@edge-markets/connect-node 1.4.0 → 1.6.0

package/README.md

@@ -6,7 +6,7 @@ Server SDK for EDGE Connect token exchange and API calls.
 
 - 🔐 **Secure token exchange** - Exchange codes for tokens with PKCE
 - 🔄 **Token refresh** - Automatic refresh token handling
-- 📡 **Full API client** - User, balance, transfers
+- 📡 **Full API client** - User, balance, transfers via `forUser()` pattern
 - 🛡️ **Typed errors** - Specific error classes for each scenario
 - 📝 **TypeScript first** - Complete type definitions
 
@@ -23,7 +23,7 @@ yarn add @edge-markets/connect-node
 ## Quick Start
 
 ```typescript
-import { EdgeConnectServer } from '@edgeboost/edge-connect-server'
+import { EdgeConnectServer } from '@edge-markets/connect-node'
 
 // Create instance once (reuse for all requests)
 const edge = new EdgeConnectServer({
@@ -35,9 +35,10 @@ const edge = new EdgeConnectServer({
 // Exchange code from EdgeLink for tokens
 const tokens = await edge.exchangeCode(code, codeVerifier)
 
-// Make API calls
-const user = await edge.getUser(tokens.accessToken)
-const balance = await edge.getBalance(tokens.accessToken)
+// Create a user-scoped client and make API calls
+const client = edge.forUser(tokens.accessToken)
+const user = await client.getUser()
+const balance = await client.getBalance()
 ```
 
 ## ⚠️ Security
@@ -56,8 +57,11 @@ interface EdgeConnectServerConfig {
   
   // Optional
   apiBaseUrl?: string           // Custom API URL (dev only)
-  authDomain?: string           // Custom Cognito domain (dev only)
+  oauthBaseUrl?: string         // Custom OAuth URL (dev only)
   timeout?: number              // Request timeout (default: 30000ms)
+  retry?: RetryConfig           // Retry configuration
+  onRequest?: (info) => void    // Hook called before each request
+  onResponse?: (info) => void   // Hook called after each response
 
   // Optional: Message Level Encryption (Connect endpoints only)
   mle?: {
@@ -152,15 +156,19 @@ async function getValidAccessToken(userId: string): Promise<string> {
 
 ## API Methods
 
+All user-scoped API methods live on `EdgeUserClient`, created via `edge.forUser(accessToken)`:
+
+```typescript
+const client = edge.forUser(accessToken)
+```
+
 ### User & Balance
 
 ```typescript
-// Get user profile
-const user = await edge.getUser(accessToken)
+const user = await client.getUser()
 // Returns: { id, email, firstName, lastName, createdAt }
 
-// Get balance
-const balance = await edge.getBalance(accessToken)
+const balance = await client.getBalance()
 // Returns: { userId, availableBalance, currency, asOf }
 ```
 
@@ -168,7 +176,7 @@ const balance = await edge.getBalance(accessToken)
 
 ```typescript
 // Initiate transfer (requires OTP verification)
-const transfer = await edge.initiateTransfer(accessToken, {
+const transfer = await client.initiateTransfer({
   type: 'debit',           // 'debit' = pull from user, 'credit' = push to user
   amount: '100.00',
   idempotencyKey: `txn_${userId}_${Date.now()}`,
@@ -176,14 +184,14 @@ const transfer = await edge.initiateTransfer(accessToken, {
 // Returns: { transferId, status: 'pending_verification', otpMethod }
 
 // Verify with OTP
-const result = await edge.verifyTransfer(accessToken, transfer.transferId, userOtp)
+const result = await client.verifyTransfer(transfer.transferId, userOtp)
 // Returns: { transferId, status: 'completed' | 'failed' }
 
 // Get transfer status
-const status = await edge.getTransfer(accessToken, transferId)
+const status = await client.getTransfer(transferId)
 
 // List transfers
-const { transfers, total } = await edge.listTransfers(accessToken, {
+const { transfers, total } = await client.listTransfers({
   status: 'completed',
   limit: 10,
   offset: 0,
@@ -194,7 +202,7 @@ const { transfers, total } = await edge.listTransfers(accessToken, {
 
 ```typescript
 // Revoke consent (disconnect user)
-await edge.revokeConsent(accessToken)
+await client.revokeConsent()
 
