@cardstack/boxel-cli 0.9.0 → 0.10.0-unstable.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardstack/boxel-cli",
-  "version": "0.9.0",
+  "version": "0.10.0-unstable.0",
   "license": "MIT",
   "description": "CLI tools for Boxel workspace management",
   "main": "./dist/index.js",

package/src/build-program.ts

@@ -64,7 +64,7 @@ export function buildBoxelProgram(version: string): Command {
     )
     .option(
       '--host-url <url>',
-      'Origin serving the browser sign-in page, when it is not the realm server (for add command)',
+      "Sign in on this origin's /cli-auth page instead of the realm server's secure origin (for add command)",
     )
     .option('--production', 'Target production — the default (for add command)')
     .option(
@@ -84,7 +84,11 @@ export function buildBoxelProgram(version: string): Command {
       `
 Sign-in (for 'add'):
   Interactive 'boxel profile add' opens your browser to the Boxel sign-in
-  page, which offers both a username/password form and Google. Use
+  page, which offers a username/password form, Google, and creating an
+  account. It is on the realm server's secure origin, and that one sign-in
+  also signs the profile in for 'boxel keys'. A realm server without a
+  secure origin that can do this gets the host app's own sign-in page, as
+  does --host-url, which names the origin whose page to open. Use
   --no-browser to sign in with a username and password in the terminal
   instead. Supplying -u with a password (or BOXEL_PASSWORD) stays fully
   non-interactive and never opens a browser, which is the path to use in CI.

package/src/commands/profile.ts

@@ -9,6 +9,10 @@ import {
 import { ensurePersonalRealm } from '../lib/personal-realm.ts';
 import { prompt, promptPassword } from '../lib/prompt.ts';
 import { SsoTimeoutError, browserLogin } from '../lib/sso-login.ts';
+import {
+  secureOriginForProfiles,
+  secureSignOut,
+} from '../lib/secure-session.ts';
 import {
   FG_GREEN,
   FG_YELLOW,
@@ -50,6 +54,9 @@ interface EnvironmentDefaults {
   // origin-scoped storage, so a page loaded from the realm server's port
   // wouldn't see the session established on the app's.
   appUrl?: string;
+  // Set by `--host-url`, which names the sign-in page to open: the host app's
+  // own, even where the realm server's secure origin could sign in instead.
+  signInOnHostApp?: boolean;
 }
 
 type PresetName = 'staging' | 'production' | 'local';
@@ -243,6 +250,7 @@ export function resolveEnvironment(
       matrixUrl: matrixUrl ?? base.matrixUrl,
       realmServerUrl: realmServerUrl ?? base.realmServerUrl,
       appUrl: appUrl ?? base.appUrl,
+      ...(appUrl ? { signInOnHostApp: true } : {}),
     },
   };
 }
@@ -426,6 +434,8 @@ export async function listProfiles(
 // browser and for the person at the terminal through it.
 export interface AddProfileDeps {
   browserLogin?: typeof browserLogin;
+  secureOriginForProfiles?: typeof secureOriginForProfiles;
+  secureSignOut?: typeof secureSignOut;
   ensurePersonalRealm?: typeof ensurePersonalRealm;
   prompt?: (question: string) => Promise<string>;
   // Whether a person is at the terminal to answer questions. A coding agent or
@@ -436,6 +446,8 @@ export interface AddProfileDeps {
 
