@preventive/triage 1.0.0-alpha.4 → 1.0.0-alpha.41

package/common/line-diff.js

@@ -0,0 +1,56 @@
+// The change blocks between two texts' lines, found by @preventive/diff: what
+// the viewer's Compare diffs (ui/view/bundle-compare-code-model.js); and the
+// server's check, apart from @preventive/compare's own, that its diff with
+// renamed names hidden takes the old side to the new (server-managed/rename-diff.ts).
+//
+// Lines are numbered the way the diff numbers them: from zero, a final
+// newline ending the last line rather than starting an empty one.
+import { diff, parseDiff } from '@preventive/diff'
+
+export function textLines(text) {
+  if (text === '') return []
+  const lines = text.split('\n')
+  if (lines.at(-1) === '') lines.pop()
+  return lines
+}
+
+// Whether a text's last line ends in a newline. One added or dropped there is
+// a change of that line, as diff has it (the viewer marks it on that line's
+// row), but for diff -b, which ignores it as it does other trailing blanks.
+const endsLine = text => text === '' || text.endsWith('\n')
+
+// A line as diff -b reads it (@preventive/diff's): a run of the C locale's
+// blanks as one space, and those that end it as none.
+const spacing = line => line.replace(/[ \t\n\v\f\r]+$/u, '').replaceAll(/[ \t\n\v\f\r]+/gu, ' ')
+
+// Each `a[a0..a1)` replaced by `b[b0..b1)`. `ignoreWhitespace` is diff -b:
+// lines differing only in how much whitespace they have pair up as unchanged,
+// whitespace added or removed between other characters still a change.
+export function changeBlocks(before, after, ignoreWhitespace = false) {
+  const text = diff(before, after, { format: 'unified', context: 0, whitespace: ignoreWhitespace ? 'change' : 'none' })
+  return text ? (parseDiff(text)[0]?.blocks ?? []).map(({ a0, a1, b0, b1 }) => ({ a0, a1, b0, b1 })) : []
+}
+
+// Whether `blocks` take `before`'s lines to `after`'s: each in order and apart
+// from the last, within both texts, and every line between them alike on both
+// sides (alike but for how much whitespace they have where `ignoreWhitespace`,
+// as diff -b has them), the last line in a block where a newline was added or
+// dropped after it, so that a diff drawn from them hides no change. A check on
+// what changeBlocks found, or on one found apart from the texts drawn.
+export function blocksHold(before, after, blocks, ignoreWhitespace = false) {
+  if (!Array.isArray(blocks)) return false
+  const a = textLines(before), b = textLines(after)
+  const alike = ignoreWhitespace ? (x, y) => spacing(x) === spacing(y) : (x, y) => x === y
+  let i = 0, j = 0
+  for (const block of [...blocks, { a0: a.length, a1: a.length, b0: b.length, b1: b.length, last: true }]) {
+    const { a0, a1, b0, b1 } = block ?? {}
+    if (![a0, a1, b0, b1].every(Number.isInteger) || a0 < i || b0 < j || a1 < a0 || b1 < b0 || a1 > a.length || b1 > b.length) return false
+    // A block changes a line, and as many lines are alike before it on each side.
+    if ((!block.last && a1 === a0 && b1 === b0) || a0 - i !== b0 - j) return false
+    if (block.last && a0 > i && !ignoreWhitespace && endsLine(before) !== endsLine(after)) return false
+    for (; i < a0; i++, j++) if (!alike(a[i], b[j])) return false
+    i = a1
+    j = b1
+  }
+  return true
+}

