descriptor,
-		pairs: /* @__PURE__ */ new Map(),
-		predicates: /* @__PURE__ */ new Map(),
-		build
-	};
-	if (!usesPredicate(nodeOf(policy), context)) {
-		if (readsGetter(policy, request, descriptor)) throw new globalThis.Error("A rule of this request reads a getter, so it has no residual condition");
-		try {
-			return inScope(residualNode(nodeOf(policy), context));
-		} catch (error) {
-			if (error instanceof TooLarge) throw new globalThis.Error(`The residual condition of this request would have more than ${String(maxResidualSize)} nodes or ${String(maxResidualDepth)} levels`);
-			throw error;
-		}
-	}
-	const decision = (value) => decideNode(policy.node, {
-		action: request.action,
-		kind: request.kind,
-		field: request.field,
-		input: {
-			value,
-			principal: request.principal,
-			path: descriptor.path
-		},
-		descriptor,
-		trace: void 0,
-		predicates: /* @__PURE__ */ new Map(),
-		decisions: /* @__PURE__ */ new Map()
-	}, []);
-	const test = (tag) => builder().predicate(policyPredicate, (value) => kindOf(value) === request.kind ? Effect.map(decision(value), (result) => result._tag === tag) : Effect.succeed(false));
-	return inScope({
-		allow: test("Allow"),
-		deny: test("Deny")
-	});
-};
+const permittedFields = permittedFields$1;
 /**
 * Gives the condition on resource values for which the policy allows a
 * request. It has no principal fields and no `Under` nodes, so you can give it
@@ -783,557 +187,49 @@ const scopedResiduals = (policy, request) => {
 *
 * A policy tree may use the condition of a child two times, so a small policy
 * may give a very large condition. When the condition would have more than
-* 10000 nodes or 500 levels, this function throws an error. In an
-* `Authorizer`, the error is
-* a defect, so the check fails.
+* 10000 nodes, this function throws an error. In an `Authorizer`, the error
+* is a defect, so the check fails.
 *
 * @stability stable
 * @category evaluation
 * @since 0.3.0
 */
-const residual = dual(2, (policy, request) => residualsAny(policy, request).allow);
-/**
-* Gives both residual conditions of a request: the values that the policy
-* allows, and the values that it denies. A value in neither is not
-* applicable. See {@link residual}.
-*
-* @stability stable
-* @category evaluation
-* @since 1.0.0
-*/
-const residuals = dual(2, residualsAny);
-const coverages = Data.taggedEnum();
-/**
-* Tests if a rule that the request may use, or its scope, reads a getter of
-* a class, in any branch of a union.
-*/
-const readsGetter = (policy, request, descriptor) => scopeReadsGetter(request, descriptor) || !readsOnly(nodeOf(policy), targetOf(request, descriptor), (field) => !readsGetterAt(descriptor.schema, field), /* @__PURE__ */ new Map());
-/**
-* Tests if a read of a field may read a getter of a class: at the field, or
-* at a field on the way to it, in any branch of a union.
-*/
-const readsGetterAt = (schema, field) => {
-	const parts = field.split(".");
-	return Arr.some(Arr.range(1, parts.length), (count) => hasGetter(schema, parts.slice(0, count).join(".")));
-};
-/**
-* Tests if the scope of a request reads a getter of a class. A scope is made
-* smaller in each residual, also next to a predicate that runs `decide`, so
-* such a scope has no residual.
-*/
-const scopeReadsGetter = (request, descriptor) => !Arr.every(scopeFields(request.within), (field) => !readsGetterAt(descriptor.schema, field));
-/**
-* Tests if a request has no residual: its scope reads a getter, or it has a
-* plain residual and a rule that it may use reads a getter. A residual with
-* a predicate runs `decide`, so the reads of its rules stay.
