@jwilleke/ngdpbase-types 5.41.1 → 5.43.0

package/lib/src/providers/NullAuditProvider.d.ts

@@ -0,0 +1,82 @@
+import BaseAuditProvider, { WikiEngine, AuditFilters, AuditSearchResults, AuditStats } from './BaseAuditProvider.js';
+import type { AuditReport } from './BaseAuditProvider.js';
+/**
+ * NullAuditProvider - No-op audit provider
+ *
+ * Used when auditing is disabled or for testing.
+ * All audit operations are no-ops that return immediately.
+ */
+declare class NullAuditProvider extends BaseAuditProvider {
+    /**
+     * Not chained (#1119): this provider stores nothing, so there is nothing to
+     * chain. A legitimate configuration rather than a hole — provided the
+     * instance cannot then claim tamper evidence, which is what
+     * getProviderInfo().guarantees reports.
+     */
+    protected chainEnabled(): boolean;
+    /** Nothing is stored, so nothing is guaranteed (#1119). */
+    getGuarantees(): AuditReport;
+    constructor(engine: WikiEngine);
+    /**
+     * Initialize the null audit provider (no-op)
+     * @returns {Promise<void>}
+     */
+    initialize(): Promise<void>;
+    /**
+     * Get provider information
+     * @returns {Object} Provider metadata
+     */
+    getProviderInfo(): {
+        name: string;
+        version: string;
+        description: string;
+        features: string[];
+    };
+    /**
+     * Log an audit event (no-op)
+     * @param {AuditEvent} _auditEvent - Audit event data
+     * @returns {Promise<string>} Dummy event ID
+     */
+    writeEvent(_record: Record<string, unknown>): Promise<string>;
+    /**
+     * Search audit logs (returns empty results)
+     * @param {AuditFilters} _filters - Search filters
+     * @param {Record<string, number>} options - Search options
+     * @returns {Promise<AuditSearchResults>} Empty search results
+     */
+    searchAuditLogs(_filters?: AuditFilters, options?: Record<string, number>): Promise<AuditSearchResults>;
+    /**
+     * Get audit statistics (returns zeros)
+     * @param {AuditFilters} _filters - Optional filters
+     * @returns {Promise<AuditStats>} Empty statistics
+     */
+    getAuditStats(_filters?: AuditFilters): Promise<AuditStats>;
+    /**
+     * Export audit logs (returns empty data)
+     * @param {AuditFilters} _filters - Export filters
+     * @param {string} format - Export format ('json', 'csv')
+     * @returns {Promise<string>} Empty export data
+     */
+    exportAuditLogs(_filters?: AuditFilters, format?: 'json' | 'csv'): Promise<string>;
+    /**
+     * Flush pending audit events (no-op)
+     * @returns {Promise<void>}
+     */
+    flush(): Promise<void>;
+    /**
+     * Clean up old audit logs (no-op)
+     * @returns {Promise<void>}
+     */
+    cleanup(): Promise<void>;
+    /**
+     * Check if the audit provider is healthy (always true)
+     * @returns {Promise<boolean>} Always true
+     */
+    isHealthy(): Promise<boolean>;
+    /**
+     * Close/cleanup the audit provider (no-op)
+     * @returns {Promise<void>}
+     */
+    close(): Promise<void>;
+}
+export default NullAuditProvider;

