From 53ae90ec13a11a0136e9d93c32f42d22682fa5a8 Mon Sep 17 00:00:00 2001
From: felis <foreverddong@outlook.com>
Date: Sat, 18 Jul 2026 22:24:00 -0700
Subject: [PATCH] move live source ownership to accounts

---
 README.md                                     |  5 +-
 apps/overlay/src/control.tsx                  | 88 +++++++++++++------
 apps/overlay/src/main.tsx                     | 12 ++-
 apps/server-rust/README.md                    |  5 +-
 .../migrations/006_account_live_source.sql    | 26 ++++++
 apps/server-rust/src/app.rs                   |  4 +
 apps/server-rust/src/auth.rs                  | 29 ++----
 apps/server-rust/src/components.rs            |  9 +-
 apps/server-rust/src/db.rs                    | 13 ++-
 apps/server-rust/src/domain.rs                |  2 +-
 apps/server-rust/src/http_api.rs              | 11 ++-
 apps/server-rust/src/live/mod.rs              |  6 +-
 apps/server-rust/src/live/supervisor.rs       |  4 +-
 apps/server-rust/src/realtime.rs              | 71 ++++++++-------
 apps/server-rust/src/repository.rs            | 23 ++---
 apps/server-rust/src/song_request.rs          |  4 +-
 docs/architecture.md                          | 12 +--
 docs/components/README.md                     | 10 +--
 docs/protocol.md                              |  4 +-
 docs/security.md                              |  5 +-
 20 files changed, 219 insertions(+), 124 deletions(-)
 create mode 100644 apps/server-rust/migrations/006_account_live_source.sql

diff --git a/README.md b/README.md
index 6966e24..87a83d8 100644
--- a/README.md
+++ b/README.md
@@ -29,7 +29,7 @@ adapter 只负责把强类型 Bilibili 命令转换成稳定的领域事件。cr
 - `components.rs`
   注册组件定义、设置 schema/迁移、事件订阅、纯投影和独立副作用 handler；新礼物展示或点歌姬不需要修改弹幕姬队列核心。
 - `realtime.rs` 按 component
-  UUID 建立独立广播通道，路由时同时校验 owner 与 source；副作用 handler 不依赖 OBS
+  UUID 建立独立广播通道；账户直播事件先按 owner 提供给全部启用组件，再由组件订阅筛选，副作用 handler 不依赖 OBS
   WebSocket 是否在线。
 - `auth.rs`、`repository.rs` 和 PostgreSQL
   RLS 共同实现身份、凭据、直播源、组件与 token 的用户隔离；`http_api.rs`
@@ -116,7 +116,8 @@ https://danmaku.luoxingci.com/control/setup
 创建和撤销邀请码。每个邀请码只能使用一次，并在创建时固定绑定一个尚未占用的 Bilibili
 `room_id`；注册者不能修改该房间，账户创建后房间绑定也不可更改。受邀用户打开注册链接，选择用户名、扫描自己的 TOTP 二维码并确认动态码即可完成注册。普通用户不能创建邀请码。
 
-每个用户在 `/control/` 配置自己的 CookieCloud 同步 UUID/Key 和密码，地址必须位于部署管理员配置的
+每个用户在 `/control/account`
+配置账户级直播监听和自己的 CookieCloud 同步 UUID/Key 与密码。该配置只创建一条上游连接，并供账户下全部现有和未来组件使用。地址必须位于部署管理员配置的
 `security.cookiecloud_allowed_hosts`
 白名单。服务禁止 HTTP 重定向并安全编码 Key 路径，避免用户凭据导致服务端任意请求。服务会先验证凭据，再将敏感字段按用户独立加密保存；Cookie、Key 和明文密码不会返回浏览器，也不会与其他账户共享。CookieCloud 中需要存在 Bilibili
 `SESSDATA`。
diff --git a/apps/overlay/src/control.tsx b/apps/overlay/src/control.tsx
index 132641f..602b862 100644
--- a/apps/overlay/src/control.tsx
+++ b/apps/overlay/src/control.tsx
@@ -1,8 +1,8 @@
 /**
  * Authenticated component studio.
  *
- * This module composes tenant-scoped component settings, CookieCloud source
- * configuration, isolated test events, OBS token rotation and system-admin
+ * This module composes tenant-scoped component settings, account-level live
+ * source configuration, isolated test events, OBS token rotation and system-admin
  * invitations. One-time secrets remain local to the panel that created them;
  * update blockers prevent the PWA from refreshing until they are saved.
  */
@@ -98,7 +98,7 @@ function ControlLayout({
   children,
 }: {
   user: AuthUser
-  active: 'components' | 'invitations'
+  active: 'components' | 'account' | 'invitations'
   onLogout: () => Promise<void>
   children: ReactNode
 }) {
@@ -117,6 +117,9 @@ function ControlLayout({
           <a className={active === 'components' ? 'active' : ''} href="/control/">
             我的组件
           </a>
+          <a className={active === 'account' ? 'active' : ''} href="/control/account">
+            直播账户
+          </a>
           {isAdmin && (
             <a className={active === 'invitations' ? 'active' : ''} href="/control/invitations">
               邀请码
@@ -509,21 +512,17 @@ function SourceEditor({
   source: CookieCloudSource
   onSaved: (source: CookieCloudSource) => void
 }) {
-  const [roomId, setRoomId] = useState(source.roomId)
+  const roomId = source.roomId
   const [host, setHost] = useState(source.cookieCloud.host)
   const [key, setKey] = useState(source.cookieCloud.key)
   const [password, setPassword] = useState('')
   const [busy, setBusy] = useState(false)
   const [flash, setFlash] = useState<Flash>()
   const sourceDirty =
-    roomId !== source.roomId ||
-    host.trim() !== source.cookieCloud.host ||
-    key !== source.cookieCloud.key ||
-    Boolean(password)
+    host.trim() !== source.cookieCloud.host || key !== source.cookieCloud.key || Boolean(password)
   usePwaUpdateBlocker('live-source', '保存或还原直播源与 CookieCloud 设置', busy || sourceDirty)
 