-*/
-const hasNoResidual = (policy, request, descriptor) => scopeReadsGetter(request, descriptor) || !usesPredicate(nodeOf(policy), targetOf(request, descriptor)) && readsGetter(policy, request, descriptor);
-/** The parts of a request that tell which rules it may use. */
-const targetOf = (request, descriptor) => ({
-	action: request.action,
-	kind: request.kind,
-	field: request.field,
-	descriptor,
-	predicates: /* @__PURE__ */ new Map()
-});
-/**
-* Tests if each field that a rule that the request may use reads passes
-* `test`. It looks at the conditions before they are made smaller. A smaller
-* condition may leave out a field, but a read of that field, such as a
-* getter, may fail when `decide` runs. A shared node is visited one time.
-*/
-const readsOnly = (node, target, test, memo) => remember(memo, node, () => {
-	switch (node._tag) {
-		case "Rules": return Arr.every(node.rules, (value) => value.when === void 0 || !matchesTarget(value, target) || Arr.every(fields(value.when), test));
-		case "All":
-		case "Any":
-		case "FirstOf": return Arr.every(node.policies, (child) => readsOnly(child, target, test, memo));
-		case "Ceiling": return readsOnly(node.cap, target, test, memo) && readsOnly(node.policy, target, test, memo);
-	}
-});
-const coverageAny = (policy, request) => {
-	const descriptor = descriptorOf(policy.domain, request.kind);
-	if (descriptor !== void 0 && hasNoResidual(policy, request, descriptor)) return coverages.Unknown({
-		condition: never,
-		reason: "schema"
-	});
-	const scoped = scopedResiduals(policy, request);
-	const allowed = scoped.allow;
-	if (descriptor !== void 0) {
-		const plain = (field) => isPlainField(descriptor.schema, field);
-		if (readsGetter(policy, request, descriptor) || !Arr.every(scopeFields(request.within), plain) || !readsOnly(nodeOf(policy), targetOf(request, descriptor), plain, /* @__PURE__ */ new Map())) return coverages.Unknown({
-			condition: allowed,
-			reason: "schema"
-		});
-	}
-	const options = { schema: scoped.schema };
-	const some = allowed._tag === "False" ? void 0 : satisfiable(allowed, options);
-	if (some === void 0 || some._tag === "Unsatisfiable") return coverages.None({ condition: never });
-	if (some._tag === "Unknown") return coverages.Unknown({
-		condition: allowed,
-		reason: some.reason
-	});
-	const refused = simplify(and(scoped.scope, not(allowed)));
-	const missing = refused._tag === "False" ? void 0 : satisfiable(refused, options);
-	if (missing === void 0 || missing._tag === "Unsatisfiable") return coverages.All({ condition: scoped.scope });
-	if (missing._tag === "Unknown") return coverages.Unknown({
-		condition: allowed,
-		reason: missing.reason
-	});
-	return coverages.Some({
-		condition: allowed,
-		allowed: some.example,
-		refused: missing.example
-	});
-};
-/**
-* Tests if the scope of a request has a value of the Schema of its kind. The
-* answer is `true` only when the search finds such a value. When the search
-* can not say, the answer is `false`. So a "yes" from it is safe to act on,
-* as for the question "may the decider answer for this scope?".
-*
-* @stability stable
-* @category evaluation
-* @since 1.0.0
-*/
-const scopeHasValue = (policy, request) => {
-	const scoped = scopedResiduals(policy, request);
-	return satisfiable(scoped.scope, { schema: scoped.schema })._tag === "Satisfiable";
-};
-/**
-* Tests if the scope of a request has no value of the Schema of its kind. A
-* scope with a mistake, such as two values for one field, is empty. With no
-* scope, the answer is `false` when the kind has a value. When the search can
-* not say, the answer is `false`.
-*
-* @stability stable
-* @category evaluation
-* @since 1.0.0
-*/
-const scopeIsEmpty = (policy, request) => {
-	const scoped = scopedResiduals(policy, request);
-	return satisfiable(scoped.scope, { schema: scoped.schema })._tag === "Unsatisfiable";
-};
+const residual = residual$1;
 /**
 * Tells how much of a scope the policy allows: all of it, none of it, or some
 * of it. See {@link Coverage}. With no scope (`within`), the scope is every
 * value of the kind.
