@ours.network/cowork 1.0.0 → 1.0.2

package/README.md

@@ -7,15 +7,15 @@ ours-cowork web
 ours-cowork docs
 ```
 
-`ours-cowork web` starts the daemon if it is absent, waits for the console, and opens `http://127.0.0.1:3052/`. Create a room with a friendly display name first, then add each invitation requirement from its Invite panel. Names are trimmed, normalized to Unicode NFC, and may contain 1–64 Unicode characters excluding control and format characters. Duplicate names are allowed. The Communication view contains the human-readable room chat; operational records remain in Events and the complete ordered stream remains in Archive.
+`ours-cowork web` starts the daemon if it is absent, waits for the console, and opens `http://127.0.0.1:3052/`. Create a room with a name first, then add each invitation requirement from its Invite panel. Names are trimmed, normalized to Unicode NFC, and may contain 1–64 Unicode characters excluding control and format characters. A normalized name must be unique among identities in the shared daemon. The Communication view contains the human-readable room chat; operational records remain in Events and the complete ordered stream remains in Archive.
 
-The friendly `room_name` is presentation metadata. By default, new rooms use the globally unique SDK identity `ours-cowork-<room_id>`. Operators may configure `roomIdentity.nameMode` as `friendly`; new rooms then use `ours-cowork-<bounded-ascii-slug>-<room_id>`. The full room ID preserves uniqueness, and the exact authenticated name is frozen at creation independently of later display-name or configuration changes. Identity CIDs, not names, remain the authorization and routing keys. Pre-1.0 rooms using `cowork-room-<room_id>` or `ours-cowork-room:<name>` custom packet state are detected and refused: back them up with the old release, recreate them, and re-invite their participants.
+Each room identity is exactly `ours-cowork:<room name>`, preserving the normalized name supplied at creation so Messenger can display it directly without separate `room_name` metadata. The authenticated identity name is frozen at creation; later room settings may change `room_name` but do not rename the identity, CID, contacts, or history. Identity CIDs, not names, remain the authorization and routing keys. Because identity names are daemon-global, creating another room with the same normalized name fails closed. Earlier unreleased ID- and slug-based identity formats are unsupported; no migration is provided for this unreleased major.
 
 The localhost HTTP console has no authentication. Keep it bound to `127.0.0.1`; do not proxy, forward, or expose the port to other hosts. Room state is refreshed by periodic polling, not pushed to the browser.
 
 The same listener describes its own room management REST API: `http://127.0.0.1:3052/openapi.json` is the OpenAPI 3.1 document and `http://127.0.0.1:3052/docs` is the browser UI for it. Both are read-only, load no remote assets, and follow the console's loopback-only exposure rules.
 
-Start or install the shared daemon with `@ours.network/cli` 2.0.1 before starting cowork. Cowork never embeds, starts, stops, or silently substitutes an ours daemon. It uses the SDK-standard shared selection (the default `~/.ours` daemon, `OURS_CONFIG`, or a coherent `OURS_PORT` plus `OURS_STATE_DIR` selection) and fails clearly when that daemon is unavailable or mismatched.
+Start or install the shared daemon with `@ours.network/cli` 2.5.0 before starting cowork. Cowork never embeds, starts, stops, or silently substitutes an ours daemon. It uses the SDK-standard shared selection (the default `~/.ours` daemon, `OURS_CONFIG`, or a coherent `OURS_PORT` plus `OURS_STATE_DIR` selection) and fails clearly when that daemon is unavailable or mismatched.
 
 The shared daemon retains application payload history outside its protocol packets: each identity has a `history.sqlite3` database and immutable content-addressed file blobs. Cowork authorizes unread metadata by authenticated CID, reads the corresponding persistent history or blob, durably archives the room item and its complete fan-out, and only then advances that exact SDK unread item. There is no packet-inbox fallback, defer queue, host outbox, or cross-store transaction.
