@cjhyy/code-shell-server 0.9.36 → 0.9.38

package/dist/project-runtime/docker-provider.js

@@ -103,6 +103,15 @@ async function within(promise, signal) {
             signal.removeEventListener("abort", onAbort);
     }
 }
+/** Shared trusted configuration parsing, including hosts with an injected provider. */
+export function resolveProjectRuntimeLimits(limits) {
+    const memoryMb = bounded(limits?.memoryMb ?? 2048, 128, 262144, "memory");
+    const cpus = bounded(limits?.cpus ?? 2, 0.1, 128, "CPU");
+    const pids = bounded(limits?.pids ?? 256, 16, 65536, "process");
+    if (!Number.isInteger(memoryMb) || !Number.isInteger(pids))
+        throw new ProjectRuntimeError("Invalid resource limits.");
+    return { memoryMb, cpus, pids };
+}
 /** An administrator-owned Docker control client. Project tasks never receive this client. */
 export function createDockerProjectProvider(options) {
     if (!UUID.test(options.installationId))
@@ -116,11 +125,7 @@ export function createDockerProjectProvider(options) {
     const dataDir = resolve(options.dataDir);
     if (/[\0,\r\n]/.test(dataDir))
         throw new ProjectRuntimeError("Unsupported project metadata path.");
-    const memory = bounded(options.limits?.memoryMb ?? 2048, 128, 262144, "memory");
-    const cpus = bounded(options.limits?.cpus ?? 2, 0.1, 128, "CPU");
-    const pids = bounded(options.limits?.pids ?? 256, 16, 65536, "process");
-    if (!Number.isInteger(memory) || !Number.isInteger(pids))
-        throw new ProjectRuntimeError("Invalid resource limits.");
+    const { memoryMb: memory, cpus, pids } = resolveProjectRuntimeLimits(options.limits);
     const commandTimeout = bounded(options.commandTimeoutMs ?? 15000, 10, 120000, "command timeout");
     const startupTimeout = bounded(options.startupTimeoutMs ?? 90000, 10, 300000, "startup timeout");
     const command = options.command ?? dockerCommand;