 *
-* The answer comes from {@link Condition.satisfiable} with the Schema of the
-* resource, so it is exact for the values of the Schema. When a condition
-* tests a field that is not a plain scalar (see `Resource.isPlainField`),
-* such as a field with a check other than a finite or integer check, the
-* answer is `Unknown`, and a check on the kind says no.
+* The answer comes from {@link Condition.satisfiable} with the shape of the
+* Schema of the resource. `All` and `None` hold for every value of the
+* Schema. `Some` means that, by the shape of the Schema, a value may get
+* either answer: a check such as a minimum length may still stop one of the
+* examples. `Unknown` comes only from a predicate or from the budget of the
+* search.
 *
-* `Some` means that some value of the Schema is allowed. It does not mean that
-* such a value is in your database. To know that, run `condition` as a query.
+* `Some` does not mean that such a value is in your database. To know that,
+* run `condition` as a query.
 *
 * @stability stable
 * @category evaluation
 * @since 1.0.0
 */
-const coverage = dual(2, coverageAny);
-const AlgorithmSchema = Schema.Literals([
-	"denyOverrides",
-	"permitOverrides",
-	"firstApplicable",
-	"lastApplicable"
-]);
-const encodedRuleSchema = (meta) => Schema.Struct({
-	_tag: Schema.Literals(["Allow", "Deny"]),
-	actions: Schema.Array(Schema.String),
-	resources: Schema.Array(Schema.String),
-	when: Schema.optionalKey(schema$1),
-	fields: Schema.String.pipe(Schema.Array, Schema.optionalKey),
-	reason: Schema.optionalKey(Schema.String),
-	id: Schema.optionalKey(Schema.String),
-	meta: Schema.optionalKey(meta ?? Schema.Never)
-});
-/**
-* The most levels of objects and arrays in the JSON form of a policy. The
-* Schema of a policy calls itself for each level, so a much deeper input
-* could fill the stack before the checks of the policy run. A policy tree of
-* `maxDepth` levels with deep conditions stays well below this.
-*/
-const maxJsonDepth = 1e3;
-/**
-* The most objects and arrays in the JSON form of an input, with a shared one
-* counted for each place. The decoder writes out a shared one each time, so
-* an input with few objects may give a very large tree.
-*/
-const maxInputNodes = 1e6;
-/**
-* Measures a value, or gives `undefined` when it is higher than `levels`. A
-* shared object is measured one time. The walk stops at that height, so it
-* does not fill the stack itself. The memo is a native `Map`, because it
-* must find an object by the object itself.
-*/
-const measure = (input, levels, memo) => {
-	if (typeof input !== "object" || input === null) return {
-		size: 0,
-		height: 0
-	};
-	const cached = memo.get(input);
-	if (cached !== void 0 && ("failed" in cached ? levels <= cached.failed : true)) return "failed" in cached || cached.height > levels ? void 0 : cached;
-	const result = levels === 0 || !isPlainData(input) ? void 0 : Arr.reduce(Object.values(input), {
-		size: 1,
-		height: 1
-	}, (total, child) => {
-		const measured = total === void 0 ? void 0 : measure(child, levels - 1, memo);
-		return total === void 0 || measured === void 0 ? void 0 : {
-			size: total.size + measured.size,
-			height: Math.max(total.height, 1 + measured.height)
-		};
-	});
-	memo.set(input, result ?? { failed: levels });
-	return result;
-};
-/**
-* Tests if each own key of an object is a plain data key that a loop over the
-* keys sees. The `length` of an array is the one key that is not seen. The
-* decoder reads keys of the prototypes too, so a prototype other than the
-* one of a plain object or an array may have only methods, as the prototype
-* of a class has.
