@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/esm/server/router/express.js

@@ -1,5 +1,62 @@
 import express from "express";
 
+//#region src/utils/validation.ts
+/** Strict string coercion: returns the value only when it's already a string. */
+function toOptionalString(value) {
+	return typeof value === "string" ? value : "";
+}
+/** Ensure a non-empty string starts with `/` (path normalization). */
+function ensureLeadingSlash(value) {
+	const trimmed = String(value ?? "").trim();
+	if (!trimmed) return "";
+	return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+}
+function isString(x) {
+	return typeof x === "string";
+}
+
+//#endregion
+//#region src/server/core/logger.ts
+function safe(fn) {
+	if (!fn) return () => {};
+	return (...args) => {
+		try {
+			fn(...args);
+		} catch {}
+	};
+}
+/**
+* Library code should never call `console.*` directly; the host decides where logs go.
+* - Default: no logs
+* - To enable: pass `logger: console` (or a structured logger) to the host config.
+*/
+function normalizeLogger(logger) {
+	if (!logger) return {
+		debug: () => {},
+		info: () => {},
+		warn: () => {},
+		error: () => {}
+	};
+	const base = logger;
+	const log = typeof base.log === "function" ? base.log.bind(base) : void 0;
+	const debug = typeof base.debug === "function" ? base.debug.bind(base) : log;
+	const info = typeof base.info === "function" ? base.info.bind(base) : log;
+	const warn = typeof base.warn === "function" ? base.warn.bind(base) : log;
+	const error = typeof base.error === "function" ? base.error.bind(base) : log;
+	return {
+		debug: safe(debug),
+		info: safe(info),
+		warn: safe(warn),
+		error: safe(error)
+	};
+}
+const coerceLogger = normalizeLogger;
+
+//#endregion
+//#region src/server/router/logger.ts
+const coerceRouterLogger = coerceLogger;
+
+//#endregion
 //#region src/server/core/SessionService.ts
 function parseCsvList(input) {
 	const out = /* @__PURE__ */ new Set();
@@ -27,9 +84,110 @@ function buildCorsOrigins(...inputs) {
 }
 
 //#endregion
-//#region src/core/WalletIframe/validation.ts
-function isString(x) {
-	return typeof x === "string";
+//#region src/server/router/express/cors.ts
+function withCors(res, opts, req) {
+	if (!opts?.corsOrigins) return;
+	let allowedOrigin;
+	const normalized = buildCorsOrigins(...opts.corsOrigins || []);
+	if (normalized === "*") {
+		allowedOrigin = "*";
+		res.set("Access-Control-Allow-Origin", "*");
+	} else if (Array.isArray(normalized)) {
+		const origin = String(req?.headers?.origin || "").trim();
+		if (origin && normalized.includes(origin)) {
+			allowedOrigin = origin;
+			res.set("Access-Control-Allow-Origin", origin);
+			res.set("Vary", "Origin");
+		}
+	}
+	res.set("Access-Control-Allow-Methods", "GET,POST,OPTIONS");
+	res.set("Access-Control-Allow-Headers", "Content-Type,Authorization");
+	if (allowedOrigin && allowedOrigin !== "*") res.set("Access-Control-Allow-Credentials", "true");
+}
+function installCors(router, opts) {
+	router.use((req, res, next) => {
+		withCors(res, opts, req);
+		const method = String(req?.method || "").toUpperCase();
+		if (opts.corsOrigins && method === "OPTIONS") {
+			res.status(204).send("");
+			return;
+		}
+		next();
+	});
+}
+
+//#endregion
+//#region src/server/router/express/routes/createAccountAndRegisterUser.ts
+function registerCreateAccountAndRegisterUser(router, ctx) {
+	router.post("/create_account_and_register_user", async (req, res) => {
+		try {
+			const { new_account_id, new_public_key, threshold_ed25519, vrf_data, webauthn_registration, deterministic_vrf_public_key, authenticator_options } = req.body || {};
+			if (!new_account_id || typeof new_account_id !== "string") throw new Error("Missing or invalid new_account_id");
+			if (!new_public_key || typeof new_public_key !== "string") throw new Error("Missing or invalid new_public_key");
+			if (!vrf_data || typeof vrf_data !== "object") throw new Error("Missing or invalid vrf_data");
+			if (!webauthn_registration || typeof webauthn_registration !== "object") throw new Error("Missing or invalid webauthn_registration");
+			const threshold = ctx.opts.threshold;
+			const thresholdClientVerifyingShareB64u = threshold_ed25519?.client_verifying_share_b64u?.trim();
+			let thresholdKeygen = null;
+			let thresholdWarning = null;
+			if (thresholdClientVerifyingShareB64u) if (!threshold) thresholdWarning = "threshold signing is not configured on this server";
+			else {
+				const rpId = typeof vrf_data.rp_id === "string" ? String(vrf_data.rp_id || "") : typeof vrf_data.rpId === "string" ? String(vrf_data.rpId || "") : "";
+				if (!rpId.trim()) thresholdWarning = "missing vrf_data.rp_id";
+				else {
+					const out = await threshold.keygenFromClientVerifyingShareForRegistration({
+						nearAccountId: new_account_id,
+						rpId,
+						clientVerifyingShareB64u: thresholdClientVerifyingShareB64u
+					});
+					if (!out.ok) thresholdWarning = out.message || "threshold-ed25519 registration keygen failed";
