@cardstack/boxel-cli 0.9.0 → 0.10.0-unstable.0

package/bundled-types/host-app/lib/secure-sign-in.ts

@@ -0,0 +1,130 @@
+import window from 'ember-window-mock';
+
+import type { ResetPasswordParams } from '@cardstack/host/components/matrix/forgot-password';
+import ENV from '@cardstack/host/config/environment';
+
+// Signing in to Boxel on the secure origin's own page. With
+// `signInOnSecureOrigin` on, the app never draws a sign-in form: a signed-out
+// app sends the user to the secure origin with the page to come back to, and
+// the secure origin sends them back with a single-use Matrix login token,
+// which the app redeems for its Matrix session (see the secure origin's
+// `security/app-handoff.js`).
+//
+// Anything that names an origin or a URL travels to the secure origin in the
+// fragment, never the query string: a firewall in front of a deployment
+// refuses a query string that names a loopback origin, and a fragment never
+// leaves the browser.
+
+export function signInOnSecureOrigin(): boolean {
+  return Boolean(ENV.signInOnSecureOrigin);
+}
+
+function modeURL(mode: string, params: Record<string, string> = {}) {
+  let url = new URL(ENV.secureOriginURL);
+  url.searchParams.set('mode', mode);
+  for (let [name, value] of Object.entries(params)) {
+    url.searchParams.set(name, value);
+  }
+  return url;
+}
+
+function withFragment(url: URL, fragment: Record<string, string>) {
+  url.hash = new URLSearchParams(fragment).toString();
+  return url.href;
+}
+
+// The app page a sign-in comes back to: this one, path and query included.
+// A login token left over from an earlier hand-off is dropped, as is the
+// fragment.
+export function currentAppPage(): string {
+  let url = new URL(window.location.href);
+  url.searchParams.delete('loginToken');
+  url.hash = '';
+  return url.href;
+}
+
+// Where a signed-out app sends the user to sign in.
+export function secureSignInURL(returnTo = currentAppPage()): string {
+  return withFragment(modeURL('sign-in'), { return: returnTo });
+}
+
+// Where the app sends the user once it has signed out of its own session, so
+// the secure origin ends its session too and comes back here signed out.
+export function secureSignOutURL(returnTo: string): string {
+  return withFragment(modeURL('sign-out'), { return: returnTo });
+}
+
+// Where a `boxel` CLI that sends the browser to the app's `/cli-auth` signs
+// in instead. Neither the port nor the state names an origin.
+export function secureCliAuthURL(port: string, state: string): string {
+  return modeURL('cli-auth', {
+    ...(port ? { port } : {}),
+    ...(state ? { state } : {}),
+  }).href;
+}
+
+// Where a password reset email sent to the app's address lands instead. The
+// client secret, the validation session and the email address go in the
+// fragment, which the secure origin's reset page reads.
+export function secureResetPasswordURL({
+  sid,
+  clientSecret,
+  email,
+}: ResetPasswordParams): string {
+  return withFragment(modeURL('reset-password'), {
+    clientSecret,
+    ...(email ? { email } : {}),
+    sid,
+  });
+}
+
+// The app's own page, at its root, signed out: where signing out comes back
+// to. It carries no card ids, so no private card is named in the address.
+export function appRootURL(): string {
+  return new URL('/', window.location.href).href;
+}
+
+// The guard against sending the user round and round: a signed-out app sends
+// the user to sign in, and only once in a short while from this tab. Coming
+// back signed out again inside that window means the sign-in didn't complete
+// (a blocked hand-off, a token that wouldn't redeem), so the app stops and
+// says so, with its button still there to try again.
+const REDIRECTED_AT_KEY = 'boxel-secure-sign-in-redirected-at';
+export const REDIRECT_GUARD_MS = 2 * 60 * 1000;
+
+function storage(): Storage | undefined {
+  try {
+    return window.sessionStorage;
+  } catch {
+    return undefined;
+  }
+}
+
+export function redirectedRecently(now = Date.now()): boolean {
+  let at = Number(storage()?.getItem(REDIRECTED_AT_KEY) ?? NaN);
+  return Number.isFinite(at) && now - at < REDIRECT_GUARD_MS;
+}
+
+export function noteRedirect(now = Date.now()) {
+  storage()?.setItem(REDIRECTED_AT_KEY, String(now));
+}
+
+// Once signed in, the next signed-out arrival is a new one, which redirects.
+export function clearRedirectGuard() {
+  storage()?.removeItem(REDIRECTED_AT_KEY);
+}
+
+// Whether the app is in a frame, which a redirect must never navigate: a
+// published site or another page frames the app, and sends a user to sign in
+// in a page of their own. Read from the real globals, never the window mock,
+// whose proxy is never its own `top`. Kept on an object so a test can say the
+// app is framed.
+export const framing = {
+  isFramed(): boolean {
+    try {
+      return globalThis.self !== globalThis.top;
+    } catch {
+      return true;
+    }
+  },
+};

package/bundled-types/host-app/services/matrix-service.ts

@@ -108,6 +108,13 @@ import {
 
 import { isSkillCard } from '../lib/file-def-manager';
 import { pickableModelIds, usedLLMsFromEvents } from '../lib/pickable-models';
+import {
+  appRootURL,
+  clearRedirectGuard,
+  framing,
+  secureSignOutURL,
+  signInOnSecureOrigin,
+} from '../lib/secure-sign-in';
 import { getSkillSourceTools, loadSkillSource } from '../lib/skill-tools';
 import { getUniqueValidToolDefinitions } from '../lib/tool-definitions';
 import { skillsIndexId } from '../lib/utils';
@@ -232,6 +239,10 @@ export default class MatrixService extends Service {
   @service declare private localPersistenceService: LocalPersistenceService;
   @tracked private _client: ExtendedClient | undefined;
   @tracked private _isInitializingNewUser = false;
+  // Set while a sign-out the user asked for is on its way to the secure
+  // origin, so the signed-out page says so rather than sending them to sign
+  // in.
+  @tracked isSigningOutToSecureOrigin = false;
   // "Post-login boot completed" now lives on SessionService as the single
   // tracked authority (`session.isAuthenticated`). MatrixService is its only
   // writer (via setPostLoginCompleted); everyone else reads it.
@@ -881,6 +892,27 @@ export default class MatrixService extends Service {
     }
   }
 
