OptionalauthenticateRequired posture, not a default: a function authenticates /submit, and an explicit false
declares the body's actor is trusted — safe only for in-process hosts, never for a
network-exposed handler. Omitting it entirely refuses to construct.
OptionalcorsBrowser origins allowed by CORS, matched exactly. Absent means no CORS headers at all, so cross-origin browser calls fail closed.
OptionalinstancesThe instance-economy lane manager (see src/instance.ts). When present, the server exposes
POST /instances/:scope/purchase — the transport an unprivileged game server calls to
request in-world purchases, with the lane living in this tier. Absent, the routes 404.
OptionalmaxByte ceiling on request bodies; past it the reply is 413. Defaults to DEFAULT_MAX_BODY_BYTES, which every legitimate operation fits well under.
The narrow pick the routes read: config for webhook policy, secrets for the webhook HMAC, clock for freshness, meter for the duplicate and degraded counters.
Optionalratefalse declares admission control off; absent means off too (infra silence is allowed
here, unlike authentication).
OptionalreadDeadline on reading a request body; past it the reply is 408, so a trickled body cannot hold the handler open. Defaults to DEFAULT_READ_TIMEOUT_MS.
OptionalreplayDedup store for provider eventIds: a repeat delivery returns 200 without invoking the
handler. When absent, the host dedups. The claim-last ordering lives at webhookRoute.
OptionalwebhookHandler for verified provider callbacks on POST /webhooks/:provider; absent, the route
answers 404.
Everything createServer accepts.
economy,ports, and theauthenticateposture are required; the rest are opt-in edge behavior — absent, CORS stays off, admission control is off, and the webhook and instance routes answer 404.