+					else thresholdKeygen = out;
+				}
+			}
+			const result = await ctx.service.createAccountAndRegisterUser({
+				new_account_id,
+				new_public_key,
+				vrf_data,
+				webauthn_registration,
+				deterministic_vrf_public_key,
+				authenticator_options
+			});
+			let response = result;
+			if (result.success && threshold && thresholdKeygen) try {
+				await threshold.putRelayerKeyMaterial({
+					relayerKeyId: thresholdKeygen.relayerKeyId,
+					publicKey: thresholdKeygen.publicKey,
+					relayerSigningShareB64u: thresholdKeygen.relayerSigningShareB64u,
+					relayerVerifyingShareB64u: thresholdKeygen.relayerVerifyingShareB64u
+				});
+				response = {
+					...response,
+					thresholdEd25519: {
+						relayerKeyId: thresholdKeygen.relayerKeyId,
+						publicKey: thresholdKeygen.publicKey,
+						relayerVerifyingShareB64u: thresholdKeygen.relayerVerifyingShareB64u,
+						clientParticipantId: thresholdKeygen.clientParticipantId,
+						relayerParticipantId: thresholdKeygen.relayerParticipantId,
+						participantIds: thresholdKeygen.participantIds
+					}
+				};
+			} catch (e) {
+				thresholdWarning = thresholdWarning || (e && typeof e === "object" && "message" in e ? String(e.message || "threshold signing persistence failed") : String(e || "threshold signing persistence failed"));
+			}
+			if (result.success && thresholdWarning) response = {
+				...response,
+				message: `${response.message || "Account created and registered successfully"} (threshold enrollment skipped: ${thresholdWarning})`
+			};
+			if (response.success) res.status(200).json(response);
+			else res.status(400).json(response);
+		} catch (error) {
+			const message = error && typeof error === "object" && "message" in error ? String(error.message || "internal error") : "internal error";
+			res.status(500).json({
+				success: false,
+				error: message
+			});
+		}
+	});
 }
 
 //#endregion
@@ -134,6 +292,70 @@ async function handleGetShamirKeyInfo(service) {
 	}
 }
 
+//#endregion
+//#region src/server/router/express/routes/health.ts
+function registerHealthRoutes(router, ctx) {
+	if (ctx.opts.healthz) router.get("/healthz", async (_req, res) => {
+		const shamir = ctx.service.shamirService;
+		const shamirConfigured = Boolean(shamir && shamir.hasShamir());
+		const thresholdConfigured = Boolean(ctx.opts.threshold);
+		let currentKeyId = null;
+		if (shamirConfigured && shamir) try {
+			const payload = JSON.parse((await handleGetShamirKeyInfo(shamir)).body);
+			currentKeyId = payload.currentKeyId || null;
+		} catch {}
+		const proverBaseUrl = ctx.service.emailRecovery?.getZkEmailProverBaseUrl?.() ?? null;
+		const zkEmailConfigured = Boolean(proverBaseUrl);
+		res.status(200).json({
+			ok: true,
+			currentKeyId,
+			shamir: {
+				configured: shamirConfigured,
+				currentKeyId
+			},
+			zkEmail: {
+				configured: zkEmailConfigured,
+				proverBaseUrl
+			},
+			thresholdEd25519: { configured: thresholdConfigured }
+		});
+	});
+	if (ctx.opts.readyz) router.get("/readyz", async (_req, res) => {
+		const shamir = ctx.service.shamirService;
+		const shamirConfigured = Boolean(shamir && shamir.hasShamir());
+		const thresholdConfigured = Boolean(ctx.opts.threshold);
+		let shamirReady = null;
+		let shamirCurrentKeyId = null;
+		let shamirError;
+		if (shamirConfigured && shamir) try {
+			await shamir.ensureReady();
+			shamirReady = true;
+			const payload = JSON.parse((await handleGetShamirKeyInfo(shamir)).body);
+			shamirCurrentKeyId = payload.currentKeyId || null;
+		} catch (e) {
+			shamirReady = false;
+			shamirError = e?.message || String(e);
+		}
+		const zk = ctx.service.emailRecovery ? await ctx.service.emailRecovery.checkZkEmailProverHealth() : {
+			configured: false,
+			baseUrl: null,
+			healthy: null
+		};
+		const ok = (shamirConfigured ? shamirReady === true : true) && (zk.configured ? zk.healthy === true : true);
+		res.status(ok ? 200 : 503).json({
+			ok,
+			shamir: {
+				configured: shamirConfigured,
+				ready: shamirConfigured ? shamirReady : null,
+				currentKeyId: shamirCurrentKeyId,
+				error: shamirError
+			},
+			thresholdEd25519: { configured: thresholdConfigured },
+			zkEmail: zk
+		});
+	});
+}
+
 //#endregion
 //#region src/server/email-recovery/zkEmail/index.ts
 function normalizeForwardableEmailPayload(input) {
@@ -250,254 +472,81 @@ function parseRecoverEmailRequest(body, opts = {}) {
 }
 
 //#endregion
-//#region src/server/core/logger.ts
-function safe(fn) {
-	if (!fn) return () => {};
-	return (...args) => {
+//#region src/server/router/express/routes/recoverEmail.ts
+function registerRecoverEmailRoute(router, ctx) {
+	router.post("/recover-email", async (req, res) => {
 		try {
-			fn(...args);
-		} catch {}
-	};
-}
-/**
-* Library code should never call `console.*` directly; the host decides where logs go.
-* - Default: no logs
-* - To enable: pass `logger: console` (or a structured logger) to the host config.
