@wtfalch/authz-store 0.2.1 → 0.4.0

package/dist/policy-resources.js

@@ -0,0 +1,46 @@
+import { and, eq } from 'drizzle-orm';
+import { accessTeams } from './resource-schema.js';
+import { authzEvents } from './schema.js';
+import { isUuid } from './types.js';
+/** Authoritative resource metadata, shared by delegation and credential lineage evaluation. */
+export async function policyResource(tx, binding, organisationId, type, id) {
+    const base = {
+        applicationId: binding.applicationId,
+        platformId: binding.platformId,
+        organisationId,
+        type,
+        id,
+    };
+    if (type === 'team' && isUuid(id)) {
+        const [row] = await tx
+            .select({ id: accessTeams.id })
+            .from(accessTeams)
+            .where(and(eq(accessTeams.tenantId, organisationId), eq(accessTeams.id, id)))
+            .limit(1);
+        return row ? { ...base, teamId: id } : undefined;
+    }
+    if (type === 'audit' && /^\d{1,15}$/.test(id)) {
+        const [row] = await tx
+            .select({
+            teamId: authzEvents.teamId,
+            actorId: authzEvents.actorId,
+            actorClass: authzEvents.actorClass,
+            subjectId: authzEvents.subjectId,
+            subjectClass: authzEvents.subjectClass,
+        })
+            .from(authzEvents)
+            .where(and(eq(authzEvents.tenantId, organisationId), eq(authzEvents.tenantVisible, true), eq(authzEvents.id, Number(id))))
+            .limit(1);
+        if (!row)
+            return undefined;
+        return {
+            ...base,
+            teamId: row.teamId,
+            actor: { id: row.actorId, class: row.actorClass },
+            ...(row.subjectId && row.subjectClass
+                ? { subject: { id: row.subjectId, class: row.subjectClass } }
+                : {}),
+        };
+    }
+    return undefined;
+}

package/dist/policy-schema.d.ts

@@ -166,6 +166,7 @@ export declare const policyRoles: import("drizzle-orm/pg-core").PgTableWithColum
                 boundary: {
                     kind: "organisation";
                     organisationId: string;
+                    descendants?: boolean | undefined;
                 } | {
                     kind: "organisations";
                     organisationIds: string[];
@@ -204,6 +205,7 @@ export declare const policyRoles: import("drizzle-orm/pg-core").PgTableWithColum
                 boundary: {
                     kind: "organisation";
                     organisationId: string;
+                    descendants?: boolean | undefined;
                 } | {
                     kind: "organisations";
                     organisationIds: string[];
@@ -507,6 +509,7 @@ export declare const policyAssignments: import("drizzle-orm/pg-core").PgTableWit
             data: {
                 kind: "organisation";
                 organisationId: string;
+                descendants?: boolean | undefined;
             } | {
                 kind: "organisations";
                 organisationIds: string[];
@@ -527,6 +530,7 @@ export declare const policyAssignments: import("drizzle-orm/pg-core").PgTableWit
             $type: {
                 kind: "organisation";
                 organisationId: string;
+                descendants?: boolean | undefined;
             } | {
                 kind: "organisations";
                 organisationIds: string[];
@@ -684,6 +688,451 @@ export declare const policyAssignments: import("drizzle-orm/pg-core").PgTableWit
     };
     dialect: "pg";
 }>;
+/**
+ * A human principal's time-boxed request to exercise a subset of the
+ * ELEVATED permissions they are otherwise only eligible for (ADR 0016, "No
+ * standing authority"). Ported from Boule's `drizzle/0014_activations.sql`
+ * (authz#83 wave 11b, `migrations/0005_activations.sql` here);
+ * `authz_roles.updated_by` above and the `'activation'`
+ * `authz_assignments.source` value that same source file added are already
+ * in `0001_baseline.sql`, so only these two tables land in the new file.
+ */
+export declare const policyActivations: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "authz_activations";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        applicationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "application_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        platformId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "platform_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        principalId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "principal_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        principalClass: import("drizzle-orm/pg-core").PgColumn<{
+            name: "principal_class";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        permissions: import("drizzle-orm/pg-core").PgColumn<{
+            name: "permissions";
+            tableName: "authz_activations";
+            dataType: "array";
+            columnType: "PgArray";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: import("drizzle-orm").Column<{
+                name: "permissions";
+                tableName: "authz_activations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            baseBuilder: import("drizzle-orm/pg-core").PgColumnBuilder<{
+                name: "permissions";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                enumValues: [string, ...string[]];
+                driverParam: string;
+            }, {}, {}, import("drizzle-orm").ColumnBuilderExtraConfig>;
+            size: undefined;
+        }>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reference: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reference";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "requested_at";
+            tableName: "authz_activations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        startsAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "starts_at";
+            tableName: "authz_activations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "authz_activations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        roleId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        endedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ended_at";
+            tableName: "authz_activations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        endedBy: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ended_by";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+/**
+ * One row per decision on an activation, never edited -- the two-person
+ * approval and self-approve-after-wait counting is a host's own check, not a
+ * DB constraint (ADR 0016).
+ */
+export declare const policyActivationApprovals: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "authz_activation_approvals";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        activationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "activation_id";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        approverId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "approver_id";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        approverClass: import("drizzle-orm/pg-core").PgColumn<{
+            name: "approver_class";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        decision: import("drizzle-orm/pg-core").PgColumn<{
+            name: "decision";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        decidedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "decided_at";
+            tableName: "authz_activation_approvals";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 export declare const policyVersion: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "authz_policy_version";
     schema: undefined;

