@nmnmcc/ability 1.0.1 → 2.0.1

package/src/Policy.ts

@@ -25,41 +25,29 @@
  *   this kind?"
  * - {@link permittedFields}: the fields that the policy lets a request use.
  *
- * Each of them also takes the request first and the policy later. In a `pipe`,
- * the policy gives the domain. Outside a `pipe`, give the domain by hand, as
- * in `Policy.decide<typeof App>(request)`. Without it the request has the type
- * `never`, so TypeScript can still check it.
+ * Each of them takes the policy first and the request second, as in
+ * `Policy.decide(policy, request)`. The policy gives the domain, so
+ * TypeScript checks the request against it.
  *
  * A policy without predicates can become JSON with {@link schema}.
  *
  * @stability stable
  * @since 0.3.0
  */
-// A policy keeps the error type and the service type of its predicates in the
-// public types. The code below works on the nodes with no types, where they
-// are `unknown`, so the language service check for `unknown` in an Effect is
-// off here.
-// @effect-diagnostics anyUnknownInErrorContext:off
 import type * as Context from "effect/Context"
-import * as Data from "effect/Data"
-import * as Arr from "effect/Array"
-import * as Chunk from "effect/Chunk"
-import * as Effect from "effect/Effect"
-import { dual } from "effect/Function"
-import * as HashMap from "effect/HashMap"
-import * as HashSet from "effect/HashSet"
-import * as Option from "effect/Option"
-import { hasProperty } from "effect/Predicate"
+import type * as Data from "effect/Data"
+import type * as Effect from "effect/Effect"
 import type * as Pipeable from "effect/Pipeable"
-import * as Ref from "effect/Ref"
-import * as Schema from "effect/Schema"
-import * as SchemaIssue from "effect/SchemaIssue"
-import * as SchemaTransformation from "effect/SchemaTransformation"
-import * as Condition from "./Condition.ts"
-import * as Decision from "./Decision.ts"
-import * as Domain from "./Domain.ts"
-import * as Resource from "./Resource.ts"
-import * as Rule from "./Rule.ts"
+import type * as Schema from "effect/Schema"
+import type * as Condition from "./Condition.ts"
+import * as Analysis from "./internal/analysis.ts"
+import * as Decide from "./internal/decide.ts"
+import * as Internal from "./internal/policy.ts"
+import type * as PolicyNodes from "./internal/policy-nodes.ts"
+import * as RuleData from "./internal/rule.ts"
+import type * as Decision from "./Decision.ts"
+import type * as Domain from "./Domain.ts"
+import type * as Resource from "./Resource.ts"
 
 /**
  * @stability stable
@@ -70,117 +58,62 @@ export type Algorithm =
 	"denyOverrides" | "permitOverrides" | "firstApplicable" | "lastApplicable"
 
 /**
+ * A list of rules with a combining algorithm.
+ *
  * @stability stable
  * @category models
  * @since 0.3.0
  */
-export interface RulesNode {
-	readonly _tag: "Rules"
-	readonly algorithm: Algorithm
-	readonly rules: ReadonlyArray<Rule.Any>
-}
+export type RulesNode = PolicyNodes.Rules
 
 /**
  * @stability stable
  * @category models
  * @since 0.3.0
  */
-export interface AllNode {
-	readonly _tag: "All"
-	readonly policies: ReadonlyArray<Node>
-}
+export type AllNode = PolicyNodes.All
 
 /**
  * @stability stable
  * @category models
  * @since 0.3.0
  */
-export interface AnyNode {
-	readonly _tag: "Any"
-	readonly policies: ReadonlyArray<Node>
-}
+export type AnyNode = PolicyNodes.Any
 
 /**
  * @stability stable
  * @category models
  * @since 0.3.0
  */
-export interface FirstOfNode {
-	readonly _tag: "FirstOf"
-	readonly policies: ReadonlyArray<Node>
-}
+export type FirstOfNode = PolicyNodes.FirstOf
 
 /**
  * @stability stable
  * @category models
  * @since 0.3.0
  */
-export interface CeilingNode {
-	readonly _tag: "Ceiling"
-	readonly cap: Node
-	readonly policy: Node
-}
+export type CeilingNode = PolicyNodes.Ceiling
 
 /**
- * The nodes of a policy tree.
+ * The nodes of a policy tree, without types. Each node is a class, and only
+ * the functions of this module and the Schema make one.
  *
  * @stability stable
  * @category models
  * @since 0.3.0
  */
-export type Node = RulesNode | AllNode | AnyNode | FirstOfNode | CeilingNode
-
-/**
- * The tree of a policy with the types of its predicates and its domain `D`.
- * Each rule and each child has the types too, and `"~Node"` is only in the types. A node made by
- * hand does not have it. So the node of one policy, or a part of it, can not
- * go into a policy with other types.
- *
- * @stability stable
- * @category models
- * @since 1.0.0
- */
-export type TypedNode<E = never, R = never, O = never, D = any> = (
-	| {
-			readonly _tag: "Rules"
-			readonly algorithm: Algorithm
-			// The rules may read different values, so a node keeps no one type of
-			// what they read. With `never`, a condition taken from a node fits no
-			// rule that reads a value or a principal.
-			readonly rules: ReadonlyArray<Rule.Rule<E, R, O, D, never>>
-	  }
-	| {
-			readonly _tag: "All" | "Any" | "FirstOf"
-			readonly policies: ReadonlyArray<TypedNode<E, R, O, D>>
-	  }
-	| {
-			readonly _tag: "Ceiling"
-			readonly cap: TypedNode<E, R, O, D>
-			readonly policy: TypedNode<E, R, O, D>
-	  }
-) & {
-	readonly "~Node": Condition.Variance<E, R, O>
-}
+export type Node = PolicyNodes.Node
 
 /**
- * A policy for the domain `D`. `E`, `R` and `O` come from the conditions of
- * its rules. See `Condition.Condition`.
+ * A policy for the domain `D`. `X` is `Condition.Opaque` when a rule of the
+ * policy has a predicate, and `never` when the policy is plain data. A plain
+ * policy can become JSON, and `decideSync` takes it.
  *
  * @stability stable
  * @category models
  * @since 0.3.0
  */
-export interface Policy<D extends Domain.Any, E = never, R = never, O = never>
-	extends Pipeable.Pipeable {
-	readonly domain: D
-	readonly node: TypedNode<E, R, O, D>
-	readonly "~Policy": Condition.Variance<E, R, O>
-	/**
-	 * Only in the types. A policy reads the values and the principal of its
-	 * domain, so a policy of one domain is not a policy of a wider domain.
-	 */
-	readonly "~Domain": (domain: D) => D
-}
+export type Policy<D extends Domain.Any, X = never> = Internal.PolicyData<D, X>
 
 /**
  * Any policy.
@@ -189,7 +122,7 @@ export interface Policy<D extends Domain.Any, E = never, R = never, O = never>
  * @category models
  * @since 0.3.0
  */
-export type Any = Policy<any, any, any, any>
+export type Any = Policy<any, any>
 
 /**
  * The domain of a policy.
@@ -198,45 +131,17 @@ export type Any = Policy<any, any, any, any>
  * @category utility types
  * @since 0.3.0
  */
-export type DomainOf<P> = P extends Policy<infer D, any, any, any> ? D : never
+export type DomainOf<P> = P extends Policy<infer D, any> ? D : never
 
 /**
- * The error type of a policy.
+ * The mark of a policy or a rule: `Condition.Opaque` when it has a predicate.
  *
  * @stability stable
  * @category utility types
  * @since 0.3.0
  */
-export type Error<P> = P extends {
-	readonly "~Policy"?: Condition.Variance<infer E, infer _R, infer _O>
-}
-	? E
-	: never
-
-/**
- * The service type of a policy.
- *
- * @stability stable
- * @category utility types
- * @since 0.3.0
- */
-export type Services<P> = P extends {
-	readonly "~Policy"?: Condition.Variance<infer _E, infer R, infer _O>
-}
-	? R
-	: never
-
-/**
- * `Condition.Opaque` when a policy has a predicate.
- *
- * @stability stable
- * @category utility types
- * @since 0.3.0
- */
-export type OpaqueOf<P> = P extends {
-	readonly "~Policy"?: Condition.Variance<infer _E, infer _R, infer O>
-}
-	? O
+export type OpaqueOf<P> = P extends { readonly "~Opaque": () => infer X }
+	? X
 	: never
 
 /**
@@ -288,9 +193,6 @@ export type Scope<D, K extends string> = (
 		Domain.Principal<D>
 	>,
 ) => Condition.Condition<
-	never,
-	never,
-	never,
 	Condition.Reads<Domain.ValueOf<D, K>, Domain.Principal<D>>
 >
 
@@ -370,7 +272,7 @@ export interface AnyRequest {
  */
 export interface Step {
 	readonly path: ReadonlyArray<number>
-	readonly rule: Rule.Any
+	readonly rule: AnyRule
 	readonly applies: boolean
 }
 
@@ -387,345 +289,329 @@ export interface Explanation {
 	readonly steps: ReadonlyArray<Step>
 }
 
+// Rules
+
 /**
- * The options of a list of rules.
+ * A rule for the domain `D`. `I` is what the tests of its condition read, and
+ * `X` is its mark: see `Condition.Condition`. A predicate reads the values and
+ * the principal of its domain, so a rule may go only into a policy of its own
+ * domain. A rule from {@link rule} has the domain `any`.
  *
  * @stability stable
  * @category models
  * @since 0.3.0
  */
-export interface Options {
-	/** The default is `denyOverrides`. */
-	readonly algorithm?: Algorithm
+export interface Rule<D = any, I = unknown, X = never>
+	extends RuleShape<I, X>, Pipeable.Pipeable {
+	readonly "~Opaque": () => X
+	readonly "~Domain": (domain: D) => D
+	[Symbol.iterator](): Generator<Rule<D, I, X>, Rule<D, I, X>, unknown>
 }
 
-const nodes = Data.taggedEnum<Node>()
+/**
+ * The data of a rule.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export interface RuleShape<I = unknown, X = never> {
+	readonly _tag: "Allow" | "Deny"
+	readonly actions: ReadonlyArray<string>
+	readonly resources: ReadonlyArray<string>
+	readonly when?: Condition.Condition<I, X>
+	readonly fields?: ReadonlyArray<string>
+	readonly reason?: string
+	readonly id?: string
+	readonly meta?: unknown
+	/**
+	 * The domain of the builder that made the rule. Two domains may have the
+	 * same types but other paths, so the types can not tell them apart. It is
+	 * not in the JSON form of a rule.
+	 */
+	readonly domain?: Domain.Any
+}
 
 /**
- * The most nodes that the JSON form of a policy may have. A tree may use one
- * child in many places, and the JSON form writes it out each time, so a small
- * tree may have a very large JSON form.
+ * Any rule.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
  */
-const maxEncodedNodes = 100_000
+// Every rule fits `never` as what it reads, and a condition taken from such a
+// rule fits no rule that reads a value or a principal.
+export type AnyRule = Rule<any, never, any>
 
 /**
- * The number of nodes of the JSON form of a condition. A shared child counts
- * one time for each place, as the JSON form writes it out each time.
+ * A resource in a rule: a kind name, a resource of the domain, or `"*"`.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
  */
-const conditionSize = (ast: Ast, memo: Map<Ast, number>): number =>
-	remember(memo, ast, () => {
-		switch (ast._tag) {
-			case "And":
-			case "Or":
-				return Arr.reduce(
-					ast.conditions,
-					1,
-					(size, child) => size + conditionSize(child, memo),
-				)
-			case "Not":
-				return 1 + conditionSize(ast.condition, memo)
-			default:
-				return 1
-		}
-	})
+export type RuleTarget<D> = Domain.Kind<D> | Domain.Resources<D> | "*"
 
 /**
- * The number of nodes of the JSON form of a tree, with the conditions of its
- * rules.
+ * The kind name of a target.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 0.3.0
  */
-const encodedSize = (
-	node: Node,
-	memo: Map<Node, number> = new Map(),
-	conditions: Map<Ast, number> = new Map(),
-): number =>
-	remember(memo, node, () => {
-		switch (node._tag) {
-			case "Rules":
-				return Arr.reduce(
-					node.rules,
-					1,
-					(size, value) =>
-						size +
-						1 +
-						(value.when === undefined
-							? 0
-							: conditionSize(value.when as Ast, conditions)),
-				)
-			case "All":
-			case "Any":
-			case "FirstOf":
-				return Arr.reduce(
-					node.policies,
-					1,
-					(size, child) => size + encodedSize(child, memo, conditions),
-				)
-			case "Ceiling":
-				return (
-					1 +
-					encodedSize(node.cap, memo, conditions) +
-					encodedSize(node.policy, memo, conditions)
-				)
-		}
-	})
-
-/** Gives the JSON form of a tree, when it is not too large. */
-const encodeTree = (node: Node): EncodedNode => {
-	if (encodedSize(node) > maxEncodedNodes) {
-		throw new globalThis.Error(tooLargeMessage)
-	}
-	return encodeNode(node)
-}
+export type KindOf<T> = T extends string ? T : Resource.Kind<T>
 
-const tooLargeMessage = `The JSON form of this policy would have more than ${String(maxEncodedNodes)} nodes`
-
-const encodeNode = (node: Node): EncodedNode => {
-	switch (node._tag) {
-		case "Rules":
-			return {
-				_tag: "Rules",
-				algorithm: node.algorithm,
-				// The domain of a rule is not in its JSON form.
-				rules: node.rules.map(
-					({ domain: _domain, ...value }) => ({ ...value }) as EncodedRule,
-				),
-			}
-		case "All":
-		case "Any":
-		case "FirstOf":
-			return { _tag: node._tag, policies: node.policies.map(encodeNode) }
-		case "Ceiling":
-			return {
-				_tag: "Ceiling",
-				cap: encodeNode(node.cap),
-				policy: encodeNode(node.policy),
-			}
-	}
-}
+/**
+ * The actions that a rule may use for the kinds `K`.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 0.3.0
+ */
+export type ActionFor<D, K> =
+	| "*"
+	| ("*" extends K
+			? Domain.AnyAction<D>
+			: Domain.ActionOf<D, Extract<K, string>>)
 
