@nmnmcc/ability 2.0.5 → 2.0.7

package/dist/internal/trampoline.js

@@ -0,0 +1,75 @@
+import * as Effect from "effect/Effect";
+import * as Arr from "effect/Array";
+import * as Option from "effect/Option";
+import * as Cause from "effect/Cause";
+import * as Exit from "effect/Exit";
+// src/internal/trampoline.ts
+/**
+* Walks that do not fill the stack.
+*
+* A walk is written one time, with the steps of a {@link Runner}, and a
+* runner runs it:
+* - {@link direct} runs each step at once, as a plain call does. It is fast,
+*   and it is for an input with few levels.
+* - {@link loop} puts each step into the run loop of an Effect. A step gives
+*   the next step in place of calling it, and the loop runs one step after
+*   the other, so the stack does not grow with the levels of the input. This
+*   is a trampoline.
+*
+* {@link run} takes `direct` for an input with at most `directDepth` levels,
+* and `loop` for a deeper one. A walk makes each call for a child through
+* `suspend`, so the loop makes the step of the child only when it runs it.
+*/
+const value = (step) => step;
+const step = (value) => value;
+/** Runs each step at once, on the stack. */
+const direct = {
+	succeed: step,
+	suspend: (make) => make(),
+	map: (from, f) => step(f(value(from))),
+	flatMap: (from, f) => f(value(from)),
+	forEach: (items, f) => step(Arr.map(items, (item, index) => value(f(item, index)))),
+	some: (items, f) => step(Arr.some(items, (item) => value(f(item)))),
+	every: (items, f) => step(Arr.every(items, (item) => value(f(item))))
+};
+const effect = (step) => step;
+const fromEffect = (effect) => effect;
+/** Runs each step in the run loop of an Effect, so a deep walk does not fill the stack. */
+const loop = {
+	succeed: (value) => fromEffect(Effect.succeed(value)),
+	suspend: (make) => fromEffect(Effect.suspend(() => effect(make()))),
+	map: (from, f) => fromEffect(Effect.map(effect(from), f)),
+	flatMap: (from, f) => fromEffect(Effect.flatMap(effect(from), (value) => effect(f(value)))),
+	forEach: (items, f) => fromEffect(Effect.forEach(items, (item, index) => effect(f(item, index)))),
+	some: (items, f) => fromEffect(Effect.map(Effect.findFirst(items, (item) => effect(f(item))), Option.isSome)),
+	every: (items, f) => fromEffect(Effect.map(Effect.findFirst(items, (item) => Effect.map(effect(f(item)), (value) => !value)), Option.isNone))
+};
+/**
+* Gives the runner for an input with `depth` levels. The walks of a condition
+* or a policy tree know the depth of the input from its node. A walk of an
+* input with an unknown depth, as a decoder, takes `loop`.
+*/
+const runnerFor = (depth) => depth <= 200 ? direct : loop;
+/**
+* Runs a walk at once, with the runner for `depth` levels, and gives its
+* value. An error that a step throws comes out as it was, also from `loop`.
+*/
+const run = (depth, walk) => runWith(runnerFor(depth), walk);
+/** Runs a walk at once with a runner, as {@link run} does. */
+const runWith = (runner, walk) => {
+	if (runner === direct) return value(walk(direct));
+	return Exit.match(Effect.runSyncExit(effect(walk(loop))), {
+		onSuccess: (result) => result,
+		onFailure: (cause) => {
+			throw Cause.squash(cause);
+		}
+	});
+};
+/**
+* Gives the Effect of a step of `loop`, so a walk can go on in an Effect
+* that runs a predicate.
+*/
+const toEffect = (step) => effect(step);
+export { direct, loop, run, runWith, runnerFor, toEffect };
+
+//# sourceMappingURL=trampoline.js.map