package/dist/policy-schema.js

@@ -46,6 +46,69 @@ export const policyAssignments = pgTable('authz_assignments', {
     index('authz_assignments_role_idx').on(t.tenantId, t.roleId),
     index('authz_assignments_team_idx').on(t.tenantId, t.teamId),
 ]);
+/**
+ * A human principal's time-boxed request to exercise a subset of the
+ * ELEVATED permissions they are otherwise only eligible for (ADR 0016, "No
+ * standing authority"). Ported from Boule's `drizzle/0014_activations.sql`
+ * (authz#83 wave 11b, `migrations/0005_activations.sql` here);
+ * `authz_roles.updated_by` above and the `'activation'`
+ * `authz_assignments.source` value that same source file added are already
+ * in `0001_baseline.sql`, so only these two tables land in the new file.
+ */
+export const policyActivations = pgTable('authz_activations', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    tenantId: uuid('tenant_id').notNull(),
+    applicationId: text('application_id').notNull(),
+    platformId: text('platform_id').notNull(),
+    // Agents and services can never open an activation (no inbox for the
+    // self-approve-wait email, nothing eligible to approve on their behalf),
+    // so unlike memberships.principal_id/authz_assignments.principal_id this
+    // is always a person.
+    principalId: text('principal_id').notNull(),
+    principalClass: text('principal_class').notNull(),
+    // The requested subset of what the principal is eligible for. Checked
+    // against a host's policy `elevated` set in code, not here: that set is
+    // a host's own catalogue data, not the database's.
+    permissions: text('permissions').array().notNull(),
+    reason: text('reason').notNull(),
+    reference: text('reference').notNull(),
+    status: text('status').notNull().default('pending'),
+    requestedAt: timestamp('requested_at', { withTimezone: true }).notNull().defaultNow(),
+    startsAt: timestamp('starts_at', { withTimezone: true }).notNull(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    // The non-primary authz_roles row minted with exactly the requested
+    // entries, the same indirection break_glass_sessions.role_id uses.
+    roleId: uuid('role_id').notNull(),
+    endedAt: timestamp('ended_at', { withTimezone: true }),
+    endedBy: text('ended_by'),
+}, (t) => [
+    // Full definition is partial (WHERE status = 'pending') in the shipped
+    // migration; this version of drizzle's table builder cannot express
+    // that predicate, the same gap `src/testing/database.ts` documents for
+    // `bg_active_idx` and the other non-unique partial indexes this package
+    // ships.
+    index('authz_activations_pending_idx').on(t.tenantId, t.principalId),
+    index('authz_activations_tenant_idx').on(t.tenantId, t.requestedAt.desc()),
+]);
+/**
+ * One row per decision on an activation, never edited -- the two-person
+ * approval and self-approve-after-wait counting is a host's own check, not a
+ * DB constraint (ADR 0016).
+ */
+export const policyActivationApprovals = pgTable('authz_activation_approvals', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    activationId: uuid('activation_id').notNull(),
+    // Same owner-column reasoning as policyActivations.principalId above: an
+    // approver is always a person.
+    approverId: text('approver_id').notNull(),
+    approverClass: text('approver_class').notNull(),
+    decision: text('decision').notNull(),
+    reason: text('reason'),
+    decidedAt: timestamp('decided_at', { withTimezone: true }).notNull().defaultNow(),
+}, (t) => [
+    index('authz_activation_approvals_activation_idx').on(t.activationId, t.decidedAt.desc()),
+    index('authz_activation_approvals_approver_idx').on(t.approverId),
+]);
 export const policyVersion = pgTable('authz_policy_version', {
     id: integer('id').primaryKey(),
     version: integer('version').notNull(),

