@jwilleke/ngdpbase-types 5.39.0 → 5.41.0

package/lib/src/utils/privateStoreDoor.js

@@ -0,0 +1,298 @@
+/**
+ * The store door (#1414, epic #1382).
+ *
+ * A user's copy of a store kind is created when they first walk through its
+ * door — never at login and never mid-save. Decisions in
+ * docs/private-stores.md: "Recovery words: at first deliberate entry
+ * into the store", "The words are confirmed before anything is committed",
+ * "Core owns the door", "The door asks for the password when the user has no
+ * key", "`store.json` shape".
+ *
+ * This module holds what the door does, not how it is shown: which kinds
+ * exist, the words that are pending confirmation, and the commit. The route
+ * renders; nothing here touches HTTP.
+ *
+ * What exists only while the words screen is open lives in a process Map keyed
+ * by the session's private-store handle — never in express-session JSON, never
+ * logged, never in a record. Abandon the flow and nothing was written.
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import { createEncryptedStore, isSealedBytes, newRecoveryWords, sameMnemonic, unwrapDek } from './privateStoreCrypto.js';
+import { isSharedFolderOwner, isValidStoreId, privateStoreRoot, privateUserKeysPath, systemCategoryVaults, storeMetaPath } from './privateStorePath.js';
+import { readVaultSealState } from './privateStoreMeta.js';
+import { SYSTEM_CATEGORY_KEY } from './systemCategoryRules.js';
+import { listPrivateOwners } from './privateStoreTakeout.js';
+import { writeFileAtomic } from './atomicWrite.js';
+import { SECRET_FILE_MODE } from './secretFileMode.js';
+/** The site itself, as the owner of its own vault kinds; no add-on may claim it. */
+export const ADMIN_STORE_OWNER = 'admin';
+/**
+ * The kind named `id`, or `null` when no system-category declares that vault.
+ * `encrypt` is read as the boolean it is and nothing else (a string "true" is
+ * not a switch).
+ */
+export function storeKindFromConfig(getProperty, id) {
+    if (!isValidStoreId(id))
+        return null;
+    const categories = getProperty(SYSTEM_CATEGORY_KEY, null);
+    const vault = systemCategoryVaults(categories).find((v) => v.vaultId === id);
+    if (!vault)
+        return null;
+    const entry = categories[vault.key];
+    const owner = typeof entry?.owner === 'string' && entry.owner ? entry.owner : ADMIN_STORE_OWNER;
+    return { id, owner, encrypt: vault.encrypt };
+}
+export function storeDoorState(kind, ownerState) {
+    if (kind.owner === ADMIN_STORE_OWNER || ownerState === 'loaded')
+        return { open: true };
+    switch (ownerState) {
+        case 'failed':
+            return { open: false, reason: 'unavailable', message: 'This store is temporarily unavailable. Its data is untouched; try again later.' };
+        case 'disabled':
+            return { open: false, reason: 'disabled', message: 'The add-on that owns this store is turned off on this site. Its data is untouched.' };
+        default:
+            return { open: false, reason: 'not-installed', message: 'The add-on that owns this store is not installed on this site. Its data is untouched.' };
+    }
+}
+/** Every vault kind, by id: the vault each system-category declares (#1505). */
+export function storeKindIds(allProperties) {
+    return [...new Set(systemCategoryVaults(allProperties[SYSTEM_CATEGORY_KEY]).map((v) => v.vaultId))].sort();
+}
+/**
+ * How many users hold a copy of a kind: whose `store.json` for it exists.
+ * The copy is what the door creates, so this is "who has walked through".
+ */
+export async function countStoreCopies(pagesDirectory, kindId, layout) {
+    let copies = 0;
+    for (const owner of await listPrivateOwners(pagesDirectory, layout)) {
+        // #2125: the shared folders' container is the organization's, not a user holding a copy.