-*/
-const isPlainData = (input) => Arr.every(Reflect.ownKeys(input), (key) => {
-	const property = Object.getOwnPropertyDescriptor(input, key);
-	return property !== void 0 && "value" in property && (property.enumerable === true || Array.isArray(input) && key === "length");
-}) && hasOnlyMethods(Object.getPrototypeOf(input));
-/** Tests if the prototypes from `prototype` up have only methods. */
-const hasOnlyMethods = (prototype) => prototype === null || prototype === Object.prototype || prototype === Array.prototype || typeof prototype === "object" && Arr.every(Reflect.ownKeys(prototype), (key) => {
-	const property = Object.getOwnPropertyDescriptor(prototype, key);
-	return typeof key === "symbol" || key === "constructor" || property !== void 0 && "value" in property && typeof property.value === "function";
-}) && hasOnlyMethods(Object.getPrototypeOf(prototype));
-/** Tests if a value is low and small enough to decode. */
-const fitsLimits = (input) => {
-	const measured = measure(input, maxJsonDepth, /* @__PURE__ */ new Map());
-	return measured === void 0 ? `A policy may have at most ${String(maxJsonDepth)} levels of JSON` : measured.size > maxInputNodes ? `A policy may have at most ${String(maxInputNodes)} objects and arrays in JSON` : true;
-};
-const encodedNodeSchema = (meta) => {
-	const self = Schema.Union([
-		Schema.TaggedStruct("Rules", {
-			algorithm: AlgorithmSchema,
-			rules: Schema.Array(encodedRuleSchema(meta))
-		}),
-		Schema.TaggedStruct("All", { policies: Schema.Array(Schema.suspend(() => self)) }),
-		Schema.TaggedStruct("Any", { policies: Schema.Array(Schema.suspend(() => self)) }),
-		Schema.TaggedStruct("FirstOf", { policies: Schema.Array(Schema.suspend(() => self)) }),
-		Schema.TaggedStruct("Ceiling", {
-			cap: Schema.suspend(() => self),
-			policy: Schema.suspend(() => self)
-		})
-	]);
-	return self;
-};
-const principalRefs = (ast) => Array.from(refsIn(ast, /* @__PURE__ */ new Map()));
-/** The principal fields of a node. A shared node is visited one time. */
-const refsIn = (node, memo) => remember(memo, node, () => {
-	const refs = (operands) => HashSet.fromIterable(Arr.flatMap(operands, (operand) => operand._tag === "Principal" ? [operand.path] : []));
-	switch (node._tag) {
-		case "Compare": return refs([node.value]);
-		case "In": return refs(node.values);
-		case "Under": return refs(node.prefix);
-		case "And":
-		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, refsIn(child, memo)));
-		case "Not": return refsIn(node.condition, memo);
-		default: return HashSet.empty();
-	}
-});
-const literalTests = (node) => Arr.map(Array.from(literalTestsIn(node, /* @__PURE__ */ new Map())), (text) => {
-	const [field, value] = JSON.parse(text);
-	return [field, hasProperty(value, "number") ? Number(value.number) : value];
-});
-/**
-* The JSON text of a test. JSON has no `Infinity`, `-Infinity` or `NaN`, so
-* such a number goes in as its text.
-*/
-const literalText = (field, value) => JSON.stringify([field, typeof value === "number" && !Number.isFinite(value) ? { number: String(value) } : value]);
-/**
-* The tests of fields with fixed values in a node, each as the JSON text of a
-* {@link LiteralTest}. A set of texts keeps each test one time, so a node
-* with many shared parts gives a small set. A shared node is visited one time.
-*/
-const literalTestsIn = (node, memo) => remember(memo, node, () => {
-	const tests = (field, operands) => HashSet.fromIterable(Arr.flatMap(operands, (operand) => operand._tag === "Literal" ? [literalText(field, operand.value)] : []));
-	switch (node._tag) {
-		case "Compare": return tests(node.field, [node.value]);
-		case "In": return tests(node.field, node.values);
-		case "And":
-		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, literalTestsIn(child, memo)));
-		case "Not": return literalTestsIn(node.condition, memo);
-		default: return HashSet.empty();
-	}
-});
-const principalTests = (node) => Arr.map(Array.from(principalTestsIn(node, /* @__PURE__ */ new Map())), (text) => JSON.parse(text));
-/**
-* The tests of fields with principal fields in a node, each as the JSON text
-* of a {@link PrincipalTest}. See {@link literalTestsIn}.
