@cjhyy/code-shell-server 0.9.36 → 0.9.37

package/dist/project-runtime/lock.js

@@ -1,43 +1,212 @@
-import { lstatSync } from "node:fs";
+import * as fs from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join, resolve } from "node:path";
 import { lockSync } from "@cjhyy/code-shell-core/internal";
 /** One control process per directory; heartbeat leases recover after a crash. */
 export function acquireProjectControllerLock(directory) {
-    const original = lstatSync(directory);
+    directory = resolve(directory);
+    const original = fs.lstatSync(directory);
     if (!original.isDirectory() || original.isSymbolicLink())
         throw new Error("Unsafe project control directory.");
+    const lockPath = `${directory}.lock`;
+    let identity;
+    let candidate;
+    let owner;
+    let candidateOwner;
+    let mtime;
     let compromised = false;
     let released = false;
+    const sameDirectory = (actual, expected) => actual.isDirectory() &&
+        !actual.isSymbolicLink() &&
+        actual.dev === expected.dev &&
+        actual.ino === expected.ino;
+    const ownerFile = (actual) => actual.isFile() &&
+        !actual.isSymbolicLink() &&
+        actual.nlink === 1 &&
+        actual.size === 0 &&
+        (actual.mode & 0o077) === 0;
+    function readOwner() {
+        const entries = fs.readdirSync(lockPath);
+        if (!entries.length)
+            return; // A historical proper-lockfile owner had no marker.
+        if (entries.length !== 1 ||
+            !/^\.owner-[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(entries[0]))
+            throw lost();
+        const identity = fs.lstatSync(join(lockPath, entries[0]));
+        if (!ownerFile(identity))
+            throw lost();
+        return { name: entries[0], identity };
+    }
+    function assertOwner(expected) {
+        const current = readOwner();
+        if (!current ||
+            current.name !== expected.name ||
+            current.identity.dev !== expected.identity.dev ||
+            current.identity.ino !== expected.identity.ino)
+            throw lost();
+    }
+    const lost = () => {
+        compromised = true;
+        // ENOENT terminates proper-lockfile's renewal immediately, rather than
+        // repeatedly retrying an owner which has already permanently lost custody.
+        return Object.assign(new Error("Project controller lock is no longer held."), {
+            code: "ENOENT",
+        });
+    };
+    function assertRoot() {
+        if (compromised)
+            throw lost();
+        try {
+            if (!sameDirectory(fs.lstatSync(directory), original))
+                throw lost();
+        }
+        catch {
+            throw lost();
+        }
+    }
+    function assertOwned() {
+        assertRoot();
+        try {
+            const current = fs.lstatSync(lockPath);
+            if (!identity ||
+                !owner ||
+                !sameDirectory(current, identity) ||
+                (mtime !== undefined && current.mtimeMs !== mtime))
+                throw lost();
+            assertOwner(owner);
+        }
+        catch {
+            throw lost();
+        }
+    }
+    // lockSync's adapter invokes these synchronous functions for acquisition,
+    // every heartbeat and exit cleanup. Guarding only callback-style fs methods
+    // would leave its renewal and release paths unprotected.
+    const guardedFs = {
+        ...fs,
+        mkdirSync(path) {
+            if (path !== lockPath)
+                return fs.mkdirSync(path);
+            assertRoot();
+            fs.mkdirSync(path, { mode: 0o700 });
+            identity = fs.lstatSync(path);
+            const name = `.owner-${randomUUID()}`;
+            const marker = fs.openSync(join(path, name), fs.constants.O_CREAT |
+                fs.constants.O_EXCL |
+                fs.constants.O_WRONLY |
+                fs.constants.O_NOFOLLOW, 0o600);
+            try {
+                owner = { name, identity: fs.fstatSync(marker) };
+                if (!ownerFile(owner.identity))
+                    throw lost();
+            }
+            finally {
+                fs.closeSync(marker);
+            }
+            mtime = fs.lstatSync(path).mtimeMs;
+            assertOwned();
+        },
+        statSync(path) {
+            if (path !== lockPath)
+                return fs.statSync(path);
+            if (identity)
+                assertOwned();
+            else
+                assertRoot();
+            const current = fs.lstatSync(path);
+            if (!current.isDirectory() || current.isSymbolicLink())
+                throw lost();
+            // An existing stale lock may be removed only if it remains the exact
+            // directory whose age proper-lockfile just inspected.
+            if (!identity) {
+                candidate = current;
+                candidateOwner = readOwner();
+            }
+            return current;
+        },
+        utimesSync(path, atime, nextMtime) {
+            if (path !== lockPath)
+                return fs.utimesSync(path, atime, nextMtime);
+            assertOwned();
+            const descriptor = fs.openSync(path, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+            try {
+                if (!sameDirectory(fs.fstatSync(descriptor), identity))
+                    throw lost();
+                // Renew the captured inode, never a replacement installed between the
+                // path check and the write. Recheck the public path before accepting it.
+                fs.futimesSync(descriptor, atime, nextMtime);
+                mtime = fs.fstatSync(descriptor).mtimeMs;
+                assertOwned();
+            }
+            catch {
+                throw lost();
+            }
+            finally {
+                fs.closeSync(descriptor);
+            }
+        },
+        rmdirSync(path) {
+            if (path !== lockPath)
+                return fs.rmdirSync(path);
+            if (identity) {
+                assertOwned();
+                fs.unlinkSync(join(path, owner.name));
+            }
+            else {
+                assertRoot();
+                if (!candidate || !sameDirectory(fs.lstatSync(path), candidate))
+                    throw lost();
+                if (candidateOwner) {
+                    assertOwner(candidateOwner);
+                    fs.unlinkSync(join(path, candidateOwner.name));
+                }
+                else if (fs.readdirSync(path).length)
+                    throw lost();
+            }
+            // Only our own random marker (or the exact observed stale candidate's)
+            // was removed. If the pathname changes immediately before this syscall,
+            // an established new owner still has its different marker: ENOTEMPTY
+            // preserves it, and stale acquisition must fail rather than claim success.
+            fs.rmdirSync(path);
+        },
+    };
     let unlock;
     try {
         unlock = lockSync(directory, {
+            realpath: false,
+            lockfilePath: lockPath,
             stale: 30000,
             update: 10000,
             retries: 0,
+            fs: guardedFs,
             onCompromised: () => {
                 compromised = true;
             },
         });
+        assertOwned();
     }
-    catch {
-        throw new Error("Another project controller owns this data directory; stop it before starting another.");
+    catch (error) {
+        throw new Error(compromised
+            ? "Project controller lock is no longer held."
+            : "Another project controller owns this data directory; stop it before starting another.", { cause: error });
     }
     return {
         assertHeld() {
             if (released || compromised)
                 throw new Error("Project controller lock is no longer held.");
-            const current = lstatSync(directory);
-            if (!current.isDirectory() ||
-                current.isSymbolicLink() ||
-                current.dev !== original.dev ||
-                current.ino !== original.ino)
-                throw new Error("Project control directory changed while the controller was running.");
+            assertOwned();
         },
         release() {
             if (released)
                 return;
             released = true;
-            if (!compromised)
-                unlock();
+            try {
+                assertOwned();
+            }
+            catch {
+                return; // The lost owner may never delete another owner's replacement.
+            }
+            unlock();
         },
     };
 }

