@jwilleke/ngdpbase-types 5.42.0 → 5.44.0

package/lib/src/managers/ExportManager.d.ts

@@ -10,17 +10,7 @@ export type { PdfOptions, PdfMargin, PdfPageSize } from '../export/pdfEngine.js'
  * when something asked for a PDF and could not have one; cleared by the next
  * render that works.
  */
-export declare const PDF_UNAVAILABLE_REASON = "PDF export unavailable: choose a PDF provider (local-chrome or chrome-service) in ngdpbase.export.pdf.provider, or fix the one chosen (the server log says why)";
-/**
- * Export file metadata interface
- */
-export interface ExportFileInfo {
-    filename: string;
-    path: string;
-    size: number;
-    created: Date;
-    modified: Date;
-}
+export declare const PDF_UNAVAILABLE_REASON = "PDFs can't be made right now. Choose how PDFs are made in the settings, or fix the one already chosen.";
 /**
  * Export configuration interface
  */
@@ -146,13 +136,6 @@ declare class ExportManager extends BaseManager {
      * @returns {Promise<void>}
      */
     initialize(config?: ExportConfig): Promise<void>;
-    /**
-     * Export a single page to HTML
-     * @param {string} pageName - Page name to export
-     * @param {ExportUser|null} user - User object for locale-aware formatting
-     * @returns {Promise<string>} HTML content
-     */
-    exportPageToHtml(pageName: string, ctx: ActorContext, user?: ExportUser | null): Promise<string>;
     /**
      * One page as a complete HTML document: its content rendered, with the
      * export's styling and metadata footer. It reads nothing: the caller has
@@ -171,32 +154,6 @@ declare class ExportManager extends BaseManager {
      * @returns {Promise<string>} Combined HTML content
      */
     exportPagesToHtml(pageNames: string[], ctx: ActorContext, user?: ExportUser | null): Promise<string>;
-    /**
-     * Export page(s) to markdown
-     * @param {string|string[]} pageNames - Single page name or array of page names
-     * @param {ExportUser|null} user - User object for locale-aware formatting
-     * @returns {Promise<string>} Markdown content
-     */
-    exportToMarkdown(pageNames: string | string[], ctx: ActorContext, user?: ExportUser | null): Promise<string>;
-    /**
-     * Save export to file
-     * @param {string} content - Content to save
-     * @param {string} filename - Filename
-     * @param {string} format - File format
-     * @returns {Promise<string>} File path
-     */
-    saveExport(content: string, filename: string, format: string): Promise<string>;
-    /**
-     * Get list of available exports
-     * @returns {Promise<ExportFileInfo[]>} List of export files
-     */
-    getExports(): Promise<ExportFileInfo[]>;
-    /**
-     * Delete an export file
-     * @param {string} filename - Export filename
-     * @returns {Promise<void>}
-     */
-    deleteExport(filename: string): Promise<void>;
     /**
      * Get formatted timestamp using user's locale
      * @param {ExportUser|null} user - User object (optional)

package/lib/src/managers/ExportManager.js

@@ -1,6 +1,5 @@
 import BaseManager from './BaseManager.js';
 import fs from 'fs/promises';
-import path from 'path';
 import LocaleUtils from '../utils/LocaleUtils.js';
 import logger from '../utils/logger.js';
 import { actorOf } from '../context/ActorContext.js';
@@ -15,7 +14,7 @@ export { PdfUnavailableError };
  * when something asked for a PDF and could not have one; cleared by the next
  * render that works.