 /**
- * The tree of a policy as a value that `JSON.stringify` keeps with no loss.
- * See `Condition.toJsonValue`.
+ * The targets in the resource argument of a rule: the one target, or the
+ * targets of a list.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 1.0.0
  */
-const jsonNode = (node: EncodedNode, meta: Schema.Top | undefined): unknown => {
-	const json = (child: EncodedNode) => jsonNode(child, meta)
-	switch (node._tag) {
-		case "Rules":
-			return {
-				...node,
-				rules: Arr.map(node.rules, (value) => ({
-					...value,
-					...(value.when === undefined
-						? {}
-						: { when: Condition.toJsonValue(value.when as Ast) }),
-					// The `meta` of a rule is a decoded value. Its JSON form comes
-					// from the `meta` Schema of the domain, as in `schema`.
-					...(value.meta === undefined || meta === undefined
-						? {}
-						: {
-								meta: Schema.encodeUnknownSync(
-									meta as Schema.Codec<unknown, unknown>,
-								)(value.meta),
-							}),
-				})),
-			}
-		case "All":
-		case "Any":
-		case "FirstOf":
-			return { ...node, policies: Arr.map(node.policies, json) }
-		case "Ceiling":
-			return { ...node, cap: json(node.cap), policy: json(node.policy) }
-	}
-}
+export type TargetOf<Res> = Res extends ReadonlyArray<infer X> ? X : Res
 
 /**
- * The class of every policy value. Two policies of one domain with the same
- * tree are equal. As JSON, a policy is its tree.
+ * The actions that a rule may use for its resource argument. A list of
+ * resources may use an action of any of them. One target with a union type
+ * may use only an action of every kind in the union, because its value may be
+ * any one of them. When the argument may be a list or one target, the rule
+ * may use only an action that each of these shapes allows.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 1.0.0
  */
-class PolicyData extends Data.Class<{
-	readonly domain: Domain.Any
-	readonly node: Node
-}> {
-	toJSON(): unknown {
-		return jsonNode(encodeTree(this.node), this.domain.meta)
-	}
-}
+export type ActionForTargets<D, Res> = (
+	Res extends ReadonlyArray<infer X>
+		? (action: ActionFor<D, KindOf<X>>) => void
+		: (action: ActionForTarget<D, Res>) => void
+) extends (action: infer A) => void
+	? A
+	: never
 
-/** The node of a policy, with no types, for the code below. */
-const nodeOf = (policy: Any): Node => policy.node as Node
+/** The actions for one target that is not a list. */
+type ActionForTarget<D, Res> =
+	| "*"
+	| ("*" extends KindOf<Res>
+			? Domain.AnyAction<D>
+			: Domain.CommonAction<D, Extract<KindOf<Res>, string>>)
 
-const fromNode = (domain: Domain.Any, node: Node): any =>
-	new PolicyData({ domain, node })
+/**
+ * The data type of the kinds `K`. For `"*"` it has no fields.
+ *
+ * @stability stable
+ * @category utility types
+ * @since 0.3.0
+ */
+export type DataFor<D, K> = "*" extends K
+	? {}
+	: Domain.DataOf<D, Extract<K, string>>
 
 /**
- * Makes a policy from a list of rules.
+ * The value type of the kinds `K`.
  *
  * @stability stable
- * @category constructors
+ * @category utility types
  * @since 0.3.0
  */
-export const rules: <
-	D extends Domain.Any,
-	Rules extends Rule.Rule<any, any, any, D, never>,
->(
-	domain: D,
-	rules: Iterable<Rules>,
-	options?: Options,
-) => Policy<
-	D,
-	Rule.Error<Rules>,
-	Rule.Services<Rules>,
-	Rule.OpaqueOf<Rules>
-> = (domain, values, options) => {
-	const node = nodes.Rules({
-		algorithm: options?.algorithm ?? "denyOverrides",
-		rules: Array.from(values),
-	})
-	// A value that is not a rule, such as a copy of a rule made with a spread,
-	// may keep the type fields of another rule, and it does not work in a
-	// generator. It is a mistake in the code, so it is a defect.
-	if (!Arr.every(node.rules, Rule.isRule)) {
-		throw new globalThis.Error("A value in the list is not a rule")
-	}
-	// A rule from a builder of another domain is a mistake in the code, so it
-	// is a defect. Two domains may have the same types, so the types do not
-	// find it.
-	if (
-		Arr.some(node.rules, (value) => {
-			const origin = Rule.domainOf(value)
-			return origin !== undefined && origin !== domain
-		})
-	) {
-		throw new globalThis.Error(
-			"A rule comes from the builder of another domain",
-		)
-	}
-	// A rule from `Rule.make` keeps no domain, so its names are checked here.
-	const issues = validate(domain, encodeNode(node))
-	if (issues.length > 0) {
-		throw new globalThis.Error(
-			`A rule does not fit the domain: ${issues.map((issue) => issue.issue).join("; ")}`,
-		)
-	}
-	return fromNode(domain, node)
+export type ValueFor<D, K> = "*" extends K
+	? Domain.AnyValue<D>
+	: Domain.ValueOf<D, Extract<K, string>>
+
+/**
+ * A field name or a field pattern of the kinds `K`.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export type FieldFor<D, K> =
+	Condition.FieldName<DataFor<D, K>> | `${string}*${string}`
+
+/**
+ * A condition that a rule for the kinds `K` may have. Its predicates may read
+ * only the values of these kinds and the principal of the domain.
+ *
+ * @stability stable
+ * @category models
+ * @since 1.0.0
+ */
+export type ConditionFor<D, K> = Condition.Condition<
+	Condition.Reads<ValueFor<D, K>, Domain.Principal<D>>,
+	any
+>
+
+/**
+ * The options of a rule.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface RuleOptions<D, K, C extends Condition.Any> {
+	/** The condition. It gets a builder with the types of the resource. */
+	readonly when?: (
+		builder: Condition.Builder<
+			DataFor<D, K>,
+			ValueFor<D, K>,
+			Domain.Principal<D>
+		>,
+	) => C
+	readonly fields?: ReadonlyArray<FieldFor<D, K>>
+	readonly reason?: string
+	readonly id?: string
+	readonly meta?: Domain.Meta<D>
 }
 
+type SingleOrArray<A> = A | ReadonlyArray<A>
+
 /**
- * Makes a policy from a generator function that gives rules. It is pure and it
- * gives its result at once.
+ * Makes rules with the types of a domain.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Builder<D> {
+	readonly allow: <
+		const Res extends SingleOrArray<RuleTarget<D>>,
+		const A extends ActionForTargets<D, Res>,
+		const C extends ConditionFor<D, KindOf<TargetOf<Res>>> =
+			Condition.Condition,
+	>(
+		action: SingleOrArray<A>,
+		resource: Res,
+		options?: RuleOptions<D, KindOf<TargetOf<Res>>, C>,
+	) => Rule<D, Condition.ReadsOf<C>, Condition.OpaqueOf<C>>
+	readonly deny: <
+		const Res extends SingleOrArray<RuleTarget<D>>,
+		const A extends ActionForTargets<D, Res>,
+		const C extends ConditionFor<D, KindOf<TargetOf<Res>>> =
+			Condition.Condition,
+	>(
+		action: SingleOrArray<A>,
+		resource: Res,
+		options?: RuleOptions<D, KindOf<TargetOf<Res>>, C>,
+	) => Rule<D, Condition.ReadsOf<C>, Condition.OpaqueOf<C>>
+}
+
+/**
+ * Makes rules with the types of a domain. `Policy.define` gives one to its
+ * generator. Use this one to make rules outside of a generator.
  *
  * @example
  * ```ts
- * const policy = Policy.define(App)(function* (_) {
- *   yield* _.allow("read", Document)
- *   yield* _.allow(["update", "delete"], Document, {
- *     when: ($) => $.eq("ownerId", $.principal("id")),
- *   })
+ * const _ = Policy.builder(App)
+ * const rule = _.allow("read", Document, {
+ *   when: ($) => $.eq("ownerId", $.principal("id")),
  * })
  * ```
  *
  * @stability stable
  * @category constructors
- * @since 0.3.0
+ * @since 2.0.0
  */
-export const define =
-	<D extends Domain.Any>(domain: D, options?: Options) =>
-	<Rules extends Rule.Rule<any, any, any, D, never>, A>(
-		body: (builder: Rule.Builder<D>) => Generator<Rules, A, unknown>,
-	): Policy<
-		D,
-		Rule.Error<Rules>,
-		Rule.Services<Rules>,
-		Rule.OpaqueOf<Rules>
-	> => {
-		const iterator = body(Rule.builder(domain))
-		// Each rule goes back into the generator, as `yield*` gives it.
-		const collected = Arr.unfold(iterator.next(), (state) =>
-			state.done === true
-				? Option.none()
-				: Option.some([state.value, iterator.next(state.value)] as const),
-		)
-		return rules(domain, collected, options)
-	}
+export const builder = <D extends Domain.Any>(domain: D): Builder<D> =>
+	RuleData.builder(domain) as never
 
 /**
- * A policy with no rules. It is not applicable to any request.
+ * Makes a rule from its data, with no types. It does not check the data
+ * against a domain: a policy does that when the rule goes into it. Use
+ * {@link builder} for rules with types, or {@link schema} for rules from JSON.
+ *
+ * The condition may not have a predicate. A policy checks the fields of a
+ * condition against the resources of its rule, but it can not check what
+ * the code of a predicate reads. A rule from the builder keeps that in its
+ * types; this one could give a predicate of one kind to another kind.
  *
  * @stability stable
  * @category constructors
- * @since 0.3.0
+ * @since 2.0.0
  */
-export const empty = <D extends Domain.Any>(domain: D): Policy<D> =>
-	rules(domain, [])
-
-type Combined<D extends Domain.Any, Ps extends ReadonlyArray<Any>> = Policy<
-	D,
-	Error<Ps[number]>,
-	Services<Ps[number]>,
-	OpaqueOf<Ps[number]>
->
+export const rule: <I = unknown>(
+	data: RuleShape<I, never>,
+	// The types come from the data only, not from where the rule goes.
+) => Rule<any, NoInfer<I>> = RuleData.makePlain as never
 
-const sameDomain = (policies: ReadonlyArray<Any>): Domain.Any => {
-	// A copy of a policy made with a spread may keep the type fields of another
-	// policy. Only a policy value goes into a tree.
-	if (!Arr.every(policies, isPolicy)) {
-		throw new globalThis.Error("A value in the list is not a policy")
-	}
-	const domain = policies[0]!.domain
-	if (!Arr.every(policies, (policy) => policy.domain === domain)) {
-		throw new globalThis.Error(
-			"Policies from two domains can not be put together",
-		)
-	}
-	return domain
+/**
+ * The options of a list of rules.
+ *
+ * @stability stable
+ * @category models
+ * @since 0.3.0
+ */
+export interface Options {
+	/** The default is `denyOverrides`. */
+	readonly algorithm?: Algorithm
 }
 
 /**
- * The most levels in a policy tree. A walk over a tree calls itself for each
- * level, so a much deeper tree could fill the stack and stop a check.
+ * The error when a rule does not fit its domain: it names a kind, an action,
+ * a field or a field of the principal that the domain does not have, or it
+ * tests a field with a value that the field can not hold. It has one issue
+ * for each problem, with its path, and a suggestion when a name has a mistake.
+ *
+ * @stability stable
+ * @category errors
+ * @since 2.0.0
  */
-const maxDepth = 256
-
-/** The number of levels of a policy tree. */
-const heightOf = (node: Node, memo: Map<Node, number> = new Map()): number =>
-	remember(memo, node, () => {
-		const height = (child: Node) => heightOf(child, memo)
-		switch (node._tag) {
-			case "Rules":
-				return 1
-			case "All":
-			case "Any":
-			case "FirstOf":
-				return (
-					1 +
-					Arr.reduce(node.policies, 0, (top, child) =>
-						Math.max(top, height(child)),
-					)
-				)
-			case "Ceiling":
-				return 1 + Math.max(height(node.cap), height(node.policy))
-		}
-	})
+export const PolicyError: typeof Internal.PolicyError = Internal.PolicyError
 
 /**
- * Makes a policy from a new node. Its children come from policies, so each
- * has at most `maxDepth` levels, and the walk of `heightOf` is safe.
+ * @stability stable
+ * @category errors
+ * @since 2.0.0
  */
-const fromCombined = (domain: Domain.Any, node: Node): any => {
-	if (heightOf(node) > maxDepth) {
-		throw new globalThis.Error(
-			`A policy tree may have at most ${maxDepth} levels`,
-		)
-	}
-	return fromNode(domain, node)
-}
+export type PolicyError = Internal.PolicyError
+
+/** The mark of a union of rules: `Condition.Opaque` when one has a predicate. */
+type RulesOpaque<Rules> = Rules extends { readonly "~Opaque": () => infer X }
+	? X
+	: never
+
+/**
+ * Makes a policy from a generator function that gives rules. It is pure and it
+ * gives its result at once.
+ *
+ * @example
+ * ```ts
+ * const policy = Policy.define(App)(function* (_) {
+ *   yield* _.allow("read", Document)
+ *   yield* _.allow(["update", "delete"], Document, {
+ *     when: ($) => $.eq("ownerId", $.principal("id")),
+ *   })
+ * })
+ * ```
+ *
+ * @stability stable
+ * @category constructors
+ * @since 0.3.0
+ */
+export const define: <D extends Domain.Any>(
+	domain: D,
+	options?: Options,
+) => <Rules extends Rule<D, never, any>, A>(
+	body: (builder: Builder<D>) => Generator<Rules, A, unknown>,
+) => Policy<D, RulesOpaque<Rules>> = Internal.define as never
 
-const combine =
-	(tag: "All" | "Any" | "FirstOf") =>
-	(policies: ReadonlyArray<Any>): any =>
-		fromCombined(
-			sameDomain(policies),
-			nodes[tag]({ policies: policies.map(nodeOf) }),
-		)
+type Combined<D extends Domain.Any, Ps extends ReadonlyArray<Any>> = Policy<
+	D,
+	OpaqueOf<Ps[number]>
+>
 
 /**
  * Every policy must allow, and one deny is enough to deny. With some policies
@@ -735,11 +621,9 @@ const combine =
  * @category combinators
  * @since 0.3.0
  */
-export const all: <
-	const Ps extends readonly [Policy<any, any, any, any>, ...Array<Any>],
->(
+export const all: <const Ps extends readonly [Any, ...Array<Any>]>(
 	policies: Ps,
-) => Combined<DomainOf<Ps[0]>, Ps> = combine("All")
+) => Combined<DomainOf<Ps[0]>, Ps> = Internal.combine("All")
 
 /**
  * One allow is enough. Without an allow, one deny gives a deny.
@@ -748,11 +632,9 @@ export const all: <
  * @category combinators
  * @since 0.3.0
  */
-export const any: <
-	const Ps extends readonly [Policy<any, any, any, any>, ...Array<Any>],
->(
+export const any: <const Ps extends readonly [Any, ...Array<Any>]>(
 	policies: Ps,
-) => Combined<DomainOf<Ps[0]>, Ps> = combine("Any")
+) => Combined<DomainOf<Ps[0]>, Ps> = Internal.combine("Any")
 