package/dist/internal/trampoline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trampoline.js","names":[],"sources":["../../src/internal/trampoline.ts"],"sourcesContent":["/**\n * Walks that do not fill the stack.\n *\n * A walk is written one time, with the steps of a {@link Runner}, and a\n * runner runs it:\n * - {@link direct} runs each step at once, as a plain call does. It is fast,\n *   and it is for an input with few levels.\n * - {@link loop} puts each step into the run loop of an Effect. A step gives\n *   the next step in place of calling it, and the loop runs one step after\n *   the other, so the stack does not grow with the levels of the input. This\n *   is a trampoline.\n *\n * {@link run} takes `direct` for an input with at most `directDepth` levels,\n * and `loop` for a deeper one. A walk makes each call for a child through\n * `suspend`, so the loop makes the step of the child only when it runs it.\n */\nimport * as Arr from \"effect/Array\"\nimport * as Cause from \"effect/Cause\"\nimport * as Effect from \"effect/Effect\"\nimport * as Exit from \"effect/Exit\"\nimport * as Option from \"effect/Option\"\n\n/**\n * A step of a walk that gives an `A`. A runner of steps knows what a step\n * is: the value itself for `direct`, and an Effect for `loop`. The type is\n * only in the types.\n */\nexport interface Step<A> {\n\treadonly \"~Step\": (_: never) => A\n}\n\n/** The steps that a walk may take. */\nexport interface Runner {\n\treadonly succeed: <A>(value: A) => Step<A>\n\t/** The step that `step` makes, when the runner runs it. */\n\treadonly suspend: <A>(step: () => Step<A>) => Step<A>\n\treadonly map: <A, B>(step: Step<A>, f: (value: A) => B) => Step<B>\n\treadonly flatMap: <A, B>(step: Step<A>, f: (value: A) => Step<B>) => Step<B>\n\t/** Runs a step for each item, in order, and gives their values. */\n\treadonly forEach: <A, B>(\n\t\titems: ReadonlyArray<A>,\n\t\tf: (item: A, index: number) => Step<B>,\n\t) => Step<ReadonlyArray<B>>\n\t/** Runs a step for each item, in order, up to the first `true`. */\n\treadonly some: <A>(\n\t\titems: ReadonlyArray<A>,\n\t\tf: (item: A) => Step<boolean>,\n\t) => Step<boolean>\n\t/** Runs a step for each item, in order, up to the first `false`. */\n\treadonly every: <A>(\n\t\titems: ReadonlyArray<A>,\n\t\tf: (item: A) => Step<boolean>,\n\t) => Step<boolean>\n}\n\n// A step of `direct` is its value. The casts below only change the type.\nconst value = <A>(step: Step<A>): A => step as unknown as A\nconst step = <A>(value: A): Step<A> => value as unknown as Step<A>\n\n/** Runs each step at once, on the stack. */\nexport const direct: Runner = {\n\tsucceed: step,\n\tsuspend: (make) => make(),\n\tmap: (from, f) => step(f(value(from))),\n\tflatMap: (from, f) => f(value(from)),\n\tforEach: (items, f) =>\n\t\tstep(Arr.map(items, (item, index) => value(f(item, index)))),\n\tsome: (items, f) => step(Arr.some(items, (item) => value(f(item)))),\n\tevery: (items, f) => step(Arr.every(items, (item) => value(f(item)))),\n}\n\n// A step of `loop` is an Effect with no error and no services. A failure of a\n// walk is a thrown error, which `run` gives back as it was.\ntype Loop<A> = Effect.Effect<A>\nconst effect = <A>(step: Step<A>): Loop<A> => step as unknown as Loop<A>\nconst fromEffect = <A>(effect: Loop<A>): Step<A> => effect as unknown as Step<A>\n\n/** Runs each step in the run loop of an Effect, so a deep walk does not fill the stack. */\nexport const loop: Runner = {\n\tsucceed: (value) => fromEffect(Effect.succeed(value)),\n\tsuspend: (make) => fromEffect(Effect.suspend(() => effect(make()))),\n\tmap: (from, f) => fromEffect(Effect.map(effect(from), f)),\n\tflatMap: (from, f) =>\n\t\tfromEffect(Effect.flatMap(effect(from), (value) => effect(f(value)))),\n\tforEach: (items, f) =>\n\t\tfromEffect(Effect.forEach(items, (item, index) => effect(f(item, index)))),\n\tsome: (items, f) =>\n\t\tfromEffect(\n\t\t\tEffect.map(\n\t\t\t\tEffect.findFirst(items, (item) => effect(f(item))),\n\t\t\t\tOption.isSome,\n\t\t\t),\n\t\t),\n\tevery: (items, f) =>\n\t\tfromEffect(\n\t\t\tEffect.map(\n\t\t\t\tEffect.findFirst(items, (item) =>\n\t\t\t\t\tEffect.map(effect(f(item)), (value) => !value),\n\t\t\t\t),\n\t\t\t\tOption.isNone,\n\t\t\t),\n\t\t),\n}\n\n/**\n * The most levels of an input that `run` walks with `direct`. A level takes\n * a few calls of the walk and of the runner on the stack, so this keeps the\n * stack far from full, and most inputs take the fast way.\n */\nexport const directDepth = 200\n\n/**\n * Gives the runner for an input with `depth` levels. The walks of a condition\n * or a policy tree know the depth of the input from its node. A walk of an\n * input with an unknown depth, as a decoder, takes `loop`.\n */\nexport const runnerFor = (depth: number): Runner =>\n\tdepth <= directDepth ? direct : loop\n\n/**\n * Runs a walk at once, with the runner for `depth` levels, and gives its\n * value. An error that a step throws comes out as it was, also from `loop`.\n */\nexport const run = <A>(depth: number, walk: (runner: Runner) => Step<A>): A =>\n\trunWith(runnerFor(depth), walk)\n\n/** Runs a walk at once with a runner, as {@link run} does. */\nexport const runWith = <A>(\n\trunner: Runner,\n\twalk: (runner: Runner) => Step<A>,\n): A => {\n\tif (runner === direct) {\n\t\treturn value(walk(direct))\n\t}\n\treturn Exit.match(Effect.runSyncExit(effect(walk(loop))), {\n\t\tonSuccess: (result) => result,\n\t\tonFailure: (cause) => {\n\t\t\tthrow Cause.squash(cause)\n\t\t},\n\t})\n}\n\n/**\n * Gives the Effect of a step of `loop`, so a walk can go on in an Effect\n * that runs a predicate.\n */\nexport const toEffect = <A>(step: Step<A>): Effect.Effect<A> => effect(step)\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwDA,MAAM,SAAY,SAAqB;AACvC,MAAM,QAAW,UAAsB;;AAGvC,MAAa,SAAiB;CAC7B,SAAS;CACT,UAAU,SAAS,KAAK;CACxB,MAAM,MAAM,MAAM,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC;CACrC,UAAU,MAAM,MAAM,EAAE,MAAM,IAAI,CAAC;CACnC,UAAU,OAAO,MAChB,KAAK,IAAI,IAAI,QAAQ,MAAM,UAAU,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC;CAC5D,OAAO,OAAO,MAAM,KAAK,IAAI,KAAK,QAAQ,SAAS,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;CAClE,QAAQ,OAAO,MAAM,KAAK,IAAI,MAAM,QAAQ,SAAS,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACrE;AAKA,MAAM,UAAa,SAA2B;AAC9C,MAAM,cAAiB,WAA6B;;AAGpD,MAAa,OAAe;CAC3B,UAAU,UAAU,WAAW,OAAO,QAAQ,KAAK,CAAC;CACpD,UAAU,SAAS,WAAW,OAAO,cAAc,OAAO,KAAK,CAAC,CAAC,CAAC;CAClE,MAAM,MAAM,MAAM,WAAW,OAAO,IAAI,OAAO,IAAI,GAAG,CAAC,CAAC;CACxD,UAAU,MAAM,MACf,WAAW,OAAO,QAAQ,OAAO,IAAI,IAAI,UAAU,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;CACrE,UAAU,OAAO,MAChB,WAAW,OAAO,QAAQ,QAAQ,MAAM,UAAU,OAAO,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC;CAC1E,OAAO,OAAO,MACb,WACC,OAAO,IACN,OAAO,UAAU,QAAQ,SAAS,OAAO,EAAE,IAAI,CAAC,CAAC,GACjD,OAAO,MACR,CACD;CACD,QAAQ,OAAO,MACd,WACC,OAAO,IACN,OAAO,UAAU,QAAQ,SACxB,OAAO,IAAI,OAAO,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAC9C,GACA,OAAO,MACR,CACD;AACF;;;;;;AAcA,MAAa,aAAa,UACzB,SAAA,MAAuB,SAAS;;;;;AAMjC,MAAa,OAAU,OAAe,SACrC,QAAQ,UAAU,KAAK,GAAG,IAAI;;AAG/B,MAAa,WACZ,QACA,SACO;CACP,IAAI,WAAW,QACd,OAAO,MAAM,KAAK,MAAM,CAAC;CAE1B,OAAO,KAAK,MAAM,OAAO,YAAY,OAAO,KAAK,IAAI,CAAC,CAAC,GAAG;EACzD,YAAY,WAAW;EACvB,YAAY,UAAU;GACrB,MAAM,MAAM,OAAO,KAAK;EACzB;CACD,CAAC;AACF;;;;;AAMA,MAAa,YAAe,SAAoC,OAAO,IAAI"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nmnmcc/ability",
-	"version": "2.0.5",
+	"version": "2.0.7",
 	"description": "Typed, composable authorization policies for Effect programs.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/Condition.ts