  */
-export const PDF_UNAVAILABLE_REASON = 'PDF export unavailable: choose a PDF provider (local-chrome or chrome-service) in ngdpbase.export.pdf.provider, or fix the one chosen (the server log says why)';
+export const PDF_UNAVAILABLE_REASON = "PDFs can't be made right now. Choose how PDFs are made in the settings, or fix the one already chosen.";
 /** Shipped defaults of the `ngdpbase.export.pdf.*` keys. */
 const PDF_DEFAULTS = { provider: 'none', pageSize: 'Letter', timeoutMs: 30_000, maxConcurrent: 2, serviceMaxBytes: 52_428_800 };
 /**
@@ -34,7 +33,7 @@ const PDF_DEFAULTS = { provider: 'none', pageSize: 'Letter', timeoutMs: 30_000,
  *
  * @example
  * const exportManager = engine.getManager('ExportManager');
- * const html = await exportManager.exportPageToHtml('Main');
+ * const csv = exportManager.toCsv(['name'], [['Main']]);
  */
 /** A text cell starting with one of these runs as a spreadsheet formula. */
 const CSV_FORMULA_START = /^[=+\-@\t\r]/;
@@ -229,7 +228,7 @@ class ExportManager extends BaseManager {
         this.exportDirectory = config.exportDirectory
             || this.engine.getManager('ConfigurationManager')?.getResolvedDataPath('ngdpbase.directories.exports', '${FAST_STORAGE}/exports')
             || './exports';
-        const preflight = this.preflightConfiguredPath('exportDirectory', this.exportDirectory);
+        const preflight = this.preflightConfiguredPath('ngdpbase.directories.exports', this.exportDirectory);
         if (!preflight.ok) {
             this.exportDirectory = '';
             logger.info('ExportManager initialized (degraded — exports disabled)');
@@ -240,24 +239,6 @@ class ExportManager extends BaseManager {
         const pdfProviderName = this.engine.getManager('ConfigurationManager')?.getProperty('ngdpbase.export.pdf.provider', PDF_DEFAULTS.provider);
         logger.info(`ExportManager initialized (PDF provider: ${pdfProviderName ?? PDF_DEFAULTS.provider})`);
     }
-    /**
-     * Export a single page to HTML
-     * @param {string} pageName - Page name to export
-     * @param {ExportUser|null} user - User object for locale-aware formatting
-     * @returns {Promise<string>} HTML content
-     */
-    async exportPageToHtml(pageName, ctx, user = null) {
-        const pageManager = this.engine.getManager('PageManager');
-        const renderingManager = this.engine.getManager('RenderingManager');
-        if (!pageManager || !renderingManager) {
-            throw new Error('Required managers not available');
-        }
-        const page = (await pageManager.getPage(pageName, ctx));
-        if (!page) {
-            throw new Error(`Page '${pageName}' not found`);
-        }
-        return this.renderPageDocument(pageName, page, user);
-    }
     /**
      * One page as a complete HTML document: its content rendered, with the
      * export's styling and metadata footer. It reads nothing: the caller has
@@ -480,99 +461,6 @@ class ExportManager extends BaseManager {
 </html>`;
         return html;
     }
-    /**
-     * Export page(s) to markdown
-     * @param {string|string[]} pageNames - Single page name or array of page names
-     * @param {ExportUser|null} user - User object for locale-aware formatting
-     * @returns {Promise<string>} Markdown content
-     */
-    async exportToMarkdown(pageNames, ctx, user = null) {
-        const pageManager = this.engine.getManager('PageManager');
-        if (!pageManager) {
-            throw new Error('PageManager not available');
-        }
-        const names = Array.isArray(pageNames) ? pageNames : [pageNames];
-        let markdown = '';
-        if (names.length > 1) {
-            markdown += '# ngdpbase Export\n\n';
-            markdown += `*Exported on ${this.getFormattedTimestamp(user)}*\n\n`;
-            markdown += '## Table of Contents\n\n';
-            for (const pageName of names) {
-                markdown += `- [${pageName}](#${pageName.toLowerCase().replace(/[^a-z0-9]/g, '-')})\n`;
-            }
-            markdown += '\n---\n\n';
-        }
-        for (const pageName of names) {
-            const page = (await pageManager.getPage(pageName, ctx));
-            if (page) {
-                if (names.length > 1) {
-                    markdown += `# ${pageName}\n\n`;
-                }
-                markdown += page.content;
-                if (names.length > 1) {
-                    markdown += '\n\n---\n\n';
-                }
-            }
-        }
-        return markdown;
-    }
-    /**
-     * Save export to file
-     * @param {string} content - Content to save
-     * @param {string} filename - Filename
-     * @param {string} format - File format
-     * @returns {Promise<string>} File path
-     */
-    async saveExport(content, filename, format) {
-        const sanitizedFilename = filename.replace(/[^a-zA-Z0-9\-_]/g, '-');
-        const timestamp = new Date().toISOString().slice(0, 10);
-        const fullFilename = `${sanitizedFilename}_${timestamp}.${format}`;
-        const filePath = path.join(this.exportDirectory, fullFilename);
-        await fs.writeFile(filePath, content, 'utf8');
-        logger.info(`Exported to: ${fullFilename}`);
-        return filePath;
-    }
-    /**
-     * Get list of available exports
-     * @returns {Promise<ExportFileInfo[]>} List of export files
-     */
-    async getExports() {
-        try {
-            const files = await fs.readdir(this.exportDirectory);
-            const exports = [];
-            for (const file of files) {
-                const filePath = path.join(this.exportDirectory, file);
-                const stats = await fs.stat(filePath);
-                exports.push({
-                    filename: file,
-                    path: filePath,
-                    size: stats.size,
-                    created: stats.birthtime,
-                    modified: stats.mtime
-                });
-            }
-            return exports.sort((a, b) => b.created.getTime() - a.created.getTime());
-        }
-        catch (err) {
-            logger.error('Error getting exports:', err);
-            return [];
-        }
-    }
-    /**
-     * Delete an export file
-     * @param {string} filename - Export filename
-     * @returns {Promise<void>}
-     */
-    async deleteExport(filename) {
-        // Only a plain file name inside the export folder: never a path that
-        // reaches another folder.