-*/
-const principalTestsIn = (node, memo) => remember(memo, node, () => {
-	const tests = (field, operands) => HashSet.fromIterable(Arr.flatMap(operands, (operand) => operand._tag === "Principal" ? [JSON.stringify([field, operand.path])] : []));
-	switch (node._tag) {
-		case "Compare": return tests(node.field, [node.value]);
-		case "In": return tests(node.field, node.values);
-		case "And":
-		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, principalTestsIn(child, memo)));
-		case "Not": return principalTestsIn(node.condition, memo);
-		default: return HashSet.empty();
-	}
-});
-/**
-* Tests if a node has a fixed value that is not a {@link Condition.Scalar},
-* such as `undefined`. A shared node is visited one time.
-*/
-const hasBadLiteralIn = (node, memo) => remember(memo, node, () => {
-	const bad = (operands) => Arr.some(operands, (operand) => operand._tag === "Literal" && operand.value !== null && typeof operand.value !== "string" && typeof operand.value !== "number" && typeof operand.value !== "boolean");
-	switch (node._tag) {
-		case "Compare": return bad([node.value]);
-		case "In": return bad(node.values);
-		case "Under": return bad(node.prefix);
-		case "And":
-		case "Or": return Arr.some(node.conditions, (child) => hasBadLiteralIn(child, memo));
-		case "Not": return hasBadLiteralIn(node.condition, memo);
-		default: return false;
-	}
-});
-/**
-* The principal fields in the prefixes of `Under` nodes, each as the JSON text
-* of the place in the prefix and the path of the field. See
-* {@link literalTestsIn}.
-*/
-/**
-* The fixed values in the prefixes of `Under` nodes, each as the JSON text of
-* the place in the prefix, the value, and the fixed strings of the whole
-* prefix. A number that JSON can not hold is left out: it fits no field
-* that a path names. See {@link underRefsIn}.
-*/
-const underLiteralsIn = (node, memo) => remember(memo, node, () => {
-	switch (node._tag) {
-		case "Under": {
-			const strings = Arr.map(node.prefix, (operand) => operand._tag === "Literal" && typeof operand.value === "string" ? operand.value : null);
-			return HashSet.fromIterable(Arr.flatMap(node.prefix, (operand, index) => operand._tag === "Literal" && (operand.value === null || typeof operand.value === "string" || typeof operand.value === "boolean" || Number.isFinite(operand.value)) ? [JSON.stringify([
-				index,
-				operand.value,
-				strings
-			])] : []));
-		}
-		case "And":
-		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, underLiteralsIn(child, memo)));
-		case "Not": return underLiteralsIn(node.condition, memo);
-		default: return HashSet.empty();
-	}
-});
-const underLiterals = (node) => Arr.map(Array.from(underLiteralsIn(node, /* @__PURE__ */ new Map())), (text) => JSON.parse(text));
-const underRefsIn = (node, memo) => remember(memo, node, () => {
-	switch (node._tag) {
-		case "Under": {
-			const strings = Arr.map(node.prefix, (operand) => operand._tag === "Literal" && typeof operand.value === "string" ? operand.value : null);
-			return HashSet.fromIterable(Arr.flatMap(node.prefix, (operand, index) => operand._tag === "Principal" ? [JSON.stringify([
-				index,
-				operand.path,
-				strings
-			])] : []));
-		}
-		case "And":
-		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, underRefsIn(child, memo)));
-		case "Not": return underRefsIn(node.condition, memo);
-		default: return HashSet.empty();
-	}
-});
-const underRefs = (node) => Arr.map(Array.from(underRefsIn(node, /* @__PURE__ */ new Map())), (text) => JSON.parse(text));
-/**
-* Tests if the path of a resource may start with a prefix: it is as long as
-* the prefix, and each fixed string of the prefix is the string of the path
-* at its place, when the path has a string there.
-*/
-const mayStartWith = (descriptor, strings) => (descriptor.path?.length ?? 0) >= strings.length && Arr.every(strings, (string, index) => {
-	const segment = descriptor.path?.[index];
-	return string === null || typeof segment !== "string" || segment === string;
-});
-/**
-* Tests if a principal field may hold the part of a path at `index`: a string
-* of the path, or a value of the field that the path names there.