package/dist/project-runtime/lock.js

@@ -1,43 +1,212 @@
-import { lstatSync } from "node:fs";
+import * as fs from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join, resolve } from "node:path";
 import { lockSync } from "@cjhyy/code-shell-core/internal";
 /** One control process per directory; heartbeat leases recover after a crash. */
 export function acquireProjectControllerLock(directory) {
-    const original = lstatSync(directory);
+    directory = resolve(directory);
+    const original = fs.lstatSync(directory);
     if (!original.isDirectory() || original.isSymbolicLink())
         throw new Error("Unsafe project control directory.");
+    const lockPath = `${directory}.lock`;
+    let identity;
+    let candidate;
+    let owner;
+    let candidateOwner;
+    let mtime;
     let compromised = false;
     let released = false;
+    const sameDirectory = (actual, expected) => actual.isDirectory() &&
+        !actual.isSymbolicLink() &&
+        actual.dev === expected.dev &&
+        actual.ino === expected.ino;
+    const ownerFile = (actual) => actual.isFile() &&
+        !actual.isSymbolicLink() &&
+        actual.nlink === 1 &&
+        actual.size === 0 &&
+        (actual.mode & 0o077) === 0;
+    function readOwner() {
+        const entries = fs.readdirSync(lockPath);
+        if (!entries.length)
+            return; // A historical proper-lockfile owner had no marker.
+        if (entries.length !== 1 ||
+            !/^\.owner-[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(entries[0]))
+            throw lost();
+        const identity = fs.lstatSync(join(lockPath, entries[0]));
+        if (!ownerFile(identity))
+            throw lost();
+        return { name: entries[0], identity };
+    }
+    function assertOwner(expected) {
+        const current = readOwner();
+        if (!current ||
+            current.name !== expected.name ||
+            current.identity.dev !== expected.identity.dev ||
+            current.identity.ino !== expected.identity.ino)
+            throw lost();
+    }
+    const lost = () => {
+        compromised = true;
+        // ENOENT terminates proper-lockfile's renewal immediately, rather than
+        // repeatedly retrying an owner which has already permanently lost custody.
+        return Object.assign(new Error("Project controller lock is no longer held."), {
+            code: "ENOENT",
+        });
+    };
+    function assertRoot() {
+        if (compromised)
+            throw lost();
+        try {
+            if (!sameDirectory(fs.lstatSync(directory), original))
+                throw lost();
+        }
+        catch {
+            throw lost();
+        }
+    }
+    function assertOwned() {
+        assertRoot();
+        try {
+            const current = fs.lstatSync(lockPath);
+            if (!identity ||
+                !owner ||
+                !sameDirectory(current, identity) ||
+                (mtime !== undefined && current.mtimeMs !== mtime))
+                throw lost();
+            assertOwner(owner);
+        }
+        catch {
+            throw lost();
+        }
+    }
+    // lockSync's adapter invokes these synchronous functions for acquisition,
+    // every heartbeat and exit cleanup. Guarding only callback-style fs methods
+    // would leave its renewal and release paths unprotected.
+    const guardedFs = {
+        ...fs,
+        mkdirSync(path) {
+            if (path !== lockPath)
+                return fs.mkdirSync(path);
+            assertRoot();
+            fs.mkdirSync(path, { mode: 0o700 });
+            identity = fs.lstatSync(path);
+            const name = `.owner-${randomUUID()}`;
+            const marker = fs.openSync(join(path, name), fs.constants.O_CREAT |
+                fs.constants.O_EXCL |
+                fs.constants.O_WRONLY |
+                fs.constants.O_NOFOLLOW, 0o600);
+            try {
+                owner = { name, identity: fs.fstatSync(marker) };
+                if (!ownerFile(owner.identity))
+                    throw lost();
+            }
+            finally {
+                fs.closeSync(marker);
+            }
+            mtime = fs.lstatSync(path).mtimeMs;
+            assertOwned();
+        },
+        statSync(path) {
+            if (path !== lockPath)
+                return fs.statSync(path);
+            if (identity)
+                assertOwned();
+            else
+                assertRoot();
+            const current = fs.lstatSync(path);
+            if (!current.isDirectory() || current.isSymbolicLink())
+                throw lost();
+            // An existing stale lock may be removed only if it remains the exact
+            // directory whose age proper-lockfile just inspected.
+            if (!identity) {
+                candidate = current;
+                candidateOwner = readOwner();
+            }
+            return current;
+        },
+        utimesSync(path, atime, nextMtime) {
+            if (path !== lockPath)
+                return fs.utimesSync(path, atime, nextMtime);
+            assertOwned();
+            const descriptor = fs.openSync(path, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+            try {
+                if (!sameDirectory(fs.fstatSync(descriptor), identity))
+                    throw lost();
+                // Renew the captured inode, never a replacement installed between the
+                // path check and the write. Recheck the public path before accepting it.
+                fs.futimesSync(descriptor, atime, nextMtime);
+                mtime = fs.fstatSync(descriptor).mtimeMs;
+                assertOwned();
+            }
+            catch {
+                throw lost();
+            }
+            finally {
+                fs.closeSync(descriptor);
+            }
+        },
+        rmdirSync(path) {
+            if (path !== lockPath)
+                return fs.rmdirSync(path);
+            if (identity) {
+                assertOwned();
+                fs.unlinkSync(join(path, owner.name));
+            }
+            else {
+                assertRoot();
+                if (!candidate || !sameDirectory(fs.lstatSync(path), candidate))
+                    throw lost();
+                if (candidateOwner) {
+                    assertOwner(candidateOwner);
+                    fs.unlinkSync(join(path, candidateOwner.name));
+                }
+                else if (fs.readdirSync(path).length)
+                    throw lost();
+            }
+            // Only our own random marker (or the exact observed stale candidate's)
+            // was removed. If the pathname changes immediately before this syscall,
+            // an established new owner still has its different marker: ENOTEMPTY
+            // preserves it, and stale acquisition must fail rather than claim success.
+            fs.rmdirSync(path);
+        },
+    };
     let unlock;
     try {
         unlock = lockSync(directory, {
+            realpath: false,
+            lockfilePath: lockPath,
             stale: 30000,
             update: 10000,
             retries: 0,
+            fs: guardedFs,
             onCompromised: () => {
                 compromised = true;
             },
         });
+        assertOwned();
     }
-    catch {
-        throw new Error("Another project controller owns this data directory; stop it before starting another.");
+    catch (error) {
+        throw new Error(compromised
+            ? "Project controller lock is no longer held."
+            : "Another project controller owns this data directory; stop it before starting another.", { cause: error });
     }
     return {
         assertHeld() {
             if (released || compromised)
                 throw new Error("Project controller lock is no longer held.");
-            const current = lstatSync(directory);
-            if (!current.isDirectory() ||
-                current.isSymbolicLink() ||
-                current.dev !== original.dev ||
-                current.ino !== original.ino)
-                throw new Error("Project control directory changed while the controller was running.");
+            assertOwned();
         },
         release() {
             if (released)
                 return;
             released = true;
-            if (!compromised)
-                unlock();
+            try {
+                assertOwned();
+            }
+            catch {
+                return; // The lost owner may never delete another owner's replacement.
+            }
+            unlock();
         },
     };
 }

