@voltro/cms 0.86.0 → 0.88.0

package/dist/outputRouteGraph.js

@@ -0,0 +1,176 @@
+import { OutputActivationUnavailable as e } from "./outputActivation.js";
+import { copyObservedRoutes as t } from "./routeHistoryStorage.js";
+import { copySnapshotResource as n } from "./buildSnapshot.js";
+import { nativeSnapshotRouteId as r, snapshotRouteDispatch as i } from "./snapshotRouting.js";
+import { copyRouteDispositionDefinition as a } from "./routeDispositions.js";
+import { iterateApprovedRouteDispositions as o } from "./routeDispositionStore.js";
+import { readPublicRouteHistoryView as s } from "./publicRouteHistoryView.js";
+import { verifyStaticPathPage as ee, verifyStaticPathSet as te } from "./staticPathSet.js";
+import { iterateRouteHistory as c, readRouteHistoryPage as ne } from "./routeHistoryStore.js";
+import { readOutputSafetyPage as l } from "./outputActivationStore.js";
+import { admitCapturedAssetUseRights as u } from "./assetUseRights.js";
+import { isPrivateNativeRouteReservation as d } from "./privateNativeRouteReservation.js";
+import { planExactRouteDispositions as f } from "./routeDispositionGraph.js";
+import { canonicalJson as p } from "@voltro/runtime";
+// src/outputRouteGraph.ts
+var m = (t) => {
+	throw new e({ reason: t });
+}, h = (e, t) => {
+	if (typeof e != "object" || !e || Array.isArray(e) || ![Object.prototype, null].includes(Object.getPrototypeOf(e)) || Object.getOwnPropertySymbols(e).length > 0) return m("input");
+	let n = Object.getOwnPropertyDescriptors(e);
+	return Object.keys(n).sort().join(",") !== t || Object.values(n).some((e) => !e.enumerable || !("value" in e)) ? m("input") : e;
+}, g = (e, t = 1e5) => {
+	if (!Array.isArray(e) || e.length > t || Object.getOwnPropertySymbols(e).length > 0 || Object.keys(e).length !== e.length) return m("input");
+	for (let t = 0; t < e.length; t++) {
+		let n = Object.getOwnPropertyDescriptor(e, String(t));
+		if (n === void 0 || !n.enumerable || !("value" in n)) return m("input");
+	}
+	return e;
+}, _ = (e) => typeof e == "string" && /^[a-f0-9]{64}$/.test(e), v = () => {
+	let e = 2;
+	return (t) => {
+		if (e += Buffer.byteLength(p(t)) + 1, e > 67108864) return m("input");
+	};
+}, y = async (e, y, b, x) => {
+	let S = h(b, "artifacts,documents,pathSets,producers,redirects,safety"), C = y.manifest.scope, w = x.now ?? Date.now, T = y.manifest.artifacts.map((e) => ({
+		host: e.host,
+		documents: e.documents,
+		redirects: e.redirects,
+		deny: e.deny
+	})), E = g(S.artifacts, 256).map((e) => h(n({
+		key: "host-artifacts",
+		value: { artifacts: e }
+	}).value.artifacts, "deny,documents,host,redirects"));
+	if (p(E) !== p(T)) return m("integrity");
+	let D = g(S.producers, 256).map((e) => h(n({
+		key: "producer",
+		value: { producer: e }
+	}).value.producer, "buildId,consumerId,host"));
+	if (D.length !== y.manifest.paths.length || D.some((e, t) => e.host !== y.manifest.paths[t].host || typeof e.consumerId != "string" || typeof e.buildId != "string")) return m("integrity");
+	let O = new Map(D.map((e) => [e.host, e])), k = new Set(y.manifest.paths.map((e) => e.host)), A = await ne(e, C, {
+		expectedRevision: x.observed.generation,
+		take: 1
+	});
+	if (A.sourceDigest !== x.observed.sourceDigest) return m("changed");
+	let j = [], re = v();
+	for await (let t of c(e, C, A.revision)) {
+		if (re(t), j.length >= 1e5) return m("input");
+		j.push({
+			url: t.url,
+			routeId: t.routeId
+		});
+	}
+	let M = await s(e, C), N = M.namespace.binding;
+	if (y.manifest.paths.some((e) => !M.namespace.domains.some((t) => t.host === e.host))) return m("changed");
+	let P = [], F = [], I = v();
+	for await (let e of M.entries()) {
+		if (I(e), P.length >= 1e5) return m("input");
+		let t = {
+			url: e.url,
+			routeId: e.routeId
+		};
+		P.push(t), e.active && F.push(t);
+	}
+	let L = new Map(F.map((e) => [e.url, e.routeId])), R = [], z = /* @__PURE__ */ new Map(), B = /* @__PURE__ */ new Set(), V = v();
+	for (let e of g(S.pathSets, 256)) {
+		let t = h(e, "pages,set"), n = te(t.set, x.keys), a = n.manifest.context, o = y.manifest.paths.find((e) => e.host === a.host), s = O.get(a.host);