package/dist/project-runtime/manager.d.ts

@@ -1,12 +1,13 @@
-import type { HubSession } from "../hub/auth-store.js";
+import type { ProjectControlSession } from "./control-authority.js";
 import { ProjectRegistry, type ProjectView } from "./registry.js";
 import type { ProjectRuntimeConnection, ProjectRuntimeProvider } from "./types.js";
 export interface ProjectManagerOptions {
     registry: ProjectRegistry;
     provider: ProjectRuntimeProvider;
     publicOrigin(): string;
-    isSessionActive(session: HubSession): boolean;
+    isSessionActive(session: ProjectControlSession): boolean;
     revokeProject(id: string): Promise<void>;
+    revalidateSession?(session: ProjectControlSession): Promise<void>;
     maxRunning?: number;
     /** Clock seam for Docker observations; authorization is never cached. */
     now?: () => number;
@@ -17,20 +18,23 @@ export declare class ProjectManager {
     private readonly starts;
     private readonly stops;
     private readonly targets;
+    private readonly stopRevisions;
     private readonly statusChecks;
     private closed;
     private closing;
     constructor(options: ProjectManagerOptions);
     private authorize;
+    private ownedProject;
+    private authorizeContinuous;
     reconcile(): Promise<void>;
-    list(session: HubSession): ProjectView[];
-    get(session: HubSession, id: string): ProjectView;
-    create(session: HubSession, name: unknown): ProjectView;
-    start(session: HubSession, id: string): Promise<ProjectView>;
-    stop(session: HubSession, id: string): Promise<ProjectView>;
+    list(session: ProjectControlSession): ProjectView[];
+    get(session: ProjectControlSession, id: string): ProjectView;
+    create(session: ProjectControlSession, name: unknown): ProjectView;
+    start(session: ProjectControlSession, id: string): Promise<ProjectView>;
+    stop(session: ProjectControlSession, id: string): Promise<ProjectView>;
     private beginStop;
     private stopProject;
-    resolveTarget(session: HubSession, id: string): Promise<ProjectRuntimeConnection>;
+    resolveTarget(session: ProjectControlSession, id: string): Promise<ProjectRuntimeConnection>;
     private observeRuntime;
     /** Stop the affected runtime without relying on its already-revoked outer session. */
     stopAfterRevocationFailure(id: string): Promise<void>;

