humanish 0.104.3 → 0.106.0

package/dist/observer/serve.js

@@ -0,0 +1,305 @@
+import { listenOnLoopback, PortInUseError } from "./listen.js";
+import { createServer } from "node:http";
+import path from "node:path";
+import { pinDirectChildDirectory, pinDirectory } from "./pinned-files.js";
+import { buildHistoryIndex, matchRunRoute, serveRunPath } from "./run-routes.js";
+import { hashRunInventory, inventoryRoot, readRunInventory, } from "./run-inventory.js";
+import { renderLibraryHtml } from "./library.js";
+import { buildServeSecurityHeaders, hostAllowed, parsePublicOrigin, } from "./http.js";
+import { isSafeRunIdSegment } from "../run/paths.js";
+import { listRuns } from "../run/stored-runs.js";
+import { verifyRun } from "../verify/verify.js";
+export const SERVE_SCHEMA = "humanish.serve-result.v1";
+export function createShareSafetyAdmission(cwd, options = {}) {
+    const verifyImpl = options.verifyImpl ?? verifyRun;
+    const runsRoot = path.join(cwd, ".humanish", "runs");
+    // Keyed on a walk of every file in the run, taken on each call: a file added, removed or
+    // rewritten since the last verify changes the walk, and the run is verified again before
+    // anything in it is served. A change that leaves every stat field alone is caught by the
+    // content hash at read time, which drops the entry.
+    const cache = new Map();
+    const shareReady = (verified) => verified.ok === true && verified.shareSafety.status === "share_ready";
+    const verifyAdmission = async (runId, runDirectory, before, forget) => {
+        // A run verify refuses is never served, so its bytes are never hashed. Hashing reads every
+        // byte, and one large file in a refused run would otherwise cost startup time for nothing.
+        if (!shareReady(await verifyImpl(cwd, runId)))
+            return null;
+        // Admitted: hash, verify again, and hash after, so the served bytes are the ones verify scanned.
+        const hashesBefore = await hashRunInventory(runDirectory, before);
+        if (!hashesBefore)
+            return null;
+        if (!shareReady(await verifyImpl(cwd, runId)))
+            return null;
+        // A file that changed while verify read the run may not be the version it scanned. A changed
+        // stat shows in the next request's walk; changed bytes alone do not, so they drop the entry.
+        const after = await readRunInventory(runDirectory);
+        if (after?.signature !== before.signature)
+            return null;
+        const hashes = await hashRunInventory(runDirectory, after);
+        if (!hashes || !sameHashes(hashesBefore, hashes)) {
+            forget();
+            return null;
+        }
+        return { inventory: before, hashes, forget };
+    };
+    return {
+        async admit(runId) {
+            const runDirectory = path.join(runsRoot, runId);
+            const before = isSafeRunIdSegment(runId) ? await readRunInventory(runDirectory) : null;
+            if (!before) {
+                cache.delete(runId);
+                return null;
+            }
+            const cached = cache.get(runId);
+            if (cached?.signature === before.signature) {
+                return cached.admitted;
+            }
+            const entry = {
+                signature: before.signature,
+                admitted: Promise.resolve(null),
+            };
+            const forget = () => {
+                if (cache.get(runId) === entry)
+                    cache.delete(runId);
+            };
+            entry.admitted = verifyAdmission(runId, runDirectory, before, forget).catch(() => null);
+            cache.set(runId, entry);
+            return entry.admitted;
+        },
+    };
+}
+function sameHashes(left, right) {
+    return left.size === right.size && [...left].every(([key, hash]) => right.get(key) === hash);
+}
+export function createServeRequestHandler(options) {
+    return async (request, response) => {
+        try {
+            for (const [name, value] of Object.entries(buildServeSecurityHeaders())) {
+                response.setHeader(name, value);
+            }
+            const method = request.method ?? "GET";
+            if (method !== "GET" && method !== "HEAD") {
+                writeText(response, 405, "Method Not Allowed");
+                return;
+            }
+            if (!hostAllowed(request.headers.host, options.hostAllowlist)) {
+                writeText(response, 421, "Misdirected Request");