 interface AddProfileContext {
   browserLogin: typeof browserLogin;
+  secureOriginForProfiles: typeof secureOriginForProfiles;
+  secureSignOut: typeof secureSignOut;
   ensurePersonalRealm: typeof ensurePersonalRealm;
   prompt: (question: string) => Promise<string>;
   interactive: boolean;
@@ -490,16 +502,30 @@ type AddProfileOutcome =
 // account is replaced, since the browser has just proven it is that account.
 // It keeps its display name. `addProfile` leaves a different active profile
 // active.
+//
+// The sign-in page is the realm server's secure origin when it can sign a
+// profile in, and the host app's own page otherwise, or when `--host-url`
+// names one. The secure origin also hands over a secure session, kept with
+// the profile, so `boxel keys` works without a separate `boxel keys sign-in`.
 async function addProfileViaBrowser(
   manager: ProfileManager,
   matrixUrl: string,
   hostUrl: string,
   realmServerUrl: string,
+  signInOnHostApp: boolean,
   ctx: AddProfileContext,
 ): Promise<AddProfileOutcome> {
   let auth;
   try {
-    auth = await ctx.browserLogin({ matrixUrl, hostUrl });
+    let secureOriginUrl = signInOnHostApp
+      ? undefined
+      : await ctx.secureOriginForProfiles(realmServerUrl);
+    auth = await ctx.browserLogin({
+      matrixUrl,
+      hostUrl,
+      secureOriginUrl,
+      discardSecureSession: (s) => ctx.secureSignOut(realmServerUrl, s.token),
+    });
   } catch (err) {
     if (err instanceof SsoTimeoutError) {
       console.log(`\n${FG_YELLOW}${err.message}${RESET}`);
@@ -508,6 +534,24 @@ async function addProfileViaBrowser(
     throw err;
   }
 
+  // A secure session is for the account the Matrix device is. The secure
+  // origin signs both in from one sign-in, so they always agree; one that
+  // doesn't is ended rather than kept.
+  let { secureSession, ...matrixAuth } = auth;
+  if (secureSession && secureSession.userId !== auth.userId) {
+    await ctx
+      .secureSignOut(realmServerUrl, secureSession.token)
+      .catch(() => {});
+    secureSession = undefined;
+  }
+  const endUnused = async () => {
+    if (secureSession) {
+      await ctx
+        .secureSignOut(realmServerUrl, secureSession.token)
+        .catch(() => {});
+    }
+  };
+
   // The page can sign in as an account other than the one the user expected —
   // a Google identity whose verified email matches no existing account gets a
   // brand-new one. Naming it before anything is written makes that visible
@@ -519,11 +563,13 @@ async function addProfileViaBrowser(
   if (ctx.interactive) {
     const proceed = await ctx.prompt('Save this profile? [Y/n]: ');
     if (proceed.toLowerCase() === 'n') {
+      await endUnused();
       console.log('Cancelled.');
       return { status: 'cancelled' };
     }
 
     if (!(await confirmOverwrite(manager, auth.userId, ctx))) {
+      await endUnused();
       return { status: 'cancelled' };
     }
 
@@ -532,12 +578,31 @@ async function addProfileViaBrowser(
     // Undefined for a new profile, which addProfileWithAuth names by default.
     displayName = manager.getProfile(auth.userId)?.displayName;
   }
+  // A secure session the profile had is ended, on the realm server that
+  // issued it, when saving the profile replaces it or drops it (as moving the
+  // profile to another realm server does), rather than left to run out its
+  // week.
+  let previous = manager.getProfile(auth.userId);
   await manager.addProfileWithAuth(
     auth.userId,
-    auth,
+    matrixAuth,
     displayName,
     realmServerUrl,
+    secureSession,
   );
+  let kept = manager.getProfile(auth.userId)?.secureSession;
+  if (previous?.secureSession && kept?.token !== previous.secureSession.token) {
+    await ctx
+      .secureSignOut(previous.realmServerUrl, previous.secureSession.token)
+      .catch(() => {});
+  }
+  if (secureSession) {
+    console.log(
+      `${FG_GREEN}✓${RESET} Signed in to manage keys until ${new Date(
+        secureSession.expiresAt,
+      ).toLocaleString()}`,
+    );
+  }
 