+  // The sign-out the user asks for. With sign-in on the secure origin, the app
+  // signs out of its own session first, exactly as `logout()` always does
+  // (the service worker's realm tokens included, so the next user's images
+  // never carry them), and then sends the user to the secure origin to end
+  // its session too. That page comes back to the app's root, signed out, and
+  // the full navigation drops any card code that was running.
+  //
+  // A framed app is never navigated (the secure origin refuses to be framed):
+  // it signs out of its own session only, and its signed-out page offers
+  // sign-in in a tab of its own.
+  async signOut() {
+    if (!signInOnSecureOrigin() || framing.isFramed()) {
+      await this.logout();
+      return;
+    }
+    this.isSigningOutToSecureOrigin = true;
+    clearRedirectGuard();
+    await this.logout();
+    window.location.replace(secureSignOutURL(appRootURL()));
+  }
+
   // A loginToken next to a session stored in this browser means "switch to the
   // token's account" (`boxel browse --profile B` against a browser signed in as
   // A). Ordered so a bad/expired token is non-destructive:
@@ -908,6 +940,20 @@ export default class MatrixService extends Service {
       // non-destructive failure page rather than falling to the login form.
       throw new AccountSwitchError('redeem', e);
     }
+    if (auth.user_id === previousAuth.user_id) {
+      // A token for the account already stored here, as when two tabs signed
+      // out together each come back from signing in on the secure origin,
+      // switches nothing. The new session boots alongside the stored one,
+      // which another tab may be running. Logging the stored one out would
+      // sign that tab out, and would end the secure windows this sign-in
+      // just came from.
+      try {
+        await this.start({ auth, refreshRoutes: true });
+      } catch (e) {
+        throw new AccountSwitchError('boot', e);
+      }
+      return;
+    }
     await this.logout({
       skipIndexTransition: true,
       serverLogoutAuth: previousAuth,

package/bundled-types/host-app/services/monaco-service.ts

@@ -26,7 +26,6 @@ import TSWorkerUrl from 'monaco-editor/esm/vs/language/typescript/ts.worker.js?w
 
 import { logger, type SingleCardDocument } from '@cardstack/runtime-common';
 
-import config from '@cardstack/host/config/environment';
 import type CardService from '@cardstack/host/services/card-service';
 import type SessionService from '@cardstack/host/services/session';
 import {
@@ -42,8 +41,6 @@ import type * as _MonacoSDK from 'monaco-editor';
 export type MonacoSDK = typeof _MonacoSDK;
 export type IStandaloneCodeEditor = _MonacoSDK.editor.IStandaloneCodeEditor;
 
-const { serverEchoDebounceMs } = config;
-
 const log = logger('service:monaco');
 
 // `new Worker(url)` rejects cross-origin URLs, but importScripts inside a
@@ -104,8 +101,6 @@ export default class MonacoService extends Service {
   @tracked hasFocus = false;
   @service declare cardService: CardService;
   @service declare session: SessionService;
-  // this is in the service so that we can manipulate it in our tests
-  serverEchoDebounceMs = serverEchoDebounceMs;
 
   private waiterManager = createMonacoWaiterManager();
   // Disposables for global Monaco listeners (e.g. `onDidCreateEditor`). Monaco

package/bundled-types/host-app/utils/login-token.ts

@@ -1,29 +1,42 @@
 import window from 'ember-window-mock';
 
-// The `loginToken` handed off by `boxel browse` and by Google SSO is
-// deliberately NOT a registered route query param, so it must be read straight
-// from `window.location.search`. It is single-use, so readers strip it from the
-// URL immediately: a refresh must not re-trigger a spent exchange, and any
+// The `loginToken` handed off by `boxel browse` and by Google SSO arrives in
+// the query string; the secure origin's sign-in hands it over in the URL's
+// fragment, which no server or access log sees. It is deliberately NOT a
+// registered route query param, so it must be read straight from
+// `window.location`. It is single-use, so readers strip it from the URL
+// immediately: a refresh must not re-trigger a spent exchange, and any
 // `transitionTo` in the login flow would otherwise drop the unregistered param.
 
+function fragmentParams(): URLSearchParams {
+  return new URLSearchParams(window.location.hash.replace(/^#/, ''));
+}
+
 export function peekLoginToken(): string | null {
-  return new URLSearchParams(window.location.search).get('loginToken');
+  return (
+    new URLSearchParams(window.location.search).get('loginToken') ??
+    fragmentParams().get('loginToken')
+  );
 }
 
 // Reads the single-use loginToken and strips it from the URL via
 // `history.replaceState`, returning the token (or null if none present).
 export function consumeLoginTokenFromUrl(): string | null {
   let params = new URLSearchParams(window.location.search);
-  let token = params.get('loginToken');
+  let fragment = fragmentParams();
+  let token = params.get('loginToken') ?? fragment.get('loginToken');
   if (!token) {
     return null;
   }
   params.delete('loginToken');
   let search = params.toString();
-  let newUrl =
-    window.location.pathname +
-    (search ? `?${search}` : '') +
-    window.location.hash;
+  // A fragment that didn't carry the token is kept exactly as it was.
+  let hash = window.location.hash;
+  if (fragment.has('loginToken')) {
+    fragment.delete('loginToken');
+    hash = fragment.size > 0 ? `#${fragment}` : '';
+  }
+  let newUrl = window.location.pathname + (search ? `?${search}` : '') + hash;
   window.history.replaceState({}, '', newUrl);
   return token;
 }