package/dist/project-runtime/manager.js

@@ -5,6 +5,7 @@ export class ProjectManager {
     starts = new Map();
     stops = new Map();
     targets = new Map();
+    stopRevisions = new Map();
     statusChecks = new Map();
     closed = false;
     closing;
@@ -21,6 +22,16 @@ export class ProjectManager {
         if (!this.options.isSessionActive(session))
             throw new ProjectRegistryError(401, "登录已过期，请重新登录。");
     }
+    ownedProject(session, id) {
+        return "kind" in session
+            ? this.options.registry.getAccount(session.ownerId, id)
+            : this.options.registry.get(session.username, id);
+    }
+    async authorizeContinuous(session) {
+        this.authorize(session);
+        await this.options.revalidateSession?.(session);
+        this.authorize(session);
+    }
     async reconcile() {
         this.statusChecks.clear();
         // Never adopt a previous controller's approvals or device credentials after a crash.
@@ -41,30 +52,47 @@ export class ProjectManager {
     }
     list(session) {
         this.authorize(session);
-        return this.options.registry.list(session.username);
+        return "kind" in session
+            ? this.options.registry.listAccount(session.ownerId)
+            : this.options.registry.list(session.username);
     }
     get(session, id) {
         this.authorize(session);
-        return projectView(this.options.registry.get(session.username, id));
+        return projectView(this.ownedProject(session, id));
     }
     create(session, name) {
         this.authorize(session);
-        return projectView(this.options.registry.create(session.username, name));
+        return projectView("kind" in session
+            ? this.options.registry.createAccount(session.ownerId, name)
+            : this.options.registry.create(session.username, name));
     }
     async start(session, id) {
         this.authorize(session);
-        this.options.registry.get(session.username, id);
+        this.ownedProject(session, id);
+        const revision = this.stopRevisions.get(id) ?? 0;
+        const authorizeStart = () => {
+            this.authorize(session);
+            if ((this.stopRevisions.get(id) ?? 0) !== revision)
+                throw new ProjectRegistryError(409, "项目启动已取消。");
+        };
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
+        authorizeStart();
         const stopping = this.stops.get(id);
         if (stopping)
             await stopping;
-        this.authorize(session);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
+        authorizeStart();
         const existing = this.starts.get(id);
         if (existing) {
             const result = await existing;
-            this.authorize(session);
+            if (this.options.revalidateSession)
+                await this.authorizeContinuous(session);
+            authorizeStart();
             return result;
         }
-        const project = this.options.registry.get(session.username, id);
+        const project = this.ownedProject(session, id);
         if (project.status === "running") {
             await this.resolveTarget(session, id);
             return this.get(session, id);
@@ -84,14 +112,18 @@ export class ProjectManager {
         const operation = (async () => {
             try {
                 await this.options.revokeProject(id);
-                this.authorize(session);
-                if (this.options.registry.get(session.username, id).status !== "starting")
+                if (this.options.revalidateSession)
+                    await this.authorizeContinuous(session);
+                authorizeStart();
+                if (this.ownedProject(session, id).status !== "starting")
                     throw new ProjectRegistryError(409, "项目启动已取消。");
                 const target = await this.options.provider.ensure(record, {
                     publicOrigin: this.options.publicOrigin(),
                 });
-                this.authorize(session);
-                const current = this.options.registry.get(session.username, id);
+                if (this.options.revalidateSession)
+                    await this.authorizeContinuous(session);
+                authorizeStart();
+                const current = this.ownedProject(session, id);
                 if (current.status !== "starting" || current.generation !== record.generation)
                     throw new ProjectRegistryError(409, "项目启动已取消。");
                 if (target.generation !== record.generation)
@@ -109,7 +141,7 @@ export class ProjectManager {
                 catch {
                     stopped = false;
                 }
-                const current = this.options.registry.get(session.username, id);
+                const current = this.ownedProject(session, id);
                 if (current.generation === record.generation && current.status === "starting") {
                     this.options.registry.update(id, {
                         status: stopped ? "stopped" : "error",
@@ -129,8 +161,13 @@ export class ProjectManager {
     }
     async stop(session, id) {
         this.authorize(session);
-        this.options.registry.get(session.username, id);
+        this.ownedProject(session, id);
+        this.stopRevisions.set(id, (this.stopRevisions.get(id) ?? 0) + 1);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         const result = await this.beginStop(id);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         this.authorize(session);
         return result;
     }
@@ -168,15 +205,19 @@ export class ProjectManager {
         }
     }
     async resolveTarget(session, id) {
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         this.authorize(session);
-        const record = this.options.registry.get(session.username, id);
+        const record = this.ownedProject(session, id);
         const target = this.targets.get(id);
         if (record.status !== "running" || !target || target.generation !== record.generation)
             throw new ProjectRegistryError(409, "项目尚未运行，请先启动项目。");
         // The provider checks labels and the loopback binding, not just a remembered port.
         const state = await this.observeRuntime(record, target);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         this.authorize(session);
-        const current = this.options.registry.get(session.username, id);
+        const current = this.ownedProject(session, id);
         if (current.status !== "running" || current.generation !== target.generation)
             throw new ProjectRegistryError(409, "项目已停止或重新启动，请重新进入。");
         if (state.state !== "running" || state.url !== target.url) {