   // The browser can hand back a brand-new account: a Google sign-in whose
   // verified email matches nothing gets one minted by Synapse itself, with no
@@ -547,7 +612,7 @@ async function addProfileViaBrowser(
   // and a failure only warns: the profile works without it, and signing in to
   // the web app offers workspace creation.
   try {
-    const result = await ctx.ensurePersonalRealm(auth, realmServerUrl);
+    const result = await ctx.ensurePersonalRealm(matrixAuth, realmServerUrl);
     if (result.outcome === 'created') {
       console.log(
         `${FG_GREEN}✓${RESET} Created your personal workspace: ${FG_CYAN}${result.realmUrl}${RESET}`,
@@ -620,6 +685,9 @@ export async function addProfile(
 ): Promise<void> {
   const ctx: AddProfileContext = {
     browserLogin: deps.browserLogin ?? browserLogin,
+    secureOriginForProfiles:
+      deps.secureOriginForProfiles ?? secureOriginForProfiles,
+    secureSignOut: deps.secureSignOut ?? secureSignOut,
     ensurePersonalRealm: deps.ensurePersonalRealm ?? ensurePersonalRealm,
     prompt: deps.prompt ?? prompt,
     interactive: (deps.isTty ?? (() => Boolean(process.stdin.isTTY)))(),
@@ -642,6 +710,7 @@ export async function addProfile(
         environment.matrixUrl,
         environment.appUrl ?? environment.realmServerUrl,
         environment.realmServerUrl,
+        Boolean(environment.signInOnHostApp),
         ctx,
       )
     : { status: 'usePassword' };

package/src/lib/profile-manager.ts

@@ -323,6 +323,9 @@ export class ProfileManager implements RealmAuthenticator {
     auth: MatrixAuth,
     displayName?: string,
     realmServerUrl?: string,
+    // A secure session the same sign-in gave this profile, which replaces any
+    // it had.
+    secureSession?: SecureSessionRecord,
   ): Promise<void> {
     const slots = this.resolveProfileSlots(
       matrixId,
@@ -347,7 +350,8 @@ export class ProfileManager implements RealmAuthenticator {
       realmServerToken: urlsChanged ? undefined : existing?.realmServerToken,
       // The key-management sign-in is for this profile's realm server, so it
       // carries over a re-authentication against the same one.
-      secureSession: urlsChanged ? undefined : existing?.secureSession,
+      secureSession:
+        secureSession ?? (urlsChanged ? undefined : existing?.secureSession),
     };
 
     this.config.profiles[matrixId] = profile;

package/src/lib/secure-session.ts

@@ -37,11 +37,13 @@ async function realmServerRequest(
     token,
     body,
     fetchFn = fetch,
+    signal,
   }: {
     method?: string;
     token?: string;
     body?: unknown;
     fetchFn?: typeof fetch;
+    signal?: AbortSignal;
   } = {},
 ): Promise<any> {
   let url = new URL(path, ensureTrailingSlash(realmServerUrl));
@@ -56,6 +58,7 @@ async function realmServerRequest(
     method,
     headers,
     ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+    ...(signal ? { signal } : {}),
   });
   if (!response.ok) {
     let text = await response.text().catch(() => '');
@@ -98,6 +101,32 @@ export async function fetchSecureOriginUrl(
   return url;
 }
 
+// How long `boxel profile add` waits to learn where to sign in before it
+// opens the host app's page instead.
+const SECURE_ORIGIN_CHECK_TIMEOUT_MS = 10 * 1000;
+
+// The secure origin to sign a new profile in on (`boxel profile add`), when
+// the realm server has one whose pages can: it says so with `cliAuth` in
+// `_secure-origin`. Undefined otherwise, including when the realm server has
+// no secure origin, predates it, or doesn't answer in time, and the CLI then
+// signs in on the host app's own page instead.
+export async function secureOriginForProfiles(
+  realmServerUrl: string,
+  fetchFn: typeof fetch = fetch,
+  timeoutMs = SECURE_ORIGIN_CHECK_TIMEOUT_MS,
+): Promise<string | undefined> {
+  try {
+    let json = await realmServerRequest(realmServerUrl, '_secure-origin', {
+      fetchFn,
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    let { url, cliAuth } = json?.data?.attributes ?? {};
+    return cliAuth === true && typeof url === 'string' ? url : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 // The secure window's CLI sign-in. The listener is named by port, and the
 // window only ever posts to this machine's loopback address.
 export function buildSecureSignInUrl(

package/src/lib/sso-login.ts

@@ -136,12 +136,22 @@ export interface PostedSecureSession {
   expiresAt: string;
 }
 
