@jwilleke/ngdpbase-types 5.41.1 → 5.43.0

package/lib/src/managers/ConfigurationManager.d.ts

@@ -200,6 +200,21 @@ declare class ConfigurationManager extends BaseManager {
      * @throws {Error} If default configuration file cannot be loaded
      */
     private loadConfigurations;
+    /** What the #2255 page-write migration rewrote in memory, one sentence each; PolicyDecisionPoint reports it. */
+    pageWritePolicyMigration: string[];
+    /**
+     * #2255: before the merge, rewrite the custom layer's stored copies of the
+     * shipped role policies whose page writes moved to the category policies
+     * (`migrateStoredPageWritePolicies`). In memory only, like the other
+     * migrations here; one warning per policy changed.
+     */
+    private migrateStoredPageWritePolicies;
+    /**
+     * #2246: `ngdpbase.stores.<kind>.owner|encrypt` in the custom config have
+     * been ignored since #1505. One warning per key, and one needs-attention
+     * entry naming them all. Nothing is changed, carried over or removed.
+     */
+    private reportLegacyStoreKeys;
     /**
      * #642: One-shot migration shim. If the custom config sets either of the
      * legacy keys `ngdpbase.base-url` or `ngdpbase.baseURL`, copy the value

package/lib/src/managers/ConsentManager.d.ts

@@ -95,6 +95,8 @@ declare class ConsentManager extends BaseManager {
      * made on an earlier account of the same name is never theirs (#1937).
      */
     private recordsOf;
+    /** The acceptances still standing: each `accept` line with no later `withdraw` of the same document, version and subject. */
+    private standingOf;
     private accountOf;
     /**
      * The documents of `scope` that `username` has not accepted at their
@@ -134,6 +136,19 @@ declare class ConsentManager extends BaseManager {
      * @returns The records written; empty when there was nothing to accept
      */
     accept(ctx: ActorContext, scope: ConsentScope, seen: ConsentSeen[], how: string, subject?: string): Promise<ConsentRecord[]>;
+    /**
+     * Withdraw `username`'s acceptances in `scope` about `subject` (#1523 slice
+     * 1c, Q5: a remembered browser is withdrawn by removing it). Recorded first
+     * as `consent-withdraw` (on-failure refuse: nothing is withdrawn), then a
+     * `withdraw` line is appended for each acceptance, so the history keeps
+     * both. Called by the code that removed the thing the acceptance was
+     * about, which has already decided the caller may; nothing to withdraw is
+     * not an error.
+     *
+     * @param why Why, for the record: `removed`, `expired`, `password-changed`
+     * @returns The `withdraw` lines written
+     */
+    withdraw(username: string, scope: ConsentScope, subject: string, ctx: ActorContext, why: string): Promise<ConsentRecord[]>;
     /**
      * The account `username` was deleted (`AuthManager.closeAccess`): its
      * records go with it, after `consent-withdraw` names what it had accepted

package/lib/src/managers/ImportManager.d.ts

@@ -312,6 +312,10 @@ declare class ImportManager extends BaseManager {
     private readonly iceRuns;
     /** ICE (#2171): a rechecking run's store, as fingerprint → id, read once per run and store; dropped when the run ends. */
     private readonly storeHoldings;
+    /** ICE (#2188): what a run gives files back their ids with, by run and store; dropped when the run ends. */
+    private readonly storeRestoring;
+    /** ICE (#2171): the fingerprints of the files a rechecking run put back into a store, by run and store; dropped when the run ends. */
+    private readonly storeRestored;
     /** ICE: work waiting for the background job, each with its own context: an import run or an export (#2120). */
     private readonly iceQueue;
     /** ICE: true while a background job is draining the queue. */
@@ -701,6 +705,17 @@ declare class ImportManager extends BaseManager {
      * save door. Nothing here logs a page's or a file's name (#1461, #2110).
      */
     private receiveTakeoutEntry;
+    /**
+     * Point every page of the user's store `store` that links a file by an id
+     * in `ids` at the file's id now (#2188), through the page door. Only an id
+     * no store of the user's holds is repointed: a link that opens their own
+     * file, say one that moved to another of their stores keeping its id, is
+     * left. An id held only by the shared pool or someone else's store is not
+     * the page's file, so it is repointed.