package/common/linked-workspace-groups.js

@@ -0,0 +1,63 @@
+// Explicit links combine already-resolved workspace App rows. This is a view
+// grouping, not report deduplication: each report's revalidation answer has
+// already been checked in its own row, and links never create report conflicts.
+//
+// `visibleTabs` decides which tabs may BRIDGE two rows; `retainedTabs` (the
+// same projection unless the caller says otherwise) decides which tabs the
+// combined row keeps. They part when a display choice shows a row more of
+// itself without meaning to re-draw the workspace's row boundaries.
+export function mergeLinkedWorkspaceGroups(groups, duplicatesOf, visibleTabs, retainedTabs = visibleTabs) {
+  const parent = groups.map((_, i) => i)
+  const find = (i) => {
+    while (parent[i] !== i) { parent[i] = parent[parent[i]]; i = parent[i] }
+    return i
+  }
+  const tabs = groups.map(visibleTabs)
+  const byId = new Map()
+  for (let i = 0; i < tabs.length; i++) {
+    for (const f of tabs[i]) {
+      if (!f.id) continue
+      if (!byId.has(f.id)) byId.set(f.id, [])
+      byId.get(f.id).push(i)
+    }
+  }
+  for (const [id, rows] of byId) {
+    for (const other of duplicatesOf(id)) {
+      if (other === id) continue
+      for (const a of rows) {
+        for (const b of byId.get(other) ?? []) {
+          const left = find(a), right = find(b)
+          if (left !== right) parent[right] = left
+        }
+      }
+    }
+  }
+  const components = new Map()
+  for (let i = 0; i < groups.length; i++) {
+    const root = find(i)
+    if (!components.has(root)) components.set(root, [])
+    components.get(root).push(i)
+  }
+  if (components.size === groups.length) return groups
+  const key = (f) => f.id ?? String(f._id)
+  const merged = [...components.values()].map((indices) => {
+    if (indices.length === 1) return groups[indices[0]]
+    // Retain the tabs visible in each original row. An imported App finding
+    // or an unjudged source row must not disappear when linked to a pass row.
+    const visible = new Map()
+    for (const i of indices) for (const f of retainedTabs(groups[i])) if (!visible.has(key(f))) visible.set(key(f), f)
+    const members = new Map()
+    for (const i of indices) {
+      for (const f of groups[i]) {
+        if (!members.has(key(f))) members.set(key(f), visible.get(key(f)) ?? f)
+      }
+    }
+    const group = [...members.values()]
+    const first = groups[indices[0]]
+    group.workspaceKey = first.workspaceKey ?? key(first[0])
+    group.linkedTabs = [...visible.values()]
+    return group
+  })
+  Object.defineProperty(merged, 'ruledOutIds', { value: groups.ruledOutIds, configurable: true })
+  return merged
+}

package/common/managed/comments.ts

@@ -0,0 +1,34 @@
+// Managed comments are independent records, shared by reports containing the
+// same finding. Imported and legacy comments may lack attribution or dates.
+export interface ManagedComment {
+  id: string
+  findingId: string
+  body: string
+  authorId: string | null
+  authorLogin: string | null
+  createdAt: number | null
+  updatedAt: number | null
+  version: number
+}
+
+export const MAX_COMMENT_TEXT = 10_000
+
+// Callers also enforce write access to the report containing the finding.
+// Admins can remove comments with no linked user, but cannot claim authorship.
+export function canDeleteComment(comment: Pick<ManagedComment, 'authorId'>, actor: { id: string; role: string } | null | undefined): boolean {
+  return actor != null && (comment.authorId === actor.id || (comment.authorId == null && actor.role === 'admin'))
+}
+
+export function compareManagedComments(a: ManagedComment, b: ManagedComment): number {
+  if (a.createdAt == null && b.createdAt != null) return -1
+  if (a.createdAt != null && b.createdAt == null) return 1
+  const byDate = (a.createdAt ?? 0) - (b.createdAt ?? 0)
+  if (byDate !== 0) return byDate
+  if (a.id === b.id) return 0
+  return a.id < b.id ? -1 : 1
+}
+
+export function parseCommentBody(value: unknown): string | null {
+  if (typeof value !== 'string' || value.length > MAX_COMMENT_TEXT) return null
+  return value.trim() || null
+}

package/common/managed/npm-packages.d.ts

@@ -0,0 +1,5 @@
+export const MAX_TEAM_NPM_SCOPES: number
+export function isNpmPackageName(value: unknown): value is string
+export function isNpmPackageSpec(value: unknown): value is string
+export function npmPackageScope(name: string): string | null
+export function normalizeNpmScope(value: unknown): string | null