+		if (o === void 0 || s === void 0 || B.has(n.id) || n.id !== o.setId || n.manifest.count !== o.count || a.tenantId !== C.tenantId || a.site !== C.site || a.environment !== C.environment || a.snapshotId !== y.manifest.snapshot.id || a.snapshotDigest !== y.manifest.snapshot.digest || a.releaseId !== y.manifest.snapshot.releaseId || a.inputsId !== y.manifest.app.inputsId || a.executionId !== y.manifest.app.executionId || a.policyDigest !== y.manifest.renderPolicyDigest || a.consumerId !== s.consumerId || a.buildId !== s.buildId || a.host !== o.host || p(a.localeIds) !== p(N.definition.site.locales.filter((e) => e.enabled).map((e) => e.id).sort()) || !a.owners.includes("cms") || !a.owners.includes("code")) return m("integrity");
+		B.add(n.id);
+		let c = g(t.pages, 500);
+		if (c.length !== n.manifest.pages.length) return m("integrity");
+		for (let e = 0; e < c.length; e++) for (let t of ee(n, e, c[e])) {
+			if (V(t), R.length >= 1e5) return m("input");
+			if (t.host !== a.host) return m("integrity");
+			let e = "https://" + t.host + t.path, n = L.get(e), o = i(N.definition.routing, t.path, n !== void 0);
+			if (z.has(e) || !N.definition.site.locales.some((e) => e.enabled && e.id === t.localeId) || o === null || o.owner !== t.owner || n !== void 0 && n !== t.routeId) return m("changed");
+			if (t.owner === "cms") {
+				if (n !== t.routeId) return m("changed");
+			} else {
+				let e = o.code === null ? void 0 : N.definition.routing.definition?.claims[o.code.file];
+				if (e?.kind !== "code" || e.public !== !0 || o.code?.file !== t.file || typeof t.file != "string" || r(C, t.localeId, t.file, t.path) !== t.routeId) return m("changed");
+			}
+			R.push(t), z.set(e, t.routeId);
+		}
+	}
+	let H = /* @__PURE__ */ new Map();
+	for (let e of R) H.set(e.host, (H.get(e.host) ?? 0) + 1);
+	if (B.size !== y.manifest.paths.length || y.manifest.paths.some((e) => (H.get(e.host) ?? 0) !== e.count)) return m("integrity");
+	let U = v(), W = g(S.documents).map((e) => {
+		let r = h(n({
+			key: "document",
+			value: { document: e }
+		}).value.document, "media,routeId,url");
+		U(r);
+		let [i] = t([{
+			url: r.url,
+			routeId: r.routeId
+		}]);
+		if (i === void 0 || z.get(i.url) !== i.routeId) return m("integrity");
+		let a = g(r.media).map((e) => {
+			let t = h(e, "digest,rights");
+			return _(t.digest) ? {
+				digest: t.digest,
+				rights: t.rights
+			} : m("integrity");
+		});
+		return {
+			...i,
+			media: a
+		};
+	});
+	if (new Set(W.map((e) => e.url)).size !== z.size) return m("integrity");
+	let G = h(S.safety, "entries,generation"), K = [], q = v(), J, Y;
+	for (;;) {
+		let t = await l(e, C, {
+			...J === void 0 ? {} : { after: J },
+			...Y === void 0 ? {} : { expectedGeneration: Y }
+		});
+		Y ??= t.generation;
+		for (let e of t.entries) {
+			if (q(e), K.length >= 1e5) return m("input");
+			K.push(e);
+		}
+		if (t.next === null) break;
+		J = t.next;
+	}
+	let ie = g(G.entries).map((e) => n({
+		key: "safety-entry",
+		value: { entry: e }
+	}).value.entry);
+	if (Y !== G.generation || p(K) !== p(ie)) return m("changed");
+	let X = new Set(K.flatMap((e) => e.target.kind === "url" ? [e.target.url] : [])), ae = new Set(K.flatMap((e) => e.target.kind === "asset" ? [e.target.digest] : []));
+	for (let t of W) {
+		if (X.has(t.url)) return m("denied");
+		let n = new URL(t.url);
+		for (let r of t.media) {
+			if (ae.has(r.digest)) return m("denied");
+			await u(e, C, r.rights, w(), x.use({
+				host: n.hostname,
+				path: n.pathname
+			}));
+		}
+	}
+	let Z = [], oe = v();
+	for await (let t of o(e, C)) {
+		if (oe(t.definition), Z.length >= 1e5) return m("input");
+		Z.push(t.definition);
+	}
+	let Q = (e) => k.has(new URL(e.url).hostname), se = [...new Map([...j.filter(Q), ...P.filter(Q)].map((e) => [e.url, e])).values()].filter((e) => d(N.definition.routing, new URL(e.url).pathname, L.has(e.url))), $ = f({
+		observed: j.filter(Q),
+		sourceObserved: P.filter(Q),
+		currentOwned: F.filter(Q),
+		reserved: se,
+		current: R.map((e) => ({
+			url: "https://" + e.host + e.path,
+			routeId: e.routeId
+		})),
+		decisions: Z.filter((e) => k.has(new URL(e.source.url).hostname)),
+		now: w()
+	}), ce = v(), le = g(S.redirects).map((e) => {
+		let t = a(e);
+		return ce(t), t;
+	});
+	if (p(le) !== p($)) return m("changed");
+	for (let e of $) if (X.has(e.source.url) || e.action.kind === "redirect" && X.has(e.action.target.url)) return m("denied");
+};
+export { y as admitOutputRouteGraph };

