@jwilleke/ngdpbase-types 5.41.1 → 5.43.0

package/lib/src/types/Policy.d.ts

@@ -12,11 +12,12 @@
  * again because a `.d.ts` may not import a `.ts`. Four copies of one shape is
  * how a field gets added to one and missed in the others.
  */
-/** Who a policy grants to. The evaluator matches `role` and `job` (#1999), its `SUBJECT_MATCHERS`. */
+/** Who a policy grants to. The evaluator matches `role`, `job` (#1999), `authenticated` and `anyone` (#2261), its `SUBJECT_MATCHERS`. */
 export interface PolicySubject {
-    /** `role`, or `job` for a scheduled job acting as itself (#1999). */
+    /** `role`, `job` for a scheduled job acting as itself (#1999), or `authenticated` / `anyone` (#2261). */
     type: string;
-    value: string;
+    /** The role or the job id. `authenticated` and `anyone` take none. */
+    value?: string;
 }
 /**
  * What a policy covers.
@@ -28,6 +29,45 @@ export interface PolicyResource {
     type: string;
     pattern: string;
 }
+/**
+ * A comparison of one attribute with a value (#2255, #2261). A string starting
+ * `subject:`, `resource:` or `environment:` names an attribute; anything else
+ * is a literal. Exactly one operator key beside `attribute`:
+ * `equals`, `not-equals`, `in`, `greater-or-equal`, `less-or-equal`.
+ */
+export type LeafCondition = {
+    attribute: string;
+} & ({
+    equals: unknown;
+} | {
+    'not-equals': unknown;
+} | {
+    in: unknown[] | string;
+} | {
+    'greater-or-equal': number | string;
+} | {
+    'less-or-equal': number | string;
+});
+/**
+ * A policy's condition: a {@link LeafCondition}, or `any-of` / `all-of` /
+ * `not` over other conditions, nested at most 4 deep.
+ *
+ * Each node is true, false or unknown. A leaf reading an attribute that is
+ * missing is unknown; in `any-of` a true branch decides, in `all-of` a false
+ * one does, and `not` of unknown is unknown. An allow applies only when the
+ * condition is true; a deny applies when it is true or unknown.
+ */
+export type PolicyCondition = LeafCondition | {
+    'any-of': PolicyCondition[];
+} | {
+    'all-of': PolicyCondition[];
+} | {
+    not: PolicyCondition;
+};
+/** The prefixes that mark a condition value as an attribute rather than a literal (#2255). */
+export declare const ATTRIBUTE_CATEGORIES: readonly ["subject", "resource", "environment"];
+/** True when `value` names an attribute (`subject:id`, `resource:owner`), not a literal. */
+export declare function isAttributeName(value: unknown): value is string;
 /** One entry of `ngdpbase.access.policies`. */
 export interface Policy {
     id: string;
@@ -44,6 +84,8 @@ export interface Policy {
     subjects?: PolicySubject[];
     resources?: PolicyResource[];
     actions?: string[];
+    /** Applies only when this holds (#2255); see {@link PolicyCondition}. */
+    condition?: PolicyCondition;
     [key: string]: unknown;
 }
 /**
@@ -88,11 +130,18 @@ export interface DecisionRequest {
     action: string;
     resource?: DecisionResource;
     /**
-     * What the PIP knows about the resource beyond its reference, for the
-     * policy resource types that match on it (#1504): a page's
-     * `system-category`. The PDP passes it through; it never loads it.
+     * Where a page or file sits, for the resource types that match on it: the
+     * `vault` (#1539) or the `shared-folder` (#2125). A page's own attributes —
+     * its `system-category`, its `owner` — are never passed: the PDP asks the
+     * PIP for them from the page id (#2255).
      */
     attributes?: Record<string, unknown>;
+    /**
+     * The page's frontmatter when the PIP itself already holds it (the page
+     * door, the list filter), so the PDP's lookup reads no page twice. Only the
+     * PIP sets it; a route never does (#2255).
+     */
+    pageMetadata?: Record<string, unknown> | null;
     /**
      * Whether a share's `resources` cover the thing being asked about.
      *
@@ -128,6 +177,18 @@ export interface Decision {
      */
     applicable: boolean;
     reason: string;
+    /**
+     * The ids of the policies that decided (#2255): the denies that matched,
+     * or, when none did, the allows that matched. Empty when no policy matched
+     * or something other than policy decided (a ceiling, step-up).
+     */
+    policyIds: string[];
+    /**
+     * The ids of allow policies that matched subject, resource and action but
+     * whose condition was false or unknown (#2288), so a refusal can say which
+     * allow was not met. Ids only, never attribute values. Absent when none.
+     */
+    conditionNotMet?: string[];
 }
 /**
  * The reason a deny carries when the subject holds the permission but its