-*/
-function normalizeLogger(logger) {
-	if (!logger) return {
-		debug: () => {},
-		info: () => {},
-		warn: () => {},
-		error: () => {}
-	};
-	const base = logger;
-	const log = typeof base.log === "function" ? base.log.bind(base) : void 0;
-	const debug = typeof base.debug === "function" ? base.debug.bind(base) : log;
-	const info = typeof base.info === "function" ? base.info.bind(base) : log;
-	const warn = typeof base.warn === "function" ? base.warn.bind(base) : log;
-	const error = typeof base.error === "function" ? base.error.bind(base) : log;
-	return {
-		debug: safe(debug),
-		info: safe(info),
-		warn: safe(warn),
-		error: safe(error)
-	};
+			const prefer = String(req?.headers?.prefer || "").toLowerCase();
+			const respondAsync = prefer.includes("respond-async") || String((req?.query)?.async || "").trim() === "1" || String((req?.query)?.respond_async || "").trim() === "1";
+			const parsed = parseRecoverEmailRequest(req.body, { headers: req.headers });
+			if (!parsed.ok) {
+				res.status(parsed.status).json({
+					code: parsed.code,
+					message: parsed.message
+				});
+				return;
+			}
+			const { accountId, emailBlob, explicitMode } = parsed;
+			if (!ctx.service.emailRecovery) {
+				res.status(503).json({
+					code: "email_recovery_unavailable",
+					message: "EmailRecoveryService is not configured on this server"
+				});
+				return;
+			}
+			if (respondAsync) {
+				ctx.service.emailRecovery.requestEmailRecovery({
+					accountId,
+					emailBlob,
+					explicitMode
+				}).then((result$1) => {
+					ctx.logger.info("[recover-email] async complete", {
+						success: result$1?.success === true,
+						accountId,
+						error: result$1?.success ? void 0 : result$1?.error
+					});
+				}).catch((err) => {
+					ctx.logger.error("[recover-email] async error", {
+						accountId,
+						error: err?.message || String(err)
+					});
+				});
+				res.status(202).json({
+					success: true,
+					queued: true,
+					accountId
+				});
+				return;
+			}
+			const result = await ctx.service.emailRecovery.requestEmailRecovery({
+				accountId,
+				emailBlob,
+				explicitMode
+			});
+			res.status(result.success ? 202 : 400).json(result);
+		} catch (e) {
+			res.status(500).json({
+				code: "internal",
+				message: e?.message || "Internal error"
+			});
+		}
+	});
 }
 
 //#endregion
-//#region src/server/router/logger.ts
-const normalizeRouterLogger = normalizeLogger;
+//#region src/server/router/relay.ts
+function parseSessionKind(body) {
+	const v = body && typeof body === "object" && !Array.isArray(body) ? body : {};
+	const raw = v.sessionKind ?? v.session_kind;
+	return raw === "cookie" ? "cookie" : "jwt";
+}
 
 //#endregion
-//#region src/server/router/express-adaptor.ts
-function normalizePath(path) {
-	const trimmed = String(path || "").trim();
-	if (!trimmed) return "";
-	return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
-}
-function withCors(res, opts, req) {
-	if (!opts?.corsOrigins) return;
-	let allowedOrigin;
-	const normalized = buildCorsOrigins(...opts.corsOrigins || []);
-	if (normalized === "*") {
-		allowedOrigin = "*";
-		res.set("Access-Control-Allow-Origin", "*");
-	} else if (Array.isArray(normalized)) {
-		const origin = String(req?.headers?.origin || "").trim();
-		if (origin && normalized.includes(origin)) {
-			allowedOrigin = origin;
-			res.set("Access-Control-Allow-Origin", origin);
-			res.set("Vary", "Origin");
-		}
-	}
-	res.set("Access-Control-Allow-Methods", "GET,POST,OPTIONS");
-	res.set("Access-Control-Allow-Headers", "Content-Type,Authorization");
-	if (allowedOrigin && allowedOrigin !== "*") res.set("Access-Control-Allow-Credentials", "true");
-}
-function createRelayRouter(service, opts = {}) {
-	const router = express.Router();
-	const mePath = opts.sessionRoutes?.auth || "/session/auth";
-	const logoutPath = opts.sessionRoutes?.logout || "/session/logout";
-	const logger = normalizeRouterLogger(opts.logger);
-	const signedDelegatePath = (() => {
-		if (!opts.signedDelegate) return "";
-		const raw = String(opts.signedDelegate.route || "").trim();
-		if (!raw) throw new Error("RelayRouterOptions.signedDelegate.route is required");
-		return normalizePath(raw);
-	})();
-	const signedDelegatePolicy = opts.signedDelegate?.policy;
-	router.use((req, res, next) => {
-		withCors(res, opts, req);
-		const method = String(req?.method || "").toUpperCase();
-		if (opts.corsOrigins && method === "OPTIONS") {
-			res.status(204).send("");
-			return;
-		}
-		next();
-	});
-	router.post("/create_account_and_register_user", async (req, res) => {
-		try {
-			const { new_account_id, new_public_key, vrf_data, webauthn_registration, deterministic_vrf_public_key, authenticator_options } = req.body || {};
-			if (!new_account_id || typeof new_account_id !== "string") throw new Error("Missing or invalid new_account_id");
-			if (!new_public_key || typeof new_public_key !== "string") throw new Error("Missing or invalid new_public_key");
-			if (!vrf_data || typeof vrf_data !== "object") throw new Error("Missing or invalid vrf_data");
-			if (!webauthn_registration || typeof webauthn_registration !== "object") throw new Error("Missing or invalid webauthn_registration");
-			const result = await service.createAccountAndRegisterUser({
-				new_account_id,
-				new_public_key,
-				vrf_data,
-				webauthn_registration,
-				deterministic_vrf_public_key,
-				authenticator_options
-			});
-			if (result.success) res.status(200).json(result);
-			else res.status(400).json(result);
-		} catch (error) {
-			res.status(500).json({
-				success: false,
-				error: error?.message || "internal error"
-			});
-		}
-	});
-	if (signedDelegatePath) {
-		router.options(signedDelegatePath, (_req, res) => {
-			res.sendStatus(204);
-		});
