@playmos/sdk 0.1.5 → 0.2.0

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/webhooks.ts"],"names":["createHmac","timingSafeEqual"],"mappings":";;;;;;;AAkBO,IAAM,YAAA,GAAN,cAA2B,KAAA,CAAM;AAAA,EAKtC,WAAA,CAAY,IAAA,EAAwB,OAAA,EAAiB,MAAA,EAAkC;AACrF,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AACvB,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAEd,IAAA,MAAA,CAAO,cAAA,CAAe,IAAA,EAAM,GAAA,CAAA,MAAA,CAAW,SAAS,CAAA;AAAA,EAClD;AACF,CAAA;;;AChBO,IAAM,qBAAA,GAAN,cAAoC,YAAA,CAAa;AAAA,EACtD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,WAAA,EAAa,CAAA,uCAAA,EAA0C,OAAO,CAAA,CAAE,CAAA;AAAA,EACxE;AACF;AAEA,SAAS,YAAY,MAAA,EAA2C;AAC9D,EAAA,MAAM,QAAQ,MAAA,CAAO,WAAA;AAAA,IACnB,OAAO,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,EAAA,KAAO;AAC5B,MAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,EAAA,CAAG,MAAM,GAAG,CAAA;AAC3B,MAAA,OAAO,CAAC,CAAA,EAAG,IAAA,EAAK,EAAG,CAAA,EAAG,MAAM,CAAA;AAAA,IAC9B,CAAC;AAAA,GACH;AACA,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,GAAG,CAAC,CAAA;AAC3B,EAAA,MAAM,EAAA,GAAK,MAAM,IAAI,CAAA;AACrB,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,IAAK,CAAC,EAAA,EAAI,MAAM,IAAI,qBAAA,CAAsB,4BAA4B,CAAA;AAC5F,EAAA,OAAO,EAAE,GAAG,EAAA,EAAG;AACjB;AAEA,SAAS,gBAAA,CAAiB,MAAA,EAAgB,CAAA,EAAW,OAAA,EAAyB;AAC5E,EAAA,OAAOA,iBAAA,CAAW,QAAA,EAAU,MAAM,CAAA,CAAE,MAAA,CAAO,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC5E;AAOO,SAAS,cACd,OAAA,EACA,eAAA,EACA,MAAA,EACA,IAAA,GAAsC,EAAC,EACzB;AACd,EAAA,IAAI,CAAC,eAAA,IAAmB,KAAA,CAAM,OAAA,CAAQ,eAAe,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,sBAAsB,0BAA0B,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,sBAAsB,wBAAwB,CAAA;AAErE,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAC5E,EAAA,MAAM,EAAE,CAAA,EAAG,EAAA,EAAG,GAAI,YAAY,eAAe,CAAA;AAE7C,EAAA,MAAM,SAAA,GAAY,KAAK,gBAAA,IAAoB,GAAA;AAC3C,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,GAAS,CAAC,IAAI,SAAA,EAAW;AACpC,IAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,6BAAA,EAAgC,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,EAC/E;AAEA,EAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,MAAA,EAAQ,CAAA,EAAG,IAAI,CAAA;AACjD,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AACrC,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,KAAK,CAAA;AAC/B,EAAA,IAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA,IAAU,CAACC,sBAAA,CAAgB,CAAA,EAAG,CAAC,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,sBAAsB,oBAAoB,CAAA;AAAA,EACtD;AAEA,EAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AACxB","file":"server.cjs","sourcesContent":["/**\n * Typed, actionable errors — the Stripe bar (spec §11).\n *\n * Every error carries a stable machine-readable `code` and is thrown at the\n * EARLIEST possible layer: input errors fire client-side before any network or\n * chain call, so a studio never pays gas to discover a typo.\n */\n\nexport type PlaymosErrorCode =\n  | \"invalid_amount\"\n  | \"missing_field\"\n  | \"insufficient_gas\"\n  | \"wallet_connection\"\n  | \"payment_failed\"\n  | \"auth\"\n  | \"api_error\"\n  | \"config\";\n\nexport class PlaymosError extends Error {\n  readonly code: PlaymosErrorCode;\n  /** Optional machine context (e.g. the offending field, the http status). */\n  readonly detail?: Record<string, unknown>;\n\n  constructor(code: PlaymosErrorCode, message: string, detail?: Record<string, unknown>) {\n    super(message);\n    this.name = new.target.name;\n    this.code = code;\n    this.detail = detail;\n    // Restore prototype chain for `instanceof` across transpile targets.