@@ -412,7 +412,8 @@ type ObjectPaths<
 > = [O] extends [never]
 	? never
 	: // A record is one field to a rule or a request, as `permittedFields`
-		// lists it.
+		// lists it. So is a struct at the last part that a path may have, since
+		// a path does not go below it.
 		| (Parents extends true
 				? K
 				: Arrays extends true
@@ -420,7 +421,9 @@ type ObjectPaths<
 						? K
 						: number extends keyof O
 							? K
-							: never
+							: [Depth] extends [0]
+								? K
+								: never
 					: never)
 		| `${K}.${FieldPathInternal<O, PreviousDepth[Depth], Arrays, Parents>}`
 

package/src/Policy.ts

@@ -53,8 +53,7 @@ import type * as Resource from "./Resource.ts"
  * @category models
  * @since 0.3.0
  */
-export type Algorithm =
-	"denyOverrides" | "permitOverrides" | "firstApplicable" | "lastApplicable"
+export type Algorithm = PolicyNodes.Algorithm
 
 /**
  * A list of rules with a combining algorithm.

package/src/internal/algebra.ts

@@ -2,9 +2,10 @@
  * The work on condition nodes: smart constructors, simplification, the step
  * that puts the principal in, tests on a value, and folds.
  *
- * The constructors of the nodes keep each condition small and low, so each
- * walk here is a plain walk with no memo. A shared child is walked again for
- * each place, and the limits of the nodes keep that work small.
+ * The constructors of the nodes keep each condition small, so each walk here
+ * has no memo. A shared child is walked again for each place, and the limits
+ * of the nodes keep that work small. A walk takes the steps of a trampoline,
+ * so a deep condition does not fill the stack: see `Trampoline`.
  */
 // A predicate gives an Effect with an error type and a service type that this
 // code does not know, so they are `unknown` here.
@@ -16,6 +17,7 @@ import * as Option from "effect/Option"
 import type * as Resource from "../Resource.ts"
 import * as Nodes from "./nodes.ts"
 import { readPath } from "./read.ts"
+import * as Trampoline from "./trampoline.ts"
 
 type Node = Nodes.Node
 
@@ -60,15 +62,46 @@ const shapeOf = (node: Node): unknown => {
  * with one text give the same answer for every value. It reads all of the
  * condition, so a search counts its size in the budget.
  */
-export const structureText = (node: Node): string =>
-	JSON.stringify(shapeOf(node))
+const structureText = (node: Node): string => JSON.stringify(shapeOf(node))
 
