@edge-markets/connect-node 1.6.1 → 1.8.0

package/dist/index.d.mts

@@ -1,16 +1,23 @@
 import * as node_https from 'node:https';
-import { EdgeEnvironment, TransferCategory, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, Transfer, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSession, VerificationSessionStatusResponse, EdgeTokens } from '@edge-markets/connect';
-export { Balance, CreateVerificationSessionRequest, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferList, TransferListItem, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
+import { EdgeEnvironment, TransferCategory, Transfer, VerificationSession, TransferType, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSessionStatusResponse, EdgeTokens, EdgeWebhookEvent, TransferStatus, EdgeWebhookEventType } from '@edge-markets/connect';
+export { Balance, BaseWebhookEvent, ConsentRevokedEventData, CreateVerificationSessionRequest, EDGE_WEBHOOK_EVENT_TYPES, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, EdgeValidationError, EdgeWebhookEvent, EdgeWebhookEventType, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferCompletedEventData, TransferExpiredEventData, TransferFailedEventData, TransferList, TransferListItem, TransferProcessingEventData, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
 
+type RequestEndpoint = 'connect_api' | 'oauth_token' | 'partner_webhook_sync';
 interface RequestInfo {
     method: string;
     url: string;
     body?: unknown;
+    endpoint?: RequestEndpoint;
+    attempt?: number;
 }
 interface ResponseInfo {
     status: number;
     body: unknown;
     durationMs: number;
+    method?: string;
+    url?: string;
+    endpoint?: RequestEndpoint;
+    attempt?: number;
 }
 interface RetryConfig {
     maxRetries?: number;
@@ -23,6 +30,17 @@ interface EdgeConnectServerConfig {
     clientSecret: string;
     environment: EdgeEnvironment;
     apiBaseUrl?: string;
+    /**
+     * Override the partner dashboard API base URL.
+     *
+     * Most integrations should omit this. The SDK derives the dashboard base
+     * from `apiBaseUrl` by replacing `/connect/v1` with `/v1`, matching the
+     * EDGE Connect gateway layout:
+     *
+     * - user-scoped API: `https://connect-staging.edgeboost.io/connect/v1`
+     * - partner dashboard API: `https://connect-staging.edgeboost.io/v1`
+     */
+    partnerApiBaseUrl?: string;
     oauthBaseUrl?: string;
     /**
      * @deprecated cognitoDomain is no longer used. Token exchange now goes through EdgeBoost API.
@@ -42,12 +60,40 @@ interface EdgeConnectServerConfig {
         strictResponseEncryption?: boolean;
     };
     mtls?: MtlsConfig;
+    /**
+     * Partner-level OAuth client ID for the `client_credentials` grant.
+     *
+     * Required ONLY when calling {@link EdgeConnectServer.syncWebhookEvents}.
+     * This is a different OAuth client than {@link clientId} — it authenticates
+     * your backend (not your users) for partner-scoped surfaces like the
+     * webhook reconciliation sync endpoint.
+     *
+     * If omitted, `syncWebhookEvents()` throws on first call but the rest of
+     * the SDK (token exchange, user-scoped API calls) continues to work.
+     */
+    partnerClientId?: string;
+    /**
+     * Partner-level OAuth client secret paired with {@link partnerClientId}.
+     *
+     * Required ONLY when calling {@link EdgeConnectServer.syncWebhookEvents}.
+     */
+    partnerClientSecret?: string;
 }
 interface MtlsConfig {
     enabled: boolean;
+    /** Client certificate PEM used to authenticate this partner to EDGE Connect. */
     cert: string;
+    /** Client private key PEM paired with `cert`. */
     key: string;
-    ca?: string;
+    /**
+     * Optional additional server trust root(s), as PEM text.
+     *
+     * The SDK appends these certificates to Node's default public trust store
+     * instead of replacing it. Public EDGE Connect gateways use public ACM
+     * certificates, so most partners should omit this unless EDGE provides a
+     * private server CA for a non-public endpoint.
+     */
+    ca?: string | string[];
 }
 interface TransferOptions {
     type: 'debit' | 'credit';
@@ -57,6 +103,38 @@ interface TransferOptions {
     category?: TransferCategory;
 }
 