package/lib/src/types/Policy.js

@@ -1,4 +1,10 @@
 'use strict';
+/** The prefixes that mark a condition value as an attribute rather than a literal (#2255). */
+export const ATTRIBUTE_CATEGORIES = ['subject', 'resource', 'environment'];
+/** True when `value` names an attribute (`subject:id`, `resource:owner`), not a literal. */
+export function isAttributeName(value) {
+    return typeof value === 'string' && ATTRIBUTE_CATEGORIES.some((c) => value.startsWith(`${c}:`));
+}
 /**
  * The reason a deny carries when the subject holds the permission but its
  * sign-in is not fresh enough to act (#1635). Declared once: the PDP writes it

package/lib/src/types/Provider.d.ts

@@ -319,6 +319,18 @@ export interface PageProvider extends BaseProvider {
         reason: string;
         detail?: string;
     }>;
+    /**
+     * Where a trashed page would come back to, and its frontmatter, so the
+     * write door can decide the restore before it happens (#1815, security
+     * review L5): its title, or its vault name when it was deleted from a
+     * vault. Null when the uuid is not in the trash.
+     *
+     * @param uuid - Page UUID
+     */
+    deletedPageForRestore?(uuid: string): Promise<{
+        name: string;
+        metadata: PageFrontmatter;
+    } | null>;
     /**
      * Get all page titles
      * @returns Sorted array of page titles
@@ -630,6 +642,12 @@ export interface StoreFileInput {
     keptOriginal?: {
         types: readonly string[];
     };
+    /**
+     * The id to store the file under, set only by AttachmentManager for a file
+     * a takeout re-import brings back (#2188), after it checked that no other
+     * file anywhere holds it. A store that already lists the id refuses it.
+     */
+    id?: string;
 }
 /**
  * A page in a private store (#1456): its entry in the store's OWN page index,

package/lib/src/types/User.d.ts

@@ -56,6 +56,12 @@ export interface UserPreferences {
     /** Additional custom preferences */
     [key: string]: unknown;
 }
+/**
+ * The account fields whose change is recorded on `user-edit` with the field name
+ * only, and that a policy condition may never read as `account:` or `profile:`
+ * (#2261): the password, the email, the roles and the like.
+ */
+export declare const SENSITIVE_USER_FIELDS: readonly ["password", "roles", "isActive", "isExternal", "isTest", "email", "profileLocked", "username"];
 /**
  * User object
  *