 /**
- * The most nodes of a condition that a smart constructor reads for its key.
- * A larger child is its own key, so the work of a constructor stays small.
+ * The work of the text of the structure of a condition: each node, and each
+ * value of an `In` test or an `Under` test. A node counts as one in `size`,
+ * also an `In` test with very many values. This walk reads the nodes only,
+ * so it takes `size` steps.
+ */
+const weightOf = (node: Node): number => {
+	switch (node._tag) {
+		case "In":
+			return 1 + node.values.length
+		case "Under":
+			return 1 + node.prefix.length
+		case "And":
+		case "Or":
+			return Arr.reduce(
+				node.conditions,
+				1,
+				(total, child) => total + weightOf(child),
+			)
+		case "Not":
+			return 1 + weightOf(node.condition)
+		default:
+			return 1
+	}
+}
+
+/**
+ * The most nodes of a condition that a smart constructor reads for its key,
+ * and the most children of a child that it puts into a node. A larger child
+ * is its own key, and it stays one child, so the work of a constructor stays
+ * small. A deep chain of `And` nodes, for one, does not copy all its leaves
+ * at each level.
  */
 const keyNodes = 64
 
+/** The most work of a key, with the values of its tests: see {@link weightOf}. */
+const keyWeight = 256
+
 /**
  * The key of a child in a smart constructor: the text of its structure, or
  * the node itself when it is large. The keys go into a native `Set`, not a
@@ -77,8 +110,10 @@ const keyNodes = 64
  * set would read all of them. A native `Set` finds a node by the node itself,
  * and it hashes a string with the random seed of the engine.
  */
-const keyOf = (node: Node): string | Node =>
-	node.size > keyNodes ? node : structureText(node)
+export const keyOf = (node: Node): string | Node =>
+	node.size > keyNodes || weightOf(node) > keyWeight
+		? node
+		: structureText(node)
 
 /**
  * Keeps the first node of each structure, in order. A large node is a copy
@@ -145,7 +180,8 @@ const shortCircuit = (
 /**
  * Makes an `And` or an `Or` of simple children, and makes it simple. It looks
  * one level down only:
- * - it puts the children of a child of the same kind into the node;
+ * - it puts the children of a child of the same kind into the node, when
+ *   the child has at most `keyNodes` of them;
  * - it stops at a `False` in an `And`, or at a `True` in an `Or`;
  * - it removes `True` from an `And`, `False` from an `Or`, copies, and the
  *   children that other children make useless.
@@ -158,7 +194,9 @@ const junction = (tag: "And" | "Or", children: ReadonlyArray<Node>): Node => {
 	const constant = tag === "And" ? "False" : "True"
 	const neutral = tag === "And" ? "True" : "False"
 	const flat = Arr.flatMap(children, (child) =>
-		child._tag === tag && !child.opaque ? child.conditions : [child],
+		child._tag === tag && !child.opaque && child.conditions.length <= keyNodes
+			? child.conditions
+			: [child],
 	)
 	return Option.match(
 		Arr.findFirstIndex(flat, (child) => child._tag === constant),
@@ -216,20 +254,41 @@ export const not = (child: Node): Node => {
 	}
 }
 
+type Step<A> = Trampoline.Step<A>
+
+/** The children of a node, each walked by `go` as a step of `R`. */
+const eachChild = <A>(
+	R: Trampoline.Runner,
+	children: ReadonlyArray<Node>,
+	go: (child: Node) => Step<A>,
+): Step<ReadonlyArray<A>> =>
+	R.forEach(children, (child) => R.suspend(() => go(child)))
+
 /** Makes a condition simple, from its leaves up. */
-export const simplify = (node: Node): Node => {
-	switch (node._tag) {
-		case "And":
-		case "Or":
-			return junction(node._tag, Arr.map(node.conditions, simplify))
-		case "Not":
-			return node.condition.pipe(simplify, not)
-		case "In":
-			return node.values.length === 0 ? never : node
-		default:
-			return node
-	}
-}
+export const simplify = (node: Node): Node =>
+	Trampoline.run(node.depth, (R) => {
+		const go = (current: Node): Step<Node> => {
+			switch (current._tag) {
+				case "And":
+				case "Or": {
+					const tag = current._tag
+					return R.map(eachChild(R, current.conditions, go), (children) =>
+						junction(tag, children),
+					)
+				}
+				case "Not":
+					return R.map(
+						R.suspend(() => go(current.condition)),
+						not,
+					)
+				case "In":
+					return R.succeed(current.values.length === 0 ? never : current)
+				default:
+					return R.succeed(current)
+			}
+		}
+		return go(node)
+	})
 