+                return;
+            }
+            const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
+            if (url.pathname === "/_humanish/api" || url.pathname.startsWith("/_humanish/api/")) {
+                writeText(response, 501, `${JSON.stringify({
+                    error: {
+                        code: "HUMANISH_SERVE_CONTROL_PLANE_DISABLED",
+                        message: "control plane not enabled in this version",
+                    },
+                }, null, 2)}\n`, "application/json; charset=utf-8");
+                return;
+            }
+            if (url.pathname === "/") {
+                if (options.entryRunId) {
+                    response.writeHead(302, {
+                        location: `/_humanish/runs/${encodeURIComponent(options.entryRunId)}/observer/index.html`,
+                    });
+                    response.end();
+                    return;
+                }
+                const history = await loadFilteredHistory(options);
+                writeText(response, 200, options.renderLibrary(history), "text/html; charset=utf-8");
+                return;
+            }
+            if (url.pathname === "/_humanish/history.json") {
+                const history = await loadFilteredHistory(options);
+                writeText(response, 200, JSON.stringify(history, null, 2), "application/json; charset=utf-8");
+                return;
+            }
+            if (url.pathname.startsWith("/_humanish/runs/")) {
+                const runRoute = matchRunRoute(url.pathname);
+                if (!runRoute) {
+                    writeText(response, 404, "Run not found");
+                    return;
+                }
+                const admitted = options.safe ? await options.admit(runRoute.runId) : null;
+                if (options.safe && !admitted) {
+                    // Byte-identical to the nonexistent-run 404: no existence oracle.
+                    writeText(response, 404, "Run not found");
+                    return;
+                }
+                const pinned = await pinDirectChildDirectory(options.proofRoot, runRoute.runId);
+                // Under --safe every read checks the file against the inventory verify covered.
+                const targetRoot = pinned && admitted ? inventoryRoot(pinned, admitted) : pinned;
+                if (!targetRoot) {
+                    writeText(response, 404, "Run not found");
+                    return;
+                }
+                // The explicit empty runtimeStreamUrls keeps a future refactor from
+                // reintroducing auth-keyed stream injection on the serve surface.
+                await serveRunPath(targetRoot, runRoute.relativePath || "observer/index.html", response, [], request);
+                return;
+            }
+            writeText(response, 404, "Not found");
+        }
+        catch {
+            writeText(response, 500, "Observer request failed");
+        }
+    };
+}
+async function loadFilteredHistory(options) {
+    if (!options.safe) {
+        return buildHistoryIndex(options.proofRoot);
+    }
+    const history = await buildHistoryIndex(options.proofRoot, async (runId, pinned) => {
+        const admitted = await options.admit(runId);
+        return admitted ? inventoryRoot(pinned, admitted) : null;
+    });
+    const runs = history.runs;
+    const latestRunId = runs.some((run) => run.runId === history.latestRunId)
+        ? history.latestRunId
+        : (runs[0]?.runId ?? null);
+    return { latestRunId, runs };
+}
+export async function serveObserverLibrary(cwdInput, options) {
+    const cwd = path.resolve(cwdInput);
+    const verifyImpl = options.verifyImpl ?? verifyRun;
+    let proofRoot;
+    try {
+        proofRoot = await pinDirectory(path.join(cwd, ".humanish", "runs"));
+    }
+    catch {
+        return {
+            ok: false,
+            error: {
+                code: "HUMANISH_RUN_NOT_FOUND",
+                message: "No run library found under .humanish/runs. Run `humanish watch` to create the first run.",
+            },
+        };
+    }
+    const admission = createShareSafetyAdmission(cwd, { verifyImpl });
+    // Exposure auth is tunnel-edge only. Under --expose, an edge-authed surface (ngrok --oauth or an
+    // operator --public-url) serves every run (mode "exposed"); an un-authed surface is admissible
+    // only because --safe narrows it to share_ready runs (mode "share-safe-open").