-*/
-const fitsPathPart = (descriptor, index, principal) => {
-	const segment = descriptor.path?.[index];
-	return segment === void 0 ? false : typeof segment === "string" ? fitsDomain(principal, segment) : domainsMeet(domainOf(descriptor.schema, segment.field), principal);
-};
-/**
-* The fields of ordered tests (`lt`, `lte`, `gt`, `gte`) in a node, each as
-* the JSON text of the field and the operand. See {@link literalTestsIn}.
-*/
-const orderedTestsIn = (node, memo) => remember(memo, node, () => {
-	switch (node._tag) {
-		case "Compare": return node.op === "eq" || node.op === "ne" ? HashSet.empty() : HashSet.make(JSON.stringify([node.field, node.value._tag === "Literal" ? {
-			_tag: "Literal",
-			type: typeof node.value.value
-		} : node.value]));
-		case "And":
-		case "Or": return Arr.reduce(node.conditions, HashSet.empty(), (all, child) => HashSet.union(all, orderedTestsIn(child, memo)));
-		case "Not": return orderedTestsIn(node.condition, memo);
-		default: return HashSet.empty();
-	}
-});
-const orderedTests = (node) => Arr.map(Array.from(orderedTestsIn(node, /* @__PURE__ */ new Map())), (text) => JSON.parse(text));
-/**
-* Tests if a field may hold a value with an order: a number or a string. An
-* ordered test is false for any other value.
-*/
-const isOrdered = (domain) => domain.string || domain.number !== "none" || Arr.some(domain.literals, (value) => typeof value === "string" || typeof value === "number");
-/**
-* Tests if two fields may hold values of one ordered type: two strings or two
-* numbers. An ordered test of two values of other types is false.
-*/
-const orderedMeet = (left, right) => {
-	const strings = (domain) => domain.string || Arr.some(domain.literals, (value) => typeof value === "string");
-	const numbers = (domain) => domain.number !== "none" || Arr.some(domain.literals, (value) => typeof value === "number");
-	return strings(left) && strings(right) || numbers(left) && numbers(right);
-};
-/**
-* Tests if two fields may hold one value: a value of one type, or a single
-* value that the other field may hold.
-*/
-const domainsMeet = (left, right) => left.string && right.string || left.boolean && right.boolean || left.number !== "none" && right.number !== "none" || Arr.some(left.literals, (value) => fitsDomain(right, value)) || Arr.some(right.literals, (value) => fitsDomain(left, value));
-/**
-* Tests if a field with this domain may hold a value of the type of `value`.
-* `null` always fits: a test with `null` is a test that the field is missing.
-*/
-const fitsDomain = (domain, value) => value === null || domain.literals.includes(value) || typeof value === "string" && domain.string || typeof value === "boolean" && domain.boolean || typeof value === "number" && domain.number !== "none";
-/**
-* Checks the names in an encoded policy against the domain. It gives one
-* message for each problem.
