@cjhyy/code-shell-server 0.9.35 → 0.9.37

package/dist/project-runtime/control-server.js

@@ -1,10 +1,12 @@
 import { remoteLinkHostConfiguration } from "../links/remote-configuration.js";
 import { describeEnvironment } from "../environment-identity.js";
 import { createServer } from "node:http";
-import { existsSync, readFileSync } from "node:fs";
+import { lstatSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { extname } from "node:path";
 import { createHubAuth } from "../hub/auth-http.js";
+import { createCloudAccountAuth } from "./cloud-account-auth.js";
+import { legacyProjectAuthority } from "./control-authority.js";
 import { resolveSafe } from "../mobile-remote/mobile-static.js";
 import { contentTypeFor } from "../static-files.js";
 import { createDockerProjectProvider } from "./docker-provider.js";
@@ -69,8 +71,16 @@ async function readBody(request) {
 /** A small account/project gateway. It never creates a worker, executes tools or mounts cwd. */
 export async function startProjectControlServer(options) {
     const remoteLink = remoteLinkHostConfiguration(options.remoteLink, options.publicOrigin);
-    if (existsSync(join(options.dataDir, "restore-in-progress")))
+    // Any entry is a barrier, including dangling symlinks. Only ENOENT means absent;
+    // permission/I/O failures must abort before registry or Hub initialization.
+    try {
+        lstatSync(join(options.dataDir, "restore-in-progress"));
         throw new Error("Cloud installation restore is incomplete; do not start this directory.");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
     const registry = new ProjectRegistry(options.dataDir);
     let proxy;
     let manager;
@@ -78,26 +88,38 @@ export async function startProjectControlServer(options) {
     let server;
     let shuttingDown = false;
     try {
-        const auth = await createHubAuth({
-            dataDir: options.dataDir,
-            publicOrigin: options.publicOrigin,
-            onRevoke: (sessionId) => {
+        const onRevoke = (sessionId) => {
+            if (shuttingDown)
+                return;
+            void proxy?.revokeOwner(sessionId).catch(async () => {
                 if (shuttingDown)
                     return;
-                void proxy?.revokeOwner(sessionId).catch(async () => {
-                    if (shuttingDown)
-                        return;
-                    // The revoked browser's transports are already closed. If its inner
-                    // session cannot be revoked, stop the single administrator's runtimes.
-                    try {
-                        await manager?.stopAll();
-                    }
-                    catch {
-                        console.error("[project-control] could not confirm project termination after session revocation.");
-                    }
-                });
-            },
-        });
+                // The revoked browser's transports are already closed. If its inner
+                // session cannot be revoked, stop the single administrator's runtimes.
+                try {
+                    await manager?.stopAll();
+                }
+                catch {
+                    console.error("[project-control] could not confirm project termination after session revocation.");
+                }
+            });
+        };
+        const binding = registry.accountBinding;
+        if (!!binding !== !!options.accountAuthority || (binding && !options.publicOrigin))
+            throw new Error("Cloud account authority requires explicit matching ownership and public origin.");
+        const auth = binding
+            ? createCloudAccountAuth({
+                binding,
+                installationId: registry.installationId,
+                publicOrigin: options.publicOrigin,
+                authority: options.accountAuthority,
+                onRevoke,
+            })
+            : legacyProjectAuthority(await createHubAuth({
+                dataDir: options.dataDir,
+                publicOrigin: options.publicOrigin,
+                onRevoke,
+            }));
         let listeningOrigin = "";
         const publicOrigin = () => options.publicOrigin ?? listeningOrigin;
         provider =
@@ -113,9 +135,12 @@ export async function startProjectControlServer(options) {
             registry,
             provider,
             publicOrigin,
-            isSessionActive: (session) => auth.store
-                .listSessions()
-                .some((item) => item.id === session.id && item.username === session.username),
+            isSessionActive: (session) => auth.isActive(session),
+            ...(binding
+                ? {
+                    revalidateSession: (session) => auth.revalidate(session),
+                }
+                : {}),
             revokeProject: async (id) => {
                 await proxy?.revokeProject(id);
             },
@@ -172,6 +197,7 @@ export async function startProjectControlServer(options) {
                     throw new ProjectRegistryError(400, "项目请求参数无效。");
                 if (pathname === "/api/v1/projects" && request.method === "GET") {
                     const availability = await provider.availability();
+                    await auth.revalidate(session);
                     json(response, 200, {
                         runtime: "docker",
                         ...availability,
@@ -183,10 +209,11 @@ export async function startProjectControlServer(options) {
                     const body = await readBody(request);
                     if (Object.keys(body).some((key) => key !== "name"))
                         throw new ProjectRegistryError(400, "仅支持设置项目名称。");
+                    await auth.revalidate(session);
                     json(response, 201, { project: projects.create(session, body.name) });
                     return;
                 }
-                const match = /^\/api\/v1\/projects\/([a-f0-9-]{36})(?:\/(start|stop))?$/.exec(pathname);
+                const match = /^\/api\/v1\/projects\/([a-f0-9-]{36})(?:\/(start|stop|open))?$/.exec(pathname);
                 if (match && request.method === "GET" && !match[2]) {
                     json(response, 200, { project: projects.get(session, match[1]) });
                     return;
@@ -195,6 +222,14 @@ export async function startProjectControlServer(options) {
                     const body = await readBody(request);
                     if (Object.keys(body).length)
                         throw new ProjectRegistryError(400, "启动和停止不接受额外参数。");
+                    if (match[2] === "open") {
+                        await projects.resolveTarget(session, match[1]);
+                        json(response, 200, {
+                            project: projects.get(session, match[1]),
+                            url: `${publicOrigin()}/?project=${match[1]}`,
+                        });
+                        return;
+                    }
                     const project = match[2] === "start"
                         ? await projects.start(session, match[1])
                         : await projects.stop(session, match[1]);
@@ -286,6 +321,7 @@ export async function startProjectControlServer(options) {
                         // Revoke streams and inner sessions before stopping their servers.
                         // If logout is unreachable, confirmed runtime termination is the
                         // fallback; a real stop failure must still reject close().
+                        auth.close?.();
                         await transport.close().catch(() => { });
                         await projects.close();
                     }