 // Clean up stored tokens
 await db.edgeConnections.delete(userId)
@@ -212,7 +220,8 @@ import {
 } from '@edge-markets/connect-node'
 
 try {
-  const balance = await edge.getBalance(accessToken)
+  const client = edge.forUser(accessToken)
+  const balance = await client.getBalance()
 } catch (error) {
   if (error instanceof EdgeAuthenticationError) {
     // Token expired - try refresh or reconnect
@@ -273,7 +282,8 @@ export class EdgeService {
 
   async getBalance(accessToken: string) {
     try {
-      return await this.edge.getBalance(accessToken)
+      const client = this.edge.forUser(accessToken)
+      return await client.getBalance()
     } catch (error) {
       if (error instanceof EdgeConsentRequiredError) {
         this.logger.warn('User consent required')
@@ -323,7 +333,8 @@ app.post('/api/edge/exchange', async (req, res) => {
 app.get('/api/edge/balance', async (req, res) => {
   try {
     const accessToken = await getAccessTokenForUser(req.user.id)
-    const balance = await edge.getBalance(accessToken)
+    const client = edge.forUser(accessToken)
+    const balance = await client.getBalance()
     res.json(balance)
   } catch (error) {
     // Handle errors...
@@ -339,10 +350,3 @@ app.get('/api/edge/balance', async (req, res) => {
 ## License
 
 MIT
-
-
-
-
-
-
-

package/dist/index.d.mts

@@ -1,5 +1,6 @@
-import { EdgeEnvironment, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, Transfer, ListTransfersParams, TransferList, EdgeTokens } from '@edge-markets/connect';
-export { Balance, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, ListTransfersParams, Transfer, TransferList, TransferListItem, TransferStatus, TransferType, User, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
+import * as node_https from 'node:https';
+import { EdgeEnvironment, TransferCategory, SdkGeolocation, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, Transfer, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSession, VerificationSessionStatusResponse, EdgeTokens } from '@edge-markets/connect';
+export { Balance, CreateVerificationSessionRequest, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferList, TransferListItem, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
 
 interface RequestInfo {
     method: string;
@@ -40,11 +41,27 @@ interface EdgeConnectServerConfig {
         partnerKeyId: string;
         strictResponseEncryption?: boolean;
     };
+    mtls?: MtlsConfig;
+}
+interface MtlsConfig {
+    enabled: boolean;
+    cert: string;
+    key: string;
+    ca?: string;
 }
 interface TransferOptions {
     type: 'debit' | 'credit';
     amount: string;
     idempotencyKey: string;
+    /** Optional transaction category for settlement window determination */
+    category?: TransferCategory;
+}
+/**
+ * Options for verifying a transfer with OTP.
+ */
+interface VerifyTransferOptions {
+    /** SDK-reported geolocation for cross-referencing against IP-based geo */
+    sdkGeo?: SdkGeolocation;
 }
 
 /**
@@ -61,12 +78,23 @@ declare class EdgeUserClient {
     verifyIdentity(options: VerifyIdentityOptions): Promise<VerifyIdentityResult>;
     getBalance(): Promise<Balance>;
     initiateTransfer(options: TransferOptions): Promise<Transfer>;
-    verifyTransfer(transferId: string, otp: string): Promise<Transfer>;
+    verifyTransfer(transferId: string, otp: string, options?: VerifyTransferOptions): Promise<Transfer>;
     getTransfer(transferId: string): Promise<Transfer>;
     listTransfers(params?: ListTransfersParams): Promise<TransferList>;
     revokeConsent(): Promise<{
         revoked: boolean;
     }>;
+    /**
+     * Creates an EDGE-hosted transfer verification session.
+     * Returns a `verificationUrl` to open in an iframe or popup.
+     * The handoff token is single-use and expires in 120 seconds.
+     */
+    createVerificationSession(transferId: string, options: CreateVerificationSessionRequest): Promise<VerificationSession>;
+    /**
+     * Polls the status of a verification session.
+     * Use as an alternative to postMessage events.
+     */
+    getVerificationSessionStatus(transferId: string, sessionId: string): Promise<VerificationSessionStatusResponse>;
 }
 