-// The ways a browser can finish the flow: Synapse redirecting back with a
-// single-use token (the SSO branch), the authorizing page POSTing a session it
-// already obtained (the password branch), or the secure window POSTing a
-// secure session.
+// The ways a browser can finish the flow:
+//
+// - a single-use Matrix login token, for this process to redeem for a device
+//   of its own. The secure origin's `cli-auth` page sends it, and Synapse's
+//   single sign-on returns one to the app's `/cli-auth` page. A `?loginToken=`
+//   navigation is the form every version of the CLI accepts; the secure
+//   origin POSTs it instead when it also hands over a secure session.
+// - the app's `/cli-auth` page POSTing a Matrix session it already signed in
+//   (its password branch).
+// - the secure origin POSTing a secure session alone (`boxel keys sign-in`).
 export type LoopbackResult =
-  | { kind: 'loginToken'; loginToken: string }
+  | {
+      kind: 'loginToken';
+      loginToken: string;
+      secureSession?: PostedSecureSession;
+    }
   | { kind: 'session'; session: PostedSession }
   | { kind: 'secureSession'; session: PostedSecureSession };
 
@@ -246,6 +256,7 @@ export async function startLoopbackCallback(opts?: {
         return;
       }
 
+      let secureSession: PostedSecureSession | undefined;
       if (posted?.has('secure_session')) {
         const token = posted.get('secure_session');
         const userId = posted.get('user_id');
@@ -258,13 +269,32 @@ export async function startLoopbackCallback(opts?: {
           );
           return;
         }
+        secureSession = { token, userId, expiresAt };
+      }
+
+      if (posted?.has('login_token')) {
+        const loginToken = posted.get('login_token');
+        if (!loginToken) {
+          fail(
+            res,
+            'That sign-in did not include a complete session.',
+            'callback POST had an empty login_token',
+          );
+          return;
+        }
         succeed(res, {
-          kind: 'secureSession',
-          session: { token, userId, expiresAt },
+          kind: 'loginToken',
+          loginToken,
+          ...(secureSession ? { secureSession } : {}),
         });
         return;
       }
 
+      if (secureSession) {
+        succeed(res, { kind: 'secureSession', session: secureSession });
+        return;
+      }
+
       if (posted) {
         const accessToken = posted.get('access_token');
         const deviceId = posted.get('device_id');
@@ -521,7 +551,9 @@ export function watchForCopyKey(
 export const CLI_AUTH_PATH = 'cli-auth';
 
 // The host app's authorization page, which offers the same sign-in choices as
-// the web login: a password form and a Google button.
+// the web login: a password form and a Google button. The CLI opens it when
+// the realm server's secure origin can't sign a profile in (see
+// `buildSecureCliAuthUrl`), or when `--host-url` names it.
 //
 // The listener is identified by port rather than by handing over its URL. A URL
 // in a query argument reads as an SSRF attempt to the WAF in front of deployed
@@ -538,6 +570,23 @@ export function buildCliAuthUrl(
   return url.href;
 }
 
+// The secure origin's sign-in for a new profile (its `cli-auth` mode). It
+// hands the listener a Matrix login token to redeem, and, because this CLI
+// asks for one with `session=secure`, the secure session `boxel keys` uses,
+// so one sign-in sets up both. As with the app's page, the listener is named
+// by port alone.
+export function buildSecureCliAuthUrl(
+  secureOriginUrl: string,
+  callback: { port: number; state: string },
+): string {
+  const url = new URL(secureOriginUrl);
+  url.searchParams.set('mode', 'cli-auth');
+  url.searchParams.set('port', String(callback.port));
+  url.searchParams.set('state', callback.state);
+  url.searchParams.set('session', 'secure');
+  return url.href;
+}
+
 // The page is paired with one homeserver, so a session it returns should be
 // valid on the homeserver this profile is being created against. Checking it
 // here turns a host/homeserver mismatch into a clear message instead of a
@@ -569,8 +618,15 @@ async function verifySession(
 
 export interface BrowserLoginOptions {
   matrixUrl: string;
-  // Origin of the host app serving the authorization page.
+  // Origin of the host app serving the authorization page, opened when
+  // `secureOriginUrl` is not given.
   hostUrl: string;
+  // The realm server's secure origin, when it signs profiles in. Its
+  // `cli-auth` page is opened instead of the host app's.
+  secureOriginUrl?: string;
+  // Ends a secure session that came with a login token that couldn't be
+  // redeemed, so nothing leaves it live with no profile holding it.
+  discardSecureSession?: (session: PostedSecureSession) => Promise<void>;
   timeoutMs?: number;
   fetchFn?: typeof fetch;
   openBrowserFn?: (url: string) => Promise<boolean>;
@@ -579,16 +635,26 @@ export interface BrowserLoginOptions {
   copyToClipboardFn?: (text: string) => Promise<boolean>;
 }
 