 /**
  * The first policy that allows or denies gives the answer.
@@ -761,11 +643,9 @@ export const any: <
  * @category combinators
  * @since 0.3.0
  */
-export const firstOf: <
-	const Ps extends readonly [Policy<any, any, any, any>, ...Array<Any>],
->(
+export const firstOf: <const Ps extends readonly [Any, ...Array<Any>]>(
 	policies: Ps,
-) => Combined<DomainOf<Ps[0]>, Ps> = combine("FirstOf")
+) => Combined<DomainOf<Ps[0]>, Ps> = Internal.combine("FirstOf")
 
 /**
  * Puts a limit on a policy. A deny from `cap` always wins. An allow from `cap`
@@ -776,92 +656,14 @@ export const firstOf: <
  * @since 0.3.0
  */
 export const ceiling: {
-	<D extends Domain.Any, E2, R2, O2>(
-		cap: Policy<D, E2, R2, O2>,
-	): <E, R, O>(policy: Policy<D, E, R, O>) => Policy<D, E | E2, R | R2, O | O2>
-	<D extends Domain.Any, E, R, O, E2, R2, O2>(
-		policy: Policy<D, E, R, O>,
-		cap: Policy<D, E2, R2, O2>,
-	): Policy<D, E | E2, R | R2, O | O2>
-} = dual(2, (policy: Any, cap: Any): any =>
-	fromCombined(
-		sameDomain([policy, cap]),
-		nodes.Ceiling({ cap: nodeOf(cap), policy: nodeOf(policy) }),
-	),
-)
-
-/**
- * Gives the answer for a key from a memo, or works it out and keeps it. One
- * node may be a child of many nodes, so each walk over a tree keeps its work
- * on a node in a memo that the walk makes for itself. No memo lives longer
- * than one call.
- *
- * The memo is a native `Map`, because it must find a node by the node itself.
- * An Effect `HashMap` finds a key by `Equal`, and the nodes are Effect data,
- * so it would hash the whole structure of a node, and a shared child again for
- * each path to it.
- */
-const remember = <K, A>(memo: Map<K, A>, key: K, work: () => A): A => {
-	// A result may be `undefined`, as the result of a fold may be, so the test
-	// asks for the key.
-	if (memo.has(key)) {
-		return memo.get(key) as A
-	}
-	const result = work()
-	memo.set(key, result)
-	return result
-}
-
-/** The memos of one walk over a policy tree. */
-interface TreeMemo {
-	readonly done: Map<Node, Node>
-	readonly predicates: Map<Node, boolean>
-}
-
-const provideNode = (
-	node: Node,
-	context: Context.Context<never>,
-	memo: TreeMemo = { done: new Map(), predicates: new Map() },
-): Node =>
-	// A node with no predicate needs no services, and it stays the same node.
-	// One node may be a child of many nodes, and it gives one new node.
-	!nodeHasPredicate(node, memo.predicates)
-		? node
-		: remember(memo.done, node, () => provideOnce(node, context, memo))
-
-const provideOnce = (
-	node: Node,
-	context: Context.Context<never>,
-	memo: TreeMemo,
-): Node => {
-	switch (node._tag) {
-		case "Rules":
-			return nodes.Rules({
-				algorithm: node.algorithm,
-				rules: node.rules.map((value) =>
-					value.when === undefined || !Condition.hasPredicate(value.when)
-						? value
-						: Rule.make({
-								...value,
-								when: Condition.provideContext(value.when, context as never),
-							}),
-				),
-			})
-		case "All":
-		case "Any":
-		case "FirstOf":
-			return nodes[node._tag]({
-				policies: Arr.map(node.policies, (child) =>
-					provideNode(child, context, memo),
-				),
-			})
-		case "Ceiling":
-			return nodes.Ceiling({
-				cap: provideNode(node.cap, context, memo),
-				policy: provideNode(node.policy, context, memo),
-			})
-	}
-}
+	<D extends Domain.Any, X2>(
+		cap: Policy<D, X2>,
+	): <X>(policy: Policy<D, X>) => Policy<D, X | X2>
+	<D extends Domain.Any, X, X2>(
+		policy: Policy<D, X>,
+		cap: Policy<D, X2>,
+	): Policy<D, X | X2>
+} = Internal.ceiling as never
 
 /**
  * Gives the services in `context` to every predicate of a policy, so the
@@ -874,318 +676,18 @@ const provideOnce = (
 export const provideContext: {
 	<R>(
 		context: Context.Context<R>,
-	): <D extends Domain.Any, E, O>(
-		policy: Policy<D, E, R, O>,
-	) => Policy<D, E, never, O>
-	<D extends Domain.Any, E, R, O>(
-		policy: Policy<D, E, R, O>,
-		context: Context.Context<R>,
-	): Policy<D, E, never, O>
-} = dual(2, (policy: Any, context: Context.Context<never>): any =>
-	fromNode(policy.domain, provideNode(nodeOf(policy), context)),
-)
+	): <D extends Domain.Any, X>(
+		policy: Policy<D, X> &
+			([Condition.ServicesOf<X>] extends [R] ? unknown : never),
+	) => Policy<D, Condition.Provided<X>>
+	<D extends Domain.Any, X>(
+		policy: Policy<D, X>,
+		context: Context.Context<Condition.ServicesOf<X>>,
+	): Policy<D, Condition.Provided<X>>
+} = Internal.provideContext as never
 
 // Decisions
 
-interface DecideContext {
-	readonly action: string
-	readonly kind: string
-	readonly field: string | undefined
-	readonly input: Condition.Input
-	/** The resource of the kind, for the fields that a rule may grant. */
-	readonly descriptor: Resource.Descriptor
-	/** The rules that were tested, for {@link explain}. */
-	readonly trace: Ref.Ref<Chunk.Chunk<Step>> | undefined
-	readonly predicates: Map<Node, boolean>
-	/**
-	 * The decisions of nodes with no predicates. One node may be a child of
-	 * many nodes, and its decision is the same each time, so it is made only
-	 * one time. A tree with shared nodes may have very many paths.
-	 */
-	readonly decisions: Map<Node, Decision.Decision>
-}
-
-const ruleApplies = (
-	value: Rule.Any,
-	context: DecideContext,
-	path: ReadonlyArray<number>,
-): Effect.Effect<boolean, unknown, unknown> => {
-	if (!Rule.matchesTarget(value, context)) {
-		return Effect.succeed(false)
-	}
-	const test =
-		value.when === undefined
-			? Effect.succeed(true)
-			: // A rule of a node keeps no type of what it reads. The decision gives
-				// it the value and the principal of the request.
-				Condition.evaluate(value.when as Condition.Any, context.input)
-	const trace = context.trace
-	return trace === undefined
-		? test
-		: Effect.tap(test, (applies) =>
-				// A chunk adds a step with no copy of the steps before.
-				Ref.update(trace, Chunk.append({ path, rule: value, applies })),
-			)
-}
-
-const fromRule = (value: Rule.Any): Decision.Decision =>
-	value._tag === "Allow"
-		? Decision.Allow({ rule: value })
-		: value.reason === undefined
-			? Decision.Deny({ rule: value })
-			: Decision.Deny({ rule: value, reason: value.reason })
-
-/** Gives the first rule that applies, in order. */
-const firstApplying = (
-	candidates: ReadonlyArray<readonly [Rule.Any, number]>,
-	context: DecideContext,
-	path: ReadonlyArray<number>,
-): Effect.Effect<Option.Option<Rule.Any>, unknown, unknown> =>
-	Effect.map(
-		Effect.findFirst(candidates, ([value, index]) =>
-			ruleApplies(value, context, [...path, index]),
-		),
-		Option.map(([value]) => value),
-	)
-
-/** Gives the first result that is found, and tests `next` only when none is. */
-const orElse = <A, E, R>(
-	first: Effect.Effect<Option.Option<A>, E, R>,
-	next: () => Effect.Effect<Option.Option<A>, E, R>,
-): Effect.Effect<Option.Option<A>, E, R> =>
-	Effect.filterOrElse(first, Option.isSome, next)
-
-const decideRules = (
-	node: RulesNode,
-	context: DecideContext,
-	path: ReadonlyArray<number>,
-): Effect.Effect<Decision.Decision, unknown, unknown> => {
-	const indexed = Arr.map(node.rules, (value, index) => [value, index] as const)
-	const denies = Arr.filter(indexed, ([value]) => value._tag === "Deny")
-	const allows = Arr.filter(indexed, ([value]) => value._tag === "Allow")
-	const first = (candidates: ReadonlyArray<readonly [Rule.Any, number]>) =>
-		firstApplying(candidates, context, path)
-	const found = (() => {
-		switch (node.algorithm) {
-			case "denyOverrides":
-				return orElse(first(denies), () => first(allows))
-			case "permitOverrides":
-				return orElse(first(allows), () => first(denies))
-			case "firstApplicable":
-				return first(indexed)
-			case "lastApplicable":
-				return first(Arr.reverse(indexed))
-		}
-	})()
-	return Effect.map(
-		found,
-		Option.match({ onNone: () => Decision.NotApplicable, onSome: fromRule }),
-	)
-}
-
-const decideNode = (
-	node: Node,
-	context: DecideContext,
-	path: ReadonlyArray<number>,
-): Effect.Effect<Decision.Decision, unknown, unknown> => {
-	// A predicate that the request may use must run each time. A predicate of
-	// a rule for another action, kind or field never runs, so the decision may
-	// be kept. A trace keeps the steps of a node only the first time, so a
-	// shared tree does not give a step for each path to a node.
-	if (usesPredicate(node, context)) {
-		return decideOnce(node, context, path)
-	}
-	const cached = context.decisions.get(node)
-	return cached !== undefined
-		? Effect.succeed(cached)
-		: Effect.tap(decideOnce(node, context, path), (decision) =>
-				Effect.sync(() => context.decisions.set(node, decision)),
-			)
-}
-
-/** The next step of a walk over children: stop with a decision, or go on. */
-type WalkStep<S> =
-	| { readonly _tag: "Stop"; readonly decision: Decision.Decision }
-	| { readonly _tag: "Next"; readonly state: S }
-
-/**
- * Decides the children in order. After each child, `step` stops with a
- * decision, or gives the state for the next child. After the last child,
- * `end` gives the decision. A child after a stop is not decided, so its
- * predicates do not run.
- */
-const walkChildren = <S>(
-	children: ReadonlyArray<Node>,
-	context: DecideContext,
-	path: ReadonlyArray<number>,
-	start: S,
-	step: (state: S, decision: Decision.Decision) => WalkStep<S>,
-	end: (state: S) => Decision.Decision,
-): Effect.Effect<Decision.Decision, unknown, unknown> => {
-	const go = (
-		index: number,
-		state: S,
-	): Effect.Effect<Decision.Decision, unknown, unknown> =>
-		index === children.length
-			? Effect.succeed(end(state))
-			: Effect.flatMap(
-					decideNode(children[index]!, context, [...path, index]),
-					(decision) => {
-						const next = step(state, decision)
-						return next._tag === "Stop"
-							? Effect.succeed(next.decision)
-							: go(index + 1, next.state)
-					},
-				)
-	return go(0, start)
-}
-
-const stop = (decision: Decision.Decision): WalkStep<never> => ({
-	_tag: "Stop",
-	decision,
-})
-
-const next = <S>(state: S): WalkStep<S> => ({ _tag: "Next", state })
-
-const decideOnce = (
-	node: Node,
-	context: DecideContext,
-	path: ReadonlyArray<number>,
-): Effect.Effect<Decision.Decision, unknown, unknown> => {
-	switch (node._tag) {
-		case "Rules":
-			return decideRules(node, context, path)
-		case "All":
-			// One deny is enough to deny. Every child must allow.
-			return walkChildren(
-				node.policies,
-				context,
-				path,
-				{
-					firstAllow: Option.none<Decision.Decision>(),
-					allAllow: node.policies.length > 0,
-				},
-				(state, decision) =>
-					decision._tag === "Deny"
-						? stop(decision)
-						: next({
-								firstAllow: Option.orElse(state.firstAllow, () =>
-									decision._tag === "Allow"
-										? Option.some(decision)
-										: Option.none(),
-								),
-								allAllow: state.allAllow && decision._tag === "Allow",
-							}),
-				(state) =>
-					state.allAllow
-						? Option.getOrElse(state.firstAllow, () => Decision.NotApplicable)
-						: Decision.NotApplicable,
-			)
-		case "Any":
-			// One allow is enough. Without one, the first deny denies.
-			return walkChildren(
-				node.policies,
-				context,
-				path,
-				Option.none<Decision.Decision>(),
-				(firstDeny, decision) =>
-					decision._tag === "Allow"
-						? stop(decision)
-						: next(
-								Option.orElse(firstDeny, () =>
-									decision._tag === "Deny"
-										? Option.some(decision)
-										: Option.none(),
-								),
-							),
-				(firstDeny) =>
-					Option.getOrElse(firstDeny, () => Decision.NotApplicable),
-			)
-		case "FirstOf":
-			return walkChildren(
-				node.policies,
-				context,
-				path,
-				undefined,
-				(_, decision) =>
-					decision._tag === "NotApplicable" ? next(undefined) : stop(decision),
-				() => Decision.NotApplicable,
-			)
-		case "Ceiling":
-			// A deny of the cap wins. Else the policy decides.
-			return Effect.filterOrElse(
-				decideNode(node.cap, context, [...path, 0]),
-				(capped) => capped._tag === "Deny",
-				() => decideNode(node.policy, context, [...path, 1]),
-			)
-	}
-}
-
-/**
- * Tests if a request fits its kind: the action is an action of the kind, and
- * the field, if there is one, is a field of the kind. The types check this,
- * but a value with a union type, or a value from outside, may get past them.
- * A rule for every action (`"*"`) must not cover an action that the kind does
- * not have, so such a request is not applicable.
- *
- * @stability stable
- * @category predicates
- * @since 1.0.0
- */
-export const fitsKind = (
-	descriptor: Resource.Descriptor,
-	request: { readonly action: string; readonly field?: string | undefined },
-): boolean =>
-	descriptor.actions.includes(request.action) &&
-	(request.field === undefined ||
-		descriptor.fieldPaths.includes(request.field) ||
-		Resource.hasPath(descriptor.schema, request.field) ||
-		Resource.hasGetter(descriptor.schema, request.field))
-
-const makeContext = (
-	domain: Domain.Any,
-	request: AnyRequest,
-	trace: Ref.Ref<Chunk.Chunk<Step>> | undefined,
-): DecideContext | undefined => {
-	const kind = Resource.kindOf(request.resource)
-	const descriptor =
-		kind === undefined ? undefined : Domain.descriptorOf(domain, kind)
-	if (
-		kind === undefined ||
-		descriptor === undefined ||
-		!fitsKind(descriptor, request)
-	) {
-		return undefined
-	}
-	return {
-		action: request.action,
-		kind,
-		field: request.field,
-		input: {
-			value: request.resource,
-			principal: request.principal,
-			path: descriptor.path,
-		},
-		descriptor,
-		trace,
-		predicates: new Map(),
-		decisions: new Map(),
-	}
-}
-
-const decideAny = (
-	policy: Any,
-	request: AnyRequest,
-): Effect.Effect<Decision.Decision, unknown, unknown> =>
-	// Each run of the Effect needs its own store of decisions, because the
-	// resource value may change between two runs.
-	Effect.suspend(() => {
-		const context = makeContext(policy.domain, request, undefined)
-		return context === undefined
-			? Effect.succeed(Decision.NotApplicable)
-			: decideNode(nodeOf(policy), context, [])
-	})
-
 /**
  * Gives the decision of a policy for a request.
  *
@@ -1193,17 +695,14 @@ const decideAny = (
  * @category evaluation
  * @since 0.3.0
  */
-export const decide: {
-	<D extends Domain.Any = never>(
-		request: Request<D>,
-	): <E, R, O>(
-		policy: Policy<D, E, R, O>,
-	) => Effect.Effect<Decision.Decision, E, R>
-	<D extends Domain.Any, E, R, O>(
-		policy: Policy<D, E, R, O>,
-		request: Request<NoInfer<D>>,
-	): Effect.Effect<Decision.Decision, E, R>
-} = dual(2, decideAny) as never
+export const decide: <D extends Domain.Any, X>(
+	policy: Policy<D, X>,
+	request: Request<NoInfer<D>>,
+) => Effect.Effect<
+	Decision.Decision,
+	Condition.ErrorOf<X>,
+	Condition.ServicesOf<X>
+> = Decide.decideAny as never
 