 declare class EdgeConnectServer {
@@ -75,9 +103,16 @@ declare class EdgeConnectServer {
     private readonly oauthBaseUrl;
     private readonly timeout;
     private readonly retryConfig;
+    private readonly httpsAgent;
+    private readonly dispatcher;
     static getInstance(config: EdgeConnectServerConfig): EdgeConnectServer;
     static clearInstances(): void;
     constructor(config: EdgeConnectServerConfig);
+    /**
+     * Returns the `node:https.Agent` configured with mTLS client certificates.
+     * Use this with axios, got, or other HTTP clients. Returns `undefined` if mTLS is not configured.
+     */
+    getHttpsAgent(): node_https.Agent | undefined;
     /**
      * Create a user-scoped client for making authenticated API calls.
      *
@@ -97,4 +132,4 @@ declare class EdgeConnectServer {
     private handleApiErrorFromBody;
 }
 
-export { EdgeConnectServer, type EdgeConnectServerConfig, EdgeUserClient, type RequestInfo, type ResponseInfo, type RetryConfig, type TransferOptions };
+export { EdgeConnectServer, type EdgeConnectServerConfig, EdgeUserClient, type MtlsConfig, type RequestInfo, type ResponseInfo, type RetryConfig, type TransferOptions, type VerifyTransferOptions };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { EdgeEnvironment, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, Transfer, ListTransfersParams, TransferList, EdgeTokens } from '@edge-markets/connect';
-export { Balance, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, ListTransfersParams, Transfer, TransferList, TransferListItem, TransferStatus, TransferType, User, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
+import * as node_https from 'node:https';
+import { EdgeEnvironment, TransferCategory, SdkGeolocation, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, Transfer, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSession, VerificationSessionStatusResponse, EdgeTokens } from '@edge-markets/connect';
+export { Balance, CreateVerificationSessionRequest, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferList, TransferListItem, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
 
 interface RequestInfo {
     method: string;
@@ -40,11 +41,27 @@ interface EdgeConnectServerConfig {
         partnerKeyId: string;
         strictResponseEncryption?: boolean;
     };
+    mtls?: MtlsConfig;
+}
+interface MtlsConfig {
+    enabled: boolean;
+    cert: string;
+    key: string;
+    ca?: string;
 }
 interface TransferOptions {
     type: 'debit' | 'credit';
     amount: string;
     idempotencyKey: string;
+    /** Optional transaction category for settlement window determination */
+    category?: TransferCategory;
+}
+/**
+ * Options for verifying a transfer with OTP.
+ */
+interface VerifyTransferOptions {
+    /** SDK-reported geolocation for cross-referencing against IP-based geo */
+    sdkGeo?: SdkGeolocation;
 }
 
 /**
@@ -61,12 +78,23 @@ declare class EdgeUserClient {
     verifyIdentity(options: VerifyIdentityOptions): Promise<VerifyIdentityResult>;
     getBalance(): Promise<Balance>;
     initiateTransfer(options: TransferOptions): Promise<Transfer>;
-    verifyTransfer(transferId: string, otp: string): Promise<Transfer>;
+    verifyTransfer(transferId: string, otp: string, options?: VerifyTransferOptions): Promise<Transfer>;
     getTransfer(transferId: string): Promise<Transfer>;
     listTransfers(params?: ListTransfersParams): Promise<TransferList>;
     revokeConsent(): Promise<{
         revoked: boolean;
     }>;
+    /**
+     * Creates an EDGE-hosted transfer verification session.
+     * Returns a `verificationUrl` to open in an iframe or popup.
+     * The handoff token is single-use and expires in 120 seconds.
+     */
+    createVerificationSession(transferId: string, options: CreateVerificationSessionRequest): Promise<VerificationSession>;
+    /**
+     * Polls the status of a verification session.
+     * Use as an alternative to postMessage events.
+     */
+    getVerificationSessionStatus(transferId: string, sessionId: string): Promise<VerificationSessionStatusResponse>;
 }
 
 declare class EdgeConnectServer {
@@ -75,9 +103,16 @@ declare class EdgeConnectServer {
     private readonly oauthBaseUrl;
     private readonly timeout;
     private readonly retryConfig;
+    private readonly httpsAgent;
+    private readonly dispatcher;
     static getInstance(config: EdgeConnectServerConfig): EdgeConnectServer;
     static clearInstances(): void;
     constructor(config: EdgeConnectServerConfig);
+    /**
+     * Returns the `node:https.Agent` configured with mTLS client certificates.
+     * Use this with axios, got, or other HTTP clients. Returns `undefined` if mTLS is not configured.
+     */
+    getHttpsAgent(): node_https.Agent | undefined;
     /**
      * Create a user-scoped client for making authenticated API calls.
      *
@@ -97,4 +132,4 @@ declare class EdgeConnectServer {
     private handleApiErrorFromBody;
 }
 
