@keri-ts/hosting 0.0.0-stage → 2.0.1

package/esm/hosting/npm/src/src/http/protocol/endpoints/generic-cesr-ingress.js

@@ -0,0 +1,272 @@
+/**
+ * Generic CESR POST/PUT ingress for the Tufa HTTP edge.
+ *
+ * Explicit routes are classified before this module runs. This handler owns
+ * the remaining raw CESR traffic and decides whether it belongs to local
+ * witness ingestion, mailbox SSE query streaming, or normal runtime ingress.
+ */
+import { Ilks, parse, ParserError } from "cesr-ts";
+import { call, ensure, run } from "effection";
+import { drainWitnessCues, isCesrContentType, requestBytes, rethrowCleanupFailure, ValidationError, } from "keri-ts/runtime";
+import { jsonNoContentResponse, textResponse } from "../responses.js";
+import { drainRuntimeCues } from "../runtime-bridge.js";
+/** No hosted endpoint matched this generic ingress request. */
+const NONE_HOSTED_ROUTE = {
+    kind: "none",
+    endpoint: null,
+    relativePath: null,
+};
+/** Classify generic POST/PUT CESR ingress after all explicit HTTP routes. */
+export function classifyGenericCesrIngressRoute(context) {
+    if (!context.runtime || (context.method !== "POST" && context.method !== "PUT")) {
+        return null;
+    }
+    if (context.genericIngress?.kind === "ambiguous") {
+        return {
+            kind: "ambiguousHostedPath",
+            message: "Ambiguous hosted endpoint path",
+        };
+    }
+    return {
+        kind: "genericCesrIngress",
+        hosted: context.genericIngress ?? NONE_HOSTED_ROUTE,
+    };
+}
+/**
+ * Decide how one inspected CESR request should be ingested.
+ *
+ * This is the explicit replacement for the old inline witness-root boolean.
+ */
+export function classifyCesrIngressRoute(context, hosted, serder) {
+    const mailboxAid = hosted.kind === "one"
+        ? hosted.endpoint?.eid ?? null
+        : null;
+    const witnessHab = context.policy.witnessHab;
+    if (witnessHab
+        && hosted.kind === "one"
+        && hosted.endpoint?.eid === witnessHab.pre
+        && serder.ilk !== Ilks.qry
+        && serder.ilk !== Ilks.exn) {
+        // Witness-hosted events are accepted locally by the witness processor, but
+        // witness `qry` and peer `exn` traffic still belongs to runtime routing.
+        return { kind: "witnessLocalIngress", witnessHab };
+    }
+    if (serder.ilk === Ilks.qry && serder.route === "mbx") {
+        const query = serder.ked?.q;
+        const pre = typeof query?.i === "string" ? query.i : null;
+        return {
+            kind: "mailboxQueryStream",
+            mailboxAid,
+            pre,
+            topics: query?.topics,
+        };
+    }
+    return { kind: "runtimeIngress", mailboxAid };
+}
+/** Return the mailbox stream correlated with this already-authorized query. */
+function querySseResponse(context, said) {
+    if (!said) {
+        return textResponse("Query is missing said", 400);
+    }
+    return new Response(context.runtime.mailboxDirector.streamQueryResponse(said), {
+        status: 200,
+        headers: {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            "Connection": "close",
+        },
+    });
+}
+/** Run one request in a single owned Effection task and join it on disconnect. */
+export async function handleGenericCesrIngress(context, hosted) {
+    if (!isCesrContentType(context.req.headers.get("content-type"))) {
+        await context.req.body?.cancel();
+        return textResponse("Unacceptable content type.", 406);
+    }
+    let response, operationFailure;
+    const task = run(function* () {
+        try {
+            response = yield* call(() => ingest(context, hosted, (value) => response = value));
+            return response;
+        }
+        catch (error) {
+            operationFailure = { error };
+            throw error;
+        }
+    });
+    let stopping;
+    /** Own one halt and join its cleanup; notification observes but never consumes its failure. */
+    const stop = () => {
+        stopping ??= Promise.resolve(task.halt());
+        void stopping.catch(() => { });
+    };
+    context.req.signal.addEventListener("abort", stop, { once: true });
+    if (context.req.signal.aborted)
+        stop();
+    let primary;
+    const cleanup = [];
+    const note = (error) => {
+        if (!cleanup.includes(error))
+            cleanup.push(error);
+    };
+    let haltedCleanly = false;
+    try {
+        await task;
+    }
+    catch (error) {
+        primary = { error };
+    }
+    finally {
+        context.req.signal.removeEventListener("abort", stop);
+        try {
+            await (stopping ?? Promise.resolve(task.halt()));
+            haltedCleanly = true;
+        }
+        catch (error) {
+            note(error);
+        }
+        // Failure may precede reader acquisition; cancellation failure is still this owner's responsibility.