+     * A page that cannot be saved is passed over and named in `failed`; the
+     * rest are still done. Pages are named by uuid, never by title.
+     */
+    private relinkStorePages;
     /** A takeout's page into the store, as #1472 decided: see {@link privateStoreReceiver}. */
     private saveTakeoutPage;
     /**

package/lib/src/managers/PageManager.d.ts

@@ -97,6 +97,26 @@ export interface PageSaveOptions {
      * doc says so.
      */
     preserveEditor?: boolean;
+    /**
+     * The user a NEW page is made for, by a system job (#1815): they become its
+     * author and editor, where a create otherwise takes both from the acting
+     * context. For the pages the system makes on a user's behalf — the profile
+     * page at sign-up, the new profile page of a rename — so the job's
+     * `page-create`, granted in policy, decides the write, and the page is
+     * still the user's (author-lock leaves it to them). Refused from any context
+     * but the system principal's job, and refused for a page that already
+     * exists (`PageWriteRefusedError`, `page-create`): the job never edits
+     * that page instead.
+     */
+    createdFor?: string;
+    /**
+     * The author of a page an add-on pushes (#2255): `addon:<slug>`. A new copy
+     * is authored by the add-on, and a copy seeded before #2255, authored by
+     * the system principal, is re-stamped with it. Taken only from the system
+     * principal's job and only in the `addon:<slug>` form; ignored otherwise.
+     * Any other author is kept, as on every edit.
+     */
+    shippedAuthor?: string;
     /**
      * Request-level detail the manager cannot see, for the audit record (#1121).
      *
@@ -199,11 +219,25 @@ export declare class PageAudienceRefusedError extends Error {
     readonly pageName: string;
     constructor(pageName: string);
 }
+/** The permission a page write is decided on (#1815). */
+export type PageWriteAction = 'page-create' | 'page-edit' | 'page-delete' | 'page-rename';
+/**
+ * A write refused by the write door (#1815): the context may not create,
+ * edit or delete this page, decided by policy, the page's own rules and the
+ * vault container rule. Nothing was written. Routes answer it with 403. The
+ * message names no page, so a private title never reaches a log (#2178).
+ */
+export declare class PageWriteRefusedError extends Error {
+    readonly pageName: string;
+    readonly action: PageWriteAction;
+    constructor(pageName: string, action: PageWriteAction);
+}
 export declare class PageContentValidationError extends Error {
     readonly validationErrors: FilterValidationError[];
     constructor(pageName: string, validationErrors: FilterValidationError[]);
 }
 import { type PageAction } from '../utils/pageUrl.js';
+import { type VaultSealState } from '../utils/privateStoreMeta.js';
 /** One vault page with data outside its vault (#1842), as the repair actions offer it. */
 export interface VaultRepairItem {
     owner: string;
@@ -261,6 +295,9 @@ export type VaultRepairResult = ({
 /** The move of existing captures into the capture vault (#1505), recorded per vault it moved them out of. */
 /** The refusal when someone without `admin-system` names a system-category (#1503, operator 2026-10-29). */
 export declare const SYSTEM_CATEGORY_ADMIN_ONLY = "Only administrators can set a page's system category";
+/** The system-category of a page in a shared folder (#2255): given when it is created there, by nothing else. */
+export declare const SHARED_CATEGORY = "shared";
+export declare const SHARED_CATEGORY_REFUSAL = "A page is in the shared system category only when it is created in a shared folder";
 /** What a write may give a page as its system-category ({@link PageManager.systemCategoryForWrite}). */
 export type SystemCategoryForWrite = {
     ok: true;
@@ -327,6 +364,11 @@ export interface ShippedPageSource {
     exclude?: (data: Record<string, unknown>) => string | undefined;
     /** Metadata the source adds to every page it writes (e.g. `addon`, a default category) */
     extraMetadata?: (data: Record<string, unknown>) => Record<string, unknown>;
+    /**
+     * The author of the pages it writes, for an add-on's (#2255): `addon:<slug>`
+     * (`SavePageOptions.shippedAuthor`). Absent, they are the system principal's.