-export { EdgeConnectServer, type EdgeConnectServerConfig, EdgeUserClient, type RequestInfo, type ResponseInfo, type RetryConfig, type TransferOptions };
+export { EdgeConnectServer, type EdgeConnectServerConfig, EdgeUserClient, type MtlsConfig, type RequestInfo, type ResponseInfo, type RetryConfig, type TransferOptions, type VerifyTransferOptions };

package/dist/index.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -25,16 +35,19 @@ __export(index_exports, {
   EdgeConnectServer: () => EdgeConnectServer,
   EdgeConsentRequiredError: () => import_connect3.EdgeConsentRequiredError,
   EdgeError: () => import_connect3.EdgeError,
+  EdgeIdentityVerificationError: () => import_connect3.EdgeIdentityVerificationError,
   EdgeInsufficientScopeError: () => import_connect3.EdgeInsufficientScopeError,
   EdgeNetworkError: () => import_connect3.EdgeNetworkError,
   EdgeNotFoundError: () => import_connect3.EdgeNotFoundError,
   EdgeTokenExchangeError: () => import_connect3.EdgeTokenExchangeError,
   EdgeUserClient: () => EdgeUserClient,
+  TRANSFER_CATEGORIES: () => import_connect4.TRANSFER_CATEGORIES,
   getEnvironmentConfig: () => import_connect4.getEnvironmentConfig,
   isApiError: () => import_connect3.isApiError,
   isAuthenticationError: () => import_connect3.isAuthenticationError,
   isConsentRequiredError: () => import_connect3.isConsentRequiredError,
   isEdgeError: () => import_connect3.isEdgeError,
+  isIdentityVerificationError: () => import_connect3.isIdentityVerificationError,
   isNetworkError: () => import_connect3.isNetworkError,
   isProductionEnvironment: () => import_connect4.isProductionEnvironment
 });
@@ -85,6 +98,9 @@ function validateTransferOptions(options) {
   } else if (options.idempotencyKey.length > 255) {
     errors.idempotencyKey = ["Must be 255 characters or less"];
   }
+  if (options.category && !["sportsbook", "casino", "dfs", "sweepstakes"].includes(options.category)) {
+    errors.category = ["Must be one of: sportsbook, casino, dfs, sweepstakes"];
+  }
   if (Object.keys(errors).length > 0) {
     throw new import_connect.EdgeValidationError("Invalid transfer options", errors);
   }
@@ -113,14 +129,21 @@ var EdgeUserClient = class {
       amount: options.amount,
       idempotencyKey: options.idempotencyKey
     };
+    if (options.category) {
+      body.category = options.category;
+    }
     return this.server._apiRequest("POST", "/transfer", this.accessToken, body);
   }
-  async verifyTransfer(transferId, otp) {
+  async verifyTransfer(transferId, otp, options) {
+    const body = { otp };
+    if (options?.sdkGeo) {
+      body.sdkGeo = options.sdkGeo;
+    }
     return this.server._apiRequest(
       "POST",
       `/transfer/${encodeURIComponent(transferId)}/verify`,
       this.accessToken,
-      { otp }
+      body
     );
   }
   async getTransfer(transferId) {
@@ -138,6 +161,30 @@ var EdgeUserClient = class {
   async revokeConsent() {
     return this.server._apiRequest("DELETE", "/consent", this.accessToken);
   }
+  /**
+   * Creates an EDGE-hosted transfer verification session.
+   * Returns a `verificationUrl` to open in an iframe or popup.
+   * The handoff token is single-use and expires in 120 seconds.
+   */
+  async createVerificationSession(transferId, options) {
+    return this.server._apiRequest(
+      "POST",
+      `/transfer/${encodeURIComponent(transferId)}/verification-session`,
+      this.accessToken,
+      { origin: options.origin }
+    );
+  }
+  /**
+   * Polls the status of a verification session.
+   * Use as an alternative to postMessage events.
+   */
+  async getVerificationSessionStatus(transferId, sessionId) {
+    return this.server._apiRequest(
+      "GET",
+      `/transfer/${encodeURIComponent(transferId)}/verification-session/${encodeURIComponent(sessionId)}`,
+      this.accessToken
+    );
+  }
 };
 