+// What a browser sign-in gives the new profile: a Matrix device of its own,
+// and, from the secure origin, a secure session for `boxel keys`.
+export type BrowserLoginResult = MatrixAuth & {
+  secureSession?: PostedSecureSession;
+};
+
 // Sign in through the browser. The authorization page decides how the user
-// authenticates, so this ends one of two ways: Google sends the browser back
-// through Synapse with a single-use token to redeem, or the page signs in with
-// a password and hands over the resulting session directly.
+// authenticates. The secure origin always ends with a single-use login token
+// to redeem, with a secure session beside it. The app's page ends one of two
+// ways: Google sends the browser back through Synapse with a single-use token
+// to redeem, or the page signs in with a password and hands over the
+// resulting session directly.
 export async function browserLogin(
   options: BrowserLoginOptions,
-): Promise<MatrixAuth> {
+): Promise<BrowserLoginResult> {
   const {
     matrixUrl,
     hostUrl,
+    secureOriginUrl,
+    discardSecureSession,
     timeoutMs,
     fetchFn = fetch,
     openBrowserFn = openBrowser,
@@ -599,7 +665,9 @@ export async function browserLogin(
   const callback = await startLoopbackCallback({ timeoutMs });
   let stopCopyKey: (() => void) | undefined;
   try {
-    const authUrl = buildCliAuthUrl(hostUrl, callback);
+    const authUrl = secureOriginUrl
+      ? buildSecureCliAuthUrl(secureOriginUrl, callback)
+      : buildCliAuthUrl(hostUrl, callback);
     const opened = await openBrowserFn(authUrl);
     if (opened) {
       log('Opening your browser to sign in or create an account...');
@@ -620,7 +688,18 @@ export async function browserLogin(
 
     const result = await callback.waitForResult();
     if (result.kind === 'loginToken') {
-      return await redeemLoginToken(matrixUrl, result.loginToken, fetchFn);
+      let auth;
+      try {
+        auth = await redeemLoginToken(matrixUrl, result.loginToken, fetchFn);
+      } catch (e) {
+        if (result.secureSession) {
+          await discardSecureSession?.(result.secureSession).catch(() => {});
+        }
+        throw e;
+      }
+      return result.secureSession
+        ? { ...auth, secureSession: result.secureSession }
+        : auth;
     }
     if (result.kind !== 'session') {
       throw new Error('The browser returned a different kind of sign-in.');