+     */
+    author?: string;
     /**
      * Called by the boot seed for a source page this site already holds, with the
      * live page and the parsed source — the addon seed's metadata tidy-ups and
@@ -622,8 +664,10 @@ declare class PageManager extends BaseManager implements CatalogSource {
     private readShippedSystemCategories;
     /**
      * Which system-category a write by `ctx` gives a page (#1503, operator
-     * 2026-10-29): only an administrator (`admin-system`, asked of the PDP) sets
-     * or changes one. Anyone else's new page takes `fallback` (else the default
+     * 2026-10-29): only a holder of `page-categorize` (#2255; shipped to admin)
+     * sets or changes one. `shared` is set by nobody: a page created in a shared
+     * folder gets it at the write door (`savePage`), and a request naming it for
+     * any other page is refused, `page-categorize` or not. Anyone else's new page takes `fallback` (else the default
      * system-category) and an existing page keeps its own (`current`); a request
      * naming any other is refused, never rewritten. An administrator's request
      * comes back as given (`undefined` when it names none), for the caller's own
@@ -644,16 +688,10 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * taken for a shipped one. Shipped pages are admin-only and never private.
      */
     isShippedPageCopy(uuid: string): Promise<boolean>;
-    /**
-     * One-time access backfill for a live required page (#1411): a page with no
-     * `access` gets the default for its category, as a metadata-only save that
-     * keeps `lastModified`. A page that has any `access` — an operator's choice —
-     * is left alone.
-     */
-    private backfillShippedPageAccess;
     /**
      * The source for the pages an addon ships (#1406). Pages it writes carry
-     * `addon` and, when the source names none, the `addon` category (#931).
+     * `addon`, the add-on as author (`addon:<slug>`, #2255) and, when the source
+     * names none, the `addon` category (#931).
      *
      * @param addonName - The addon's name
      * @param pagesDir - The addon's `pages/` folder
@@ -926,6 +964,82 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * @throws when `ctx` may not file into the page's folder
      */
     private assertMayFileInSharedFolder;
+    /**
+     * May `ctx` edit or delete this existing page (#1815)? The page decision
+     * every route asks (`canUserAccessPage`), with the page's metadata, so the
+     * delegation ceilings, the vault container rule, author-lock, the page's own
+     * rules and policy all count, in that one evaluator. `record` false asks it
+     * as an affordance, which records nothing (#1668). Without a PIP nothing is
+     * writable.
+     */
+    private mayChangeExisting;
+    /**
+     * May `ctx` create a page at `destination` (#1815)? In a vault, the
+     * container rule and then `page-create` with the vault (`permitsInVault`;
+     * a shared folder by its own permission). A public page, `page-create`
+     * asked of the PDP about the page (#2255: the PDP reads its attributes from
+     * the PIP). The same rule as `hasPermissionOn`.
+     *
+     * @returns `permit`, and the `policyIds` of the `page-create` decision when
+     *   one was made (#2272); a vault page is decided by the container rule and
+     *   `permitsInVault`, which name none.
+     */
+    private decideCreateAt;
+    /**
+     * Where a save puts the page (#1815, decision 7): the private name the
+     * provider will store it under, or its public title. Read from the page's
+     * own `private` / `store` frontmatter, the rule the provider's placement
+     * follows: a private name stays private unless the save says
+     * `private: false`; a public title goes into a vault when it says
+     * `private: true`, the owner's and the store it names, else the vault the
+     * page is in now, else the default vault.
+     *
+     * @param owner - The username whose vault a public title would go into: the
+     *   page's author (for a new page, whoever it is made by or for)
+     */
+    private writeDestination;
+    /** The container a page name is in: its vault, or the public space. */
+    private static containerOf;
+    /**
+     * The write door's decision for a save (#1815, operator 2026-11-04). An
+     * existing page is edited only by a context the page decision lets edit it
+     * ({@link mayChangeExisting}); a page arriving in a container it is not in
+     * now — a new page, or a move into or out of a vault — is also created
+     * there ({@link decideCreateAt}). Whatever route the write came by: the route's
+     * own check is an early refusal, this is the one that counts.