 // src/mle.ts
@@ -215,6 +262,37 @@ function fromBase64Url(value) {
   return Buffer.from(normalized, "base64");
 }
 
+// src/mtls.ts
+var import_node_https = __toESM(require("https"));
+function createHttpsAgent(config) {
+  return new import_node_https.default.Agent({
+    cert: config.cert,
+    key: config.key,
+    rejectUnauthorized: true,
+    ...config.ca ? { ca: config.ca } : {}
+  });
+}
+function createUndiciDispatcher(config) {
+  const moduleName = "undici";
+  const { Agent } = require(moduleName);
+  return new Agent({
+    connect: {
+      cert: config.cert,
+      key: config.key,
+      rejectUnauthorized: true,
+      ...config.ca ? { ca: config.ca } : {}
+    }
+  });
+}
+function validateMtlsConfig(config) {
+  if (!config.cert?.trim()) {
+    throw new Error("EdgeConnectServer: mTLS cert is required when enabled");
+  }
+  if (!config.key?.trim()) {
+    throw new Error("EdgeConnectServer: mTLS key is required when enabled");
+  }
+}
+
 // src/types.ts
 var DEFAULT_TIMEOUT = 3e4;
 var USER_AGENT = "@edge-markets/connect-node/1.0.0";
@@ -261,6 +339,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       ...DEFAULT_RETRY_CONFIG,
       ...config.retry
     };
+    if (config.mtls?.enabled) {
+      validateMtlsConfig(config.mtls);
+      this.httpsAgent = createHttpsAgent(config.mtls);
+      this.dispatcher = createUndiciDispatcher(config.mtls);
+    }
+  }
+  /**
+   * Returns the `node:https.Agent` configured with mTLS client certificates.
+   * Use this with axios, got, or other HTTP clients. Returns `undefined` if mTLS is not configured.
+   */
+  getHttpsAgent() {
+    return this.httpsAgent;
   }
   /**
    * Create a user-scoped client for making authenticated API calls.
@@ -285,14 +375,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       redirect_uri: redirectUri || this.config.redirectUri || ""
     };
     try {
-      const response = await this.fetchWithTimeout(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "User-Agent": USER_AGENT
+      const response = await this.fetchWithTimeout(
+        tokenUrl,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": USER_AGENT
+          },
+          body: JSON.stringify(body)
         },
-        body: JSON.stringify(body)
-      });
+        this.dispatcher
+      );
       if (!response.ok) {
         const error = await response.json().catch(() => ({}));
         throw this.handleTokenError(error, response.status);
@@ -313,14 +407,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       client_secret: this.config.clientSecret
     };
     try {
-      const response = await this.fetchWithTimeout(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "User-Agent": USER_AGENT
+      const response = await this.fetchWithTimeout(
+        tokenUrl,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": USER_AGENT
+          },
+          body: JSON.stringify(body)
         },
-        body: JSON.stringify(body)
-      });
+        this.dispatcher
+      );
       if (!response.ok) {
         const error = await response.json().catch(() => ({}));
         throw new import_connect2.EdgeAuthenticationError(
@@ -360,11 +458,15 @@ var EdgeConnectServer = class _EdgeConnectServer {
             requestBody = { jwe: encryptMle(body, this.config.clientId, mleConfig) };
           }
         }
-        const response = await this.fetchWithTimeout(url, {
-          method,
-          headers: requestHeaders,
-          body: requestBody !== void 0 ? JSON.stringify(requestBody) : void 0
-        });
+        const response = await this.fetchWithTimeout(
+          url,
+          {
+            method,
+            headers: requestHeaders,
+            body: requestBody !== void 0 ? JSON.stringify(requestBody) : void 0
+          },
+          this.dispatcher
+        );
         const rawResponseBody = await response.json().catch(() => ({}));
         let responseBody = rawResponseBody;
         if (mleEnabled && typeof rawResponseBody?.jwe === "string") {
@@ -423,14 +525,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
   async sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
   }
-  async fetchWithTimeout(url, options) {
+  async fetchWithTimeout(url, options, dispatcher) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
     try {
-      return await fetch(url, {
+      const fetchOptions = {
         ...options,
         signal: controller.signal
-      });
+      };
+      if (dispatcher) {
+        fetchOptions.dispatcher = dispatcher;
+      }
+      return await fetch(url, fetchOptions);
     } finally {
       clearTimeout(timeoutId);
     }
@@ -486,8 +592,21 @@ var EdgeConnectServer = class _EdgeConnectServer {
       }
     }
     if (status === 404) {
-      const resourceType = path.includes("/transfer") ? "Transfer" : "Resource";
-      const resourceId = path.split("/").pop() || "unknown";
+      let resourceType = "Resource";
+      let resourceId = path.split("/").pop() || "unknown";
+      if (path.includes("/verification-session/")) {
+        resourceType = "VerificationSession";
+        const parts = path.split("/");
+        const vsIdx = parts.indexOf("verification-session");
+        resourceId = vsIdx >= 0 && parts[vsIdx + 1] ? parts[vsIdx + 1] : "unknown";
+      } else if (path.includes("/verification-session")) {
+        resourceType = "Transfer";
+        const parts = path.split("/");
+        const txIdx = parts.indexOf("transfer");
+        resourceId = txIdx >= 0 && parts[txIdx + 1] ? parts[txIdx + 1] : "unknown";
+      } else if (path.includes("/transfer")) {
+        resourceType = "Transfer";
+      }
       return new import_connect2.EdgeNotFoundError(resourceType, resourceId);
     }
     if (status === 422 && error.error === "identity_verification_failed") {
@@ -515,16 +634,19 @@ var import_connect4 = require("@edge-markets/connect");
   EdgeConnectServer,
   EdgeConsentRequiredError,
   EdgeError,
+  EdgeIdentityVerificationError,
   EdgeInsufficientScopeError,
   EdgeNetworkError,
   EdgeNotFoundError,
   EdgeTokenExchangeError,
   EdgeUserClient,
+  TRANSFER_CATEGORIES,
   getEnvironmentConfig,
   isApiError,
   isAuthenticationError,
   isConsentRequiredError,
   isEdgeError,
+  isIdentityVerificationError,
   isNetworkError,
   isProductionEnvironment
 });

