初始提交：DSH 多租户平台（dshs）

src/isolation.ts

@@ -0,0 +1,21 @@
+/**
+ * Account-level isolation helpers. Linux-only: each user maps to a deterministic
+ * OS uid so the orchestrator can spawn its DSH as that account (via setuid) and
+ * per-user 0700 directories become a real boundary.
+ *
+ * `hashUid` is the *legacy* deterministic hash (stable across restarts and
+ * hosts); new users get `baseUid + row_id` from the DB instead (collision-free,
+ * see `src/db`). `hashUid` remains as the backfill value for pre-existing rows
+ * and the fallback when a uid is not yet assigned.
+ * @module dshs/isolation
+ */
+
+/**
+ * Deterministic OS uid for a user id (stable across restarts and hosts).
+ * `baseUid` should sit above the distro's system uid range (typically < 1000).
+ */
+export function hashUid(userId: string, baseUid: number): number {
+  let hash = 0
+  for (let i = 0; i < userId.length; i++) hash = (hash * 31 + userId.charCodeAt(i)) >>> 0
+  return baseUid + (hash % 100000)
+}