 

package/dist/cli.js

@@ -4061,6 +4061,232 @@ var coerce = {
 };
 var NEVER = INVALID;
 
+// src/config.ts
+var DIRECTORY_MODE = 448;
+var FILE_MODE = 384;
+var NO_FOLLOW = nodeFs.constants.O_NOFOLLOW ?? 0;
+var CoworkConfigSchema = external_exports.object({
+  version: external_exports.literal(1),
+  stateDir: external_exports.string().min(1),
+  rest: external_exports.object({
+    enabled: external_exports.boolean(),
+    port: external_exports.number().int().min(1).max(65535)
+  }).strict()
+}).strict();
+var CoworkConfigError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "CoworkConfigError";
+  }
+};
+function defaultConfig(home = homedir()) {
+  return {
+    version: 1,
+    stateDir: resolve(home, ".ours-cowork"),
+    rest: { enabled: true, port: 3052 }
+  };
+}
+function loadConfig(env = process.env, io = {}) {
+  rejectRemovedEnvironment(env);
+  const fs2 = io.fs ?? nodeFs;
+  const defaults = defaultConfig(io.home);
+  const configPath = resolve(env.OURS_COWORK_CONFIG ?? join(io.home ?? homedir(), ".ours-cowork", "config.json"));
+  let file = defaults;
+  const stat = lstatIfPresent(fs2, configPath);
+  if (stat) {
+    assertSecureFile(fs2, configPath, "config file");
+    let parsed;
+    try {
+      parsed = JSON.parse(readSecureFile(fs2, configPath, "config file").toString("utf8"));
+    } catch (error) {
+      throw new CoworkConfigError(`malformed cowork config at ${configPath}`, { cause: error });
+    }
+    rejectRemovedConfig(parsed, configPath);
+    try {
+      file = CoworkConfigSchema.parse(parsed);
+    } catch (error) {
+      throw new CoworkConfigError(`invalid cowork config at ${configPath}`, { cause: error });
+    }
+  } else if (env.OURS_COWORK_CONFIG !== void 0) {
+    throw new CoworkConfigError(`configured cowork config does not exist: ${configPath}`);
+  }
+  const restPort = env.OURS_COWORK_REST_PORT === void 0 ? void 0 : parsePort(env.OURS_COWORK_REST_PORT);
+  try {
+    return CoworkConfigSchema.parse({
+      version: 1,
+      stateDir: resolve(env.OURS_COWORK_STATE_DIR ?? file.stateDir),
+      rest: {
+        enabled: restPort === void 0 ? file.rest.enabled : true,
+        port: restPort ?? file.rest.port
+      }
+    });
+  } catch (error) {
+    throw new CoworkConfigError("invalid effective cowork config", { cause: error });
+  }
+}
+function rejectRemovedEnvironment(env) {
+  const removed = [
+    "OURS_COWORK_BROKER_URL",
+    "OURS_COWORK_DAEMON_MODE",
+    "OURS_COWORK_DAEMON_ENDPOINT",
+    "OURS_COWORK_DAEMON_STATE_DIR"
+  ].filter((name) => env[name] !== void 0);
+  if (removed.length === 0) return;
+  throw new CoworkConfigError(
+    `${removed.join(", ")} ${removed.length === 1 ? "was" : "were"} removed: ours-cowork now attaches only to the shared ours daemon. Configure that daemon with @ours.network/cli and select it through the standard OURS_CONFIG, OURS_PORT, and OURS_STATE_DIR inputs.`
+  );
+}
+function rejectRemovedConfig(value, path) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+  const removed = ["brokerUrl", "daemon"].filter((key) => Object.hasOwn(value, key));
+  if (removed.length === 0) return;
+  throw new CoworkConfigError(
+    `cowork config at ${path} contains removed ${removed.join(" and ")} ${removed.length === 1 ? "key" : "keys"}: ours-cowork now attaches only to the shared ours daemon. Remove those keys and configure the daemon with @ours.network/cli.`
+  );
+}
+function ensureRuntimeState(config, io = {}) {
+  const parsed = CoworkConfigSchema.parse(config);