package/dist/index.mjs

@@ -1,3 +1,10 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
 // src/edge-connect-server.ts
 import {
   EdgeApiError,
@@ -54,6 +61,9 @@ function validateTransferOptions(options) {
   } else if (options.idempotencyKey.length > 255) {
     errors.idempotencyKey = ["Must be 255 characters or less"];
   }
+  if (options.category && !["sportsbook", "casino", "dfs", "sweepstakes"].includes(options.category)) {
+    errors.category = ["Must be one of: sportsbook, casino, dfs, sweepstakes"];
+  }
   if (Object.keys(errors).length > 0) {
     throw new EdgeValidationError("Invalid transfer options", errors);
   }
@@ -82,14 +92,21 @@ var EdgeUserClient = class {
       amount: options.amount,
       idempotencyKey: options.idempotencyKey
     };
+    if (options.category) {
+      body.category = options.category;
+    }
     return this.server._apiRequest("POST", "/transfer", this.accessToken, body);
   }
-  async verifyTransfer(transferId, otp) {
+  async verifyTransfer(transferId, otp, options) {
+    const body = { otp };
+    if (options?.sdkGeo) {
+      body.sdkGeo = options.sdkGeo;
+    }
     return this.server._apiRequest(
       "POST",
       `/transfer/${encodeURIComponent(transferId)}/verify`,
       this.accessToken,
-      { otp }
+      body
     );
   }
   async getTransfer(transferId) {
@@ -107,6 +124,30 @@ var EdgeUserClient = class {
   async revokeConsent() {
     return this.server._apiRequest("DELETE", "/consent", this.accessToken);
   }
+  /**
+   * Creates an EDGE-hosted transfer verification session.
+   * Returns a `verificationUrl` to open in an iframe or popup.
+   * The handoff token is single-use and expires in 120 seconds.
+   */
+  async createVerificationSession(transferId, options) {
+    return this.server._apiRequest(
+      "POST",
+      `/transfer/${encodeURIComponent(transferId)}/verification-session`,
+      this.accessToken,
+      { origin: options.origin }
+    );
+  }
+  /**
+   * Polls the status of a verification session.
+   * Use as an alternative to postMessage events.
+   */
+  async getVerificationSessionStatus(transferId, sessionId) {
+    return this.server._apiRequest(
+      "GET",
+      `/transfer/${encodeURIComponent(transferId)}/verification-session/${encodeURIComponent(sessionId)}`,
+      this.accessToken
+    );
+  }
 };
 