   useEffect(() => {
-    setRoomId(source.roomId)
     setHost(source.cookieCloud.host)
     setKey(source.cookieCloud.key)
     setPassword('')
@@ -535,7 +534,7 @@ function SourceEditor({
     setFlash(undefined)
     try {
       const payload = await api<unknown>(
-        '/api/v1/source',
+        '/api/v1/account/live-source',
         json('PUT', {
           roomId: roomId.trim(),
           cookieCloud: {
@@ -548,7 +547,7 @@ function SourceEditor({
       const next = normalizeSource(payload)
       onSaved(next)
       setPassword('')
-      setFlash({ kind: 'success', text: '直播源已保存，连接会使用新的隔离配置。' })
+      setFlash({ kind: 'success', text: '账户直播源已保存，所有组件会共享这条事件流。' })
     } catch (reason) {
       setFlash({ kind: 'error', text: errorMessage(reason, '直播源保存失败') })
     } finally {
@@ -559,7 +558,7 @@ function SourceEditor({
   return (
     <Panel
       title="Bilibili 直播源"
-      description="该 CookieCloud 凭据仅属于当前账户，不会与其他用户共享。"
+      description="每个账户只有一条监听连接和一份 CookieCloud 凭据；监听事件会提供给本账户的所有组件。"
       aside={
         source.connected === undefined ? undefined : (
           <span className={`status-chip ${source.connected ? 'online' : 'offline'}`}>
@@ -572,13 +571,7 @@ function SourceEditor({
       <form className="field-grid two-columns" onSubmit={submit}>
         <label>
           邀请码绑定的直播间 ID
-          <input
-            required
-            readOnly
-            inputMode="numeric"
-            value={roomId}
-            onChange={event => setRoomId(event.target.value)}
-          />
+          <input required readOnly inputMode="numeric" value={roomId} />
           <small>直播间由系统管理员签发邀请码时固定，用户不能自行切换。</small>
         </label>
         <label>
@@ -942,7 +935,6 @@ export function ComponentsPage({
   const [components, setComponents] = useState<ComponentSummary[]>([])
   const [selectedId, setSelectedId] = useState<string>()
   const [settings, setSettings] = useState<ComponentSettings>()
-  const [source, setSource] = useState<CookieCloudSource>()
   const [loading, setLoading] = useState(true)
   const [saving, setSaving] = useState(false)
   const [flash, setFlash] = useState<Flash>()
@@ -984,14 +976,10 @@ export function ComponentsPage({
     const load = async () => {
       setLoading(true)
       try {
-        const [componentPayload, sourcePayload] = await Promise.all([
-          api<unknown>('/api/v1/components'),
-          api<unknown>('/api/v1/source'),
-        ])
+        const componentPayload = await api<unknown>('/api/v1/components')
         if (cancelled) return
         const nextComponents = normalizeComponents(componentPayload)
         setComponents(nextComponents)
-        setSource(normalizeSource(sourcePayload))
         const requested = new URLSearchParams(location.search).get('component')
         const first =
           nextComponents.find(component => component.id === requested) ??
@@ -1132,13 +1120,61 @@ export function ComponentsPage({
               <div className="empty-state">当前账户还没有可配置的组件。</div>
             </Panel>
           )}
-          {source && <SourceEditor source={source} onSaved={setSource} />}
         </div>
       </div>
     </ControlLayout>
   )
 }
 