package/common/managed/npm-packages.js

@@ -0,0 +1,34 @@
+// npm package names, versions and scopes as the managed npm viewer takes
+// them, shared by its routes, the server and the Teams page.
+
+// Upstream's rule (@preventive/upstream src/args.js): a scope, then a name
+// starting with none of `.`, `_` and `-`, 214 characters in all.
+const PACKAGE_NAME = /^(?=.{1,214}$)(?:@[\w.-]+\/[\w-]|[\dA-Za-z])[\w.-]*$/u
+// An exact version or a dist-tag, as the registry resolves `/<name>/<spec>`.
+const PACKAGE_SPEC = /^(?=.{1,256}$)[\dA-Za-z][\w.+-]*$/u
+// npm's rule for a scope: lowercase, and not starting with `.` or `_`.
+const SCOPE = /^@[\da-z~-][\w.~-]*$/u
+export const MAX_TEAM_NPM_SCOPES = 100
+
+export function isNpmPackageName(value) {
+  return typeof value === 'string' && PACKAGE_NAME.test(value)
+}
+
+export function isNpmPackageSpec(value) {
+  return typeof value === 'string' && PACKAGE_SPEC.test(value)
+}
+
+// `@scope` of a scoped name, lowercased as scopes are compared; null for an
+// unscoped one.
+export function npmPackageScope(name) {
+  return name.startsWith('@') && name.includes('/') ? name.slice(0, name.indexOf('/')).toLowerCase() : null
+}
+
+// A scope as typed: `scope` or `@scope`, either case, surrounding space
+// ignored. Null when it is not one npm could publish under.
+export function normalizeNpmScope(value) {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim().toLowerCase()
+  const scope = trimmed.startsWith('@') ? trimmed : `@${trimmed}`
+  return scope.length <= 214 && SCOPE.test(scope) ? scope : null
+}

package/common/managed/permissions.ts

@@ -0,0 +1,31 @@
+// Per-membership visibility permissions for a team's users — shared by the
+// managed server (which stores + validates them) and the admin client (the
+// team-member checkboxes). Each is an independent opt-in, BOTH DEFAULT OFF:
+//   dependencies — scan findings in dependencies' own code; App impact stays visible
+//   security     — security findings and published bundle advisories
+// The managed server filters report responses and authorizes advisory lookups
+// using these independent permissions.
+export type VisibilityPermission = 'dependencies' | 'security'
+
+export const VISIBILITY_PERMISSIONS: readonly VisibilityPermission[] = ['dependencies', 'security']
+
+// Human labels for the admin checkboxes (keyed by permission).
+export const VISIBILITY_PERMISSION_LABELS: Record<VisibilityPermission, string> = {
+  dependencies: 'Dependencies',
+  security: 'Security',
+}
+
+// A membership's resolved permission set; every key present (false = off).
+export type TeamUserPermissions = Record<VisibilityPermission, boolean>
+
+// All-off — the default for a fresh membership.
+const DEFAULT_TEAM_USER_PERMISSIONS: TeamUserPermissions = { dependencies: false, security: false }
+
+// Coerce arbitrary input (a request body) into a full permission set: a key is
+// granted only when explicitly `true`; anything else (absent, non-bool) is off.
+export function parseTeamUserPermissions(x: unknown): TeamUserPermissions {
+  const o = (x == null || typeof x !== 'object') ? {} : x as Record<string, unknown>
+  const out = { ...DEFAULT_TEAM_USER_PERMISSIONS }
+  for (const p of VISIBILITY_PERMISSIONS) out[p] = o[p] === true
+  return out
+}