 /**
  * Gives the decision of a policy with no predicates, at once.
@@ -1212,106 +711,31 @@ export const decide: {
  * @category evaluation
  * @since 0.3.0
  */
-export const decideSync: {
-	<D extends Domain.Any = never>(
-		request: Request<D>,
-	): (policy: Policy<D>) => Decision.Decision
-	<D extends Domain.Any>(
-		policy: Policy<D>,
-		request: Request<NoInfer<D>>,
-	): Decision.Decision
-} = dual(2, (policy: Any, request: AnyRequest): Decision.Decision =>
-	Effect.runSync(
-		// The public type of `decideSync` takes only policies with no
-		// predicates, so this Effect has no error and needs no services.
-		// @effect-diagnostics-next-line unsafeEffectTypeAssertion:off
-		decideAny(policy, request) as Effect.Effect<Decision.Decision>,
-	),
-)
+export const decideSync: <D extends Domain.Any>(
+	policy: Policy<D>,
+	request: Request<NoInfer<D>>,
+) => Decision.Decision = Decide.decideSync
 
 /**
  * Gives the decision of a policy and the rules that were tested to make it.
  *
- * One node may be a child of many nodes. A node with no predicate that the
- * request may use gives the same decision each time, so its rules are tested,
- * and are in the steps, only the first time. So a small tree with many shared
- * nodes gives a short list of steps.
+ * One node may be a child of many nodes. Its rules are tested, and are in the
+ * steps, each time that the decision comes to it.
  *
  * @stability stable
  * @category evaluation
  * @since 0.3.0
  */
-export const explain: {
-	<D extends Domain.Any = never>(
-		request: Request<D>,
-	): <E, R, O>(policy: Policy<D, E, R, O>) => Effect.Effect<Explanation, E, R>
-	<D extends Domain.Any, E, R, O>(
-		policy: Policy<D, E, R, O>,
-		request: Request<NoInfer<D>>,
-	): Effect.Effect<Explanation, E, R>
-} = dual(
-	2,
-	(
-		policy: Any,
-		request: AnyRequest,
-	): Effect.Effect<Explanation, unknown, unknown> =>
-		// Each run of the Effect needs its own trace, so the trace is made inside
-		// the Effect.
-		Effect.gen(function* () {
-			const trace = yield* Ref.make(Chunk.empty<Step>())
-			const context = makeContext(policy.domain, request, trace)
-			if (context === undefined) {
-				return { decision: Decision.NotApplicable, steps: [] }
-			}
-			const decision = yield* decideNode(nodeOf(policy), context, [])
-			return { decision, steps: Chunk.toReadonlyArray(yield* Ref.get(trace)) }
-		}),
-) as never
-
-/**
- * Tests if a deny rule of the request names a part inside `field`.
- */
-const deniesInside = (
-	node: Node,
-	target: { readonly action: string; readonly kind: string },
-	field: string,
-	// A native set: it must find a node by the node itself. See `remember`.
-	seen: Set<Node> = new Set(),
-): boolean => {
-	// One node may be a child of many nodes. It is tested one time.
-	if (seen.has(node)) {
-		return false
-	}
-	seen.add(node)
-	switch (node._tag) {
-		case "Rules":
-			return node.rules.some(
-				(value) =>
-					value._tag === "Deny" &&
-					value.fields !== undefined &&
-					value.fields.some((pattern) => Rule.matchesInside(pattern, field)) &&
-					(value.actions.includes("*") ||
-						value.actions.includes(target.action)) &&
-					(value.resources.includes("*") ||
-						value.resources.includes(target.kind)),
-			)
-		case "All":
-		case "Any":
-		case "FirstOf":
-			return node.policies.some((child) =>
-				deniesInside(child, target, field, seen),
-			)
-		case "Ceiling":
-			return (
-				deniesInside(node.cap, target, field, seen) ||
-				deniesInside(node.policy, target, field, seen)
-			)
-	}
-}
+export const explain: <D extends Domain.Any, X>(
+	policy: Policy<D, X>,
+	request: Request<NoInfer<D>>,
+) => Effect.Effect<Explanation, Condition.ErrorOf<X>, Condition.ServicesOf<X>> =
+	Decide.explain as never
 
 /**
  * Gives the fields of a resource value that the policy lets a request use. It
- * tests each field of the resource Schema, with dots for nested fields.
+ * tests each field that a list of fields shows: each scalar, record or array
+ * of the resource Schema, with dots for nested fields.
  *
  * A field that holds more than one value, such as a record, is left out when a
  * deny rule names a part of it. The list can not name that part, and the whole
@@ -1321,91 +745,17 @@ const deniesInside = (
  * @category evaluation
  * @since 0.3.0
  */
-export const permittedFields: {
-	<D extends Domain.Any = never>(
-		request: FieldlessRequest<D>,
-	): <E, R, O>(
-		policy: Policy<D, E, R, O>,
-	) => Effect.Effect<ReadonlyArray<string>, E, R>
-	<D extends Domain.Any, E, R, O>(
-		policy: Policy<D, E, R, O>,
-		request: FieldlessRequest<NoInfer<D>>,
-	): Effect.Effect<ReadonlyArray<string>, E, R>
-} = dual(
-	2,
-	(
-		policy: Any,
-		request: Omit<AnyRequest, "field">,
-	): Effect.Effect<ReadonlyArray<string>, unknown, unknown> => {
-		const kind = Resource.kindOf(request.resource)
-		const descriptor: Resource.Descriptor | undefined =
-			kind === undefined ? undefined : Domain.descriptorOf(policy.domain, kind)
-		if (descriptor === undefined) {
-			return Effect.succeed([])
-		}
-		return Effect.filter(descriptor.fieldPaths, (field) =>
-			Effect.map(
-				decideAny(policy, { ...request, field }),
-				(result) =>
-					result._tag === "Allow" &&
-					!(
-						descriptor.openPaths.includes(field) &&
-						deniesInside(
-							nodeOf(policy),
-							{ ...request, kind: descriptor.kind },
-							field,
-						)
-					),
-			),
-		)
-	},
-) as never
+export const permittedFields: <D extends Domain.Any, X>(
+	policy: Policy<D, X>,
+	request: FieldlessRequest<NoInfer<D>>,
+) => Effect.Effect<
+	ReadonlyArray<string>,
+	Condition.ErrorOf<X>,
+	Condition.ServicesOf<X>
+> = Decide.permittedFields as never
 
 // Residual conditions
 
-type Ast = Condition.Ast
-
-/**
- * The two residual conditions of a request. See {@link residuals}.
- *
- * @stability stable
- * @category models
- * @since 1.0.0
- */
-export interface Residuals<E = never, R = never, O = never, I = unknown> {
-	/** The condition on resource values for which the policy allows. */
-	readonly allow: Condition.Condition<E, R, O, I>
-	/** The condition on resource values for which the policy denies. */
-	readonly deny: Condition.Condition<E, R, O, I>
-}
-
-/**
- * A request about a kind of resource, with no types.
- *
- * @stability stable
- * @category models
- * @since 1.0.0
- */
-export interface AnyKindRequest {
-	readonly principal: object
-	readonly action: string
-	readonly kind: string
-	readonly field?: string | undefined
-	/**
-	 * A scope needs the types of the domain for its builder. With the request
-	 * first, the domain is not known yet, so give the policy first.
-	 */
-	readonly within?: never
-}
-
-/**
- * `unknown` when the request `Req` is a request of the type `T`, and `never`
- * when it is not. With the request first and the policy later, the request is
- * checked when the policy, and so the domain, is known. For a union, each
- * member must be such a request.
- */
-type Fits<Req, T> = [Req] extends [T] ? unknown : never
-
 /**
  * What a residual condition reads: a value of the kind `K`. The principal is
  * already in it. A residual is for one kind, so when `K` is a union of kinds,
@@ -1425,504 +775,6 @@ export type ResidualReads<D, K> = Condition.Reads<
 	unknown
 >
 