 // Tests on a value
 
@@ -323,69 +382,99 @@ const testUnder = (
 	})
 }
 
-/** Tests a simple condition with no predicate on a value. */
-const testSync = (node: Node, input: Input): boolean => {
-	switch (node._tag) {
-		case "True":
-			return true
-		case "False":
-			return false
-		case "Compare":
-			return testCompare(
-				node.op,
-				getField(input.value, node.field),
-				resolve(node.value, input.principal),
-			)
-		case "In": {
-			const field = getField(input.value, node.field)
-			return node.values.some(
-				(operand) => resolve(operand, input.principal) === field,
-			)
+/**
+ * The test of a simple condition with no predicate on a value, as a walk.
+ * The children of `And` and `Or` run in order, and they stop at the first
+ * child that gives the answer.
+ */
+const testWith = (input: Input) => (R: Trampoline.Runner) => {
+	const go = (node: Node): Step<boolean> => {
+		switch (node._tag) {
+			case "True":
+				return R.succeed(true)
+			case "False":
+				return R.succeed(false)
+			case "Compare":
+				return R.succeed(
+					testCompare(
+						node.op,
+						getField(input.value, node.field),
+						resolve(node.value, input.principal),
+					),
+				)
+			case "In": {
+				const field = getField(input.value, node.field)
+				return R.succeed(
+					node.values.some(
+						(operand) => resolve(operand, input.principal) === field,
+					),
+				)
+			}
+			case "Exists":
+				return R.succeed(getField(input.value, node.field) !== null)
+			case "Under":
+				return R.succeed(testUnder(node.prefix, input))
+			case "And":
+				return R.every(node.conditions, (child) => R.suspend(() => go(child)))
+			case "Or":
+				return R.some(node.conditions, (child) => R.suspend(() => go(child)))
+			case "Not":
+				return R.map(
+					R.suspend(() => go(node.condition)),
+					(value) => !value,
+				)
+			case "Predicate":
+				// The types stop this. A predicate needs `evaluate`.
+				throw new Error(
+					`The predicate "${node.name}" needs an Effect. Use Condition.evaluate.`,
+				)
 		}
-		case "Exists":
-			return getField(input.value, node.field) !== null
-		case "Under":
-			return testUnder(node.prefix, input)
-		case "And":
-			return Arr.every(node.conditions, (child) => testSync(child, input))
-		case "Or":
-			return Arr.some(node.conditions, (child) => testSync(child, input))
-		case "Not":
-			return !testSync(node.condition, input)
-		case "Predicate":
-			// The types stop this. A predicate needs `evaluate`.
-			throw new Error(
-				`The predicate "${node.name}" needs an Effect. Use Condition.evaluate.`,
-			)
 	}
+	return go
 }
 