package/lib/src/types/express.d.ts

@@ -40,6 +40,14 @@ declare module 'express-session' {
             purpose: 'register' | 'authenticate' | 'reauth';
             expires: number;
         };
+        /**
+         * #421: an authenticator-app seed offered on /profile/totp, until a code confirms it (10 minutes).
+         * Sealed for the account by `totpEnrolmentStart`; the plain seed never enters the session.
+         */
+        totpEnrolment?: {
+            pending: string;
+            expires: number;
+        };
         /** The step-up asked for and not yet given (#2145): its permission, where it returns, whether returning redoes it. */
         pendingStepUp?: PendingStepUp;
         /** The path whose next page view says "Confirmed — you can do it now" after a step-up (#2145). */
@@ -49,6 +57,20 @@ declare module 'express-session' {
         /** A sign-in waiting for its second factor: the handle, and where to go after (#1523). No identity yet. */
         pendingSignIn?: string;
         pendingRedirect?: string;
+        /**
+         * #1523 slice 1c: "Remember this browser" was ticked and a second factor
+         * completed the sign-in; the next page has the browser make its key. The
+         * version of the page the person was shown, the sign-in's amr, where to go
+         * after, until when (epoch ms), and the id of the sign-in's audit record,
+         * which the remembered row names. Single use.
+         */
+        rememberBrowser?: {
+            version: string;
+            amr: string[];
+            next: string;
+            until: number;
+            auditId?: string;
+        };
         /** A verified outside identity no account has connected, waiting for the person to sign in another way (#1743). */
         pendingConnection?: PendingConnection;
         /** #2073: an outside sign-in whose email several accounts share, waiting for the person to choose one. */

package/lib/src/utils/addonPageSync.d.ts

@@ -55,15 +55,3 @@ export interface SyncRowState {
  * @param userModifiedFlag - The live copy is explicitly marked edited
  */
 export declare function syncRowState(seedStatus: SeededAddonPageStatus, userModifiedFlag?: boolean): SyncRowState;
-/**
- * Default edit access for a page ngdpbase ships (#971, #1411): a `general`
- * page is instance-owned and gets no stamp; any other category — system,
- * documentation, addon, unclassified — is administrator-edit only. A source
- * that declares its own `access` overrides this.
- *
- * @param category - The page's resolved `system-category`
- * @returns The access object to stamp, or undefined to leave the page unprotected
- */
-export declare function defaultShippedPageAccess(category: unknown): {
-    edit: string[];
-} | undefined;

package/lib/src/utils/auditChain.d.ts

@@ -0,0 +1,83 @@
+/** `prevHash` of the first record in a chain. */
+export declare const GENESIS_HASH = "genesis";
+/**
+ * Hash a record in its position in the chain.
+ *
+ * `seq` and `prevHash` are part of the input, not just the payload — otherwise
+ * records could be reordered, or a record moved to a different predecessor,
+ * without breaking anything.
+ */
+export declare function hashRecord(record: Record<string, unknown>, seq: number, prevHash: string): string;
+/** Add `seq`, `prevHash` and `hash` to a record. Returns a new object. */
+export declare function stampRecord(record: Record<string, unknown>, seq: number, prevHash: string): Record<string, unknown>;
+/** Outcome of verifying a chain. `brokenAt` is the 1-based position, not the seq. */
+export interface ChainVerdict {
+    ok: boolean;
+    checked: number;
+    brokenAt?: number;
+    reason?: string;
+}
+/**
+ * Where a chain that does not begin at genesis begins (#1537): the sequence
+ * and hash of the last record before the first one present. A retention
+ * checkpoint holds exactly this for the records it removed, so what remains
+ * verifies from it rather than from genesis.
+ */
+export interface ChainStart {
+    seq: number;
+    hash: string;
+}
+/**
+ * Walk a chain in order and report the first break.
+ *
+ * @param records - Audit records, oldest first
+ * @param options.expectedHead - Hash the last record must have. Supplying it is
+ *   the only way to detect truncation: removing records from the end breaks no
+ *   link, so the chain alone cannot see it.
+ * @param options.start - The checkpoint the chain continues from (#1537). The
+ *   first record must then carry `start.seq + 1` and link to `start.hash`;
+ *   without it the first record must link to genesis.
+ */
+export declare function verifyChain(records: readonly Record<string, unknown>[], options?: {
+    expectedHead?: string;
+    start?: ChainStart;
+}): ChainVerdict;
+/** Event type of a record that declares a deliberate chain discontinuity (#1124). */
+export declare const CHAIN_RESTART_EVENT: "audit-chain-restart";
+/** One contiguous chain within a log. */
+export interface ChainSegment {
+    /** Index of the segment's first record in the input. */
+    startIndex: number;
+    verdict: ChainVerdict;
+    /** The restart marker that begins this segment, if it was started by one. */
+    restart?: Record<string, unknown>;
+    /** True when a break at the END of this segment is followed by a restart marker. */
+    explained: boolean;
+    /** True when this segment's marker names a previous head that does not match. */
+    mismatchedPrevious: boolean;
+}
+export interface LogVerdict {
+    ok: boolean;
+    segments: ChainSegment[];
+}
+/**
+ * Verify a log that may contain deliberate discontinuities (#1124).
+ *
+ * `verifyChain` answers "is this one chain intact", which is the right question
+ * for a chain and the wrong one for a log that has legitimately restarted — a
+ * migration, a restore, or a bug that wrote unverifiable records. Without this,
+ * one bad record leaves a log unverifiable forever and the only ways forward
+ * are dishonest: edit the log, delete it, or ignore the verifier.
+ *
+ * A break is __explained__ only when the very next record is a restart marker.
+ * That is what keeps the marker from being an escape hatch: an attacker who
+ * wants a clean chain must write a record saying they broke it, which is a
+ * confession rather than a cover-up.
+ *
+ * The marker's claimed `previousHash` is checked against the head it actually
+ * follows. A marker asserting a history that did not happen is itself a
+ * finding — otherwise a restart could claim anything.
+ */
+export declare function verifyLog(records: readonly Record<string, unknown>[], options?: {
+    start?: ChainStart;
+}): LogVerdict;