\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/** amount ≤ 0, non-numeric, empty, or more than 2 decimal places. */\nexport class InvalidAmountError extends PlaymosError {\n  constructor(amount: unknown) {\n    super(\n      \"invalid_amount\",\n      `Invalid amount: ${JSON.stringify(amount)}. Provide a positive USD decimal string with at most 2 decimals, e.g. \"4.99\".`,\n      { amount },\n    );\n  }\n}\n\n/** A required field (sku, playerId, gameId, roundId, agentId…) was empty. */\nexport class MissingFieldError extends PlaymosError {\n  constructor(field: string) {\n    super(\"missing_field\", `Missing required field: \"${field}\".`, { field });\n  }\n}\n\n/** gas mode \"player\" and the player's ETH is too low to cover gas (pre-check, §7). */\nexport class InsufficientGasError extends PlaymosError {\n  constructor(detail?: Record<string, unknown>) {\n    super(\n      \"insufficient_gas\",\n      \"The player's wallet has too little ETH to pay gas. Ask them to add a little ETH, or switch to gas.mode: \\\"sponsored\\\".\",\n      detail,\n    );\n  }\n}\n\n/** The player closed or failed the wallet sheet, or no provider is available. */\nexport class WalletConnectionError extends PlaymosError {\n  constructor(message = \"Could not connect the player's wallet.\", detail?: Record<string, unknown>) {\n    super(\"wallet_connection\", message, detail);\n  }\n}\n\n/** The on-chain settlement reverted, was cancelled, or timed out. */\nexport class PaymentFailedError extends PlaymosError {\n  constructor(message = \"The on-chain payment did not complete.\", detail?: Record<string, unknown>) {\n    super(\"payment_failed\", message, detail);\n  }\n}\n\n/** Bad, missing, or wrong-environment API key (e.g. a pk_test_ key on a live route). */\nexport class AuthError extends PlaymosError {\n  constructor(message = \"Invalid or missing API key.\", detail?: Record<string, unknown>) {\n    super(\"auth\", message, detail);\n  }\n}\n\n/** The Playmos service returned a non-2xx we don't have a more specific error for. */\nexport class ApiError extends PlaymosError {\n  constructor(message: string, detail?: Record<string, unknown>) {\n    super(\"api_error\", message, detail);\n  }\n}\n\n/** SDK misconfiguration (e.g. a missing contract address for on-chain mode). */\nexport class ConfigError extends PlaymosError {\n  constructor(message: string, detail?: Record<string, unknown>) {\n    super(\"config\", message, detail);\n  }\n}\n","/**\n * Webhook signature verification (spec §6.2) — server-side only.\n *\n * Signature scheme (mirrors the Playmos service byte-for-byte):\n *   header `X-Playmos-Signature: t=<unixSeconds>,v1=<hex>`\n *   where <hex> = HMAC_SHA256(secret, `${t}.${rawBody}`)\n *\n * Verify BEFORE trusting an event. Uses node:crypto (constant-time compare) and\n * rejects stale timestamps to blunt replay. Throws on any mismatch.\n */\n\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { PlaymosError } from \"./errors.js\";\nimport type { WebhookEvent } from \"./types.js\";\n\nexport class WebhookSignatureError extends PlaymosError {\n  constructor(message: string) {\n    super(\"api_error\", `Webhook signature verification failed: ${message}`);\n  }\n}\n\nfunction parseHeader(header: string): { t: number; v1: string } {\n  const parts = Object.fromEntries(\n    header.split(\",\").map((kv) => {\n      const [k, v] = kv.split(\"=\");\n      return [k?.trim(), v?.trim()];\n    }),\n  );\n  const t = Number(parts[\"t\"]);\n  const v1 = parts[\"v1\"];\n  if (!Number.isFinite(t) || !v1) throw new WebhookSignatureError(\"malformed signature header\");\n  return { t, v1 };\n}\n\nfunction computeSignature(secret: string, t: number, rawBody: string): string {\n  return createHmac(\"sha256\", secret).update(`${t}.