+  const fs2 = io.fs ?? nodeFs;
+  const stateDir = resolve(parsed.stateDir);
+  assertSecureAncestors(fs2, stateDir, "state directory");
+  const existing = lstatIfPresent(fs2, stateDir);
+  if (!existing) {
+    createSecureDirectoryTree(fs2, stateDir, "state directory");
+  }
+  assertSecureDirectory(fs2, stateDir, "state directory");
+  const roomsPath = join(stateDir, "rooms");
+  const rooms = lstatIfPresent(fs2, roomsPath);
+  if (!rooms) {
+    fs2.mkdirSync(roomsPath, { mode: DIRECTORY_MODE });
+    secureOpenedDirectory(fs2, roomsPath, "rooms directory");
+    fsyncDirectory(fs2, stateDir);
+  }
+  assertSecureDirectory(fs2, roomsPath, "rooms directory");
+  return {
+    socketPath: join(stateDir, "management.sock"),
+    pidPath: join(stateDir, "daemon.pid"),
+    lockPath: join(stateDir, "daemon.lock")
+  };
+}
+function parsePort(value) {
+  if (!/^[1-9][0-9]{0,4}$/.test(value)) {
+    throw new CoworkConfigError("OURS_COWORK_REST_PORT must be a decimal port from 1 to 65535");
+  }
+  const port = Number(value);
+  if (port > 65535) throw new CoworkConfigError("OURS_COWORK_REST_PORT must be from 1 to 65535");
+  return port;
+}
+function assertSecureAncestors(fs2, path, label) {
+  const absolute = isAbsolute(path) ? path : resolve(path);
+  const root = parse(absolute).root;
+  const rootOwner = fs2.lstatSync(root).uid;
+  let cursor = root;
+  const components = absolute.slice(root.length).split("/").filter(Boolean);
+  for (const [index, component] of components.entries()) {
+    cursor = join(cursor, component);
+    const stat = lstatIfPresent(fs2, cursor);
+    if (stat?.isSymbolicLink()) throw new CoworkConfigError(`${label} must not traverse a symbolic link (symlink): ${cursor}`);
+    if (!stat) break;
+    if (!stat.isDirectory()) {
+      if (index === components.length - 1) return;
+      throw new CoworkConfigError(`${label} ancestor is not a directory: ${cursor}`);
+    }
+    if (index < components.length - 1) assertTrustedAncestor(stat, rootOwner, cursor, label);
+  }
+}
+function assertTrustedAncestor(stat, rootOwner, path, label) {
+  const uid = typeof process.getuid === "function" ? process.getuid() : stat.uid;
+  const trustedStickyDirectory = (stat.mode & 512) !== 0;
+  const writableByOthers = (stat.mode & 18) !== 0;
+  const trustedOwner = stat.uid === uid || stat.uid === 0 || stat.uid === rootOwner;
+  if (writableByOthers && (!trustedStickyDirectory || !trustedOwner)) {
+    throw new CoworkConfigError(`${label} has an unsafe writable ancestor: ${path}`);
+  }
+}
+function createSecureDirectoryTree(fs2, path, label) {
+  const missing = [];
+  let cursor = path;
+  while (!lstatIfPresent(fs2, cursor)) {
+    missing.push(cursor);
+    const parent = dirname(cursor);
+    if (parent === cursor) throw new CoworkConfigError(`cannot locate an existing ancestor for ${label}`);
+    cursor = parent;
+  }
+  assertSecureAncestors(fs2, path, label);
+  for (const directory of missing.reverse()) {
+    fs2.mkdirSync(directory, { mode: DIRECTORY_MODE });
+    secureOpenedDirectory(fs2, directory, label);
+    fsyncDirectory(fs2, dirname(directory));
+  }
+}
+function secureOpenedDirectory(fs2, path, label) {
+  let fd;
+  try {
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    const opened = fs2.fstatSync(fd);
+    const current = fs2.lstatSync(path);
+    if (!opened.isDirectory() || current.isSymbolicLink() || opened.dev !== current.dev || opened.ino !== current.ino) {