+/** Account-owned upstream configuration, intentionally separate from every
+ * component editor so adding future components cannot create another listener. */
+export function AccountLiveSourcePage({
+  user,
+  onLogout,
+}: {
+  user: AuthUser
+  onLogout: () => Promise<void>
+}) {
+  const [source, setSource] = useState<CookieCloudSource>()
+  const [loading, setLoading] = useState(true)
+  const [flash, setFlash] = useState<Flash>()
+
+  useEffect(() => {
+    let cancelled = false
+    api<unknown>('/api/v1/account/live-source')
+      .then(payload => {
+        if (!cancelled) setSource(normalizeSource(payload))
+      })
+      .catch(reason => {
+        if (!cancelled)
+          setFlash({ kind: 'error', text: errorMessage(reason, '无法读取账户直播源') })
+      })
+      .finally(() => {
+        if (!cancelled) setLoading(false)
+      })
+    return () => {
+      cancelled = true
+    }
+  }, [])
+
+  return (
+    <ControlLayout user={user} active="account" onLogout={onLogout}>
+      <div className="admin-content">
+        <div className="page-heading">
+          <div>
+            <p className="eyebrow">ACCOUNT LIVE STREAM</p>
+            <h1>直播账户</h1>
+            <p>配置一次直播间与 CookieCloud，供当前账户下所有现有及未来组件使用。</p>
+          </div>
+        </div>
+        <FlashMessage flash={flash} />
+        {loading && <div className="loading-panel jade-panel">正在读取账户直播源…</div>}
+        {source && <SourceEditor source={source} onSaved={setSource} />}
+      </div>
+    </ControlLayout>
+  )
+}
+
 async function loadCompleteSongQueue(componentId: string): Promise<SongRequestPage> {
   // A queue may change between paginated HTTP requests. Restart instead of
   // presenting pages from different revisions as one ordering.
diff --git a/apps/overlay/src/main.tsx b/apps/overlay/src/main.tsx
index 031c178..47d65fa 100644
--- a/apps/overlay/src/main.tsx
+++ b/apps/overlay/src/main.tsx
@@ -10,7 +10,13 @@ import { useCallback, useEffect, useState } from 'react'
 import { createRoot } from 'react-dom/client'
 import { ApiError, api, errorMessage, json, normalizeSession } from './api'
 import { EnrollmentPage, LoginPage } from './auth'
-import { ComponentsPage, ForbiddenPage, InvitationsPage, SongRequestsPage } from './control'
+import {
+  AccountLiveSourcePage,
+  ComponentsPage,
+  ForbiddenPage,
+  InvitationsPage,
+  SongRequestsPage,
+} from './control'
 import { Overlay, tokenFromFragment } from './overlay'
 import { PwaControls, authRoute, cleanupLegacyPwa, initializePwa } from './pwa'
 import { SongRequestOverlay } from './songOverlay'
@@ -166,6 +172,10 @@ function App() {
     if (!session.user) return <Redirect to="/control/login" />
     return <ComponentsPage user={session.user} onLogout={logout} />
   }
+  if (path === '/control/account') {
+    if (!session.user) return <Redirect to="/control/login" />
+    return <AccountLiveSourcePage user={session.user} onLogout={logout} />
+  }
   if (path === '/control/invitations') {
     if (!session.user) return <Redirect to="/control/login" />
     if (session.user.role !== 'system_admin')
diff --git a/apps/server-rust/README.md b/apps/server-rust/README.md
index ed4a4a5..9927813 100644
--- a/apps/server-rust/README.md
+++ b/apps/server-rust/README.md
@@ -18,13 +18,14 @@ crate 导出。
 | `live`         | provider trait、Bilibili adapter 与 source supervisor    |
 | `overlay`      | 弹幕姬设置及礼物/表情目录                                |
 | `rate_limit`   | 匿名登录和 enrollment 滥用限制                           |
-| `realtime`     | source event routing 与 component-scoped fanout          |
+| `realtime`     | account event routing 与 component-scoped fanout         |
 | `repository`   | PostgreSQL component facade 和热路径缓存同步             |
 | `song_request` | 点歌命令、事务队列、评分、快照和管理服务                 |
 