+    const mode = options.expose
+        ? options.edgeAuthed
+            ? "exposed"
+            : "share-safe-open"
+        : "loopback";
+    let entryRunId;
+    if (options.entryRunId) {
+        const resolved = options.entryRunId === "latest" ? ((await listRuns(cwd)).latest ?? null) : options.entryRunId;
+        const pinned = resolved ? await pinDirectChildDirectory(proofRoot, resolved) : null;
+        if (!resolved || !pinned) {
+            return {
+                ok: false,
+                error: { code: "HUMANISH_RUN_NOT_FOUND", message: `Run not found: ${options.entryRunId}` },
+            };
+        }
+        if (options.safe && (await admission.admit(resolved)) === null) {
+            const verified = await verifyImpl(cwd, resolved).catch(() => null);
+            const status = verified?.shareSafety.status ?? "unverifiable";
+            const reasons = verified?.shareSafety.reasons.map((reason) => reason.code).join(", ") || "VERIFY_FAILED";
+            return {
+                ok: false,
+                error: {
+                    code: "HUMANISH_SERVE_RUN_NOT_SHAREABLE",
+                    message: `Run ${resolved} is not share_ready (shareSafety: ${status}; reasons: ${reasons}); --safe refuses to serve it.`,
+                },
+            };
+        }
+        entryRunId = resolved;
+    }
+    // Counts are computed over the UNCAPPED run list, not the 80-item history
+    // index: an edge-authed surface (non-safe) grants access to every run by direct
+    // URL, and share-safe modes admit every share_ready run per request, so a
+    // count capped at 80 would understate exactly what the exposure warning
+    // claims. runsListed feeds the operator's declared-friction warning.
+    const allRuns = (await listRuns(cwd)).runs;
+    let runsListed;
+    let shareReadyCount;
+    if (options.safe) {
+        const admitted = await Promise.all(allRuns.map((run) => admission.admit(run.runId)));
+        shareReadyCount = admitted.filter((run) => run !== null).length;
+        runsListed = shareReadyCount;
+    }
+    else {
+        runsListed = allRuns.length;
+    }
+    const declaredOrigin = options.publicOrigin ? parsePublicOrigin(options.publicOrigin) : null;
+    const hostAllowlist = new Set();
+    const handler = createServeRequestHandler({
+        proofRoot,
+        safe: options.safe,
+        admit: (runId) => admission.admit(runId),
+        hostAllowlist,
+        ...(entryRunId ? { entryRunId } : {}),
+        renderLibrary: (history) => renderLibraryHtml(history, {
+            mode,
+            safe: options.safe,
+            capabilities: { actions: false },
+        }),
+        ...(options.controlPlane ? { controlPlane: options.controlPlane } : {}),
+    });
+    const server = createServer((request, response) => {
+        void handler(request, response);
+    });
+    let port;
+    try {
+        port = await listenOnLoopback(server, options.port);
+    }
+    catch (error) {
+        if (error instanceof PortInUseError) {
+            // The most expected failure a serve command has, named instead of HUMANISH_UNEXPECTED (#484).
+            return { ok: false, error: { code: "HUMANISH_SERVE_PORT_IN_USE", message: error.message } };
+        }
+        throw error;
+    }
+    hostAllowlist.add(`127.0.0.1:${port}`);
+    hostAllowlist.add(`localhost:${port}`);
+    hostAllowlist.add(`[::1]:${port}`);
+    if (declaredOrigin) {
+        hostAllowlist.add(declaredOrigin.host);
+    }
+    return {
+        ok: true,
+        server: {
+            url: `http://127.0.0.1:${port}/`,
+            port,
+            mode,
+            runsListed,
+            ...(shareReadyCount !== undefined ? { shareReadyCount } : {}),
+            ...(entryRunId ? { entryRunId } : {}),
+            // A tunnel's public origin is only known after the tunnel starts (post bind); this lets the
+            // caller declare it, extending the Host allowlist so the authenticated edge forwarding under
+            // that Host is admitted. Never flips any in-process auth flag (there is none).
