Returns an error message when rootPath is unsafe to mount pre-auth, or null when it is usable.
Fail closed: invalid paths must not be mounted.
Reserved matching is case-insensitive (Express does not set case sensitive routing)
and bidirectional: claiming a parent of a reserved prefix (/telephony vs /telephony/twilio)
is also a collision because Express prefix-matches the parent.
extraReservedRoots is the running server's actual mounts (graphqlRootPath, widget, …)
so this check cannot drift from serve(). Discovery-time normalize uses only the
static baseline; prepareServerExtensionConfigs passes the extras.
Returns an error message when
rootPathis unsafe to mount pre-auth, ornullwhen it is usable. Fail closed: invalid paths must not be mounted.Reserved matching is case-insensitive (Express does not set
case sensitive routing) and bidirectional: claiming a parent of a reserved prefix (/telephonyvs/telephony/twilio) is also a collision because Express prefix-matches the parent.extraReservedRootsis the running server's actual mounts (graphqlRootPath, widget, …) so this check cannot drift fromserve(). Discovery-time normalize uses only the static baseline;prepareServerExtensionConfigspasses the extras.