package/lib/src/providers/TotpAuthProvider.d.ts

@@ -0,0 +1,55 @@
+import type { AuthProvider, AuthResult, AuthVerifyCredentials, FactorDescription } from './BaseAuthProvider.js';
+import type { CredentialRecord } from './BaseCredentialsProvider.js';
+/** Steps either side of now that are accepted. */
+export declare const TOTP_DRIFT_STEPS = 1;
+/** The store access AuthManager grants: an account's TOTP rows, and recording a use. */
+export interface TotpStoreAccess {
+    rows(username: string): CredentialRecord[];
+    used(id: string, at: string, secret: string): Promise<void>;
+}
+/** A new seed, offered while enrolling and kept by the caller until it is confirmed. */
+export interface TotpEnrolment {
+    /** Base32, for typing into the app by hand. */
+    seed: string;
+    /** The `otpauth://` URI the QR code carries. */
+    uri: string;
+}
+/**
+ * The time step `code` belongs to within the drift window, or null. Pure; the
+ * caller decides about replay.
+ */
+export declare function matchingStep(seed: string, code: string, now: number): number | null;
+export declare class TotpAuthProvider implements AuthProvider {
+    private readonly credentialsKey;
+    private readonly issuer;
+    private readonly store;
+    private readonly now;
+    readonly id = "totp";
+    readonly displayName = "Authenticator app";
+    readonly factor: FactorDescription;
+    private readonly serial;
+    /**
+     * @param credentialsKey `NGDPBASE_CREDENTIALS_KEY`, from which the seed key is derived
+     * @param issuer         shown in the authenticator app beside the account
+     */
+    constructor(credentialsKey: string, issuer: string, store: TotpStoreAccess, now?: () => number);
+    /** A fresh 160-bit seed and its URI for `username`. Nothing is stored. */
+    newEnrolment(username: string): TotpEnrolment;
+    /**
+     * Seal a seed that is offered but not yet confirmed, so it can wait in the
+     * session without being readable there or in a session log (#421). Its own
+     * shape, so it never opens as a stored secret.
+     */
+    sealPending(username: string, seed: string): string;
+    /** Open what `sealPending` made for `username`; null when it is not that. */
+    openPending(username: string, sealed: unknown): string | null;
+    /**
+     * Check the code that confirms an enrolment and seal the seed for the store.
+     * The confirming code's step is recorded, so it cannot then sign anyone in.
+     * Null when the seed is malformed or the code does not match.
+     */
+    confirmEnrolment(username: string, seed: string, code: string): string | null;
+    /** Verify `credentials.code` for `credentials.username`. A failure gives no reason. */
+    verify(credentials: AuthVerifyCredentials): Promise<AuthResult | null>;
+    private open;
+}