package/bundled-test-harness/assets/account-switch-failed-B3pr_iC3.js

@@ -1,32 +0,0 @@
-import "./chunk-Rp0pCe6z.js";
-import { wt as setComponentTemplate } from "./cache-DtDz7X5V-Wn8jRDfL.js";
-import { H as templateFactory, S as on } from "./index-DaCZcoCY-CgzbilMy.js";
-import "./modifier-D0EP-FQ7.js";
-import "./component-BJO47HTh.js";
-import "./template-factory-ds9s0u8l.js";
-import { t as templateOnly } from "./template-only-6nVzLWF-.js";
-import { mt as ButtonComponent } from "./components-CbCTWAON.js";
-import { ot as IconComponent } from "./icons-DBXBZgLe.js";
-//#region app/components/matrix/auth-container.gts
-var AuthContainer = setComponentTemplate(templateFactory({
-	"id": "htH45WsD",
-	"block": "[[[10,0],[14,0,\"auth\"],[14,\"data-theme\",\"dark\"],[14,\"data-scopedcss-677709524c-5b977cb1ba\",\"\"],[12],[1,\"\\n  \"],[10,0],[14,0,\"logo\"],[14,\"aria-hidden\",\"true\"],[14,\"data-scopedcss-677709524c-5b977cb1ba\",\"\"],[12],[1,\"\\n    \"],[8,[32,0],[[24,\"data-scopedcss-677709524c-5b977cb1ba\",\"\"]],null,null],[1,\"\\n  \"],[13],[1,\"\\n  \"],[10,0],[14,0,\"container\"],[14,\"data-scopedcss-677709524c-5b977cb1ba\",\"\"],[12],[1,\"\\n    \"],[10,0],[14,0,\"content\"],[14,\"data-scopedcss-677709524c-5b977cb1ba\",\"\"],[12],[1,\"\\n      \"],[18,1,null],[1,\"\\n    \"],[13],[1,\"\\n  \"],[13],[1,\"\\n\"],[13],[1,\"\\n\\n\"]],[\"&default\"],[\"yield\"]]",
-	"moduleName": "/home/runner/work/boxel/boxel/packages/host/app/components/matrix/auth-container.gts",
-	"scope": () => [IconComponent],
-	"isStrictMode": true
-}), templateOnly());
-//#endregion
-//#region app/components/matrix/account-switch-failed.gts
-var AccountSwitchFailed = setComponentTemplate(templateFactory({
-	"id": "qyRxvnlb",
-	"block": "[[[8,[32,0],[[24,\"data-scopedcss-30e1a72aed-bdba3a3d06\",\"\"]],null,[[\"default\"],[[[[1,\"\\n  \"],[10,0],[14,0,\"centered\"],[14,\"data-test-account-switch-failed\",\"\"],[14,\"data-scopedcss-30e1a72aed-bdba3a3d06\",\"\"],[12],[1,\"\\n    \"],[10,1],[14,0,\"title\"],[14,\"data-scopedcss-30e1a72aed-bdba3a3d06\",\"\"],[12],[1,\"Couldn't switch accounts\"],[13],[1,\"\\n    \"],[10,2],[14,0,\"message\"],[14,\"data-scopedcss-30e1a72aed-bdba3a3d06\",\"\"],[12],[1,\"The sign-in link has expired or was already used. You\\n      haven't been signed out — return home to keep using your current\\n      account.\"],[13],[1,\"\\n    \"],[8,[32,1],[[24,\"data-test-account-switch-back-home\",\"\"],[24,\"data-scopedcss-30e1a72aed-bdba3a3d06\",\"\"],[4,[32,2],[\"click\",[30,1]],null]],[[\"@kind\",\"@size\"],[\"link-primary\",\"extra-small\"]],[[\"default\"],[[[[1,\"Back to home\"]],[]]]]],[1,\"\\n  \"],[13],[1,\"\\n\"]],[]]]]],[1,\"\\n\\n\"]],[\"@onBackToHome\"],[]]",
-	"moduleName": "/home/runner/work/boxel/boxel/packages/host/app/components/matrix/account-switch-failed.gts",
-	"scope": () => [
-		AuthContainer,
-		ButtonComponent,
-		on
-	],
-	"isStrictMode": true
-}), templateOnly());
-//#endregion
-export { AuthContainer as n, AccountSwitchFailed as t };