 // src/mle.ts
@@ -184,6 +225,37 @@ function fromBase64Url(value) {
   return Buffer.from(normalized, "base64");
 }
 
+// src/mtls.ts
+import https from "https";
+function createHttpsAgent(config) {
+  return new https.Agent({
+    cert: config.cert,
+    key: config.key,
+    rejectUnauthorized: true,
+    ...config.ca ? { ca: config.ca } : {}
+  });
+}
+function createUndiciDispatcher(config) {
+  const moduleName = "undici";
+  const { Agent } = __require(moduleName);
+  return new Agent({
+    connect: {
+      cert: config.cert,
+      key: config.key,
+      rejectUnauthorized: true,
+      ...config.ca ? { ca: config.ca } : {}
+    }
+  });
+}
+function validateMtlsConfig(config) {
+  if (!config.cert?.trim()) {
+    throw new Error("EdgeConnectServer: mTLS cert is required when enabled");
+  }
+  if (!config.key?.trim()) {
+    throw new Error("EdgeConnectServer: mTLS key is required when enabled");
+  }
+}
+
 // src/types.ts
 var DEFAULT_TIMEOUT = 3e4;
 var USER_AGENT = "@edge-markets/connect-node/1.0.0";
@@ -230,6 +302,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       ...DEFAULT_RETRY_CONFIG,
       ...config.retry
     };
+    if (config.mtls?.enabled) {
+      validateMtlsConfig(config.mtls);
+      this.httpsAgent = createHttpsAgent(config.mtls);
+      this.dispatcher = createUndiciDispatcher(config.mtls);
+    }
+  }
+  /**
+   * Returns the `node:https.Agent` configured with mTLS client certificates.
+   * Use this with axios, got, or other HTTP clients. Returns `undefined` if mTLS is not configured.
+   */
+  getHttpsAgent() {
+    return this.httpsAgent;
   }
   /**
    * Create a user-scoped client for making authenticated API calls.
@@ -254,14 +338,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       redirect_uri: redirectUri || this.config.redirectUri || ""
     };
     try {
-      const response = await this.fetchWithTimeout(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "User-Agent": USER_AGENT
+      const response = await this.fetchWithTimeout(
+        tokenUrl,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": USER_AGENT
+          },
+          body: JSON.stringify(body)
         },
-        body: JSON.stringify(body)
-      });
+        this.dispatcher
+      );
       if (!response.ok) {
         const error = await response.json().catch(() => ({}));
         throw this.handleTokenError(error, response.status);
@@ -282,14 +370,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       client_secret: this.config.clientSecret
     };
     try {
-      const response = await this.fetchWithTimeout(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "User-Agent": USER_AGENT
+      const response = await this.fetchWithTimeout(
+        tokenUrl,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": USER_AGENT
+          },
+          body: JSON.stringify(body)
         },
-        body: JSON.stringify(body)
-      });
+        this.dispatcher
+      );
       if (!response.ok) {
         const error = await response.json().catch(() => ({}));
         throw new EdgeAuthenticationError(
@@ -329,11 +421,15 @@ var EdgeConnectServer = class _EdgeConnectServer {
             requestBody = { jwe: encryptMle(body, this.config.clientId, mleConfig) };
           }
         }
-        const response = await this.fetchWithTimeout(url, {
-          method,
-          headers: requestHeaders,
-          body: requestBody !== void 0 ? JSON.stringify(requestBody) : void 0
-        });
+        const response = await this.fetchWithTimeout(
+          url,
+          {
+            method,
+            headers: requestHeaders,
+            body: requestBody !== void 0 ? JSON.stringify(requestBody) : void 0
+          },
+          this.dispatcher
+        );
         const rawResponseBody = await response.json().catch(() => ({}));