package/dist/project-runtime/proxy.d.ts

@@ -1,12 +1,12 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type Duplex } from "node:stream";
 import { type HubAuth } from "../hub/auth-http.js";
-import type { HubSession } from "../hub/auth-store.js";
+import type { ProjectControlAuthority, ProjectControlSession } from "./control-authority.js";
 import type { ProjectRuntimeConnection } from "./types.js";
 export type RuntimeTarget = ProjectRuntimeConnection;
 export interface ProjectRuntimeProxyOptions {
-    auth: HubAuth;
-    resolveTarget(projectId: string, session: HubSession): Promise<RuntimeTarget>;
+    auth: HubAuth | ProjectControlAuthority;
+    resolveTarget(projectId: string, session: ProjectControlSession): Promise<RuntimeTarget>;
     publicOrigin: () => string;
     /** Stop this runtime if its private logout cannot acknowledge revocation.
      * Dispatched after retirement settles; may call back into revokeProject. */

package/dist/project-runtime/proxy.js

@@ -86,6 +86,9 @@ export function createProjectRuntimeProxy(options) {
     }
     async function validate(lease) {
         const session = assertLease(lease);
+        if ("revalidate" in options.auth)
+            await options.auth.revalidate(session);
+        assertLease(lease);
         const current = checkedTarget(await options.resolveTarget(lease.projectId, session));
         assertLease(lease);
         if (!sameTarget(current, lease.target)) {
@@ -212,7 +215,7 @@ export function createProjectRuntimeProxy(options) {
         // An opaque iframe has no cookie and Origin:null. Only its already issued
         // random capability takes this path; another signed-in owner cannot borrow it.
         if (req.headers.authorization !== undefined ||
-            req.headers.cookie?.includes(`${HUB_SESSION_COOKIE}=`)) {
+            req.headers.cookie?.includes(`${"cookieName" in options.auth ? options.auth.cookieName : HUB_SESSION_COOKIE}=`)) {
             const session = await options.auth.authenticate(req);
             if (!session || session.id !== grant.lease.sessionId)
                 throw new ProxyError(403, "Panel asset belongs to another session");