+        if (context.req.body && !context.req.body.locked) {
+            try {
+                await context.req.body.cancel();
+            }
+            catch (error) {
+                if (error !== context.req.signal.reason) {
+                    note(error);
+                }
+            }
+        }
+    }
+    const ownCancellation = context.req.signal.aborted && stopping && haltedCleanly
+        && (!operationFailure || operationFailure.error === context.req.signal.reason);
+    if (primary && !ownCancellation) {
+        const error = primary.error;
+        if (!context.req.signal.aborted && !cleanup.length) {
+            if (error instanceof ParserError || error instanceof ValidationError)
+                return textResponse(error.message, 400);
+        }
+        if (!cleanup.includes(error))
+            cleanup.unshift(error);
+    }
+    // Published output is independent of ingress. A late abort must close it outside status/error mapping.
+    if (response && (context.req.signal.aborted || cleanup.length)) {
+        try {
+            await response.body?.cancel();
+        }
+        catch (error) {
+            note(error);
+        }
+    }
+    if (cleanup.length === 1)
+        throw cleanup[0];
+    if (cleanup.length)
+        throw new AggregateError(cleanup, "HTTP ingress cleanup failed");
+    return context.req.signal.aborted ? textResponse("Request cancelled", 408) : response;
+}
+/**
+ * Parse on demand, dispatch each completed child, and retain only the final response query.
+ *
+ * @param context Request context owning body parsing and response lifetime.
+ * @param hosted Selected hosted endpoint/provenance for this request.
+ * @param publish Synchronous response-publication callback for the request owner; invoked while response resources remain live.
+ * @returns Request-owned response; ordinary queries acknowledge intake and the final authorized mailbox query may stream.
+ */
+function* ingest(context, hosted, publish) {
+    const runtime = context.runtime;
+    let seen = false;
+    let query;
+    // Close and join the request parser before publishing a mailbox response.
+    yield* call(function* () {
+        const controller = new AbortController();
+        const signal = AbortSignal.any([controller.signal, context.req.signal]);
+        try {
+            signal.throwIfAborted();
+            const frames = parse(requestBytes(context.req, { signal }));
+            let pending;
+            // The earlier resource joins the read after processing children stop.
+            yield* ensure(function* () {
+                try {
+                    if (pending) {
+                        try {
+                            yield* call(() => pending);
+                        }
+                        catch (error) {
+                            rethrowCleanupFailure(error, signal);
+                        }
+                    }
+                }
+                finally {
+                    yield* call(() => frames.return());
+                }
+            });
+            while (true) {
+                signal.throwIfAborted();
+                pending = frames.next();
+                let result;
+                try {
+                    result = yield* call(() => pending);
+                }
+                catch (error) {
+                    pending = undefined;
+                    throw error;
+                }
+                pending = undefined;
+                signal.throwIfAborted();
+                if (result.done)
+                    break;
+                const frame = result.value;
+                yield* call(function* () {
+                    query = undefined;
+                    seen = true;
+                    const serder = frame.body;
+                    const route = classifyCesrIngressRoute(context, hosted, serder);
+                    if (serder.ilk === Ilks.qry) {
+                        query = {
+                            serder,
+                            mailbox: route.kind === "mailboxQueryStream",
+                            authorized: false,
+                        };
+                    }
+                    const { decision, mailboxQueryAuthorized } = yield* runtime.protocol.dispatch(frame, {
+                        local: route.kind === "witnessLocalIngress",
+                        mailboxAid: route.kind === "witnessLocalIngress" ? hosted.endpoint?.eid : route.mailboxAid,
+                        escrows: true,
+                    });
+                    if (query) {
+                        // SAIDs exclude attachments: authorize this exact envelope, not an older query cue.