package/dist/outputSafetyArtifact.js

@@ -0,0 +1,146 @@
+import { normalizeHost as e } from "./domainHost.js";
+import { copyOutputActivationScope as t } from "./outputActivation.js";
+import { copySnapshotResource as n } from "./buildSnapshot.js";
+import { readOutputSafetyPage as r } from "./outputActivationStore.js";
+import { Schema as i } from "effect";
+import { createHash as a } from "node:crypto";
+import { canonicalJson as o } from "@voltro/runtime";
+// src/outputSafetyArtifact.ts
+var s = class extends i.TaggedError()("OutputSafetyArtifactUnavailable", { reason: i.Literals([
+	"binding",
+	"changed",
+	"budget"
+]) }) {}, c = (e) => {
+	throw new s({ reason: e });
+}, l = (e) => a("sha256").update(o(e)).digest("hex"), u = (e) => typeof e == "string" && /^[a-f0-9]{64}$/.test(e), d = (e) => typeof e == "string" && /^[A-Za-z0-9_-]{1,64}$/.test(e), f = (e, t) => !e || typeof e != "object" || Array.isArray(e) || Object.keys(e).sort().join(",") !== t ? c("binding") : e, p = (t) => {
+	let r = f(n({
+		key: "safety-binding",
+		value: { binding: t }
+	}).value.binding, "app,buildId,consumerId,documents,host,snapshot"), i = f(r.snapshot, "digest,id"), a = f(r.app, "executionId,inputsId"), o = f(r.documents, "artifactId,pathSetIds");
+	return !d(i.id) || !u(i.digest) || !u(a.inputsId) || !u(a.executionId) || !u(o.artifactId) || !Array.isArray(o.pathSetIds) || o.pathSetIds.length < 1 || o.pathSetIds.length > 64 || !o.pathSetIds.every(u) || new Set(o.pathSetIds).size !== o.pathSetIds.length || !d(r.consumerId) || !d(r.buildId) || typeof r.host != "string" || r.host.length > 253 || e(r.host) !== r.host ? c("binding") : {
+		snapshot: {
+			id: i.id,
+			digest: i.digest
+		},
+		app: {
+			inputsId: a.inputsId,
+			executionId: a.executionId
+		},
+		documents: {
+			artifactId: o.artifactId,
+			pathSetIds: [...o.pathSetIds].sort()
+		},
+		consumerId: r.consumerId,
+		buildId: r.buildId,
+		host: r.host
+	};
+}, m = (e) => {
+	let t = f(n({
+		key: "safety-selection",
+		value: { selection: e }
+	}).value.selection, "artifactId");
+	return u(t.artifactId) ? { artifactId: t.artifactId } : c("binding");
+}, h = (e) => !Number.isSafeInteger(e) || e < 1 ? c("budget") : Math.min(e, 67108864), g = async (e, n, i) => {
+	let a = t(n), s = h(i.maxBytes), l = i.expectedGeneration, u, d = 0, f = [];
+	for (;;) {
+		let t = await e.transactional((e) => r(e, a, {
+			...l === void 0 ? {} : { expectedGeneration: l },
+			...u === void 0 ? {} : { after: u }
+		}));
+		if (l ??= t.generation, l > 1e5) return c("budget");
+		for (let e of t.entries) {
+			if (d += Buffer.byteLength(o(e), "utf8") + 1, d > s) return c("budget");
+			f.push(e);
+		}
+		if (t.next === null) break;
+		u = t.next;
+	}
+	return f.length === l ? {
+		generation: l,
+		entries: f
+	} : c("changed");