+            addPublicOrigin(origin) {
+                const parsed = parsePublicOrigin(origin);
+                if (!parsed) {
+                    return;
+                }
+                hostAllowlist.add(parsed.host);
+            },
+            close: async () => {
+                const closed = closeServer(server);
+                // Keep-alive sockets would otherwise keep close() pending past the point
+                // the operator believes Ctrl-C tore the server down.
+                server.closeAllConnections?.();
+                await closed;
+            },
+        },
+    };
+}
+function writeText(response, status, body, contentType = "text/plain; charset=utf-8") {
+    response.writeHead(status, { "content-type": contentType });
+    response.end(body);
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+}

package/dist/observer/static.js

@@ -0,0 +1,369 @@
+import { constants as fsConstants } from "node:fs";
+import { createServer } from "node:http";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import { buildArtifactSecurityHeaders } from "./http.js";
+// Loopback-only host for the Observer static server. We never bind 0.0.0.0:
+// the Observer surfaces local run evidence and must stay reachable only from
+// the machine that owns the run bundle.
+export const OBSERVER_STATIC_HOST = "127.0.0.1";
+// Minimal extension -> content-type map. Kept dependency-free (no `mime`
+// package) because the Observer ships a small, known set of asset kinds.
+const CONTENT_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".htm": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".map": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+    ".ico": "image/x-icon",
+    ".md": "text/markdown; charset=utf-8",
+    ".ndjson": "application/x-ndjson; charset=utf-8",
+    ".txt": "text/plain; charset=utf-8",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+};
+export function observerStaticContentType(filePath) {
+    return CONTENT_TYPES[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+/**
+ * Resolve, guard, and serve a single static request from `root`. Never throws:
+ * any unexpected failure is reported as a 500 so the connection always closes.
+ * Exported directly so the security guards can be unit-tested without binding a
+ * socket.
+ */
+export async function respondToObserverStaticRequest(options, request, response) {
+    applySecurityHeaders(response);
+    try {
+        const root = await pinStaticRoot(options.root);
+        await respondToPinnedObserverStaticRequest(root, options, request, response);
+    }
+    catch {
+        if (response.headersSent) {
+            response.end();
+            return;
+        }
+        writeText(response, 500, "Observer request failed");
+    }
+}
+async function respondToPinnedObserverStaticRequest(root, options, request, response) {
+    applySecurityHeaders(response);
+    const indexRelative = options.indexPath ?? "index.html";
+    try {
+        await assertPinnedStaticRoot(root);
+        const method = request.method ?? "GET";
+        if (method !== "GET" && method !== "HEAD") {
+            writeText(response, 405, "Method Not Allowed");
+            return;
+        }
+        let pathname;
+        try {
+            pathname = new URL(request.url ?? "/", `http://${OBSERVER_STATIC_HOST}`).pathname;
+        }
+        catch {
+            writeText(response, 400, "Bad Request");
+            return;
+        }
+        if (pathname === "/" && options.redirectRootTo) {
+            const location = `/${options.redirectRootTo.replace(/^\/+/, "")}`;
+            response.writeHead(302, {
+                location,
+                "cache-control": "no-store",
+                "content-length": "0",
+            });
+            response.end();
+            return;
+        }
+        let decoded;
+        try {
+            decoded = decodeURIComponent(pathname);
+        }
+        catch {
+            writeText(response, 400, "Bad Request");
+            return;
+        }
+        // Reject embedded NUL bytes outright rather than letting them reach the fs.