 ## 重要不变量
 
-- handler 不能信任请求体中的 owner；owner 必须来自 session 或 source context。
+- handler 不能信任请求体中的 owner；owner 必须来自 session 或账户 source context。
+- `component_instances` 不保存 source 绑定；账户唯一的监听事件会按 owner 提供给其全部启用组件。
 - tenant table 查询必须在 `Db::set_tenant` 后的事务中执行。
 - provider 只能输出 canonical、bounded、sanitized `LiveEvent`。
 - `libilibili` listener 必须保持 20 秒心跳；断线后由 adapter 重新获取弹幕 host/token 并重建 socket。
diff --git a/apps/server-rust/migrations/006_account_live_source.sql b/apps/server-rust/migrations/006_account_live_source.sql
new file mode 100644
index 0000000..bb4acaf
--- /dev/null
+++ b/apps/server-rust/migrations/006_account_live_source.sql
@@ -0,0 +1,26 @@
+-- Move live-listener ownership fully to the account boundary.
+--
+-- `live_sources.owner_user_id` and `cookiecloud_credentials.user_id` already
+-- enforce one listener configuration and one credential source per account.
+-- The component-level `source_id` foreign key was therefore redundant and,
+-- more importantly, made new component kinds look as though they selected
+-- their own upstream listener. Components now subscribe to their owner's
+-- canonical event stream and retain only their account ownership.
+
+DROP INDEX IF EXISTS component_instances_source_idx;
+
+ALTER TABLE component_instances
+  DROP CONSTRAINT IF EXISTS component_instances_owner_user_id_source_id_fkey;
+
+ALTER TABLE component_instances
+  DROP COLUMN IF EXISTS source_id;
+
+CREATE INDEX IF NOT EXISTS component_instances_owner_enabled_idx
+  ON component_instances(owner_user_id, enabled, created_at);
+
+COMMENT ON TABLE live_sources IS
+  'One immutable Bilibili live-listener configuration per account.';
+COMMENT ON TABLE cookiecloud_credentials IS
+  'One encrypted CookieCloud credential source per account.';
+COMMENT ON TABLE component_instances IS
+  'Account-owned consumers of the owning account live-event stream.';
diff --git a/apps/server-rust/src/app.rs b/apps/server-rust/src/app.rs
index 4fa7934..da71f6f 100644
--- a/apps/server-rust/src/app.rs
+++ b/apps/server-rust/src/app.rs
@@ -279,6 +279,10 @@ async fn migrate(db: &Db) -> Result<(), String> {
         (3_i32, include_str!("../migrations/003_multitenancy.sql")),
         (4_i32, include_str!("../migrations/004_auth_hardening.sql")),
         (5_i32, include_str!("../migrations/005_song_request.sql")),
+        (
+            6_i32,
+            include_str!("../migrations/006_account_live_source.sql"),
+        ),
     ] {
         let applied = transaction
             .query_one(
diff --git a/apps/server-rust/src/auth.rs b/apps/server-rust/src/auth.rs
index 6e4b0d1..52560e5 100644
--- a/apps/server-rust/src/auth.rs
+++ b/apps/server-rust/src/auth.rs
@@ -611,14 +611,9 @@ impl AuthService {
             .expect("OverlaySettings is always JSON serializable");
         transaction
             .execute(
-                "INSERT INTO component_instances(id,owner_user_id,source_id,kind,name,settings) \
-                 VALUES($1,$2,$3,'danmaku_overlay','弹幕姬',$4)",
-                &[
-                    &default_component_id,
-                    &user_id,
-                    &default_source_id,
-                    &default_settings,
-                ],
+                "INSERT INTO component_instances(id,owner_user_id,kind,name,settings) \
+                 VALUES($1,$2,'danmaku_overlay','弹幕姬',$3)",
+                &[&default_component_id, &user_id, &default_settings],
             )
             .await?;
         let song_component_id = Uuid::new_v4();
@@ -627,12 +622,11 @@ impl AuthService {
         transaction
             .execute(
                 "INSERT INTO component_instances \
-                 (id,owner_user_id,source_id,kind,name,settings,settings_version,enabled) \
-                 VALUES($1,$2,$3,$4,$5,$6,1,true)",
+                 (id,owner_user_id,kind,name,settings,settings_version,enabled) \
+                 VALUES($1,$2,$3,$4,$5,1,true)",
                 &[
                     &song_component_id,
                     &user_id,
-                    &default_source_id,
                     &SONG_REQUEST_KIND,
                     &SONG_REQUEST_NAME,
                     &song_settings,
@@ -1240,13 +1234,6 @@ impl AuthService {
             .ok_or(AuthError::InvalidCredentials)?
             .get(0);
         Db::set_tenant(&transaction, owner_user_id).await?;
-        let source_id: Uuid = transaction
-            .query_one(
-                "SELECT id FROM live_sources WHERE owner_user_id=$1",
-                &[&owner_user_id],
-            )
-            .await?
-            .get(0);
         let component_id = if let Some(row) = transaction
             .query_opt(
                 "SELECT id FROM component_instances \
@@ -1268,9 +1255,9 @@ impl AuthService {
             let id = Uuid::new_v4();
             transaction
                 .execute(
-                    "INSERT INTO component_instances(id,owner_user_id,source_id,kind,name,settings) \
-                     VALUES($1,$2,$3,'danmaku_overlay','弹幕姬',$4)",
-                    &[&id, &owner_user_id, &source_id, &settings],
+                    "INSERT INTO component_instances(id,owner_user_id,kind,name,settings) \
+                     VALUES($1,$2,'danmaku_overlay','弹幕姬',$3)",
+                    &[&id, &owner_user_id, &settings],
                 )
                 .await?;
             id
diff --git a/apps/server-rust/src/components.rs b/apps/server-rust/src/components.rs
index 219093b..2fe9892 100644
--- a/apps/server-rust/src/components.rs
+++ b/apps/server-rust/src/components.rs
@@ -84,7 +84,10 @@ pub struct ComponentInstance {
     pub id: Uuid,
     #[serde(skip_serializing)]
     pub owner_id: Uuid,
-    pub source_id: Uuid,
+    /// Runtime identity of the owner's account-level source. This value is
+    /// derived while loading the component and is not stored on its row.
+    #[serde(rename = "sourceId")]