+}, _ = (e, t) => Buffer.from(o({
+	version: 1,
+	generation: e.generation,
+	index: t,
+	entries: e.entries.slice(t * 500, (t + 1) * 500)
+}) + "\n", "utf8"), v = (e, t) => {
+	let n = [], r = 0;
+	for (let i = 0; i < Math.max(1, Math.ceil(e.entries.length / 500)); i++) {
+		let o = _(e, i);
+		if (r += o.length, r > t) return c("budget");
+		n.push({
+			path: "safety/" + String(i).padStart(5, "0") + ".json",
+			size: o.length,
+			digest: a("sha256").update(o).digest("hex"),
+			contentType: "application/json"
+		});
+	}
+	return n;
+}, y = (e, t, n) => ({
+	version: 1,
+	profile: "voltro.cms.snapshot-safety-output/v1",
+	kind: "deny",
+	...e,
+	...t,
+	generation: n.generation,
+	entryCount: n.entries.length,
+	chunkCount: Math.max(1, Math.ceil(n.entries.length / 500)),
+	safetyDigest: l(n.entries)
+}), b = async (e, n, r) => {
+	let i = t(n), a = h(r.maxBytes), s = r.admit, d = r.provider, f = p(await e.transactional((e) => s(e))), m = await g(e, i, { maxBytes: a }), b = l(m.entries), x = v(m, a), S;
+	try {
+		S = await d.begin();
+		for (let e = 0; e < x.length; e++) {
+			let t = _(m, e);
+			await S.write(x[e], (async function* () {
+				yield t;
+			})());
+		}
+		let t = p(await e.transactional((e) => s(e)));
+		if (o(t) !== o(f) || l((await g(e, i, {
+			maxBytes: a,
+			expectedGeneration: m.generation
+		})).entries) !== b) return c("changed");
+		let n = await S.seal(y(i, f, m));
+		return u(n.id) ? {
+			artifactId: n.id,
+			generation: m.generation,
+			entryCount: m.entries.length
+		} : c("binding");
+	} catch (e) {
+		throw S !== void 0 && await Promise.allSettled([S.abort()]), e;
+	}
+}, x = async (e, r, i, a) => {
+	if (!u(i)) return c("binding");
+	let s = t(r), d = h(a.maxBytes), m = a.provider.read?.bind(a.provider);
+	if (m === void 0) return c("binding");
+	let _ = p(await e.transactional((e) => a.admit(e))), b = await g(e, s, { maxBytes: d }), x = {
+		version: 1,
+		subject: y(s, _, b),
+		files: v(b, d)
+	};
+	if (l(x) !== i) return c("binding");
+	let S = f(n({
+		key: "safety-artifact",
+		value: { artifact: await m(i) }
+	}).value.artifact, "id,manifest");
+	if (S.id !== i || o(S.manifest) !== o(x)) return c("binding");
+	let C = p(await e.transactional((e) => a.admit(e)));
+	return o(C) !== o(_) || l((await g(e, s, {
+		maxBytes: d,
+		expectedGeneration: b.generation
+	})).entries) !== l(b.entries) ? c("changed") : {
+		verification: {
+			...b,
+			artifactId: i,
+			safetyDigest: l(b.entries),
+			binding: _
+		},
+		artifact: {
+			id: i,
+			manifest: x
+		}
+	};
+}, S = async (...e) => (await x(...e)).verification;
+export { s as OutputSafetyArtifactUnavailable, b as captureOutputSafetyArtifact, m as copyOutputSafetySelection, x as readCurrentOutputSafetyArtifact, g as readOutputSafetySnapshot, S as readVerifiedOutputSafetyArtifact };