package/dist/policy.d.ts

@@ -0,0 +1,71 @@
+import { type ResourcePermission, type ResourceRole, type TenantKind } from '@wtfalch/authz';
+import type { StoreBinding } from './binding.js';
+/** One `systemRoles[kind][key]` entry of a host's policy catalogue JSON. */
+export interface PolicyRoleTemplate {
+    readonly key: string;
+    readonly label: string;
+    readonly description: string;
+    readonly revision: number;
+    readonly guards: readonly string[];
+    readonly entries: readonly {
+        readonly permission: string;
+        readonly boundary?: string;
+        readonly scope?: unknown;
+        readonly relation?: string;
+    }[];
+}
+/**
+ * The shape a host's own `policy-catalogue.json` must have for `definePolicy` to build a
+ * `StorePolicy` from it. The store has no catalogue of its own — this is the host's data,
+ * typed so `definePolicy` can be generic over it.
+ */
+export interface PolicyData {
+    readonly permissions: Record<string, ResourcePermission>;
+    readonly defaultCeiling: readonly string[];
+    readonly maxDepth: number;
+    /** Partial: a host's JSON need not define a role set for every `TenantKind` (Boule's has none for `product`); asking for a missing kind throws. */
+    readonly systemRoles: Partial<Record<TenantKind, Record<string, PolicyRoleTemplate>>>;
+    /** ADR 0016: the permissions that are eligible, not standingly usable, by default. */
+    readonly elevated: readonly string[];
+    /** The subset of `elevated` a second person must also approve before it activates. */
+    readonly coApproval: readonly string[];
+}
+/**
+ * A `StoreBinding` plus everything a host's own `policy-catalogue.ts` used to export: the
+ * compiled catalogue, the built-in and starter role templates, and the ADR 0016 sets. Only
+ * `roles.ts` and `boot.ts` need the template methods; everywhere else a plain `StoreBinding`
+ * (which this also is) is enough.
+ */
+export interface StorePolicy extends StoreBinding {
+    readonly defaultCeiling: readonly string[];
+    readonly maxDepth: number;
+    /** ADR 0016: the permissions that are eligible, not standingly usable, by default. */
+    readonly elevated: ReadonlySet<string>;
+    /** The subset of `elevated` a second person must also approve before it activates. */
+    readonly requiresCoApproval: ReadonlySet<string>;
+    readonly offered: readonly string[];
+    /**
+     * ADR 0016: the only true built-in left is `self_service` — resynced on every boot. Every
+     * other `systemRoles` entry (`owner`, `admin`, `billing`, `member`) is a starter role, seeded
+     * once by `starterRoles` below, as an ordinary editable row nothing here resyncs again.
+     */
+    builtInRoles(organisationId: string, kind: TenantKind): Omit<ResourceRole, 'id'>[];
+    /** The starter role set a new tenant of this kind is seeded with once, at creation (ADR 0016). */
+    starterRoles(organisationId: string, kind: TenantKind): Omit<ResourceRole, 'id'>[];
+}
+/**
+ * Builds a `StorePolicy` from a host's own `policy-catalogue.json` data and its
+ * `{ applicationId, platformId }`. Generic over the host's data because every host's catalogue
+ * differs; this function is the one piece of that shape both applications wrote identically.
+ *
+ * `binding.hostEvents` (0.4.0), when given, is carried onto the returned `StorePolicy` unchanged
+ * so `record`/`recordAs`/`writeServiceEvent` can validate a host's own audit actions against it.
+ * A name in `hostEvents` that repeats a core event name is a configuration error — it would make
+ * an audit row ambiguous about which vocabulary it came from — so this throws rather than let it
+ * pass silently.
+ */
+export declare function definePolicy(data: PolicyData, binding: {
+    readonly applicationId: string;
+    readonly platformId: string;
+    readonly hostEvents?: readonly string[];
+}): StorePolicy;