-        if (!filename || filename !== path.basename(filename) || filename === '.' || filename === '..') {
-            throw new Error(`Not an export file name: ${filename}`);
-        }
-        const filePath = path.join(this.exportDirectory, filename);
-        await fs.unlink(filePath);
-        logger.info(`Deleted export: ${filename}`);
-    }
     /**
      * Get formatted timestamp using user's locale
      * @param {ExportUser|null} user - User object (optional)

package/lib/src/managers/ImportManager.d.ts

@@ -633,6 +633,13 @@ declare class ImportManager extends BaseManager {
      * is permitted, and a refusal to someone who holds it is step-up's.
      */
     private mayExportPage;
+    /**
+     * `core.search` as an export source: a search's pages and files as one zip
+     * ({@link searchExportSource}). Like a page, a search is offered to a user
+     * who holds `page-export`, and read as the user who asked, each page and
+     * file by its own read check. Recorded as one `page-export` of the search.
+     */
+    private searchExportSource;
     /**
      * `core.pages` as an export source (#2120, D5: pages export checks
      * `page-export`). A page is offered for export when its reader may see it

package/lib/src/managers/PageManager.d.ts

@@ -97,6 +97,26 @@ export interface PageSaveOptions {
      * doc says so.
      */
     preserveEditor?: boolean;
+    /**
+     * The user a NEW page is made for, by a system job (#1815): they become its
+     * author and editor, where a create otherwise takes both from the acting
+     * context. For the pages the system makes on a user's behalf — the profile
+     * page at sign-up, the new profile page of a rename — so the job's
+     * `page-create`, granted in policy, decides the write, and the page is
+     * still the user's (author-lock leaves it to them). Refused from any context
+     * but the system principal's job, and refused for a page that already
+     * exists (`PageWriteRefusedError`, `page-create`): the job never edits
+     * that page instead.
+     */
+    createdFor?: string;
+    /**
+     * The author of a page an add-on pushes (#2255): `addon:<slug>`. A new copy
+     * is authored by the add-on, and a copy seeded before #2255, authored by
+     * the system principal, is re-stamped with it. Taken only from the system
+     * principal's job and only in the `addon:<slug>` form; ignored otherwise.
+     * Any other author is kept, as on every edit.
+     */
+    shippedAuthor?: string;
     /**
      * Request-level detail the manager cannot see, for the audit record (#1121).
      *
@@ -199,11 +219,25 @@ export declare class PageAudienceRefusedError extends Error {
     readonly pageName: string;
     constructor(pageName: string);
 }
+/** The permission a page write is decided on (#1815). */
+export type PageWriteAction = 'page-create' | 'page-edit' | 'page-delete' | 'page-rename';
+/**
+ * A write refused by the write door (#1815): the context may not create,
+ * edit or delete this page, decided by policy, the page's own rules and the
+ * vault container rule. Nothing was written. Routes answer it with 403. The
+ * message names no page, so a private title never reaches a log (#2178).