package/lib/src/utils/auditEventNames.generated.d.ts

@@ -224,6 +224,8 @@ export declare const AUDIT_EVENT: {
     readonly USER_EDIT: "user-edit";
     /** User profile read; not recorded, read volume */
     readonly USER_READ: "user-read";
+    /** An administrator read or changed a page inside another person's vault that is not encrypted (ngdpbase.vaults.admin-access, #2255): the administrator is the actor, and the vault's owner, the vault and the page are named */
+    readonly VAULT_ADMIN_ACCESS: "vault-admin-access";
     /** Not an action: read from a proxy grant at the vault door; the grant itself is recorded as proxy-grant */
     readonly VAULT_PROXY: "vault-proxy";
     /** A vault page's leftovers moved into its vault (#1842): its shared-pool files (moved, or copied where other public pages use them) and its footnotes and comments from the public folders. Names the owner, vault and page uuid and the counts, never a title or file name. Run by the vault's owner, or for a vault that isn't sealed by someone holding admin-system */

package/lib/src/utils/auditEventNames.generated.js

@@ -231,6 +231,8 @@ export const AUDIT_EVENT = {
     USER_EDIT: 'user-edit',
     /** User profile read; not recorded, read volume */
     USER_READ: 'user-read',
+    /** An administrator read or changed a page inside another person's vault that is not encrypted (ngdpbase.vaults.admin-access, #2255): the administrator is the actor, and the vault's owner, the vault and the page are named */
+    VAULT_ADMIN_ACCESS: 'vault-admin-access',
     /** Not an action: read from a proxy grant at the vault door; the grant itself is recorded as proxy-grant */
     VAULT_PROXY: 'vault-proxy',
     /** A vault page's leftovers moved into its vault (#1842): its shared-pool files (moved, or copied where other public pages use them) and its footnotes and comments from the public folders. Names the owner, vault and page uuid and the counts, never a title or file name. Run by the vault's owner, or for a vault that isn't sealed by someone holding admin-system */