package/lib/src/providers/TotpAuthProvider.js

@@ -0,0 +1,145 @@
+/**
+ * TOTP — an authenticator app's six-digit code (#421), on `otpauth` (decided
+ * on #1523, 2026-10-31).
+ *
+ * - A second factor only (`primary: false`): something you have, `amr`
+ *   `otp`, AAL1 on its own. After a password the sign-in covers two factor
+ *   types and AuthManager's `assess()` lifts it to AAL2. Not phishing-resistant.
+ * - The seed lives in the credentials store (#1524), kind `totp`, AES-GCM
+ *   encrypted under a subkey of `NGDPBASE_CREDENTIALS_KEY`
+ *   (`utils/totpSeedCipher`). The row's sealed secret also holds the last time
+ *   step used, so a code cannot be used twice in its window.
+ * - A code is accepted for the current 30-second step and one step either
+ *   side (RFC 6238 §5.2 drift), never for a step at or before the last one used.
+ * - Verification for one account runs one at a time, so two requests carrying
+ *   the same code cannot both pass before the step is recorded.
+ */
+import { Secret, TOTP, URI } from 'otpauth';
+import { openTotpSecret, sealTotpSecret } from '../utils/totpSeedCipher.js';
+import { KeyedSerial } from '../utils/keyedSerial.js';
+/** RFC 6238 defaults, which every authenticator app supports. */
+const PERIOD = 30;
+const DIGITS = 6;
+/** Steps either side of now that are accepted. */
+export const TOTP_DRIFT_STEPS = 1;
+function totpFor(seed, issuer = '', label = '') {
+    return new TOTP({ issuer, label, algorithm: 'SHA1', digits: DIGITS, period: PERIOD, secret: Secret.fromBase32(seed) });
+}
+function isCode(code) {
+    return typeof code === 'string' && /^\d{6}$/.test(code);
+}
+function currentStep(now) {
+    return Math.floor(now / 1000 / PERIOD);
+}
+/**
+ * The time step `code` belongs to within the drift window, or null. Pure; the
+ * caller decides about replay.
+ */
+export function matchingStep(seed, code, now) {
+    if (!isCode(code))
+        return null;
+    const delta = totpFor(seed).validate({ token: code, timestamp: now, window: TOTP_DRIFT_STEPS });
+    return delta === null ? null : currentStep(now) + delta;
+}
+export class TotpAuthProvider {
+    credentialsKey;
+    issuer;
+    store;
+    now;
+    id = 'totp';
+    displayName = 'Authenticator app';
+    factor = { amr: ['otp'], aal: 1, primary: false };
+    serial = new KeyedSerial();
+    /**
+     * @param credentialsKey `NGDPBASE_CREDENTIALS_KEY`, from which the seed key is derived
+     * @param issuer         shown in the authenticator app beside the account
+     */
+    constructor(credentialsKey, issuer, store, now = Date.now) {
+        this.credentialsKey = credentialsKey;
+        this.issuer = issuer;
+        this.store = store;
+        this.now = now;
+        if (!credentialsKey)
+            throw new Error('TOTP needs NGDPBASE_CREDENTIALS_KEY (#421)');
+    }
+    /** A fresh 160-bit seed and its URI for `username`. Nothing is stored. */
+    newEnrolment(username) {
+        const seed = new Secret({ size: 20 }).base32;
+        return { seed, uri: URI.stringify(totpFor(seed, this.issuer, username)) };
+    }
+    /**
+     * Seal a seed that is offered but not yet confirmed, so it can wait in the
+     * session without being readable there or in a session log (#421). Its own
+     * shape, so it never opens as a stored secret.
+     */
+    sealPending(username, seed) {
+        return sealTotpSecret(this.credentialsKey, username, JSON.stringify({ pendingSeed: seed }));
+    }
+    /** Open what `sealPending` made for `username`; null when it is not that. */
+    openPending(username, sealed) {
+        if (typeof sealed !== 'string')
+            return null;
+        const plain = openTotpSecret(this.credentialsKey, username, sealed);
+        if (!plain)
+            return null;
+        try {
+            const p = JSON.parse(plain);
+            return typeof p.pendingSeed === 'string' ? p.pendingSeed : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Check the code that confirms an enrolment and seal the seed for the store.
+     * The confirming code's step is recorded, so it cannot then sign anyone in.
+     * Null when the seed is malformed or the code does not match.
+     */
+    confirmEnrolment(username, seed, code) {
+        let step;
+        try {
+            step = matchingStep(seed, code, this.now());
+        }
+        catch {
+            return null; // not base32
+        }
+        if (step === null)
+            return null;
+        return sealTotpSecret(this.credentialsKey, username, JSON.stringify({ seed, lastStep: step }));
+    }
+    /** Verify `credentials.code` for `credentials.username`. A failure gives no reason. */
+    async verify(credentials) {
+        const { username, code } = credentials;
+        if (typeof username !== 'string' || !username || !isCode(code))
+            return null;
+        return this.serial.run(username, async () => {
+            const now = this.now();
+            for (const row of this.store.rows(username)) {
+                const secret = this.open(row);
+                if (!secret)
+                    continue;
+                const step = matchingStep(secret.seed, code, now);
+                if (step === null || step <= secret.lastStep)
+                    continue;
+                const next = sealTotpSecret(this.credentialsKey, username, JSON.stringify({ seed: secret.seed, lastStep: step }));
+                await this.store.used(row.id, new Date(now).toISOString(), next);
+                return { username };
+            }
+            return null;
+        });
+    }
+    open(row) {
+        if (row.kind !== 'totp')
+            return null;
+        const plain = openTotpSecret(this.credentialsKey, row.username, row.secret);
+        if (!plain)
+            return null;
+        try {
+            const s = JSON.parse(plain);
+            return typeof s.seed === 'string' && typeof s.lastStep === 'number' ? s : null;
+        }
+        catch {
+            return null;
+        }
+    }
+}