package/dist/outputTargetRest.js

@@ -0,0 +1,61 @@
+import { cmsCredential as e, privateCmsHttpRoutes as t, privateCmsOperation as n } from "./privateCmsTransport.js";
+import { CmsOutputDeploymentUnavailable as r } from "./outputDeploymentService.js";
+import { outputDeploymentManifestSchema as i } from "./outputDeploymentRest.js";
+import { Schema as a } from "effect";
+import { strictInput as o } from "@voltro/protocol";
+// src/outputTargetRest.ts
+var s = a.String.check(a.isPattern(/^[A-Za-z0-9_-]{1,64}$/)), c = a.String.check(a.isPattern(/^[a-f0-9]{64}$/)), l = a.String.check(a.isMaxLength(253)), u = a.Struct({
+	deploymentId: s,
+	snapshot: a.Struct({
+		id: s,
+		digest: c
+	}),
+	pathSets: a.Array(a.Struct({
+		host: l,
+		jobId: s,
+		digest: c
+	})).check(a.isMaxLength(256)),
+	artifacts: a.Array(a.Struct({
+		host: l,
+		documents: c,
+		assets: c,
+		redirects: c,
+		sitemap: c,
+		robots: c,
+		deny: c
+	})).check(a.isMaxLength(256))
+}), d = a.Struct({
+	set: a.Struct({
+		id: c,
+		manifest: i
+	}),
+	pathSets: a.Array(a.Struct({
+		host: l,
+		jobId: s
+	})),
+	outputs: a.Array(a.Struct({
+		region: s,
+		outputId: c
+	}))
+}), f = (i) => {
+	let a = [{
+		...n({
+			namespace: "cms.outputTarget",
+			path: "/v1/cms/output-targets",
+			operationPrefix: "cmsOutputTarget",
+			tags: ["CMS output deployment"],
+			error: r,
+			credentialError: "CmsOutputDeploymentUnavailable",
+			errorStatus: { CmsOutputDeploymentUnavailable: 409 }
+		}, "prepare", "Prepare one original complete output target", "Scoped cms:deploy credential. The server derives app, schema, binding and cache contracts from the actual retained snapshot and verifies original signed path jobs. Fixed server ports stage and rehash all six roles in every required region. Metadata alone grants no activation or serving authority.", o(u, "cms.outputTarget.prepare", !0), d, (t, n) => i.prepare({
+			...t,
+			credential: e(n, "CmsOutputDeploymentUnavailable")
+		})),
+		maxBodyBytes: 524288
+	}];
+	return {
+		routes: a,
+		httpRoutes: t(a)
+	};
+};
+export { f as cmsOutputTargetRest };

package/dist/pathSegmentEncoding.js

@@ -0,0 +1,3 @@
+// src/pathSegmentEncoding.ts
+var e = (e) => encodeURIComponent(e);
+export { e as encodeCanonicalPathSegment };

package/dist/presenceAnchors.js

@@ -1,4 +1,4 @@
-//#region src/presenceAnchors.ts
+// src/presenceAnchors.ts
 var e = /^[A-Za-z0-9_.:/-]{1,120}$/, t = (t) => typeof t == "string" && e.test(t), n = (e) => Number.isInteger(e) && e >= 0 && e <= 1e6, r = (e) => typeof e == "number" && Number.isFinite(e) && e >= 0 && e <= 1, i = (e) => {
 	if (typeof e != "object" || !e) return null;
 	let i = e;
@@ -64,5 +64,4 @@ var e = /^[A-Za-z0-9_.:/-]{1,120}$/, t = (t) => typeof t == "string" && e.test(t
 		field: a
 	});
 };
-//#endregion
 export { i as parsePresenceAnchor, a as presenceAnchorOf };