+        if (isSharedFolderOwner(owner))
+            continue;
+        if (await fs.pathExists(storeMetaPath(pagesDirectory, owner, kindId, layout)))
+            copies++;
+    }
+    return copies;
+}
+/**
+ * Every vault of a sealed kind that holds files in the clear (#1834): a folder
+ * with something in it but no `store.json` (written before its door was
+ * opened), or a `store.json` that is not sealed. Read only — nothing is moved,
+ * sealed or deleted; what to do with the files is an administrator's call.
+ */
+export async function findUnsealedVaults(pagesDirectory, layout) {
+    const found = [];
+    if (layout.sealedVaults.length === 0)
+        return found;
+    for (const owner of await listPrivateOwners(pagesDirectory, layout)) {
+        for (const vault of layout.sealedVaults) {
+            const root = privateStoreRoot(pagesDirectory, owner, vault, layout);
+            if (!await fs.pathExists(root))
+                continue;
+            const { state } = await readVaultSealState(pagesDirectory, owner, vault, layout);
+            if (state === 'mismatch')
+                found.push({ owner, vault, state });
+            else if (state === 'unopened' && (await fs.readdir(root)).length > 0)
+                found.push({ owner, vault, state });
+        }
+    }
+    return found;
+}
+/** The first bytes of a file — enough to see the sealed-file magic without reading the rest. */
+async function headOf(file) {
+    const handle = await fs.promises.open(file, 'r');
+    try {
+        const buf = Buffer.alloc(64);
+        const { bytesRead } = await handle.read(buf, 0, buf.length, 0);
+        return buf.subarray(0, bytesRead);
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Every sealed vault (its `store.json` says `encrypt: true`) that holds files
+ * in the clear (#1836): a page's history moved in with `fs.move`, an
+ * attachment adopted without its I/O, a backup restored from before the vault
+ * was sealed. A sealed file starts with the `sealBytes` magic, so each file's
+ * first bytes tell them apart without the key. `store.json` is the one file
+ * that is never sealed; an empty file holds nothing and is not counted.
+ *
+ * Read only — nothing is moved, sealed or deleted; what to do with the files
+ * is an administrator's call. Vaults that are not sealed at all are
+ * {@link findUnsealedVaults}'s.
+ */
+export async function findPlaintextInSealedVaults(pagesDirectory, layout) {
+    const found = [];
+    for (const owner of await listPrivateOwners(pagesDirectory, layout)) {
+        const userDir = path.join(pagesDirectory, layout.privateRoot, owner);
+        for (const ent of await fs.readdir(userDir, { withFileTypes: true })) {
+            if (!ent.isDirectory() || !isValidStoreId(ent.name))
+                continue;
+            const vault = ent.name;
+            let state;
+            try {
+                ({ state } = await readVaultSealState(pagesDirectory, owner, vault, layout));
+            }
+            catch {
+                continue; // an unreadable store.json is not a sealed one; not this check's to report
+            }
+            if (state !== 'sealed')
+                continue;
+            const root = privateStoreRoot(pagesDirectory, owner, vault, layout);
+            let files = 0;
+            const areas = new Set();
+            for (const f of await fs.readdir(root, { recursive: true, withFileTypes: true })) {
+                if (!f.isFile())
+                    continue;
+                const full = path.join(f.parentPath, f.name);
+                const rel = path.relative(root, full).split(path.sep);
+                if (rel.length === 1 && rel[0] === layout.files.storemeta)
+                    continue;
+                const head = await headOf(full);
+                if (head.length === 0 || isSealedBytes(head))
+                    continue;
+                files++;
+                areas.add(rel.length === 1 ? '.' : rel[0]);
+            }
+            if (files > 0)
+                found.push({ owner, vault, files, areas: [...areas].sort() });
+        }
+    }
+    return found;
+}
+/** Attempts at confirming the words: one, plus `ngdpbase.stores.recovery.confirmretries`. */
+export function confirmAttempts(getProperty) {
+    const retries = getProperty('ngdpbase.stores.recovery.confirmretries', 1);
+    return 1 + (typeof retries === 'number' && Number.isInteger(retries) && retries > 0 ? retries : 0);
+}
+/** Words not confirmed within this time are forgotten, as an abandoned tab is. */
+const PENDING_TTL_MS = 30 * 60 * 1000;
+const pending = new Map();
+function forget(handle) {
+    const entry = pending.get(handle);
+    if (entry)
+        entry.kek.fill(0);
+    pending.delete(handle);
+}
+function live(handle, username, store) {
+    const entry = pending.get(handle);
+    if (!entry)
+        return undefined;
+    if (Date.now() - entry.startedAt > PENDING_TTL_MS || entry.username !== username || entry.store !== store) {
+        forget(handle);
+        return undefined;
+    }
+    return entry;
+}
+/**
+ * Hold a new user KEK and its words while the user writes them down. Replaces
+ * anything this session had pending: starting over is always allowed.