package/dist/api.js

@@ -2787,7 +2787,7 @@ In order to be iterable, non-array objects must have a [Symbol.iterator]() metho
 ${t.stack}`:n}var gA=null;function xw(){return(gA===null||gA.buffer.detached===!0||gA.buffer.detached===void 0&&gA.buffer!==at.memory.buffer)&&(gA=new DataView(at.memory.buffer)),gA}function ww(t,e){return qMt(t>>>0,e)}var vw=null;function Bw(){return(vw===null||vw.byteLength===0)&&(vw=new Uint8Array(at.memory.buffer)),vw}function Tbe(t,e){try{return t.apply(this,e)}catch(r){let n=jMt(r);at.__wbindgen_exn_store(n)}}function yu(t,e,r){if(r===void 0){let a=pE.encode(t),l=e(a.length,1)>>>0;return Bw().subarray(l,l+a.length).set(a),Da=a.length,l}let n=t.length,s=e(n,1)>>>0,i=Bw(),o=0;for(;o<n;o++){let a=t.charCodeAt(o);if(a>127)break;i[s+o]=a}if(o!==n){o!==0&&(t=t.slice(o)),s=r(s,n,n=o+t.length*3,1)>>>0;let a=Bw().subarray(s+o,s+n),l=pE.encodeInto(t,a);o+=l.written,s=r(s,n,o,1)>>>0}return Da=o,s}function A9(t){let e=at.__wbindgen_externrefs.get(t);return at.__externref_table_dealloc(t),e}var Dbe=new TextDecoder("utf-8",{ignoreBOM:!0,fatal:!0});Dbe.decode();function qMt(t,e){return Dbe.decode(Bw().subarray(t,t+e))}var pE=new TextEncoder;"encodeInto"in pE||(pE.encodeInto=function(t,e){let r=pE.encode(t);return e.set(r),{read:t.length,written:r.length}});var Da=0,HMt=`${__dirname}/content_tag_bg.wasm`,VMt=require("fs").readFileSync(HMt),GMt=new WebAssembly.Module(VMt),YMt=new WebAssembly.Instance(GMt,UMt()),at=YMt.exports;at.__wbindgen_start()});var Nbe=y((nrr,Qbe)=>{var{Preprocessor:WMt}=_be();Qbe.exports.Preprocessor=WMt});var o3t={};Fl(o3t,{BoxelCLIClient:()=>o1,isQuiet:()=>PZ,resetProfileManager:()=>aZ,runRealmQunit:()=>Vbe,runTestsForRealm:()=>qbe,setProfileManager:()=>lZ,setQuiet:()=>NZ});module.exports=Qa(o3t);var fo=Dt(require("fs")),dN=Dt(require("path")),sZ=Dt(require("os")),iZ=Dt(bT());var hBe=process.stdout.isTTY===!0&&!process.env.NO_COLOR,jl=t=>hBe?t:"",Na=jl("\x1B[32m"),io=jl("\x1B[33m"),Pf=jl("\x1B[36m"),sH=jl("\x1B[35m"),Ps=jl("\x1B[31m"),Lr=jl("\x1B[2m"),iH=jl("\x1B[1m"),et=jl("\x1B[0m");var ABe="boxel-local://",D4t=`${ABe}capture/`;var oH="app.boxel.realms";function dt(t){return t.endsWith("/")?t:`${t}/`}var Ho=class extends Error{status;constructor(e,r){super(r),this.name="MatrixAuthError",this.status=e}};async function aH(t,e,r){let n=await fetch(new URL("_matrix/client/v3/login",t).href,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({identifier:{type:"m.id.user",user:e},password:r,type:"m.login.password"})}),s=await n.json();if(!n.ok)throw new Error(`Matrix login failed: ${n.status} ${JSON.stringify(s)}`);return{accessToken:s.access_token,deviceId:s.device_id,userId:s.user_id,matrixUrl:t}}async function mBe(t){let e=await fetch(new URL(`_matrix/client/v3/user/${encodeURIComponent(t.userId)}/openid/request_token`,t.matrixUrl).href,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${t.accessToken}`},body:"{}"});if(!e.ok){let r=await e.text();throw e.status===401||e.status===403?new Ho(e.status,`OpenID token request failed: ${e.status} ${r}`):new Error(`OpenID token request failed: ${e.status} ${r}`)}return await e.json()}async function TA(t,e,r={}){let n=await mBe(t),s=`${e.replace(/\/$/,"")}/_server-session`,i=await fetch(s,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/json"},body:JSON.stringify(r.extendedLifetime?{...n,lifetime:"extended"}:n)});if(!i.ok){let a=await i.text();throw new Error(`Realm server session failed: ${i.status} ${a}`)}let o=i.headers.get("Authorization");if(!o)throw new Error("Realm server session response did not include an Authorization header");return o}async function CT(t,e){let r=`${t.replace(/\/$/,"")}/_realm-auth?include-public=true`,n=await fetch(r,{method:"POST",headers:{Accept:"application/json","Content-Type":"application/json",Authorization:e}});if(!n.ok){let s=await n.text();throw new Error(`Realm auth lookup failed: ${n.status} ${s}`)}return await n.json()}function IT(t){return new URL(`_matrix/client/v3/user/${encodeURIComponent(t.userId)}/account_data/${oH}`,t.matrixUrl).href}async function ST(t){return lH(t,"best-effort")}async function gBe(t){return lH(t,"strict")}async function lH(t,e){let r;try{r=await fetch(IT(t),{headers:{Authorization:`Bearer ${t.accessToken}`}})}catch(n){if(e==="strict")throw new Error(`Could not read the realm list from Matrix account data: ${n instanceof Error?n.message:String(n)}`);return[]}if(r.status===401||r.status===403){let n=await r.text();throw new Ho(r.status,`Matrix account_data fetch failed: ${r.status} ${n}`)}if(r.status===404)return[];if(!r.ok){if(e==="strict"){let n=await r.text();throw new Error(`Could not read the realm list from Matrix account data: ${r.status} ${n}`)}return[]}try{let n=await r.json();return Array.isArray(n.realms)?