package/dist/project-runtime/manager.d.ts

@@ -1,13 +1,16 @@
-import type { HubSession } from "../hub/auth-store.js";
+import type { ProjectControlSession } from "./control-authority.js";
 import { ProjectRegistry, type ProjectView } from "./registry.js";
 import type { ProjectRuntimeConnection, ProjectRuntimeProvider } from "./types.js";
 export interface ProjectManagerOptions {
     registry: ProjectRegistry;
     provider: ProjectRuntimeProvider;
     publicOrigin(): string;
-    isSessionActive(session: HubSession): boolean;
+    isSessionActive(session: ProjectControlSession): boolean;
     revokeProject(id: string): Promise<void>;
+    revalidateSession?(session: ProjectControlSession): Promise<void>;
     maxRunning?: number;
+    maxRunningPerOwner?: number;
+    maxProjectsPerOwner?: number;
     /** Clock seam for Docker observations; authorization is never cached. */
     now?: () => number;
 }
@@ -17,24 +20,29 @@ export declare class ProjectManager {
     private readonly starts;
     private readonly stops;
     private readonly targets;
+    private readonly stopRevisions;
     private readonly statusChecks;
     private closed;
     private closing;
     constructor(options: ProjectManagerOptions);
     private authorize;
+    private ownedProject;
+    private authorizeContinuous;
     reconcile(): Promise<void>;
-    list(session: HubSession): ProjectView[];
-    get(session: HubSession, id: string): ProjectView;
-    create(session: HubSession, name: unknown): ProjectView;
-    start(session: HubSession, id: string): Promise<ProjectView>;
-    stop(session: HubSession, id: string): Promise<ProjectView>;
+    list(session: ProjectControlSession): ProjectView[];
+    get(session: ProjectControlSession, id: string): ProjectView;
+    create(session: ProjectControlSession, name: unknown): ProjectView;
+    start(session: ProjectControlSession, id: string): Promise<ProjectView>;
+    stop(session: ProjectControlSession, id: string): Promise<ProjectView>;
     private beginStop;
     private stopProject;
-    resolveTarget(session: HubSession, id: string): Promise<ProjectRuntimeConnection>;
+    resolveTarget(session: ProjectControlSession, id: string): Promise<ProjectRuntimeConnection>;
     private observeRuntime;
     /** Stop the affected runtime without relying on its already-revoked outer session. */
     stopAfterRevocationFailure(id: string): Promise<void>;
     /** Emergency fallback when an outer owner's affected projects are unavailable. */
     stopAll(): Promise<void>;
+    /** Revocation fallback for one Account; never interrupts another owner's runtimes. */
+    stopOwner(ownerId: string): Promise<void>;
     close(): Promise<void>;
 }