+ */
+export function holdWordsForConfirmation(handle, args) {
+    forget(handle);
+    pending.set(handle, {
+        username: args.username,
+        store: args.store,
+        kek: Buffer.from(args.kek),
+        envelope: args.envelope,
+        mnemonic: args.mnemonic,
+        attemptsLeft: Math.max(1, args.attempts),
+        startedAt: Date.now()
+    });
+}
+/** Whether this session is part-way through the words screen for `store`. */
+export function hasPendingWords(handle, username, store) {
+    return live(handle, username, store) !== undefined;
+}
+/**
+ * The words this session is part-way through confirming for `store`, to
+ * download or print (#2144), or undefined: none, or they expired. Once
+ * confirmed or abandoned they are gone.
+ */
+export function pendingWordsOf(handle, username, store) {
+    const entry = live(handle, username, store);
+    return entry ? { words: entry.mnemonic.split(' '), madeAt: new Date(entry.startedAt), envelope: entry.envelope } : undefined;
+}
+/**
+ * Check the words the user typed back. A match hands over the KEK and envelope
+ * to commit and forgets the words. A miss discards the words it showed — they
+ * are never shown again — and, while attempts remain, makes a new set for the
+ * same uncommitted KEK. No attempts left: everything is forgotten and nothing
+ * was ever written.
+ */
+export function confirmWords(handle, username, store, entered) {
+    const entry = live(handle, username, store);
+    if (!entry)
+        return { status: 'none' };
+    if (sameMnemonic(entered, entry.mnemonic)) {
+        const kek = Buffer.from(entry.kek);
+        const envelope = entry.envelope;
+        forget(handle);
+        return { status: 'confirmed', kek, envelope };
+    }
+    entry.attemptsLeft -= 1;
+    if (entry.attemptsLeft <= 0) {
+        forget(handle);
+        return { status: 'exhausted' };
+    }
+    const fresh = newRecoveryWords(entry.kek);
+    entry.mnemonic = fresh.mnemonic;
+    entry.envelope = { ...entry.envelope, recoveryWrap: fresh.recoveryWrap };
+    return { status: 'retry', mnemonic: fresh.mnemonic, attemptsLeft: entry.attemptsLeft };
+}
+/** Logout, or a new login in this session: nothing pending survives it. */
+export function dropPendingWords(handle) {
+    forget(handle);
+}
+/** Test teardown only. */
+export function clearPendingWords() {
+    for (const handle of [...pending.keys()])
+        forget(handle);
+}
+async function writeExclusive(file, value) {
+    // An existing file is a refusal, never an overwrite: replacing a store.json
+    // loses the wrapped DEK — and with it every byte of the store. Atomic, owner
+    // only and flushed (#1625): a crash mid-write leaves no truncated key file.