-const always: Ast = Condition.always
-const never: Ast = Condition.never
-
-/**
- * The most nodes that a residual condition may have. A policy tree may use a
- * condition of a child two times, in its allow condition and in its deny
- * condition, so a small policy may give a very large condition. Past this
- * size, `residual` throws an error.
- */
-const maxResidualSize = 10_000
-
-/**
- * The most levels that a residual condition may have. The rules of an ordered
- * algorithm, such as `firstApplicable`, give one level for each run of rules
- * with one tag. A walk over a condition calls itself for each level, so a much
- * deeper condition could fill the stack. Past this depth, `residual` throws an
- * error.
- */
-const maxResidualDepth = 500
-
-/**
- * A residual condition is too large. See {@link maxResidualSize} and
- * {@link maxResidualDepth}.
- */
-class TooLarge {}
-
-/**
- * Makes conditions for one residual, with no types. Each step simplifies the
- * condition, and it stops the work when the condition is too large. The
- * steps keep their work for the parts they have seen, for this residual only.
- */
-interface Build {
-	// A list goes in as an array, not as arguments: a call may take only so
-	// many arguments, and a policy may have more rules.
-	readonly and: (values: ReadonlyArray<Ast>) => Ast
-	readonly or: (values: ReadonlyArray<Ast>) => Ast
-	readonly not: (value: Ast) => Ast
-}
-
-const makeBuild = (): Build => {
-	const simplify = Condition.simplifier()
-	const sizes = new Map<Ast, number>()
-	/** Gives the number of nodes in a condition, as JSON would have them. */
-	const sizeOf = (ast: Ast): number =>
-		remember(sizes, ast, () => {
-			switch (ast._tag) {
-				case "And":
-				case "Or":
-					return Arr.reduce(
-						ast.conditions,
-						1,
-						(size, child) => size + sizeOf(child),
-					)
-				case "Not":
-					return 1 + sizeOf(ast.condition)
-				default:
-					return 1
-			}
-		})
-	const depths = new Map<Ast, number>()
-	/**
-	 * Gives the number of levels in a condition. Each child went through
-	 * `limit`, so this walk is not deeper than `maxResidualDepth`.
-	 */
-	const depthOf = (ast: Ast): number =>
-		remember(depths, ast, () => {
-			switch (ast._tag) {
-				case "And":
-				case "Or":
-					return (
-						1 +
-						Arr.reduce(ast.conditions, 0, (top, child) =>
-							Math.max(top, depthOf(child)),
-						)
-					)
-				case "Not":
-					return 1 + depthOf(ast.condition)
-				default:
-					return 1
-			}
-		})
-	const limit = (ast: Ast): Ast => {
-		if (sizeOf(ast) > maxResidualSize || depthOf(ast) > maxResidualDepth) {
-			throw new TooLarge()
-		}
-		return ast
-	}
-	// These steps work on nodes with no types, so they leave out the type
-	// field of a condition.
-	return {
-		and: (values) =>
-			limit(simplify(Condition.andAll(values as ReadonlyArray<never>))),
-		or: (values) =>
-			limit(simplify(Condition.orAll(values as ReadonlyArray<never>))),
-		not: (value) => limit(simplify(Condition.not(value as never))),
-	}
-}
-
-/** The two residual conditions of a node, with no types. */
-interface Pair {
-	readonly allow: Ast
-	readonly deny: Ast
-}
-
-interface ResidualContext {
-	readonly action: string
-	readonly kind: string
-	readonly field: string | undefined
-	readonly input: {
-		readonly principal: object
-		readonly path: Condition.Input["path"]
-	}
-	/** The resource of the kind, for the fields that a rule may grant. */
-	readonly descriptor: Resource.Descriptor
-	/**
-	 * The work done on each node. One node may be a child of many nodes, so
-	 * the work on it is done only one time.
-	 */
-	readonly pairs: Map<Node, Pair>
-	readonly predicates: Map<Node, boolean>
-	readonly build: Build
-}
-
-const ruleCondition = (value: Rule.Any, context: ResidualContext): Ast =>
-	!Rule.matchesTarget(value, context)
-		? never
-		: value.when === undefined
-			? always
-			: Condition.partial(value.when as Condition.Any, context.input)
-
-/**
- * Gives the conditions for "the first rule that applies is an allow rule" and
- * "the first rule that applies is a deny rule".
- */
-const firstApplicableResidual = (
-	values: ReadonlyArray<Rule.Any>,
-	context: ResidualContext,
-): Pair => {
-	const { and, not, or } = context.build
-	// The rules go in runs of one tag, from the last run to the first. The
-	// conditions of a run go into one node at once. With one node for each
-	// rule, each step would flatten the whole condition again.
-	const runs = Arr.isReadonlyArrayNonEmpty(values)
-		? Arr.groupWith(values, (a, b) => a._tag === b._tag)
-		: []
-	return Arr.reduceRight(
-		runs,
-		{ allow: never, deny: never },
-		(rest: Pair, run): Pair => {
-			const applies = or(Arr.map(run, (value) => ruleCondition(value, context)))
-			return run[0]._tag === "Allow"
-				? {
-						allow: or([applies, rest.allow]),
-						deny: and([not(applies), rest.deny]),
-					}
-				: {
-						allow: and([not(applies), rest.allow]),
-						deny: or([applies, rest.deny]),
-					}
-		},
-	)
-}
-
-const residualNode = (node: Node, context: ResidualContext): Pair =>
-	remember(context.pairs, node, () => residualOnce(node, context))
-
-const residualOnce = (node: Node, context: ResidualContext): Pair => {
-	const { and, not, or } = context.build
-	switch (node._tag) {
-		case "Rules": {
-			switch (node.algorithm) {
-				case "denyOverrides": {
-					const deny = or(
-						node.rules
-							.filter((value) => value._tag === "Deny")
-							.map((value) => ruleCondition(value, context)),
-					)
-					const allow = and([
-						not(deny),
-						or(
-							node.rules
-								.filter((value) => value._tag === "Allow")
-								.map((value) => ruleCondition(value, context)),
-						),
-					])
-					return { allow, deny }
-				}
-				case "permitOverrides": {
-					const allow = or(
-						node.rules
-							.filter((value) => value._tag === "Allow")
-							.map((value) => ruleCondition(value, context)),
-					)
-					const deny = and([
-						not(allow),
-						or(
-							node.rules
-								.filter((value) => value._tag === "Deny")
-								.map((value) => ruleCondition(value, context)),
-						),
-					])
-					return { allow, deny }
-				}
-				case "firstApplicable":
-					return firstApplicableResidual(node.rules, context)
-				case "lastApplicable":
-					return firstApplicableResidual(node.rules.slice().reverse(), context)
-			}
-		}
-		// falls through: every algorithm returns above
-		case "All": {
-			if (node.policies.length === 0) {
-				return { allow: never, deny: never }
-			}
-			const pairs = node.policies.map((child) => residualNode(child, context))
-			const deny = or(pairs.map((pair) => pair.deny))
-			const allow = and([...pairs.map((pair) => pair.allow), not(deny)])
-			return { allow, deny }
-		}
-		case "Any": {
-			const pairs = node.policies.map((child) => residualNode(child, context))
-			const allow = or(pairs.map((pair) => pair.allow))
-			const deny = and([not(allow), or(pairs.map((pair) => pair.deny))])
-			return { allow, deny }
-		}
-		case "FirstOf": {
-			// The first child that gives an answer wins.
-			return Arr.reduceRight(
-				node.policies,
-				{ allow: never, deny: never },
-				(rest: Pair, child): Pair => {
-					const pair = residualNode(child, context)
-					return {
-						allow: or([pair.allow, and([not(pair.deny), rest.allow])]),
-						deny: or([pair.deny, and([not(pair.allow), rest.deny])]),
-					}
-				},
-			)
-		}
-		case "Ceiling": {
-			const cap = residualNode(node.cap, context)
-			const inner = residualNode(node.policy, context)
-			return {
-				allow: and([not(cap.deny), inner.allow]),
-				deny: or([cap.deny, inner.deny]),
-			}
-		}
-	}
-}
-
-/** The name of the predicate of a residual condition that runs `decide`. */
-const policyPredicate = "policy"
-
-/** Tests if a rule of a policy tree has a predicate. */
-const nodeHasPredicate = (
-	node: Node,
-	memo: Map<Node, boolean> = new Map(),
-): boolean =>
-	remember(memo, node, () => {
-		const test = (child: Node) => nodeHasPredicate(child, memo)
-		switch (node._tag) {
-			case "Rules":
-				return Arr.some(
-					node.rules,
-					(value) =>
-						value.when !== undefined && Condition.hasPredicate(value.when),
-				)
-			case "All":
-			case "Any":
-			case "FirstOf":
-				return Arr.some(node.policies, test)
-			case "Ceiling":
-				return test(node.cap) || test(node.policy)
-		}
-	})
-
-/** Tests if a rule that the request may use has a predicate. */
-/** What {@link usesPredicate} needs: the request and a memo. */
-interface PredicateContext {
-	readonly action: string
-	readonly kind: string
-	readonly field: string | undefined
-	readonly descriptor: Resource.Descriptor
-	readonly predicates: Map<Node, boolean>
-}
-
-const usesPredicate = (node: Node, context: PredicateContext): boolean =>
-	remember(context.predicates, node, () => usesPredicateOnce(node, context))
-
-const usesPredicateOnce = (node: Node, context: PredicateContext): boolean => {
-	switch (node._tag) {
-		case "Rules":
-			return node.rules.some(
-				(value) =>
-					value.when !== undefined &&
-					Condition.hasPredicate(value.when) &&
-					Rule.matchesTarget(value, context),
-			)
-		case "All":
-		case "Any":
-		case "FirstOf":
-			return node.policies.some((child) => usesPredicate(child, context))
-		case "Ceiling":
-			return (
-				usesPredicate(node.cap, context) || usesPredicate(node.policy, context)
-			)
-	}
-}
-
-const isScopeValue = (operand: Condition.Operand): boolean =>
-	operand._tag === "Principal" ||
-	operand.value === null ||
-	typeof operand.value === "string" ||
-	typeof operand.value === "number" ||
-	typeof operand.value === "boolean"
-
-/**
- * Gives the problem of a scope that is not plain data, or `undefined` when it
- * is plain data. A predicate, or a value that a condition can not hold, such
- * as `undefined` from a route parameter, is a defect: such a scope could make
- * a check pass on the wrong values. A shared node is tested one time.
- */
-const scopeProblem = (
-	ast: Ast,
-	memo: Map<Ast, string | null> = new Map(),
-): string | undefined =>
-	remember(memo, ast, (): string | null => {
-		switch (ast._tag) {
-			case "Predicate":
-				return "can not have a predicate"
-			case "Compare":
-				return isScopeValue(ast.value)
-					? null
-					: `has a value for "${ast.field}" that is not a scalar`
-			case "In":
-				return Arr.every(ast.values, isScopeValue)
-					? null
-					: `has a value for "${ast.field}" that is not a scalar`
-			case "Under":
-				return Arr.every(ast.prefix, isScopeValue)
-					? null
-					: "has a path part that is not a scalar"
-			case "And":
-			case "Or":
-				return (
-					Option.getOrNull(
-						Arr.findFirst(
-							Arr.map(ast.conditions, (child) => scopeProblem(child, memo)),
-							(problem) => problem !== undefined,
-						),
-					) ?? null
-				)
-			case "Not":
-				return scopeProblem(ast.condition, memo) ?? null
-			default:
-				return null
-		}
-	}) ?? undefined
-
-/**
- * Gives the condition of a scope, with the principal and the path in it.
- * With no scope, it is `True`.
- */
-/**
- * The fields that a scope reads, before it is made smaller. A smaller scope
- * may leave out a read that fails, such as a getter.
- */
-const scopeFields = (within: unknown): ReadonlyArray<string> =>
-	within === undefined
-		? []
-		: Condition.fields(
-				(within as (builder: unknown) => Ast)(Condition.builder()),
-			)
-
-const scopeOf = (within: unknown, input: ResidualContext["input"]): Ast => {
-	if (within === undefined) {
-		return always
-	}
-	const ast = (within as (builder: unknown) => Ast)(Condition.builder())
-	const problem = scopeProblem(ast)
-	if (problem !== undefined) {
-		throw new globalThis.Error(`A scope ${problem}`)
-	}
-	return Condition.partial(ast as Condition.Condition, input)
-}
-
-/** A request about a kind with no types, with the scope of a target. */
-interface ScopedRequest {
-	readonly principal: object
-	readonly action: string
-	readonly kind: string
-	readonly field?: string | undefined
-	readonly within?: unknown
-}
-
-/** The scope of a request, and the residual conditions inside it. */
-interface Scoped extends Pair {
-	readonly scope: Ast
-	readonly schema: Schema.Top | undefined
-}
-
-const residualsAny = (policy: Any, request: ScopedRequest): Pair =>
-	scopedResiduals(policy, request)
-
-const scopedResiduals = (policy: Any, request: ScopedRequest): Scoped => {
-	const descriptor = Domain.descriptorOf(policy.domain, request.kind)
-	if (descriptor === undefined || !fitsKind(descriptor, request)) {
-		return { scope: never, allow: never, deny: never, schema: undefined }
-	}
-	// A scope is made smaller below, and that may leave out a read of a
-	// getter that fails. So such a scope has no residual.
-	if (scopeReadsGetter(request, descriptor)) {
-		throw new globalThis.Error(
-			"The scope of this request reads a getter, so it has no residual condition",
-		)
-	}
-	const input = { principal: request.principal, path: descriptor.path }
-	const scope = scopeOf(request.within, input)
-	const build = makeBuild()
-	const and = build.and
-	const inScope = (pair: Pair): Scoped => ({
-		scope,
-		allow: and([scope, pair.allow]),
-		deny: and([scope, pair.deny]),
-		schema: descriptor.schema,
-	})
-	if (scope._tag === "False") {
-		return inScope({ allow: never, deny: never })
-	}
-	const context: ResidualContext = {
-		action: request.action,
-		kind: request.kind,
-		field: request.field,
-		input,
-		descriptor,
-		pairs: new Map(),
-		predicates: new Map(),
-		build,
-	}
-	if (!usesPredicate(nodeOf(policy), context)) {
-		// A read of a getter may fail when `decide` runs, and a smaller
-		// condition may leave the read out. So a plain residual can not agree
-		// with `decide`, and there is none.
-		if (readsGetter(policy, request, descriptor)) {
-			throw new globalThis.Error(
-				"A rule of this request reads a getter, so it has no residual condition",
-			)
-		}
-		try {
-			return inScope(residualNode(nodeOf(policy), context))
-		} catch (error) {
-			// The type of the residual of a plain policy says that it has no
-			// predicate, so it can not be the predicate below. The policy is too
-			// large for a residual, and that is a defect.
-			if (error instanceof TooLarge) {
-				throw new globalThis.Error(
-					`The residual condition of this request would have more than ${String(maxResidualSize)} nodes or ${String(maxResidualDepth)} levels`,
-				)
-			}
-			throw error
-		}
-	}
-	// A predicate may fail, and it may give another answer each time it runs.
-	// A tree of `And` and `Or` nodes can not run the predicates in the same
-	// order and the same number of times as `decide`. So the residual is one
-	// predicate that runs `decide` for each value.
-	const decision = (value: object) =>
-		decideNode(
-			policy.node,
-			{
-				action: request.action,
-				kind: request.kind,
-				field: request.field,
-				input: {
-					value,
-					principal: request.principal,
-					path: descriptor.path,
-				},
-				descriptor,
-				trace: undefined,
-				predicates: new Map(),
-				decisions: new Map(),
-			},
-			[],
-		)
-	// A value of another kind is not a value that the residual is about, so
-	// the rules of this kind must not run on it.
-	const test = (tag: Decision.Decision["_tag"]): Ast =>
-		Condition.builder<any, any, any>().predicate(policyPredicate, (value) =>
-			Resource.kindOf(value) === request.kind
-				? Effect.map(decision(value), (result) => result._tag === tag)
-				: Effect.succeed(false),
-		)
-	// The scope comes first in each `And`, so the policy runs only on values
-	// in the scope.
-	return inScope({ allow: test("Allow"), deny: test("Deny") })
-}
-
 /**
  * Gives the condition on resource values for which the policy allows a
  * request. It has no principal fields and no `Under` nodes, so you can give it
@@ -1942,50 +794,22 @@ const scopedResiduals = (policy: Any, request: ScopedRequest): Scoped => {
  *
  * A policy tree may use the condition of a child two times, so a small policy
  * may give a very large condition. When the condition would have more than
- * 10000 nodes or 500 levels, this function throws an error. In an
- * `Authorizer`, the error is
- * a defect, so the check fails.
+ * 10000 nodes, this function throws an error. In an `Authorizer`, the error
+ * is a defect, so the check fails.
  *
  * @stability stable
  * @category evaluation
  * @since 0.3.0
  */
-export const residual: {
-	<const Req extends AnyKindRequest>(
-		request: Req,
-	): <D extends Domain.Any, E, R, O>(
-		policy: Policy<D, E, R, O> & Fits<Req, KindRequest<D>>,
-	) => Condition.Condition<E, R, O, ResidualReads<D, Req["kind"]>>
-	<D extends Domain.Any, E, R, O, const Req extends KindRequest<NoInfer<D>>>(
-		policy: Policy<D, E, R, O>,
-		request: Req,
-	): Condition.Condition<E, R, O, ResidualReads<D, Req["kind"]>>
-} = dual(
-	2,
-	(policy: Any, request: KindRequest<Domain.Any>): Ast =>
-		residualsAny(policy, request).allow,
-) as never
-
-/**
- * Gives both residual conditions of a request: the values that the policy
- * allows, and the values that it denies. A value in neither is not
- * applicable. See {@link residual}.
- *
- * @stability stable
- * @category evaluation
- * @since 1.0.0
- */
-export const residuals: {
-	<const Req extends AnyKindRequest>(
-		request: Req,
-	): <D extends Domain.Any, E, R, O>(
-		policy: Policy<D, E, R, O> & Fits<Req, KindRequest<D>>,
-	) => Residuals<E, R, O, ResidualReads<D, Req["kind"]>>
-	<D extends Domain.Any, E, R, O, const Req extends KindRequest<NoInfer<D>>>(
-		policy: Policy<D, E, R, O>,
-		request: Req,
-	): Residuals<E, R, O, ResidualReads<D, Req["kind"]>>
-} = dual(2, residualsAny) as never
+export const residual: <
+	D extends Domain.Any,
+	X,
+	const Req extends KindRequest<NoInfer<D>>,
+>(
+	policy: Policy<D, X>,
+	request: Req,
+) => Condition.Condition<ResidualReads<D, Req["kind"]>, X> =
+	Analysis.residual as never
 