package/lib/src/utils/auditEvents.d.ts

@@ -142,6 +142,8 @@ export interface TokenInput extends CommonInput {
     previousExpiresAt?: string;
     /** Only meaningful for `revoke`; ignored otherwise. */
     revokedBy?: string;
+    /** Only meaningful for `mint` (#2287): the sign-in level stored with the token; absent when it stored none. */
+    aal?: 1 | 2 | 3;
 }
 /**
  * What an attachment record says about the file. A file in an ENCRYPTED store

package/lib/src/utils/auditEvents.js

@@ -289,7 +289,7 @@ export async function recordAuditEvent(sink, event, onError) {
  * every event is useless as a filter.
  */
 export function buildTokenAuditEvent(input) {
-    const { op, id, owner, ownerUser, name, scopes, expiresAt, previousExpiresAt, revokedBy, viaToken } = input;
+    const { op, id, owner, ownerUser, name, scopes, expiresAt, previousExpiresAt, revokedBy, viaToken, aal } = input;
     const who = whoOf(input);
     const metadata = {
         id,
@@ -302,6 +302,8 @@ export function buildTokenAuditEvent(input) {
     if (op === 'mint') {
         metadata.scopes = [...(scopes ?? [])];
         metadata.expiresAt = expiresAt;
+        // #2287: the level the token holds, or null when it stored none; the record that answers "was this minted after a second factor?"
+        metadata.aal = aal ?? null;
     }
     if (op === 'extend') {
         metadata.previousExpiresAt = previousExpiresAt;

package/lib/src/utils/auditHeadWitness.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Off-box witness for the audit chain head (#1138).
+ *
+ * The chain detects alteration and deletion, and __cannot detect truncation of
+ * the tail__: removing records from the end breaks no link. That is also the
+ * attack an intruder actually wants — remove the record of what they just did.
+ * Everything before their session verifies perfectly, and the log ends looking
+ * like a clean shutdown.
+ *
+ * It cannot be fixed locally, for the reason #1119 made the chain functions
+ * pure: an attacker who owns the machine owns anything the machine wrote
+ * locally, including a head stored beside the log. __The head has to leave the
+ * box, or it is not evidence.__
+ *
+ * Three decisions from docs/security-posture.md shape what this does and does
+ * not do:
+ *
+ * - __D13__ — deployment methodology does not influence the design. This
+ *   publishes a head to a configured destination and takes no view on what that
+ *   destination is. Whether it is genuinely off-box is the operator's decision
+ *   and the operator's to state.
+ * - __D21__ — report facts, not a claim. There is deliberately no `offBox:
+ *   true` produced here. Nothing on this machine can verify that a path leaves
+ *   it, and asserting so would be the `durable` defect (#1148) repeated: a
+ *   boolean derived from something that does not establish it.
+ * - __D20__ — no scoring. A verdict says what is observably true of the records
+ *   and the witness, and stops there.
+ */
+/** What is published: one sequence number and one hash. Nothing else. */
+export interface ChainWitness {
+    seq: number;
+    hash: string;
+    /** Which instance the head belongs to, so one store can hold several. */
+    instance: string;
+    publishedAt: string;
+}
+/** The minimum of a stored record this assessment needs. */
+export interface ChainRecord {
+    seq?: number;
+    hash?: string;
+}
+export type WitnessVerdict = 
+/** The log is consistent with the witness. */
+'intact'
+/** The witness is ahead of the log: records were removed from the end. */
+ | 'truncated'
+/** The witnessed sequence is present with a different hash, or absent. */
+ | 'altered'
+/** No witness. NOT the same statement as "intact". */
+ | 'unknown';
+export interface WitnessAssessment {
+    verdict: WitnessVerdict;
+    /** How many records are missing from the end. Only meaningful when truncated. */
+    missing?: number;
+    reason?: string;
+}
+export interface BuildWitnessInput {
+    seq: number;
+    hash: string;
+    instance: string;
+    at: Date;
+}
+/**
+ * Build the record to publish.
+ *
+ * The head is one hash and one sequence number. Publishing more would put
+ * audit CONTENT wherever the witness lives, which is a different and much
+ * larger trust decision than publishing a fingerprint of it.
+ */
+export declare function buildWitness(input: BuildWitnessInput): ChainWitness;
+/**
+ * Is it time to publish again?
+ *
+ * The gap between publications is the window an attacker can truncate within,
+ * which makes the interval the actual security parameter — worth setting
+ * explicitly rather than inheriting.
+ *
+ * A zero or negative interval publishes every time rather than never: a
+ * misconfigured interval must fail toward more evidence, not toward silently
+ * disabling the witness.
+ */
+export declare function shouldPublish(lastPublishedAtMs: number | null, nowMs: number, intervalMs: number): boolean;
+/**
+ * Compare a published head against the records now on disk.
+ *
+ * The verdicts are kept distinct because an assessor needs the difference:
+ * truncation says records were removed, alteration says one was rewritten, and
+ * reporting both as "broken" loses what they would act on.
+ *
+ * `unknown` is never reported as `intact`. "Nothing is witnessing this log" and
+ * "this log is intact" are different statements, and deriving the second from
+ * the first is exactly the claim #1148 removed elsewhere.
+ */
+export declare function assessWitness(witness: ChainWitness | {
+    seq: number;
+    hash: string;
+} | null, records: readonly ChainRecord[]): WitnessAssessment;