+    await writeFileAtomic(file, JSON.stringify(value), 'utf8', { exclusive: true, mode: SECRET_FILE_MODE, fsync: true });
+}
+/** Whether `username` already has a copy of `store` — the door is then just a way in. */
+export async function storeCopyExists(args) {
+    return fs.pathExists(storeMetaPath(args.pagesDirectory, args.username, args.store, args.layout));
+}
+/** Whether `username` has a user KEK on disk. */
+export async function userKeysExist(args) {
+    return fs.pathExists(privateUserKeysPath(args.pagesDirectory, args.username, args.layout));
+}
+/**
+ * Write the user's copy of a store kind: `user-keys.json` first when this
+ * commit creates the user's KEK, then `store.json` — each written only if it
+ * does not exist yet. Returns the store DEK for a sealed copy, so the caller
+ * can put it in the session that walked through the door.
+ */
+export async function commitStoreCopy(args) {
+    const created = (args.now ?? new Date()).toISOString();
+    if (args.kind.encrypt && !args.kek)
+        throw new Error('encrypted store is locked: missing KEK');
+    const keysFile = privateUserKeysPath(args.pagesDirectory, args.username, args.layout);
+    if (args.newEnvelope)
+        await writeExclusive(keysFile, args.newEnvelope);
+    try {
+        const metaFile = storeMetaPath(args.pagesDirectory, args.username, args.kind.id, args.layout);
+        if (!args.kind.encrypt) {
+            const record = { kind: args.kind.id, encrypt: false, created };
+            await writeExclusive(metaFile, record);
+            return {};
+        }
+        const sealed = createEncryptedStore(args.kek);
+        const record = { kind: args.kind.id, encrypt: true, created, dekWrap: sealed.dekWrap };
+        await writeExclusive(metaFile, record);
+        return { dek: unwrapDek(args.kek, sealed) };
+    }
+    catch (err) {
+        // A key must never outlive the store it was made for: no orphan key.
+        if (args.newEnvelope)
+            await fs.remove(keysFile);
+        throw err;
+    }
+}

package/lib/src/utils/privateStoreImport.d.ts

@@ -46,13 +46,3 @@ export type ParsedTakeout = {
 };
 /** What a takeout's entries hold. */
 export declare function readTakeout(entries: readonly ZipEntry[]): ParsedTakeout;
-/** `body` with every `/attachments/{old}` link pointed at its new id. */
-export declare function rewriteAttachmentLinks(body: string, ids: ReadonlyMap<string, string>): string;
-/** Whether `body` links to the file `id`. */
-export declare function linksToAttachment(body: string, id: string): boolean;
-/**
- * The first free title of `title`, `title (imported)`, `title (imported 2)` …
- * (operator, 2026-09-25): a DIFFERENT page already holding the title keeps it,
- * and the import lands beside it.
- */
-export declare function freeImportTitle(title: string, isTaken: (candidate: string) => Promise<boolean>): Promise<string>;

package/lib/src/utils/privateStoreMeta.js

@@ -0,0 +1,123 @@
+/**
+ * Per-store encrypt flag on disk (#1384).
+ *
+ * Lives on `pages/vaults/{user}/{store}/store.json`, not on PageManager.
+ * Missing file = encrypt off (`default/` stays plaintext unless enabled).