+ */
+export declare class PageWriteRefusedError extends Error {
+    readonly pageName: string;
+    readonly action: PageWriteAction;
+    constructor(pageName: string, action: PageWriteAction);
+}
 export declare class PageContentValidationError extends Error {
     readonly validationErrors: FilterValidationError[];
     constructor(pageName: string, validationErrors: FilterValidationError[]);
 }
 import { type PageAction } from '../utils/pageUrl.js';
+import { type VaultSealState } from '../utils/privateStoreMeta.js';
 /** One vault page with data outside its vault (#1842), as the repair actions offer it. */
 export interface VaultRepairItem {
     owner: string;
@@ -261,6 +295,9 @@ export type VaultRepairResult = ({
 /** The move of existing captures into the capture vault (#1505), recorded per vault it moved them out of. */
 /** The refusal when someone without `admin-system` names a system-category (#1503, operator 2026-10-29). */
 export declare const SYSTEM_CATEGORY_ADMIN_ONLY = "Only administrators can set a page's system category";
+/** The system-category of a page in a shared folder (#2255): given when it is created there, by nothing else. */
+export declare const SHARED_CATEGORY = "shared";
+export declare const SHARED_CATEGORY_REFUSAL = "A page is in the shared system category only when it is created in a shared folder";
 /** What a write may give a page as its system-category ({@link PageManager.systemCategoryForWrite}). */
 export type SystemCategoryForWrite = {
     ok: true;
@@ -327,6 +364,11 @@ export interface ShippedPageSource {
     exclude?: (data: Record<string, unknown>) => string | undefined;
     /** Metadata the source adds to every page it writes (e.g. `addon`, a default category) */
     extraMetadata?: (data: Record<string, unknown>) => Record<string, unknown>;
+    /**
+     * The author of the pages it writes, for an add-on's (#2255): `addon:<slug>`
+     * (`SavePageOptions.shippedAuthor`). Absent, they are the system principal's.
+     */
+    author?: string;
     /**
      * Called by the boot seed for a source page this site already holds, with the
      * live page and the parsed source — the addon seed's metadata tidy-ups and
@@ -622,8 +664,10 @@ declare class PageManager extends BaseManager implements CatalogSource {
     private readShippedSystemCategories;
     /**
      * Which system-category a write by `ctx` gives a page (#1503, operator
-     * 2026-10-29): only an administrator (`admin-system`, asked of the PDP) sets
-     * or changes one. Anyone else's new page takes `fallback` (else the default
+     * 2026-10-29): only a holder of `page-categorize` (#2255; shipped to admin)
+     * sets or changes one. `shared` is set by nobody: a page created in a shared
+     * folder gets it at the write door (`savePage`), and a request naming it for
+     * any other page is refused, `page-categorize` or not. Anyone else's new page takes `fallback` (else the default
      * system-category) and an existing page keeps its own (`current`); a request
      * naming any other is refused, never rewritten. An administrator's request
      * comes back as given (`undefined` when it names none), for the caller's own
@@ -644,16 +688,10 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * taken for a shipped one. Shipped pages are admin-only and never private.
      */
     isShippedPageCopy(uuid: string): Promise<boolean>;
-    /**
-     * One-time access backfill for a live required page (#1411): a page with no
-     * `access` gets the default for its category, as a metadata-only save that
-     * keeps `lastModified`. A page that has any `access` — an operator's choice —
-     * is left alone.
-     */
-    private backfillShippedPageAccess;
     /**
      * The source for the pages an addon ships (#1406). Pages it writes carry
-     * `addon` and, when the source names none, the `addon` category (#931).
+     * `addon`, the add-on as author (`addon:<slug>`, #2255) and, when the source
+     * names none, the `addon` category (#931).
      *
      * @param addonName - The addon's name
      * @param pagesDir - The addon's `pages/` folder
@@ -926,6 +964,82 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * @throws when `ctx` may not file into the page's folder
      */
     private assertMayFileInSharedFolder;
+    /**
+     * May `ctx` edit or delete this existing page (#1815)? The page decision
+     * every route asks (`canUserAccessPage`), with the page's metadata, so the
+     * delegation ceilings, the vault container rule, author-lock, the page's own
+     * rules and policy all count, in that one evaluator. `record` false asks it
+     * as an affordance, which records nothing (#1668). Without a PIP nothing is
+     * writable.