package/lib/src/security/PolicyDecisionPoint.d.ts

@@ -30,6 +30,8 @@ import { type RoleGrant } from '../utils/roleGrants.js';
 import { type ActorContext } from '../context/ActorContext.js';
 export declare const POLICIES_KEY = "ngdpbase.access.policies";
 export declare const POLICIES_ENABLED_KEY = "ngdpbase.access.policies.enabled";
+/** Whether an administrator may enter another person's unencrypted vault (#2255). */
+export declare const VAULTS_ADMIN_ACCESS_KEY = "ngdpbase.vaults.admin-access";
 /**
  * What `decide`, `permits` and `holds` take (#2022): the caller's own context
  * — a request's `PermissionSubject` or a job's `JobContext` — or a subject
@@ -256,7 +258,20 @@ export declare class PolicyDecisionPoint extends BaseManager {
      * own sign-in, once policy has said yes.
      */
     private proxyCeiling;
-    /** Does the named actor HOLD `action` (policy alone, live)? Step-up is the proxy subject's question, not theirs. */
+    /**
+     * Does the named actor HOLD the action (policy alone, live)? Step-up is the
+     * proxy subject's question, not theirs. Asked about the same page when the
+     * request names one (#2255), so an actor who may edit only some categories
+     * is asked about this page's.
+     *
+     * Inside a vault or a shared folder the actor is asked the bare capability,
+     * as before #2255 (#2267): the `vault` and `shared-folder` matchers assume
+     * the container rule proved the subject may be there, and for the actor it
+     * did not — the person represented passed it. Asked with the container, a
+     * reader actor would hold everything `vault-owner` holds in someone else's
+     * vault. The door (`permitsInVault`), the page door and the list filter all
+     * come through here, so they agree.
+     */
     private actorHolds;
     /**
      * Decide. The order is load-bearing:
@@ -277,5 +292,46 @@ export declare class PolicyDecisionPoint extends BaseManager {
     decide(subject: DecisionInput, request: DecisionRequest): Promise<Decision>;
     /** `decide`, with the step-up rule applied or not — {@link holds} is the only caller that leaves it out. */
     private evaluate;
+    /**
+     * The first declared system category on which the policies permit a page
+     * write (#2255, decision 10), or null. Asked once per category, so a deny
+     * on one still wins there. Owner conditions are unknown here (no page), so
+     * a grant that needs the author does not count. Only enabled categories
+     * that are not bound to a location count (#2268): `shared` is a shared
+     * folder's, decided with the folder, and every account holds `vault-owner`,
+     * so counting it would give a reader every page write as a capability.
+     */
+    private onSomeCategory;
+    /**
+     * Every system category the catalogue declares, core and add-ons, enabled
+     * or not, lowercased; with `inUse`, only those enabled and not bound to a
+     * shared folder (`storageLocation.sharedfolder`).
+     */
+    private declaredCategories;
+    /**
+     * May an administrator enter `owner`'s vault (#2255,
+     * `ngdpbase.vaults.admin-access`)? Asked only after the container rule has
+     * refused someone who is not the owner. Yes when all hold:
+     *
+     * - the key is true, read now, on every request (shipped true);
+     * - the caller is a signed-in session or a job, not a share link, a proxy
+     *   or an agent token;
+     * - the caller holds `admin-system`;
+     * - the vault is not encrypted: an encrypted vault always needs its key,
+     *   whatever the key says, so it is not entered at all.
+     *
+     * `record` true (a door) writes `vault-admin-access` with the administrator
+     * as the actor and the owner, vault and page named; an affordance passes
+     * false and records nothing. Lists and search never ask this, so an
+     * administrator does not see other people's vault pages listed.
+     */
+    adminMayEnterVault(ctx: ActorContext | null | undefined, owner: string, vault: string, resource: string, record?: boolean): Promise<boolean>;
+    /**
+     * The declared system categories on which an allow policy grants `action`
+     * through the `system-category` resource type (#2255). The sitemap asks it
+     * with `pushed-pages-edit` to leave pushed pages out. A summary of the
+     * policies, never an answer to "may this subject".
+     */
+    categoriesGranting(action: string): string[];
 }
 export default PolicyDecisionPoint;