+    pub account_source_id: Uuid,
     pub kind: String,
     pub name: String,
     pub enabled: bool,
@@ -95,7 +98,7 @@ pub struct ComponentInstance {
 impl ComponentInstance {
     pub fn new(
         owner_id: Uuid,
-        source_id: Uuid,
+        account_source_id: Uuid,
         kind: impl Into<String>,
         name: impl Into<String>,
         settings_version: u32,
@@ -104,7 +107,7 @@ impl ComponentInstance {
         Self {
             id: Uuid::new_v4(),
             owner_id,
-            source_id,
+            account_source_id,
             kind: kind.into(),
             name: name.into(),
             enabled: true,
diff --git a/apps/server-rust/src/db.rs b/apps/server-rust/src/db.rs
index 65b2795..513a7cf 100644
--- a/apps/server-rust/src/db.rs
+++ b/apps/server-rust/src/db.rs
@@ -108,8 +108,11 @@ impl Db {
         Self::set_tenant(&transaction, user_id).await?;
         let rows = transaction
             .query(
-                "SELECT id,source_id,kind,name,settings,settings_version,enabled \
-                 FROM component_instances WHERE owner_user_id=$1 ORDER BY created_at",
+                "SELECT component.id,source.id,component.kind,component.name,component.settings,\
+                        component.settings_version,component.enabled \
+                 FROM component_instances AS component \
+                 JOIN live_sources AS source ON source.owner_user_id=component.owner_user_id \
+                 WHERE component.owner_user_id=$1 ORDER BY component.created_at",
                 &[&user_id],
             )
             .await?;
@@ -119,7 +122,7 @@ impl Db {
             .map(|row| ComponentRecord {
                 id: row.get(0),
                 owner_user_id: user_id,
-                source_id: row.get(1),
+                account_source_id: row.get(1),
                 kind: row.get(2),
                 name: row.get(3),
                 settings: row.get(4),
@@ -141,7 +144,9 @@ pub struct ActiveTenant {
 pub struct ComponentRecord {
     pub id: Uuid,
     pub owner_user_id: Uuid,
-    pub source_id: Uuid,
+    /// Derived from the account's singleton live source; it is not component
+    /// configuration and is never persisted on `component_instances`.
+    pub account_source_id: Uuid,
     pub kind: String,
     pub name: String,
     pub settings: Value,
diff --git a/apps/server-rust/src/domain.rs b/apps/server-rust/src/domain.rs
index e93eb1e..c3caf19 100644
--- a/apps/server-rust/src/domain.rs
+++ b/apps/server-rust/src/domain.rs
@@ -288,7 +288,7 @@ impl ComponentMessage {
         Self {
             owner_id: component.owner_id,
             component_id: component.id,
-            source_id: component.source_id,
+            source_id: component.account_source_id,
             version: COMPONENT_PROTOCOL_VERSION,
             id: Uuid::new_v4(),
             occurred_at: chrono::Utc::now().to_rfc3339_opts(chrono::SecondsFormat::Millis, true),
diff --git a/apps/server-rust/src/http_api.rs b/apps/server-rust/src/http_api.rs
index 6e6fa9b..18a99fa 100644
--- a/apps/server-rust/src/http_api.rs
+++ b/apps/server-rust/src/http_api.rs
@@ -60,6 +60,14 @@ pub fn router(state: AppState) -> Router {
         .route("/api/v1/invitations/{id}", delete(revoke_invitation))
         .route("/api/v1/source", get(get_source).put(put_source))
         .route("/api/v1/source/reconnect", post(reconnect_source))
+        .route(
+            "/api/v1/account/live-source",
+            get(get_source).put(put_source),
+        )
+        .route(
+            "/api/v1/account/live-source/reconnect",
+            post(reconnect_source),
+        )
         .route(
             "/api/v1/components",
             get(list_components).post(create_component),
@@ -108,6 +116,7 @@ pub fn router(state: AppState) -> Router {
         .route("/control/register", get(spa_page))
         .route("/control/setup", get(spa_page))
         .route("/control/invitations", get(spa_page))
+        .route("/control/account", get(spa_page))
         .route("/obs/{public_id}", get(spa_page))
         .fallback_service(
             ServeDir::new("/app/web").not_found_service(ServeFile::new("/app/web/index.html")),
@@ -899,7 +908,7 @@ async fn component_test_event(
     };
     let mut event = LiveEvent::new(
         component.owner_id,
-        component.source_id,
+        component.account_source_id,
         "test",
         session.user.room_id,
         payload,
diff --git a/apps/server-rust/src/live/mod.rs b/apps/server-rust/src/live/mod.rs
index 1a5ced0..f85ab5d 100644
--- a/apps/server-rust/src/live/mod.rs
+++ b/apps/server-rust/src/live/mod.rs
@@ -42,9 +42,9 @@ impl SourceStatus {
 #[derive(Clone)]
 pub struct SourceContext {
     pub owner_id: Uuid,
-    /// Stable database identity for the account's single fixed live source.
-    /// It remains distinct from the owner id so future provider/source models
-    /// do not leak the current one-room product rule into event contracts.
+    /// Stable identity for the account's single fixed listener. Components do
+    /// not persist or select this ID; it remains in event envelopes so clients
+    /// can identify the shared upstream connection.
     pub source_id: Uuid,
     pub room_id: String,
 }
diff --git a/apps/server-rust/src/live/supervisor.rs b/apps/server-rust/src/live/supervisor.rs
index de2618e..19d612d 100644
--- a/apps/server-rust/src/live/supervisor.rs
+++ b/apps/server-rust/src/live/supervisor.rs
@@ -1,4 +1,4 @@
-//! Per-source task ownership, restart and cancellation.
+//! Per-account source task ownership, restart and cancellation.
 //!
 //! The supervisor guarantees at most one provider generation for a source ID.
 //! Reconfiguration cancels the old task before a replacement starts, preventing
@@ -27,7 +27,7 @@ struct RunningSource {
     status: watch::Receiver<SourceStatus>,
 }
 