+     *
+     * @throws PageWriteRefusedError when either is refused; nothing is written
+     */
+    private assertMaySave;
+    /**
+     * Record a refused `page-create` as `authorization-deny` (#1815, security
+     * review L1). The edit and delete refusals are recorded by the page
+     * decision (`canUserAccessPage`); a create is decided by the PDP, which
+     * records nothing, so the door records it here: core records every refusal.
+     * Standard tier, `continue` on failure: the refusal stands either way.
+     *
+     * @param policyIds - The policies of the `page-create` decision that refused
+     *   (#2272). Only a refusal that decision made passes any; one no policy
+     *   decided (`createdFor` misuse) leaves the field off the record.
+     * @param conditionNotMet - Allows of that decision that matched but whose condition was not met (#2288).
+     */
+    private recordCreateRefusal;
+    /** `shippedAuthor` when the system principal's job gives it in the `addon:<slug>` form (#2255); otherwise nothing. */
+    private shippedAuthorFor;
+    /** Is `ctx` a job of the system principal (#631) — the only context that may make a page for someone else (#1815)? */
+    private isSystemJob;
+    /** The username a page's stored author names (#2097), or null. */
+    private authorUsername;
+    /**
+     * Would `ctx` be allowed to edit this page — asked only to decide what to
+     * offer or report, never before writing it (#1815). The same decision as
+     * the write door, as an affordance: it records nothing (#1668). Saving still
+     * asks the door.
+     *
+     * @param identifier - Page UUID, title, slug or vault name
+     * @param ctx - Whose question this is — never defaulted
+     */
+    mayEditPage(identifier: string, ctx: ActorContext): Promise<boolean>;
     /**
      * Admin-override save (#689): the admin "Edit raw" textarea, split into
      * frontmatter and body and written through the door (#1462).
@@ -975,7 +1089,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * What a page stores for the user `name` (#2097): `IdentityManager.storedReferenceOf`.
      */
     private referenceTo;
-    /** `audience` and each `access[action]` of a save, user entries as {@link referenceTo} stores them (#2097). */
+    /** The `audience` of a save, user entries as {@link referenceTo} stores them (#2097). */
     private convertAccessListsForSave;
     /**
      * The frontmatter a save writes, from the frontmatter it was given (#1462).
@@ -994,6 +1108,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * @param actingUser - Who is writing this revision, from the context (#1164)
      * @param viaToken - The agent token this write came through (#946), if any
      * @param keepEditor - Leave the stored `editor` alone (`preserveEditor`, #1457)
+     * @param shippedAuthor - An add-on page's author (`shippedAuthor`, #2255), already checked
      * @returns The frontmatter to hand the provider
      */
     private normalizeSaveMetadata;
@@ -1009,7 +1124,9 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * `ctx` is mandatory and positional: the save acts as the caller's subject
      * (#1179), a private-store write reaches that session's keys through it
-     * (#1382), and the audit record names it. A caller forwards the context it
+     * (#1382), and the audit record names it. The write is decided here, for
+     * that context, before anything is written (#1815): `page-edit` on the page
+     * as it is, `page-create` where it is going when that is somewhere new. A caller forwards the context it
      * was given — a request's subject, or the job's for boot and scheduled
      * work — and never invents one.
      *
@@ -1020,6 +1137,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * @param options - Validation and conflict-check opt-outs, `rawFrontmatter` (#689),
      *   `preserveLastModified`, `preserveEditor` (#1457), audit enrichment
      * @returns Where the page landed, and what it was called before
+     * @throws PageWriteRefusedError when `ctx` may not make this write
      *
      * @example
      * await pageManager.savePage('New Page', '# Hello World', { 'user-keywords': ['tutorial'] }, req.userContext);
@@ -1110,6 +1228,26 @@ declare class PageManager extends BaseManager implements CatalogSource {
     }>>;
     /** The store ids the requester has of their own (#1387). */
     listOwnStoreIds(ctx: ActorContext): Promise<string[]>;
+    /**
+     * The requester's own vaults, each with its pages and whether it is
+     * encrypted (#2245), for `/my/vaults`.