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import logger from './logger.js';
+import { STORE_META_FILENAME, resolvePrivateStoreLayout, storeMetaPath, privateStoreRoot } from './privateStorePath.js';
+function looksLikeWrap(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const blob = value;
+    return typeof blob.iv === 'string' && typeof blob.tag === 'string' && typeof blob.ct === 'string';
+}
+export async function readStoreMeta(pagesDirectory, creator, store, layout) {
+    const file = storeMetaPath(pagesDirectory, creator, store, layout);
+    if (!await fs.pathExists(file))
+        return { encrypt: false };
+    const raw = await fs.readJson(file);
+    if (!raw || typeof raw !== 'object')
+        return { encrypt: false };
+    const rec = raw;
+    if (rec.encrypt === true) {
+        return {
+            encrypt: true,
+            dekWrap: looksLikeWrap(rec.dekWrap) ? rec.dekWrap : { iv: '', tag: '', ct: '' }
+        };
+    }
+    return { encrypt: false };
+}
+export function kindIsSealed(layout, store) {
+    return resolvePrivateStoreLayout(layout).sealedVaults.includes(store);
+}
+function sealStateOf(kindSealed, metaExists, encrypt) {
+    if (encrypt)
+        return 'sealed';
+    if (!kindSealed)
+        return 'plain';
+    return metaExists ? 'mismatch' : 'unopened';
+}
+/** {@link VaultSealState} of `owner`'s `store`, with the record that decided it. */
+export async function readVaultSealState(pagesDirectory, owner, store, layout) {
+    const kindSealed = kindIsSealed(layout, store);
+    const metaExists = await fs.pathExists(storeMetaPath(pagesDirectory, owner, store, layout));
+    let meta;
+    try {
+        meta = await readStoreMeta(pagesDirectory, owner, store, layout);
+    }
+    catch (err) {
+        // An unreadable store.json under a sealed kind is a vault that cannot be
+        // shown to be sealed: refused like any other mismatch, never plain.
+        if (!kindSealed)
+            throw err;
+        meta = { encrypt: false };
+    }
+    return { state: sealStateOf(kindSealed, metaExists, meta.encrypt), meta };
+}
+/** The synchronous form of {@link readVaultSealState}, for synchronous page lookups. */
+export function readVaultSealStateSync(pagesDirectory, owner, store, layout) {
+    const metaFile = storeMetaPath(pagesDirectory, owner, store, layout);
+    const metaExists = fs.existsSync(metaFile);
+    let encrypt = false;
+    if (metaExists) {
+        const meta = fs.readJsonSync(metaFile, { throws: false });
+        encrypt = meta?.encrypt === true;
+    }
+    return sealStateOf(kindIsSealed(layout, store), metaExists, encrypt);
+}
+/**
+ * A read or write refused because the vault's kind is sealed and the vault
+ * is not (#1834). Never answered with plain I/O: the bytes would be clear on
+ * disk under a kind that says they are sealed.
+ */
+export class SealedVaultRefusedError extends Error {
+    owner;
+    store;
+    reason;
+    code = 'sealed-vault-refused';
+    constructor(owner, store, reason) {
+        super(reason === 'unopened'
+            ? `Vault '${store}' is encrypted and has not been opened yet: open it at /stores/${store} first.`
+            : `Vault '${store}' should be encrypted, but its stored copy is not, so it stays closed until an administrator resolves it.`);
+        this.owner = owner;
+        this.store = store;
+        this.reason = reason;
+        this.name = 'SealedVaultRefusedError';
+    }
+}
+/**
+ * Throw {@link SealedVaultRefusedError} for a state that may not be read or
+ * written, logging it: an unopened vault is the owner's next step (warn), a
+ * mismatch is the site's configuration and its disk disagreeing (error).
+ * Names the owner and vault, never a page or its content.