package/common/managed/report-content.ts

@@ -0,0 +1,72 @@
+import { parseLinkedFindings } from '../../client/linked-findings.js'
+import { dependencyDirectory, isDependencyFile } from '../../client/dependency-paths.js'
+import { detectFormat, loadFindings, parseCodexCsvToScans, readReport, reportEntries, reportRepoGithub } from '@preventive/report'
+import { commonFileDirectory } from './repository-alias.ts'
+
+// A managed blob retains one server identity even when a CSV contains several
+// scans. Keep all their findings (and upstream ids) under that identity. CSV
+// repository columns describe findings, not an embedded report-level location.
+export function readManagedReport(content: string, filename: string): ReturnType<typeof readReport> {
+  const links = content.trimStart().startsWith('[') ? parseLinkedFindings(content) : null
+  if (links) return { data: { source: 'links', findings: [], links: links.groups }, format: 'links', reason: null }
+  const parsed = readReport(content)
+  // Permission-filtered responses can be JSON under the original CSV filename.
+  if (parsed.data != null || detectFormat(content, filename) !== 'codex') return parsed
+  try {
+    const scans = parseCodexCsvToScans(content)
+    return {
+      data: { type: 'security', source: 'codex-security', findings: scans.flatMap((scan) => scan.data.findings) },
+      format: 'codex', reason: null,
+    }
+  } catch (err) {
+    return { data: null, format: null, reason: err instanceof Error ? err.message : 'Invalid Codex CSV' }
+  }
+}
+
+export function loadManagedFindings(content: string, filename: string): ReturnType<typeof loadFindings> {
+  const parsed = readManagedReport(content, filename)
+  return parsed.data == null ? Promise.resolve(null) : loadFindings(JSON.stringify(parsed.data))
+}
+
+// Source access follows individual visible members, not their shared finding
+// IDs: another member with the same ID can cite files the viewer cannot see.
+export function managedFindingSourcePaths(findings: unknown[]): Set<string> {
+  const paths = new Set<string>()
+  for (const finding of findings) {
+    if (!finding || typeof finding !== 'object') continue
+    const f = finding as { file?: unknown; evidence?: { file?: unknown }[] }
+    if (typeof f.file === 'string' && f.file) paths.add(f.file)
+    for (const evidence of Array.isArray(f.evidence) ? f.evidence : []) {
+      if (typeof evidence?.file === 'string' && evidence.file) paths.add(evidence.file)
+    }
+  }
+  return paths
+}
+
+// The report's own findings, in either entry shape, outside the dependency
+// directory the local report view would choose: node_modules, else vendor,
+// else dependencies.
+function ownFindings(data: unknown) {
+  const objects = (reportEntries(data) ?? []).flat().filter((finding): finding is { file?: unknown } => finding != null && typeof finding === 'object')
+  const directory = dependencyDirectory([{ groups: [objects], tree: (data as { tree?: unknown } | null)?.tree }])
+  return { directory, own: objects.filter(finding => !isDependencyFile(finding.file, directory)) }
+}
+
+// Findings name the repository of their own file. Like the local report view,
+// a report without its own repository belongs to the one repository named by
+// its own findings (Claude Security and Codex exports name one on every finding).
+export function findingsRepository(data: unknown): string | null {
+  const repos = new Map<string, string>()
+  for (const finding of ownFindings(data).own) {
+    const github = reportRepoGithub(finding)
+    if (github) repos.set(github.toLowerCase(), github)
+  }
+  return repos.size === 1 ? [...repos.values()][0]! : null
+}
+
+// The directory shared by the files the report's own findings cite, for alias
+// matching. Dependency paths, including cited evidence, cannot hide it.
+export function ownFileDirectory(data: unknown): string {
+  const { directory, own } = ownFindings(data)
+  return commonFileDirectory([...managedFindingSourcePaths(own)].filter(path => !isDependencyFile(path, directory)))
+}