-/// Owns exactly one provider task per account/source. Restart always cancels
+/// Owns exactly one provider task per account. Restart always cancels
 /// the prior generation before starting another, which prevents the duplicate
 /// listeners produced by the legacy `/reconnect` handler.
 #[derive(Clone)]
diff --git a/apps/server-rust/src/realtime.rs b/apps/server-rust/src/realtime.rs
index a39fbd0..b2efeae 100644
--- a/apps/server-rust/src/realtime.rs
+++ b/apps/server-rust/src/realtime.rs
@@ -1,6 +1,6 @@
 //! Tenant-aware event routing and component-scoped realtime fanout.
 //!
-//! The router resolves enabled instances by owner and source, validates their
+//! The router resolves every enabled instance owned by the account, validates its
 //! settings/subscriptions, runs durable handlers, then publishes passive
 //! projections. Each component owns a separate broadcast channel; there is no
 //! global receiver that could accidentally observe another tenant's events.
@@ -126,15 +126,11 @@ impl Error for ComponentStoreError {}
 pub type ComponentStoreFuture<'a> =
     Pin<Box<dyn Future<Output = Result<Vec<ComponentInstance>, ComponentStoreError>> + Send + 'a>>;
 
-/// Persistence port used by source routing. A PostgreSQL implementation should
-/// always scope its query by both owner and source; the router repeats that
-/// check as defense in depth.
+/// Persistence port used by account-stream routing. A provider event is offered
+/// to every enabled component owned by that account; each component definition
+/// then filters it through its event subscription.
 pub trait ComponentInstanceStore: Send + Sync {
-    fn list_enabled_for_source<'a>(
-        &'a self,
-        owner_id: Uuid,
-        source_id: Uuid,
-    ) -> ComponentStoreFuture<'a>;
+    fn list_enabled_for_owner<'a>(&'a self, owner_id: Uuid) -> ComponentStoreFuture<'a>;
 }
 
 #[derive(Clone, Default)]
@@ -173,22 +169,14 @@ impl InMemoryComponentStore {
 }
 
 impl ComponentInstanceStore for InMemoryComponentStore {
-    fn list_enabled_for_source<'a>(
-        &'a self,
-        owner_id: Uuid,
-        source_id: Uuid,
-    ) -> ComponentStoreFuture<'a> {
+    fn list_enabled_for_owner<'a>(&'a self, owner_id: Uuid) -> ComponentStoreFuture<'a> {
         Box::pin(async move {
             Ok(self
                 .instances
                 .read()
                 .unwrap_or_else(|poisoned| poisoned.into_inner())
                 .iter()
-                .filter(|instance| {
-                    instance.enabled
-                        && instance.owner_id == owner_id
-                        && instance.source_id == source_id
-                })
+                .filter(|instance| instance.enabled && instance.owner_id == owner_id)
                 .cloned()
                 .collect())
         })
@@ -229,7 +217,7 @@ pub enum RouteError {
 impl fmt::Display for RouteError {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
-            Self::Store(error) => write!(formatter, "cannot resolve source components: {error}"),
+            Self::Store(error) => write!(formatter, "cannot resolve account components: {error}"),
         }
     }
 }
@@ -282,7 +270,7 @@ impl SourceEventRouter {
     pub async fn route(&self, event: Arc<LiveEvent>) -> Result<RouteReport, RouteError> {
         let components = self
             .components
-            .list_enabled_for_source(event.owner_id, event.source_id)
+            .list_enabled_for_owner(event.owner_id)
             .await?;
         let mut report = RouteReport {
             considered: components.len(),
@@ -290,14 +278,11 @@ impl SourceEventRouter {
         };
 
         for component in components {
-            if !component.enabled
-                || component.owner_id != event.owner_id
-                || component.source_id != event.source_id
-            {
+            if !component.enabled || component.owner_id != event.owner_id {
                 report.failures.push(RouteFailure {
                     component_id: component.id,
                     stage: RouteStage::Scope,
-                    detail: "component owner/source does not match the source event".into(),
+                    detail: "component owner does not match the account event stream".into(),
                 });
                 continue;
             }
@@ -349,7 +334,7 @@ impl SourceEventRouter {
             match runtime.project(&component, &event) {
                 Ok(Some(message)) => {
                     if message.owner_id != component.owner_id
-                        || message.source_id != component.source_id
+                        || message.source_id != event.source_id
                         || message.component_id != component.id
                     {
                         report.failures.push(RouteFailure {
@@ -517,16 +502,38 @@ mod tests {
         assert!(report.failures.is_empty());
     }
 
+    #[tokio::test]
+    async fn one_account_event_is_offered_to_all_owned_components() {
+        let owner_id = Uuid::new_v4();
+        let account_source_id = Uuid::new_v4();
+        let first = overlay(owner_id, account_source_id);
+        let second = overlay(owner_id, account_source_id);
+        let first_id = first.id;
+        let second_id = second.id;
+        let hub = EventHub::new(8);
+        let mut first_rx = hub.subscribe(first_id);
+        let mut second_rx = hub.subscribe(second_id);
+        let store = Arc::new(InMemoryComponentStore::new(vec![first, second]));
+        let router = SourceEventRouter::new(ComponentRegistry::default(), store, hub);
+
+        let report = router
+            .route(danmaku(owner_id, account_source_id))
+            .await
+            .unwrap();
+
+        assert_eq!(report.considered, 2);
+        assert_eq!(report.projected, 2);
+        assert_eq!(first_rx.try_recv().unwrap().component_id, first_id);
+        assert_eq!(second_rx.try_recv().unwrap().component_id, second_id);
+        assert!(report.failures.is_empty());
+    }
+
     struct LeakyStore {
         instances: Vec<ComponentInstance>,
     }
 
     impl ComponentInstanceStore for LeakyStore {
-        fn list_enabled_for_source<'a>(
-            &'a self,
-            _owner_id: Uuid,
-            _source_id: Uuid,
-        ) -> ComponentStoreFuture<'a> {
+        fn list_enabled_for_owner<'a>(&'a self, _owner_id: Uuid) -> ComponentStoreFuture<'a> {
             Box::pin(async move { Ok(self.instances.clone()) })
         }
     }
diff --git a/apps/server-rust/src/repository.rs b/apps/server-rust/src/repository.rs
index 1d18d54..34dbdd4 100644
--- a/apps/server-rust/src/repository.rs
+++ b/apps/server-rust/src/repository.rs
@@ -2,7 +2,7 @@
 //!
 //! PostgreSQL is authoritative. Successful writes are reflected into the
 //! in-process [`InMemoryComponentStore`] used by the hot event path; startup and
-//! source restarts hydrate that cache from tenant-scoped rows before events are
+//! account-source restarts hydrate that cache from tenant-scoped rows before events are
 //! routed.
 