package/dist/project-runtime/manager.js

@@ -5,6 +5,7 @@ export class ProjectManager {
     starts = new Map();
     stops = new Map();
     targets = new Map();
+    stopRevisions = new Map();
     statusChecks = new Map();
     closed = false;
     closing;
@@ -14,6 +15,12 @@ export class ProjectManager {
             (options.maxRunning ?? 4) < 1 ||
             (options.maxRunning ?? 4) > 32)
             throw new Error("Project running limit must be between 1 and 32.");
+        for (const [name, value, maximum] of [
+            ["running per owner", options.maxRunningPerOwner ?? 2, 32],
+            ["projects per owner", options.maxProjectsPerOwner ?? 16, 128],
+        ])
+            if (!Number.isSafeInteger(value) || value < 1 || value > maximum)
+                throw new Error(`Project ${name} limit must be between 1 and ${maximum}.`);
     }
     authorize(session) {
         if (this.closed)
@@ -21,6 +28,16 @@ export class ProjectManager {
         if (!this.options.isSessionActive(session))
             throw new ProjectRegistryError(401, "登录已过期，请重新登录。");
     }
+    ownedProject(session, id) {
+        return "kind" in session
+            ? this.options.registry.getAccount(session.ownerId, id)
+            : this.options.registry.get(session.username, id);
+    }
+    async authorizeContinuous(session) {
+        this.authorize(session);
+        await this.options.revalidateSession?.(session);
+        this.authorize(session);
+    }
     async reconcile() {
         this.statusChecks.clear();
         // Never adopt a previous controller's approvals or device credentials after a crash.
@@ -41,30 +58,52 @@ export class ProjectManager {
     }
     list(session) {
         this.authorize(session);
-        return this.options.registry.list(session.username);
+        return "kind" in session
+            ? this.options.registry.listAccount(session.ownerId)
+            : this.options.registry.list(session.username);
     }
     get(session, id) {
         this.authorize(session);
-        return projectView(this.options.registry.get(session.username, id));
+        return projectView(this.ownedProject(session, id));
     }
     create(session, name) {
         this.authorize(session);
-        return projectView(this.options.registry.create(session.username, name));
+        if (this.options.registry.multiAccount &&
+            "kind" in session &&
+            this.options.registry.listAccount(session.ownerId).length >=
+                (this.options.maxProjectsPerOwner ?? 16))
+            throw new ProjectRegistryError(429, `每个账号最多创建 ${this.options.maxProjectsPerOwner ?? 16} 个项目。`);
+        return projectView("kind" in session
+            ? this.options.registry.createAccount(session.ownerId, name)
+            : this.options.registry.create(session.username, name));
     }
     async start(session, id) {
         this.authorize(session);
-        this.options.registry.get(session.username, id);
+        this.ownedProject(session, id);
+        const revision = this.stopRevisions.get(id) ?? 0;
+        const authorizeStart = () => {
+            this.authorize(session);
+            if ((this.stopRevisions.get(id) ?? 0) !== revision)
+                throw new ProjectRegistryError(409, "项目启动已取消。");
+        };
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
+        authorizeStart();
         const stopping = this.stops.get(id);
         if (stopping)
             await stopping;
-        this.authorize(session);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
+        authorizeStart();
         const existing = this.starts.get(id);
         if (existing) {
             const result = await existing;
-            this.authorize(session);
+            if (this.options.revalidateSession)
+                await this.authorizeContinuous(session);
+            authorizeStart();
             return result;
         }
-        const project = this.options.registry.get(session.username, id);
+        const project = this.ownedProject(session, id);
         if (project.status === "running") {
             await this.resolveTarget(session, id);
             return this.get(session, id);
@@ -76,6 +115,16 @@ export class ProjectManager {
             item.generation > 0).length;
         if (count >= (this.options.maxRunning ?? 4))
             throw new ProjectRegistryError(429, `最多同时运行 ${this.options.maxRunning ?? 4} 个项目，请先停止其他项目。`);
+        if (this.options.registry.multiAccount) {
+            const ownerCount = this.options.registry
+                .all()
+                .filter((item) => item.ownerId === project.ownerId &&
+                item.id !== id &&
+                ["running", "starting", "stopping", "error"].includes(item.status) &&
+                item.generation > 0).length;
+            if (ownerCount >= (this.options.maxRunningPerOwner ?? 2))