+     */
+    private mayChangeExisting;
+    /**
+     * May `ctx` create a page at `destination` (#1815)? In a vault, the
+     * container rule and then `page-create` with the vault (`permitsInVault`;
+     * a shared folder by its own permission). A public page, `page-create`
+     * asked of the PDP about the page (#2255: the PDP reads its attributes from
+     * the PIP). The same rule as `hasPermissionOn`.
+     *
+     * @returns `permit`, and the `policyIds` of the `page-create` decision when
+     *   one was made (#2272); a vault page is decided by the container rule and
+     *   `permitsInVault`, which name none.
+     */
+    private decideCreateAt;
+    /**
+     * Where a save puts the page (#1815, decision 7): the private name the
+     * provider will store it under, or its public title. Read from the page's
+     * own `private` / `store` frontmatter, the rule the provider's placement
+     * follows: a private name stays private unless the save says
+     * `private: false`; a public title goes into a vault when it says
+     * `private: true`, the owner's and the store it names, else the vault the
+     * page is in now, else the default vault.
+     *
+     * @param owner - The username whose vault a public title would go into: the
+     *   page's author (for a new page, whoever it is made by or for)
+     */
+    private writeDestination;
+    /** The container a page name is in: its vault, or the public space. */
+    private static containerOf;
+    /**
+     * The write door's decision for a save (#1815, operator 2026-11-04). An
+     * existing page is edited only by a context the page decision lets edit it
+     * ({@link mayChangeExisting}); a page arriving in a container it is not in
+     * now — a new page, or a move into or out of a vault — is also created
+     * there ({@link decideCreateAt}). Whatever route the write came by: the route's
+     * own check is an early refusal, this is the one that counts.
+     *
+     * @throws PageWriteRefusedError when either is refused; nothing is written
+     */
+    private assertMaySave;
+    /**
+     * Record a refused `page-create` as `authorization-deny` (#1815, security
+     * review L1). The edit and delete refusals are recorded by the page
+     * decision (`canUserAccessPage`); a create is decided by the PDP, which
+     * records nothing, so the door records it here: core records every refusal.
+     * Standard tier, `continue` on failure: the refusal stands either way.
+     *
+     * @param policyIds - The policies of the `page-create` decision that refused
+     *   (#2272). Only a refusal that decision made passes any; one no policy
+     *   decided (`createdFor` misuse) leaves the field off the record.
+     * @param conditionNotMet - Allows of that decision that matched but whose condition was not met (#2288).
+     */
+    private recordCreateRefusal;
+    /** `shippedAuthor` when the system principal's job gives it in the `addon:<slug>` form (#2255); otherwise nothing. */
+    private shippedAuthorFor;
+    /** Is `ctx` a job of the system principal (#631) — the only context that may make a page for someone else (#1815)? */
+    private isSystemJob;
+    /** The username a page's stored author names (#2097), or null. */
+    private authorUsername;
+    /**
+     * Would `ctx` be allowed to edit this page — asked only to decide what to
+     * offer or report, never before writing it (#1815). The same decision as
+     * the write door, as an affordance: it records nothing (#1668). Saving still
+     * asks the door.
+     *
+     * @param identifier - Page UUID, title, slug or vault name
+     * @param ctx - Whose question this is — never defaulted
+     */
+    mayEditPage(identifier: string, ctx: ActorContext): Promise<boolean>;
     /**
      * Admin-override save (#689): the admin "Edit raw" textarea, split into
      * frontmatter and body and written through the door (#1462).
@@ -975,7 +1089,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * What a page stores for the user `name` (#2097): `IdentityManager.storedReferenceOf`.
      */
     private referenceTo;
-    /** `audience` and each `access[action]` of a save, user entries as {@link referenceTo} stores them (#2097). */
+    /** The `audience` of a save, user entries as {@link referenceTo} stores them (#2097). */
     private convertAccessListsForSave;
     /**
      * The frontmatter a save writes, from the frontmatter it was given (#1462).
@@ -994,6 +1108,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * @param actingUser - Who is writing this revision, from the context (#1164)
      * @param viaToken - The agent token this write came through (#946), if any
      * @param keepEditor - Leave the stored `editor` alone (`preserveEditor`, #1457)
+     * @param shippedAuthor - An add-on page's author (`shippedAuthor`, #2255), already checked
      * @returns The frontmatter to hand the provider
      */
     private normalizeSaveMetadata;
@@ -1009,7 +1124,9 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * `ctx` is mandatory and positional: the save acts as the caller's subject
      * (#1179), a private-store write reaches that session's keys through it
-     * (#1382), and the audit record names it. A caller forwards the context it
+     * (#1382), and the audit record names it. The write is decided here, for
+     * that context, before anything is written (#1815): `page-edit` on the page
+     * as it is, `page-create` where it is going when that is somewhere new. A caller forwards the context it
      * was given — a request's subject, or the job's for boot and scheduled
      * work — and never invents one.