 use std::{fmt, sync::Arc};
@@ -69,12 +69,11 @@ impl TenantRepository {
                 transaction
                     .execute(
                         "INSERT INTO component_instances \
-                         (id,owner_user_id,source_id,kind,name,settings,settings_version,enabled) \
-                         VALUES($1,$2,$3,$4,$5,$6,1,true) ON CONFLICT DO NOTHING",
+                         (id,owner_user_id,kind,name,settings,settings_version,enabled) \
+                         VALUES($1,$2,$3,$4,$5,1,true) ON CONFLICT DO NOTHING",
                         &[
                             &id,
                             &tenant.user_id,
-                            &tenant.source_id,
                             &SONG_REQUEST_KIND,
                             &SONG_REQUEST_NAME,
                             &settings,
@@ -159,12 +158,11 @@ impl TenantRepository {
         transaction
             .execute(
                 "INSERT INTO component_instances \
-                 (id,owner_user_id,source_id,kind,name,settings,settings_version,enabled) \
-                 VALUES($1,$2,$3,$4,$5,$6,$7,true)",
+                 (id,owner_user_id,kind,name,settings,settings_version,enabled) \
+                 VALUES($1,$2,$3,$4,$5,$6,true)",
                 &[
                     &component.id,
                     &owner_id,
-                    &source_id,
                     &component.kind,
                     &component.name,
                     &component.settings,
@@ -220,8 +218,11 @@ impl TenantRepository {
         Db::set_tenant(&transaction, owner_id).await?;
         let row = transaction
             .query_opt(
-                "SELECT id,source_id,kind,name,settings,settings_version,enabled \
-                 FROM component_instances WHERE owner_user_id=$1 AND id=$2",
+                "SELECT component.id,source.id,component.kind,component.name,component.settings,\
+                        component.settings_version,component.enabled \
+                 FROM component_instances AS component \
+                 JOIN live_sources AS source ON source.owner_user_id=component.owner_user_id \
+                 WHERE component.owner_user_id=$1 AND component.id=$2",
                 &[&owner_id, &component_id],
             )
             .await?
@@ -230,7 +231,7 @@ impl TenantRepository {
         self.validate_loaded_component(component_from_record(ComponentRecord {
             id: row.get(0),
             owner_user_id: owner_id,
-            source_id: row.get(1),
+            account_source_id: row.get(1),
             kind: row.get(2),
             name: row.get(3),
             settings: row.get(4),
@@ -423,7 +424,7 @@ fn component_from_record(record: ComponentRecord) -> Result<ComponentInstance, R
     Ok(ComponentInstance {
         id: record.id,
         owner_id: record.owner_user_id,
-        source_id: record.source_id,
+        account_source_id: record.account_source_id,
         kind: record.kind,
         name: record.name,
         enabled: record.enabled,
diff --git a/apps/server-rust/src/song_request.rs b/apps/server-rust/src/song_request.rs
index 5e0b166..9cc74dc 100644
--- a/apps/server-rust/src/song_request.rs
+++ b/apps/server-rust/src/song_request.rs
@@ -678,8 +678,8 @@ async fn ensure_song_component(
     let valid: bool = transaction
         .query_one(
             "SELECT EXISTS(SELECT 1 FROM component_instances WHERE owner_user_id=$1 \
-             AND id=$2 AND source_id=$3 AND kind='song_request' AND enabled)",
-            &[&component.owner_id, &component.id, &component.source_id],
+             AND id=$2 AND kind='song_request' AND enabled)",
+            &[&component.owner_id, &component.id],
         )
         .await?
         .get(0);
diff --git a/docs/architecture.md b/docs/architecture.md
index 04af659..efd1a8d 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -5,8 +5,8 @@
 
 ## 核心目标
 
-- 每个账户固定绑定一个 Bilibili 直播间和一个独立直播源。
-- 一个直播源只建立一条上游连接，但可以把事件投递给多个组件实例。
+- 每个账户固定绑定一个 Bilibili 直播间、一个 CookieCloud 来源和一条独立监听连接。
+- 组件不绑定或选择直播源；账户事件流会提供给该账户所有启用的组件实例。
 - 平台原始命令先转换成稳定的领域事件，组件不直接依赖 Bilibili `CMD`。
 - HTTP 会话、直播源、组件、OBS token 和实时通道均以租户为边界。
 - 新组件可以增加设置、投影和持久化副作用，而不修改直播连接核心。
@@ -32,7 +32,9 @@ flowchart LR
 1. `SourceSupervisor` 为每个 `source_id` 保持至多一个 provider task。
 2. `BilibiliProvider` 使用该用户加密保存的 CookieCloud 凭据构造 `libilibili`
    客户端；crate 负责 WBI、WebSocket 与压缩包解析，adapter 再把强类型命令转换成 `LiveEvent`。
-3. `SourceEventRouter` 同时使用 `owner_id` 与 `source_id` 查找启用的组件，并再次检查组件归属。
+3. `SourceEventRouter` 按 `owner_id`
+   取得该账户所有启用组件，再由各组件的订阅声明筛选事件类型；`source_id`
+   只标识账户级监听，不存储在组件行中。
 4. 匹配订阅后，路由器先执行可持久化的 `EventHandler`，再执行无副作用的 `EventProjection`。
 5. 投影结果只发布到该 `component_id` 的广播通道。没有全局 WebSocket 事件总线。
 6. OBS 使用组件级只读 token 订阅一个组件，不能读取控制台 API。
@@ -42,8 +44,8 @@ flowchart LR
 | 状态             | 权威来源     | 内存副本                 | 说明                          |
 | ---------------- | ------------ | ------------------------ | ----------------------------- |
 | 用户、TOTP、会话 | PostgreSQL   | 无                       | Secret 加密，token 只保存摘要 |
-| CookieCloud 凭据 | PostgreSQL   | provider 构建期间解密    | 不返回浏览器                  |
-| 直播源和房间     | PostgreSQL   | `SourceSupervisor`       | 每用户固定一个房间            |
+| CookieCloud 凭据 | PostgreSQL   | provider 构建期间解密    | 每账户一份，不返回浏览器      |
+| 直播源和房间     | PostgreSQL   | `SourceSupervisor`       | 每账户固定一个房间和连接      |
 | 组件实例与设置   | PostgreSQL   | `InMemoryComponentStore` | 写入成功后刷新热路径缓存      |
 | 礼物/表情目录    | Bilibili API | provider catalog         | 刷新失败保留最近成功快照      |
 | 实时消息         | provider     | `EventHub` 有界广播      | 不作为业务持久化机制          |
diff --git a/docs/components/README.md b/docs/components/README.md
index bcc5904..fc64de9 100644
--- a/docs/components/README.md
+++ b/docs/components/README.md
@@ -1,6 +1,6 @@
 # 组件开发指南
 