package/lib/src/utils/auditLifecycle.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Process lifecycle as audit events (#1149).
+ *
+ * Nothing recorded that an instance started or stopped, so an unclean exit was
+ * undetectable from the log. That matters because of #1148: on an unclean exit
+ * the buffered audit records are lost, the chain resumes from the last WRITTEN
+ * record at boot, verification passes, and nothing shows anything is absent.
+ * The log does not lie about the records it holds — it simply cannot say that
+ * records are missing.
+ *
+ * A `system-start` with no `system-shutdown` before it says exactly that. It
+ * cannot recover the lost records; it marks the window in which records may be
+ * absent, which is the difference between an audit trail with a known gap and
+ * one that quietly appears complete.
+ */
+import type { AuditEvent } from './auditEvents.js';
+/** What the previous run's ending can be established to be. */
+export type PreviousRun = 
+/** A shutdown was recorded after the last start. */
+'clean'
+/** A start was recorded with no shutdown after it. Records may be missing. */
+ | 'unclean'
+/** No start on record — a first boot, or history beyond the log. */
+ | 'none'
+/** The records present cannot establish an ordering. */
+ | 'unknown';
+/** The minimum of a stored record this assessment needs. */
+export interface LifecycleRecord {
+    timestamp?: string;
+}
+/**
+ * Decide how the previous run ended, from the latest record of each phase.
+ *
+ * Deliberately conservative in three places, because the whole value of this
+ * is that it does not overclaim:
+ *
+ * - No start on record is `none`, not `unclean`. A first boot must not accuse
+ *   itself, or every new instance cries wolf and the signal stops being read.
+ * - A shutdown with no start is `unknown`, not `clean`. That is only reachable
+ *   through a truncated or rotated log, and concluding "clean" from half the
+ *   evidence is the failure this exists to prevent.
+ * - Equal timestamps are `unclean`. Same-millisecond records cannot establish
+ *   ordering, so the shutdown did not *demonstrably* follow the start.
+ */
+export declare function assessPreviousRun(lastStart: LifecycleRecord | null, lastShutdown: LifecycleRecord | null): PreviousRun;
+export interface LifecycleEventInput {
+    /** The system principal (#631). Falls back to the literal only where no UserManager answers. */
+    principal?: string;
+    phase: 'start' | 'shutdown';
+    /** The running version, so a restart is distinguishable from an upgrade. */
+    version: string;
+    pid: number;
+    /** Required on a start, meaningless on a shutdown. */
+    previousRun?: PreviousRun;
+    /**
+     * The transport the instance actually bound (#1153).
+     *
+     * "This instance is serving HTTP" is a security fact, and the log had no
+     * record of it — only the version and pid.
+     */
+    scheme?: 'http' | 'https';
+}
+/**
+ * Build the audit event for a process starting or stopping.
+ *
+ * `previousRun` appears on a start only, following the rule `page-rename` and
+ * `token-mint` already use: a field present on every event is useless as a
+ * filter. A shutdown is a statement about itself and makes no claim about the
+ * past.
+ */
+export declare function buildLifecycleAuditEvent(input: LifecycleEventInput): AuditEvent;