[...n.realms]:[]}catch{if(e==="strict")throw new Error("Could not read the realm list from Matrix account data: response body was not valid JSON");return[]}}async function cH(t,e){let r=await gBe(t);if(!r.includes(e)){r.push(e);let n=await fetch(IT(t),{method:"PUT",headers:{"Content-Type":"application/json",Authorization:`Bearer ${t.accessToken}`},body:JSON.stringify({realms:r})});if(!n.ok){let s=await n.text();throw n.status===401||n.status===403?new Ho(n.status,`Failed to update Matrix account data: ${n.status} ${s}`):new Error(`Failed to update Matrix account data: ${n.status} ${s}`)}}}async function uH(t,e){let r=dt(e),n=await ST(t),s=n.filter(o=>dt(o)!==r);if(s.length===n.length)return!1;let i=await fetch(IT(t),{method:"PUT",headers:{"Content-Type":"application/json",Authorization:`Bearer ${t.accessToken}`},body:JSON.stringify({realms:s})});if(!i.ok){let o=await i.text();throw i.status===401||i.status===403?new Ho(i.status,`Failed to update Matrix account data: ${i.status} ${o}`):new Error(`Failed to update Matrix account data: ${i.status} ${o}`)}return!0}var pH=Dt(require("readline")),fH=require("stream");function yBe(t,e){let r=Math.min(e,Math.floor(t.length/4));return r>0?t.slice(-r):""}function dH(t,e={}){let r=e.input??process.stdin,n=e.output??process.stdout,s=new fH.Writable({write:(o,a,l)=>l()}),i=pH.createInterface({input:r,output:s,terminal:!0});return new Promise((o,a)=>{let l=r.readableFlowing;r.isTTY&&r.setRawMode(!0);let c=()=>{r.removeListener("data",u),r.isTTY&&r.setRawMode(!1),i.close(),l||r.pause()},u=f=>{try{let d=f.toString().split("\x1B[200~").join("").split("\x1B[201~").join("");for(let A of d)if(A===`
 `||A==="\r"){c(),n.write(`
 `);let h=e.revealLast?yBe(p,e.revealLast):"";h&&n.write(`  (${[...p].length} characters, ending in ${h})
-`),o(p);return}else A===""?(c(),process.exit()):A==="\x7F"||A==="\b"?p.length>0&&(p=[...p].slice(0,-1).join(""),n.write("\b \b")):A>=" "&&(p+=A,n.write("*"))}catch(d){c(),a(d)}},p="";try{n.write(t),r.on("data",u),r.resume()}catch(f){c(),a(f)}})}var rZ=Dt(eZ()),nUe=15*6e4,tZ;function Lm(t,e){tZ??=new rZ.Agent({headersTimeout:nUe});let r={...e,dispatcher:tZ};return fetch(t,r)}var sUe=dN.join(sZ.homedir(),".boxel-cli"),iUe="profiles.json",oUe=300;function aUe(t,e=oUe){let r=t.replace(/^Bearer\s+/i,""),n=iZ.default.decode(r);if(!n?.exp)return!0;let s=Math.floor(Date.now()/1e3);return n.exp-s<e}var qr="No active profile. Run `boxel profile add` to create one.";function lUe(t){return t.match(/^https:\/\/cardstack\.com\/([^/]+)\/$/)?.[1]}function cUe(t){return t.endsWith(":stack.cards")?"staging":t.endsWith(":boxel.ai")?"production":t.endsWith(":localhost")?"local":"unknown"}function fN(t){let e=t.match(/^@([^:]+):/);return e?e[1]:t}function oZ(t){let e=t.match(/:([^:]+)$/);return e?e[1]:"unknown"}function nZ(t){let e=fN(t),r=oZ(t);return`${Lr}[${et}${Pf}${e}${et} ${Lr}\xB7${et} ${sH}${r}${et}${Lr}]${et}`}var HC=class{config;configDir;profilesFile;matrixLoginFn;promptPasswordFn;isTtyFn;loadError=null;constructor(e,r){this.configDir=e||sUe,this.profilesFile=dN.join(this.configDir,iUe),this.config=this.loadConfig(),this.matrixLoginFn=r?.matrixLogin??aH,this.promptPasswordFn=r?.promptPassword??dH,this.isTtyFn=r?.isTty??(()=>!!process.stdin.isTTY)}ensureConfigDir(){fo.existsSync(this.configDir)||fo.mkdirSync(this.configDir,{recursive:!0})}loadConfig(){let e={profiles:{},activeProfile:null};if(!fo.existsSync(this.profilesFile))return e;try{let r=fo.readFileSync(this.profilesFile,"utf-8"),n=JSON.parse(r);if(n&&typeof n=="object"&&!Array.isArray(n)){let s=n,i=s.profiles&&typeof s.profiles=="object"&&!Array.isArray(s.profiles)?s.profiles:null,o=s.activeProfile===null||typeof s.activeProfile=="string"?s.activeProfile:null;if(i)return{profiles:i,activeProfile:o}}this.loadError=`Profiles file at ${this.profilesFile} is not a recognizable profiles store; starting with no profiles.`}catch(r){this.loadError=`Could not read profiles file at ${this.profilesFile}: ${r instanceof Error?r.message:String(r)}`}return e}getLoadError(){return this.loadError}saveConfig(){this.ensureConfigDir(),fo.writeFileSync(this.profilesFile,JSON.stringify(this.config,null,2),{mode:384});try{fo.chmodSync(this.profilesFile,384)}catch{}}listProfiles(){return Object.keys(this.config.profiles)}getProfile(e){return this.config.profiles[e]}getActiveProfileId(){return this.config.activeProfile}getActiveProfile(){let e=this.config.activeProfile;if(!e)return null;let r=this.config.profiles[e];return r?