@edge-markets/connect-node 1.5.0 → 1.6.1

package/README.md

@@ -175,7 +175,7 @@ const balance = await client.getBalance()
 ### Transfers
 
 ```typescript
-// Initiate transfer (requires OTP verification)
+// 1. Initiate the transfer — returns a pending transfer that requires verification.
 const transfer = await client.initiateTransfer({
   type: 'debit',           // 'debit' = pull from user, 'credit' = push to user
   amount: '100.00',
@@ -183,12 +183,22 @@ const transfer = await client.initiateTransfer({
 })
 // Returns: { transferId, status: 'pending_verification', otpMethod }
 
-// Verify with OTP
-const result = await client.verifyTransfer(transfer.transferId, userOtp)
-// Returns: { transferId, status: 'completed' | 'failed' }
+// 2. Create an EDGE-hosted verification session. The returned `verificationUrl`
+//    is a single-use, short-lived URL you embed in an iframe or popup on your
+//    frontend. The user enters their OTP inside the EDGE-hosted UI — OTP secrets
+//    never touch your infrastructure.
+const session = await client.createVerificationSession(transfer.transferId, {
+  origin: 'https://your-site.example.com',
+})
+// Returns: { sessionId, verificationUrl, expiresAt }
+
+// 3. Listen for the postMessage event from the iframe (or poll
+//    getVerificationSessionStatus) to learn when verification completes.
+//    A `transfer.completed` webhook will be delivered to your configured
+//    webhook URL once the transfer settles.
 
 // Get transfer status
-const status = await client.getTransfer(transferId)
+const status = await client.getTransfer(transfer.transferId)
 
 // List transfers
 const { transfers, total } = await client.listTransfers({

package/dist/index.d.mts

@@ -1,5 +1,6 @@
-import { EdgeEnvironment, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, Transfer, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSession, VerificationSessionStatusResponse, EdgeTokens } from '@edge-markets/connect';
-export { Balance, CreateVerificationSessionRequest, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, ListTransfersParams, Transfer, TransferList, TransferListItem, TransferStatus, TransferType, User, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
+import * as node_https from 'node:https';
+import { EdgeEnvironment, TransferCategory, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, Transfer, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSession, VerificationSessionStatusResponse, EdgeTokens } from '@edge-markets/connect';
+export { Balance, CreateVerificationSessionRequest, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferList, TransferListItem, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
 
 interface RequestInfo {
     method: string;
@@ -40,11 +41,20 @@ interface EdgeConnectServerConfig {
         partnerKeyId: string;
         strictResponseEncryption?: boolean;
     };
+    mtls?: MtlsConfig;
+}
+interface MtlsConfig {
+    enabled: boolean;
+    cert: string;
+    key: string;
+    ca?: string;
 }
 interface TransferOptions {
     type: 'debit' | 'credit';
     amount: string;
     idempotencyKey: string;
+    /** Optional transaction category for settlement window determination */
+    category?: TransferCategory;
 }
 
 /**
@@ -61,7 +71,6 @@ declare class EdgeUserClient {
     verifyIdentity(options: VerifyIdentityOptions): Promise<VerifyIdentityResult>;
     getBalance(): Promise<Balance>;
     initiateTransfer(options: TransferOptions): Promise<Transfer>;
-    verifyTransfer(transferId: string, otp: string): Promise<Transfer>;
     getTransfer(transferId: string): Promise<Transfer>;
     listTransfers(params?: ListTransfersParams): Promise<TransferList>;
     revokeConsent(): Promise<{
@@ -86,9 +95,16 @@ declare class EdgeConnectServer {
     private readonly oauthBaseUrl;
     private readonly timeout;
     private readonly retryConfig;
+    private readonly httpsAgent;
+    private readonly dispatcher;
     static getInstance(config: EdgeConnectServerConfig): EdgeConnectServer;
     static clearInstances(): void;
     constructor(config: EdgeConnectServerConfig);
+    /**
+     * Returns the `node:https.Agent` configured with mTLS client certificates.
+     * Use this with axios, got, or other HTTP clients. Returns `undefined` if mTLS is not configured.
+     */
+    getHttpsAgent(): node_https.Agent | undefined;
     /**
      * Create a user-scoped client for making authenticated API calls.