-		router.post(signedDelegatePath, async (req, res) => {
-			try {
-				const { hash, signedDelegate } = req.body || {};
-				if (typeof hash !== "string" || !hash || !signedDelegate) {
-					res.status(400).json({
-						ok: false,
-						code: "invalid_body",
-						message: "Expected { hash, signedDelegate }"
-					});
-					return;
-				}
-				const result = await service.executeSignedDelegate({
-					hash,
-					signedDelegate,
-					policy: signedDelegatePolicy
-				});
-				if (!result || !result.ok) {
-					res.status(400).json({
-						ok: false,
-						code: result?.code || "delegate_execution_failed",
-						message: result?.error || "Failed to execute delegate action"
-					});
-					return;
-				}
-				res.status(200).json({
-					ok: true,
-					relayerTxHash: result.transactionHash || null,
-					status: "submitted",
-					outcome: result.outcome ?? null
-				});
-			} catch (e) {
-				res.status(500).json({
-					ok: false,
-					code: "internal",
-					message: e?.message || "Internal error while executing delegate action"
-				});
-			}
-		});
-	}
-	router.post("/vrf/apply-server-lock", async (req, res) => {
-		const shamir = service.shamirService;
-		if (!shamir || !shamir.hasShamir()) return res.status(503).json({
-			error: "shamir_disabled",
-			message: "Shamir 3-pass is not configured on this server"
-		});
-		try {
-			const serverResponse = await handleApplyServerLock(shamir, { body: req.body });
-			Object.entries(serverResponse.headers).forEach(([k, v]) => res.set(k, v));
-			res.status(serverResponse.status);
-			res.send(JSON.parse(serverResponse.body));
-		} catch (e) {
-			res.status(500).json({
-				error: "internal",
-				details: e?.message
-			});
-		}
-	});
-	router.post("/vrf/remove-server-lock", async (req, res) => {
-		const shamir = service.shamirService;
-		if (!shamir || !shamir.hasShamir()) return res.status(503).json({
-			error: "shamir_disabled",
-			message: "Shamir 3-pass is not configured on this server"
-		});
+//#region src/server/router/express/routes/sessions.ts
+function registerSessionRoutes(router, ctx) {
+	router.get(ctx.mePath, async (req, res) => {
 		try {
-			const serverResponse = await handleRemoveServerLock(shamir, { body: req.body });
-			Object.entries(serverResponse.headers).forEach(([k, v]) => res.set(k, v));
-			res.status(serverResponse.status);
-			res.send(JSON.parse(serverResponse.body));
-		} catch (e) {
-			res.status(500).json({
-				error: "internal",
-				details: e?.message
-			});
-		}
-	});
-	router.post("/verify-authentication-response", async (req, res) => {
-		try {
-			if (!req?.body) {
-				res.status(400).json({
-					code: "invalid_body",
-					message: "Request body is required"
-				});
-				return;
-			}
-			const body = req.body;
-			const valid = body && body.vrf_data && body.webauthn_authentication;
-			if (!valid) {
-				res.status(400).json({
-					code: "invalid_body",
-					message: "vrf_data and webauthn_authentication are required"
-				});
-				return;
-			}
-			const result = await service.verifyAuthenticationResponse(body);
-			const status = result.success ? 200 : 400;
-			if (status !== 200) {
-				res.status(status).json({
-					code: "not_verified",
-					message: result.message || "Authentication verification failed"
-				});
-				return;
-			}
-			const sessionKind = (body?.sessionKind || body?.session_kind) === "cookie" ? "cookie" : "jwt";
-			const session = opts.session;
-			if (session && result.verified) try {
-				const sub = String(body.vrf_data.user_id || "");
-				const token = await session.signJwt(sub, {
-					rpId: body.vrf_data.rp_id,
-					blockHeight: body.vrf_data.block_height
-				});
-				logger.info(`[relay] creating ${sessionKind === "cookie" ? "HttpOnly session" : "JWT"} for`, sub);
-				if (sessionKind === "cookie") {
-					res.set("Set-Cookie", session.buildSetCookie(token));
-					const { jwt: _omit,...rest } = result;
-					res.status(200).json(rest);
-					return;
-				}
-				res.status(200).json({
-					...result,
-					jwt: token
-				});
-				return;
-			} catch (e) {}
-			res.status(200).json(result);
-		} catch (e) {
-			res.status(500).json({
-				code: "internal",
-				message: e?.message || "Internal error"
-			});
-		}
-	});
-	router.get(mePath, async (req, res) => {
-		try {
-			const session = opts.session;
+			const session = ctx.opts.session;
 			if (!session) {
 				res.status(501).json({
 					authenticated: false,
@@ -527,9 +576,9 @@ function createRelayRouter(service, opts = {}) {
 			});
 		}
 	});
-	router.post(logoutPath, async (_req, res) => {
+	router.post(ctx.logoutPath, async (_req, res) => {
 		try {
-			const session = opts.session;
+			const session = ctx.opts.session;
 			if (session) res.set("Set-Cookie", session.buildClearCookie());
 			res.status(200).json({ success: true });
 		} catch (e) {
@@ -542,8 +591,8 @@ function createRelayRouter(service, opts = {}) {
 	});
 	router.post("/session/refresh", async (req, res) => {
 		try {
-			const sessionKind = (req.body || {}).sessionKind === "cookie" ? "cookie" : (req.body || {}).session_kind === "cookie" ? "cookie" : "jwt";
-			const session = opts.session;
+			const sessionKind = parseSessionKind(req.body || {});
+			const session = ctx.opts.session;
 			if (!session) {
 				res.status(501).json({
 					code: "sessions_disabled",
@@ -575,65 +624,49 @@ function createRelayRouter(service, opts = {}) {
 			});
 		}
 	});
-	router.post("/recover-email", async (req, res) => {
+}
+
+//#endregion
+//#region src/server/router/express/routes/shamir.ts
+function registerShamirRoutes(router, ctx) {
+	router.post("/vrf/apply-server-lock", async (req, res) => {
+		const shamir = ctx.service.shamirService;
+		if (!shamir || !shamir.hasShamir()) return res.status(503).json({