package/dist/project-runtime/registry.d.ts

@@ -1,5 +1,6 @@
-import { renameSync } from "node:fs";
+import { fsyncSync, renameSync } from "node:fs";
 import type { ProjectRuntimeRecord } from "./types.js";
+import { type CloudAccountBinding } from "./account-binding.js";
 export type ProjectStatus = "stopped" | "starting" | "running" | "stopping" | "error";
 export interface StoredProject extends ProjectRuntimeRecord {
     name: string;
@@ -32,14 +33,20 @@ export declare class ProjectRegistry {
     private readonly controllerLock;
     private diskDigest;
     private markerEstablished;
+    private storageFailed;
     constructor(dataDir: string, now?: () => number, io?: {
         rename?: typeof renameSync;
+        fsync?: typeof fsyncSync;
+        offlineAccountAdoption?: boolean;
     });
     /** Release the single-controller lease on shutdown or startup failure. */
     close(): void;
     /** Offline restore only: new Docker namespace, same project credentials for restored data volumes. */
     renewInstallationForRestore(): void;
     get installationId(): string;
+    get accountBinding(): CloudAccountBinding | undefined;
+    /** Offline migration only; the caller must durably preserve source evidence first. */
+    bindAccount(binding: CloudAccountBinding): void;
     private validate;
     private assertStorage;
     private write;
@@ -47,6 +54,12 @@ export declare class ProjectRegistry {
     list(username: string): ProjectView[];
     get(username: string, id: string): StoredProject;
     create(username: string, name: unknown): StoredProject;
+    listAccount(ownerId: string): ProjectView[];
+    getAccount(ownerId: string, id: string): StoredProject;
+    createAccount(ownerId: string, name: unknown): StoredProject;
+    private requireLegacy;
+    private requireAccountOwner;
+    private createForOwner;
     update(id: string, patch: {
         status: ProjectStatus;
         generation?: number;