      *
@@ -1020,6 +1137,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * @param options - Validation and conflict-check opt-outs, `rawFrontmatter` (#689),
      *   `preserveLastModified`, `preserveEditor` (#1457), audit enrichment
      * @returns Where the page landed, and what it was called before
+     * @throws PageWriteRefusedError when `ctx` may not make this write
      *
      * @example
      * await pageManager.savePage('New Page', '# Hello World', { 'user-keywords': ['tutorial'] }, req.userContext);
@@ -1108,8 +1226,37 @@ declare class PageManager extends BaseManager implements CatalogSource {
         title: string;
         uuid: string;
     }>>;
+    /**
+     * Every public page stamped with one system-category (#2299), by the name
+     * `mayShowPage` takes. Vault pages are not listed: they are their owners', not
+     * an administrator's to be told about. Says nothing about who may see a page;
+     * the caller asks `mayShowPage` as the reader.
+     *
+     * @param category - The category's key or label, any case
+     */
+    listCategoryPages(category: string): Promise<string[]>;
     /** The store ids the requester has of their own (#1387). */
     listOwnStoreIds(ctx: ActorContext): Promise<string[]>;
+    /**
+     * The requester's own vaults, each with its pages and whether it is
+     * encrypted (#2245), for `/my/vaults`.
+     *
+     * `state` is the vault's {@link VaultSealState} (#1834): `sealed` is
+     * encrypted, `plain` is not, and `unopened` or `mismatch` is a vault whose
+     * kind says it must be encrypted while its copy is not. `readable` is false
+     * for a vault this context cannot open, such as a sealed vault still
+     * locked: its pages are then unknown, not none.
+     */
+    listOwnVaults(ctx: ActorContext): Promise<Array<{
+        id: string;
+        state: VaultSealState;
+        readable: boolean;
+        pages: Array<{
+            name: string;
+            title: string;
+            uuid: string;
+        }>;
+    }>>;
     listOwnDeletedPrivatePages(ctx: ActorContext): Promise<StoreDeletedEntry[]>;
     /**
      * Bring one of the requester's private pages back from its store's trash
@@ -1233,14 +1380,25 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * and the context names who put it there. Afterwards the page is taken out
      * of every shared index, here and nowhere else (#1462).
      *
+     * The write door decides `page-delete` on the page first (#1815), and the
+     * delete is recorded as `page-delete` before it happens.
+     *
      * @param identifier - Page UUID, title, or slug
      * @param ctx - Who is acting (#1179)
+     * @param options - `audit.skip` when the caller already recorded this
+     *   delete; `audit.ipAddress`, the request's address, for the record
      * @returns True if deleted, false if not found
+     * @throws PageWriteRefusedError when `ctx` may not delete the page
      *
      * @example
      * const deleted = await pageManager.deletePage('Old Page', req.userContext);
      */
-    deletePage(identifier: string, ctx: ActorContext): Promise<boolean>;
+    deletePage(identifier: string, ctx: ActorContext, options?: {
+        audit?: {
+            skip?: boolean;
+            ipAddress?: string;
+        };
+    }): Promise<boolean>;
     /**
      * Delete the pages a test made (#2008): every shared page carrying the
      * `test-artifact` system keyword (#1355), and never a page without it.
@@ -1253,7 +1411,8 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * follow. One page's failure never stops the rest; it is reported.
      *
      * The caller decides who may ask: the sweep route asks `admin-system`, and
-     * an account delete has already been decided as `user-delete`. Private
+     * an account delete has already been decided as `user-delete` and sends a
+     * system job (#1815). Each delete is still decided by `deletePage`. Private
      * vault pages are not in the shared index, so they are not reached here.
