@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/cli/credential-context.js

@@ -2,40 +2,8 @@
 /*---------------------------------------------------------------------------------------------
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ON_DENIED_TIMEOUT_MS = exports.WARRANT_DENIED_REASON = void 0;
 exports.runWithCredential = runWithCredential;
 exports.currentCredential = currentCredential;
 exports.requireUserId = requireUserId;
@@ -49,52 +17,62 @@ exports.requireUserId = requireUserId;
  * exactly as the Databricks OBO docs prescribe ("read it from the request on
  * each call … rather than trying to have it persist").
  *
- * Stdio MCP subprocesses cannot see AsyncLocalStorage. When `dataTokenDir` is
- * provided, `runWithCredential` writes the per-turn data token to a scoped file
- * and exposes `dataTokenFile` so MCP env resolution can pass
- * `AGENTHIPPO_DATA_TOKEN_FILE` (read by the MCP server on each tool call).
+ * The credential lives in broker (serve) process memory only. It is never
+ * written to disk and never crosses into an engine subprocess: engines receive
+ * a turn-scoped nonce for the loopback data-plane gateway instead
+ * (secure-obo-design §2/§3 — the agent gets a capability, not the credential).
  */
 const async_hooks_1 = require("async_hooks");
-const node_crypto_1 = require("node:crypto");
-const node_fs_1 = require("node:fs");
-const path = __importStar(require("path"));
+/** Stable, queryable reason code for the one case runWithCredential rejects. */
+exports.WARRANT_DENIED_REASON = 'token_without_verified_user';
+/** Default bound on `onDenied` so a hung audit write cannot stall admission forever. */
+exports.ON_DENIED_TIMEOUT_MS = 2_000;
 const storage = new async_hooks_1.AsyncLocalStorage();
-function tokenDir(baseDir) {
-    return path.join(baseDir, 'mcp-data-tokens');
-}
-async function prepareCredentialScope(cred, options) {
-    const token = cred.dataToken?.trim();
-    const baseDir = options?.dataTokenDir?.trim();
-    if (!token || !baseDir) {
-        return cred;
+/**
+ * Invoke `onDenied` best-effort with a hard timeout. Never throws: logging must
+ * not replace or delay the fail-closed rejection that follows.
+ */
+async function invokeOnDenied(onDenied, reason, timeoutMs) {
+    if (!onDenied) {
+        return;
+    }
+    const ms = Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : exports.ON_DENIED_TIMEOUT_MS;
+    let timer;
+    try {
+        await Promise.race([
+            Promise.resolve().then(() => onDenied(reason)),
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, ms);
+                timer.unref?.();
+            }),
+        ]);
+    }
+    catch {
+        // Evidence logging must never suppress or replace the fail-closed error below.
+    }
+    finally {
+        if (timer) {
+            clearTimeout(timer);
+        }
     }
-    const dir = tokenDir(baseDir);
-    await node_fs_1.promises.mkdir(dir, { recursive: true });
-    const file = path.join(dir, `${(0, node_crypto_1.randomUUID)()}.token`);
-    await node_fs_1.promises.writeFile(file, token, { mode: 0o600 });
-    return { ...cred, dataTokenFile: file };
 }
-async function cleanupCredentialScope(cred) {
-    if (!cred.dataTokenFile) {
-        return;
+async function checkCredentialScope(cred, options) {
+    const token = cred.dataToken?.trim();
+    // A per-turn OBO credential without a verified identity would hand a tool someone's
+    // live data-plane token while the turn can't attribute or scope its use to anyone —
+    // fail closed before the turn runs, rather than let a tool run with a real credential
+    // attached to an unknown/placeholder user.
+    if (token && !cred.userId?.trim()) {
+        await invokeOnDenied(options?.onDenied, exports.WARRANT_DENIED_REASON, options?.onDeniedTimeoutMs ?? exports.ON_DENIED_TIMEOUT_MS);
+        throw new Error(`OBO data token present without a verified user in request scope (fail-closed: ${exports.WARRANT_DENIED_REASON})`);
     }
-    await node_fs_1.promises.unlink(cred.dataTokenFile).catch(() => undefined);
 }
 /**
- * Run `fn` with `cred` as the ambient request-scoped credential.
- * When `options.dataTokenDir` is set and `cred.dataToken` is present, writes a
- * turn-scoped token file for stdio MCP servers.
+ * Run `fn` with `cred` as the ambient request-scoped credential (memory only).
  */
 async function runWithCredential(cred, fn, options) {
-    const scoped = await prepareCredentialScope(cred, options);
-    return storage.run(scoped, async () => {
-        try {
-            return await fn();
-        }
-        finally {
-            await cleanupCredentialScope(scoped);
-        }
-    });
+    await checkCredentialScope(cred, options);
+    return storage.run(cred, async () => fn());
 }
 /** The current turn's credential, or `undefined` outside any `runWithCredential` scope. */
 function currentCredential() {