+                        query.transportOnly = decision?.kind === "drop"
+                            && (decision.reason === "missingProcessor" || decision.reason === "replay")
+                            && !["logs", "ksn", "mbx", "tels", "tsn"].includes(query.serder.route ?? "");
+                        query.authorized = decision?.kind !== "drop" && decision?.kind !== "pending"
+                            && decision?.kind !== "missing"
+                            && (!query.mailbox || mailboxQueryAuthorized);
+                    }
+                    if (route.kind === "witnessLocalIngress") {
+                        yield* drainWitnessCues(runtime, route.witnessHab, runtime.cues);
+                    }
+                    else {
+                        yield* drainRuntimeCues(runtime, context.policy.serviceHab, runtime.cues);
+                    }
+                });
+            }
+        }
+        finally {
+            controller.abort();
+        }
+    });
+    if (!seen)
+        return textResponse("Invalid CESR request", 400);
+    if (!query)
+        return jsonNoContentResponse();
+    // Unhandled or cached-replayed custom queries acknowledge transport only; no protocol work is authorized.
+    if (query.transportOnly)
+        return jsonNoContentResponse();
+    if (!query.authorized)
+        return textResponse("Query requester is not authorized", 403);
+    if (query.mailbox) {
+        const response = querySseResponse(context, query.serder.said ?? null);
+        publish(response);
+        return response;
+    }
+    return jsonNoContentResponse();
+}

package/esm/hosting/npm/src/src/http/protocol/endpoints/health.js

@@ -0,0 +1,9 @@
+import { textResponse } from "../responses.js";
+/** Classify `/health` before any runtime-aware routing. */
+export function classifyHealthRoute(context) {
+    return context.pathname === "/health" ? { kind: "health" } : null;
+}
+/** Return the fixed health response. */
+export function handleHealthRoute() {
+    return textResponse("ok", 200);
+}

package/esm/hosting/npm/src/src/http/protocol/endpoints/mailbox-admin.js

@@ -0,0 +1,136 @@
+import { Ilks } from "cesr-ts";
+import { run } from "effection";
+import { chunkBytes, readMailboxAdminRequest, Roles, ValidationError, } from "keri-ts/runtime";
+import { textResponse } from "../responses.js";
+/** Classify mailbox-admin requests before witness or generic ingress routing. */
+export function classifyMailboxAdminRoute(context) {
+    if (!context.runtime || context.method !== "POST") {
+        return null;
+    }
+    if (context.mailboxAdmin?.kind === "ambiguous") {
+        return {
+            kind: "ambiguousHostedPath",
+            message: "Ambiguous mailbox endpoint path",
+        };
+    }
+    if (context.mailboxAdmin?.kind === "one") {
+        return {
+            kind: "mailboxAdmin",
+            mailboxAid: context.mailboxAdmin.endpoint.eid,
+        };
+    }
+    return null;
+}
+/**
+ * Handle mailbox add/remove authorization requests for one hosted mailbox AID.
+ *
+ * Contract:
+ * - request body is either one `application/cesr` stream or one
+ *   `multipart/form-data` request carrying `kel`, optional `delkel`, and `rpy`
+ * - both request shapes normalize to one mailbox authorization CESR stream
+ * - that stream ends in the mailbox authorization `rpy`
+ */
+export async function handleMailboxAdmin(runtime, req, mailboxAid, serviceHab) {
+    let mailboxRequest;
+    try {
+        mailboxRequest = await readMailboxAdminRequest(req);
+    }
+    catch (error) {
+        if (req.signal.aborted)
+            return textResponse("Request cancelled", 408);
+        if (error instanceof ValidationError) {
+            return textResponse(error.message, 400);
+        }
+        return textResponse(String(error), 400);
+    }
+    if (!mailboxRequest) {
+        await req.body?.cancel().catch(() => { });
+        return textResponse("Unacceptable content type.", 406);
+    }
+    const { bytes, inspection } = mailboxRequest;
+    const validation = validateMailboxAuthorizationReply(inspection, mailboxAid);
+    if (validation instanceof Response) {
+        return validation;
+    }
+    const { cid, role, expected } = validation;
+    const task = run(() => settleMailboxAdminIngress(runtime, bytes, mailboxAid, req.signal));
+    /** Request disconnect cancels its owned settlement, including any pending escrow storage. */
+    const stop = () => {