+ */
+export function refuseUnsealedVault(owner, store, state) {
+    if (state === 'unopened') {
+        logger.warn(`[private-store] refused: ${owner}'s vault '${store}' is sealed by its kind but has not been opened (no store.json) — nothing written in the clear (#1834)`);
+        throw new SealedVaultRefusedError(owner, store, 'unopened');
+    }
+    if (state === 'mismatch') {
+        logger.error(`[private-store] refused: ${owner}'s vault '${store}' is sealed by its kind but its store.json is not sealed — not read or written (#1834)`);
+        throw new SealedVaultRefusedError(owner, store, 'mismatch');
+    }
+}
+/** True when `dir` is a store directory with encrypt on (`store.json`). */
+export async function storeDirectoryIsEncrypted(dir, metaFilename = STORE_META_FILENAME) {
+    const file = path.join(dir, metaFilename);
+    if (!await fs.pathExists(file))
+        return false;
+    try {
+        const raw = await fs.readJson(file);
+        return raw?.encrypt === true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function writeStoreMeta(pagesDirectory, creator, store, record, layout) {
+    await fs.ensureDir(privateStoreRoot(pagesDirectory, creator, store, layout));
+    await fs.writeJson(storeMetaPath(pagesDirectory, creator, store, layout), record);
+}

package/lib/src/utils/privateStorePath.d.ts

@@ -141,9 +141,45 @@ export interface PrivatePageName {
     store: string;
     title: string;
 }
+/**
+ * The organization's shared folders (#1775, #2125) are kept as one more
+ * container under the vaults' parent folder, owned by this reserved name
+ * rather than a user: `pages/vaults/shared-folders/{folder}/`, laid out as a
+ * vault is. So the page and file doors, the per-folder page, file and search
+ * indexes, history, trash, backup and every scanner that keeps vault content
+ * out of the shared indexes treat a folder exactly as they treat a vault.
+ * What differs is who may act (a permission, `shared-folder-read` /
+ * `shared-folder-file` on `shared/{folder}`, never the owner rule:
+ * `utils/sharedFolderAccess.ts`), where the key comes from (the server, by
+ * SharedFolderManager), and the name: `shared/{folder}/{title}`, which is
+ * also its URL. No account can be called this (`RESERVED_USERNAMES`).
+ */
+export declare const SHARED_FOLDER_OWNER = "shared-folders";
+/** A shared folder page's name, and its URL without the leading slash: `shared/{folder}/{title}`. */
+export declare const SHARED_PAGE_NAME_PREFIX = "shared/";
+/** The first path segment of a shared folder's URL: `/shared/{folder}/{title}`. */
+export declare const SHARED_URL_SEGMENT: string;
+/** True when `owner` is the shared folders' container, not a user's. */
+export declare function isSharedFolderOwner(owner: unknown): boolean;
 export declare function formatPrivatePageName(owner: string, store: string, title: string): string;
-/** The parts of a private page name, or null when `name` is not one. */
+/**
+ * The parts of a private page name, or null when `name` is not one. A shared
+ * folder's page, `shared/{folder}/{title}`, reads as the container
+ * {@link SHARED_FOLDER_OWNER}'s; `vaults/shared-folders/…` is not a name.
+ */
 export declare function parsePrivatePageName(name: unknown): PrivatePageName | null;
+/**
+ * A page's name for a log line (#1461, #2118, #2178): a private page's title
+ * stays out of logs, so it goes by its uuid, from its `metadata` — with its
+ * owner and store when its name holds them, and as "uuid unknown" before it
+ * has one. A private page saved under its bare title (#1520) is known only by
+ * its `metadata`. A public page goes by its name, and its uuid when known.
+ * The audit record is not a log line: it keeps the page's name.
+ */
+export declare function nameForLog(pageName: string, metadata?: {
+    private?: unknown;
+    uuid?: unknown;
+} | null): string;
 /**
  * The name a page an identifier opened is known by: its title — the
  * identifier may be a uuid or slug, and every downstream index is keyed by

package/lib/src/utils/privateStorePath.js

@@ -198,21 +198,78 @@ export const LEGACY_PRIVATE_ROOT = 'private';
  * from `private/` to `vaults/` in #1506.
  */
 export const PRIVATE_SLUG_PREFIX = 'vaults--';
+/**
+ * The organization's shared folders (#1775, #2125) are kept as one more
+ * container under the vaults' parent folder, owned by this reserved name
+ * rather than a user: `pages/vaults/shared-folders/{folder}/`, laid out as a
+ * vault is. So the page and file doors, the per-folder page, file and search
+ * indexes, history, trash, backup and every scanner that keeps vault content
+ * out of the shared indexes treat a folder exactly as they treat a vault.