package/dist/project-runtime/lock.js

@@ -1,43 +1,212 @@
-import { lstatSync } from "node:fs";
+import * as fs from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join, resolve } from "node:path";
 import { lockSync } from "@cjhyy/code-shell-core/internal";
 /** One control process per directory; heartbeat leases recover after a crash. */
 export function acquireProjectControllerLock(directory) {
-    const original = lstatSync(directory);
+    directory = resolve(directory);
+    const original = fs.lstatSync(directory);
     if (!original.isDirectory() || original.isSymbolicLink())
         throw new Error("Unsafe project control directory.");
+    const lockPath = `${directory}.lock`;
+    let identity;
+    let candidate;
+    let owner;
+    let candidateOwner;
+    let mtime;
     let compromised = false;
     let released = false;
+    const sameDirectory = (actual, expected) => actual.isDirectory() &&
+        !actual.isSymbolicLink() &&
+        actual.dev === expected.dev &&
+        actual.ino === expected.ino;
+    const ownerFile = (actual) => actual.isFile() &&
+        !actual.isSymbolicLink() &&
+        actual.nlink === 1 &&
+        actual.size === 0 &&
+        (actual.mode & 0o077) === 0;
+    function readOwner() {
+        const entries = fs.readdirSync(lockPath);
+        if (!entries.length)
+            return; // A historical proper-lockfile owner had no marker.
+        if (entries.length !== 1 ||
+            !/^\.owner-[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(entries[0]))
+            throw lost();
+        const identity = fs.lstatSync(join(lockPath, entries[0]));
+        if (!ownerFile(identity))
+            throw lost();
+        return { name: entries[0], identity };
+    }
+    function assertOwner(expected) {
+        const current = readOwner();
+        if (!current ||
+            current.name !== expected.name ||
+            current.identity.dev !== expected.identity.dev ||
+            current.identity.ino !== expected.identity.ino)
+            throw lost();
+    }
+    const lost = () => {
+        compromised = true;
+        // ENOENT terminates proper-lockfile's renewal immediately, rather than
+        // repeatedly retrying an owner which has already permanently lost custody.
+        return Object.assign(new Error("Project controller lock is no longer held."), {
+            code: "ENOENT",
+        });
+    };
+    function assertRoot() {
+        if (compromised)
+            throw lost();
+        try {
+            if (!sameDirectory(fs.lstatSync(directory), original))
+                throw lost();
+        }
+        catch {
+            throw lost();
+        }
+    }
+    function assertOwned() {
+        assertRoot();
+        try {
+            const current = fs.lstatSync(lockPath);
+            if (!identity ||
+                !owner ||
+                !sameDirectory(current, identity) ||
+                (mtime !== undefined && current.mtimeMs !== mtime))
+                throw lost();
+            assertOwner(owner);
+        }
+        catch {
+            throw lost();
+        }
+    }
+    // lockSync's adapter invokes these synchronous functions for acquisition,
+    // every heartbeat and exit cleanup. Guarding only callback-style fs methods
+    // would leave its renewal and release paths unprotected.
+    const guardedFs = {
+        ...fs,
+        mkdirSync(path) {
+            if (path !== lockPath)
+                return fs.mkdirSync(path);
+            assertRoot();
+            fs.mkdirSync(path, { mode: 0o700 });
+            identity = fs.lstatSync(path);
+            const name = `.owner-${randomUUID()}`;
+            const marker = fs.openSync(join(path, name), fs.constants.O_CREAT |
+                fs.constants.O_EXCL |
+                fs.constants.O_WRONLY |
+                fs.constants.O_NOFOLLOW, 0o600);
+            try {
+                owner = { name, identity: fs.fstatSync(marker) };
+                if (!ownerFile(owner.identity))
+                    throw lost();
+            }
+            finally {
+                fs.closeSync(marker);
+            }
+            mtime = fs.lstatSync(path).mtimeMs;
+            assertOwned();
+        },
+        statSync(path) {
+            if (path !== lockPath)