      *
@@ -108,4 +124,4 @@ declare class EdgeConnectServer {
     private handleApiErrorFromBody;
 }
 
-export { EdgeConnectServer, type EdgeConnectServerConfig, EdgeUserClient, type RequestInfo, type ResponseInfo, type RetryConfig, type TransferOptions };
+export { EdgeConnectServer, type EdgeConnectServerConfig, EdgeUserClient, type MtlsConfig, type RequestInfo, type ResponseInfo, type RetryConfig, type TransferOptions };

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import { EdgeEnvironment, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, Transfer, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSession, VerificationSessionStatusResponse, EdgeTokens } from '@edge-markets/connect';
-export { Balance, CreateVerificationSessionRequest, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, ListTransfersParams, Transfer, TransferList, TransferListItem, TransferStatus, TransferType, User, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
+import * as node_https from 'node:https';
+import { EdgeEnvironment, TransferCategory, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, Transfer, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSession, VerificationSessionStatusResponse, EdgeTokens } from '@edge-markets/connect';
+export { Balance, CreateVerificationSessionRequest, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferList, TransferListItem, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
 
 interface RequestInfo {
     method: string;
@@ -40,11 +41,20 @@ interface EdgeConnectServerConfig {
         partnerKeyId: string;
         strictResponseEncryption?: boolean;
     };
+    mtls?: MtlsConfig;
+}
+interface MtlsConfig {
+    enabled: boolean;
+    cert: string;
+    key: string;
+    ca?: string;
 }
 interface TransferOptions {
     type: 'debit' | 'credit';
     amount: string;
     idempotencyKey: string;
+    /** Optional transaction category for settlement window determination */
+    category?: TransferCategory;
 }
 
 /**
@@ -61,7 +71,6 @@ declare class EdgeUserClient {
     verifyIdentity(options: VerifyIdentityOptions): Promise<VerifyIdentityResult>;
     getBalance(): Promise<Balance>;
     initiateTransfer(options: TransferOptions): Promise<Transfer>;
-    verifyTransfer(transferId: string, otp: string): Promise<Transfer>;
     getTransfer(transferId: string): Promise<Transfer>;
     listTransfers(params?: ListTransfersParams): Promise<TransferList>;
     revokeConsent(): Promise<{
@@ -86,9 +95,16 @@ declare class EdgeConnectServer {
     private readonly oauthBaseUrl;
     private readonly timeout;
     private readonly retryConfig;
+    private readonly httpsAgent;
+    private readonly dispatcher;
     static getInstance(config: EdgeConnectServerConfig): EdgeConnectServer;
     static clearInstances(): void;
     constructor(config: EdgeConnectServerConfig);
+    /**
+     * Returns the `node:https.Agent` configured with mTLS client certificates.
+     * Use this with axios, got, or other HTTP clients. Returns `undefined` if mTLS is not configured.
+     */
+    getHttpsAgent(): node_https.Agent | undefined;
     /**
      * Create a user-scoped client for making authenticated API calls.
      *
@@ -108,4 +124,4 @@ declare class EdgeConnectServer {
     private handleApiErrorFromBody;
 }
 
-export { EdgeConnectServer, type EdgeConnectServerConfig, EdgeUserClient, type RequestInfo, type ResponseInfo, type RetryConfig, type TransferOptions };
+export { EdgeConnectServer, type EdgeConnectServerConfig, EdgeUserClient, type MtlsConfig, type RequestInfo, type ResponseInfo, type RetryConfig, type TransferOptions };

package/dist/index.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -25,16 +35,19 @@ __export(index_exports, {
   EdgeConnectServer: () => EdgeConnectServer,
   EdgeConsentRequiredError: () => import_connect3.EdgeConsentRequiredError,
   EdgeError: () => import_connect3.EdgeError,
+  EdgeIdentityVerificationError: () => import_connect3.EdgeIdentityVerificationError,
   EdgeInsufficientScopeError: () => import_connect3.EdgeInsufficientScopeError,
   EdgeNetworkError: () => import_connect3.EdgeNetworkError,
   EdgeNotFoundError: () => import_connect3.EdgeNotFoundError,
   EdgeTokenExchangeError: () => import_connect3.EdgeTokenExchangeError,
   EdgeUserClient: () => EdgeUserClient,
+  TRANSFER_CATEGORIES: () => import_connect4.TRANSFER_CATEGORIES,
   getEnvironmentConfig: () => import_connect4.getEnvironmentConfig,
