@cjhyy/code-shell-server 0.9.36 → 0.9.38

package/dist/project-runtime/backup.js

@@ -1,17 +1,19 @@
 import { createHash, randomUUID } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
-import { constants, createWriteStream } from "node:fs";
+import { closeSync, constants, createWriteStream, fsyncSync, fstatSync, lstatSync, openSync, writeFileSync, } from "node:fs";
 import { lstat, mkdir, open, readdir, realpath, rm, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { Transform } from "node:stream";
 import { HubAuthStore } from "../hub/auth-store.js";
 import { ProjectRegistry } from "./registry.js";
+import { isCloudAccountOrigin } from "./account-binding.js";
 const LABEL = "io.codeshell.project-runtime";
 const FORMAT = "codeshell.project-installation-backup";
 const MAX_CONTROL_FILE = 16 * 1024 * 1024;
 const SHA = /^[a-f0-9]{64}$/;
 const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+const MULTI_CONTROL_FILES = ["project-control/initialized", "project-control/registry.json"];
 const digest = (value) => ({
     sha256: createHash("sha256").update(value).digest("hex"),
     bytes: value.length,
@@ -256,6 +258,14 @@ async function copyControl(source, destination, records, prefix = "") {
         }
     }
 }
+async function assertMultiControlInventory(source) {
+    for (const name of await readdir(source))
+        if (!["project-control", "project-control.lock", "project-runtime-secrets"].includes(name))
+            throw new Error("Multi-account backup refuses unknown controller state files.");
+    for (const name of await readdir(join(source, "project-control")))
+        if (!["initialized", "registry.json"].includes(name))
+            throw new Error("Multi-account backup refuses unknown project control files.");
+}
 /** Offline, owner-only backup. It never stops projects or modifies their volumes. */
 export async function backupProjectInstallation(options) {
     imageId(options.helperImage);
@@ -263,15 +273,21 @@ export async function backupProjectInstallation(options) {
     await directory(source);
     // Do not initialize a fresh registry as a side effect of a mistaken backup path.
     await regular(join(source, "project-control/registry.json"), 512 * 1024);
-    const registry = new ProjectRegistry(source);
+    const registry = new ProjectRegistry(source, Date.now, {
+        multiAccountOrigin: options.multiAccountOrigin,
+    });
     let destination;
     try {
         const rows = registry.all();
         if (rows.some((row) => row.status !== "stopped"))
             throw new Error("Stop all projects and the controller before backup.");
-        const auth = new HubAuthStore({ dataDir: source });
-        if (!auth.isInitialized())
-            throw new Error("Complete administrator setup before backing up.");
+        if (registry.multiAccount)
+            await assertMultiControlInventory(source);
+        if (!registry.multiAccount) {
+            const auth = new HubAuthStore({ dataDir: source });
+            if (!auth.isInitialized())
+                throw new Error("Complete administrator setup before backing up.");
+        }
         const installationId = registry.installationId;
         const projects = rows.map(({ id, ownerId, generation }) => ({ id, ownerId, generation }));
         await stopped(installationId, projects);
@@ -281,7 +297,8 @@ export async function backupProjectInstallation(options) {
         await mkdir(join(destination, "volumes"), { mode: 0o700 });
         const manifest = {
             format: FORMAT,
-            version: 1,
+            version: registry.multiAccount ? 2 : 1,
+            ...(registry.multiAccount ? { multiAccountOrigin: registry.multiAccount.accountOrigin } : {}),
             createdAt: new Date().toISOString(),
             installationId,
             helperImage: options.helperImage,
@@ -289,7 +306,20 @@ export async function backupProjectInstallation(options) {
             control: Object.create(null),
             volumes: [],
         };
-        await copyControl(source, join(destination, "control"), manifest.control);
+        if (registry.multiAccount) {
+            await mkdir(join(destination, "control/project-control"), { mode: 0o700 });
+            for (const path of MULTI_CONTROL_FILES) {
+                const bytes = await controlBytes(source, path);
+                await writeFile(join(destination, "control", path), bytes, {
+                    mode: 0o600,
+                    flag: "wx",
+                    flush: true,
+                });
+                manifest.control[path] = digest(bytes);
+            }
+        }
+        else
+            await copyControl(source, join(destination, "control"), manifest.control);
         for (const project of projects) {
             let found = 0;
             for (const kind of ["data", "workspace"]) {
@@ -316,6 +346,8 @@ export async function backupProjectInstallation(options) {
         }
         await stopped(installationId, projects);
         registry.all(); // Recheck registry ownership and unchanged bytes after asynchronous work.