+                return fs.statSync(path);
+            if (identity)
+                assertOwned();
+            else
+                assertRoot();
+            const current = fs.lstatSync(path);
+            if (!current.isDirectory() || current.isSymbolicLink())
+                throw lost();
+            // An existing stale lock may be removed only if it remains the exact
+            // directory whose age proper-lockfile just inspected.
+            if (!identity) {
+                candidate = current;
+                candidateOwner = readOwner();
+            }
+            return current;
+        },
+        utimesSync(path, atime, nextMtime) {
+            if (path !== lockPath)
+                return fs.utimesSync(path, atime, nextMtime);
+            assertOwned();
+            const descriptor = fs.openSync(path, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+            try {
+                if (!sameDirectory(fs.fstatSync(descriptor), identity))
+                    throw lost();
+                // Renew the captured inode, never a replacement installed between the
+                // path check and the write. Recheck the public path before accepting it.
+                fs.futimesSync(descriptor, atime, nextMtime);
+                mtime = fs.fstatSync(descriptor).mtimeMs;
+                assertOwned();
+            }
+            catch {
+                throw lost();
+            }
+            finally {
+                fs.closeSync(descriptor);
+            }
+        },
+        rmdirSync(path) {
+            if (path !== lockPath)
+                return fs.rmdirSync(path);
+            if (identity) {
+                assertOwned();
+                fs.unlinkSync(join(path, owner.name));
+            }
+            else {
+                assertRoot();
+                if (!candidate || !sameDirectory(fs.lstatSync(path), candidate))
+                    throw lost();
+                if (candidateOwner) {
+                    assertOwner(candidateOwner);
+                    fs.unlinkSync(join(path, candidateOwner.name));
+                }
+                else if (fs.readdirSync(path).length)
+                    throw lost();
+            }
+            // Only our own random marker (or the exact observed stale candidate's)
+            // was removed. If the pathname changes immediately before this syscall,
+            // an established new owner still has its different marker: ENOTEMPTY
+            // preserves it, and stale acquisition must fail rather than claim success.
+            fs.rmdirSync(path);
+        },
+    };
     let unlock;
     try {
         unlock = lockSync(directory, {
+            realpath: false,
+            lockfilePath: lockPath,
             stale: 30000,
             update: 10000,
             retries: 0,
+            fs: guardedFs,
             onCompromised: () => {
                 compromised = true;
             },
         });
+        assertOwned();
     }
-    catch {
-        throw new Error("Another project controller owns this data directory; stop it before starting another.");
+    catch (error) {
+        throw new Error(compromised
+            ? "Project controller lock is no longer held."
+            : "Another project controller owns this data directory; stop it before starting another.", { cause: error });
     }
     return {
         assertHeld() {
             if (released || compromised)
                 throw new Error("Project controller lock is no longer held.");
-            const current = lstatSync(directory);
-            if (!current.isDirectory() ||
-                current.isSymbolicLink() ||
-                current.dev !== original.dev ||
-                current.ino !== original.ino)
-                throw new Error("Project control directory changed while the controller was running.");
+            assertOwned();
         },
         release() {
             if (released)
                 return;
             released = true;
-            if (!compromised)
-                unlock();
+            try {
+                assertOwned();
+            }
+            catch {
+                return; // The lost owner may never delete another owner's replacement.
+            }
+            unlock();
         },
     };
 }