   isApiError: () => import_connect3.isApiError,
   isAuthenticationError: () => import_connect3.isAuthenticationError,
   isConsentRequiredError: () => import_connect3.isConsentRequiredError,
   isEdgeError: () => import_connect3.isEdgeError,
+  isIdentityVerificationError: () => import_connect3.isIdentityVerificationError,
   isNetworkError: () => import_connect3.isNetworkError,
   isProductionEnvironment: () => import_connect4.isProductionEnvironment
 });
@@ -85,6 +98,9 @@ function validateTransferOptions(options) {
   } else if (options.idempotencyKey.length > 255) {
     errors.idempotencyKey = ["Must be 255 characters or less"];
   }
+  if (options.category && !["sportsbook", "casino", "dfs", "sweepstakes"].includes(options.category)) {
+    errors.category = ["Must be one of: sportsbook, casino, dfs, sweepstakes"];
+  }
   if (Object.keys(errors).length > 0) {
     throw new import_connect.EdgeValidationError("Invalid transfer options", errors);
   }
@@ -113,16 +129,11 @@ var EdgeUserClient = class {
       amount: options.amount,
       idempotencyKey: options.idempotencyKey
     };
+    if (options.category) {
+      body.category = options.category;
+    }
     return this.server._apiRequest("POST", "/transfer", this.accessToken, body);
   }
-  async verifyTransfer(transferId, otp) {
-    return this.server._apiRequest(
-      "POST",
-      `/transfer/${encodeURIComponent(transferId)}/verify`,
-      this.accessToken,
-      { otp }
-    );
-  }
   async getTransfer(transferId) {
     return this.server._apiRequest("GET", `/transfer/${encodeURIComponent(transferId)}`, this.accessToken);
   }
@@ -239,6 +250,37 @@ function fromBase64Url(value) {
   return Buffer.from(normalized, "base64");
 }
 
+// src/mtls.ts
+var import_node_https = __toESM(require("https"));
+function createHttpsAgent(config) {
+  return new import_node_https.default.Agent({
+    cert: config.cert,
+    key: config.key,
+    rejectUnauthorized: true,
+    ...config.ca ? { ca: config.ca } : {}
+  });
+}
+function createUndiciDispatcher(config) {
+  const moduleName = "undici";
+  const { Agent } = require(moduleName);
+  return new Agent({
+    connect: {
+      cert: config.cert,
+      key: config.key,
+      rejectUnauthorized: true,
+      ...config.ca ? { ca: config.ca } : {}
+    }
+  });
+}
+function validateMtlsConfig(config) {
+  if (!config.cert?.trim()) {
+    throw new Error("EdgeConnectServer: mTLS cert is required when enabled");
+  }
+  if (!config.key?.trim()) {
+    throw new Error("EdgeConnectServer: mTLS key is required when enabled");
+  }
+}
+
 // src/types.ts
 var DEFAULT_TIMEOUT = 3e4;
 var USER_AGENT = "@edge-markets/connect-node/1.0.0";
@@ -254,6 +296,28 @@ var instances = /* @__PURE__ */ new Map();
 function getInstanceKey(config) {
   return `${config.clientId}:${config.environment}`;
 }
+var MTLS_ENFORCED_HOSTS = /* @__PURE__ */ new Set(["connect-staging.edgeboost.io", "api.edgeboost.com"]);
+function isMtlsEnforcedHost(host) {
+  if (MTLS_ENFORCED_HOSTS.has(host)) {
+    return true;
+  }
+  for (const enforced of MTLS_ENFORCED_HOSTS) {
+    if (host.endsWith("." + enforced)) {
+      return true;
+    }
+  }
+  return false;
+}
+function environmentRequiresMtls(environment, apiBaseUrl) {
+  if (environment === "staging" || environment === "production") {
+    return true;
+  }
+  try {
+    return isMtlsEnforcedHost(new URL(apiBaseUrl).host);
+  } catch {
+    return false;
+  }
+}
 var EdgeConnectServer = class _EdgeConnectServer {
   static getInstance(config) {
     const key = getInstanceKey(config);
@@ -285,6 +349,22 @@ var EdgeConnectServer = class _EdgeConnectServer {
       ...DEFAULT_RETRY_CONFIG,
       ...config.retry
     };
+    if (config.mtls?.enabled) {
+      validateMtlsConfig(config.mtls);
+      this.httpsAgent = createHttpsAgent(config.mtls);
+      this.dispatcher = createUndiciDispatcher(config.mtls);
+    } else if (environmentRequiresMtls(config.environment, this.apiBaseUrl)) {
+      console.warn(
+        `[EdgeConnectServer] environment='${config.environment}' is served from an mTLS-enforced host (${this.apiBaseUrl}) but no mtls config was provided. Requests will fail at the TLS handshake with a connection reset. Pass mtls: { enabled: true, cert, key, ca? } to EdgeConnectServer or coordinate with EDGE DevRel to issue a partner client certificate.`
+      );
+    }
+  }
+  /**
+   * Returns the `node:https.Agent` configured with mTLS client certificates.
