[runtime] accept base64url keys and force JSON error responses

Why: runtime signing tests were failing because base64url-encoded key material and ENS TXT values were not decoded reliably, causing signer fallback and HTML Express error pages.

Contract impact: none

Author: GsCommand

server.mjs

@@ -58,6 +58,19 @@ process.on("uncaughtException", (err) => {
 const app = express();
 app.use(express.json({ limit: "2mb" }));
 
+// Force JSON errors (prevents Express HTML error pages)
+app.use((err, req, res, next) => {
+  if (err) {
+    return res.status(400).json({
+      ok: false,
+      error: "invalid_json",
+      message: err.message,
+      ...instancePayload(),
+    });
+  }
+  next();
+});
+
 // basic CORS (no deps)
 app.use((req, res, next) => {
   res.setHeader("Access-Control-Allow-Origin", "*");
@@ -214,9 +227,15 @@ function normalizePemLoose(input) {
 
 function decodeB64Strict(s) {
   try {
-    const cleaned = String(s || "").replace(/\s+/g, "");
+    const cleaned0 = String(s || "").replace(/\s+/g, "");
+    if (!cleaned0) return null;
+
+    let cleaned = cleaned0.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = cleaned.length % 4;
+    if (pad) cleaned += "=".repeat(4 - pad);
+
     const out = Buffer.from(cleaned, "base64");
-    if (out.length === 0 && cleaned.length) return null;
+    if (!out.length) return null;
     return out;
   } catch {
     return null;
@@ -563,10 +582,10 @@ async function withTimeout(promise, ms, label = "timeout") {
 function parseEd25519Txt(txt) {
   if (!txt) return null;
   const s = String(txt).trim();
-  const m = s.match(/^ed25519:([A-Za-z0-9+/=]+)$/i);
+  const m = s.match(/^ed25519:([A-Za-z0-9+/_=-]+)$/i);
   if (!m) return null;
-  const raw = Buffer.from(m[1], "base64");
-  if (raw.length !== 32) return null;
+  const raw = decodeB64Strict(m[1]);
+  if (!raw || raw.length !== 32) return null;
   return raw;
 }
 
@@ -1813,3 +1832,21 @@ app.post("/verify", async (req, res) => {
   }
 });
 // verb routes
+// -----------------------
+for (const verb of ENABLED_VERBS) {
+  app.post(`/${verb}/v${API_VERSION}`, (req, res) => handleVerb(verb, req, res));
+}
+
+// JSON 404 for any unknown routes
+app.use((req, res) => {
+  res.status(404).json({ ok: false, error: "not_found", path: req.path, ...instancePayload() });
+});
+
+// -----------------------
+// boot + listen
+// -----------------------
+initializeSignerConfigOrThrow();
+
+app.listen(PORT, HOST, () => {
+  console.log(`runtime listening on http://${HOST}:${PORT}`);
+});