+                throw new ProjectRegistryError(429, `每个账号最多同时运行 ${this.options.maxRunningPerOwner ?? 2} 个项目。`);
+        }
         this.statusChecks.delete(id);
         const record = this.options.registry.update(id, {
             status: "starting",
@@ -84,14 +133,18 @@ export class ProjectManager {
         const operation = (async () => {
             try {
                 await this.options.revokeProject(id);
-                this.authorize(session);
-                if (this.options.registry.get(session.username, id).status !== "starting")
+                if (this.options.revalidateSession)
+                    await this.authorizeContinuous(session);
+                authorizeStart();
+                if (this.ownedProject(session, id).status !== "starting")
                     throw new ProjectRegistryError(409, "项目启动已取消。");
                 const target = await this.options.provider.ensure(record, {
                     publicOrigin: this.options.publicOrigin(),
                 });
-                this.authorize(session);
-                const current = this.options.registry.get(session.username, id);
+                if (this.options.revalidateSession)
+                    await this.authorizeContinuous(session);
+                authorizeStart();
+                const current = this.ownedProject(session, id);
                 if (current.status !== "starting" || current.generation !== record.generation)
                     throw new ProjectRegistryError(409, "项目启动已取消。");
                 if (target.generation !== record.generation)
@@ -109,7 +162,7 @@ export class ProjectManager {
                 catch {
                     stopped = false;
                 }
-                const current = this.options.registry.get(session.username, id);
+                const current = this.ownedProject(session, id);
                 if (current.generation === record.generation && current.status === "starting") {
                     this.options.registry.update(id, {
                         status: stopped ? "stopped" : "error",
@@ -129,8 +182,13 @@ export class ProjectManager {
     }
     async stop(session, id) {
         this.authorize(session);
-        this.options.registry.get(session.username, id);
+        this.ownedProject(session, id);
+        this.stopRevisions.set(id, (this.stopRevisions.get(id) ?? 0) + 1);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         const result = await this.beginStop(id);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         this.authorize(session);
         return result;
     }
@@ -168,15 +226,19 @@ export class ProjectManager {
         }
     }
     async resolveTarget(session, id) {
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         this.authorize(session);
-        const record = this.options.registry.get(session.username, id);
+        const record = this.ownedProject(session, id);
         const target = this.targets.get(id);
         if (record.status !== "running" || !target || target.generation !== record.generation)
             throw new ProjectRegistryError(409, "项目尚未运行，请先启动项目。");
         // The provider checks labels and the loopback binding, not just a remembered port.
         const state = await this.observeRuntime(record, target);
+        if (this.options.revalidateSession)
+            await this.authorizeContinuous(session);
         this.authorize(session);
-        const current = this.options.registry.get(session.username, id);
+        const current = this.ownedProject(session, id);
         if (current.status !== "running" || current.generation !== target.generation)
             throw new ProjectRegistryError(409, "项目已停止或重新启动，请重新进入。");
         if (state.state !== "running" || state.url !== target.url) {
@@ -232,6 +294,18 @@ export class ProjectManager {
         if (results.some((result) => result.status === "rejected" || result.value.status !== "stopped"))
             throw new ProjectRegistryError(503, "部分项目尚未确认停止，请检查 Docker。");
     }
+    /** Revocation fallback for one Account; never interrupts another owner's runtimes. */
+    async stopOwner(ownerId) {
+        this.options.registry.listAccount(ownerId); // Require an actual Account owner.
+        const projects = this.options.registry.all().filter((project) => project.ownerId === ownerId);
+        for (const project of projects)
+            this.stopRevisions.set(project.id, (this.stopRevisions.get(project.id) ?? 0) + 1);
+        const results = await Promise.allSettled(projects
+            .filter((project) => project.generation > 0 && project.status !== "stopped")
+            .map((project) => this.beginStop(project.id)));
+        if (results.some((result) => result.status === "rejected" || result.value.status !== "stopped"))
+            throw new ProjectRegistryError(503, "部分账号项目尚未确认停止，请检查 Docker。");
+    }
     close() {
         if (this.closing)
             return this.closing;