+        void task.halt();
+    };
+    req.signal.addEventListener("abort", stop, { once: true });
+    if (req.signal.aborted)
+        stop();
+    try {
+        await task;
+    }
+    catch (error) {
+        if (req.signal.aborted)
+            return textResponse("Request cancelled", 408);
+        throw error;
+    }
+    finally {
+        req.signal.removeEventListener("abort", stop);
+        await task.halt();
+    }
+    if (req.signal.aborted)
+        return textResponse("Request cancelled", 408);
+    const acceptance = confirmMailboxAuthorization(runtime, cid, mailboxAid, expected);
+    if (acceptance instanceof Response) {
+        return acceptance;
+    }
+    return new Response(JSON.stringify({
+        cid,
+        role,
+        eid: mailboxAid,
+        allowed: expected,
+    }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+    });
+}
+/** Validate the terminal mailbox authorization reply before local acceptance checks. */
+export function validateMailboxAuthorizationReply(inspection, mailboxAid) {
+    const serder = inspection.terminal;
+    if (!serder) {
+        return textResponse("Mailbox authorization stream is required", 400);
+    }
+    if (serder.ilk !== Ilks.rpy) {
+        return textResponse("Mailbox authorization stream must end in rpy", 400);
+    }
+    const route = serder.route ?? "";
+    if (route !== "/end/role/add" && route !== "/end/role/cut") {
+        return textResponse("Unsupported mailbox authorization route", 400);
+    }
+    const data = serder.ked?.a;
+    const cid = typeof data?.cid === "string" ? data.cid : null;
+    const role = typeof data?.role === "string" ? data.role : null;
+    const eid = typeof data?.eid === "string" ? data.eid : null;
+    if (!cid || !role || !eid) {
+        return textResponse("Mailbox authorization reply is missing cid/role/eid", 400);
+    }
+    if (role !== Roles.mailbox) {
+        return textResponse("Mailbox authorization reply must use role=mailbox", 400);
+    }
+    if (eid !== mailboxAid) {
+        return textResponse("Mailbox authorization target does not match hosted mailbox", 403);
+    }
+    return { cid, role, expected: route === "/end/role/add" };
+}
+/** Confirm that mailbox authorization state was accepted locally. */
+export function confirmMailboxAuthorization(runtime, cid, mailboxAid, expected) {
+    const end = runtime.hby.db.ends.get([cid, Roles.mailbox, mailboxAid]);
+    const accepted = expected ? !!end?.allowed : !!end && !end.allowed;
+    if (!accepted) {
+        return textResponse("Mailbox authorization reply was not accepted", 403);
+    }
+    return null;
+}
+/** Settle mailbox-admin CESR ingress without responder-side cue forwarding. */
+export function* settleMailboxAdminIngress(runtime, bytes, mailboxAid, signal) {
+    yield* runtime.reactor.process((owned) => chunkBytes(bytes, { signal: owned }), {
+        mailboxAid,
+        signal,
+        escrows: true,
+    });
+}

package/esm/hosting/npm/src/src/http/protocol/endpoints/oobi.js

@@ -0,0 +1,171 @@
+import { endpointBasePath, fetchEndpointUrls, preferredUrl, Roles } from "keri-ts/runtime";
+import { textResponse } from "../responses.js";
+/** Parse one OOBI-style request path into its route semantics. */
+export function parseOobiRouteRequest(pathname) {
+    const parts = pathname.split("/").filter((part) => part.length > 0);
+    if (parts.length >= 4
+        && parts[0] === ".well-known"
+        && parts[1] === "keri"
+        && parts[2] === "oobi") {
+        return {
+            kind: "wellKnown",
+            aid: parts[3] ?? null,
+            role: Roles.controller,
+        };
+    }
+    if (parts[0] === "oobi") {
+        const value = parts[1] ?? null;
+        if (parts.length === 2) {
+            return {
+                kind: "oobi",
+                aid: value,
+                said: value ?? undefined,
+                role: undefined,
+                eid: undefined,
+            };
+        }
+        return {
+            kind: "oobi",
+            aid: value,
+            role: parts[2],
+            eid: parts[3],
+        };
+    }
+    return null;
+}
+/** Classify OOBI requests after mailbox-admin and witness-specific routes. */
+export function classifyOobiRoute(context) {
+    if (!context.runtime || !context.oobi) {
+        return null;
+    }
+    if (context.hosted?.kind === "ambiguous" && context.policy.hostedPrefixes) {
+        return {
+            kind: "ambiguousHostedPath",