+        if (registry.multiAccount)
+            await assertMultiControlInventory(source);
         const manifestBytes = JSON.stringify(manifest, null, 2) + "\n";
         if (Buffer.byteLength(manifestBytes) > 1024 * 1024)
             throw new Error("Backup manifest exceeds its supported size.");
@@ -342,7 +374,10 @@ export async function backupProjectInstallation(options) {
 }
 function validateManifest(value) {
     if (value?.format !== FORMAT ||
-        value.version !== 1 ||
+        ![1, 2].includes(value.version) ||
+        (value.version === 1
+            ? value.multiAccountOrigin !== undefined
+            : !isCloudAccountOrigin(value.multiAccountOrigin)) ||
         !UUID.test(value.installationId) ||
         !Array.isArray(value.projects) ||
         value.projects.length > 128 ||
@@ -375,12 +410,16 @@ function validateManifest(value) {
     }
     if (Object.keys(value.control).length > 4096)
         throw new Error("Invalid control inventory.");
+    if (value.version === 2 &&
+        Object.keys(value.control).sort().join() !== MULTI_CONTROL_FILES.join())
+        throw new Error("Multi-account backup requires its exact controller inventory.");
     for (const [path, entry] of Object.entries(value.control)) {
         if (!path ||
             path.includes("\\") ||
             path.split("/").some((part) => !part || part === "." || part === "..") ||
             /[\0\r\n]/.test(path) ||
             path === "restore-in-progress" ||
+            ["project-runtime-secrets", "administrator-setup.txt", "environment.json"].some((obsolete) => path.startsWith(obsolete + "/")) ||
             path.startsWith("project-control.lock/") ||
             path === "project-control.lock" ||
             !entry ||
@@ -404,7 +443,7 @@ function validateManifest(value) {
     for (const path of [
         "project-control/registry.json",
         "project-control/initialized",
-        "hub/auth.json",
+        ...(value.version === 1 ? ["hub/auth.json"] : []),
     ])
         if (!Object.hasOwn(value.control, path))
             throw new Error("Backup lacks required control data.");
@@ -418,6 +457,8 @@ export async function restoreProjectInstallation(options) {
     await directory(join(source, "volumes"));
     const manifest = JSON.parse((await regular(join(source, "manifest.json"), 1024 * 1024)).toString());
     validateManifest(manifest);
+    if (manifest.multiAccountOrigin !== options.multiAccountOrigin)
+        throw new Error("Restore requires the explicitly configured Account origin and matching installation mode.");
     // Verify every archive before creating a destination or Docker resource.
     for (const volume of manifest.volumes)
         same(await fileDigest(join(source, volume.file)), volume.digest);
@@ -425,31 +466,67 @@ export async function restoreProjectInstallation(options) {
         same(digest(await controlBytes(join(source, "control"), path)), expected);
     await docker(["image", "inspect", options.helperImage]);
     const destination = await exclusiveDestination(source, resolve(options.destination));
+    const marker = join(destination, "restore-in-progress");
+    const directories = new Set([destination]);
+    const sync = (path) => {
+        const before = lstatSync(path);
+        if (before.isSymbolicLink() || (!before.isFile() && !before.isDirectory()))
+            throw new Error("Restore durability requires ordinary files and directories.");
+        const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const current = fstatSync(fd);
+            if (current.dev !== before.dev || current.ino !== before.ino)
+                throw new Error("Restore storage changed while opening.");
+            (options.io?.fsync ?? fsyncSync)(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    };
+    const persistMarker = (rearm = false) => {
+        try {
+            writeFileSync(marker, "1\n", { mode: 0o600, flag: "wx" });
+        }
+        catch (error) {
+            if (!rearm || error.code !== "EEXIST")
+                throw error;
+        }
+        sync(marker);
+        sync(destination);
+        sync(dirname(destination));
+    };
     const created = [];
     let registry;
     try {