package/dist/project-runtime/registry.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { constants, chmodSync, closeSync, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join, resolve } from "node:path";
 import { acquireProjectControllerLock } from "./lock.js";
+import { CLOUD_ADOPTION_PENDING, isCloudAccountBinding, } from "./account-binding.js";
 const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
 const TOKEN = /^[A-Za-z0-9_-]{43}$/;
 const STATUSES = new Set(["stopped", "starting", "running", "stopping", "error"]);
@@ -58,6 +59,7 @@ export class ProjectRegistry {
     controllerLock;
     diskDigest;
     markerEstablished = false;
+    storageFailed = false;
     constructor(dataDir, now = Date.now, io = {}) {
         this.now = now;
         this.io = io;
@@ -72,6 +74,16 @@ export class ProjectRegistry {
         this.marker = join(this.directory, "initialized");
         this.controllerLock = acquireProjectControllerLock(this.directory);
         try {
+            if (!this.io.offlineAccountAdoption) {
+                try {
+                    lstatSync(join(this.directory, CLOUD_ADOPTION_PENDING));
+                    throw new Error("Cloud account adoption is incomplete; retry its explicit offline transaction.");
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                }
+            }
             if (existsSync(this.marker)) {
                 if (privateFileBytes(this.marker, 16).toString() !== "1\n")
                     throw new Error("Project initialization marker is corrupt.");
@@ -109,6 +121,8 @@ export class ProjectRegistry {
             throw new Error("Stop all projects before restoring an installation.");
         const next = structuredClone(this.data);
         next.installationId = randomUUID();
+        if (next.accountBinding)
+            next.accountBinding.managementEpoch = randomUUID();
         for (const project of next.projects) {
             if (project.generation > 0)
                 project.generation += 1;
@@ -122,15 +136,43 @@ export class ProjectRegistry {
         this.assertStorage();
         return this.data.installationId;
     }
+    get accountBinding() {
+        this.assertStorage();
+        return this.data.accountBinding && { ...this.data.accountBinding };
+    }
+    /** Offline migration only; the caller must durably preserve source evidence first. */
+    bindAccount(binding) {
+        this.assertStorage();
+        if (this.data.version !== 1 ||
+            this.data.accountBinding !== undefined ||
+            !isCloudAccountBinding(binding) ||
+            this.data.owners.length !== 1 ||
+            this.data.owners[0].id !== binding.ownerId ||
+            this.data.projects.some((project) => project.status !== "stopped"))
+            throw new Error("Cloud adoption requires one explicit legacy owner and stopped projects.");
+        const next = structuredClone(this.data);
+        // The real historical registry rejects version 2. Unknown metadata alone
+        // cannot prevent an old controller from continuing its username authority.
+        next.version = 2;
+        next.accountBinding = { ...binding };
+        this.write(next);
+        this.data = next;
+    }
     validate(data = this.data) {
         if (!data ||
-            data.version !== 1 ||
+            (data.version !== 1 && data.version !== 2) ||
             !UUID.test(data.installationId) ||
             !Array.isArray(data.owners) ||
             !Array.isArray(data.projects) ||
             data.owners.length > 128 ||
             data.projects.length > 128)
             throw new Error("Project registry is corrupt; restore its backup");
+        if ((data.version === 1 && data.accountBinding !== undefined) ||
+            (data.version === 2 &&
+                (!isCloudAccountBinding(data.accountBinding) ||
+                    data.owners.length !== 1 ||
+                    data.owners[0]?.id !== data.accountBinding.ownerId)))
+            throw new Error("Cloud account ownership is missing or corrupt; restore its backup.");
         const owners = new Set();
         const names = new Set();
         for (const owner of data.owners) {
@@ -174,6 +216,8 @@ export class ProjectRegistry {
         }
     }
     assertStorage() {
+        if (this.storageFailed)
+            throw new Error("Project registry durability failed; restart and diagnose before continuing.");
         this.controllerLock.assertHeld();
         if (this.markerEstablished && privateFileBytes(this.marker, 16).toString() !== "1\n")
             throw new Error("Project initialization marker changed.");
@@ -192,15 +236,29 @@ export class ProjectRegistry {
             throw new Error("Project registry is too large.");
         const file = join(this.directory, `.registry-${randomUUID()}.tmp`);
         let fd;
+        let committed = false;
         try {
             fd = openSync(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
             writeFileSync(fd, bytes);
-            fsyncSync(fd);
+            (this.io.fsync ?? fsyncSync)(fd);
             closeSync(fd);
             fd = undefined;
             this.assertStorage();
             (this.io.rename ?? renameSync)(file, this.file);
+            committed = true;
             this.diskDigest = digest(bytes);
+            const directory = openSync(this.directory, constants.O_RDONLY);
+            try {
+                (this.io.fsync ?? fsyncSync)(directory);
+            }
+            finally {
+                closeSync(directory);
+            }
+        }
+        catch (error) {
+            if (committed)
+                this.storageFailed = true;
+            throw error;
         }
         finally {
             if (fd !== undefined)
@@ -214,11 +272,13 @@ export class ProjectRegistry {
     }
     list(username) {
         this.assertStorage();
+        this.requireLegacy();
         const owner = this.data.owners.find((item) => item.username === username);
         return this.data.projects.filter((item) => item.ownerId === owner?.id).map(projectView);
     }
     get(username, id) {
         this.assertStorage();
+        this.requireLegacy();
         const owner = this.data.owners.find((item) => item.username === username);
         const project = this.data.projects.find((item) => item.id === id && item.ownerId === owner?.id);
         if (!project)
@@ -227,6 +287,35 @@ export class ProjectRegistry {
     }
     create(username, name) {
         this.assertStorage();
+        this.requireLegacy();
+        return this.createForOwner(username, name);
+    }
+    listAccount(ownerId) {
+        this.requireAccountOwner(ownerId);
+        return this.data.projects.filter((item) => item.ownerId === ownerId).map(projectView);
+    }
+    getAccount(ownerId, id) {
+        this.requireAccountOwner(ownerId);
+        const project = this.data.projects.find((item) => item.id === id && item.ownerId === ownerId);
+        if (!project)
+            throw new ProjectRegistryError(404, "找不到这个项目。");
+        return { ...project };
+    }
+    createAccount(ownerId, name) {
+        this.requireAccountOwner(ownerId);
+        // This username is internal legacy metadata, never the Account display name.
+        return this.createForOwner(this.data.owners[0].username, name);
+    }
+    requireLegacy() {
+        if (this.data.version !== 1)
+            throw new ProjectRegistryError(403, "此 Cloud 已采用明确的账号归属，请通过云账号管理。");
+    }
+    requireAccountOwner(ownerId) {
+        this.assertStorage();
+        if (this.data.version !== 2 || this.data.accountBinding?.ownerId !== ownerId)
+            throw new ProjectRegistryError(403, "此账号没有 Cloud 管理权限。");
+    }
+    createForOwner(username, name) {
         if (typeof name !== "string" ||
             !name.trim() ||
             name.trim().length > 80 ||