+      throw new CoworkConfigError(`${label} changed while opening`);
+    }
+    fs2.fchmodSync(fd, DIRECTORY_MODE);
+    fs2.fsyncSync(fd);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
+  }
+}
+function assertSecureDirectory(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
+  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
+  if (!stat.isDirectory()) throw new CoworkConfigError(`${label} must be a directory`);
+  if ((stat.mode & 511) !== DIRECTORY_MODE) {
+    throw new CoworkConfigError(`${label} mode must be 0700`);
+  }
+  assertOwner(stat, label);
+}
+function assertSecureFile(fs2, path, label) {
+  const stat = fs2.lstatSync(path);
+  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
+  if (!stat.isFile() || stat.nlink !== 1) throw new CoworkConfigError(`${label} must be a single-link regular file`);
+  if ((stat.mode & 511) !== FILE_MODE) throw new CoworkConfigError(`${label} mode must be 0600`);
+  assertOwner(stat, label);
+}
+function assertOwner(stat, label) {
+  if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+    throw new CoworkConfigError(`${label} must be owned by the current user`);
+  }
+}
+function readSecureFile(fs2, path, label) {
+  let fd;
+  try {
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    const opened = fs2.fstatSync(fd);
+    const current = fs2.lstatSync(path);
+    if (!opened.isFile() || opened.nlink !== 1 || (opened.mode & 511) !== FILE_MODE || typeof process.getuid === "function" && opened.uid !== process.getuid() || current.isSymbolicLink() || current.dev !== opened.dev || current.ino !== opened.ino) {
+      throw new CoworkConfigError(`${label} changed while opening`);
+    }
+    return fs2.readFileSync(fd);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
+  }
+}
+function fsyncDirectory(fs2, path) {
+  let fd;
+  try {
+    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
+    fs2.fsyncSync(fd);
+  } finally {
+    if (fd !== void 0) fs2.closeSync(fd);
+  }
+}
+function lstatIfPresent(fs2, path) {
+  try {
+    return fs2.lstatSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+
 // src/contracts.ts
 import { createHash } from "node:crypto";
 var MAX_TEXT_BYTES = 262144;
@@ -4072,8 +4298,6 @@ var MAX_FILE_NAME_BYTES = 255;
 var MAX_MIME_BYTES = 255;
 var MAX_ROLE_BYTES = 256;
 var MAX_ROOM_NAME_CHARACTERS = 64;
-var MAX_ROOM_IDENTITY_NAME_CHARACTERS = 64;
-var MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS = 25;
 function utf8Bounded(label, maximumBytes) {
   return external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") >= 1, `${label} must be at least 1 UTF-8 byte`).refine(
     (value) => Buffer.byteLength(value, "utf8") <= maximumBytes,
@@ -4120,24 +4344,13 @@ var RoomNameSchema = external_exports.string().refine(
     });
   }
 });
-var RoomIdentityNameModeSchema = external_exports.enum(["stable_id", "friendly"]);
-var ROOM_IDENTITY_PREFIX = "ours-cowork-";
-var SDK_IDENTITY_NAME_PATTERN = /^[A-Za-z0-9 _.@-]{1,64}$/;
-var FRIENDLY_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function roomIdentityName(roomId) {
-  return `${ROOM_IDENTITY_PREFIX}${LowerCrockfordUlidSchema.parse(roomId)}`;
-}
-function legacyRoomIdentityName(roomId) {
-  return `cowork-room-${LowerCrockfordUlidSchema.parse(roomId)}`;
-}
+var ROOM_IDENTITY_PREFIX = "ours-cowork:";
 function isPersistedRoomIdentityName(roomId, identityName) {
-  const id = LowerCrockfordUlidSchema.safeParse(roomId);
-  if (!id.success) return false;