 /**
  * How much of a scope a policy allows. In each case, `condition` is the exact
@@ -2006,275 +830,47 @@ export const residuals: {
  * @category models
  * @since 1.0.0
  */
-export type Coverage<
-	E = never,
-	R = never,
-	O = never,
-	I = unknown,
-> = Data.TaggedEnum<{
-	All: { readonly condition: Condition.Condition<E, R, O, I> }
-	None: { readonly condition: Condition.Condition<E, R, O, I> }
+export type Coverage<I = unknown, X = never> = Data.TaggedEnum<{
+	All: { readonly condition: Condition.Condition<I, X> }
+	None: { readonly condition: Condition.Condition<I, X> }
 	Some: {
-		readonly condition: Condition.Condition<E, R, O, I>
+		readonly condition: Condition.Condition<I, X>
 		readonly allowed: Condition.Example
 		readonly refused: Condition.Example
 	}
 	Unknown: {
-		readonly condition: Condition.Condition<E, R, O, I>
-		readonly reason: "predicate" | "budget" | "schema"
+		readonly condition: Condition.Condition<I, X>
+		readonly reason: "predicate" | "budget"
 	}
 }>
 
-/** A {@link Coverage} with no types. */
-type AnyCoverage = Data.TaggedEnum<{
-	All: { readonly condition: Ast }
-	None: { readonly condition: Ast }
-	Some: {
-		readonly condition: Ast
-		readonly allowed: Condition.Example
-		readonly refused: Condition.Example
-	}
-	Unknown: {
-		readonly condition: Ast
-		readonly reason: "predicate" | "budget" | "schema"
-	}
-}>
-
-const coverages = Data.taggedEnum<AnyCoverage>()
-
-/**
- * Tests if a rule that the request may use, or its scope, reads a getter of
- * a class, in any branch of a union.
- */
-const readsGetter = (
-	policy: Any,
-	request: ScopedRequest,
-	descriptor: Resource.Descriptor,
-): boolean =>
-	scopeReadsGetter(request, descriptor) ||
-	!readsOnly(
-		nodeOf(policy),
-		targetOf(request, descriptor),
-		(field) => !readsGetterAt(descriptor.schema, field),
-		new Map(),
-	)
-
-/**
- * Tests if a read of a field may read a getter of a class: at the field, or
- * at a field on the way to it, in any branch of a union.
- */
-const readsGetterAt = (schema: Schema.Top, field: string): boolean => {
-	const parts = field.split(".")
-	return Arr.some(Arr.range(1, parts.length), (count) =>
-		Resource.hasGetter(schema, parts.slice(0, count).join(".")),
-	)
-}
-
-/**
- * Tests if the scope of a request reads a getter of a class. A scope is made
- * smaller in each residual, also next to a predicate that runs `decide`, so
- * such a scope has no residual.
- */
-const scopeReadsGetter = (
-	request: ScopedRequest,
-	descriptor: Resource.Descriptor,
-): boolean =>
-	!Arr.every(
-		scopeFields(request.within),
-		(field) => !readsGetterAt(descriptor.schema, field),
-	)
-
-/**
- * Tests if a request has no residual: its scope reads a getter, or it has a
- * plain residual and a rule that it may use reads a getter. A residual with
- * a predicate runs `decide`, so the reads of its rules stay.
- */
-const hasNoResidual = (
-	policy: Any,
-	request: ScopedRequest,
-	descriptor: Resource.Descriptor,
-): boolean =>
-	scopeReadsGetter(request, descriptor) ||
-	(!usesPredicate(nodeOf(policy), targetOf(request, descriptor)) &&
-		readsGetter(policy, request, descriptor))
-
-/** The parts of a request that tell which rules it may use. */
-const targetOf = (
-	request: ScopedRequest,
-	descriptor: Resource.Descriptor,
-): PredicateContext => ({
-	action: request.action,
-	kind: request.kind,
-	field: request.field,
-	descriptor,
-	predicates: new Map(),
-})
-
-/**
- * Tests if each field that a rule that the request may use reads passes
- * `test`. It looks at the conditions before they are made smaller. A smaller
- * condition may leave out a field, but a read of that field, such as a
- * getter, may fail when `decide` runs. A shared node is visited one time.
- */
-const readsOnly = (
-	node: Node,
-	target: PredicateContext,
-	test: (field: string) => boolean,
-	memo: Map<Node, boolean>,
-): boolean =>
-	remember(memo, node, () => {
-		switch (node._tag) {
-			case "Rules":
-				return Arr.every(
-					node.rules,
-					(value) =>
-						value.when === undefined ||
-						!Rule.matchesTarget(value, target) ||
-						Arr.every(Condition.fields(value.when as Ast), test),
-				)
-			case "All":
-			case "Any":
-			case "FirstOf":
-				return Arr.every(node.policies, (child) =>
-					readsOnly(child, target, test, memo),
-				)
-			case "Ceiling":
-				return (
-					readsOnly(node.cap, target, test, memo) &&
-					readsOnly(node.policy, target, test, memo)
-				)
-		}
-	})
-
-const coverageAny = (policy: Any, request: ScopedRequest): AnyCoverage => {
-	const descriptor = Domain.descriptorOf(policy.domain, request.kind)
-	// A request with no residual has the condition `False`.
-	if (descriptor !== undefined && hasNoResidual(policy, request, descriptor)) {
-		return coverages.Unknown({ condition: never, reason: "schema" })
-	}
-	const scoped = scopedResiduals(policy, request)
-	const allowed = scoped.allow
-	// Each field that a rule or the scope reads must be plain, also a field
-	// that a smaller condition leaves out. The condition is the residual.
-	if (descriptor !== undefined) {
-		const plain = (field: string) =>
-			Resource.isPlainField(descriptor.schema, field)
-		if (
-			readsGetter(policy, request, descriptor) ||
-			!Arr.every(scopeFields(request.within), plain) ||
-			!readsOnly(
-				nodeOf(policy),
-				targetOf(request, descriptor),
-				plain,
-				new Map(),
-			)
-		) {
-			return coverages.Unknown({ condition: allowed, reason: "schema" })
-		}
-	}
-
-	const options = { schema: scoped.schema }
-	const some =
-		allowed._tag === "False"
-			? undefined
-			: Condition.satisfiable(allowed as Condition.Condition, options)
-	if (some === undefined || some._tag === "Unsatisfiable") {
-		return coverages.None({ condition: never })
-	}
-	if (some._tag === "Unknown") {
-		return coverages.Unknown({ condition: allowed, reason: some.reason })
-	}
-	// Only two nodes more than `allowed`, so it needs no size limit.
-	const refused: Ast = Condition.simplify(
-		Condition.and(
-			scoped.scope as Condition.Condition,
-			Condition.not(allowed as Condition.Condition),
-		),
-	)
-	const missing =
-		refused._tag === "False"
-			? undefined
-			: Condition.satisfiable(refused as Condition.Condition, options)
-	if (missing === undefined || missing._tag === "Unsatisfiable") {
-		return coverages.All({ condition: scoped.scope })
-	}
-	if (missing._tag === "Unknown") {
-		return coverages.Unknown({ condition: allowed, reason: missing.reason })
-	}
-	return coverages.Some({
-		condition: allowed,
-		allowed: some.example,
-		refused: missing.example,
-	})
-}
-
-/**
- * Tests if the scope of a request has a value of the Schema of its kind. The
- * answer is `true` only when the search finds such a value. When the search
- * can not say, the answer is `false`. So a "yes" from it is safe to act on,
- * as for the question "may the decider answer for this scope?".
- *
- * @stability stable
- * @category evaluation
- * @since 1.0.0
- */
-export const scopeHasValue = (policy: Any, request: ScopedRequest): boolean => {
-	const scoped = scopedResiduals(policy, request)
-	return (
-		Condition.satisfiable(scoped.scope as Condition.Any, {
-			schema: scoped.schema,
-		})._tag === "Satisfiable"
-	)
-}
-
-/**
- * Tests if the scope of a request has no value of the Schema of its kind. A
- * scope with a mistake, such as two values for one field, is empty. With no
- * scope, the answer is `false` when the kind has a value. When the search can
- * not say, the answer is `false`.
- *
- * @stability stable
- * @category evaluation
- * @since 1.0.0
- */
-export const scopeIsEmpty = (policy: Any, request: ScopedRequest): boolean => {
-	const scoped = scopedResiduals(policy, request)
-	return (
-		Condition.satisfiable(scoped.scope as Condition.Any, {
-			schema: scoped.schema,
-		})._tag === "Unsatisfiable"
-	)
-}
-
 /**
  * Tells how much of a scope the policy allows: all of it, none of it, or some
  * of it. See {@link Coverage}. With no scope (`within`), the scope is every
  * value of the kind.
  *
- * The answer comes from {@link Condition.satisfiable} with the Schema of the
- * resource, so it is exact for the values of the Schema. When a condition
- * tests a field that is not a plain scalar (see `Resource.isPlainField`),
- * such as a field with a check other than a finite or integer check, the
- * answer is `Unknown`, and a check on the kind says no.
+ * The answer comes from {@link Condition.satisfiable} with the shape of the
+ * Schema of the resource. `All` and `None` hold for every value of the
+ * Schema. `Some` means that, by the shape of the Schema, a value may get
+ * either answer: a check such as a minimum length may still stop one of the
+ * examples. `Unknown` comes only from a predicate or from the budget of the
+ * search.
  *
- * `Some` means that some value of the Schema is allowed. It does not mean that
- * such a value is in your database. To know that, run `condition` as a query.
+ * `Some` does not mean that such a value is in your database. To know that,
+ * run `condition` as a query.
  *
  * @stability stable
  * @category evaluation
  * @since 1.0.0
  */
-export const coverage: {
-	<const Req extends AnyKindRequest>(
-		request: Req,
-	): <D extends Domain.Any, E, R, O>(
-		policy: Policy<D, E, R, O> & Fits<Req, KindRequest<D>>,
-	) => Coverage<E, R, O, ResidualReads<D, Req["kind"]>>
-	<D extends Domain.Any, E, R, O, const Req extends KindRequest<NoInfer<D>>>(
-		policy: Policy<D, E, R, O>,
-		request: Req,
-	): Coverage<E, R, O, ResidualReads<D, Req["kind"]>>
-} = dual(2, coverageAny) as never
+export const coverage: <
+	D extends Domain.Any,
+	X,
+	const Req extends KindRequest<NoInfer<D>>,
+>(
+	policy: Policy<D, X>,
+	request: Req,
+) => Coverage<ResidualReads<D, Req["kind"]>, X> = Analysis.coverageAny as never
 
 // Schema
 
@@ -2319,997 +915,20 @@ export type EncodedNode =
 			readonly policy: EncodedNode
 	  }
 