${rawBody}`).digest(\"hex\");\n}\n\n/**\n * Verify a webhook and return the parsed event. `rawBody` MUST be the exact raw\n * request bytes (use express.raw / fastify rawBody) — a re-serialized JSON body\n * will not match the signature.\n */\nexport function verifyWebhook(\n  rawBody: string | Buffer,\n  signatureHeader: string | string[] | undefined,\n  secret: string,\n  opts: { toleranceSeconds?: number } = {},\n): WebhookEvent {\n  if (!signatureHeader || Array.isArray(signatureHeader)) {\n    throw new WebhookSignatureError(\"missing signature header\");\n  }\n  if (!secret) throw new WebhookSignatureError(\"missing signing secret\");\n\n  const body = typeof rawBody === \"string\" ? rawBody : rawBody.toString(\"utf8\");\n  const { t, v1 } = parseHeader(signatureHeader);\n\n  const tolerance = opts.toleranceSeconds ?? 300;\n  const nowSec = Math.floor(Date.now() / 1000);\n  if (Math.abs(nowSec - t) > tolerance) {\n    throw new WebhookSignatureError(`timestamp outside tolerance (${tolerance}s)`);\n  }\n\n  const expected = computeSignature(secret, t, body);\n  const a = Buffer.from(expected, \"hex\");\n  const b = Buffer.from(v1, \"hex\");\n  if (a.length !== b.length || !timingSafeEqual(a, b)) {\n    throw new WebhookSignatureError(\"signature mismatch\");\n  }\n\n  return JSON.parse(body) as WebhookEvent;\n}\n"]}

package/dist/server.d.cts

@@ -0,0 +1,26 @@
+import { z as PlaymosError, W as WebhookEvent } from './errors-CjL85YKR.cjs';
+
+/**
+ * Webhook signature verification (spec §6.2) — server-side only.
+ *
+ * Signature scheme (mirrors the Playmos service byte-for-byte):
+ *   header `X-Playmos-Signature: t=<unixSeconds>,v1=<hex>`
+ *   where <hex> = HMAC_SHA256(secret, `${t}.${rawBody}`)
+ *
+ * Verify BEFORE trusting an event. Uses node:crypto (constant-time compare) and
+ * rejects stale timestamps to blunt replay. Throws on any mismatch.
+ */
+
+declare class WebhookSignatureError extends PlaymosError {
+    constructor(message: string);
+}
+/**
+ * Verify a webhook and return the parsed event. `rawBody` MUST be the exact raw
+ * request bytes (use express.raw / fastify rawBody) — a re-serialized JSON body
+ * will not match the signature.
+ */
+declare function verifyWebhook(rawBody: string | Buffer, signatureHeader: string | string[] | undefined, secret: string, opts?: {
+    toleranceSeconds?: number;
+}): WebhookEvent;
+
+export { WebhookSignatureError, verifyWebhook };

package/dist/server.d.ts

@@ -0,0 +1,26 @@
+import { z as PlaymosError, W as WebhookEvent } from './errors-CjL85YKR.js';
+
+/**
+ * Webhook signature verification (spec §6.2) — server-side only.
+ *
+ * Signature scheme (mirrors the Playmos service byte-for-byte):
+ *   header `X-Playmos-Signature: t=<unixSeconds>,v1=<hex>`
+ *   where <hex> = HMAC_SHA256(secret, `${t}.${rawBody}`)
+ *
+ * Verify BEFORE trusting an event. Uses node:crypto (constant-time compare) and
+ * rejects stale timestamps to blunt replay. Throws on any mismatch.
+ */
+
+declare class WebhookSignatureError extends PlaymosError {
+    constructor(message: string);
+}
+/**
+ * Verify a webhook and return the parsed event. `rawBody` MUST be the exact raw
+ * request bytes (use express.raw / fastify rawBody) — a re-serialized JSON body
+ * will not match the signature.