+			error: "shamir_disabled",
+			message: "Shamir 3-pass is not configured on this server"
+		});
 		try {
-			const prefer = String(req?.headers?.prefer || "").toLowerCase();
-			const respondAsync = prefer.includes("respond-async") || String((req?.query)?.async || "").trim() === "1" || String((req?.query)?.respond_async || "").trim() === "1";
-			const parsed = parseRecoverEmailRequest(req.body, { headers: req.headers });
-			if (!parsed.ok) {
-				res.status(parsed.status).json({
-					code: parsed.code,
-					message: parsed.message
-				});
-				return;
-			}
-			const { accountId, emailBlob, explicitMode } = parsed;
-			if (!service.emailRecovery) {
-				res.status(503).json({
-					code: "email_recovery_unavailable",
-					message: "EmailRecoveryService is not configured on this server"
-				});
-				return;
-			}
-			if (respondAsync) {
-				service.emailRecovery.requestEmailRecovery({
-					accountId,
-					emailBlob,
-					explicitMode
-				}).then((result$1) => {
-					logger.info("[recover-email] async complete", {
-						success: result$1?.success === true,
-						accountId,
-						error: result$1?.success ? void 0 : result$1?.error
-					});
-				}).catch((err) => {
-					logger.error("[recover-email] async error", {
-						accountId,
-						error: err?.message || String(err)
-					});
-				});
-				res.status(202).json({
-					success: true,
-					queued: true,
-					accountId
-				});
-				return;
-			}
-			const result = await service.emailRecovery.requestEmailRecovery({
-				accountId,
-				emailBlob,
-				explicitMode
+			const serverResponse = await handleApplyServerLock(shamir, { body: req.body });
+			Object.entries(serverResponse.headers).forEach(([k, v]) => res.set(k, v));
+			res.status(serverResponse.status);
+			res.send(JSON.parse(serverResponse.body));
+		} catch (e) {
+			res.status(500).json({
+				error: "internal",
+				details: e?.message
 			});
-			res.status(result.success ? 202 : 400).json(result);
+		}
+	});
+	router.post("/vrf/remove-server-lock", async (req, res) => {
+		const shamir = ctx.service.shamirService;
+		if (!shamir || !shamir.hasShamir()) return res.status(503).json({
+			error: "shamir_disabled",
+			message: "Shamir 3-pass is not configured on this server"
+		});
+		try {
+			const serverResponse = await handleRemoveServerLock(shamir, { body: req.body });
+			Object.entries(serverResponse.headers).forEach(([k, v]) => res.set(k, v));
+			res.status(serverResponse.status);
+			res.send(JSON.parse(serverResponse.body));
 		} catch (e) {
 			res.status(500).json({
-				code: "internal",
-				message: e?.message || "Internal error"
+				error: "internal",
+				details: e?.message
 			});
 		}
 	});
 	router.get("/shamir/key-info", async (_req, res) => {
-		const shamir = service.shamirService;
+		const shamir = ctx.service.shamirService;
 		if (!shamir || !shamir.hasShamir()) return res.status(503).json({
 			error: "shamir_disabled",
 			message: "Shamir 3-pass is not configured on this server"
@@ -650,65 +683,449 @@ function createRelayRouter(service, opts = {}) {
 			});
 		}
 	});
-	if (opts.healthz) router.get("/healthz", async (_req, res) => {
-		const shamir = service.shamirService;
-		const shamirConfigured = Boolean(shamir && shamir.hasShamir());
-		let currentKeyId = null;
-		if (shamirConfigured && shamir) try {
-			const payload = JSON.parse((await handleGetShamirKeyInfo(shamir)).body);
-			currentKeyId = payload.currentKeyId || null;
-		} catch {}
-		const proverBaseUrl = service.emailRecovery?.getZkEmailProverBaseUrl?.() ?? null;
-		const zkEmailConfigured = Boolean(proverBaseUrl);
-		res.status(200).json({
-			ok: true,
-			currentKeyId,
-			shamir: {
-				configured: shamirConfigured,
-				currentKeyId
-			},
-			zkEmail: {
-				configured: zkEmailConfigured,
-				proverBaseUrl
+}
+
+//#endregion
+//#region src/server/router/express/routes/signedDelegate.ts
+function registerSignedDelegateRoutes(router, ctx) {
+	if (!ctx.signedDelegatePath) return;
+	router.options(ctx.signedDelegatePath, (_req, res) => {
+		res.sendStatus(204);
+	});
+	router.post(ctx.signedDelegatePath, async (req, res) => {
+		try {
+			const { hash, signedDelegate } = req.body || {};
+			if (typeof hash !== "string" || !hash || !signedDelegate) {
+				res.status(400).json({
+					ok: false,
+					code: "invalid_body",
+					message: "Expected { hash, signedDelegate }"
+				});
+				return;
+			}
+			const result = await ctx.service.executeSignedDelegate({
+				hash,
+				signedDelegate,
+				policy: ctx.signedDelegatePolicy
+			});
+			if (!result || !result.ok) {
+				res.status(400).json({
+					ok: false,
+					code: result?.code || "delegate_execution_failed",
+					message: result?.error || "Failed to execute delegate action"
+				});
+				return;
 			}
+			res.status(200).json({
+				ok: true,
+				relayerTxHash: result.transactionHash || null,
+				status: "submitted",
+				outcome: result.outcome ?? null
+			});
+		} catch (e) {
+			res.status(500).json({
+				ok: false,
+				code: "internal",
+				message: e?.message || "Internal error while executing delegate action"
+			});
+		}
+	});
+}
+
+//#endregion
+//#region src/server/threshold/statusCodes.ts
+function thresholdEd25519StatusCode(result) {
+	if (result.ok) return 200;
+	switch (result.code) {
+		case "not_found": return 404;
+		case "not_implemented": return 501;
+		case "threshold_disabled": return 503;
+		case "internal": return 500;
+		case "unauthorized": return 401;
+		default: return 400;
+	}
+}
+
+//#endregion
+//#region src/server/core/ThresholdService/validation.ts
+function isObject(v) {
+	return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function parseThresholdEd25519SessionClaims(raw) {
+	if (!isObject(raw)) return null;
+	const kind = toOptionalString(raw.kind);