{id:e,profile:r}:null}resolveProfileSlots(e,r,n,s){let i=cUe(e),o=fN(e);if(i==="unknown"&&(!n||!s))throw new Error(`Unknown domain in Matrix ID "${e}". You must provide explicit --matrix-url and --realm-server-url for non-standard domains.`);let a,l;i==="production"?(a="https://matrix.boxel.ai",l="https://app.boxel.ai/"):i==="local"?(a="http://localhost:8008",l="https://localhost:4201/"):(a="https://matrix-staging.stack.cards",l="https://realms-staging.stack.cards/");let c=oZ(e);return{matrixUrl:n||a,realmServerUrl:s||l,displayName:r||`${o} \xB7 ${c}`,username:o}}async addProfileWithAuth(e,r,n,s){let i=this.resolveProfileSlots(e,n,r.matrixUrl,s),o=this.config.profiles[e],a=!!o&&(o.matrixUrl!==i.matrixUrl||o.realmServerUrl!==i.realmServerUrl),l={displayName:i.displayName,matrixUrl:i.matrixUrl,realmServerUrl:i.realmServerUrl,matrixAccessToken:r.accessToken,matrixUserId:r.userId,matrixDeviceId:r.deviceId,realmTokens:a?void 0:o?.realmTokens,realmServerToken:a?void 0:o?.realmServerToken,secureSession:a?void 0:o?.secureSession};this.config.profiles[e]=l,this.config.activeProfile||(this.config.activeProfile=e),this.saveConfig()}async addProfile(e,r,n,s,i){let o=this.config.profiles[e],a=this.resolveProfileSlots(e,n??o?.displayName,s??o?.matrixUrl,i??o?.realmServerUrl),l=await this.matrixLoginFn(a.matrixUrl,a.username,r);if(l.userId!==e)throw new Error(`Matrix returned userId "${l.userId}" but profile was added as "${e}". Check the Matrix ID and try again.`);await this.addProfileWithAuth(e,l,a.displayName,a.realmServerUrl)}async removeProfile(e){if(!this.config.profiles[e])return!1;if(delete this.config.profiles[e],this.config.activeProfile===e){let r=Object.keys(this.config.profiles);this.config.activeProfile=r.length>0?r[0]:null}return this.saveConfig(),!0}switchProfile(e){return this.config.profiles[e]?(this.config.activeProfile=e,this.saveConfig(),!0):!1}updateDisplayName(e,r){return this.config.profiles[e]?(this.config.profiles[e].displayName=r,this.saveConfig(),!0):!1}updateUrls(e,r){let n=this.config.profiles[e];if(!n)return!1;let s=!1;return r.matrixUrl&&r.matrixUrl!==n.matrixUrl&&(n.matrixUrl=r.matrixUrl,s=!0),r.realmServerUrl&&r.realmServerUrl!==n.realmServerUrl&&(n.realmServerUrl=r.realmServerUrl,s=!0),s&&(n.realmTokens=void 0,n.realmServerToken=void 0,n.secureSession=void 0,this.saveConfig()),s}setRealmToken(e,r){let n=this.getActiveProfile();n&&(n.profile.realmTokens||(n.profile.realmTokens={}),n.profile.realmTokens[e]=r,this.saveConfig())}getRealmToken(e){return this.getActiveProfile()?.profile.realmTokens?.[e]}setRealmServerToken(e){let r=this.getActiveProfile();r&&(r.profile.realmServerToken=e,this.saveConfig())}getRealmServerToken(){return this.getActiveProfile()?.profile.realmServerToken}setSecureSession(e){let r=this.getActiveProfile();r&&(r.profile.secureSession=e,this.saveConfig())}getSecureSession(){let e=this.getActiveProfile()?.profile.secureSession;if(!(!e||Date.parse(e.expiresAt)<=Date.now()))return e}clearSecureSession(){let e=this.getActiveProfile();e?.profile.secureSession&&(e.profile.secureSession=void 0,this.saveConfig())}getStoredMatrixAuth(e){let r=e??this.config.activeProfile??void 0,n=r?this.config.profiles[r]:void 0;if(!r||!n)throw new Error(qr);if(!n.matrixAccessToken)throw new Error(`Profile "${r}" has no stored Matrix access token. Run \`boxel profile add\` to re-authenticate.`);return{accessToken:n.matrixAccessToken,userId:n.matrixUserId,deviceId:n.matrixDeviceId,matrixUrl:n.matrixUrl}}async reAuthenticate(e){let r=e??this.config.activeProfile??void 0,n=r?this.config.profiles[r]:void 0;if(!r||!n)throw new Error(qr);if(!this.isTtyFn())throw new Error(`Stored Matrix token for "${r}" is no longer valid. Run \`boxel profile add -u ${r} -p <password>\` to re-authenticate.`);console.log(`