+ * What differs is who may act (a permission, `shared-folder-read` /
+ * `shared-folder-file` on `shared/{folder}`, never the owner rule:
+ * `utils/sharedFolderAccess.ts`), where the key comes from (the server, by
+ * SharedFolderManager), and the name: `shared/{folder}/{title}`, which is
+ * also its URL. No account can be called this (`RESERVED_USERNAMES`).
+ */
+export const SHARED_FOLDER_OWNER = 'shared-folders';
+/** A shared folder page's name, and its URL without the leading slash: `shared/{folder}/{title}`. */
+export const SHARED_PAGE_NAME_PREFIX = 'shared/';
+/** The first path segment of a shared folder's URL: `/shared/{folder}/{title}`. */
+export const SHARED_URL_SEGMENT = SHARED_PAGE_NAME_PREFIX.slice(0, -1);
+/** True when `owner` is the shared folders' container, not a user's. */
+export function isSharedFolderOwner(owner) {
+    return owner === SHARED_FOLDER_OWNER;
+}
 export function formatPrivatePageName(owner, store, title) {
+    if (isSharedFolderOwner(owner))
+        return `${SHARED_PAGE_NAME_PREFIX}${store}/${title}`;
     return `${PRIVATE_PAGE_NAME_PREFIX}${owner}/${store}/${title}`;
 }
-/** The parts of a private page name, or null when `name` is not one. */
+/**
+ * The parts of a private page name, or null when `name` is not one. A shared
+ * folder's page, `shared/{folder}/{title}`, reads as the container
+ * {@link SHARED_FOLDER_OWNER}'s; `vaults/shared-folders/…` is not a name.
+ */
 export function parsePrivatePageName(name) {
-    if (typeof name !== 'string' || !name.startsWith(PRIVATE_PAGE_NAME_PREFIX))
+    if (typeof name !== 'string')
+        return null;
+    if (name.startsWith(SHARED_PAGE_NAME_PREFIX)) {
+        const parts = name.slice(SHARED_PAGE_NAME_PREFIX.length).split('/');
+        if (parts.length !== 2)
+            return null;
+        const [store, title] = parts;
+        if (!isValidStoreId(store) || !title.trim())
+            return null;
+        return { owner: SHARED_FOLDER_OWNER, store, title };
+    }
+    if (!name.startsWith(PRIVATE_PAGE_NAME_PREFIX))
         return null;
     const parts = name.slice(PRIVATE_PAGE_NAME_PREFIX.length).split('/');
     if (parts.length !== 3)
         return null;
     const [owner, store, title] = parts;
-    if (!owner || !isSafePathSegment(owner) || !isValidStoreId(store) || !title.trim())
+    if (!owner || !isSafePathSegment(owner) || isSharedFolderOwner(owner) || !isValidStoreId(store) || !title.trim())
         return null;
     return { owner, store, title };
 }
+/**
+ * A page's name for a log line (#1461, #2118, #2178): a private page's title
+ * stays out of logs, so it goes by its uuid, from its `metadata` — with its
+ * owner and store when its name holds them, and as "uuid unknown" before it
+ * has one. A private page saved under its bare title (#1520) is known only by
+ * its `metadata`. A public page goes by its name, and its uuid when known.
+ * The audit record is not a log line: it keeps the page's name.
+ */
+export function nameForLog(pageName, metadata) {
+    const uuid = typeof metadata?.uuid === 'string' && metadata.uuid ? metadata.uuid : null;
+    const byUuid = `(uuid ${uuid ?? 'unknown'})`;
+    const vault = parsePrivatePageName(pageName);
+    if (vault)
+        return `a page in ${vault.owner}'s store '${vault.store}' ${byUuid}`;
+    if (metadata?.private === true)
+        return `a private page ${byUuid}`;
+    return uuid ? `'${pageName}' ${byUuid}` : `'${pageName}'`;
+}
 /**
  * The name a page an identifier opened is known by: its title — the
  * identifier may be a uuid or slug, and every downstream index is keyed by