      *
      * @param ctx - Who is acting; named in every record
@@ -1502,7 +1661,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
     private warnUnmatchableAddonAudience;
     /**
      * At startup, once add-ons have loaded (#1964): warn about every page whose
-     * `audience` or `access` names an add-on that can match nobody — unknown,
+     * `audience` names an add-on that can match nobody — unknown,
      * not per-person, or not loaded.
      *
      * @returns Each page and slug warned about
@@ -1617,8 +1776,10 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * `pages/vaults/{user}/` and every store below it is owned by that user.
      * Nobody else acts in it unless the owner delegated (a share the owner
-     * issued, once the store's Share switch exists — #1388). No role reaches in,
-     * admin included (security-posture P2: no `hasRole` as an allow).
+     * issued, once the store's Share switch exists — #1388). No role reaches in
+     * (security-posture P2: no `hasRole` as an allow); at a door, a holder of
+     * `admin-system` may enter an unencrypted vault when
+     * `ngdpbase.vaults.admin-access` is on (#2255), recorded each time.
      *
      * The owner is the one in the page's name (#1456), not frontmatter
      * `author`, so reassigning `author` cannot move ownership (#711).
@@ -1629,7 +1790,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *   - `false` — a private name, and the caller is neither — whether or not
      *               the page exists
      */
-    checkPrivatePageAccess(wikiContext: WikiContext, pageNameOrUuid: string): Promise<boolean | null>;
+    checkPrivatePageAccess(wikiContext: WikiContext, pageNameOrUuid: string, adminEntry?: 'record' | 'quiet' | 'none'): Promise<boolean | null>;
     /**
      * Owner and store of a private page, or `null` when the page is not private
      * or does not exist (#1398). The owner owns the page and every attachment
@@ -1686,6 +1847,15 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * Best-effort: a failure is logged and never blocks start-up. An encrypted
      * store is not readable here and is not touched — it migrates at its
      * owner's unlock, through {@link migratePrivateLinks}.
+     *
+     * #1815 (operator, 2026-11-04, decision 2): the public pages are the system
+     * principal's work; each user's vaults are a job on behalf of that user
+     * ({@link jobContextForOwner}), through the write door like any write. The
+     * vault container rule admits a job carrying its owner, and the owner's
+     * rights in their own vaults come from policy, resolved when each write is
+     * decided. The system principal is let into no vault. A shared folder is
+     * not a user's and opens to no boot job (its key never reaches one), so it
+     * is not visited.
      */
     migratePrivateLinksAtBoot(): Promise<void>;
     /**
@@ -1799,8 +1969,9 @@ declare class PageManager extends BaseManager implements CatalogSource {
      * keeps its `lastModified` and `editor`, since nobody edited it. The audit
      * record is a rename, from the old path to the new.
      *
-     * Access is not decided here, as for every save: the caller has already
-     * been let into the page. A page is never moved out of an encrypted vault
+     * Access is decided by the save it makes, as for every write (#1815): an
+     * edit of the page where it is and a create in the vault it goes to. A
+     * page is never moved out of an encrypted vault
      * into one that is not, since that would write it in the clear.
      *
      * @param pageName - The page's private name, `vaults/{owner}/{vault}/{title}`
@@ -1823,7 +1994,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * @returns How many pages moved
      */
-    moveCapturesToCaptureVault(ctx: ActorContext): Promise<number>;
+    moveCapturesToCaptureVault(ctx: ActorContext, owner?: string): Promise<number>;
     /**
      * Move private pages made before #1505 into their system-category's own
      * vault (#1507). Until then every private page went to its owner's default
@@ -1838,7 +2009,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * @returns How many pages moved
      */
-    movePagesToCategoryVaults(ctx: ActorContext): Promise<number>;
+    movePagesToCategoryVaults(ctx: ActorContext, owner?: string): Promise<number>;
     /**
      * Every private slug in the `vaults--…` form (#1507), once per vault. A
      * private page's slug is made fresh on every save, so each page whose slug
@@ -1848,7 +2019,7 @@ declare class PageManager extends BaseManager implements CatalogSource {
      *
      * @returns How many pages were re-saved
      */
-    migratePrivateSlugs(ctx: ActorContext): Promise<number>;
+    migratePrivateSlugs(ctx: ActorContext, owner?: string): Promise<number>;
     /**
      * One pass of a vault move: every page in the vaults `ctx` can open is
      * offered to `pick`, which names the vault it goes to (and any frontmatter