package/dist/project-runtime/manager.d.ts

@@ -1,12 +1,13 @@
-import type { HubSession } from "../hub/auth-store.js";
+import type { ProjectControlSession } from "./control-authority.js";
 import { ProjectRegistry, type ProjectView } from "./registry.js";
 import type { ProjectRuntimeConnection, ProjectRuntimeProvider } from "./types.js";
 export interface ProjectManagerOptions {
     registry: ProjectRegistry;
     provider: ProjectRuntimeProvider;
     publicOrigin(): string;
-    isSessionActive(session: HubSession): boolean;
+    isSessionActive(session: ProjectControlSession): boolean;
     revokeProject(id: string): Promise<void>;
+    revalidateSession?(session: ProjectControlSession): Promise<void>;
     maxRunning?: number;
     /** Clock seam for Docker observations; authorization is never cached. */
     now?: () => number;
@@ -17,20 +18,23 @@ export declare class ProjectManager {
     private readonly starts;
     private readonly stops;
     private readonly targets;
+    private readonly stopRevisions;
     private readonly statusChecks;
     private closed;
     private closing;
     constructor(options: ProjectManagerOptions);
     private authorize;
+    private ownedProject;
+    private authorizeContinuous;
     reconcile(): Promise<void>;
-    list(session: HubSession): ProjectView[];
-    get(session: HubSession, id: string): ProjectView;
-    create(session: HubSession, name: unknown): ProjectView;
-    start(session: HubSession, id: string): Promise<ProjectView>;
-    stop(session: HubSession, id: string): Promise<ProjectView>;
+    list(session: ProjectControlSession): ProjectView[];
+    get(session: ProjectControlSession, id: string): ProjectView;
+    create(session: ProjectControlSession, name: unknown): ProjectView;
+    start(session: ProjectControlSession, id: string): Promise<ProjectView>;
+    stop(session: ProjectControlSession, id: string): Promise<ProjectView>;
     private beginStop;
     private stopProject;
-    resolveTarget(session: HubSession, id: string): Promise<ProjectRuntimeConnection>;
+    resolveTarget(session: ProjectControlSession, id: string): Promise<ProjectRuntimeConnection>;
     private observeRuntime;
     /** Stop the affected runtime without relying on its already-revoked outer session. */
     stopAfterRevocationFailure(id: string): Promise<void>;