package/dist/project-runtime/proxy.d.ts

@@ -1,12 +1,12 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type Duplex } from "node:stream";
 import { type HubAuth } from "../hub/auth-http.js";
-import type { HubSession } from "../hub/auth-store.js";
+import type { ProjectControlAuthority, ProjectControlSession } from "./control-authority.js";
 import type { ProjectRuntimeConnection } from "./types.js";
 export type RuntimeTarget = ProjectRuntimeConnection;
 export interface ProjectRuntimeProxyOptions {
-    auth: HubAuth;
-    resolveTarget(projectId: string, session: HubSession): Promise<RuntimeTarget>;
+    auth: HubAuth | ProjectControlAuthority;
+    resolveTarget(projectId: string, session: ProjectControlSession): Promise<RuntimeTarget>;
     publicOrigin: () => string;
     /** Stop this runtime if its private logout cannot acknowledge revocation.
      * Dispatched after retirement settles; may call back into revokeProject. */

package/dist/project-runtime/proxy.js

@@ -2,6 +2,7 @@ import { request as httpRequest } from "node:http";
 import { Transform } from "node:stream";
 import { WebSocket, WebSocketServer } from "ws";
 import { HUB_SESSION_COOKIE } from "../hub/auth-http.js";
+import { ProjectRegistryError } from "./registry.js";
 import { createLinkBrowserHandoff } from "../links/browser-handoff.js";
 const UUID = "[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}";
 const PROJECT_PATH = new RegExp(`^/p/(${UUID})(/.*)$`);
@@ -86,6 +87,9 @@ export function createProjectRuntimeProxy(options) {
     }
     async function validate(lease) {
         const session = assertLease(lease);
+        if ("revalidate" in options.auth)
+            await options.auth.revalidate(session);
+        assertLease(lease);
         const current = checkedTarget(await options.resolveTarget(lease.projectId, session));
         assertLease(lease);
         if (!sameTarget(current, lease.target)) {
@@ -212,7 +216,7 @@ export function createProjectRuntimeProxy(options) {
         // An opaque iframe has no cookie and Origin:null. Only its already issued
         // random capability takes this path; another signed-in owner cannot borrow it.
         if (req.headers.authorization !== undefined ||
-            req.headers.cookie?.includes(`${HUB_SESSION_COOKIE}=`)) {
+            req.headers.cookie?.includes(`${"cookieName" in options.auth ? options.auth.cookieName : HUB_SESSION_COOKIE}=`)) {
             const session = await options.auth.authenticate(req);
             if (!session || session.id !== grant.lease.sessionId)
                 throw new ProxyError(403, "Panel asset belongs to another session");
@@ -750,13 +754,19 @@ function httpError(res, error) {
         res.destroy();
         return;
     }
-    const status = error instanceof ProxyError ? error.status : 503;
+    const status = error instanceof ProxyError || error instanceof ProjectRegistryError ? error.status : 503;
     res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" });
     res.end(JSON.stringify({
-        error: error instanceof ProxyError ? error.message : "Project runtime unavailable",
+        error: error instanceof ProxyError
+            ? error.message
+            : status === 401
+                ? "Authentication required"
+                : status === 404
+                    ? "Project endpoint not found"
+                    : "Project runtime unavailable",
     }));
 }
 function upgradeError(socket, error) {
-    const status = error instanceof ProxyError ? error.status : 503;
-    socket.end(`HTTP/1.1 ${status} Error\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    const status = error instanceof ProxyError || error instanceof ProjectRegistryError ? error.status : 503;
+    socket.end(`HTTP/1.1 ${status} Error\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`, () => socket.destroy());
 }

package/dist/project-runtime/registry.d.ts

@@ -1,5 +1,6 @@
-import { renameSync } from "node:fs";
+import { fsyncSync, renameSync } from "node:fs";
 import type { ProjectRuntimeRecord } from "./types.js";
+import { type CloudAccountBinding, type CloudMultiAccountConfiguration } from "./account-binding.js";
 export type ProjectStatus = "stopped" | "starting" | "running" | "stopping" | "error";
 export interface StoredProject extends ProjectRuntimeRecord {
     name: string;
@@ -32,14 +33,26 @@ export declare class ProjectRegistry {
     private readonly controllerLock;
     private diskDigest;
     private markerEstablished;
+    private storageFailed;
     constructor(dataDir: string, now?: () => number, io?: {
         rename?: typeof renameSync;
+        fsync?: typeof fsyncSync;
+        offlineAccountAdoption?: boolean;
+        /** Explicit startup policy; never inferred from the first authenticated user. */
+        multiAccountOrigin?: string;
     });
     /** Release the single-controller lease on shutdown or startup failure. */
     close(): void;
     /** Offline restore only: new Docker namespace, same project credentials for restored data volumes. */
     renewInstallationForRestore(): void;
     get installationId(): string;
+    get accountBinding(): CloudAccountBinding | undefined;
+    get multiAccount(): CloudMultiAccountConfiguration | undefined;
+    /** Called only after trusted authority verification, never with browser-selected identity. */
+    ensureAccountOwner(accountOrigin: string, accountId: string): string;
+    private requireConfiguredMode;
+    /** Offline migration only; the caller must durably preserve source evidence first. */
+    bindAccount(binding: CloudAccountBinding): void;
     private validate;
     private assertStorage;
     private write;
@@ -47,6 +60,13 @@ export declare class ProjectRegistry {
     list(username: string): ProjectView[];
     get(username: string, id: string): StoredProject;
     create(username: string, name: unknown): StoredProject;
+    listAccount(ownerId: string): ProjectView[];
+    getAccount(ownerId: string, id: string): StoredProject;
+    createAccount(ownerId: string, name: unknown): StoredProject;
+    private requireLegacy;
+    private requireAccountOwner;
+    private createForOwner;
+    private createForAccountOwner;
     update(id: string, patch: {
         status: ProjectStatus;
         generation?: number;