+     *
+     * `state` is the vault's {@link VaultSealState} (#1834): `sealed` is
+     * encrypted, `plain` is not, and `unopened` or `mismatch` is a vault whose
+     * kind says it must be encrypted while its copy is not. `readable` is false
+     * for a vault this context cannot open, such as a sealed vault still
+     * locked: its pages are then unknown, not none.
+     */
+    listOwnVaults(ctx: ActorContext): Promise<Array<{
+        id: string;
+        state: VaultSealState;
+        readable: boolean;
+        pages: Array<{
+            name: string;
+            title: string;
+            uuid: string;
+        }>;
+    }>>;
     listOwnDeletedPrivatePages(ctx: ActorContext): Promise<StoreDeletedEntry[]>;
     /**
      * Bring one of the requester's private pages back from its store's trash
@@ -1233,14 +1371,25 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * and the context names who put it there. Afterwards the page is taken out
      * of every shared index, here and nowhere else (#1462).
      *
+     * The write door decides `page-delete` on the page first (#1815), and the
+     * delete is recorded as `page-delete` before it happens.
+     *
      * @param identifier - Page UUID, title, or slug
      * @param ctx - Who is acting (#1179)
+     * @param options - `audit.skip` when the caller already recorded this
+     *   delete; `audit.ipAddress`, the request's address, for the record
      * @returns True if deleted, false if not found
+     * @throws PageWriteRefusedError when `ctx` may not delete the page
      *
      * @example
      * const deleted = await pageManager.deletePage('Old Page', req.userContext);
      */
-    deletePage(identifier: string, ctx: ActorContext): Promise<boolean>;
+    deletePage(identifier: string, ctx: ActorContext, options?: {
+        audit?: {
+            skip?: boolean;
+            ipAddress?: string;
+        };
+    }): Promise<boolean>;
     /**
      * Delete the pages a test made (#2008): every shared page carrying the
      * `test-artifact` system keyword (#1355), and never a page without it.
@@ -1253,7 +1402,8 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * follow. One page's failure never stops the rest; it is reported.
      *
      * The caller decides who may ask: the sweep route asks `admin-system`, and
-     * an account delete has already been decided as `user-delete`. Private
+     * an account delete has already been decided as `user-delete` and sends a
+     * system job (#1815). Each delete is still decided by `deletePage`. Private
      * vault pages are not in the shared index, so they are not reached here.
      *
      * @param ctx - Who is acting; named in every record
@@ -1502,7 +1652,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
     private warnUnmatchableAddonAudience;
     /**
      * At startup, once add-ons have loaded (#1964): warn about every page whose
-     * `audience` or `access` names an add-on that can match nobody — unknown,
+     * `audience` names an add-on that can match nobody — unknown,
      * not per-person, or not loaded.
      *
      * @returns Each page and slug warned about
@@ -1617,8 +1767,10 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * `pages/vaults/{user}/` and every store below it is owned by that user.
      * Nobody else acts in it unless the owner delegated (a share the owner
-     * issued, once the store's Share switch exists — #1388). No role reaches in,
-     * admin included (security-posture P2: no `hasRole` as an allow).
+     * issued, once the store's Share switch exists — #1388). No role reaches in
+     * (security-posture P2: no `hasRole` as an allow); at a door, a holder of
+     * `admin-system` may enter an unencrypted vault when
+     * `ngdpbase.vaults.admin-access` is on (#2255), recorded each time.
      *
      * The owner is the one in the page's name (#1456), not frontmatter
      * `author`, so reassigning `author` cannot move ownership (#711).
@@ -1629,7 +1781,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *   - `false` — a private name, and the caller is neither — whether or not
      *               the page exists
      */
-    checkPrivatePageAccess(wikiContext: WikiContext, pageNameOrUuid: string): Promise<boolean | null>;
+    checkPrivatePageAccess(wikiContext: WikiContext, pageNameOrUuid: string, adminEntry?: 'record' | 'quiet' | 'none'): Promise<boolean | null>;
     /**
      * Owner and store of a private page, or `null` when the page is not private
      * or does not exist (#1398). The owner owns the page and every attachment
@@ -1686,6 +1838,15 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * Best-effort: a failure is logged and never blocks start-up. An encrypted
      * store is not readable here and is not touched — it migrates at its
      * owner's unlock, through {@link migratePrivateLinks}.