package/bundled-test-harness/assets/account-switch-failed-DTGZZo-G.css

@@ -1,61 +0,0 @@
-
-  .auth[data-scopedcss-677709524c-5b977cb1ba] {
-    /* theme color variable updates */
-    --background: #272432;
-    --foreground: var(--boxel-light);
-    --muted-foreground: #7f7c8c;
-    /* local color vars */
-    --auth-background: #191624;
-    --auth-foreground: var(--boxel-light);
-
-    position: relative;
-    min-height: 100dvh;
-    background-color: var(--auth-background);
-    color: var(--auth-foreground);
-    overflow: auto;
-  }
-  .logo[data-scopedcss-677709524c-5b977cb1ba] {
-    position: absolute;
-    top: var(--boxel-sp-lg);
-    left: var(--boxel-sp-lg);
-    --icon-color: var(--boxel-highlight);
-    width: 2rem;
-    height: 2rem;
-  }
-  .logo[data-scopedcss-677709524c-5b977cb1ba] svg {
-    width: 100%;
-    height: 100%;
-  }
-  .container[data-scopedcss-677709524c-5b977cb1ba] {
-    display: flex;
-    flex-direction: column;
-    justify-content: center;
-    align-items: center;
-    min-height: 100dvh;
-    padding: var(--boxel-sp-lg);
-  }
-  .content[data-scopedcss-677709524c-5b977cb1ba] {
-    display: flex;
-    flex-direction: column;
-    width: 100%;
-    max-width: 25rem;
-    padding: var(--boxel-sp) 0 calc(var(--boxel-sp) * 2) 0;
-  }
-
-  .centered[data-scopedcss-30e1a72aed-bdba3a3d06] {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    gap: var(--boxel-sp-sm);
-    text-align: center;
-  }
-  .title[data-scopedcss-30e1a72aed-bdba3a3d06] {
-    font: 600 var(--boxel-font-md);
-    color: var(--foreground);
-  }
-  .message[data-scopedcss-30e1a72aed-bdba3a3d06] {
-    margin: 0 0 var(--boxel-sp-xs);
-    color: var(--foreground);
-    font: 500 var(--boxel-font-sm);
-    line-height: 1.4;
-  }

package/bundled-test-harness/assets/account-switch-failed-test-9ENVgvlx.js

@@ -1,45 +0,0 @@
-import { s as __toESM } from "./chunk-Rp0pCe6z.js";
-import { wt as setComponentTemplate } from "./cache-DtDz7X5V-Wn8jRDfL.js";
-import { H as templateFactory } from "./index-DaCZcoCY-CgzbilMy.js";
-import "./component-BJO47HTh.js";
-import "./template-factory-ds9s0u8l.js";
-import { t as templateOnly } from "./template-only-6nVzLWF-.js";
-import { d as click, h as render } from "./dist-BOAdzfkP.js";
-import { t as AccountSwitchFailed } from "./account-switch-failed-B3pr_iC3.js";
-import { t as require_qunit } from "./qunit-C-Foo4Nd.js";
-import { lt as setupRenderingTest } from "./mock-matrix-DPQ0j2MD.js";
-//#region tests/integration/components/matrix/account-switch-failed-test.gts
-var import_qunit = /* @__PURE__ */ __toESM(require_qunit());
-var noop = () => {};
-(0, import_qunit.module)("Integration | Component | matrix/account-switch-failed", function(hooks) {
-	setupRenderingTest(hooks);
-	(0, import_qunit.test)("renders the failure message and a back-to-home link", async function(assert) {
-		await render(setComponentTemplate(templateFactory({
-			"id": "TU0JbnOZ",
-			"block": "[[[8,[32,0],null,[[\"@onBackToHome\"],[[32,1]]],null]],[],[]]",
-			"moduleName": "/home/runner/work/boxel/boxel/packages/host/tests/integration/components/matrix/account-switch-failed-test.gts",
-			"scope": () => [AccountSwitchFailed, noop],
-			"isStrictMode": true
-		}), templateOnly()));
-		assert.dom("[data-test-account-switch-failed]").exists();
-		assert.dom("[data-test-account-switch-failed]").containsText("Couldn't switch accounts");
-		assert.dom("[data-test-account-switch-failed]").containsText("haven't been signed out");
-		assert.dom("[data-test-account-switch-back-home]").hasText("Back to home");
-	});
-	(0, import_qunit.test)("invokes onBackToHome when the link is clicked", async function(assert) {
-		let calls = 0;
-		let onBackToHome = () => {
-			calls++;
-		};
-		await render(setComponentTemplate(templateFactory({
-			"id": "TU0JbnOZ",
-			"block": "[[[8,[32,0],null,[[\"@onBackToHome\"],[[32,1]]],null]],[],[]]",
-			"moduleName": "/home/runner/work/boxel/boxel/packages/host/tests/integration/components/matrix/account-switch-failed-test.gts",
-			"scope": () => [AccountSwitchFailed, onBackToHome],
-			"isStrictMode": true
-		}), templateOnly()));
-		await click("[data-test-account-switch-back-home]");
-		assert.strictEqual(calls, 1, "onBackToHome fired exactly once");
-	});
-});
-//#endregion