+	if (kind !== "threshold_ed25519_session_v1") return null;
+	const sub = toOptionalString(raw.sub);
+	const sessionId = toOptionalString(raw.sessionId);
+	const relayerKeyId = toOptionalString(raw.relayerKeyId);
+	const rpId = toOptionalString(raw.rpId);
+	if (!sub || !sessionId || !relayerKeyId || !rpId) return null;
+	return {
+		sub,
+		kind,
+		sessionId,
+		relayerKeyId,
+		rpId
+	};
+}
+
+//#endregion
+//#region src/server/router/commonRouterUtils.ts
+function isPlainObject(input) {
+	return !!input && typeof input === "object" && !Array.isArray(input);
+}
+function summarizeVrfData(input) {
+	if (!isPlainObject(input)) return void 0;
+	const user_id = typeof input.user_id === "string" ? input.user_id : void 0;
+	const rp_id = typeof input.rp_id === "string" ? input.rp_id : void 0;
+	const block_height = typeof input.block_height === "number" ? input.block_height : void 0;
+	const has_intent_digest_32 = Array.isArray(input.intent_digest_32) ? true : void 0;
+	const intent_digest_32_len = Array.isArray(input.intent_digest_32) ? input.intent_digest_32.length : void 0;
+	const has_session_policy_digest_32 = Array.isArray(input.session_policy_digest_32) ? true : void 0;
+	const session_policy_digest_32_len = Array.isArray(input.session_policy_digest_32) ? input.session_policy_digest_32.length : void 0;
+	return {
+		...user_id ? { user_id } : {},
+		...rp_id ? { rp_id } : {},
+		...block_height != null ? { block_height } : {},
+		...has_intent_digest_32 != null ? { has_intent_digest_32 } : {},
+		...intent_digest_32_len != null ? { intent_digest_32_len } : {},
+		...has_session_policy_digest_32 != null ? { has_session_policy_digest_32 } : {},
+		...session_policy_digest_32_len != null ? { session_policy_digest_32_len } : {}
+	};
+}
+function looksLikeWebauthnAuthorizeBody(input) {
+	if (!isPlainObject(input)) return false;
+	return isPlainObject(input.vrf_data) && isPlainObject(input.webauthn_authentication);
+}
+async function validateThresholdEd25519AuthorizeInputs(input) {
+	if (looksLikeWebauthnAuthorizeBody(input.body)) return {
+		ok: true,
+		mode: "webauthn",
+		request: input.body
+	};
+	const session = input.session;
+	if (!session) return {
+		ok: false,
+		code: "sessions_disabled",
+		message: "Sessions are not configured on this server"
+	};
+	const parsed = await session.parse(input.headers);
+	if (!parsed.ok) return {
+		ok: false,
+		code: "unauthorized",
+		message: "Missing or invalid threshold session token"
+	};
+	const claims = parseThresholdEd25519SessionClaims(parsed.claims);
+	if (!claims) return {
+		ok: false,
+		code: "unauthorized",
+		message: "Invalid threshold session token claims"
+	};
+	const requestBody = isPlainObject(input.body) ? input.body : {};
+	return {
+		ok: true,
+		mode: "session",
+		sessionId: claims.sessionId,
+		userId: claims.sub,
+		request: requestBody
+	};
+}
+
+//#endregion
+//#region src/server/router/express/routes/thresholdEd25519.ts
+function errMessage(e) {
+	if (e && typeof e === "object" && "message" in e) return String(e.message || "Internal error");
+	return String(e || "Internal error");
+}
+async function handle(ctx, req, res, route, requestMeta, fn) {
+	try {
+		ctx.logger.info("[threshold-ed25519] request", {
+			route,
+			method: req.method,
+			...requestMeta || {}
+		});
+		const result = await fn();
+		const status = thresholdEd25519StatusCode(result);
+		ctx.logger.info("[threshold-ed25519] response", {
+			route,
+			status,
+			ok: result.ok,
+			...result.code ? { code: result.code } : {}
+		});
+		res.status(status).json(result);
+	} catch (e) {
+		ctx.logger.error("[threshold-ed25519] error", {
+			route,
+			message: errMessage(e),
+			...requestMeta || {}
+		});
+		res.status(500).json({
+			ok: false,
+			code: "internal",
+			message: errMessage(e)
+		});
+	}
+}
+function registerThresholdEd25519Routes(router, ctx) {
+	ctx.logger.info("[threshold-ed25519] routes", { enabled: Boolean(ctx.opts.threshold) });
+	router.get("/threshold-ed25519/healthz", async (req, res) => {
+		await handle(ctx, req, res, "/threshold-ed25519/healthz", {}, async () => {
+			const threshold = ctx.opts.threshold;
+			if (!threshold) return {
+				ok: false,
+				configured: false,
+				code: "threshold_disabled",
+				message: "Threshold signing is not configured on this server"
+			};
+			return {
+				ok: true,
+				configured: true
+			};
 		});
 	});
-	if (opts.readyz) router.get("/readyz", async (_req, res) => {
-		const shamir = service.shamirService;
-		const shamirConfigured = Boolean(shamir && shamir.hasShamir());
-		let shamirReady = null;
-		let shamirCurrentKeyId = null;
-		let shamirError;
-		if (shamirConfigured && shamir) try {
-			await shamir.ensureReady();
-			shamirReady = true;
-			const payload = JSON.parse((await handleGetShamirKeyInfo(shamir)).body);
-			shamirCurrentKeyId = payload.currentKeyId || null;
+	router.post("/threshold-ed25519/keygen", async (req, res) => {
+		const body = req.body || {};
+		await handle(ctx, req, res, "/threshold-ed25519/keygen", {
+			nearAccountId: typeof body.nearAccountId === "string" ? body.nearAccountId : void 0,
+			clientVerifyingShareB64u_len: typeof body.clientVerifyingShareB64u === "string" ? body.clientVerifyingShareB64u.length : void 0,
+			registrationTxHash: "registrationTxHash" in body && typeof body.registrationTxHash === "string" ? body.registrationTxHash : void 0,
+			vrf_data: summarizeVrfData(body.vrf_data)
+		}, async () => {
+			const threshold = ctx.opts.threshold;
+			if (!threshold) return {
+				ok: false,
+				code: "threshold_disabled",
+				message: "Threshold signing is not configured on this server"
+			};
+			return threshold.thresholdEd25519Keygen(body);
+		});
+	});
+	router.post("/threshold-ed25519/session", async (req, res) => {