package/lib/src/security/PolicyInformationPoint.d.ts

@@ -1,4 +1,5 @@
 import BaseManager from '../managers/BaseManager.js';
+import { type AalFacts } from '../utils/policyAttributes.js';
 import { type ActorContext } from '../context/ActorContext.js';
 import { WikiEngine } from '../types/WikiEngine.js';
 import type { AgentTokenGrant, ProxyClaim } from '../managers/UserManager.js';
@@ -52,6 +53,10 @@ interface UserContext {
  * form. They convert it themselves, through {@link asSubject}.
  */
 type PageQuestionCaller = ActorContext | UserContext | null | undefined;
+/** What a subject attribute is read from (#2261): who, and what bears on `subject:aal`. */
+export type SubjectFacts = AalFacts & {
+    username?: string;
+};
 /**
  * Access decision log entry
  */
@@ -61,8 +66,24 @@ interface AccessDecisionLog {
     action?: string;
     allowed?: boolean;
     reason?: string;
+    /** The policies that decided (#2255), recorded on a denial. */
+    policyIds?: string[];
+    /** Allows that matched but whose condition was not met (#2288), recorded on a denial. */
+    conditionNotMet?: string[];
     context?: Record<string, unknown>;
 }
+/**
+ * What the policies may read about a page (#2255), resolved by the PIP from
+ * the page itself. `attributes` holds what a resource type matches on
+ * (`system-category`), read eagerly; `read` answers a condition's
+ * `resource:<name>` for an attribute declared on the `page` resource type,
+ * lazily, so a lookup (the owner's account) is made only when a policy needs
+ * it. `undefined` is a missing attribute.
+ */
+export interface PageAttributes {
+    attributes: Record<string, unknown>;
+    read(name: string): unknown;
+}
 /**
  * PolicyInformationPoint — what a page decision needs to know about the page
  * (#1431; was ACLManager until step 8).
@@ -353,10 +374,12 @@ declare class PolicyInformationPoint extends BaseManager {
      *   Tier 1 is skipped for a vault page: `audience` grants nothing there.
      * - __Tier 0.5, author-lock__, `edit` only. It only denies: an author, or a
      *   subject holding `admin-system` (#1431 7b), falls through to Tier 1+.
-     * - __Tier 1, frontmatter__ `access[action]` / `audience`. Page-level, and
-     *   overrides global policy when it states a rule (#1054). An `audience`
-     *   covers every action, and a subject holding `admin-system` is its one
-     *   exception; `access` has none (#1964).
+     * - __Tier 1, frontmatter__ `audience`. Page-level, and decides a view
+     *   when it states a rule (#1054). An `audience` covers every action, and a
+     *   subject holding `admin-system` is its one exception (#1964). `access`
+     *   is no longer read (#2255).
+     * - A page in a shared folder is decided by the folder's permission, and a
+     *   change also by the `shared` category's policy and author-lock (#2255).
      * - __Tier 2.__ For a share visitor the share IS the policy (#1222); for
      *   anyone else, global policy.
      * - __Default deny.__ Nothing below Tier 2 grants — JSPWiki's page-body ACL
@@ -477,14 +500,65 @@ declare class PolicyInformationPoint extends BaseManager {
      */
     canUserAccessMediaItem(caller: PageQuestionCaller, item: MediaItem): Promise<boolean>;
     /**
-     * Check front matter audience / access fields (Tier 1).
+     * Check the front matter audience (Tier 1).
      * Returns a decision object; decided=false means no front matter restriction — fall through.
      *
      * An audience that leaves the subject out refuses every action, unless the
      * subject holds `admin-system` (#1964, operator 2026-10-23): asked only
-     * then. `access[action]` has no such exception.
+     * then. `access` is no longer read (#2255).
      */
     private checkFrontmatterAccess;
+    /**
+     * A page's attributes for the policies (#2255, XACML's PIP): the PDP asks
+     * this from the page id, so no route passes them. `knownMetadata` is the
+     * frontmatter when this PIP already holds it (the page door); otherwise the