package/dist/project-runtime/manager.js

@@ -5,6 +5,7 @@ export class ProjectManager {
     starts = new Map();
     stops = new Map();
     targets = new Map();
+    stopRevisions = new Map();
     statusChecks = new Map();
     closed = false;
     closing;
@@ -21,6 +22,16 @@ export class ProjectManager {
         if (!this.options.isSessionActive(session))
             throw new ProjectRegistryError(401, "登录已过期，请重新登录。");
     }
+    ownedProject(session, id) {
+        return "kind" in session
+            ? this.options.registry.getAccount(session.ownerId, id)
+            : this.options.registry.get(session.username, id);
+    }
+    async authorizeContinuous(session) {
+        this.authorize(session);
+        await this.options.revalidateSession?.(session);
+        this.authorize(session);
+    }
     async reconcile() {
         this.statusChecks.clear();
         // Never adopt a previous controller's approvals or device credentials after a crash.
@@ -41,30 +52,47 @@ export class ProjectManager {
     }
     list(session) {
         this.authorize(session);
-        return this.options.registry.list(session.username);
+        return "kind" in session
+            ? this.options.registry.listAccount(session.ownerId)
+            : this.options.registry.list(session.username);
     }
     get(session, id) {
         this.authorize(session);
-        return projectView(this.options.registry.get(session.username, id));
+        return projectView(this.ownedProject(session, id));
     }
     create(session, name) {
         this.authorize(session);
-        return projectView(this.options.registry.create(session.username, name));
+        return projectView("kind" in session
+            ? this.options.registry.createAccount(session.ownerId, name)
+            : this.options.registry.create(session.username, name));
     }
     async start(session, id) {
         this.authorize(session);
-        this.options.registry.get(session.username, id);
+        this.ownedProject(session, id);
+        const revision = this.stopRevisions.get(id) ?? 0;
+        const authorizeStart = () => {
+            this.authorize(session);
+            if ((this.stopRevisions.get(id) ?? 0) !== revision)
+                throw new ProjectRegistryError(409, "项目启动已取消。");
+        };
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
+        authorizeStart();
         const stopping = this.stops.get(id);
         if (stopping)
             await stopping;
-        this.authorize(session);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
+        authorizeStart();
         const existing = this.starts.get(id);
         if (existing) {
             const result = await existing;
-            this.authorize(session);
+            if (this.options.revalidateSession)
+                await this.authorizeContinuous(session);
+            authorizeStart();
             return result;
         }
-        const project = this.options.registry.get(session.username, id);
+        const project = this.ownedProject(session, id);
         if (project.status === "running") {
             await this.resolveTarget(session, id);
             return this.get(session, id);
@@ -84,14 +112,18 @@ export class ProjectManager {
         const operation = (async () => {
             try {
                 await this.options.revokeProject(id);
-                this.authorize(session);
-                if (this.options.registry.get(session.username, id).status !== "starting")
+                if (this.options.revalidateSession)
+                    await this.authorizeContinuous(session);
+                authorizeStart();
+                if (this.ownedProject(session, id).status !== "starting")
                     throw new ProjectRegistryError(409, "项目启动已取消。");
                 const target = await this.options.provider.ensure(record, {
                     publicOrigin: this.options.publicOrigin(),
                 });
-                this.authorize(session);
-                const current = this.options.registry.get(session.username, id);
+                if (this.options.revalidateSession)
+                    await this.authorizeContinuous(session);
+                authorizeStart();
+                const current = this.ownedProject(session, id);
                 if (current.status !== "starting" || current.generation !== record.generation)
                     throw new ProjectRegistryError(409, "项目启动已取消。");
                 if (target.generation !== record.generation)
@@ -109,7 +141,7 @@ export class ProjectManager {
                 catch {
                     stopped = false;
                 }
-                const current = this.options.registry.get(session.username, id);
+                const current = this.ownedProject(session, id);
                 if (current.generation === record.generation && current.status === "starting") {
                     this.options.registry.update(id, {
                         status: stopped ? "stopped" : "error",
@@ -129,8 +161,13 @@ export class ProjectManager {
     }
     async stop(session, id) {
         this.authorize(session);
-        this.options.registry.get(session.username, id);
+        this.ownedProject(session, id);
+        this.stopRevisions.set(id, (this.stopRevisions.get(id) ?? 0) + 1);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         const result = await this.beginStop(id);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         this.authorize(session);
         return result;
     }
@@ -168,15 +205,19 @@ export class ProjectManager {
         }
     }
     async resolveTarget(session, id) {
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         this.authorize(session);
-        const record = this.options.registry.get(session.username, id);
+        const record = this.ownedProject(session, id);
         const target = this.targets.get(id);
         if (record.status !== "running" || !target || target.generation !== record.generation)
             throw new ProjectRegistryError(409, "项目尚未运行，请先启动项目。");
         // The provider checks labels and the loopback binding, not just a remembered port.
         const state = await this.observeRuntime(record, target);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         this.authorize(session);
-        const current = this.options.registry.get(session.username, id);
+        const current = this.ownedProject(session, id);
         if (current.status !== "running" || current.generation !== target.generation)
             throw new ProjectRegistryError(409, "项目已停止或重新启动，请重新进入。");
         if (state.state !== "running" || state.url !== target.url) {