package/out/cli/data-plane/broker.js

@@ -0,0 +1,78 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialBroker = exports.identityProvider = exports.passthroughProvider = void 0;
+exports.resolveProvider = resolveProvider;
+/** Databricks Apps-style: the platform minted the downscoped per-user token already. */
+exports.passthroughProvider = {
+    name: 'passthrough',
+    refreshOnInbound: true,
+    async acquire({ userId, inboundToken }) {
+        const token = inboundToken?.trim();
+        if (!token) {
+            // The passthrough provider holds nothing of its own — no inbound credential on
+            // this turn means no data access. Never fall back to any shared credential.
+            throw new Error(`No inbound data credential for user (fail-closed) — the platform did not forward a per-user token on this request (userId=${userId})`);
+        }
+        // TTL is the platform's problem; cache briefly so mid-turn calls reuse one token.
+        return { expiresAt: Date.now() + 10 * 60_000, secretRef: token };
+    },
+};
+/** Backends where authorization is a server-side identity mapping (Postgres RLS, SAP B1 vault). */
+exports.identityProvider = {
+    name: 'identity',
+    async acquire({ userId }) {
+        if (!userId.trim()) {
+            throw new Error('No verified user (fail-closed)');
+        }
+        return { expiresAt: Number.MAX_SAFE_INTEGER, secretRef: null };
+    },
+};
+function resolveProvider(name) {
+    const n = (name ?? 'passthrough').trim().toLowerCase();
+    if (n === 'passthrough') {
+        return exports.passthroughProvider;
+    }
+    if (n === 'identity') {
+        return exports.identityProvider;
+    }
+    throw new Error(`Unknown data credential provider "${name}" (supported: passthrough, identity)`);
+}
+class CredentialBroker {
+    provider;
+    /** Per-user cache — plain in-memory Map, entries dropped on expiry. Never serialized. */
+    cache = new Map();
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /**
+     * Server-side credential selection (secure-obo-design §5 step 7): the caller supplies
+     * a verified userId from the TurnRegistry — never anything client-controlled.
+     */
+    async acquire(userId, inboundToken) {
+        if (this.provider.refreshOnInbound) {
+            // Passthrough-style providers get the platform token on every legitimate request,
+            // so the cache must never bridge a turn that arrived WITHOUT one — that would let
+            // a token-less turn (broken forwarding, channel-originated) silently reuse the
+            // user's previous token for the cache TTL instead of failing closed. Always
+            // re-acquire from exactly what this turn carried. Nothing is cached: caching
+            // would only ever serve the token-less case this branch exists to reject.
+            return this.provider.acquire({ userId, inboundToken });
+        }
+        const cached = this.cache.get(userId);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached;
+        }
+        this.cache.delete(userId);
+        const fresh = await this.provider.acquire({ userId, inboundToken });
+        this.cache.set(userId, fresh);
+        return fresh;
+    }
+    /** Drop a user's cached credential (mid-turn 401 retry path / offboarding). */
+    invalidate(userId) {
+        this.cache.delete(userId);
+    }
+}
+exports.CredentialBroker = CredentialBroker;