-        await writeFile(join(destination, "restore-in-progress"), "1\n", {
-            mode: 0o600,
-            flag: "wx",
-            flush: true,
-        });
+        persistMarker();
         for (const [path, expected] of Object.entries(manifest.control)) {
             const bytes = await controlBytes(join(source, "control"), path);
             same(digest(bytes), expected);
             await mkdir(dirname(join(destination, path)), { recursive: true, mode: 0o700 });
+            for (let parent = dirname(join(destination, path)); parent !== destination; parent = dirname(parent))
+                directories.add(parent);
             await writeFile(join(destination, path), bytes, { mode: 0o600, flag: "wx", flush: true });
         }
-        registry = new ProjectRegistry(destination);
+        registry = new ProjectRegistry(destination, Date.now, {
+            fsync: options.io?.fsync,
+            multiAccountOrigin: options.multiAccountOrigin,
+        });
         const rows = registry.all();
         if (registry.installationId !== manifest.installationId ||
             rows.some((p) => p.status !== "stopped") ||
             JSON.stringify(rows.map(({ id, ownerId, generation }) => ({ id, ownerId, generation }))) !==
                 JSON.stringify(manifest.projects))
             throw new Error("Backup control and volume identities disagree.");
-        const auth = new HubAuthStore({ dataDir: destination });
-        if (!auth.isInitialized())
-            throw new Error("Backup administrator is not initialized.");
-        auth.revokeAllSessions();
+        if (!registry.multiAccount) {
+            const auth = new HubAuthStore({ dataDir: destination });
+            if (!auth.isInitialized())
+                throw new Error("Backup administrator is not initialized.");
+            auth.revokeAllSessions();
+            // HubAuthStore publishes by rename. Persist the replacement and its directory
+            // before a new namespace or removal of the restore barrier can become visible.
+            sync(join(destination, "hub/auth.json"));
+            sync(join(destination, "hub"));
+        }
         registry.renewInstallationForRestore();
         const installationId = registry.installationId;
         for (const volume of manifest.volumes) {
@@ -472,7 +549,12 @@ export async function restoreProjectInstallation(options) {
         for (const path of ["project-runtime-secrets", "administrator-setup.txt", "environment.json"])
             await rm(join(destination, path), { recursive: true, force: true });
         registry.all();
-        await rm(join(destination, "restore-in-progress"));
+        // Copied file bytes were flushed individually; their new directory entries
+        // must also survive a crash before the installation is advertised as usable.
+        for (const path of [...directories].sort((a, b) => b.length - a.length))
+            sync(path);
+        await (options.io?.removeMarker ?? rm)(marker);
+        sync(destination);
         return {
             destination,
             installationId,
@@ -482,6 +564,15 @@ export async function restoreProjectInstallation(options) {
         };
     }
     catch (error) {
+        let barrierError;
+        try {
+            // In particular, unlink may have succeeded before its directory fsync
+            // failed. Re-establish and persist the barrier before any cleanup awaits.
+            persistMarker(true);
+        }
+        catch (failure) {
+            barrierError = failure;
+        }
         // Only delete volumes created by this restore and still carrying its exact labels.
         for (const { name, expected } of created.reverse()) {
             try {
@@ -492,6 +583,8 @@ export async function restoreProjectInstallation(options) {
                 /* Preserve a busy/changed volume for operator inspection. */
             }
         }
+        if (barrierError)
+            throw new AggregateError([error, barrierError], `Restore failed and its durable barrier could not be confirmed; keep ${destination} offline.`, { cause: error });
         throw error; // Keep the marked offline directory as recovery evidence; never advertise success.