+        if (decoded.includes("\0")) {
+            writeText(response, 400, "Bad Request");
+            return;
+        }
+        let relative = decoded.replace(/^\/+/, "");
+        if (relative === "" || relative.endsWith("/")) {
+            relative = `${relative}${indexRelative}`;
+        }
+        const target = path.resolve(root.physicalPath, relative);
+        if (!isPathInside(root.physicalPath, target)) {
+            writeText(response, 403, "Forbidden");
+            return;
+        }
+        let info;
+        try {
+            info = await lstat(target);
+        }
+        catch {
+            writeText(response, 404, "Not Found");
+            return;
+        }
+        if (info.isSymbolicLink()) {
+            writeText(response, 403, "Forbidden");
+            return;
+        }
+        let filePath = target;
+        if (info.isDirectory()) {
+            filePath = path.resolve(target, indexRelative);
+            if (!isPathInside(root.physicalPath, filePath)) {
+                writeText(response, 403, "Forbidden");
+                return;
+            }
+        }
+        const rawBody = await readContainedRegularFile(root, filePath);
+        const body = rawBody ? recordedObserverStaticBody(filePath, rawBody) : null;
+        if (!body) {
+            writeText(response, 404, "Not Found");
+            return;
+        }
+        response.writeHead(200, {
+            "cache-control": "no-store",
+            "content-type": observerStaticContentType(filePath),
+            "content-length": String(body.byteLength),
+        });
+        if (method === "HEAD") {
+            response.end();
+            return;
+        }
+        response.end(body);
+    }
+    catch {
+        if (response.headersSent) {
+            response.end();
+            return;
+        }
+        writeText(response, 500, "Observer request failed");
+    }
+}
+function applySecurityHeaders(response) {
+    for (const [name, value] of Object.entries(buildArtifactSecurityHeaders()))
+        response.setHeader(name, value);
+}
+/** Static serving is recorded evidence. Neither JSON files nor inline HTML snapshots
+ * can carry a live process observation or grant provider-origin access. */
+function recordedObserverStaticBody(filePath, body) {
+    const strip = (text) => {
+        try {
+            const data = JSON.parse(text);
+            if (!data ||
+                typeof data !== "object" ||
+                Array.isArray(data) ||
+                data.schema !== "humanish.observer-data.v1")
+                return null;
+            const projection = data;
+            delete projection.runtime;
+            if (Array.isArray(projection.streams)) {
+                for (const stream of projection.streams) {
+                    if (!stream || typeof stream !== "object" || Array.isArray(stream))
+                        continue;
+                    const embed = stream.embed;
+                    if (embed && typeof embed === "object" && !Array.isArray(embed))
+                        delete embed.runtimeDesktop;
+                }
+            }
+            return JSON.stringify(projection)
+                .replace(/</g, "\\u003c")
+                .replace(/>/g, "\\u003e")
+                .replace(/&/g, "\\u0026");
+        }
+        catch {
+            return null;
+        }
+    };
+    if (path.basename(filePath) === "observer-data.json") {
+        const stripped = strip(body.toString("utf8"));
+        return stripped === null ? body : Buffer.from(stripped);
+    }
+    if (/\.html?$/i.test(filePath)) {
+        const html = body.toString("utf8");
+        // Identify Observer JSON by its schema, not an attribute spelling: HTML permits
+        // encoded ids and '>' inside quoted attributes. Other scripts remain byte-identical.
+        const sanitized = html.replace(/(<script\b(?:[^>"']|"[^"]*"|'[^']*')*>)([\s\S]*?)(<\/script\s*>)/gi, (match, start, json, end) => {
+            const stripped = strip(json);
+            return stripped === null ? match : `${start}${stripped}${end}`;
+        });
+        return sanitized === html ? body : Buffer.from(sanitized);
+    }
+    return body;
+}
+async function readContainedRegularFile(root, filePathInput) {
+    const filePath = path.resolve(filePathInput);
+    if (!isPathInside(root.physicalPath, filePath))
+        return null;
+    try {
+        await assertPinnedStaticRoot(root);
+        const expectedStats = await inspectContainedStaticFile(root, filePath);
+        if (!expectedStats) {
+            return null;
+        }
+        const handle = await open(filePath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+        try {
+            const openedStats = await handle.stat({ bigint: true });
+            if (!openedStats.isFile() ||
+                openedStats.nlink !== 1n ||
+                openedStats.dev !== expectedStats.dev ||