package/common/managed/report-filter.ts

@@ -0,0 +1,108 @@
+// Apply report permissions before serving findings, triage, or source files.
+// Security uses the same complete-row classification as the UI. Dependency
+// access is per finding: App, own source, and the own-source organizations stay.
+import { inheritReportMeta, isAppFinding, reportRepoGithub, stampSecurityGroups } from '@preventive/report'
+import { readManagedReport } from './report-content.ts'
+
+export interface ViewerPermissions {
+  dependencies: boolean
+  security: boolean
+}
+
+type Finding = Record<string, unknown>
+function object(value: unknown): Finding | null {
+  return value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Finding : null
+}
+function pathOf(finding: Finding): string {
+  return typeof finding['file'] === 'string' ? finding['file'].replaceAll('\\', '/') : ''
+}
+function isDependency(finding: Finding): boolean {
+  return /(?:^|\/)(?:node_modules|vendor|dependencies)(?:\/|$)/u.test(pathOf(finding))
+}
+function githubOrg(value: unknown): string | null {
+  return reportRepoGithub(value)?.split('/')[0]?.toLowerCase() ?? null
+}
+function npmScope(finding: Finding, fromPath = false): string | null {
+  let name = object(object(finding['package'])?.['npm'])?.['name']
+  if (typeof name !== 'string' && fromPath) {
+    const parts = pathOf(finding).split('/')
+    for (let i = parts.length - 3; i >= 0; i--) {
+      if (['node_modules', 'vendor', 'dependencies'].includes(parts[i]!)) {
+        name = `${parts[i + 1]}/${parts[i + 2]}`
+        break
+      }
+    }
+  }
+  return typeof name === 'string' ? /^(@[^/\s]+)\/[^/\s]+$/u.exec(name)?.[1] ?? null : null
+}
+
+// Parsed projections keep run inheritance and derived flags out of cached
+// reports. A known positive security stamp may include linked findings outside
+// this report; a negative stamp never overrides the intrinsic classifier.
+export function projectFinding(value: unknown, report: Finding): Finding | null {
+  const original = object(value)
+  if (!original) return null
+  const finding = { ...original }
+  inheritReportMeta(finding, report)
+  finding['_source'] = finding['source'] ?? report['source'] ?? null
+  if (!('isApp' in finding)) finding['isApp'] = isAppFinding(finding, finding['_source'])
+  if (finding['isSecurity'] === true) finding['security'] = true
+  return finding
+}
+
+// Native JSON and supported text imports obey the same permission rules.
+// A filtered text import is returned as JSON under its original filename, which
+// readManagedReport already accepts. Unchanged inputs keep their original bytes.
+export function filterReportContent(content: string, perms: ViewerPermissions, filename = '', repo?: unknown): string {
+  if (perms.dependencies && perms.security) return content
+  let data: unknown
+  try { data = JSON.parse(content) } catch {
+    const parsed = readManagedReport(content, filename)
+    if (parsed.data == null) {
+      if (/\.csv$/iu.test(filename)) throw new Error('Cannot filter unreadable CSV report')
+      return content
+    }
+    data = parsed.data
+  }
+  const filtered = filterReportData(data, perms, repo)
+  return filtered === data ? content : JSON.stringify(filtered)
+}
+
+// repo, when supplied, is the server's authoritative assignment (including an
+// explicit unassigned value). Finding-specific repos still describe their source.
+export function filterReportData(data: unknown, perms: ViewerPermissions, repo?: unknown, securityIds?: Set<string>): unknown {
+  if (perms.dependencies && perms.security) return data
+  const report = object(data)
+  if (!report) return data
+  const key = Array.isArray(report['findings']) ? 'findings' : Array.isArray(report['groups']) ? 'groups' : null
+  if (!key) return data
+  const entries = (report[key] as unknown[]).map(entry => ({
+    entry, members: (Array.isArray(entry) ? entry : [entry]).map(original => ({ original, finding: projectFinding(original, report) })),
+  }))
+  const groups = entries.map(({ members }) => members.flatMap(({ finding }) => finding ? [finding] : []))
+  if (!perms.security) stampSecurityGroups(groups)
+  const githubOrgs = new Set<string>(), npmScopes = new Set<string>()
+  const addOrgs = (finding: Finding) => {
+    const github = githubOrg(finding), npm = npmScope(finding)
+    if (github) githubOrgs.add(github)
+    if (npm) npmScopes.add(npm)
+  }
+  addOrgs({ ...report, repo: repo === undefined ? report['repo'] : repo })
+  for (const finding of groups.flat()) {
+    if (finding['isApp'] !== true && !isDependency(finding)) addOrgs(finding)
+  }
+  const kept: unknown[] = []
+  let changed = false
+  for (const { entry, members } of entries) {
+    // Classify the complete row before hiding dependency components.
+    if (!perms.security && members.some(({ finding }) => finding?.['isSecurity'] === true || securityIds?.has(String(finding?.['id'])))) { changed = true; continue }
+    const visible = members.filter(({ finding }) => !finding || perms.dependencies || finding['isApp'] === true || !isDependency(finding)
+      || githubOrgs.has(githubOrg(finding) ?? '') || npmScopes.has(npmScope(finding, true) ?? ''))
+    if (visible.length === members.length) kept.push(entry)
+    else {
+      changed = true
+      if (visible.length > 0) kept.push(Array.isArray(entry) ? visible.map(({ original }) => original) : visible[0]!.original)
+    }
+  }
+  return changed ? { ...report, [key]: kept } : data
+}