+`),o(p);return}else A===""?(c(),process.exit()):A==="\x7F"||A==="\b"?p.length>0&&(p=[...p].slice(0,-1).join(""),n.write("\b \b")):A>=" "&&(p+=A,n.write("*"))}catch(d){c(),a(d)}},p="";try{n.write(t),r.on("data",u),r.resume()}catch(f){c(),a(f)}})}var rZ=Dt(eZ()),nUe=15*6e4,tZ;function Lm(t,e){tZ??=new rZ.Agent({headersTimeout:nUe});let r={...e,dispatcher:tZ};return fetch(t,r)}var sUe=dN.join(sZ.homedir(),".boxel-cli"),iUe="profiles.json",oUe=300;function aUe(t,e=oUe){let r=t.replace(/^Bearer\s+/i,""),n=iZ.default.decode(r);if(!n?.exp)return!0;let s=Math.floor(Date.now()/1e3);return n.exp-s<e}var qr="No active profile. Run `boxel profile add` to create one.";function lUe(t){return t.match(/^https:\/\/cardstack\.com\/([^/]+)\/$/)?.[1]}function cUe(t){return t.endsWith(":stack.cards")?"staging":t.endsWith(":boxel.ai")?"production":t.endsWith(":localhost")?"local":"unknown"}function fN(t){let e=t.match(/^@([^:]+):/);return e?e[1]:t}function oZ(t){let e=t.match(/:([^:]+)$/);return e?e[1]:"unknown"}function nZ(t){let e=fN(t),r=oZ(t);return`${Lr}[${et}${Pf}${e}${et} ${Lr}\xB7${et} ${sH}${r}${et}${Lr}]${et}`}var HC=class{config;configDir;profilesFile;matrixLoginFn;promptPasswordFn;isTtyFn;loadError=null;constructor(e,r){this.configDir=e||sUe,this.profilesFile=dN.join(this.configDir,iUe),this.config=this.loadConfig(),this.matrixLoginFn=r?.matrixLogin??aH,this.promptPasswordFn=r?.promptPassword??dH,this.isTtyFn=r?.isTty??(()=>!!process.stdin.isTTY)}ensureConfigDir(){fo.existsSync(this.configDir)||fo.mkdirSync(this.configDir,{recursive:!0})}loadConfig(){let e={profiles:{},activeProfile:null};if(!fo.existsSync(this.profilesFile))return e;try{let r=fo.readFileSync(this.profilesFile,"utf-8"),n=JSON.parse(r);if(n&&typeof n=="object"&&!Array.isArray(n)){let s=n,i=s.profiles&&typeof s.profiles=="object"&&!Array.isArray(s.profiles)?s.profiles:null,o=s.activeProfile===null||typeof s.activeProfile=="string"?s.activeProfile:null;if(i)return{profiles:i,activeProfile:o}}this.loadError=`Profiles file at ${this.profilesFile} is not a recognizable profiles store; starting with no profiles.`}catch(r){this.loadError=`Could not read profiles file at ${this.profilesFile}: ${r instanceof Error?r.message:String(r)}`}return e}getLoadError(){return this.loadError}saveConfig(){this.ensureConfigDir(),fo.writeFileSync(this.profilesFile,JSON.stringify(this.config,null,2),{mode:384});try{fo.chmodSync(this.profilesFile,384)}catch{}}listProfiles(){return Object.keys(this.config.profiles)}getProfile(e){return this.config.profiles[e]}getActiveProfileId(){return this.config.activeProfile}getActiveProfile(){let e=this.config.activeProfile;if(!e)return null;let r=this.config.profiles[e];return r?{id:e,profile:r}:null}resolveProfileSlots(e,r,n,s){let i=cUe(e),o=fN(e);if(i==="unknown"&&(!n||!s))throw new Error(`Unknown domain in Matrix ID "${e}". You must provide explicit --matrix-url and --realm-server-url for non-standard domains.`);let a,l;i==="production"?(a="https://matrix.boxel.ai",l="https://app.boxel.ai/"):i==="local"?(a="http://localhost:8008",l="https://localhost:4201/"):(a="https://matrix-staging.stack.cards",l="https://realms-staging.stack.cards/");let c=oZ(e);return{matrixUrl:n||a,realmServerUrl:s||l,displayName:r||`${o} \xB7 ${c}`,username:o}}async addProfileWithAuth(e,r,n,s,i){let o=this.resolveProfileSlots(e,n,r.matrixUrl,s),a=this.config.profiles[e],l=!!a&&(a.matrixUrl!==o.matrixUrl||a.realmServerUrl!==o.realmServerUrl),c={displayName:o.displayName,matrixUrl:o.matrixUrl,realmServerUrl:o.realmServerUrl,matrixAccessToken:r.accessToken,matrixUserId:r.userId,matrixDeviceId:r.deviceId,realmTokens:l?void 0:a?.realmTokens,realmServerToken:l?void 0:a?.realmServerToken,secureSession:i??(l?void 0:a?.secureSession)};this.config.profiles[e]=c,this.config.activeProfile||(this.config.activeProfile=e),this.saveConfig()}async addProfile(e,r,n,s,i){let o=this.config.profiles[e],a=this.resolveProfileSlots(e,n??o?.displayName,s??o?.matrixUrl,i??o?.realmServerUrl),l=await this.matrixLoginFn(a.matrixUrl,a.username,r);if(l.userId!==e)throw new Error(`Matrix returned userId "${l.userId}" but profile was added as "${e}". Check the Matrix ID and try again.`);await this.addProfileWithAuth(e,l,a.displayName,a.realmServerUrl)}async removeProfile(e){if(!this.config.profiles[e])return!1;if(delete this.config.profiles[e],this.config.activeProfile===e){let r=Object.keys(this.config.profiles);this.config.activeProfile=r.length>0?r[0]:null}return this.saveConfig(),!0}switchProfile(e){return this.config.profiles[e]?(this.config.activeProfile=e,this.saveConfig(),!0):!1}updateDisplayName(e,r){return this.config.profiles[e]?(this.config.profiles[e].displayName=r,this.saveConfig(),!0):!1}updateUrls(e,r){let n=this.config.profiles[e];if(!n)return!1;let s=!1;return r.matrixUrl&&r.matrixUrl!==n.matrixUrl&&(n.matrixUrl=r.matrixUrl,s=!0),r.realmServerUrl&&r.realmServerUrl!==n.realmServerUrl&&(n.realmServerUrl=r.realmServerUrl,s=!0),s&&(n.realmTokens=void 0,n.realmServerToken=void 0,n.secureSession=void 0,this.saveConfig()),s}setRealmToken(e,r){let n=this.getActiveProfile();n&&(n.profile.realmTokens||(n.profile.realmTokens={}),n.profile.realmTokens[e]=r,this.saveConfig())}getRealmToken(e){return this.getActiveProfile()?.profile.realmTokens?.