package/lib/src/utils/browserDescription.d.ts

@@ -9,3 +9,21 @@
  * Null when the header names neither a browser nor a device we know.
  */
 export declare function describeBrowser(userAgent: string | undefined): string | null;
+/**
+ * #1523 slice 1c — the browser and operating system a remembered browser's
+ * device key was issued to, from the User-Agent and the `Sec-CH-UA-Platform`
+ * client hint every Chromium browser sends. Families only ("Chrome",
+ * "Windows"), never versions, so an update keeps the browser remembered. No
+ * fingerprinting beyond what each request already carries (operator,
+ * 2026-10-04). Null when the browser or the system cannot be told: such a
+ * browser is never remembered.
+ */
+export interface BrowserIdentity {
+    browser: string;
+    os: string;
+    /** The `Sec-CH-UA-Platform` hint, unquoted; empty when the browser sent none. */
+    platform: string;
+}
+export declare function browserIdentity(userAgent: string | undefined, platformHint: string | undefined): BrowserIdentity | null;
+/** Whether two identities name the same browser on the same system, the hint included (both sent it, or neither). */
+export declare function sameBrowser(a: BrowserIdentity, b: BrowserIdentity): boolean;

package/lib/src/utils/browserDescription.js

@@ -26,3 +26,15 @@ export function describeBrowser(userAgent) {
         return `${browser} on ${device}`;
     return browser ?? device;
 }
+export function browserIdentity(userAgent, platformHint) {
+    const described = describeBrowser(userAgent);
+    const [browser, os] = described?.split(' on ') ?? [];
+    if (!browser || !os)
+        return null;
+    const platform = (platformHint ?? '').trim().replace(/^"|"$/g, '').slice(0, 40);
+    return { browser, os, platform };
+}
+/** Whether two identities name the same browser on the same system, the hint included (both sent it, or neither). */
+export function sameBrowser(a, b) {
+    return a.browser === b.browser && a.os === b.os && a.platform === b.platform;
+}