+ */
+declare function verifyWebhook(rawBody: string | Buffer, signatureHeader: string | string[] | undefined, secret: string, opts?: {
+    toleranceSeconds?: number;
+}): WebhookEvent;
+
+export { WebhookSignatureError, verifyWebhook };

package/dist/server.js

@@ -0,0 +1,47 @@
+import { PlaymosError } from './chunk-B7SHFZYY.js';
+import { timingSafeEqual, createHmac } from 'crypto';
+
+var WebhookSignatureError = class extends PlaymosError {
+  constructor(message) {
+    super("api_error", `Webhook signature verification failed: ${message}`);
+  }
+};
+function parseHeader(header) {
+  const parts = Object.fromEntries(
+    header.split(",").map((kv) => {
+      const [k, v] = kv.split("=");
+      return [k?.trim(), v?.trim()];
+    })
+  );
+  const t = Number(parts["t"]);
+  const v1 = parts["v1"];
+  if (!Number.isFinite(t) || !v1) throw new WebhookSignatureError("malformed signature header");
+  return { t, v1 };
+}
+function computeSignature(secret, t, rawBody) {
+  return createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
+}
+function verifyWebhook(rawBody, signatureHeader, secret, opts = {}) {
+  if (!signatureHeader || Array.isArray(signatureHeader)) {
+    throw new WebhookSignatureError("missing signature header");
+  }
+  if (!secret) throw new WebhookSignatureError("missing signing secret");
+  const body = typeof rawBody === "string" ? rawBody : rawBody.toString("utf8");
+  const { t, v1 } = parseHeader(signatureHeader);
+  const tolerance = opts.toleranceSeconds ?? 300;
+  const nowSec = Math.floor(Date.now() / 1e3);
+  if (Math.abs(nowSec - t) > tolerance) {
+    throw new WebhookSignatureError(`timestamp outside tolerance (${tolerance}s)`);
+  }
+  const expected = computeSignature(secret, t, body);
+  const a = Buffer.from(expected, "hex");
+  const b = Buffer.from(v1, "hex");
+  if (a.length !== b.length || !timingSafeEqual(a, b)) {
+    throw new WebhookSignatureError("signature mismatch");
+  }
+  return JSON.parse(body);
+}
+
+export { WebhookSignatureError, verifyWebhook };
+//# sourceMappingURL=server.js.map
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/webhooks.ts"],"names":[],"mappings":";;;AAeO,IAAM,qBAAA,GAAN,cAAoC,YAAA,CAAa;AAAA,EACtD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,WAAA,EAAa,CAAA,uCAAA,EAA0C,OAAO,CAAA,CAAE,CAAA;AAAA,EACxE;AACF;AAEA,SAAS,YAAY,MAAA,EAA2C;AAC9D,EAAA,MAAM,QAAQ,MAAA,CAAO,WAAA;AAAA,IACnB,OAAO,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,EAAA,KAAO;AAC5B,MAAA,MAAM,CAAC,CAAA,EAAG,CAAC,CAAA,GAAI,EAAA,CAAG,MAAM,GAAG,CAAA;AAC3B,MAAA,OAAO,CAAC,CAAA,EAAG,IAAA,EAAK,EAAG,CAAA,EAAG,MAAM,CAAA;AAAA,IAC9B,CAAC;AAAA,GACH;AACA,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,GAAG,CAAC,CAAA;AAC3B,EAAA,MAAM,EAAA,GAAK,MAAM,IAAI,CAAA;AACrB,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,IAAK,CAAC,EAAA,EAAI,MAAM,IAAI,qBAAA,CAAsB,4BAA4B,CAAA;AAC5F,EAAA,OAAO,EAAE,GAAG,EAAA,EAAG;AACjB;AAEA,SAAS,gBAAA,CAAiB,MAAA,EAAgB,CAAA,EAAW,OAAA,EAAyB;AAC5E,EAAA,OAAO,UAAA,CAAW,QAAA,EAAU,MAAM,CAAA,CAAE,MAAA,CAAO,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAC5E;AAOO,SAAS,cACd,OAAA,EACA,eAAA,EACA,MAAA,EACA,IAAA,GAAsC,EAAC,EACzB;AACd,EAAA,IAAI,CAAC,eAAA,IAAmB,KAAA,CAAM,OAAA,CAAQ,eAAe,CAAA,EAAG;AACtD,IAAA,MAAM,IAAI,sBAAsB,0BAA0B,CAAA;AAAA,EAC5D;AACA,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,sBAAsB,wBAAwB,CAAA;AAErE,EAAA,MAAM,OAAO,OAAO,OAAA,KAAY,WAAW,OAAA,GAAU,OAAA,CAAQ,SAAS,MAAM,CAAA;AAC5E,EAAA,MAAM,EAAE,CAAA,EAAG,EAAA,EAAG,GAAI,YAAY,eAAe,CAAA;AAE7C,EAAA,MAAM,SAAA,GAAY,KAAK,gBAAA,IAAoB,GAAA;AAC3C,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,GAAS,CAAC,IAAI,SAAA,EAAW;AACpC,IAAA,MAAM,IAAI,qBAAA,CAAsB,CAAA,6BAAA,EAAgC,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,EAC/E;AAEA,EAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,MAAA,EAAQ,CAAA,EAAG,IAAI,CAAA;AACjD,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AACrC,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,EAAA,EAAI,KAAK,CAAA;AAC/B,EAAA,IAAI,CAAA,CAAE,WAAW,CAAA,CAAE,MAAA,IAAU,CAAC,eAAA,CAAgB,CAAA,EAAG,CAAC,CAAA,EAAG;AACnD,IAAA,MAAM,IAAI,sBAAsB,oBAAoB,CAAA;AAAA,EACtD;AAEA,EAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AACxB","file":"server.js","sourcesContent":["/**\n * Webhook signature verification (spec §6.2) — server-side only.