+   * Use this with axios, got, or other HTTP clients. Returns `undefined` if mTLS is not configured.
+   */
+  getHttpsAgent() {
+    return this.httpsAgent;
   }
   /**
    * Create a user-scoped client for making authenticated API calls.
@@ -309,14 +389,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       redirect_uri: redirectUri || this.config.redirectUri || ""
     };
     try {
-      const response = await this.fetchWithTimeout(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "User-Agent": USER_AGENT
+      const response = await this.fetchWithTimeout(
+        tokenUrl,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": USER_AGENT
+          },
+          body: JSON.stringify(body)
         },
-        body: JSON.stringify(body)
-      });
+        this.dispatcher
+      );
       if (!response.ok) {
         const error = await response.json().catch(() => ({}));
         throw this.handleTokenError(error, response.status);
@@ -337,14 +421,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       client_secret: this.config.clientSecret
     };
     try {
-      const response = await this.fetchWithTimeout(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "User-Agent": USER_AGENT
+      const response = await this.fetchWithTimeout(
+        tokenUrl,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": USER_AGENT
+          },
+          body: JSON.stringify(body)
         },
-        body: JSON.stringify(body)
-      });
+        this.dispatcher
+      );
       if (!response.ok) {
         const error = await response.json().catch(() => ({}));
         throw new import_connect2.EdgeAuthenticationError(
@@ -384,11 +472,15 @@ var EdgeConnectServer = class _EdgeConnectServer {
             requestBody = { jwe: encryptMle(body, this.config.clientId, mleConfig) };
           }
         }
-        const response = await this.fetchWithTimeout(url, {
-          method,
-          headers: requestHeaders,
-          body: requestBody !== void 0 ? JSON.stringify(requestBody) : void 0
-        });
+        const response = await this.fetchWithTimeout(
+          url,
+          {
+            method,
+            headers: requestHeaders,
+            body: requestBody !== void 0 ? JSON.stringify(requestBody) : void 0
+          },
+          this.dispatcher
+        );
         const rawResponseBody = await response.json().catch(() => ({}));
         let responseBody = rawResponseBody;
         if (mleEnabled && typeof rawResponseBody?.jwe === "string") {
@@ -447,14 +539,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
   async sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
   }
-  async fetchWithTimeout(url, options) {
+  async fetchWithTimeout(url, options, dispatcher) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
     try {
-      return await fetch(url, {
+      const fetchOptions = {
         ...options,
         signal: controller.signal
-      });
+      };
+      if (dispatcher) {
+        fetchOptions.dispatcher = dispatcher;
+      }
+      return await fetch(url, fetchOptions);
     } finally {
       clearTimeout(timeoutId);
     }
@@ -552,16 +648,19 @@ var import_connect4 = require("@edge-markets/connect");
   EdgeConnectServer,
   EdgeConsentRequiredError,
   EdgeError,
+  EdgeIdentityVerificationError,
   EdgeInsufficientScopeError,
   EdgeNetworkError,
   EdgeNotFoundError,
   EdgeTokenExchangeError,
   EdgeUserClient,
+  TRANSFER_CATEGORIES,
   getEnvironmentConfig,
   isApiError,
   isAuthenticationError,
   isConsentRequiredError,
   isEdgeError,
+  isIdentityVerificationError,
   isNetworkError,
   isProductionEnvironment
 });

package/dist/index.mjs

@@ -1,3 +1,10 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
 // src/edge-connect-server.ts
 import {
   EdgeApiError,
@@ -54,6 +61,9 @@ function validateTransferOptions(options) {
   } else if (options.idempotencyKey.length > 255) {
     errors.idempotencyKey = ["Must be 255 characters or less"];
   }