+            message: "Ambiguous hosted endpoint path",
+        };
+    }
+    return { kind: "oobi", request: context.oobi };
+}
+/** Serve one OOBI request from local accepted habitat state. */
+export function handleOobiRoute(context, request) {
+    const runtime = context.runtime;
+    if (request.said) {
+        const schemer = runtime.hby.db.schema.get(request.said);
+        if (schemer) {
+            return new Response(new Blob([schemer.raw.slice().buffer]), {
+                status: 200,
+                headers: {
+                    "Content-Type": "application/schema+json",
+                },
+            });
+        }
+    }
+    const aid = request.aid ?? defaultOobiAid(runtime, context.policy.serviceHab, context.policy.hostedPrefixes);
+    if (!aid) {
+        return textResponse("no blind oobi for this node", 404);
+    }
+    const hosted = context.hosted ?? {
+        kind: "none",
+        endpoint: null,
+        relativePath: null,
+    };
+    const respondingHabAid = selectResponderHab(runtime, hosted, aid, request.eid, context.policy.hostedPrefixes);
+    const hab = respondingHabAid ? runtime.hby.habs.get(respondingHabAid) : undefined;
+    if (!hab) {
+        if (hosted.kind === "ambiguous" && context.policy.hostedPrefixes) {
+            return textResponse("Ambiguous hosted endpoint path", 409);
+        }
+        return textResponse("Not Found", 404);
+    }
+    const body = runtime.replyStreams.openNonEmpty(hab.replyToOobiMessages(aid, request.role, request.eid ? [request.eid] : []));
+    if (!body)
+        return textResponse("Not Found", 404);
+    return new Response(body, {
+        status: 200,
+        headers: {
+            // Both pinned v1 Oobiery implementations require this label; main also
+            // accepts it. OOBI media is distinct from attachment-header POST media.
+            "Content-Type": "application/json+cesr",
+            "KERI-AID": aid,
+            "Oobi-Aid": aid,
+        },
+    });
+}
+/**
+ * Pick the default local AID whose Hab should answer a blind OOBI request when
+ * the request omits an AID.
+ */
+export function defaultOobiAid(runtime, serviceHab, hostedPrefixes) {
+    if (serviceHab?.pre) {
+        return serviceHab.pre;
+    }
+    if (hostedPrefixes?.length === 1) {
+        const candidate = hostedPrefixes[0];
+        if (candidate && runtime.hby.habs.has(candidate)) {
+            return candidate;
+        }
+    }
+    if (runtime.hby.habs.size === 1) {
+        return runtime.hby.habs.keys().next().value;
+    }
+    return undefined;
+}
+/**
+ * Choose which local Hab should answer an OOBI request and return that Hab's
+ * AID.
+ *
+ * Preference order:
+ * - the requested AID itself when locally controlled
+ * - the explicit endpoint AID when it is locally controlled
+ * - the hosted endpoint matched from the request path
+ */
+export function selectResponderHab(runtime, hosted, aid, eid, hostedPrefixes) {
+    const hostedSet = hostedPrefixes ? new Set(hostedPrefixes) : null;
+    const hostedCandidate = (candidate) => {
+        if (!candidate || !runtime.hby.habs.has(candidate)) {
+            return undefined;
+        }
+        if (hostedSet && !hostedSet.has(candidate)) {
+            return undefined;
+        }
+        return candidate;
+    };
+    const rootHostedCandidate = (candidate) => {
+        if (!candidate || !runtime.hby.habs.has(candidate)) {
+            return undefined;
+        }
+        if (hostedSet && !hostedSet.has(candidate)) {
+            return undefined;
+        }
+        const preferred = preferredUrl(fetchEndpointUrls(runtime.hby, candidate));
+        if (!preferred || endpointBasePath(preferred) !== "/") {
+            return undefined;
+        }
+        return candidate;
+    };
+    if (hostedSet) {
+        if (hosted.kind === "ambiguous") {
+            return undefined;
+        }
+        if (hosted.kind === "one") {
+            const hostedAid = hosted.endpoint?.eid;
+            if (hostedAid
+                && runtime.hby.habs.has(hostedAid)
+                && (aid === hostedAid || eid === hostedAid)) {
+                return hostedAid;
+            }
+            return undefined;
+        }
+        return hostedCandidate(aid)
+            ?? hostedCandidate(eid)
+            ?? rootHostedCandidate(aid)
+            ?? rootHostedCandidate(eid);
+    }
+    if (runtime.hby.habs.has(aid)) {
+        return aid;
+    }