\n *\n * Signature scheme (mirrors the Playmos service byte-for-byte):\n *   header `X-Playmos-Signature: t=<unixSeconds>,v1=<hex>`\n *   where <hex> = HMAC_SHA256(secret, `${t}.${rawBody}`)\n *\n * Verify BEFORE trusting an event. Uses node:crypto (constant-time compare) and\n * rejects stale timestamps to blunt replay. Throws on any mismatch.\n */\n\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { PlaymosError } from \"./errors.js\";\nimport type { WebhookEvent } from \"./types.js\";\n\nexport class WebhookSignatureError extends PlaymosError {\n  constructor(message: string) {\n    super(\"api_error\", `Webhook signature verification failed: ${message}`);\n  }\n}\n\nfunction parseHeader(header: string): { t: number; v1: string } {\n  const parts = Object.fromEntries(\n    header.split(\",\").map((kv) => {\n      const [k, v] = kv.split(\"=\");\n      return [k?.trim(), v?.trim()];\n    }),\n  );\n  const t = Number(parts[\"t\"]);\n  const v1 = parts[\"v1\"];\n  if (!Number.isFinite(t) || !v1) throw new WebhookSignatureError(\"malformed signature header\");\n  return { t, v1 };\n}\n\nfunction computeSignature(secret: string, t: number, rawBody: string): string {\n  return createHmac(\"sha256\", secret).update(`${t}.${rawBody}`).digest(\"hex\");\n}\n\n/**\n * Verify a webhook and return the parsed event. `rawBody` MUST be the exact raw\n * request bytes (use express.raw / fastify rawBody) — a re-serialized JSON body\n * will not match the signature.\n */\nexport function verifyWebhook(\n  rawBody: string | Buffer,\n  signatureHeader: string | string[] | undefined,\n  secret: string,\n  opts: { toleranceSeconds?: number } = {},\n): WebhookEvent {\n  if (!signatureHeader || Array.isArray(signatureHeader)) {\n    throw new WebhookSignatureError(\"missing signature header\");\n  }\n  if (!secret) throw new WebhookSignatureError(\"missing signing secret\");\n\n  const body = typeof rawBody === \"string\" ? rawBody : rawBody.toString(\"utf8\");\n  const { t, v1 } = parseHeader(signatureHeader);\n\n  const tolerance = opts.toleranceSeconds ?? 300;\n  const nowSec = Math.floor(Date.now() / 1000);\n  if (Math.abs(nowSec - t) > tolerance) {\n    throw new WebhookSignatureError(`timestamp outside tolerance (${tolerance}s)`);\n  }\n\n  const expected = computeSignature(secret, t, body);\n  const a = Buffer.from(expected, \"hex\");\n  const b = Buffer.from(v1, \"hex\");\n  if (a.length !== b.length || !timingSafeEqual(a, b)) {\n    throw new WebhookSignatureError(\"signature mismatch\");\n  }\n\n  return JSON.parse(body) as WebhookEvent;\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@playmos/sdk",
-  "version": "0.1.5",
-  "description": "Playmos SDK — stablecoin payments for games on Base. One SDK for IAP (1%), skill-game prize-pool entries (10%, 60/30/10), and agent economies. USD in, USDC on-chain, no crypto UX for players.",
+  "version": "0.2.0",
+  "description": "Playmos SDK \u2014 stablecoin payments for games on Base. One SDK for IAP (1%), skill-game prize-pool entries (10%, 60/30/10), and agent economies. USD in, USDC on-chain, no crypto UX for players.",
   "license": "UNLICENSED",
   "private": false,
   "type": "module",
@@ -14,6 +14,11 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
     }
   },
   "files": [
@@ -37,7 +42,7 @@
     "vitest": "^2.1.0"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=18 <25"
   },
   "keywords": [
     "playmos",