+                openedStats.ino !== expectedStats.ino) {
+                return null;
+            }
+            const recheckedStats = await inspectContainedStaticFile(root, filePath);
+            if (!recheckedStats ||
+                recheckedStats.dev !== expectedStats.dev ||
+                recheckedStats.ino !== expectedStats.ino) {
+                return null;
+            }
+            await assertPinnedStaticRoot(root);
+            const body = await handle.readFile();
+            await assertPinnedStaticRoot(root);
+            return body;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+export function createObserverStaticHandler(options) {
+    let rootPromise;
+    return (request, response) => {
+        applySecurityHeaders(response);
+        rootPromise ??= pinStaticRoot(options.root);
+        void rootPromise
+            .then((root) => respondToPinnedObserverStaticRequest(root, options, request, response))
+            .catch(() => {
+            if (response.headersSent) {
+                response.end();
+                return;
+            }
+            writeText(response, 500, "Observer request failed");
+        });
+    };
+}
+export async function serveObserverStatic(options) {
+    const entryPath = options.entryPath?.replace(/^\/+/, "") ?? "";
+    const handlerOptions = {
+        root: options.root,
+        ...(options.indexPath === undefined ? {} : { indexPath: options.indexPath }),
+        ...(entryPath ? { redirectRootTo: entryPath } : {}),
+    };
+    const root = await pinStaticRoot(options.root);
+    const handler = (request, response) => {
+        void respondToPinnedObserverStaticRequest(root, handlerOptions, request, response);
+    };
+    const server = createServer(handler);
+    const port = await listen(server, options.port ?? 0);
+    return {
+        url: `http://${OBSERVER_STATIC_HOST}:${port}/${entryPath}`,
+        port,
+        host: OBSERVER_STATIC_HOST,
+        close: () => closeServer(server),
+    };
+}
+function writeText(response, status, message) {
+    const body = `${message}\n`;
+    response.writeHead(status, {
+        "cache-control": "no-store",
+        "content-type": "text/plain; charset=utf-8",
+        "content-length": String(Buffer.byteLength(body)),
+    });
+    response.end(body);
+}
+function isPathInside(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return (relative === "" ||
+        (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)));
+}
+async function inspectContainedStaticFile(root, filePath) {
+    const relative = path.relative(root.physicalPath, filePath);
+    if (!relative ||
+        relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)) {
+        return null;
+    }
+    const segments = relative.split(path.sep).filter(Boolean);
+    let current = root.physicalPath;
+    let fileIdentity = null;
+    for (const [index, segment] of segments.entries()) {
+        current = path.join(current, segment);
+        const stats = await lstat(current, { bigint: true });
+        if (stats.isSymbolicLink())
+            return null;
+        if (index < segments.length - 1) {
+            if (!stats.isDirectory())
+                return null;
+        }
+        else {
+            if (!stats.isFile() || stats.nlink !== 1n)
+                return null;
+            fileIdentity = { dev: stats.dev, ino: stats.ino };
+        }
+    }
+    if ((await realpath(filePath)) !== filePath)
+        return null;
+    return fileIdentity;
+}
+async function pinStaticRoot(rootInput) {
+    const physicalPath = await realpath(path.resolve(rootInput));
+    const stats = await lstat(physicalPath, { bigint: true });
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+        throw new Error("Observer static roots must be physical directories.");
+    }
+    return Object.freeze({
+        birthtimeNs: stats.birthtimeNs,
+        dev: stats.dev,
+        ino: stats.ino,
+        physicalPath,
+    });
+}
+async function assertPinnedStaticRoot(root) {
+    const stats = await lstat(root.physicalPath, { bigint: true });
+    if (stats.isSymbolicLink() ||
+        !stats.isDirectory() ||
+        stats.birthtimeNs !== root.birthtimeNs ||
+        stats.dev !== root.dev ||
+        stats.ino !== root.ino ||
+        (await realpath(root.physicalPath)) !== root.physicalPath) {
+        throw new Error("Observer static root identity changed.");
+    }
+}
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, OBSERVER_STATIC_HOST, () => {
+            server.off("error", reject);
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                reject(new Error("Observer static server did not bind to a TCP port."));
+                return;
+            }
+            resolve(address.port);
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+            }
+            else {
+                resolve();
+            }
+        });
+    });
+}