+    if (eid && runtime.hby.habs.has(eid)) {
+        return eid;
+    }
+    return hosted.endpoint?.eid ?? undefined;
+}

package/esm/hosting/npm/src/src/http/protocol/endpoints/witness-http.js

@@ -0,0 +1,98 @@
+import { run } from "effection";
+import { CESR_DESTINATION_HEADER, readRequiredCesrRequestBytes, witnessKeyStateGet, witnessQueryGet, witnessReceiptGet, witnessReceiptPost, } from "keri-ts/runtime";
+import { cesrResponse, textResponse } from "../responses.js";
+/** Classify witness-only `/receipts` and `/query` routes ahead of generic ingress. */
+export function classifyWitnessHttpRoute(context) {
+    if (!context.runtime || !context.policy.witnessHab) {
+        return null;
+    }
+    if (context.hosted?.kind === "ambiguous") {
+        return {
+            kind: "ambiguousHostedPath",
+            message: "Ambiguous hosted endpoint path",
+        };
+    }
+    const relativePath = context.hosted?.relativePath ?? context.pathname;
+    if ((context.method === "POST" || context.method === "PUT")
+        && relativePath === "/receipts") {
+        return {
+            kind: "witnessReceiptsPost",
+            witnessHab: context.policy.witnessHab,
+        };
+    }
+    if (context.method === "GET" && relativePath === "/receipts") {
+        return {
+            kind: "witnessReceiptsGet",
+            witnessHab: context.policy.witnessHab,
+        };
+    }
+    if (context.method === "GET" && relativePath === "/query") {
+        return { kind: "witnessQueryGet", witnessHab: context.policy.witnessHab };
+    }
+    if (context.method === "GET" && relativePath === "/ksn") {
+        return { kind: "witnessKeyStateGet", witnessHab: context.policy.witnessHab };
+    }
+    return null;
+}
+/** Handle one witness `/receipts` POST request; `options.local` follows the core receipt policy. */
+export async function handleWitnessReceiptPost(runtime, req, witnessHab, options = {}) {
+    const bytes = await readRequiredCesrRequestBytes(req);
+    if (!bytes) {
+        return textResponse("Unacceptable content type.", 406);
+    }
+    const result = await run(function* () {
+        return yield* witnessReceiptPost(runtime, witnessHab, bytes, options);
+    });
+    if (result.kind === "accepted") {
+        return cesrResponse(result.body, result.status);
+    }
+    if (result.kind === "escrow") {
+        return new Response(null, {
+            status: result.status,
+            headers: { "Content-Type": "application/json" },
+        });
+    }
+    return textResponse(result.message, result.status);
+}
+/** Handle one witness `/receipts` GET request. */
+export function handleWitnessReceiptGet(context, witnessHab) {
+    const snText = context.url.searchParams.get("sn");
+    const sn = snText === null ? null : Number.parseInt(snText, 10);
+    const result = witnessReceiptGet(witnessHab, {
+        pre: context.url.searchParams.get("pre"),
+        sn: Number.isNaN(sn ?? Number.NaN) ? null : sn,
+        said: context.url.searchParams.get("said"),
+    });
+    if (result.kind === "accepted") {
+        return cesrResponse(result.body, result.status);
+    }
+    return textResponse(result.message, result.status);
+}
+/** Handle one witness `/query` GET request. */
+export function handleWitnessQueryGet(context, witnessHab) {
+    const snText = context.url.searchParams.get("sn");
+    const sn = snText === null ? null : Number.parseInt(snText, 10);
+    const runtime = context.runtime;
+    const result = witnessQueryGet(witnessHab, {
+        typ: context.url.searchParams.get("typ"),
+        pre: context.url.searchParams.get("pre"),
+        sn: Number.isNaN(sn ?? Number.NaN) ? null : sn,
+    });
+    if (result.kind === "accepted") {
+        return new Response(runtime.replyStreams.open(result.messages), {
+            status: result.status,
+            headers: { "Content-Type": "application/cesr" },
+        });
+    }
+    return textResponse(result.message, result.status);
+}
+/** Serve the signed witness state-notice contract with explicit destination selection. */
+export function handleWitnessKeyStateGet(context, witnessHab) {
+    const result = witnessKeyStateGet(witnessHab, {
+        pre: context.url.searchParams.get("pre"),
+        destination: context.req.headers.get(CESR_DESTINATION_HEADER),
+    });
+    return result.kind === "accepted"
+        ? cesrResponse(result.body, result.status)
+        : textResponse(result.message, result.status);
+}