package/dist/preview.js

@@ -1,5 +1,5 @@
 import { createHmac as e, timingSafeEqual as t } from "node:crypto";
-//#region src/preview.ts
+// src/preview.ts
 var n = 3600, r = (e) => (Buffer.isBuffer(e) ? e : Buffer.from(e, "utf8")).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""), i = (e) => Buffer.from(e.replace(/-/g, "+").replace(/_/g, "/"), "base64"), a = (e) => e ?? process.env.VOLTRO_SESSION_SECRET ?? null, o = (t, i, o = {}) => {
 	let s = a(o.secret);
 	if (s === null) throw Error("cms previewToken requires a signing secret — set VOLTRO_SESSION_SECRET or pass { secret }. Refusing to sign with a hardcoded default (it would ship in the bundle and be forgeable).");
@@ -27,5 +27,4 @@ var n = 3600, r = (e) => (Buffer.isBuffer(e) ? e : Buffer.from(e, "utf8")).toStr
 		return null;
 	}
 };
-//#endregion
 export { o as previewToken, s as verifyPreviewToken };

package/dist/privateCmsTransport.js

@@ -0,0 +1,75 @@
+import { Effect as e } from "effect";
+import { defineAction as t } from "@voltro/protocol";
+import { RestRouteError as n, projectedFailure as r, publicApiRoute as i, restError as a, restRoutesToHttpRoutes as o } from "@voltro/protocol/rest";
+// src/privateCmsTransport.ts
+var s = {
+	"cache-control": "private, no-store",
+	pragma: "no-cache",
+	vary: "Authorization"
+}, c = (e) => {
+	let t = e.headers.authorization;
+	return typeof t != "string" || t.length > 520 ? null : /^Bearer ([^\s]+)$/i.exec(t)?.[1] ?? null;
+}, l = (e, t) => c(e) ?? (() => {
+	throw a(401, {
+		error: t,
+		_tag: t,
+		reason: "credential"
+	}, {
+		...s,
+		"www-authenticate": "Bearer"
+	});
+})(), u = (e) => c(e) === null ? {
+	status: 401,
+	message: "CMS credential required"
+} : void 0, d = async (t, i, o) => {
+	let c = await e.runPromise(e.result(t));
+	if (c._tag === "Success") return c.success;
+	let l = c.failure;
+	if (typeof l == "object" && l && "_tag" in l && l._tag === i && "reason" in l && l.reason === "credential") {
+		let e = r(l, o, { errorStatus: { [i]: 401 } });
+		throw e instanceof n ? a(e.status, e.body, {
+			...s,
+			"www-authenticate": "Bearer"
+		}) : e;
+	}
+	throw l;
+}, f = (e, n, r, a, o, s, c) => {
+	let l = `${e.namespace}.${n}`, f = t({
+		name: l,
+		input: o,
+		output: s,
+		error: e.error,
+		openAccess: "Dedicated credential exchange: the header guard and server-bound CMS service verify authority; no ambient Subject grants access.",
+		publicApi: {
+			method: "POST",
+			path: `${e.path}/${n}`,
+			security: "required",
+			idempotent: !1,
+			operationId: `${e.operationPrefix}${n[0].toUpperCase()}${n.slice(1)}`,
+			tags: [...e.tags],
+			errorStatus: e.errorStatus,
+			...Object.hasOwn(e.errorStatus, e.credentialError) ? { additionalErrorStatuses: { [e.credentialError]: [401] } } : {},
+			summary: r,
+			description: a
+		}
+	}), p = i(f, (t, n) => d(c(t, n), e.credentialError, f));
+	return {
+		...p,
+		guards: [...p.guards ?? [], u],
+		maxBodyBytes: 16384
+	};
+}, p = (e) => o(e).map((e) => ({
+	...e,
+	handle: async (...t) => {
+		let n = await e.handle(...t);
+		return {
+			...n,
+			headers: {
+				...n.headers,
+				...s,
+				...n.status === 401 ? { "www-authenticate": "Bearer" } : {}
+			}
+		};
+	}
+}));
+export { l as cmsCredential, s as privateCmsHeaders, p as privateCmsHttpRoutes, f as privateCmsOperation };

package/dist/privateNativeRouteReservation.js

@@ -0,0 +1,9 @@
+import { snapshotRouteDispatch as e } from "./snapshotRouting.js";
+// src/privateNativeRouteReservation.ts
+var t = (t, n, r) => {
+	let i = e(t, n, r);
+	if (i?.owner !== "code") return !1;
+	let a = t.definition?.claims[i.code.file];
+	return a?.kind !== "code" || a.public !== !0;
+};
+export { t as isPrivateNativeRouteReservation };