         let responseBody = rawResponseBody;
         if (mleEnabled && typeof rawResponseBody?.jwe === "string") {
@@ -392,14 +488,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
   async sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
   }
-  async fetchWithTimeout(url, options) {
+  async fetchWithTimeout(url, options, dispatcher) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
     try {
-      return await fetch(url, {
+      const fetchOptions = {
         ...options,
         signal: controller.signal
-      });
+      };
+      if (dispatcher) {
+        fetchOptions.dispatcher = dispatcher;
+      }
+      return await fetch(url, fetchOptions);
     } finally {
       clearTimeout(timeoutId);
     }
@@ -455,8 +555,21 @@ var EdgeConnectServer = class _EdgeConnectServer {
       }
     }
     if (status === 404) {
-      const resourceType = path.includes("/transfer") ? "Transfer" : "Resource";
-      const resourceId = path.split("/").pop() || "unknown";
+      let resourceType = "Resource";
+      let resourceId = path.split("/").pop() || "unknown";
+      if (path.includes("/verification-session/")) {
+        resourceType = "VerificationSession";
+        const parts = path.split("/");
+        const vsIdx = parts.indexOf("verification-session");
+        resourceId = vsIdx >= 0 && parts[vsIdx + 1] ? parts[vsIdx + 1] : "unknown";
+      } else if (path.includes("/verification-session")) {
+        resourceType = "Transfer";
+        const parts = path.split("/");
+        const txIdx = parts.indexOf("transfer");
+        resourceId = txIdx >= 0 && parts[txIdx + 1] ? parts[txIdx + 1] : "unknown";
+      } else if (path.includes("/transfer")) {
+        resourceType = "Transfer";
+      }
       return new EdgeNotFoundError(resourceType, resourceId);
     }
     if (status === 422 && error.error === "identity_verification_failed") {
@@ -480,6 +593,7 @@ import {
   EdgeAuthenticationError as EdgeAuthenticationError2,
   EdgeConsentRequiredError as EdgeConsentRequiredError2,
   EdgeError as EdgeError2,
+  EdgeIdentityVerificationError as EdgeIdentityVerificationError2,
   EdgeInsufficientScopeError as EdgeInsufficientScopeError2,
   EdgeNetworkError as EdgeNetworkError2,
   EdgeNotFoundError as EdgeNotFoundError2,
@@ -488,25 +602,29 @@ import {
   isAuthenticationError,
   isConsentRequiredError,
   isEdgeError,
+  isIdentityVerificationError,
   isNetworkError
 } from "@edge-markets/connect";
-import { getEnvironmentConfig as getEnvironmentConfig2, isProductionEnvironment } from "@edge-markets/connect";
+import { TRANSFER_CATEGORIES, getEnvironmentConfig as getEnvironmentConfig2, isProductionEnvironment } from "@edge-markets/connect";
 export {
   EdgeApiError2 as EdgeApiError,
   EdgeAuthenticationError2 as EdgeAuthenticationError,
   EdgeConnectServer,
   EdgeConsentRequiredError2 as EdgeConsentRequiredError,
   EdgeError2 as EdgeError,
+  EdgeIdentityVerificationError2 as EdgeIdentityVerificationError,
   EdgeInsufficientScopeError2 as EdgeInsufficientScopeError,
   EdgeNetworkError2 as EdgeNetworkError,
   EdgeNotFoundError2 as EdgeNotFoundError,
   EdgeTokenExchangeError2 as EdgeTokenExchangeError,
   EdgeUserClient,
+  TRANSFER_CATEGORIES,
   getEnvironmentConfig2 as getEnvironmentConfig,
   isApiError,
   isAuthenticationError,
   isConsentRequiredError,
   isEdgeError,
+  isIdentityVerificationError,
   isNetworkError,
   isProductionEnvironment
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edge-markets/connect-node",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Server SDK for EDGE Connect token exchange and API calls",
   "author": "Edge Markets",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@edge-markets/connect": "^1.3.0"
+    "@edge-markets/connect": "^1.5.0"
   },
   "devDependencies": {
     "tsup": "^8.0.0",