     }
     finally {

package/dist/project-runtime/cloud-account-auth.d.ts

@@ -0,0 +1,23 @@
+import { type CloudAccountBinding } from "./account-binding.js";
+import type { CloudAccountAuthority, CloudManagementSession, ProjectControlAuthority } from "./control-authority.js";
+export declare const CLOUD_MANAGEMENT_AUTHORITY_VERSION = 2;
+export declare const CLOUD_MANAGEMENT_COOKIE = "cs_cloud_management";
+export declare function cloudManagementSessionView(session: CloudManagementSession): {
+    id: string;
+    kind: "cloud-management";
+    audience: string;
+    installationId: string;
+    accountOrigin: string;
+    accountId: string;
+    managementEpoch: string;
+    expiresAt: number;
+};
+/** An explicitly bound Account controls one existing single-operator installation. */
+export declare function createCloudAccountAuth(options: {
+    binding: CloudAccountBinding;
+    installationId: string;
+    publicOrigin: string;
+    authority: CloudAccountAuthority;
+    onRevoke(sessionId: string): void;
+    now?: () => number;
+}): ProjectControlAuthority;

package/dist/project-runtime/cloud-account-auth.js

@@ -0,0 +1,287 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { isCloudAccountOrigin } from "./account-binding.js";
+import { ProjectRegistryError } from "./registry.js";
+export const CLOUD_MANAGEMENT_AUTHORITY_VERSION = 2;
+export const CLOUD_MANAGEMENT_COOKIE = "cs_cloud_management";
+const TOKEN = /^[A-Za-z0-9_-]{43}$/;
+const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+const hash = (token) => createHash("sha256").update(token).digest("hex");
+export function cloudManagementSessionView(session) {
+    const { ownerId: _ownerId, ...view } = session;
+    return view;
+}
+function principalValid(value) {
+    return (value &&
+        Object.keys(value).sort().join() ===
+            ["accountOrigin", "accountId", "sessionId", "rootSessionId", "authorityEpoch", "expiresAt"]
+                .sort()
+                .join() &&
+        isCloudAccountOrigin(value.accountOrigin) &&
+        UUID.test(value.accountId) &&
+        UUID.test(value.sessionId) &&
+        value.sessionId === value.rootSessionId &&
+        UUID.test(value.authorityEpoch) &&
+        Number.isSafeInteger(value.expiresAt));
+}
+/** An explicitly bound Account controls one existing single-operator installation. */
+export function createCloudAccountAuth(options) {
+    const now = options.now ?? Date.now;
+    if (!isCloudAccountOrigin(options.publicOrigin) ||
+        options.authority.accountOrigin !== options.binding.accountOrigin ||
+        !UUID.test(options.installationId))
+        throw new Error("Cloud authority configuration does not match explicit ownership.");
+    const sessions = new Map();
+    const reading = new Set();
+    let closed = false;
+    let exchanging = 0;
+    let attempts = { until: now() + 60_000, count: 0 };
+    function revoke(entry) {
+        if (entry.revoked)
+            return;
+        entry.revoked = true;
+        options.onRevoke(entry.session.id);
+    }
+    function entryFor(session) {
+        if (closed || !("kind" in session))
+            return;
+        const entry = sessions.get(session.id);
+        if (!entry || entry.revoked || entry.session.expiresAt <= now()) {
+            if (entry)
+                revoke(entry);
+            return;
+        }
+        // Do not let a caller change owner, epoch or deadline using an existing id.
+        if (JSON.stringify(entry.session) !== JSON.stringify(session))
+            return;
+        return entry;
+    }
+    async function revalidate(session) {
+        const entry = entryFor(session);
+        if (!entry)
+            throw new ProjectRegistryError(401, "Cloud 管理登录已失效。");
+        try {
+            const current = await options.authority.validate({ ...entry.principal }, options.installationId);
+            if (!principalValid(current) ||
+                Object.keys(current).some((key) => current[key] !==
+                    entry.principal[key]) ||
+                !entryFor(session))
+                throw new Error("Cloud Account authority changed.");
+        }
+        catch {
+            revoke(entry);
+            throw new ProjectRegistryError(401, "Cloud 管理授权已失效，请重新登录云账号。");