+		const body = req.body || {};
+		await handle(ctx, req, res, "/threshold-ed25519/session", {
+			relayerKeyId: typeof body.relayerKeyId === "string" ? body.relayerKeyId : void 0,
+			clientVerifyingShareB64u_len: typeof body.clientVerifyingShareB64u === "string" ? body.clientVerifyingShareB64u.length : void 0,
+			sessionPolicy: body.sessionPolicy ? { version: body.sessionPolicy.version } : void 0,
+			vrf_data: summarizeVrfData(body.vrf_data)
+		}, async () => {
+			const threshold = ctx.opts.threshold;
+			if (!threshold) return {
+				ok: false,
+				code: "threshold_disabled",
+				message: "Threshold signing is not configured on this server"
+			};
+			const session = ctx.opts.session;
+			if (!session) return {
+				ok: false,
+				code: "sessions_disabled",
+				message: "Sessions are not configured on this server"
+			};
+			const result = await threshold.thresholdEd25519Session(body);
+			if (!result.ok) return result;
+			const sessionId = String(result.sessionId || "").trim();
+			if (!sessionId) return {
+				ok: false,
+				code: "internal",
+				message: "threshold session missing sessionId"
+			};
+			const userId = body.vrf_data.user_id;
+			const rpId = body.vrf_data.rp_id;
+			const relayerKeyId = body.relayerKeyId;
+			const token = await session.signJwt(userId, {
+				kind: "threshold_ed25519_session_v1",
+				sessionId,
+				relayerKeyId,
+				rpId
+			});
+			const sessionKind = parseSessionKind(body);
+			if (sessionKind === "cookie") {
+				res.set("Set-Cookie", session.buildSetCookie(token));
+				const { jwt: _omit,...rest } = result;
+				return {
+					...rest,
+					ok: true
+				};
+			}
+			return {
+				...result,
+				jwt: token
+			};
+		});
+	});
+	router.post("/threshold-ed25519/authorize", async (req, res) => {
+		const bodyUnknown = req.body || {};
+		const body = bodyUnknown || {};
+		await handle(ctx, req, res, "/threshold-ed25519/authorize", {
+			relayerKeyId: typeof body.relayerKeyId === "string" ? body.relayerKeyId : void 0,
+			clientVerifyingShareB64u_len: typeof body.clientVerifyingShareB64u === "string" ? body.clientVerifyingShareB64u.length : void 0,
+			purpose: typeof body.purpose === "string" ? body.purpose : void 0,
+			signing_digest_32_len: Array.isArray(body.signing_digest_32) ? body.signing_digest_32.length : void 0,
+			vrf_data: summarizeVrfData(body.vrf_data)
+		}, async () => {
+			const threshold = ctx.opts.threshold;
+			if (!threshold) return {
+				ok: false,
+				code: "threshold_disabled",
+				message: "Threshold signing is not configured on this server"
+			};
+			const validated = await validateThresholdEd25519AuthorizeInputs({
+				body: bodyUnknown,
+				headers: req.headers || {},
+				session: ctx.opts.session
+			});
+			if (!validated.ok) return validated;
+			if (validated.mode === "webauthn") return threshold.authorizeThresholdEd25519(validated.request);
+			return threshold.authorizeThresholdEd25519WithSession({
+				sessionId: validated.sessionId,
+				userId: validated.userId,
+				request: validated.request
+			});
+		});
+	});
+	router.post("/threshold-ed25519/sign/init", async (req, res) => {
+		const body = req.body || {};
+		await handle(ctx, req, res, "/threshold-ed25519/sign/init", {
+			mpcSessionId: typeof body.mpcSessionId === "string" ? body.mpcSessionId : void 0,
+			relayerKeyId: typeof body.relayerKeyId === "string" ? body.relayerKeyId : void 0,
+			nearAccountId: typeof body.nearAccountId === "string" ? body.nearAccountId : void 0,
+			signingDigestB64u_len: typeof body.signingDigestB64u === "string" ? body.signingDigestB64u.length : void 0
+		}, async () => {
+			const threshold = ctx.opts.threshold;
+			if (!threshold) return {
+				ok: false,
+				code: "threshold_disabled",
+				message: "Threshold signing is not configured on this server"
+			};
+			return threshold.thresholdEd25519SignInit(body);
+		});
+	});
+	router.post("/threshold-ed25519/sign/finalize", async (req, res) => {
+		const body = req.body || {};
+		await handle(ctx, req, res, "/threshold-ed25519/sign/finalize", {
+			signingSessionId: typeof body.signingSessionId === "string" ? body.signingSessionId : void 0,
+			clientSignatureShareB64u_len: typeof body.clientSignatureShareB64u === "string" ? body.clientSignatureShareB64u.length : void 0
+		}, async () => {
+			const threshold = ctx.opts.threshold;
+			if (!threshold) return {
+				ok: false,
+				code: "threshold_disabled",
+				message: "Threshold signing is not configured on this server"
+			};
+			return threshold.thresholdEd25519SignFinalize(body);
+		});
+	});
+	router.post("/threshold-ed25519/internal/cosign/init", async (req, res) => {
+		const body = req.body || {};
+		await handle(ctx, req, res, "/threshold-ed25519/internal/cosign/init", {
+			coordinatorGrant_len: typeof body.coordinatorGrant === "string" ? body.coordinatorGrant.length : void 0,
+			signingSessionId: typeof body.signingSessionId === "string" ? body.signingSessionId : void 0,
+			cosignerShareB64u_len: typeof body.cosignerShareB64u === "string" ? body.cosignerShareB64u.length : void 0
+		}, async () => {
+			const threshold = ctx.opts.threshold;
+			if (!threshold) return {
+				ok: false,
+				code: "threshold_disabled",
+				message: "Threshold signing is not configured on this server"
+			};
+			if (!threshold.thresholdEd25519CosignInit) return {
+				ok: false,
+				code: "not_found",
+				message: "threshold-ed25519 cosigner endpoints are not enabled on this server"
+			};
+			return threshold.thresholdEd25519CosignInit(body);
+		});
+	});
+	router.post("/threshold-ed25519/internal/cosign/finalize", async (req, res) => {
+		const body = req.body || {};
+		await handle(ctx, req, res, "/threshold-ed25519/internal/cosign/finalize", {