-const AlgorithmSchema = Schema.Literals([
-	"denyOverrides",
-	"permitOverrides",
-	"firstApplicable",
-	"lastApplicable",
-])
-
-const encodedRuleSchema = (meta: Schema.Top | undefined) =>
-	Schema.Struct({
-		_tag: Schema.Literals(["Allow", "Deny"]),
-		actions: Schema.Array(Schema.String),
-		resources: Schema.Array(Schema.String),
-		when: Schema.optionalKey(Condition.schema),
-		fields: Schema.String.pipe(Schema.Array, Schema.optionalKey),
-		reason: Schema.optionalKey(Schema.String),
-		id: Schema.optionalKey(Schema.String),
-		meta: Schema.optionalKey(
-			(meta ?? Schema.Never) as Schema.Codec<unknown, unknown>,
-		),
-	})
-
-/**
- * The most levels of objects and arrays in the JSON form of a policy. The
- * Schema of a policy calls itself for each level, so a much deeper input
- * could fill the stack before the checks of the policy run. A policy tree of
- * `maxDepth` levels with deep conditions stays well below this.
- */
-const maxJsonDepth = 1000
-
-/**
- * The most objects and arrays in the JSON form of an input, with a shared one
- * counted for each place. The decoder writes out a shared one each time, so
- * an input with few objects may give a very large tree.
- */
-const maxInputNodes = 1_000_000
-
-/** The size and the height of a value, in objects and arrays. */
-interface Measure {
-	readonly size: number
-	readonly height: number
-}
-
-/**
- * Measures a value, or gives `undefined` when it is higher than `levels`. A
- * shared object is measured one time. The walk stops at that height, so it
- * does not fill the stack itself. The memo is a native `Map`, because it
- * must find an object by the object itself.
- */
-const measure = (
-	input: unknown,
-	levels: number,
-	memo: Map<object, Measure | { readonly failed: number }>,
-): Measure | undefined => {
-	if (typeof input !== "object" || input === null) {
-		return { size: 0, height: 0 }
-	}
-	const cached = memo.get(input)
-	// A value that was too high for some levels is too high for fewer.
-	if (
-		cached !== undefined &&
-		("failed" in cached ? levels <= cached.failed : true)
-	) {
-		return "failed" in cached || cached.height > levels ? undefined : cached
-	}
-	// After the first child that is too high, the fold measures no more
-	// children. The walk has few frames for each level, so it does not fill
-	// the stack at the most levels.
-	// An input with a key that a loop over the keys does not see, or with a
-	// getter, may give the decoder more than the measure sees. Such an input
-	// is not plain data, so it fails.
-	const result =
-		levels === 0 || !isPlainData(input)
-			? undefined
-			: Arr.reduce(
-					Object.values(input),
-					{ size: 1, height: 1 } as Measure | undefined,
-					(total, child) => {
-						const measured =
-							total === undefined ? undefined : measure(child, levels - 1, memo)
-						return total === undefined || measured === undefined
-							? undefined
-							: {
-									size: total.size + measured.size,
-									height: Math.max(total.height, 1 + measured.height),
-								}
-					},
-				)
-	memo.set(input, result ?? { failed: levels })
-	return result
-}
-
-/**
- * Tests if each own key of an object is a plain data key that a loop over the
- * keys sees. The `length` of an array is the one key that is not seen. The
- * decoder reads keys of the prototypes too, so a prototype other than the
- * one of a plain object or an array may have only methods, as the prototype
- * of a class has.
- */
-const isPlainData = (input: object): boolean =>
-	Arr.every(Reflect.ownKeys(input), (key) => {
-		const property = Object.getOwnPropertyDescriptor(input, key)
-		return (
-			property !== undefined &&
-			"value" in property &&
-			(property.enumerable === true ||
-				(Array.isArray(input) && key === "length"))
-		)
-	}) && hasOnlyMethods(Object.getPrototypeOf(input))
-
-/** Tests if the prototypes from `prototype` up have only methods. */
-const hasOnlyMethods = (prototype: unknown): boolean =>
-	prototype === null ||
-	prototype === Object.prototype ||
-	prototype === Array.prototype ||
-	(typeof prototype === "object" &&
-		Arr.every(Reflect.ownKeys(prototype), (key) => {
-			const property = Object.getOwnPropertyDescriptor(prototype, key)
-			return (
-				typeof key === "symbol" ||
-				key === "constructor" ||
-				(property !== undefined &&
-					"value" in property &&
-					typeof property.value === "function")
-			)
-		}) &&
-		hasOnlyMethods(Object.getPrototypeOf(prototype)))
-
-/** Tests if a value is low and small enough to decode. */
-const fitsLimits = (input: unknown): string | true => {
-	const measured = measure(input, maxJsonDepth, new Map())
-	return measured === undefined
-		? `A policy may have at most ${String(maxJsonDepth)} levels of JSON`
-		: measured.size > maxInputNodes
-			? `A policy may have at most ${String(maxInputNodes)} objects and arrays in JSON`
-			: true
-}
-
-const encodedNodeSchema = (
-	meta: Schema.Top | undefined,
-): Schema.Codec<EncodedNode> => {
-	const self: Schema.Codec<EncodedNode> = Schema.Union([
-		Schema.TaggedStruct("Rules", {
-			algorithm: AlgorithmSchema,
-			rules: Schema.Array(encodedRuleSchema(meta)),
-		}),
-		Schema.TaggedStruct("All", {
-			policies: Schema.Array(Schema.suspend(() => self)),
-		}),
-		Schema.TaggedStruct("Any", {
-			policies: Schema.Array(Schema.suspend(() => self)),
-		}),
-		Schema.TaggedStruct("FirstOf", {
-			policies: Schema.Array(Schema.suspend(() => self)),
-		}),
-		Schema.TaggedStruct("Ceiling", {
-			cap: Schema.suspend(() => self),
-			policy: Schema.suspend(() => self),
-		}),
-	]) as never
-	return self
-}
-
-type ConditionNode = Condition.Encoded | Ast
-
-const principalRefs = (ast: ConditionNode): ReadonlyArray<string> =>
-	Array.from(refsIn(ast, new Map()))
-
-/** The principal fields of a node. A shared node is visited one time. */
-const refsIn = (
-	node: ConditionNode,
-	memo: Map<ConditionNode, HashSet.HashSet<string>>,
-): HashSet.HashSet<string> =>
-	remember(memo, node, () => {
-		const refs = (operands: ReadonlyArray<Condition.Operand>) =>
-			HashSet.fromIterable(
-				Arr.flatMap(operands, (operand) =>
-					operand._tag === "Principal" ? [operand.path] : [],
-				),
-			)
-		switch (node._tag) {
-			case "Compare":
-				return refs([node.value])
-			case "In":
-				return refs(node.values)
-			case "Under":
-				return refs(node.prefix)
-			case "And":
-			case "Or":
-				return Arr.reduce(
-					node.conditions as ReadonlyArray<ConditionNode>,
-					HashSet.empty<string>(),
-					(all, child) => HashSet.union(all, refsIn(child, memo)),
-				)
-			case "Not":
-				return refsIn(node.condition, memo)
-			default:
-				return HashSet.empty()
-		}
-	})
-
-interface Issue {
-	readonly path: ReadonlyArray<PropertyKey>
-	readonly issue: string
-}
-
-/** A test of a field with a fixed value, as in `eq("level", 3)`. */
-type LiteralTest = readonly [field: string, value: Condition.Scalar]
-
-const literalTests = (node: ConditionNode): ReadonlyArray<LiteralTest> =>
-	Arr.map(Array.from(literalTestsIn(node, new Map())), (text) => {
-		const [field, value] = JSON.parse(text) as readonly [string, unknown]
-		return [
-			field,
-			hasProperty(value, "number") ? Number(value.number) : value,
-		] as LiteralTest
-	})
-
-/**
- * The JSON text of a test. JSON has no `Infinity`, `-Infinity` or `NaN`, so
- * such a number goes in as its text.
- */
-const literalText = (field: string, value: Condition.Scalar): string =>
-	JSON.stringify([
-		field,
-		typeof value === "number" && !Number.isFinite(value)
-			? { number: String(value) }
-			: value,
-	])
-
-/**
- * The tests of fields with fixed values in a node, each as the JSON text of a
- * {@link LiteralTest}. A set of texts keeps each test one time, so a node
- * with many shared parts gives a small set. A shared node is visited one time.
- */
-const literalTestsIn = (
-	node: ConditionNode,
-	memo: Map<ConditionNode, HashSet.HashSet<string>>,
-): HashSet.HashSet<string> =>
-	remember(memo, node, () => {
-		const tests = (
-			field: string,
-			operands: ReadonlyArray<Condition.Operand>,
-		): HashSet.HashSet<string> =>
-			HashSet.fromIterable(
-				Arr.flatMap(operands, (operand) =>
-					operand._tag === "Literal" ? [literalText(field, operand.value)] : [],
-				),
-			)
-		switch (node._tag) {
-			case "Compare":
-				return tests(node.field, [node.value])
-			case "In":
-				return tests(node.field, node.values)
-			case "And":
-			case "Or":
-				return Arr.reduce(
-					node.conditions as ReadonlyArray<ConditionNode>,
-					HashSet.empty<string>(),
-					(all, child) => HashSet.union(all, literalTestsIn(child, memo)),
-				)
-			case "Not":
-				return literalTestsIn(node.condition, memo)
-			default:
-				return HashSet.empty()
-		}
-	})
-
-/** A test of a field with a field of the principal, as in `eq("ownerId", $.principal("id"))`. */
-type PrincipalTest = readonly [field: string, ref: string]
-
-const principalTests = (node: ConditionNode): ReadonlyArray<PrincipalTest> =>
-	Arr.map(
-		Array.from(principalTestsIn(node, new Map())),
-		(text) => JSON.parse(text) as PrincipalTest,
-	)
-
-/**
- * The tests of fields with principal fields in a node, each as the JSON text
- * of a {@link PrincipalTest}. See {@link literalTestsIn}.
- */
-const principalTestsIn = (
-	node: ConditionNode,
-	memo: Map<ConditionNode, HashSet.HashSet<string>>,
-): HashSet.HashSet<string> =>
-	remember(memo, node, () => {
-		const tests = (
-			field: string,
-			operands: ReadonlyArray<Condition.Operand>,
-		): HashSet.HashSet<string> =>
-			HashSet.fromIterable(
-				Arr.flatMap(operands, (operand) =>
-					operand._tag === "Principal"
-						? [JSON.stringify([field, operand.path])]
-						: [],
-				),
-			)
-		switch (node._tag) {
-			case "Compare":
-				return tests(node.field, [node.value])
-			case "In":
-				return tests(node.field, node.values)
-			case "And":
-			case "Or":
-				return Arr.reduce(
-					node.conditions as ReadonlyArray<ConditionNode>,
-					HashSet.empty<string>(),
-					(all, child) => HashSet.union(all, principalTestsIn(child, memo)),
-				)
-			case "Not":
-				return principalTestsIn(node.condition, memo)
-			default:
-				return HashSet.empty()
-		}
-	})
-
-/**
- * Tests if a node has a fixed value that is not a {@link Condition.Scalar},
- * such as `undefined`. A shared node is visited one time.
- */
-const hasBadLiteralIn = (
-	node: ConditionNode,
-	memo: Map<ConditionNode, boolean>,
-): boolean =>
-	remember(memo, node, () => {
-		const bad = (operands: ReadonlyArray<Condition.Operand>) =>
-			Arr.some(
-				operands,
-				(operand) =>
-					operand._tag === "Literal" &&
-					operand.value !== null &&
-					typeof operand.value !== "string" &&
-					typeof operand.value !== "number" &&
-					typeof operand.value !== "boolean",
-			)
-		switch (node._tag) {
-			case "Compare":
-				return bad([node.value])
-			case "In":
-				return bad(node.values)
-			case "Under":
-				return bad(node.prefix)
-			case "And":
-			case "Or":
-				return Arr.some(
-					node.conditions as ReadonlyArray<ConditionNode>,
-					(child) => hasBadLiteralIn(child, memo),
-				)
-			case "Not":
-				return hasBadLiteralIn(node.condition, memo)
-			default:
-				return false
-		}
-	})
-
-/**
- * The principal fields in the prefixes of `Under` nodes, each as the JSON text
- * of the place in the prefix and the path of the field. See
- * {@link literalTestsIn}.
- */
-/**
- * The fixed values in the prefixes of `Under` nodes, each as the JSON text of
- * the place in the prefix, the value, and the fixed strings of the whole
- * prefix. A number that JSON can not hold is left out: it fits no field
- * that a path names. See {@link underRefsIn}.
- */
-const underLiteralsIn = (
-	node: ConditionNode,
-	memo: Map<ConditionNode, HashSet.HashSet<string>>,
-): HashSet.HashSet<string> =>
-	remember(memo, node, () => {
-		switch (node._tag) {
-			case "Under": {
-				const strings = Arr.map(node.prefix, (operand) =>
-					operand._tag === "Literal" && typeof operand.value === "string"
-						? operand.value
-						: null,
-				)
-				return HashSet.fromIterable(
-					Arr.flatMap(node.prefix, (operand, index) =>
-						operand._tag === "Literal" &&
-						(operand.value === null ||
-							typeof operand.value === "string" ||
-							typeof operand.value === "boolean" ||
-							Number.isFinite(operand.value))
-							? [JSON.stringify([index, operand.value, strings])]
-							: [],
-					),
-				)
-			}
-			case "And":
-			case "Or":
-				return Arr.reduce(
-					node.conditions as ReadonlyArray<ConditionNode>,
-					HashSet.empty<string>(),
-					(all, child) => HashSet.union(all, underLiteralsIn(child, memo)),
-				)
-			case "Not":
-				return underLiteralsIn(node.condition, memo)
-			default:
-				return HashSet.empty()
-		}
-	})
-
-/** A fixed value in a path test. See {@link underLiteralsIn}. */
-type UnderLiteral = readonly [
-	index: number,
-	value: Condition.Scalar,
-	strings: ReadonlyArray<string | null>,
-]
-
-const underLiterals = (node: ConditionNode): ReadonlyArray<UnderLiteral> =>
-	Arr.map(
-		Array.from(underLiteralsIn(node, new Map())),
-		(text) => JSON.parse(text) as UnderLiteral,
-	)
-
-const underRefsIn = (
-	node: ConditionNode,
-	memo: Map<ConditionNode, HashSet.HashSet<string>>,
-): HashSet.HashSet<string> =>
-	remember(memo, node, () => {
-		switch (node._tag) {
-			case "Under": {
-				// The fixed strings of the prefix, so the check can leave out a
-				// resource whose path can not match them.
-				const strings = Arr.map(node.prefix, (operand) =>
-					operand._tag === "Literal" && typeof operand.value === "string"
-						? operand.value
-						: null,
-				)
-				return HashSet.fromIterable(
-					Arr.flatMap(node.prefix, (operand, index) =>
-						operand._tag === "Principal"
-							? [JSON.stringify([index, operand.path, strings])]
-							: [],
-					),
-				)
-			}
-			case "And":
-			case "Or":
-				return Arr.reduce(
-					node.conditions as ReadonlyArray<ConditionNode>,
-					HashSet.empty<string>(),
-					(all, child) => HashSet.union(all, underRefsIn(child, memo)),
-				)
-			case "Not":
-				return underRefsIn(node.condition, memo)
-			default:
-				return HashSet.empty()
-		}
-	})
-
-/**
- * A principal field in a path test: its place in the prefix, its path, and
- * the fixed strings of the whole prefix, or `null` for another part.
- */
-type UnderRef = readonly [
-	index: number,
-	ref: string,
-	strings: ReadonlyArray<string | null>,
-]
-
-const underRefs = (node: ConditionNode): ReadonlyArray<UnderRef> =>
-	Arr.map(
-		Array.from(underRefsIn(node, new Map())),
-		(text) => JSON.parse(text) as UnderRef,
-	)
-
-/**
- * Tests if the path of a resource may start with a prefix: it is as long as
- * the prefix, and each fixed string of the prefix is the string of the path
- * at its place, when the path has a string there.
- */
-const mayStartWith = (
-	descriptor: Resource.Descriptor,
-	strings: ReadonlyArray<string | null>,
-): boolean =>
-	// A path shorter than the prefix never matches.
-	(descriptor.path?.length ?? 0) >= strings.length &&
-	Arr.every(strings, (string, index) => {
-		const segment = descriptor.path?.[index]
-		return string === null || typeof segment !== "string" || segment === string
-	})
-
-/**
- * Tests if a principal field may hold the part of a path at `index`: a string
- * of the path, or a value of the field that the path names there.
- */
-const fitsPathPart = (
-	descriptor: Resource.Descriptor,
-	index: number,
-	principal: Resource.FieldDomain,
-): boolean => {
-	const segment = descriptor.path?.[index]
-	return segment === undefined
-		? false
-		: typeof segment === "string"
-			? fitsDomain(principal, segment)
-			: domainsMeet(
-					Resource.domainOf(descriptor.schema, segment.field),
-					principal,
-				)
-}
-
-/**
- * The fields of ordered tests (`lt`, `lte`, `gt`, `gte`) in a node, each as