+        }
+    }
+    function requestToken(req) {
+        let authorizations = 0;
+        for (let i = 0; i < req.rawHeaders.length; i += 2)
+            if (req.rawHeaders[i].toLowerCase() === "authorization")
+                authorizations++;
+        if (authorizations > 1)
+            return;
+        const bearer = req.headers.authorization;
+        const cookie = req.headers.cookie
+            ?.split(";")
+            .map((part) => part.trim())
+            .filter((part) => part.startsWith(`${CLOUD_MANAGEMENT_COOKIE}=`));
+        if (bearer !== undefined && cookie?.length)
+            return;
+        if (bearer !== undefined)
+            return /^Bearer ([A-Za-z0-9_-]{43})$/.exec(bearer)?.[1];
+        if (cookie?.length === 1)
+            return cookie[0].slice(CLOUD_MANAGEMENT_COOKIE.length + 1);
+    }
+    function isOriginAllowed(req) {
+        let hosts = 0;
+        for (let i = 0; i < req.rawHeaders.length; i += 2)
+            if (req.rawHeaders[i].toLowerCase() === "host")
+                hosts++;
+        if (hosts !== 1 ||
+            req.headers.host !== new URL(options.publicOrigin).host ||
+            req.headers["sec-fetch-site"] === "cross-site")
+            return false;
+        return req.headers.origin === undefined || req.headers.origin === options.publicOrigin;
+    }
+    async function authenticate(req) {
+        if (!isOriginAllowed(req))
+            return null;
+        const token = requestToken(req);
+        if (!token || !TOKEN.test(token))
+            return null;
+        const entry = [...sessions.values()].find((row) => row.hash === hash(token));
+        if (!entry || !entryFor(entry.session))
+            return null;
+        await revalidate(entry.session);
+        return { ...entry.session };
+    }
+    function json(res, status, value) {
+        res.writeHead(status, {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            "Referrer-Policy": "no-referrer",
+            "X-Content-Type-Options": "nosniff",
+        });
+        res.end(JSON.stringify(value));
+    }
+    async function readBody(req) {
+        if (!/^application\/json(?:\s*;|$)/i.test(req.headers["content-type"] ?? ""))
+            throw new ProjectRegistryError(415, "请使用 JSON 提交。");
+        const chunks = [];
+        let size = 0;
+        const timer = setTimeout(() => req.destroy(), 5000);
+        timer.unref();
+        reading.add(req);
+        try {
+            for await (const chunk of req) {
+                size += chunk.length;
+                if (size > 4096)
+                    throw new ProjectRegistryError(413, "请求过大。");
+                chunks.push(Buffer.from(chunk));
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            reading.delete(req);
+        }
+        try {
+            const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            if (body && typeof body === "object" && !Array.isArray(body))
+                return body;
+        }
+        catch {
+            /* fixed public error below */
+        }
+        throw new ProjectRegistryError(400, "请求格式无效。");
+    }
+    async function handle(req, res) {
+        const path = (req.url ?? "/").split("?", 1)[0];
+        if (!path.startsWith("/api/v1/cloud-management/") && !path.startsWith("/api/v1/auth/"))
+            return false;
+        if (!isOriginAllowed(req))
+            throw new ProjectRegistryError(403, "请求来源无效。");
+        if (closed)
+            throw new ProjectRegistryError(503, "Cloud 管理服务正在关闭。");
+        if (req.url !== path)
+            throw new ProjectRegistryError(400, "请求参数无效。");
+        if (path === "/api/v1/cloud-management/capabilities" && req.method === "GET") {
+            json(res, 200, {
+                version: CLOUD_MANAGEMENT_AUTHORITY_VERSION,
+                mode: "cloud-account",
+                cloudOrigin: options.publicOrigin,
+                installationId: options.installationId,
+                accountOrigin: options.binding.accountOrigin,
+            });
+            return true;
+        }
+        if (path === "/api/v1/cloud-management/session" && req.method === "POST") {
+            // Main sends an Account-issued target-bound single-use ticket, never its root credential.