+/** Tests a simple condition with no predicate on a value. */
+const testSync = (node: Node, input: Input): boolean =>
+	Trampoline.run(node.depth, (R) => testWith(input)(R)(node))
+
 /**
  * Tests a simple condition on a value. The children of `And` and `Or` run in
- * order, and they stop at the first child that gives the answer.
+ * order, and they stop at the first child that gives the answer. Each call
+ * for a child is a step of the Effect, so a deep condition does not fill the
+ * stack. A part with no predicate runs as a walk in the same loop.
  */
 const test = (
 	node: Node,
 	input: Input,
 ): Effect.Effect<boolean, unknown, unknown> => {
 	if (!node.opaque) {
-		return Effect.sync(() => testSync(node, input))
+		return node.depth <= Trampoline.directDepth
+			? Effect.sync(() => testSync(node, input))
+			: node.pipe(testWith(input)(Trampoline.loop), Trampoline.toEffect)
 	}
 	switch (node._tag) {
 		case "Predicate":
 			return Nodes.runOf(node)(input.value, input.principal)
 		case "Not":
-			return Effect.map(test(node.condition, input), (value) => !value)
+			return Effect.map(
+				Effect.suspend(() => test(node.condition, input)),
+				(value) => !value,
+			)
 		case "And":
 			return Effect.map(
 				Effect.findFirst(node.conditions, (child) =>
-					Effect.map(test(child, input), (value) => !value),
+					Effect.map(
+						Effect.suspend(() => test(child, input)),
+						(value) => !value,
+					),
 				),
 				Option.isNone,
 			)
 		case "Or":
 			return Effect.map(
-				Effect.findFirst(node.conditions, (child) => test(child, input)),
+				Effect.findFirst(node.conditions, (child) =>
+					Effect.suspend(() => test(child, input)),
+				),
 				Option.isSome,
 			)
 		default:
@@ -465,96 +554,126 @@ export interface PartialInput {
  * resource. The result is simple. It has no principal fields and no `Under`
  * nodes. A predicate keeps the principal.
  */
-export const partial = (node: Node, input: PartialInput): Node => {
-	const bind = (current: Node): Node => {
-		switch (current._tag) {
-			case "Compare": {
-				const value = bindOperand(current.value, input.principal)
-				return value === undefined
-					? never
-					: value === current.value
-						? current
-						: new Nodes.Compare({ op: current.op, field: current.field, value })
-			}
-			case "In": {
-				const values = Arr.flatMap(current.values, (operand) =>
-					Option.toArray(
-						Option.fromUndefinedOr(bindOperand(operand, input.principal)),
-					),
-				)
-				return values.length === 0
-					? never
-					: new Nodes.In({ field: current.field, values })
-			}
-			case "Under":
-				return expandUnder(current.prefix, input.principal, input.path)
-			case "And":
-				return and(Arr.map(current.conditions, bind))
-			case "Or":
-				return or(Arr.map(current.conditions, bind))
-			case "Not":
-				return current.condition.pipe(bind, not)
-			case "Predicate": {
-				const run = Nodes.runOf(current)
-				return new Nodes.Predicate({
-					name: current.name,
-					run: (value) => run(value, input.principal),
-				})
+export const partial = (node: Node, input: PartialInput): Node =>
+	Trampoline.run(node.depth, (R) => {
+		const bind = (current: Node): Step<Node> => {
+			switch (current._tag) {
+				case "Compare": {
+					const value = bindOperand(current.value, input.principal)
+					return R.succeed(
+						value === undefined
+							? never
+							: value === current.value
+								? current
+								: new Nodes.Compare({
+										op: current.op,
+										field: current.field,
+										value,
+									}),
+					)
+				}
+				case "In": {
+					const values = Arr.flatMap(current.values, (operand) =>
+						Option.toArray(
+							Option.fromUndefinedOr(bindOperand(operand, input.principal)),
+						),
+					)
+					return R.succeed(
+						values.length === 0
+							? never
+							: new Nodes.In({ field: current.field, values }),
+					)
+				}
+				case "Under":
+					return R.succeed(
+						expandUnder(current.prefix, input.principal, input.path),
+					)
+				case "And":
+					return R.map(eachChild(R, current.conditions, bind), and)
+				case "Or":
+					return R.map(eachChild(R, current.conditions, bind), or)
+				case "Not":
+					return R.map(
+						R.suspend(() => bind(current.condition)),
+						not,
+					)
+				case "Predicate": {
+					const run = Nodes.runOf(current)
+					return R.succeed(
+						new Nodes.Predicate({
+							name: current.name,
+							run: (value) => run(value, input.principal),
+						}),
+					)
+				}
+				default:
+					return R.succeed(current)
 			}
-			default:
-				return current
 		}
-	}
-	return bind(node)
-}
+		return bind(node)
+	})
 