+     *
+     * #1815 (operator, 2026-11-04, decision 2): the public pages are the system
+     * principal's work; each user's vaults are a job on behalf of that user
+     * ({@link jobContextForOwner}), through the write door like any write. The
+     * vault container rule admits a job carrying its owner, and the owner's
+     * rights in their own vaults come from policy, resolved when each write is
+     * decided. The system principal is let into no vault. A shared folder is
+     * not a user's and opens to no boot job (its key never reaches one), so it
+     * is not visited.
      */
     migratePrivateLinksAtBoot(): Promise<void>;
     /**
@@ -1799,8 +1960,9 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * keeps its `lastModified` and `editor`, since nobody edited it. The audit
      * record is a rename, from the old path to the new.
      *
-     * Access is not decided here, as for every save: the caller has already
-     * been let into the page. A page is never moved out of an encrypted vault
+     * Access is decided by the save it makes, as for every write (#1815): an
+     * edit of the page where it is and a create in the vault it goes to. A
+     * page is never moved out of an encrypted vault
      * into one that is not, since that would write it in the clear.
      *
      * @param pageName - The page's private name, `vaults/{owner}/{vault}/{title}`
@@ -1823,7 +1985,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * @returns How many pages moved
      */
-    moveCapturesToCaptureVault(ctx: ActorContext): Promise<number>;
+    moveCapturesToCaptureVault(ctx: ActorContext, owner?: string): Promise<number>;
     /**
      * Move private pages made before #1505 into their system-category's own
      * vault (#1507). Until then every private page went to its owner's default
@@ -1838,7 +2000,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * @returns How many pages moved
      */
-    movePagesToCategoryVaults(ctx: ActorContext): Promise<number>;
+    movePagesToCategoryVaults(ctx: ActorContext, owner?: string): Promise<number>;
     /**
      * Every private slug in the `vaults--…` form (#1507), once per vault. A
      * private page's slug is made fresh on every save, so each page whose slug
@@ -1848,7 +2010,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * @returns How many pages were re-saved
      */
-    migratePrivateSlugs(ctx: ActorContext): Promise<number>;
+    migratePrivateSlugs(ctx: ActorContext, owner?: string): Promise<number>;
     /**
      * One pass of a vault move: every page in the vaults `ctx` can open is
      * offered to `pick`, which names the vault it goes to (and any frontmatter

package/lib/src/managers/PolicyEvaluator.d.ts

@@ -1,5 +1,6 @@
 import BaseManager from './BaseManager.js';
-import type { Policy, PolicySubject, PolicyResource } from '../types/Policy.js';
+import type { Policy, PolicySubject, PolicyResource, PolicyCondition } from '../types/Policy.js';
+import { type DeclaredSubjectAttribute } from '../utils/policyAttributes.js';
 import { WikiEngine } from '../types/WikiEngine.js';
 /**
  * User context for policy evaluation
@@ -17,15 +18,55 @@ interface UserContext {
  * PIP (#1504): today a page's `system-category`.
  */
 export type ResourceAttributes = Record<string, unknown>;
+/**
+ * Reads one attribute a condition names, `subject:id` or `resource:owner`
+ * (#2255). Supplied by the PDP from the PIP; `undefined` or `null` is a
+ * missing attribute. Asked only when a matching policy has a condition. A
+ * reader may be async (an identity is resolved through IdentityManager), and
+ * the evaluator awaits every read.
+ */
+export type AttributeReader = (name: string) => unknown | Promise<unknown>;
 /**
  * Access evaluation context
  */
 interface AccessContext {
     pageName: string;
+    /**
+     * The action asked. `actions` widens it: a policy granting any of them
+     * matches (#2255: a page write is `page-edit` or `pushed-pages-edit`).