package/dist/project-runtime/proxy.d.ts

@@ -1,12 +1,12 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type Duplex } from "node:stream";
 import { type HubAuth } from "../hub/auth-http.js";
-import type { HubSession } from "../hub/auth-store.js";
+import type { ProjectControlAuthority, ProjectControlSession } from "./control-authority.js";
 import type { ProjectRuntimeConnection } from "./types.js";
 export type RuntimeTarget = ProjectRuntimeConnection;
 export interface ProjectRuntimeProxyOptions {
-    auth: HubAuth;
-    resolveTarget(projectId: string, session: HubSession): Promise<RuntimeTarget>;
+    auth: HubAuth | ProjectControlAuthority;
+    resolveTarget(projectId: string, session: ProjectControlSession): Promise<RuntimeTarget>;
     publicOrigin: () => string;
     /** Stop this runtime if its private logout cannot acknowledge revocation.
      * Dispatched after retirement settles; may call back into revokeProject. */

package/dist/project-runtime/proxy.js

@@ -86,6 +86,9 @@ export function createProjectRuntimeProxy(options) {
     }
     async function validate(lease) {
         const session = assertLease(lease);
+        if ("revalidate" in options.auth)
+            await options.auth.revalidate(session);
+        assertLease(lease);
         const current = checkedTarget(await options.resolveTarget(lease.projectId, session));
         assertLease(lease);
         if (!sameTarget(current, lease.target)) {
@@ -212,7 +215,7 @@ export function createProjectRuntimeProxy(options) {
         // An opaque iframe has no cookie and Origin:null. Only its already issued
         // random capability takes this path; another signed-in owner cannot borrow it.
         if (req.headers.authorization !== undefined ||
-            req.headers.cookie?.includes(`${HUB_SESSION_COOKIE}=`)) {
+            req.headers.cookie?.includes(`${"cookieName" in options.auth ? options.auth.cookieName : HUB_SESSION_COOKIE}=`)) {
             const session = await options.auth.authenticate(req);
             if (!session || session.id !== grant.lease.sessionId)
                 throw new ProxyError(403, "Panel asset belongs to another session");

package/dist/project-runtime/registry.d.ts

@@ -1,5 +1,6 @@
-import { renameSync } from "node:fs";
+import { fsyncSync, renameSync } from "node:fs";
 import type { ProjectRuntimeRecord } from "./types.js";
+import { type CloudAccountBinding } from "./account-binding.js";
 export type ProjectStatus = "stopped" | "starting" | "running" | "stopping" | "error";
 export interface StoredProject extends ProjectRuntimeRecord {
     name: string;
@@ -32,14 +33,20 @@ export declare class ProjectRegistry {
     private readonly controllerLock;
     private diskDigest;
     private markerEstablished;
+    private storageFailed;
     constructor(dataDir: string, now?: () => number, io?: {
         rename?: typeof renameSync;
+        fsync?: typeof fsyncSync;
+        offlineAccountAdoption?: boolean;
     });
     /** Release the single-controller lease on shutdown or startup failure. */
     close(): void;
     /** Offline restore only: new Docker namespace, same project credentials for restored data volumes. */
     renewInstallationForRestore(): void;
     get installationId(): string;
+    get accountBinding(): CloudAccountBinding | undefined;
+    /** Offline migration only; the caller must durably preserve source evidence first. */
+    bindAccount(binding: CloudAccountBinding): void;
     private validate;
     private assertStorage;
     private write;
@@ -47,6 +54,12 @@ export declare class ProjectRegistry {
     list(username: string): ProjectView[];
     get(username: string, id: string): StoredProject;
     create(username: string, name: unknown): StoredProject;
+    listAccount(ownerId: string): ProjectView[];
+    getAccount(ownerId: string, id: string): StoredProject;
+    createAccount(ownerId: string, name: unknown): StoredProject;
+    private requireLegacy;
+    private requireAccountOwner;
+    private createForOwner;
     update(id: string, patch: {
         status: ProjectStatus;
         generation?: number;