+     * page is read with the caller's own context, so a sealed page stays closed
+     * to anyone without its key (#1422). A page that cannot be read has no
+     * attributes: no category policy matches it and every condition on it is
+     * unknown.
+     */
+    pageAttributes(caller: PageQuestionCaller, pageName: string, knownMetadata?: Record<string, unknown> | null): Promise<PageAttributes>;
+    /**
+     * {@link pageAttributes} from frontmatter already in hand (the list
+     * filter). Attributes are those declared on the `page` resource type in
+     * `ngdpbase.access.resource-types`, each read from its `from` source; the
+     * sources are code (`frontmatter:<field>` today).
+     *
+     * - `system-category` is lowercased; a page with none is in the default
+     *   category (the entry with `default: true`); a page in a shared folder is
+     *   `shared`, whatever its frontmatter says (#2255).
+     * - An `identity` attribute (`owner`, from `author`) is compared by the
+     *   account it names: an @id or a username not yet converted both read as
+     *   that account's username, an orphan as missing (#2097).
+     */
+    pageAttributesFrom(pageName: string, metadata: PageFrontmatter | null | undefined): PageAttributes;
+    /**
+     * A subject attribute a condition reads (#2255, #2261): `subject:<name>`,
+     * declared in `ngdpbase.access.subject-attributes` (`id` always is) and read
+     * from its `from` source here, the only place a subject attribute is read. A
+     * request cannot send one. Missing when it is not declared, cannot be read, or
+     * the subject has none (`subject:aal` of a visitor who is not signed in, of a
+     * token made before it was stored); the evaluator then fails closed. Returns
+     * the value, or a Promise of it for a field read from the account (the
+     * evaluator awaits every read).
+     */
+    subjectAttribute(subject: SubjectFacts | null | undefined, name: string): unknown;
+    /** One read of a declared subject attribute from its source. A value of the wrong type, or a source that throws, is missing. */
+    private readSubjectSource;
+    /** The page's category for the policies (#2255): lowercased; the default when it has none; `shared` in a shared folder. */
+    private pageCategory;
+    /** The attributes declared on the `page` resource type (#2255). */
+    private declaredPageAttributes;
+    /** An identity reference as the policies compare it: the username of the account it names, or missing (#2097). */
+    private identityValue;
+    /** Pages already warned about for an `access:` that is not the legacy stamp (#2255): once per page per process. */
+    private readonly warnedAccess;
+    /**
+     * `access:` frontmatter no longer has any effect (#2255). The stamp install
+     * wrote (`{ edit: [admin] }`) is left alone silently; any other value is
+     * someone's rule that is now ignored, so it is said once per page.
+     */
+    private warnLegacyAccess;
     /**
      * Does the page's `audience` admit this subject (#1964)? True when the page
      * names no audience, the subject matches it, or the subject holds
@@ -501,6 +575,12 @@ declare class PolicyInformationPoint extends BaseManager {
      * Accepts either a single object or positional args for backward compatibility.
      */
     logAccessDecision(userOrObj: UserContext | AccessDecisionLog, pageName?: string, action?: string, allowed?: boolean, reason?: string, _context?: Record<string, unknown>): void;
+    /**
+     * Record a page write a door refused on a capability alone (#2272): the
+     * route's `page-edit` / `page-create` check asks the PDP, which records
+     * nothing. Same record as every other page denial, `policyIds` included.
+     */
+    recordPageRefusal(subject: UserContext | null | undefined, pageName: string, action: string, reason: string, policyIds?: readonly string[], conditionNotMet?: readonly string[]): Promise<void>;
     /** The name a decision is recorded under: the subject's, or `anonymous`. */
     private static recordedUser;
     /**