+			coordinatorGrant_len: typeof body.coordinatorGrant === "string" ? body.coordinatorGrant.length : void 0,
+			signingSessionId: typeof body.signingSessionId === "string" ? body.signingSessionId : void 0,
+			cosignerIds_len: Array.isArray(body.cosignerIds) ? body.cosignerIds.length : void 0
+		}, async () => {
+			const threshold = ctx.opts.threshold;
+			if (!threshold) return {
+				ok: false,
+				code: "threshold_disabled",
+				message: "Threshold signing is not configured on this server"
+			};
+			if (!threshold.thresholdEd25519CosignFinalize) return {
+				ok: false,
+				code: "not_found",
+				message: "threshold-ed25519 cosigner endpoints are not enabled on this server"
+			};
+			return threshold.thresholdEd25519CosignFinalize(body);
+		});
+	});
+}
+
+//#endregion
+//#region src/server/router/express/routes/verifyAuthenticationResponse.ts
+function registerVerifyAuthenticationResponse(router, ctx) {
+	router.post("/verify-authentication-response", async (req, res) => {
+		try {
+			if (!req?.body) {
+				res.status(400).json({
+					code: "invalid_body",
+					message: "Request body is required"
+				});
+				return;
+			}
+			const body = req.body;
+			const valid = body && body.vrf_data && body.webauthn_authentication;
+			if (!valid) {
+				res.status(400).json({
+					code: "invalid_body",
+					message: "vrf_data and webauthn_authentication are required"
+				});
+				return;
+			}
+			const result = await ctx.service.verifyAuthenticationResponse(body);
+			const status = result.success ? 200 : 400;
+			if (status !== 200) {
+				res.status(status).json({
+					code: "not_verified",
+					message: result.message || "Authentication verification failed"
+				});
+				return;
+			}
+			const sessionKind = parseSessionKind(body);
+			const session = ctx.opts.session;
+			if (session && result.verified) try {
+				const sub = String(body.vrf_data.user_id || "");
+				const token = await session.signJwt(sub, {
+					rpId: body.vrf_data.rp_id,
+					blockHeight: body.vrf_data.block_height
+				});
+				ctx.logger.info(`[relay] creating ${sessionKind === "cookie" ? "HttpOnly session" : "JWT"} for`, sub);
+				if (sessionKind === "cookie") {
+					res.set("Set-Cookie", session.buildSetCookie(token));
+					const { jwt: _omit,...rest } = result;
+					res.status(200).json(rest);
+					return;
+				}
+				res.status(200).json({
+					...result,
+					jwt: token
+				});
+				return;
+			} catch (e) {}
+			res.status(200).json(result);
 		} catch (e) {
-			shamirReady = false;
-			shamirError = e?.message || String(e);
+			res.status(500).json({
+				code: "internal",
+				message: e?.message || "Internal error"
+			});
 		}
-		const zk = service.emailRecovery ? await service.emailRecovery.checkZkEmailProverHealth() : {
-			configured: false,
-			baseUrl: null,
-			healthy: null
-		};
-		const ok = (shamirConfigured ? shamirReady === true : true) && (zk.configured ? zk.healthy === true : true);
-		res.status(ok ? 200 : 503).json({
-			ok,
-			shamir: {
-				configured: shamirConfigured,
-				ready: shamirConfigured ? shamirReady : null,
-				currentKeyId: shamirCurrentKeyId,
-				error: shamirError
-			},
-			zkEmail: zk
-		});
 	});
+}
+
+//#endregion
+//#region src/server/router/express/routes/wellKnown.ts
+function registerWellKnownRoutes(router, ctx) {
 	const wellKnownPaths = ["/.well-known/webauthn", "/.well-known/webauthn/"];
 	for (const p of wellKnownPaths) router.get(p, async (_req, res) => {
 		try {
-			const origins = await service.getRorOrigins();
+			const origins = await ctx.service.getRorOrigins();
 			res.set("Content-Type", "application/json; charset=utf-8");
 			res.set("Cache-Control", "max-age=60, stale-while-revalidate=600");
 			res.status(200).send(JSON.stringify({ origins }));
@@ -716,10 +1133,55 @@ function createRelayRouter(service, opts = {}) {
 			res.status(200).json({ origins: [] });
 		}
 	});
+}
+
+//#endregion
+//#region src/server/router/routerOptions.ts
+function resolveThresholdOption(service, opts) {
+	return opts.threshold !== void 0 ? opts.threshold : service.getThresholdSigningService();
+}
+
+//#endregion
+//#region src/server/router/express/createRelayRouter.ts
+function createRelayRouter(service, opts = {}) {
+	const router = express.Router();
+	const threshold = resolveThresholdOption(service, opts);
+	const effectiveOpts = {
+		...opts,
+		threshold
+	};
+	const mePath = effectiveOpts.sessionRoutes?.auth || "/session/auth";
+	const logoutPath = effectiveOpts.sessionRoutes?.logout || "/session/logout";
+	const logger = coerceRouterLogger(effectiveOpts.logger);
+	let signedDelegatePath = "";
+	if (effectiveOpts.signedDelegate) signedDelegatePath = ensureLeadingSlash(effectiveOpts.signedDelegate.route) || "/signed-delegate";
+	const signedDelegatePolicy = effectiveOpts.signedDelegate?.policy;
+	installCors(router, effectiveOpts);
+	const ctx = {
+		service,
+		opts: effectiveOpts,
+		logger,
+		mePath,
+		logoutPath,
+		signedDelegatePath,
+		signedDelegatePolicy
+	};
+	registerCreateAccountAndRegisterUser(router, ctx);
+	registerSignedDelegateRoutes(router, ctx);
+	registerShamirRoutes(router, ctx);
+	registerVerifyAuthenticationResponse(router, ctx);
+	registerThresholdEd25519Routes(router, ctx);
+	registerSessionRoutes(router, ctx);
+	registerRecoverEmailRoute(router, ctx);
+	registerHealthRoutes(router, ctx);
+	registerWellKnownRoutes(router, ctx);
 	return router;
 }
+
+//#endregion
+//#region src/server/router/express/cron.ts
 function startKeyRotationCronjob(service, opts = {}) {
-	const logger = normalizeRouterLogger(opts.logger);
+	const logger = coerceRouterLogger(opts.logger);
 	const enabled = Boolean(opts.enabled);
 	const intervalMinutes = Math.max(1, Number(opts.intervalMinutes || 0) || 60);
 	const maxGraceKeys = Math.max(0, Number(opts.maxGraceKeys ?? 0) || 0);