 /** Gives the services in `context` to every predicate of a condition. */
-export const provide = (node: Node, context: Context.Context<never>): Node => {
-	if (!node.opaque) {
-		return node
-	}
-	switch (node._tag) {
-		case "Predicate": {
-			const run = Nodes.runOf(node)
-			return new Nodes.Predicate({
-				name: node.name,
-				run: (value, principal) =>
-					Effect.provideContext(run(value, principal), context),
-			})
+export const provide = (node: Node, context: Context.Context<never>): Node =>
+	Trampoline.run(node.depth, (R) => {
+		const go = (current: Node): Step<Node> => {
+			if (!current.opaque) {
+				return R.succeed(current)
+			}
+			switch (current._tag) {
+				case "Predicate": {
+					const run = Nodes.runOf(current)
+					return R.succeed(
+						new Nodes.Predicate({
+							name: current.name,
+							run: (value, principal) =>
+								Effect.provideContext(run(value, principal), context),
+						}),
+					)
+				}
+				case "And":
+					return R.map(
+						eachChild(R, current.conditions, go),
+						(children) => new Nodes.And(children),
+					)
+				case "Or":
+					return R.map(
+						eachChild(R, current.conditions, go),
+						(children) => new Nodes.Or(children),
+					)
+				case "Not":
+					return R.map(
+						R.suspend(() => go(current.condition)),
+						(child) => new Nodes.Not(child),
+					)
+				default:
+					return R.succeed(current)
+			}
 		}
-		case "And":
-			return new Nodes.And(
-				Arr.map(node.conditions, (child) => provide(child, context)),
-			)
-		case "Or":
-			return new Nodes.Or(
-				Arr.map(node.conditions, (child) => provide(child, context)),
-			)
-		case "Not":
-			return new Nodes.Not(provide(node.condition, context))
-		default:
-			return node
-	}
-}
+		return go(node)
+	})
 
 /** The fields that a condition tests, in the order that they first come. */
 export const fields = (node: Node): ReadonlyArray<string> => {
-	const all = (current: Node): ReadonlyArray<string> => {
-		switch (current._tag) {
-			case "Compare":
-			case "In":
-			case "Exists":
-				return [current.field]
-			case "And":
-			case "Or":
-				return Arr.flatMap(current.conditions, all)
-			case "Not":
-				return all(current.condition)
-			default:
-				return []
+	const all = Trampoline.run(node.depth, (R) => {
+		const go = (current: Node): Step<ReadonlyArray<string>> => {
+			switch (current._tag) {
+				case "Compare":
+				case "In":
+				case "Exists":
+					return R.succeed([current.field])
+				case "And":
+				case "Or":
+					return R.map(eachChild(R, current.conditions, go), Arr.flatten)
+				case "Not":
+					return R.suspend(() => go(current.condition))
+				default:
+					return R.succeed([])
+			}
 		}
-	}
+		return go(node)
+	})
 	// A native `Set`, as in `dedupe`: a field of a condition that is not bound
 	// to a domain may be any string.
-	return Array.from(new Set(all(node)))
+	return Array.from(new Set(all))
 }

package/src/internal/analysis.ts

@@ -51,6 +51,8 @@ interface Build {
 }
 
 const limit = (node: Nodes.Node): Ast => {
+	// A residual grows by its nodes, as the conditions of the rules come
+	// together. Its values come from the policy, which has a limit of them.
 	if (node.size > Limits.residualNodes) {
 		throw Limits.exceeded(
 			"A residual condition",
@@ -296,7 +298,7 @@ const scopeOf = (
 	const issues = Bind.ruleIssues(
 		domain,
 		{ actions: [request.action], resources: [request.kind], when: ast },
-		["within"],
+		() => ["within"],
 	)
 	if (issues.length > 0) {
 		throw new globalThis.Error(