package/common/managed/repository-alias.ts

@@ -0,0 +1,65 @@
+export interface RepositoryAliasInput {
+  oldRepo: string
+  oldPath: string
+  repoId: number
+  newPath: string
+}
+
+function containsPath(parent: string, path: string) {
+  return !parent || path === parent || path.startsWith(`${parent}/`)
+}
+
+function aliasLocation(alias: RepositoryAliasInput, directory: string) {
+  if (containsPath(alias.oldPath, directory)) {
+    const suffix = directory.slice(alias.oldPath.length).replace(/^\//u, '')
+    return { directory: [alias.newPath, suffix].filter(Boolean).join('/'), filePrefix: '' }
+  }
+  if (!containsPath(directory, alias.oldPath)) return null
+  const filePrefix = alias.oldPath.slice(directory.length).replace(/^\//u, '')
+  // This suffix is already in every file path. The destination must preserve
+  // it, so mapping needs only a new directory, never a file-path rewrite.
+  if (alias.newPath === filePrefix) return { directory: '', filePrefix }
+  if (!alias.newPath.endsWith(`/${filePrefix}`)) return null
+  return { directory: alias.newPath.slice(0, -filePrefix.length - 1), filePrefix }
+}
+
+// Match directory boundaries, keeping any subdirectory below the alias. A
+// shared file prefix can prove a more specific alias applies without changing
+// those files. The most specific applicable source wins, once, never chained.
+export function matchRepositoryAlias(github: string, directory: string, aliases: readonly RepositoryAliasInput[], filePrefix = '') {
+  let match: { repoId: number; directory: string } | null = null, specificity = -1
+  for (const alias of aliases) {
+    if (alias.oldRepo.toLowerCase() !== github.toLowerCase()) continue
+    const location = aliasLocation(alias, directory)
+    if (!location || !containsPath(location.filePrefix, filePrefix) || alias.oldPath.length <= specificity) continue
+    match = { repoId: alias.repoId, directory: location.directory }
+    specificity = alias.oldPath.length
+  }
+  return match
+}
+
+// Run before decoding a bundle's inventory: unrelated repos/directories and
+// mappings without the required common suffix cannot benefit from its paths.
+export function repositoryAliasNeedsFilePrefix(github: string, directory: string, aliases: readonly RepositoryAliasInput[]) {
+  return aliases.some(alias => alias.oldRepo.toLowerCase() === github.toLowerCase()
+    && Boolean(aliasLocation(alias, directory)?.filePrefix))
+}
+
+// Whole directory segments only; no source bodies, hashing, or path rewriting.
+// A single file still proves its parent prefix. Stop as soon as none is shared.
+export function commonFileDirectory(paths: Iterable<string>): string {
+  let prefix: string[] | undefined
+  for (const path of paths) {
+    const parts = path.split('/')
+    if (parts.some(part => !part || part === '.' || part === '..') || path.includes('\\')) return ''
+    parts.pop()
+    if (prefix === undefined) prefix = parts
+    else {
+      let length = 0
+      while (length < prefix.length && length < parts.length && prefix[length] === parts[length]) length++
+      prefix.length = length
+    }
+    if (prefix.length === 0) return ''
+  }
+  return prefix?.join('/') ?? ''
+}

package/common/managed/roles.ts

@@ -0,0 +1,28 @@
+// Managed-mode user roles, shared by the managed server (which stores +
+// validates them) and the admin client (the role picker). A linear privilege
+// ladder, highest first:
+//   admin  — full access incl. managing other users' roles
+//   manage — owned/team content management
+//   triage — can triage findings
+//   view   — read-only
+//   none   — no access
+// Admins manage workspace access. Managers handle owned uploads and content
+// in their teams; repository changes also require repository/path access. View
+// is the floor for reading content, triage for annotating accessible reports.
+// None cannot read or mutate managed data, regardless of ownership or teams.
+export type Role = 'admin' | 'manage' | 'triage' | 'view' | 'none'
+
+export const ROLES: readonly Role[] = ['admin', 'manage', 'triage', 'view', 'none']
+
+export function isRole(x: unknown): x is Role {
+  return typeof x === 'string' && (ROLES as readonly string[]).includes(x)
+}
+
+// True iff `role` sits at or above `min` in the privilege ladder. ROLES is
+// ordered highest-first, so a lower index is more privileged; an unknown role
+// (index -1) is never "at least" anything. e.g. roleAtLeast(role, 'view') is
+// "has at least read access" (everything except 'none').
+export function roleAtLeast(role: Role, min: Role): boolean {
+  const r = ROLES.indexOf(role)
+  return r !== -1 && r <= ROLES.indexOf(min)
+}

package/common/managed/routes.d.ts

@@ -0,0 +1,2 @@
+// The static server only needs to recognise managed pages, not resolve them.
+export function parseManagedRoute(url: URL): { view: string } | null