[e]}setRealmServerToken(e){let r=this.getActiveProfile();r&&(r.profile.realmServerToken=e,this.saveConfig())}getRealmServerToken(){return this.getActiveProfile()?.profile.realmServerToken}setSecureSession(e){let r=this.getActiveProfile();r&&(r.profile.secureSession=e,this.saveConfig())}getSecureSession(){let e=this.getActiveProfile()?.profile.secureSession;if(!(!e||Date.parse(e.expiresAt)<=Date.now()))return e}clearSecureSession(){let e=this.getActiveProfile();e?.profile.secureSession&&(e.profile.secureSession=void 0,this.saveConfig())}getStoredMatrixAuth(e){let r=e??this.config.activeProfile??void 0,n=r?this.config.profiles[r]:void 0;if(!r||!n)throw new Error(qr);if(!n.matrixAccessToken)throw new Error(`Profile "${r}" has no stored Matrix access token. Run \`boxel profile add\` to re-authenticate.`);return{accessToken:n.matrixAccessToken,userId:n.matrixUserId,deviceId:n.matrixDeviceId,matrixUrl:n.matrixUrl}}async reAuthenticate(e){let r=e??this.config.activeProfile??void 0,n=r?this.config.profiles[r]:void 0;if(!r||!n)throw new Error(qr);if(!this.isTtyFn())throw new Error(`Stored Matrix token for "${r}" is no longer valid. Run \`boxel profile add -u ${r} -p <password>\` to re-authenticate.`);console.log(`
 ${io}Stored Matrix session for ${nZ(r)} has expired.${et}`);let s=await this.promptPasswordFn(`Password for ${r}: `);if(!s)throw new Error("Re-authentication cancelled: password is required.");let i=fN(r),o=await this.matrixLoginFn(n.matrixUrl,i,s);return await this.addProfileWithAuth(r,o,n.displayName,n.realmServerUrl),this.getStoredMatrixAuth(r)}async fetchRealmServerTokenWithReauth(){let e=this.getStoredMatrixAuth(),n=this.getActiveProfile().profile.realmServerUrl.replace(/\/$/,"");try{let s=await TA(e,n);return this.setRealmServerToken(s),s}catch(s){if(!(s instanceof Ho))throw s;let i=await this.reAuthenticate(),o=await TA(i,n);return this.setRealmServerToken(o),o}}async getOrRefreshServerToken(){let e=this.getRealmServerToken();return e&&!aUe(e)?e:this.fetchRealmServerTokenWithReauth()}async refreshServerToken(){return this.fetchRealmServerTokenWithReauth()}async mintExtendedServerToken(){let e=this.getStoredMatrixAuth(),n=this.getActiveProfile().profile.realmServerUrl.replace(/\/$/,"");try{return await TA(e,n,{extendedLifetime:!0})}catch(s){if(!(s instanceof Ho))throw s;let i=await this.reAuthenticate();return TA(i,n,{extendedLifetime:!0})}}findRealmTokenForUrl(e){let r=this.getActiveProfile();if(!r?.profile.realmTokens)return;let n=r.profile.realmServerUrl.replace(/\/+$/,"")+"/";for(let[s,i]of Object.entries(r.profile.realmTokens)){if(!i)continue;if(e.startsWith(s))return i;let o=lUe(s);if(o&&e.startsWith(`${n}${o}/`))return i}}async fetchAndStoreAllRealmTokens(){let e=await this.getOrRefreshServerToken(),n=this.getActiveProfile().profile.realmServerUrl.replace(/\/$/,""),s=await CT(n,e);for(let[i,o]of Object.entries(s))this.setRealmToken(i,o)}async getRealmTokenForUrl(e){let r=this.findRealmTokenForUrl(e);if(r)return r;try{await this.fetchAndStoreAllRealmTokens()}catch{return}return this.findRealmTokenForUrl(e)}buildHeaders(e,r,n){let s=e instanceof Request?new Headers(e.headers):new Headers,i=new Headers(r?.headers);for(let[o,a]of i)s.set(o,a);return s.has("Authorization")||s.set("Authorization",n),s}async authedRealmFetch(e,r){let n=e instanceof Request?e.url:e instanceof URL?e.href:e,s=await this.getRealmTokenForUrl(n);if(s){let l=this.buildHeaders(e,r,s),c=await Lm(e,{...r,headers:l});if(c.status!==401)return c}let i=this.getActiveProfile();if(i&&(i.profile.realmTokens={},i.profile.realmServerToken=void 0,this.saveConfig()),await this.fetchAndStoreAllRealmTokens(),s=this.findRealmTokenForUrl(n),!s)throw new Error(`No realm token available for ${n}. The realm may not be accessible.`);let o=this.buildHeaders(e,r,s);return await Lm(e,{...r,headers:o})}async authedRealmServerFetch(e,r){let n=await this.getOrRefreshServerToken(),s=this.buildHeaders(e,r,n),i=await fetch(e,{...r,headers:s});return i.status===401&&(n=await this.refreshServerToken(),s=this.buildHeaders(e,r,n),i=await fetch(e,{...r,headers:s})),i}async fetchAndStoreRealmToken(e,r){let s=this.getActiveProfile().profile.realmServerUrl.replace(/\/$/,""),o=(await CT(s,r))[e];return o&&this.setRealmToken(e,o),o}async withMatrixAuthRecovery(e){try{return await e(this.getStoredMatrixAuth())}catch(r){if(!(r instanceof Ho))throw r;let n=await this.reAuthenticate();return e(n)}}async addToUserRealms(e){await this.withMatrixAuthRecovery(r=>cH(r,e))}async removeFromUserRealms(e){return this.withMatrixAuthRecovery(r=>uH(r,e))}async getUserRealms(){return this.withMatrixAuthRecovery(e=>ST(e))}async migrateFromEnv(){let e=process.env.MATRIX_URL,r=process.env.MATRIX_USERNAME,n=process.env.MATRIX_PASSWORD,s=process.env.REALM_SERVER_URL;if(!e||!r||!n||!s)return null;let o=e.includes("boxel.ai")?"boxel.ai":"stack.cards",a=`@${r}:${o}`,l=!this.config.profiles[a];return await this.addProfile(a,n,void 0,e,s),{profileId:a,created:l}}printStatus(){let e=this.getActiveProfile();e?(console.log(`