-*/
-const validate = (domain, root) => {
-	const principalPaths = domain.principal.pipe(fieldPaths, HashSet.fromIterable);
-	const ruleIssues = (value, at) => {
-		const all = value.resources.includes("*");
-		const named = Array.from(HashSet.fromIterable(Arr.filter(value.resources, (kind) => kind !== "*")));
-		const descriptors = Arr.flatMap(named, (kind) => {
-			const descriptor = descriptorOf(domain, kind);
-			return descriptor === void 0 ? [] : [descriptor];
-		});
-		const known = all ? Array.from(HashMap.values(domain.resources)) : descriptors;
-		const applicable = Arr.filter(descriptors, (descriptor) => value.actions.includes("*") || Arr.some(value.actions, (action) => descriptor.actions.includes(action)));
-		const usedFields = [...Arr.filter(value.fields ?? [], (field) => !field.includes("*")), ...value.when === void 0 ? [] : fields(value.when)];
-		return [
-			...Arr.map(Arr.filter(named, (kind) => !HashMap.has(domain.resources, kind)), (kind) => ({
-				path: [...at, "resources"],
-				issue: `There is no resource with the kind "${kind}"`
-			})),
-			...Arr.map(Arr.filter(value.actions, (action) => action !== "*" && !Arr.some(known, (descriptor) => descriptor.actions.includes(action))), (action) => ({
-				path: [...at, "actions"],
-				issue: `The action "${action}" is not an action of these resources`
-			})),
-			...Arr.map(Arr.filter(usedFields, (field) => all || descriptors.length === 0 || !Arr.every(descriptors, (descriptor) => descriptor.fieldPaths.includes(field) || hasPath(descriptor.schema, field) || hasGetter(descriptor.schema, field))), (field) => ({
-				path: at,
-				issue: `The field "${field}" is not a field of every resource of the rule`
-			})),
-			...Arr.map(Arr.filter(value.when === void 0 ? [] : principalRefs(value.when), (ref) => !HashSet.has(principalPaths, ref) && !hasPath(domain.principal, ref) && !hasGetter(domain.principal, ref)), (ref) => ({
-				path: [...at, "when"],
-				issue: `The principal has no field "${ref}"`
-			})),
-			...Arr.map(Arr.filter(value.when === void 0 ? [] : literalTests(value.when), ([field, literal]) => Arr.some(applicable, (descriptor) => !fitsDomain(domainOf(descriptor.schema, field), literal))), ([field, literal]) => ({
-				path: [...at, "when"],
-				issue: `The field "${field}" can not hold the value ${JSON.stringify(literal)}`
-			})),
-			...Arr.map(Arr.filter(value.when === void 0 ? [] : principalTests(value.when), ([field, ref]) => Arr.some(applicable, (descriptor) => !domainsMeet(domainOf(descriptor.schema, field), domainOf(domain.principal, ref)))), ([field, ref]) => ({
-				path: [...at, "when"],
-				issue: `The field "${field}" can not hold a value of the principal field "${ref}"`
-			})),
-			...value.when !== void 0 && !isAst(value.when) ? [{
-				path: [...at, "when"],
-				issue: "The condition is not a whole condition tree"
-			}] : [],
-			...value.when !== void 0 && hasBadLiteralIn(value.when, /* @__PURE__ */ new Map()) ? [{
-				path: [...at, "when"],
-				issue: "A test has a fixed value that is not a string, a number, a boolean or null"
-			}] : [],
-			...Arr.map(Arr.filter(value.when === void 0 ? [] : underRefs(value.when), ([index, ref, strings]) => Arr.some(Arr.filter(all ? Arr.filter(known, (descriptor) => descriptor.path?.[index] !== void 0 && (value.actions.includes("*") || Arr.some(value.actions, (action) => descriptor.actions.includes(action)))) : applicable, (descriptor) => mayStartWith(descriptor, strings)), (descriptor) => !fitsPathPart(descriptor, index, domainOf(domain.principal, ref)))), ([, ref]) => ({
-				path: [...at, "when"],
-				issue: `The principal field "${ref}" can not hold a part of the path of the resource`
-			})),
-			...Arr.map(Arr.filter(value.when === void 0 ? [] : underLiterals(value.when), ([index, literal, strings]) => Arr.some(Arr.filter(all ? Arr.filter(known, (descriptor) => value.actions.includes("*") || Arr.some(value.actions, (action) => descriptor.actions.includes(action))) : applicable, (descriptor) => mayStartWith(descriptor, strings)), (descriptor) => {
-				const segment = descriptor.path?.[index];