-  if (identityName === roomIdentityName(id.data) || identityName === legacyRoomIdentityName(id.data)) return true;
-  const suffix = `-${id.data}`;
-  if (!identityName.startsWith(ROOM_IDENTITY_PREFIX) || !identityName.endsWith(suffix)) return false;
-  const slug = identityName.slice(ROOM_IDENTITY_PREFIX.length, -suffix.length);
-  return slug.length >= 1 && slug.length <= MAX_FRIENDLY_IDENTITY_SLUG_CHARACTERS && FRIENDLY_SLUG_PATTERN.test(slug) && identityName.length <= MAX_ROOM_IDENTITY_NAME_CHARACTERS && SDK_IDENTITY_NAME_PATTERN.test(identityName);
+  if (!LowerCrockfordUlidSchema.safeParse(roomId).success || !identityName.startsWith(ROOM_IDENTITY_PREFIX)) {
+    return false;
+  }
+  const parsed = RoomNameSchema.safeParse(identityName.slice(ROOM_IDENTITY_PREFIX.length));
+  return parsed.success && identityName === `${ROOM_IDENTITY_PREFIX}${parsed.data}`;
 }
 var RoleSchema = utf8Bounded("role", MAX_ROLE_BYTES);
 var ROOM_ROLE = "room";
@@ -4794,237 +5007,6 @@ var AppendRecordSchema = external_exports.discriminatedUnion("kind", [
   refineFileRecord(record, context);
 });
 
-// src/config.ts
-var DIRECTORY_MODE = 448;
-var FILE_MODE = 384;
-var NO_FOLLOW = nodeFs.constants.O_NOFOLLOW ?? 0;
-var CoworkConfigSchema = external_exports.object({
-  version: external_exports.literal(1),
-  stateDir: external_exports.string().min(1),
-  roomIdentity: external_exports.object({
-    nameMode: RoomIdentityNameModeSchema
-  }).strict().default({ nameMode: "stable_id" }),
-  rest: external_exports.object({
-    enabled: external_exports.boolean(),
-    port: external_exports.number().int().min(1).max(65535)
-  }).strict()
-}).strict();
-var CoworkConfigError = class extends Error {
-  constructor(message, options) {
-    super(message, options);
-    this.name = "CoworkConfigError";
-  }
-};
-function defaultConfig(home = homedir()) {
-  return {
-    version: 1,
-    stateDir: resolve(home, ".ours-cowork"),
-    roomIdentity: { nameMode: "stable_id" },
-    rest: { enabled: true, port: 3052 }
-  };
-}
-function loadConfig(env = process.env, io = {}) {
-  rejectRemovedEnvironment(env);
-  const fs2 = io.fs ?? nodeFs;
-  const defaults = defaultConfig(io.home);
-  const configPath = resolve(env.OURS_COWORK_CONFIG ?? join(io.home ?? homedir(), ".ours-cowork", "config.json"));
-  let file = defaults;
-  const stat = lstatIfPresent(fs2, configPath);
-  if (stat) {
-    assertSecureFile(fs2, configPath, "config file");
-    let parsed;
-    try {
-      parsed = JSON.parse(readSecureFile(fs2, configPath, "config file").toString("utf8"));
-    } catch (error) {
-      throw new CoworkConfigError(`malformed cowork config at ${configPath}`, { cause: error });
-    }
-    rejectRemovedConfig(parsed, configPath);
-    try {
-      file = CoworkConfigSchema.parse(parsed);
-    } catch (error) {
-      throw new CoworkConfigError(`invalid cowork config at ${configPath}`, { cause: error });
-    }
-  } else if (env.OURS_COWORK_CONFIG !== void 0) {
-    throw new CoworkConfigError(`configured cowork config does not exist: ${configPath}`);
-  }
-  const restPort = env.OURS_COWORK_REST_PORT === void 0 ? void 0 : parsePort(env.OURS_COWORK_REST_PORT);
-  try {
-    return CoworkConfigSchema.parse({
-      version: 1,
-      stateDir: resolve(env.OURS_COWORK_STATE_DIR ?? file.stateDir),
-      roomIdentity: file.roomIdentity,
-      rest: {
-        enabled: restPort === void 0 ? file.rest.enabled : true,
-        port: restPort ?? file.rest.port
-      }
-    });
-  } catch (error) {