-组件是“一个直播源上的独立功能实例”。当前内建 `danmaku_overlay` 与
+组件是“消费所属账户事件流的独立功能实例”。当前内建 `danmaku_overlay` 与
 `song_request`，未来礼物墙或统计组件也应使用同一套契约。
 
 ## 一个组件由什么组成
@@ -10,7 +10,7 @@
 | 定义     | `ComponentDefinition` | kind、设置版本、默认值、校验、迁移、订阅          |
 | 投影     | `EventProjection`     | 把 `LiveEvent` 转成浏览器消息，不执行持久化副作用 |
 | Handler  | `EventHandler`        | 可选的数据库写入、点歌或外部动作                  |
-| 实例     | `ComponentInstance`   | owner、source、kind、名称、设置和启用状态         |
+| 实例     | `ComponentInstance`   | owner、kind、名称、设置和启用状态                 |
 | 实时通道 | `EventHub`            | 按 component ID 隔离的有界广播                    |
 | 前端     | React renderer/editor | 管理设置、测试与 OBS 展示                         |
 
@@ -25,7 +25,7 @@
 4. 实现无副作用的 `EventProjection`。返回 `None` 表示该事件无需发送浏览器。
 5. 若需要可靠业务动作，实现 `EventHandler`：
    - 即使没有 OBS 客户端也会执行。
-   - 数据库操作必须包含 owner/source/component 条件。
+   - 数据库操作必须包含 owner/component 条件。
    - 上游可能重试或出现组合事件，因此 handler 自己负责幂等。
 6. 在 `ComponentRegistry::with_builtin_components` 注册定义与投影，再注册 handler。
 7. 增加数据库创建/设置 API；不要把组件专属关系数据无限塞入 JSON settings。
@@ -49,8 +49,8 @@ Handler 面向“业务事实”。例如点歌请求、礼物累计或审计写
 
 ## 租户与 token 规则
 
-- 组件必须属于同一个 owner 与 source。
-- 路由和数据库查询都要重复检查这一关系。
+- 组件必须属于经过认证的 owner，不能选择或覆盖账户直播源。
+- 路由和数据库查询都要重复检查 owner；账户事件可被其所有启用组件订阅。
 - 每个组件单独签发 access token，默认只有 `events:subscribe`。
 - 删除组件或轮换 token 时，关闭该组件 channel，使已有 socket 立即失效。
 - 组件 WebSocket 不得暴露其他组件列表或控制 API。
diff --git a/docs/protocol.md b/docs/protocol.md
index 7b589ea..3f70154 100644
--- a/docs/protocol.md
+++ b/docs/protocol.md
@@ -65,7 +65,9 @@ close 结束连接。
 ```
 
 `ownerId` 永远不会序列化到浏览器。消费者应按 `version` 和 `type`
-分派，并忽略不认识的 payload 字段，从而允许兼容地增加元数据。
+分派，并忽略不认识的 payload 字段，从而允许兼容地增加元数据。 `sourceId`
+标识所属账户唯一的直播监听连接，不表示组件单独绑定了一个直播源；同一账户不同组件收到的实时事件具有相同的
+`sourceId`。
 
 ## 事件类型
 
diff --git a/docs/security.md b/docs/security.md
index 00ac6b2..e737cbb 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -6,12 +6,13 @@ token。以下规则是实现约束，而不是可选部署建议。
 ## 租户隔离
 
 - HTTP handler 只从服务端会话解析 `owner_id`，不接受客户端声明的 owner。
-- 组件查询同时限定 `owner_user_id` 与 `source_id`。
+- 组件查询始终限定 `owner_user_id`；组件表不保存直播源外键。
+- 直播间、直播源和 CookieCloud 凭据分别以账户 ID 建立唯一约束与 RLS 边界。
 - 数据库使用 owner 复合外键、RLS 和 `FORCE ROW LEVEL SECURITY`。
 - tenant 查询必须在事务中执行 `SET LOCAL app.user_id`，不能使用会泄漏到连接池的 session-level
   `SET`。
 - 实时广播按 `component_id` 建立独立 channel，不提供全局订阅。
-- 路由器在投影发布前再次验证 owner、source 和 component ID。
+- 路由器按事件的可信 `owner_id` 扇出，并在投影发布前再次验证 owner、账户 source 和 component ID。
 
 ## Secret 生命周期