- * the JSON text of the field and the operand. See {@link literalTestsIn}.
- */
-const orderedTestsIn = (
-	node: ConditionNode,
-	memo: Map<ConditionNode, HashSet.HashSet<string>>,
-): HashSet.HashSet<string> =>
-	remember(memo, node, () => {
-		switch (node._tag) {
-			case "Compare":
-				return node.op === "eq" || node.op === "ne"
-					? HashSet.empty()
-					: HashSet.make(
-							JSON.stringify([
-								node.field,
-								// The type of a fixed value, not the value: JSON has no
-								// `Infinity`.
-								node.value._tag === "Literal"
-									? { _tag: "Literal", type: typeof node.value.value }
-									: node.value,
-							]),
-						)
-			case "And":
-			case "Or":
-				return Arr.reduce(
-					node.conditions as ReadonlyArray<ConditionNode>,
-					HashSet.empty<string>(),
-					(all, child) => HashSet.union(all, orderedTestsIn(child, memo)),
-				)
-			case "Not":
-				return orderedTestsIn(node.condition, memo)
-			default:
-				return HashSet.empty()
-		}
-	})
-
-/** The operand of an ordered test: the type of a fixed value, or a principal field. */
-type OrderedOperand =
-	| { readonly _tag: "Literal"; readonly type: string }
-	| { readonly _tag: "Principal"; readonly path: string }
-
-const orderedTests = (
-	node: ConditionNode,
-): ReadonlyArray<readonly [field: string, operand: OrderedOperand]> =>
-	Arr.map(
-		Array.from(orderedTestsIn(node, new Map())),
-		(text) =>
-			JSON.parse(text) as readonly [field: string, operand: OrderedOperand],
-	)
-
-/**
- * Tests if a field may hold a value with an order: a number or a string. An
- * ordered test is false for any other value.
- */
-const isOrdered = (domain: Resource.FieldDomain): boolean =>
-	domain.string ||
-	domain.number !== "none" ||
-	Arr.some(
-		domain.literals,
-		(value) => typeof value === "string" || typeof value === "number",
-	)
-
-/**
- * Tests if two fields may hold values of one ordered type: two strings or two
- * numbers. An ordered test of two values of other types is false.
- */
-const orderedMeet = (
-	left: Resource.FieldDomain,
-	right: Resource.FieldDomain,
-): boolean => {
-	const strings = (domain: Resource.FieldDomain) =>
-		domain.string ||
-		Arr.some(domain.literals, (value) => typeof value === "string")
-	const numbers = (domain: Resource.FieldDomain) =>
-		domain.number !== "none" ||
-		Arr.some(domain.literals, (value) => typeof value === "number")
-	return (strings(left) && strings(right)) || (numbers(left) && numbers(right))
-}
-
-/**
- * Tests if two fields may hold one value: a value of one type, or a single
- * value that the other field may hold.
- */
-const domainsMeet = (
-	left: Resource.FieldDomain,
-	right: Resource.FieldDomain,
-): boolean =>
-	// A principal field that is `null` is a missing value, and a test with a
-	// missing value is false. A principal field that holds an object is not a
-	// scalar, and it is a missing value too. So only scalars can be shared.
-	(left.string && right.string) ||
-	(left.boolean && right.boolean) ||
-	(left.number !== "none" && right.number !== "none") ||
-	Arr.some(left.literals, (value) => fitsDomain(right, value)) ||
-	Arr.some(right.literals, (value) => fitsDomain(left, value))
-
-/**
- * Tests if a field with this domain may hold a value of the type of `value`.
- * `null` always fits: a test with `null` is a test that the field is missing.
- */
-const fitsDomain = (
-	domain: Resource.FieldDomain,
-	value: Condition.Scalar,
-): boolean =>
-	value === null ||
-	domain.literals.includes(value) ||
-	(typeof value === "string" && domain.string) ||
-	(typeof value === "boolean" && domain.boolean) ||
-	(typeof value === "number" && domain.number !== "none")
-
-/**
- * Checks the names in an encoded policy against the domain. It gives one
- * message for each problem.
- */
-const validate = (
-	domain: Domain.Any,
-	root: EncodedNode,
-): ReadonlyArray<Issue> => {
-	const principalPaths = domain.principal.pipe(
-		Resource.fieldPaths,
-		HashSet.fromIterable,
-	)
-	const ruleIssues = (
-		value: EncodedRule,
-		at: ReadonlyArray<PropertyKey>,
-	): ReadonlyArray<Issue> => {
-		const all = value.resources.includes("*")
-		// Each kind is checked one time, also when the list names it again. The
-		// order of the kinds does not change the issues, so a set is enough.
-		const named = Array.from(
-			HashSet.fromIterable(Arr.filter(value.resources, (kind) => kind !== "*")),
-		)
-		const descriptors = Arr.flatMap(named, (kind) => {
-			const descriptor = Domain.descriptorOf(domain, kind)
-			return descriptor === undefined ? [] : [descriptor]
-		})
-		const known = all
-			? Array.from(HashMap.values(domain.resources))
-			: descriptors
-		// The kinds of the rule with one of its actions. The rule never runs on
-		// another kind, so the types of its tests are checked only on these.
-		const applicable = Arr.filter(
-			descriptors,
-			(descriptor) =>
-				value.actions.includes("*") ||
-				Arr.some(value.actions, (action) =>
-					descriptor.actions.includes(action),
-				),
-		)
-		const usedFields = [
-			...Arr.filter(value.fields ?? [], (field) => !field.includes("*")),
-			...(value.when === undefined ? [] : Condition.fields(value.when as Ast)),
-		]
-		return [
-			...Arr.map(
-				Arr.filter(named, (kind) => !HashMap.has(domain.resources, kind)),
-				(kind): Issue => ({
-					path: [...at, "resources"],
-					issue: `There is no resource with the kind "${kind}"`,
-				}),
-			),
-			...Arr.map(
-				Arr.filter(
-					value.actions,
-					(action) =>
-						action !== "*" &&
-						!Arr.some(known, (descriptor) =>
-							descriptor.actions.includes(action),
-						),
-				),
-				(action): Issue => ({
-					path: [...at, "actions"],
-					issue: `The action "${action}" is not an action of these resources`,
-				}),
-			),
-			...Arr.map(
-				Arr.filter(
-					usedFields,
-					(field) =>
-						all ||
-						descriptors.length === 0 ||
-						!Arr.every(
-							descriptors,
-							(descriptor) =>
-								descriptor.fieldPaths.includes(field) ||
-								// A key of a record, or a field deep in a recursive
-								// Schema, or a getter of a nested class.
-								Resource.hasPath(descriptor.schema, field) ||
-								Resource.hasGetter(descriptor.schema, field),
-						),
-				),
-				(field): Issue => ({
-					path: at,
-					issue: `The field "${field}" is not a field of every resource of the rule`,
-				}),
-			),
-			...Arr.map(
-				Arr.filter(
-					value.when === undefined ? [] : principalRefs(value.when),
-					(ref) =>
-						!HashSet.has(principalPaths, ref) &&
-						!Resource.hasPath(domain.principal, ref) &&
-						!Resource.hasGetter(domain.principal, ref),
-				),
-				(ref): Issue => ({
-					path: [...at, "when"],
-					issue: `The principal has no field "${ref}"`,
-				}),
-			),
-			// A test with a value of another type than the field never matches.
-			// The types stop it in a typed rule, so here it is a mistake, and in
-			// a deny rule it would let values through.
-			...Arr.map(
-				Arr.filter(
-					value.when === undefined ? [] : literalTests(value.when),
-					([field, literal]) =>
-						Arr.some(
-							applicable,
-							(descriptor) =>
-								!fitsDomain(
-									Resource.domainOf(descriptor.schema, field),
-									literal,
-								),
-						),
-				),
-				([field, literal]): Issue => ({
-					path: [...at, "when"],
-					issue: `The field "${field}" can not hold the value ${JSON.stringify(literal)}`,
-				}),
-			),
-			...Arr.map(
-				Arr.filter(
-					value.when === undefined ? [] : principalTests(value.when),
-					([field, ref]) =>
-						Arr.some(
-							applicable,
-							(descriptor) =>
-								!domainsMeet(
-									Resource.domainOf(descriptor.schema, field),
-									Resource.domainOf(domain.principal, ref),
-								),
-						),
-				),
-				([field, ref]): Issue => ({
-					path: [...at, "when"],
-					issue: `The field "${field}" can not hold a value of the principal field "${ref}"`,
-				}),
-			),
-			// A condition with a node that is not known would be skipped when it
-			// runs, so it is not taken.
-			...(value.when !== undefined && !Condition.isAst(value.when)
-				? [
-						{
-							path: [...at, "when"],
-							issue: "The condition is not a whole condition tree",
-						} satisfies Issue,
-					]
-				: []),
-			// A fixed value such as `undefined` is not a value of a test. Its
-			// JSON text would be `null`, and the test would mean another thing.
-			...(value.when !== undefined && hasBadLiteralIn(value.when, new Map())
-				? [
-						{
-							path: [...at, "when"],
-							issue:
-								"A test has a fixed value that is not a string, a number, a boolean or null",
-						} satisfies Issue,
-					]
-				: []),
-			// A principal field in a path test must hold a value that the path
-			// may have at that place. Else the test is always false.
-			...Arr.map(
-				Arr.filter(
-					value.when === undefined ? [] : underRefs(value.when),
-					([index, ref, strings]) =>
-						// A rule for every resource may run on each of them that has a
-						// part of its path at this place.
-						Arr.some(
-							// The rule runs only on a kind with one of its actions, and
-							// the test can match only a path that starts with the fixed
-							// strings of the prefix.
-							Arr.filter(
-								all
-									? Arr.filter(
-											known,
-											(descriptor) =>
-												descriptor.path?.[index] !== undefined &&
-												(value.actions.includes("*") ||
-													Arr.some(value.actions, (action) =>
-														descriptor.actions.includes(action),
-													)),
-										)
-									: applicable,
-								(descriptor) => mayStartWith(descriptor, strings),
-							),
-							(descriptor) =>
-								!fitsPathPart(
-									descriptor,
-									index,
-									Resource.domainOf(domain.principal, ref),
-								),
-						),
-				),
-				([, ref]): Issue => ({
-					path: [...at, "when"],
-					issue: `The principal field "${ref}" can not hold a part of the path of the resource`,
-				}),
-			),
-			// A fixed value in a path test at the place of a field of the path
-			// must be a value of that field. Else the test is always false.
-			...Arr.map(
-				Arr.filter(
-					value.when === undefined ? [] : underLiterals(value.when),
-					([index, literal, strings]) =>
-						Arr.some(
-							Arr.filter(
-								all
-									? Arr.filter(
-											known,
-											(descriptor) =>
-												value.actions.includes("*") ||
-												Arr.some(value.actions, (action) =>
-													descriptor.actions.includes(action),
-												),
-										)
-									: applicable,
-								(descriptor) => mayStartWith(descriptor, strings),
-							),
-							(descriptor) => {
-								const segment = descriptor.path?.[index]
-								return (
-									segment !== undefined &&
-									typeof segment !== "string" &&
-									!fitsDomain(
-										Resource.domainOf(descriptor.schema, segment.field),
-										literal,
-									)
-								)
-							},
-						),
-				),
-				([index, literal]): Issue => ({
-					path: [...at, "when"],
-					issue: `The path part ${String(index)} can not hold the value ${JSON.stringify(literal)}`,
-				}),
-			),
-			// An ordered test compares numbers with numbers and strings with
-			// strings. With another value it is always false.
-			...Arr.map(
-				Arr.filter(
-					value.when === undefined ? [] : orderedTests(value.when),
-					([field, operand]) =>
-						(operand._tag === "Literal" &&
-							operand.type !== "string" &&
-							operand.type !== "number") ||
-						Arr.some(applicable, (descriptor) => {
-							const fieldDomain = Resource.domainOf(descriptor.schema, field)
-							// A principal field must share an ordered type with the
-							// field: a string and a number never compare.
-							return operand._tag === "Literal"
-								? !isOrdered(fieldDomain)
-								: !orderedMeet(
-										fieldDomain,
-										Resource.domainOf(domain.principal, operand.path),
-									)
-						}),
-				),
-				([field]): Issue => ({
-					path: [...at, "when"],
-					issue: `The field "${field}" has an ordered test with a value that has no order`,
-				}),
-			),
-		]
-	}
-	const issuesOf = (
-		node: EncodedNode,
-		path: ReadonlyArray<PropertyKey>,
-		level: number,
-	): ReadonlyArray<Issue> => {
-		if (level > maxDepth) {
-			return [
-				{ path, issue: `A policy tree may have at most ${maxDepth} levels` },
-			]
-		}
-		switch (node._tag) {
-			case "Rules":
-				return Arr.flatMap(node.rules, (value, index) =>
-					ruleIssues(value, [...path, "rules", index]),
-				)
-			case "All":
-			case "Any":
-			case "FirstOf":
-				return Arr.flatMap(node.policies, (child, index) =>
-					issuesOf(child, [...path, "policies", index], level + 1),
-				)
-			case "Ceiling":
-				return [
-					...issuesOf(node.cap, [...path, "cap"], level + 1),
-					...issuesOf(node.policy, [...path, "policy"], level + 1),
-				]
-		}
-	}
-	return issuesOf(root, [], 1)
-}
-
-/**
- * Makes a policy tree from its JSON form. Each rule gets the domain of the
- * Schema, as a rule from the builder of the domain has it.
- */
-const decodeNode = (node: EncodedNode, domain: Domain.Any): Node => {
-	switch (node._tag) {
-		case "Rules":
-			return nodes.Rules({
-				algorithm: node.algorithm,
-				rules: node.rules.map((value) =>
-					Rule.make({ ...(value as Rule.Shape), domain }),
-				),
-			})
-		case "All":
-		case "Any":
-		case "FirstOf":
-			return nodes[node._tag]({
-				policies: node.policies.map((child) => decodeNode(child, domain)),
-			})
-		case "Ceiling":
-			return nodes.Ceiling({
-				cap: decodeNode(node.cap, domain),
-				policy: decodeNode(node.policy, domain),
-			})
-	}
-}
-
-/**
- * Tests if a value is a policy.
- *
- * @stability stable
- * @category guards
- * @since 0.3.0
- */
-export const isPolicy = (u: unknown): u is Any => u instanceof PolicyData
-
 /**
  * The Schema of the policies of a domain with no predicates. Decoding checks
  * every kind, action, field and principal field against the domain, and the
  * `meta` of each rule against the `meta` Schema of the domain.
  *
+ * The decoder takes at most 256 levels of policies and 500 levels of
+ * conditions, and at most 1000000 objects and array items, with a shared
+ * object counted for each place. It reads only the own data fields of the
+ * input.
+ *
  * @stability stable
  * @category schemas
  * @since 0.3.0
  */
-export const schema = <D extends Domain.Any>(
+export const schema: <D extends Domain.Any>(
 	domain: D,
-): Schema.Codec<Policy<D>, EncodedNode> =>
-	// The input is any value until the checks of `encodedNodeSchema` run, so
-	// this guard says yes to every object.
-	Schema.declare(
-		(input): input is EncodedNode =>
-			typeof input === "object" && input !== null,
-	).pipe(
-		Schema.check(Schema.makeFilter(fitsLimits)),
-		Schema.decodeTo(
-			encodedNodeSchema(domain.meta),
-			SchemaTransformation.passthrough(),
-		),
-		Schema.check(Schema.makeFilter((node) => validate(domain, node))),
-		Schema.decodeTo(
-			// A policy with a predicate is not a plain policy, and it can not
-			// become JSON.
-			Schema.declare(
-				(u): u is Policy<D> =>
-					isPolicy(u) && u.domain === domain && !nodeHasPredicate(u.node),
-			),
-			SchemaTransformation.transformEffect({
-				decode: (node: EncodedNode) =>
-					Effect.succeed(fromNode(domain, decodeNode(node, domain))),
-				// A tree whose JSON form is too large fails as a Schema issue.
-				encode: (policy: Policy<D>, options) =>
-					encodedSize(policy.node) > maxEncodedNodes
-						? Effect.fail(
-								new SchemaIssue.InvalidValue(
-									{ message: tooLargeMessage },
-									policy,
-									options,
-								),
-							)
-						: Effect.succeed(encodeNode(policy.node)),
-			}),
-		),
-	)
+) => Schema.Codec<Policy<D>, EncodedNode> = Internal.schema as never