package/out/cli/data-plane/connector-host.js

@@ -0,0 +1,121 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectorHost = exports.TURN_META_KEY = void 0;
+/**
+ * ConnectorHost — runs the pack's data connector as a BROKER-owned stdio MCP subprocess
+ * (secure-obo-design §3.1 "Data-plane MCP gateway": provider connectors live in the
+ * broker's trust domain, not the agent's).
+ *
+ * The connector is the same familiar shape as the old pack `server.mjs` (a stdio MCP
+ * server), but it is spawned by serve — never by the engine — and it receives the turn's
+ * credential per call over the private stdio pipe via MCP `_meta`
+ * (`ai.agenthippo/turn`), never via env, argv, or disk. Its own node_modules resolve
+ * from the connector's directory, so backend SDKs (@databricks/sql, pg, …) stay out of
+ * the AgentHippo CLI.
+ */
+const path = __importStar(require("path"));
+const fs_1 = require("fs");
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const stdio_js_1 = require("@modelcontextprotocol/sdk/client/stdio.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const resolveNodeBinary_1 = require("../../utils/resolveNodeBinary");
+/** `_meta` key carrying the turn context to the connector (namespaced per MCP convention). */
+exports.TURN_META_KEY = 'ai.agenthippo/turn';
+class ConnectorHost {
+    client;
+    logger;
+    connectorPath;
+    constructor(client, logger, connectorPath) {
+        this.client = client;
+        this.logger = logger;
+        this.connectorPath = connectorPath;
+    }
+    static async spawn(opts) {
+        const connectorPath = path.resolve(opts.connectorPath);
+        await fs_1.promises.access(connectorPath);
+        const nodeBin = await (0, resolveNodeBinary_1.resolveNodeBinary)();
+        const transport = new stdio_js_1.StdioClientTransport({
+            command: nodeBin,
+            args: [connectorPath],
+            // cwd = connector dir so its own node_modules resolve (backend SDKs live there).
+            cwd: path.dirname(connectorPath),
+            env: { ...process.env, AGENTHIPPO_DATA_CONNECTOR: '1' },
+            stderr: 'pipe',
+        });
+        const client = new index_js_1.Client({ name: 'agenthippo-data-gateway', version: '1.0.0' });
+        await client.connect(transport);
+        transport.stderr?.on('data', (chunk) => {
+            opts.logger?.warn(`[DataPlane] connector stderr: ${String(chunk).trimEnd()}`);
+        });
+        opts.logger?.info(`[DataPlane] connector started: ${connectorPath}`);
+        return new ConnectorHost(client, opts.logger, connectorPath);
+    }
+    async listTools() {
+        const res = await this.client.listTools();
+        return res.tools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: (t.inputSchema ?? { type: 'object' }),
+        }));
+    }
+    /**
+     * Forward a tool call with the turn context in `_meta`. The credential crosses only the
+     * private serve↔connector stdio pipe — both ends are the broker trust domain.
+     */
+    async callTool(name, args, turn) {
+        const result = await this.client.request({
+            method: 'tools/call',
+            params: {
+                name,
+                arguments: args,
+                _meta: { [exports.TURN_META_KEY]: { userId: turn.userId, credential: turn.credential } },
+            },
+        }, types_js_1.CallToolResultSchema);
+        return result;
+    }
+    async close() {
+        try {
+            await this.client.close();
+        }
+        catch (e) {
+            this.logger?.warn(`[DataPlane] connector close: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+}
+exports.ConnectorHost = ConnectorHost;