+  if (options.category && !["sportsbook", "casino", "dfs", "sweepstakes"].includes(options.category)) {
+    errors.category = ["Must be one of: sportsbook, casino, dfs, sweepstakes"];
+  }
   if (Object.keys(errors).length > 0) {
     throw new EdgeValidationError("Invalid transfer options", errors);
   }
@@ -82,16 +92,11 @@ var EdgeUserClient = class {
       amount: options.amount,
       idempotencyKey: options.idempotencyKey
     };
+    if (options.category) {
+      body.category = options.category;
+    }
     return this.server._apiRequest("POST", "/transfer", this.accessToken, body);
   }
-  async verifyTransfer(transferId, otp) {
-    return this.server._apiRequest(
-      "POST",
-      `/transfer/${encodeURIComponent(transferId)}/verify`,
-      this.accessToken,
-      { otp }
-    );
-  }
   async getTransfer(transferId) {
     return this.server._apiRequest("GET", `/transfer/${encodeURIComponent(transferId)}`, this.accessToken);
   }
@@ -208,6 +213,37 @@ function fromBase64Url(value) {
   return Buffer.from(normalized, "base64");
 }
 
+// src/mtls.ts
+import https from "https";
+function createHttpsAgent(config) {
+  return new https.Agent({
+    cert: config.cert,
+    key: config.key,
+    rejectUnauthorized: true,
+    ...config.ca ? { ca: config.ca } : {}
+  });
+}
+function createUndiciDispatcher(config) {
+  const moduleName = "undici";
+  const { Agent } = __require(moduleName);
+  return new Agent({
+    connect: {
+      cert: config.cert,
+      key: config.key,
+      rejectUnauthorized: true,
+      ...config.ca ? { ca: config.ca } : {}
+    }
+  });
+}
+function validateMtlsConfig(config) {
+  if (!config.cert?.trim()) {
+    throw new Error("EdgeConnectServer: mTLS cert is required when enabled");
+  }
+  if (!config.key?.trim()) {
+    throw new Error("EdgeConnectServer: mTLS key is required when enabled");
+  }
+}
+
 // src/types.ts
 var DEFAULT_TIMEOUT = 3e4;
 var USER_AGENT = "@edge-markets/connect-node/1.0.0";
@@ -223,6 +259,28 @@ var instances = /* @__PURE__ */ new Map();
 function getInstanceKey(config) {
   return `${config.clientId}:${config.environment}`;
 }
+var MTLS_ENFORCED_HOSTS = /* @__PURE__ */ new Set(["connect-staging.edgeboost.io", "api.edgeboost.com"]);
+function isMtlsEnforcedHost(host) {
+  if (MTLS_ENFORCED_HOSTS.has(host)) {
+    return true;
+  }
+  for (const enforced of MTLS_ENFORCED_HOSTS) {
+    if (host.endsWith("." + enforced)) {
+      return true;
+    }
+  }
+  return false;
+}
+function environmentRequiresMtls(environment, apiBaseUrl) {
+  if (environment === "staging" || environment === "production") {
+    return true;
+  }
+  try {
+    return isMtlsEnforcedHost(new URL(apiBaseUrl).host);
+  } catch {
+    return false;
+  }
+}
 var EdgeConnectServer = class _EdgeConnectServer {
   static getInstance(config) {
     const key = getInstanceKey(config);
@@ -254,6 +312,22 @@ var EdgeConnectServer = class _EdgeConnectServer {
       ...DEFAULT_RETRY_CONFIG,
       ...config.retry
     };
+    if (config.mtls?.enabled) {
+      validateMtlsConfig(config.mtls);
+      this.httpsAgent = createHttpsAgent(config.mtls);
+      this.dispatcher = createUndiciDispatcher(config.mtls);
+    } else if (environmentRequiresMtls(config.environment, this.apiBaseUrl)) {
+      console.warn(
+        `[EdgeConnectServer] environment='${config.environment}' is served from an mTLS-enforced host (${this.apiBaseUrl}) but no mtls config was provided. Requests will fail at the TLS handshake with a connection reset. Pass mtls: { enabled: true, cert, key, ca? } to EdgeConnectServer or coordinate with EDGE DevRel to issue a partner client certificate.`
+      );
+    }
+  }
+  /**
+   * Returns the `node:https.Agent` configured with mTLS client certificates.
+   * Use this with axios, got, or other HTTP clients. Returns `undefined` if mTLS is not configured.
+   */
+  getHttpsAgent() {
+    return this.httpsAgent;
   }
   /**
    * Create a user-scoped client for making authenticated API calls.