-				return segment !== void 0 && typeof segment !== "string" && !fitsDomain(domainOf(descriptor.schema, segment.field), literal);
-			})), ([index, literal]) => ({
-				path: [...at, "when"],
-				issue: `The path part ${String(index)} can not hold the value ${JSON.stringify(literal)}`
-			})),
-			...Arr.map(Arr.filter(value.when === void 0 ? [] : orderedTests(value.when), ([field, operand]) => operand._tag === "Literal" && operand.type !== "string" && operand.type !== "number" || Arr.some(applicable, (descriptor) => {
-				const fieldDomain = domainOf(descriptor.schema, field);
-				return operand._tag === "Literal" ? !isOrdered(fieldDomain) : !orderedMeet(fieldDomain, domainOf(domain.principal, operand.path));
-			})), ([field]) => ({
-				path: [...at, "when"],
-				issue: `The field "${field}" has an ordered test with a value that has no order`
-			}))
-		];
-	};
-	const issuesOf = (node, path, level) => {
-		if (level > maxDepth) return [{
-			path,
-			issue: `A policy tree may have at most ${maxDepth} levels`
-		}];
-		switch (node._tag) {
-			case "Rules": return Arr.flatMap(node.rules, (value, index) => ruleIssues(value, [
-				...path,
-				"rules",
-				index
-			]));
-			case "All":
-			case "Any":
-			case "FirstOf": return Arr.flatMap(node.policies, (child, index) => issuesOf(child, [
-				...path,
-				"policies",
-				index
-			], level + 1));
-			case "Ceiling": return [...issuesOf(node.cap, [...path, "cap"], level + 1), ...issuesOf(node.policy, [...path, "policy"], level + 1)];
-		}
-	};
-	return issuesOf(root, [], 1);
-};
-/**
-* Makes a policy tree from its JSON form. Each rule gets the domain of the
-* Schema, as a rule from the builder of the domain has it.
-*/
-const decodeNode = (node, domain) => {
-	switch (node._tag) {
-		case "Rules": return nodes.Rules({
-			algorithm: node.algorithm,
-			rules: node.rules.map((value) => make({
-				...value,
-				domain
-			}))
-		});
-		case "All":
-		case "Any":
-		case "FirstOf": return nodes[node._tag]({ policies: node.policies.map((child) => decodeNode(child, domain)) });
-		case "Ceiling": return nodes.Ceiling({
-			cap: decodeNode(node.cap, domain),
-			policy: decodeNode(node.policy, domain)
-		});
-	}
-};
-/**
-* Tests if a value is a policy.
-*
-* @stability stable
-* @category guards
-* @since 0.3.0
-*/
-const isPolicy = (u) => u instanceof PolicyData;
+const coverage = coverageAny;
 /**
 * The Schema of the policies of a domain with no predicates. Decoding checks
 * every kind, action, field and principal field against the domain, and the
 * `meta` of each rule against the `meta` Schema of the domain.
 *
+* The decoder takes at most 256 levels of policies and 500 levels of
+* conditions, and at most 1000000 objects and array items, with a shared
+* object counted for each place. It reads only the own data fields of the
+* input.
+*
 * @stability stable
 * @category schemas
 * @since 0.3.0
 */
-const schema = (domain) => Schema.declare((input) => typeof input === "object" && input !== null).pipe(Schema.check(Schema.makeFilter(fitsLimits)), Schema.decodeTo(encodedNodeSchema(domain.meta), SchemaTransformation.passthrough()), Schema.check(Schema.makeFilter((node) => validate(domain, node))), Schema.decodeTo(Schema.declare((u) => isPolicy(u) && u.domain === domain && !nodeHasPredicate(u.node)), SchemaTransformation.transformEffect({
-	decode: (node) => Effect.succeed(fromNode(domain, decodeNode(node, domain))),
-	encode: (policy, options) => encodedSize(policy.node) > maxEncodedNodes ? Effect.fail(new SchemaIssue.InvalidValue({ message: tooLargeMessage }, policy, options)) : Effect.succeed(encodeNode(policy.node))
-})));
-export { Policy_exports, all, any, ceiling, coverage, decide, decideSync, define, empty, explain, firstOf, fitsKind, isPolicy, permittedFields, provideContext, residual, residuals, rules, schema, scopeHasValue, scopeIsEmpty };
+const schema = schema$1;
+export { PolicyError, Policy_exports, all, any, builder, ceiling, coverage, decide, decideSync, define, explain, firstOf, permittedFields, provideContext, residual, rule, schema };
 
 //# sourceMappingURL=Policy.js.map