+     */
     action: string;
+    actions?: readonly string[];
     userContext?: UserContext;
     attributes?: ResourceAttributes;
+    /** For a policy's `condition`; without one every condition is unknown. */
+    readAttribute?: AttributeReader;
 }
+/**
+ * What is wrong with a policy's condition, one sentence each (#2255, #2261);
+ * empty when it is fine. Each sentence says what is wrong, then what to
+ * change. A node is a comparison (`attribute` and one operator) or `any-of`,
+ * `all-of` or `not` over other conditions, nested at most
+ * {@link MAX_CONDITION_DEPTH} deep, at most {@link MAX_CONDITION_NODES} nodes
+ * in all, an `in` list of at most {@link MAX_IN_ITEMS} and an `any-of` or
+ * `all-of` of at most {@link MAX_GROUP_CHILDREN}. Each attribute a comparison names must be
+ * declared: a `subject:<name>` in `ngdpbase.access.subject-attributes`
+ * (`id` always, `aal` as shipped), or a `resource:<name>` declared on the `page`
+ * resource type. The types of the two sides must agree. A condition with a
+ * problem never holds: an allow with it does not apply and a deny with it
+ * does, as for a missing attribute.
+ */
+export declare function conditionProblems(condition: unknown, pageAttributes: Record<string, {
+    type?: string;
+}>, subjectAttributes?: Record<string, DeclaredSubjectAttribute>): string[];
+/**
+ * Is the condition true, false or unknown (#2255, #2261)? `true` or `false`,
+ * or `undefined` when it cannot be told because an attribute it reads is
+ * missing; the caller fails closed on that. Each node is judged on its own:
+ * a missing attribute makes its leaf unknown, a true branch decides `any-of`,
+ * a false branch decides `all-of`, and `not` of unknown is unknown.
+ */
+export declare function conditionHolds(condition: PolicyCondition | undefined, read: AttributeReader | undefined, depth?: number): Promise<boolean | undefined>;
 /**
  * How each policy resource type matches (#1504). The TYPES are declared in
  * configuration, `ngdpbase.access.resource-types`, and read through
@@ -40,7 +81,12 @@ export declare const RESOURCE_MATCHERS: Record<string, (pattern: string, pageNam
  * PolicyValidator accepts: a type with no matcher here would be a policy that
  * grants nothing.
  */
-export declare const SUBJECT_MATCHERS: Record<string, (value: string, userContext: UserContext | undefined) => boolean>;
+export declare const SUBJECT_MATCHERS: Record<string, (value: string | undefined, userContext: UserContext | undefined) => boolean>;
+/**
+ * The subject types that take no `value` (#2261), for the validator. A value
+ * on one is refused rather than ignored.
+ */
+export declare const VALUELESS_SUBJECT_TYPES: readonly string[];
 /**
  * The resource types configuration declares (#1504), for the evaluator and the
  * validator alike. When the key is not set at all — a configuration older than
@@ -56,14 +102,19 @@ interface EvaluationResult {
     allowed: boolean;
     reason: string;
     policyName: string | null;
+    /** The deciding policies' ids (#2255): the denies that matched, else the allows. Empty when none matched. */
+    policyIds: string[];
+    /** Allows that matched subject, resource and action but whose condition was false or unknown (#2288). Absent when none. */
+    conditionNotMet?: string[];
 }
 /**
  * PolicyEvaluator - Evaluates access policies against a given context.
  *
  * PolicyEvaluator mimics how JSPWiki uses Java's built-in security framework
  * (java.security) to load and evaluate security policies from a policy file.
- * It evaluates policies in priority order and returns the first matching policy's
- * decision.
+ * Among the policies that match, a deny overrides any allow whatever its
+ * priority, and no match is a deny (#2255). Each decision names the policies
+ * that decided it.
  *
  * @class PolicyEvaluator
  * @extends BaseManager
@@ -112,24 +163,35 @@ declare class PolicyEvaluator extends BaseManager {
      */
     initialize(): Promise<void>;
     /**
-     * Evaluates all relevant policies to make an access decision.
-     *
-     * Policies are evaluated in priority order (highest first). The first matching
-     * policy determines the access decision. If no policies match, access is denied.
-     *
-     * @async
-     * @param {AccessContext} context - The context of the access request
-     * @returns {Promise<EvaluationResult>} Evaluation result with decision and reason
+     * Say at boot what an administrator should look at in the policies after
+     * #2255, one warning each, and one needs-attention entry for them all:
+     * stored policies the upgrade rewrote, policies it left that now decide
+     * differently (a deny) or reach pushed pages, conditions that never hold,
+     * and stored categories no policy lets anyone change (their pages are
+     * changed by nobody, admin included).