package/lib/src/security/permissions.generated.d.ts

@@ -30,6 +30,8 @@ export type CorePermission =
  | 'identity-read'
 /** Browse and view the media library (not delegated to anonymous visitors) */
  | 'media-read'
+/** Set or change a page's system-category (#2255). A page created in a shared folder gets the shared category without it */
+ | 'page-categorize'
 /** Create new pages */
  | 'page-create'
 /** Delete pages */
@@ -50,6 +52,12 @@ export type CorePermission =
  | 'profile-manage'
 /** Let another person act for you, within permissions you hold, and revoke it (#1762). Every signed-in role except demo-admin; an administrator making or revoking a grant for someone else also needs user-edit, and that grant never carries a copy of the person's vault key. A grant that includes proxy-grant lets the proxy give others access too. Asks for a fresh sign-in */
  | 'proxy-grant'
+/** Delete pushed pages (#2255) */
+ | 'pushed-pages-delete'
+/** Edit pushed pages: pages shipped by the system or an add-on (the categories a policy grants it on; system, documentation and addon as shipped) (#2255) */
+ | 'pushed-pages-edit'
+/** Rename pushed pages (#2255) */
+ | 'pushed-pages-rename'
 /** Search pages */
  | 'search-page'
 /** Search users */

package/lib/src/types/Consent.d.ts

@@ -33,6 +33,15 @@ export declare const RECOVERY_WORDS_DOCUMENT = "recovery-words";
 export declare const SHARED_FOLDERS_WORDS_CONSENT_SCOPE = "shared-folders-recovery-words";
 /** The page whose `version:` is the version of the shared-folders recovery-words wording (#2124). */
 export declare const SHARED_FOLDERS_WORDS_DOCUMENT = "shared-folders-recovery-words";
+/**
+ * The scope of "Remember this browser" (#1523 slice 1c, Q5): a person's
+ * opt-in, at the second-factor step, to a device key on this browser that
+ * skips the second-factor prompt next time. Bound to a subject: the remembered
+ * device's id, so each browser is its own consent, withdrawn by removing it.
+ */
+export declare const REMEMBER_BROWSER_CONSENT_SCOPE = "remember-browser";
+/** The page whose `version:` is the version of the "Remember this browser" wording (#1523 slice 1c). */
+export declare const REMEMBER_BROWSER_DOCUMENT = "remember-browser";
 /** Core's scopes bound to a subject, each with its one document (#1928, #2124). */
 export declare const SUBJECT_CONSENT_DOCUMENTS: Readonly<Record<ConsentScope, string>>;
 /** Scopes whose acceptance is about one thing (a subject), not the account as a whole (#1928). */
@@ -61,17 +70,21 @@ export interface ConsentSeen {
     version: string;
 }
 /**
- * One acceptance, one line of the person's file. Append-only: a later
- * version is a later line, nothing is rewritten.
+ * One acceptance, or its withdrawal, one line of the person's file.
+ * Append-only: a later version is a later line, and a withdrawal is a later
+ * `withdraw` line naming the same document, version and subject; nothing is
+ * rewritten.
  */
 export interface ConsentRecord {
-    kind: 'accept';
+    kind: 'accept' | 'withdraw';
     document: string;
     scope: ConsentScope;
     version: string;
     effective: string | null;
-    /** ISO 8601 time the person accepted. */
+    /** ISO 8601 time the person accepted (on a `withdraw` line, of the acceptance withdrawn). */
     acceptedAt: string;
+    /** ISO 8601 time it was withdrawn; on a `withdraw` line only. */
+    withdrawnAt?: string;
     /**
      * The account this was accepted on, by its creation time (#1937): a later
      * account that takes the same username never inherits it.

package/lib/src/types/Consent.js

@@ -31,10 +31,20 @@ export const RECOVERY_WORDS_DOCUMENT = 'recovery-words';
 export const SHARED_FOLDERS_WORDS_CONSENT_SCOPE = 'shared-folders-recovery-words';
 /** The page whose `version:` is the version of the shared-folders recovery-words wording (#2124). */
 export const SHARED_FOLDERS_WORDS_DOCUMENT = 'shared-folders-recovery-words';
+/**
+ * The scope of "Remember this browser" (#1523 slice 1c, Q5): a person's
+ * opt-in, at the second-factor step, to a device key on this browser that
+ * skips the second-factor prompt next time. Bound to a subject: the remembered
+ * device's id, so each browser is its own consent, withdrawn by removing it.
+ */
+export const REMEMBER_BROWSER_CONSENT_SCOPE = 'remember-browser';
+/** The page whose `version:` is the version of the "Remember this browser" wording (#1523 slice 1c). */
+export const REMEMBER_BROWSER_DOCUMENT = 'remember-browser';
 /** Core's scopes bound to a subject, each with its one document (#1928, #2124). */
 export const SUBJECT_CONSENT_DOCUMENTS = {
     [RECOVERY_WORDS_CONSENT_SCOPE]: RECOVERY_WORDS_DOCUMENT,
-    [SHARED_FOLDERS_WORDS_CONSENT_SCOPE]: SHARED_FOLDERS_WORDS_DOCUMENT
+    [SHARED_FOLDERS_WORDS_CONSENT_SCOPE]: SHARED_FOLDERS_WORDS_DOCUMENT,
+    [REMEMBER_BROWSER_CONSENT_SCOPE]: REMEMBER_BROWSER_DOCUMENT
 };
 /** Scopes whose acceptance is about one thing (a subject), not the account as a whole (#1928). */
 export const SUBJECT_CONSENT_SCOPES = Object.keys(SUBJECT_CONSENT_DOCUMENTS);

package/lib/src/types/Page.d.ts

@@ -95,13 +95,6 @@ export interface PageFrontmatter {
      * in Slice E (v3.7.0). All datasets migrated; this field is the only source of truth.
      */
     private?: boolean;
-    /** Per-action principal lists — overrides audience for the named action */
-    access?: {
-        view?: string[];
-        edit?: string[];
-        delete?: string[];
-        [key: string]: string[] | undefined;
-    };
     /** Additional custom metadata */
     [key: string]: unknown;
 }