+            if (req.headers.origin !== undefined ||
+                req.headers.cookie !== undefined ||
+                req.headers.authorization !== undefined ||
+                req.headers["sec-fetch-site"] !== undefined)
+                throw new ProjectRegistryError(403, "请从桌面 Cloud 管理器登录。");
+            if (now() >= attempts.until)
+                attempts = { until: now() + 60_000, count: 0 };
+            if (++attempts.count > 60 || exchanging >= 4)
+                throw new ProjectRegistryError(429, "Cloud 管理登录请求过多。");
+            exchanging++;
+            try {
+                const body = await readBody(req);
+                if (Object.keys(body).join() !== "ticket" ||
+                    typeof body.ticket !== "string" ||
+                    !TOKEN.test(body.ticket))
+                    throw new ProjectRegistryError(400, "Cloud 管理票据格式无效。");
+                let principal;
+                try {
+                    principal = await options.authority.redeem(body.ticket, options.installationId);
+                }
+                catch {
+                    throw new ProjectRegistryError(401, "云账号验证失败。");
+                }
+                if (closed ||
+                    !principalValid(principal) ||
+                    principal.accountOrigin !== options.binding.accountOrigin ||
+                    principal.accountId !== options.binding.accountId ||
+                    principal.expiresAt <= now())
+                    throw new ProjectRegistryError(403, "此账号没有 Cloud 管理权限。");
+                for (const [id, row] of sessions)
+                    if (row.session.expiresAt + 600_000 <= now())
+                        sessions.delete(id);
+                if (sessions.size >= 128)
+                    throw new ProjectRegistryError(429, "Cloud 管理会话数量已达上限。");
+                const token = randomBytes(32).toString("base64url");
+                const session = {
+                    id: randomUUID(),
+                    kind: "cloud-management",
+                    audience: options.publicOrigin,
+                    installationId: options.installationId,
+                    accountOrigin: principal.accountOrigin,
+                    accountId: principal.accountId,
+                    managementEpoch: options.binding.managementEpoch,
+                    expiresAt: Math.min(now() + 600_000, principal.expiresAt),
+                    ownerId: options.binding.ownerId,
+                };
+                sessions.set(session.id, {
+                    hash: hash(token),
+                    session,
+                    principal: { ...principal },
+                    revoked: false,
+                });
+                json(res, 201, { token, session: cloudManagementSessionView(session) });
+            }
+            finally {
+                exchanging--;
+            }
+            return true;
+        }
+        if (path === "/api/v1/auth/status" && req.method === "GET") {
+            const session = await authenticate(req);
+            json(res, 200, {
+                initialized: true,
+                mode: "cloud-account",
+                authenticated: !!session,
+                ...(session && "kind" in session ? { session: cloudManagementSessionView(session) } : {}),
+            });
+            return true;
+        }
+        if (["/api/v1/cloud-management/logout", "/api/v1/auth/logout"].includes(path) &&
+            req.method === "POST") {
+            const body = await readBody(req);
+            if (Object.keys(body).length)
+                throw new ProjectRegistryError(400, "退出不接受额外参数。");
+            const token = requestToken(req);
+            const entry = token &&
+                TOKEN.test(token) &&
+                [...sessions.values()].find((row) => row.hash === hash(token));
+            if (!entry)
+                throw new ProjectRegistryError(401, "Cloud 管理登录已失效。");
+            revoke(entry);
+            res.setHeader("Set-Cookie", `${CLOUD_MANAGEMENT_COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${options.publicOrigin.startsWith("https:") ? "; Secure" : ""}`);
+            json(res, 200, { revoked: true });
+            return true;
+        }
+        throw new ProjectRegistryError(403, "此 Cloud 只接受明确绑定的云账号管理。");
+    }
+    return {
+        cookieName: CLOUD_MANAGEMENT_COOKIE,
+        store: {
+            listSessions: () => [...sessions.values()]
+                .filter((row) => entryFor(row.session))
+                .map((row) => ({ ...row.session })),
+        },
+        handle,
+        authenticate,
+        isOriginAllowed,
+        isActive: (session) => !!entryFor(session),
+        revalidate,
+        close() {
+            closed = true;
+            for (const request of reading)
+                request.destroy();
+            reading.clear();
+            for (const row of sessions.values())
+                revoke(row);
+            sessions.clear();
+        },
+    };
+}

package/dist/project-runtime/cloud-browser-auth.d.ts

@@ -0,0 +1,15 @@
+import type { CloudAccountAuthority, ProjectControlAuthority } from "./control-authority.js";
+/** Browser bootstrap is separate from the native, single-operator v2 API. */
+export declare const CLOUD_BROWSER_AUTHORITY_VERSION = 1;
+export declare const CLOUD_BROWSER_COOKIE = "cs_cloud_browser";
+/** Every principal is independently scoped; a login never claims legacy projects. */
+export declare function createCloudBrowserAuth(options: {
+    accountOrigin: string;
+    managementEpoch: string;
+    installationId: string;
+    publicOrigin: string;
+    authority: CloudAccountAuthority;
+    ownerForAccount(accountOrigin: string, accountId: string): string;
+    onRevoke(sessionId: string, ownerId: string): void;
+    now?: () => number;
+}): ProjectControlAuthority;