-    throw new CoworkConfigError("invalid effective cowork config", { cause: error });
-  }
-}
-function rejectRemovedEnvironment(env) {
-  const removed = [
-    "OURS_COWORK_BROKER_URL",
-    "OURS_COWORK_DAEMON_MODE",
-    "OURS_COWORK_DAEMON_ENDPOINT",
-    "OURS_COWORK_DAEMON_STATE_DIR"
-  ].filter((name) => env[name] !== void 0);
-  if (removed.length === 0) return;
-  throw new CoworkConfigError(
-    `${removed.join(", ")} ${removed.length === 1 ? "was" : "were"} removed: ours-cowork now attaches only to the shared ours daemon. Configure that daemon with @ours.network/cli and select it through the standard OURS_CONFIG, OURS_PORT, and OURS_STATE_DIR inputs.`
-  );
-}
-function rejectRemovedConfig(value, path) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return;
-  const removed = ["brokerUrl", "daemon"].filter((key) => Object.hasOwn(value, key));
-  if (removed.length === 0) return;
-  throw new CoworkConfigError(
-    `cowork config at ${path} contains removed ${removed.join(" and ")} ${removed.length === 1 ? "key" : "keys"}: ours-cowork now attaches only to the shared ours daemon. Remove those keys and configure the daemon with @ours.network/cli.`
-  );
-}
-function ensureRuntimeState(config, io = {}) {
-  const parsed = CoworkConfigSchema.parse(config);
-  const fs2 = io.fs ?? nodeFs;
-  const stateDir = resolve(parsed.stateDir);
-  assertSecureAncestors(fs2, stateDir, "state directory");
-  const existing = lstatIfPresent(fs2, stateDir);
-  if (!existing) {
-    createSecureDirectoryTree(fs2, stateDir, "state directory");
-  }
-  assertSecureDirectory(fs2, stateDir, "state directory");
-  const roomsPath = join(stateDir, "rooms");
-  const rooms = lstatIfPresent(fs2, roomsPath);
-  if (!rooms) {
-    fs2.mkdirSync(roomsPath, { mode: DIRECTORY_MODE });
-    secureOpenedDirectory(fs2, roomsPath, "rooms directory");
-    fsyncDirectory(fs2, stateDir);
-  }
-  assertSecureDirectory(fs2, roomsPath, "rooms directory");
-  return {
-    socketPath: join(stateDir, "management.sock"),
-    pidPath: join(stateDir, "daemon.pid"),
-    lockPath: join(stateDir, "daemon.lock")
-  };
-}
-function parsePort(value) {
-  if (!/^[1-9][0-9]{0,4}$/.test(value)) {
-    throw new CoworkConfigError("OURS_COWORK_REST_PORT must be a decimal port from 1 to 65535");
-  }
-  const port = Number(value);
-  if (port > 65535) throw new CoworkConfigError("OURS_COWORK_REST_PORT must be from 1 to 65535");
-  return port;
-}
-function assertSecureAncestors(fs2, path, label) {
-  const absolute = isAbsolute(path) ? path : resolve(path);
-  const root = parse(absolute).root;
-  const rootOwner = fs2.lstatSync(root).uid;
-  let cursor = root;
-  const components = absolute.slice(root.length).split("/").filter(Boolean);
-  for (const [index, component] of components.entries()) {
-    cursor = join(cursor, component);
-    const stat = lstatIfPresent(fs2, cursor);
-    if (stat?.isSymbolicLink()) throw new CoworkConfigError(`${label} must not traverse a symbolic link (symlink): ${cursor}`);
-    if (!stat) break;
-    if (!stat.isDirectory()) {
-      if (index === components.length - 1) return;
-      throw new CoworkConfigError(`${label} ancestor is not a directory: ${cursor}`);
-    }
-    if (index < components.length - 1) assertTrustedAncestor(stat, rootOwner, cursor, label);
-  }
-}
-function assertTrustedAncestor(stat, rootOwner, path, label) {
-  const uid = typeof process.getuid === "function" ? process.getuid() : stat.uid;
-  const trustedStickyDirectory = (stat.mode & 512) !== 0;