package/out/cli/data-plane/egress.js

@@ -0,0 +1,189 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EGRESS_URL_ENV = void 0;
+exports.startEgressBroker = startEgressBroker;
+/**
+ * Egress broker — the outbound mirror of the data-plane gateway (secure-obo-design §7.6).
+ *
+ * The agent-anywhere channel token (OpenClaw bot/gateway token) is the exfiltration key §2
+ * forbids the agent from holding: with it in the agent env, a prompt-injected pack talks to
+ * the gateway RPC directly and bypasses the reply-to-sender handle allowlist (§7.4 gap 1).
+ *
+ * This broker interposes the same shape as the data plane: the agent presents ONLY the
+ * per-turn nonce (the SAME `AGENTHIPPO_TURN_NONCE` the data plane uses — one TurnRegistry
+ * entry grants both capabilities, no second secret) and a message. The broker:
+ *
+ *   1. resolves the nonce → verified {userId, sessionKey, egressStoreKey} (off-turn/expired
+ *      nonce ⇒ 401, fail closed);
+ *   2. loads THAT session's outbound handle store SERVER-SIDE (never a client-supplied path);
+ *   3. resolves the destination from the session's already-bound handles — reply-to-sender.
+ *      `to` may only SELECT AMONG bound handles, never name a new target (§7.6 step 4);
+ *   4. calls the real OpenClaw `send` with the BROKER-held token — which never entered the
+ *      agent's env.
+ *
+ * What a stolen egress nonce buys (§7.6): exactly what the agent could already do this turn —
+ * reply to its own session's bound peers, on-box, until the turn ends. It cannot address a new
+ * peer (`user:attacker` never resolves), reach another session's handles (server-side scoping),
+ * or reach OpenClaw directly (no token in its env). That is the §3.3 property, for egress.
+ */
+const http = __importStar(require("http"));
+const serve_hardening_1 = require("../serve-hardening");
+const registry_1 = require("./registry");
+const outboundHandles_1 = require("../../gateway/outboundHandles");
+const outboundPaths_1 = require("../../gateway/outboundPaths");
+/** Loopback URL of the egress broker; set into the engine child env per boot (turn-invariant). */
+exports.EGRESS_URL_ENV = 'AGENTHIPPO_EGRESS_URL';
+function bearerToken(header) {
+    const m = header?.match(/^Bearer\s+(\S+)$/i);
+    return m?.[1];
+}
+function noncePrefix(nonce) {
+    return nonce ? (0, registry_1.hashNonce)(nonce).slice(0, 12) : 'none';
+}
+/**
+ * The session's outbound store lives at a server-derived path — the caller can NEVER name it.
+ * The gateway bridge records reply handles under the raw (un-namespaced) gateway key, so the
+ * store dir id is that key (see serve.ts resolveGatewaySessionKey `outboundKey`).
+ */
+function storePathForTurn(workspaceRoot, egressStoreKey) {
+    return (0, outboundPaths_1.getGatewayOutboundFilePath)(workspaceRoot, (0, outboundPaths_1.safeGatewaySessionDirId)(egressStoreKey));
+}
+async function startEgressBroker(opts) {
+    const server = http.createServer(async (req, res) => {
+        const reject = (code, message, auditEvent, fields) => {
+            if (auditEvent) {
+                opts.audit?.('unauthorized', auditEvent, fields ?? {});
+            }
+            res.writeHead(code, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: false, error: message }));
+        };
+        try {
+            const urlPath = req.url?.split('?')[0] ?? '';
+            if (urlPath !== '/egress/send') {
+                reject(404, 'not found');
+                return;
+            }
+            if (req.method !== 'POST') {
+                res.writeHead(405, { 'Content-Type': 'application/json', 'Allow': 'POST' });
+                res.end(JSON.stringify({ ok: false, error: 'method not allowed' }));
+                return;
+            }
+            const nonce = bearerToken(req.headers.authorization);
+            const turn = nonce ? opts.registry.resolve(nonce) : undefined;
+            if (!turn) {
+                // Off-turn / expired / missing — a stale or injected caller fails CLOSED, exactly
+                // like the data-plane gateway (§3.2). No token in the agent env to fall back on.
+                reject(401, 'Unauthorized: missing, unknown, or expired turn nonce', 'egress_nonce_reject', {
+                    reason: nonce ? 'unknown_or_expired' : 'missing',
+                    nonce_sha256_prefix: noncePrefix(nonce),
+                });
+                return;
+            }
+            // A channel turn carries the outbound store key; a bare data turn (HTTP /v1/chat, no
+            // channel) has none — nothing to reply to, so egress is not available to it.
+            const storeKey = turn.egressStoreKey?.trim();
+            if (!storeKey) {
+                reject(403, 'no outbound route for this turn (not a channel-originated session)', 'egress_deny', { userId: turn.userId, reason: 'no_store_key' });
+                return;
+            }
+            let body;
+            try {
+                body = JSON.parse(await (0, serve_hardening_1.readBodyWithCap)(req));
+            }
+            catch {
+                reject(400, 'invalid JSON body');
+                return;
+            }
+            const message = typeof body.message === 'string' ? body.message : '';
+            if (!message.trim()) {
+                reject(400, 'message is required');
+                return;
+            }
+            // `to` is a SELECTOR among bound handles only — never a new destination (§7.6 step 4).
+            const to = typeof body.to === 'string' ? body.to.trim() : undefined;
+            const media = typeof body.media === 'string' ? body.media.trim() || undefined : undefined;
+            // Server-side resolution: the store path is derived from the VERIFIED turn, never the
+            // request. `resolveGatewayOutboundHandle` returns only a handle bound by a prior
+            // inbound message (reply-to-sender); an unknown `to` matches nothing ⇒ undefined.
+            const storePath = storePathForTurn(opts.workspaceRoot, storeKey);
+            let handle;
+            try {
+                handle = await (0, outboundHandles_1.resolveGatewayOutboundHandle)(storePath, opts.agentId, to ? { target: to } : undefined);
+            }
+            catch (err) {
+                opts.logger?.warn(`[Egress] store read failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            if (!handle) {
+                // No bound destination — a prompt-injected `to: user:attacker` lands here.
+                reject(404, to
+                    ? `no bound handle matches "${to}" for this session (cannot address a new destination)`
+                    : 'no reply destination bound for this session yet', 'egress_deny', { userId: turn.userId, reason: 'no_matching_handle', to: to ?? '(reply-to-sender)' });
+                return;
+            }
+            opts.audit?.(turn.sessionKey, 'egress_authorize', {
+                userId: turn.userId, channel: handle.channel, target: handle.target,
+            });
+            const result = await opts.send(handle, message, media);
+            res.writeHead(result.ok ? 200 : 502, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(result));
+        }
+        catch (err) {
+            opts.logger?.warn(`[Egress] broker error: ${err instanceof Error ? err.message : String(err)}`);
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+            }
+            res.end(JSON.stringify({ ok: false, error: 'Internal error' }));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        // Loopback ONLY — the broker must never be reachable off-box.
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Egress broker failed to bind a loopback port');
+    }
+    const url = `http://127.0.0.1:${address.port}/egress/send`;
+    opts.logger?.info(`[Egress] broker listening at ${url}`);
+    return {
+        url,
+        close: () => new Promise((resolve) => server.close(() => resolve())),
+    };
+}