+     */
+    private reportPageWritePolicies;
+    /**
+     * Evaluates all relevant policies to make an access decision (#2255).
      *
-     * @example
-     * const result = await evaluator.evaluateAccess({
-     *   pageName: 'AdminPanel',
-     *   action: 'page:edit',
-     *   userContext: { username: 'user', roles: ['editor'] }
-     * });
-     * console.log('Allowed:', result.allowed, 'Reason:', result.reason);
+     * Deny overrides allow: if any matching deny applies, the answer is deny,
+     * whatever the priorities; otherwise any matching allow permits; otherwise
+     * no policy decided. A policy with a `condition` applies only when it holds;
+     * an unknown condition (a missing attribute) keeps an allow from applying
+     * and lets a deny apply, so a missing attribute fails closed.
      */
     evaluateAccess(context: AccessContext): Promise<EvaluationResult>;
+    /**
+     * Checks and compiles each policy's condition (#2261). `compile()` does it
+     * once for a whole listing; a single decision does it for its few matches.
+     */
+    private prepare;
+    /**
+     * Deny overrides allow, over policies that already match subject, resource
+     * and action (#2255). Every matching deny whose condition is true or
+     * unknown decides; failing that, every allow whose condition is true.
+     */
+    private combine;
     /**
      * Checks if a single policy matches the given context.
      *
@@ -189,12 +251,25 @@ declare class PolicyEvaluator extends BaseManager {
      * `filter` shape, compiled once and applied to many resources.
      *
      * Policies that cannot match this subject or this action are dropped here,
-     * once; the predicate matches resources only, in the same order as
-     * `evaluateAccess` so first-match-wins gives the same answer. No log line
-     * per call: a listing asks this ~18k times, and the per-policy INFO line
-     * `evaluateAccess` writes is right for one decision and wrong for a filter.
+     * once; the predicate matches resources only and combines them exactly as
+     * `evaluateAccess` does (deny overrides allow, #2255), so a list and a
+     * single decision agree. No log line per call: a listing asks this ~18k
+     * times, and the INFO line `evaluateAccess` writes is right for one
+     * decision and wrong for a filter.
      */
-    compile(userContext: UserContext | undefined, action: string): (pageName: string, attributes?: ResourceAttributes) => EvaluationResult;
+    compile(userContext: UserContext | undefined, action: string, actions?: readonly string[]): (pageName: string, attributes?: ResourceAttributes, readAttribute?: AttributeReader) => Promise<EvaluationResult>;
+    /** The attributes declared on the `page` resource type (#2255), for checking a condition. */
+    declaredPageAttributes(): Record<string, {
+        type?: string;
+    }>;
+    /** The subject attributes a condition may read (#2261): `id` always, and those declared in `ngdpbase.access.subject-attributes`. */
+    declaredSubjectAttributes(): Record<string, DeclaredSubjectAttribute>;
+    /** Each policy in force whose condition has a problem, with the problems (#2255): for the boot warning. */
+    conditionProblemsInForce(): Array<{
+        id: string;
+        effect: Policy['effect'];
+        problems: string[];
+    }>;
     matchesResource(resources: PolicyResource[] | undefined, pageName: string, attributes?: ResourceAttributes): boolean;
     /**
      * Checks if the action matches the policy's actions.

package/lib/src/managers/ShareManager.d.ts

@@ -219,8 +219,9 @@ export default class ShareManager extends BaseManager {
      * True when a page must never appear in any share:
      *   - `private: true` (decision 1)
      *   - `owner-only` in user-keywords (decision 1)
-     *   - `audience` or per-action `access` frontmatter (decision 3 — a share
-     *     must not silently widen an author's chosen audience)
+     *   - `audience` frontmatter (decision 3 — a share must not silently widen
+     *     an author's chosen audience). A page's `access` field is not read
+     *     since #2255.
      */
     private isPageExcluded;
     /** Prepare and lock everything a link to an encrypted vault covers. `ownerCtx` must hold the vault's key. */