-  const writableByOthers = (stat.mode & 18) !== 0;
-  const trustedOwner = stat.uid === uid || stat.uid === 0 || stat.uid === rootOwner;
-  if (writableByOthers && (!trustedStickyDirectory || !trustedOwner)) {
-    throw new CoworkConfigError(`${label} has an unsafe writable ancestor: ${path}`);
-  }
-}
-function createSecureDirectoryTree(fs2, path, label) {
-  const missing = [];
-  let cursor = path;
-  while (!lstatIfPresent(fs2, cursor)) {
-    missing.push(cursor);
-    const parent = dirname(cursor);
-    if (parent === cursor) throw new CoworkConfigError(`cannot locate an existing ancestor for ${label}`);
-    cursor = parent;
-  }
-  assertSecureAncestors(fs2, path, label);
-  for (const directory of missing.reverse()) {
-    fs2.mkdirSync(directory, { mode: DIRECTORY_MODE });
-    secureOpenedDirectory(fs2, directory, label);
-    fsyncDirectory(fs2, dirname(directory));
-  }
-}
-function secureOpenedDirectory(fs2, path, label) {
-  let fd;
-  try {
-    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    const opened = fs2.fstatSync(fd);
-    const current = fs2.lstatSync(path);
-    if (!opened.isDirectory() || current.isSymbolicLink() || opened.dev !== current.dev || opened.ino !== current.ino) {
-      throw new CoworkConfigError(`${label} changed while opening`);
-    }
-    fs2.fchmodSync(fd, DIRECTORY_MODE);
-    fs2.fsyncSync(fd);
-  } finally {
-    if (fd !== void 0) fs2.closeSync(fd);
-  }
-}
-function assertSecureDirectory(fs2, path, label) {
-  const stat = fs2.lstatSync(path);
-  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
-  if (!stat.isDirectory()) throw new CoworkConfigError(`${label} must be a directory`);
-  if ((stat.mode & 511) !== DIRECTORY_MODE) {
-    throw new CoworkConfigError(`${label} mode must be 0700`);
-  }
-  assertOwner(stat, label);
-}
-function assertSecureFile(fs2, path, label) {
-  const stat = fs2.lstatSync(path);
-  if (stat.isSymbolicLink()) throw new CoworkConfigError(`${label} must not be a symbolic link (symlink)`);
-  if (!stat.isFile() || stat.nlink !== 1) throw new CoworkConfigError(`${label} must be a single-link regular file`);
-  if ((stat.mode & 511) !== FILE_MODE) throw new CoworkConfigError(`${label} mode must be 0600`);
-  assertOwner(stat, label);
-}
-function assertOwner(stat, label) {
-  if (typeof process.getuid === "function" && stat.uid !== process.getuid()) {
-    throw new CoworkConfigError(`${label} must be owned by the current user`);
-  }
-}
-function readSecureFile(fs2, path, label) {
-  let fd;
-  try {
-    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    const opened = fs2.fstatSync(fd);
-    const current = fs2.lstatSync(path);
-    if (!opened.isFile() || opened.nlink !== 1 || (opened.mode & 511) !== FILE_MODE || typeof process.getuid === "function" && opened.uid !== process.getuid() || current.isSymbolicLink() || current.dev !== opened.dev || current.ino !== opened.ino) {
-      throw new CoworkConfigError(`${label} changed while opening`);
-    }
-    return fs2.readFileSync(fd);
-  } finally {
-    if (fd !== void 0) fs2.closeSync(fd);
-  }
-}
-function fsyncDirectory(fs2, path) {
-  let fd;
-  try {
-    fd = fs2.openSync(path, nodeFs.constants.O_RDONLY | NO_FOLLOW);
-    fs2.fsyncSync(fd);
-  } finally {
-    if (fd !== void 0) fs2.closeSync(fd);
-  }
-}
-function lstatIfPresent(fs2, path) {
-  try {
-    return fs2.lstatSync(path);
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
-  }
-}
-
 // src/cli.ts
 var EXIT = {
   success: 0,