 ${iH}Active Profile:${et} ${nZ(e.id)}`),console.log(`  ${Lr}Display Name:${et} ${e.profile.displayName}`),console.log(`  ${Lr}Matrix URL:${et} ${e.profile.matrixUrl}`),console.log(`  ${Lr}Realm Server:${et} ${e.profile.realmServerUrl}`)):(console.log(`
 ${io}No active profile and no environment variables set.${et}`),console.log(`Run ${Pf}boxel profile add${et} to create a profile.`))}},Mm=null;function $t(){return Mm||(Mm=new HC),Mm}function aZ(){Mm=null}function lZ(t){Mm=new HC(t)}var cn=Dt(require("fs/promises")),xn=Dt(require("path")),SN=Dt(gZ());var bN=class{value;next;constructor(e){this.value=e}},Um=class{#e;#t;#r;constructor(){this.clear()}enqueue(e){let r=new bN(e);this.#e?(this.#t.next=r,this.#t=r):(this.#e=r,this.#t=r),this.#r++}dequeue(){let e=this.#e;if(e)return this.#e=this.#e.next,this.#r--,this.#e||(this.#t=void 0),e.value}peek(){if(this.#e)return this.#e.value}clear(){this.#e=void 0,this.#t=void 0,this.#r=0}get size(){return this.#r}*[Symbol.iterator](){let e=this.#e;for(;e;)yield e.value,e=e.next}*drain(){for(;this.#e;)yield this.dequeue()}};function CN(t){let e=!1;if(typeof t=="object"&&({concurrency:t,rejectOnClear:e=!1}=t),yZ(t),typeof e!="boolean")throw new TypeError("Expected `rejectOnClear` to be a boolean");let r=new Um,n=0,s=()=>{n<t&&r.size>0&&(n++,r.dequeue().run())},i=()=>{n--,s()},o=async(c,u,p)=>{let f=(async()=>c(...p))();u(f);try{await f}catch{}i()},a=(c,u,p,f)=>{let d={reject:p};new Promise(A=>{d.run=A,r.enqueue(d)}).then(o.bind(void 0,c,u,f)),n<t&&s()},l=(c,...u)=>new Promise((p,f)=>{a(c,p,f,u)});return Object.defineProperties(l,{activeCount:{get:()=>n},pendingCount:{get:()=>r.size},clearQueue:{value(){if(!e){r.clear();return}let c=AbortSignal.abort().reason;for(;r.size>0;)r.dequeue().reject(c)}},concurrency:{get:()=>t,set(c){yZ(c),t=c,queueMicrotask(()=>{for(;n<t&&r.size>0;)s()})}},map:{async value(c,u){let p=Array.from(c,(f,d)=>this(u,f,d));return Promise.all(p)}}}),l}function yZ(t){if(!((Number.isInteger(t)||t===Number.POSITIVE_INFINITY)&&t>0))throw new TypeError("Expected `concurrency` to be a number from 1 and up")}var BZ=Dt(xZ(),1),vZ="application/octet-stream",kUe={".gts":"text/typescript+glimmer",".gjs":"text/javascript+glimmer",".ts":"text/typescript",".jsonl":"application/jsonl"};function RUe(t){let e=t.lastIndexOf(".");if(e===-1)return vZ;let r=t.slice(e).toLowerCase(),n=kUe[r];if(n)return n;let s=(0,BZ.lookup)(t);return s||vZ}var OUe=new Set(["application/json","application/jsonl","application/javascript","application/ecmascript","application/node","application/xml","application/x-sh","application/sql","application/x-sql","application/yaml","application/x-yaml","application/toml"]),FUe=["+json","+xml","+html","+source"];function jm(t){let e=LUe(t);return e.startsWith("text/")||FUe.some(r=>e.endsWith(r))?!1:!OUe.has(e)}function LUe(t){return t.split(";")[0].trim().toLowerCase()}function pc(t){return jm(RUe(t))}var MUe=SN.default.default||SN.default,UUe=new Set([]),IN=1e4,jUe=3e3;function qs(t){let e=t.replace(/\\/g,"/").replace(/^\/+/,"");return UUe.has(e)}async function wZ(t){try{return await cn.access(t),!0}catch{return!1}}function TZ(t){try{return decodeURIComponent(t)}catch{return t}}async function DZ(t,e){let r=await t.text().catch(()=>""),n=`Failed to upload ${e}: ${t.status} ${t.statusText}${r?` \u2014 ${r.slice(0,200)}`:""}`,s=new Error(n);throw s.status=t.status,s.body=r,s}var Sd={CardSource:"application/vnd.card+source",DirectoryListing:"application/vnd.api+json",Mtimes:"application/vnd.api+json",OctetStream:"application/octet-stream"},qUe=10,HUe=500,_Z=/\.(gts|ts|gjs|js)$/,QZ=new Set(["node_modules"]),xd=class{options;authenticator;normalizedRealmUrl;ignoreCache=new Map;remoteLimit=CN(qUe);constructor(e,r){this.options=e,this.authenticator=r,this.normalizedRealmUrl=this.normalizeRealmUrl(e.realmUrl)}normalizeRealmUrl(e){try{let r=new URL(e),n=r.pathname;return(n.split("/").filter(Boolean).pop()||"").includes(".")?console.warn(`Warning: "${e}" looks like a file URL, not a realm URL.