@@ -278,14 +352,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       redirect_uri: redirectUri || this.config.redirectUri || ""
     };
     try {
-      const response = await this.fetchWithTimeout(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "User-Agent": USER_AGENT
+      const response = await this.fetchWithTimeout(
+        tokenUrl,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": USER_AGENT
+          },
+          body: JSON.stringify(body)
         },
-        body: JSON.stringify(body)
-      });
+        this.dispatcher
+      );
       if (!response.ok) {
         const error = await response.json().catch(() => ({}));
         throw this.handleTokenError(error, response.status);
@@ -306,14 +384,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
       client_secret: this.config.clientSecret
     };
     try {
-      const response = await this.fetchWithTimeout(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "User-Agent": USER_AGENT
+      const response = await this.fetchWithTimeout(
+        tokenUrl,
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "User-Agent": USER_AGENT
+          },
+          body: JSON.stringify(body)
         },
-        body: JSON.stringify(body)
-      });
+        this.dispatcher
+      );
       if (!response.ok) {
         const error = await response.json().catch(() => ({}));
         throw new EdgeAuthenticationError(
@@ -353,11 +435,15 @@ var EdgeConnectServer = class _EdgeConnectServer {
             requestBody = { jwe: encryptMle(body, this.config.clientId, mleConfig) };
           }
         }
-        const response = await this.fetchWithTimeout(url, {
-          method,
-          headers: requestHeaders,
-          body: requestBody !== void 0 ? JSON.stringify(requestBody) : void 0
-        });
+        const response = await this.fetchWithTimeout(
+          url,
+          {
+            method,
+            headers: requestHeaders,
+            body: requestBody !== void 0 ? JSON.stringify(requestBody) : void 0
+          },
+          this.dispatcher
+        );
         const rawResponseBody = await response.json().catch(() => ({}));
         let responseBody = rawResponseBody;
         if (mleEnabled && typeof rawResponseBody?.jwe === "string") {
@@ -416,14 +502,18 @@ var EdgeConnectServer = class _EdgeConnectServer {
   async sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
   }
-  async fetchWithTimeout(url, options) {
+  async fetchWithTimeout(url, options, dispatcher) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this.timeout);
     try {
-      return await fetch(url, {
+      const fetchOptions = {
         ...options,
         signal: controller.signal
-      });
+      };
+      if (dispatcher) {
+        fetchOptions.dispatcher = dispatcher;
+      }
+      return await fetch(url, fetchOptions);
     } finally {
       clearTimeout(timeoutId);
     }
@@ -517,6 +607,7 @@ import {
   EdgeAuthenticationError as EdgeAuthenticationError2,
   EdgeConsentRequiredError as EdgeConsentRequiredError2,
   EdgeError as EdgeError2,
+  EdgeIdentityVerificationError as EdgeIdentityVerificationError2,
   EdgeInsufficientScopeError as EdgeInsufficientScopeError2,
   EdgeNetworkError as EdgeNetworkError2,
   EdgeNotFoundError as EdgeNotFoundError2,
@@ -525,25 +616,29 @@ import {
   isAuthenticationError,
   isConsentRequiredError,
   isEdgeError,
+  isIdentityVerificationError,
   isNetworkError
 } from "@edge-markets/connect";
-import { getEnvironmentConfig as getEnvironmentConfig2, isProductionEnvironment } from "@edge-markets/connect";
+import { TRANSFER_CATEGORIES, getEnvironmentConfig as getEnvironmentConfig2, isProductionEnvironment } from "@edge-markets/connect";
 export {
   EdgeApiError2 as EdgeApiError,
   EdgeAuthenticationError2 as EdgeAuthenticationError,
   EdgeConnectServer,
   EdgeConsentRequiredError2 as EdgeConsentRequiredError,
   EdgeError2 as EdgeError,
+  EdgeIdentityVerificationError2 as EdgeIdentityVerificationError,
   EdgeInsufficientScopeError2 as EdgeInsufficientScopeError,
   EdgeNetworkError2 as EdgeNetworkError,
   EdgeNotFoundError2 as EdgeNotFoundError,
   EdgeTokenExchangeError2 as EdgeTokenExchangeError,
   EdgeUserClient,
+  TRANSFER_CATEGORIES,
   getEnvironmentConfig2 as getEnvironmentConfig,
   isApiError,
   isAuthenticationError,
   isConsentRequiredError,
   isEdgeError,
+  isIdentityVerificationError,
   isNetworkError,
   isProductionEnvironment
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edge-markets/connect-node",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "description": "Server SDK for EDGE Connect token exchange and API calls",
   "author": "Edge Markets",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@edge-markets/connect": "^1.4.0"
+    "@edge-markets/connect": "^1.5.1"
   },
   "devDependencies": {
     "tsup": "^8.0.0",