package/lib/src/utils/frontmatterAccess.d.ts

@@ -1,9 +1,11 @@
 /**
  * frontmatterAccess — the single implementation of ACL Tier 1 (#1054).
  *
- * A page's frontmatter can restrict who may act on it, via `access[<action>]`
- * or `audience`, which covers every action (#1964). Two subsystems needed
- * that answer and each had its own version of it, which is how they came to disagree:
+ * A page's frontmatter can restrict who may act on it with `audience`, which
+ * covers every action (#1964). The `access[<action>]` lists it once honoured
+ * were removed in #2255: what a user may do on a page is decided by its
+ * system-category and policy. Two subsystems needed the audience answer and
+ * each had its own version of it, which is how they came to disagree:
  *
  *   - `PolicyInformationPoint.checkFrontmatterAccess` decided a request, correctly.
  *   - `VersioningFileProvider.getRecentChanges` decided a listing, and only
@@ -20,8 +22,6 @@
  */
 /** The frontmatter fields Tier 1 reads. */
 export interface AccessMetadataLike {
-    /** `{ view: ['role'], edit: [...] }` — per-action principal lists. */
-    access?: unknown;
     /** Who may act on the page at all; administrators excepted (#1964). */
     audience?: unknown;
 }
@@ -39,11 +39,6 @@ export interface FrontmatterDecision {
  * neither read nor edit the page.
  */
 export declare function audiencePrincipals(metadata: AccessMetadataLike | null | undefined): string[] | null;
-/**
- * The page's `access[action]` list, or null when it states none. It applies
- * to that action only, and to everyone — administrators included.
- */
-export declare function accessPrincipals(metadata: AccessMetadataLike | null | undefined, action: string): string[] | null;
 /**
  * The entry `addon:<slug>` (#1964): "people who turned on the per-person
  * add-on <slug>". It is matched only against the viewer's enabled add-ons,
@@ -54,11 +49,10 @@ export declare const ADDON_PRINCIPAL_PREFIX = "addon:";
  * Whether deciding `action` on this page needs the viewer's enabled add-ons —
  * so a caller asks for them only when the page names one (#1964).
  */
-export declare function namesAddonPrincipal(metadata: AccessMetadataLike | null | undefined, action: string): boolean;
+export declare function namesAddonPrincipal(metadata: AccessMetadataLike | null | undefined, _action: string): boolean;
 /**
- * Every add-on slug the page names in `audience` or in any `access` list, once
- * each, in the order first named — for the warning about a slug that can match
- * nobody (#1964).
+ * Every add-on slug the page names in `audience`, once each, in the order
+ * first named — for the warning about a slug that can match nobody (#1964).
  */
 export declare function addonAudienceSlugs(metadata: AccessMetadataLike | null | undefined): string[];
 /**
@@ -75,16 +69,13 @@ export declare const AUDIENCE_ADMIN_MATCH = "admin-system";
  * plus their username. Callers holding a `UserContext` should pass
  * `[...roles, username]`; the provider layer already works in these terms.
  *
- * Two rules, in order (#1964, operator 2026-10-23):
- *
- * - __`audience`__ applies to every action. Someone it leaves out may neither
- *   read nor edit the page: every action is refused. The one exception is an
- *   administrator — a viewer holding `admin-system`, which the caller decides
- *   and passes as `isAdmin` (this module never reads a role for it). For
- *   `view`, a viewer the audience admits is allowed; for any other action it
- *   only lets them through to `access` and then policy.
- * - __`access[action]`__ applies to that action, to everyone, administrators
- *   included. When the page states it, it decides.
+ * `audience` applies to every action (#1964, operator 2026-10-23). Someone it
+ * leaves out may neither read nor edit the page: every action is refused. The
+ * one exception is an administrator — a viewer holding `admin-system`, which
+ * the caller decides and passes as `isAdmin` (this module never reads a role
+ * for it). For `view`, a viewer the audience admits is allowed; for any other
+ * action it only lets them through to policy. A page's `access` field is not
+ * read (#2255).
  *
  * An `addon:<slug>` entry matches only when `<slug>` is in `enabledAddons`,
  * the viewer's enabled per-person add-ons (#1964); a caller that does not

package/lib/src/utils/legacyStoreKeys.d.ts

@@ -0,0 +1,16 @@
+/** One leftover key and what to tell the operator about it. */
+export interface LegacyStoreKey {
+    key: string;
+    kind: string;
+    setting: 'owner' | 'encrypt';
+    /** One sentence: the key, that it has no effect, and what replaces it. */
+    message: string;
+}
+/**
+ * Every legacy per-kind key in the operator's custom config, in file order.
+ * `categories` is the merged `ngdpbase.system-category` map, used to name the
+ * entry that declares the kind's vault (the `default` vault is `general`'s).
+ */
+export declare function legacyStoreKeys(customConfig: Record<string, unknown> | null | undefined, categories: unknown): LegacyStoreKey[];
+/** The needs-attention reason for a non-empty list: every key, in one sentence. */
+export declare function legacyStoreKeysReason(found: LegacyStoreKey[]): string;