+interface TransferAmountLimits {
+    min?: string | number;
+    max?: string | number;
+}
+interface CreateTransferIdempotencyKeyOptions {
+    partnerUserId: string;
+    type: TransferType;
+    amount: string | number;
+    category?: TransferCategory;
+    externalId?: string;
+    nonce?: string;
+    namespace?: string;
+}
+interface TransferIntent {
+    type: TransferType;
+    amount: string | number;
+    category?: TransferCategory | null;
+}
+interface StartTransferVerificationOptions {
+    transfer: TransferOptions;
+    origin: string;
+}
+interface StartTransferVerificationResult {
+    transfer: Transfer;
+    verificationSession: VerificationSession;
+}
+declare function normalizeMoneyAmount(value: string | number): string;
+declare function validateTransferAmount(value: string | number, limits?: TransferAmountLimits): string;
+declare function createTransferIdempotencyKey(options: CreateTransferIdempotencyKeyOptions): string;
+declare function assertSameTransferIntent(existing: TransferIntent, requested: TransferIntent): void;
+declare function startTransferVerification(client: Pick<EdgeUserClient, 'initiateTransfer' | 'createVerificationSession'>, options: StartTransferVerificationOptions): Promise<StartTransferVerificationResult>;
+
 /**
  * A lightweight, user-scoped API client created via {@link EdgeConnectServer.forUser}.
  *
@@ -71,6 +149,7 @@ declare class EdgeUserClient {
     verifyIdentity(options: VerifyIdentityOptions): Promise<VerifyIdentityResult>;
     getBalance(): Promise<Balance>;
     initiateTransfer(options: TransferOptions): Promise<Transfer>;
+    startTransferVerification(options: StartTransferVerificationOptions): Promise<StartTransferVerificationResult>;
     getTransfer(transferId: string): Promise<Transfer>;
     listTransfers(params?: ListTransfersParams): Promise<TransferList>;
     revokeConsent(): Promise<{
@@ -89,14 +168,134 @@ declare class EdgeUserClient {
     getVerificationSessionStatus(transferId: string, sessionId: string): Promise<VerificationSessionStatusResponse>;
 }
 
+type EdgeTokenVaultKeyMaterial = string | Buffer | Uint8Array;
+interface EdgeTokenVaultKey {
+    id: string;
+    key: EdgeTokenVaultKeyMaterial;
+}
+interface EdgeTokenVaultOptions {
+    currentKey: EdgeTokenVaultKey;
+    previousKeys?: EdgeTokenVaultKey[];
+}
+declare class EdgeTokenVault {
+    private readonly currentKey;
+    private readonly keysById;
+    constructor(options: EdgeTokenVaultOptions);
+    encryptTokens(tokens: EdgeTokens): string;
+    decryptTokens(envelope: string): EdgeTokens;
+    isEncrypted(value: unknown): value is string;
+}
+declare function createEdgeTokenVault(options: EdgeTokenVaultOptions): EdgeTokenVault;
+declare function isEdgeTokenVaultEnvelope(value: unknown): value is string;
+
+type EdgeTokenStoreValue = EdgeTokens | string;
+interface EdgeTokenStoreSaveContext {
+    tokens: EdgeTokens;
+    refreshed: boolean;
+}
+interface EdgeTokenStore {
+    load: (subjectId: string) => Promise<EdgeTokenStoreValue | null | undefined> | EdgeTokenStoreValue | null | undefined;
+    save: (subjectId: string, value: EdgeTokenStoreValue, context: EdgeTokenStoreSaveContext) => Promise<void> | void;
+}
+interface EdgeUserSessionOptions {
+    edge: Pick<EdgeConnectServer, 'forUser' | 'refreshTokens'>;
+    subjectId: string;
+    tokenStore: EdgeTokenStore;
+    tokenVault?: Pick<EdgeTokenVault, 'encryptTokens' | 'decryptTokens' | 'isEncrypted'>;
+    refreshSkewMs?: number;
+    now?: () => number;
+    onRefresh?: (tokens: EdgeTokens) => Promise<void> | void;
+}
+interface GetValidTokensOptions {
+    forceRefresh?: boolean;
+}
+declare class EdgeUserSession {
+    private readonly edge;
+    private readonly subjectId;
+    private readonly tokenStore;
+    private readonly tokenVault?;
+    private readonly refreshSkewMs;
+    private readonly now;
+    private readonly onRefresh?;
+    constructor(options: EdgeUserSessionOptions);
+    getValidTokens(options?: GetValidTokensOptions): Promise<EdgeTokens>;
+    getClient(options?: GetValidTokensOptions): Promise<EdgeUserClient>;
+    withClient<T>(callback: (client: EdgeUserClient, tokens: EdgeTokens) => Promise<T> | T): Promise<T>;
+    saveTokens(tokens: EdgeTokens, refreshed?: boolean): Promise<void>;
+    private loadTokens;
+}
+declare function createEdgeUserSession(options: EdgeUserSessionOptions): EdgeUserSession;
+
+interface WebhookReconcilerCursorStore {
+    load: () => Promise<string | null | undefined> | string | null | undefined;
+    save: (cursor: string) => Promise<void> | void;
+}
+interface WebhookReconcilerOptions {
+    edge: Pick<EdgeConnectServer, 'syncWebhookEvents'>;
+    cursorStore: WebhookReconcilerCursorStore;
+    processEvent: (event: EdgeWebhookEvent) => Promise<void> | void;
+    limit?: SyncWebhookEventsOptions['limit'];
+    maxPages?: number;
+}
+interface WebhookReconcilerRunResult {
+    processed: number;
+    pages: number;
+    cursor?: string;
+    hasMore: boolean;
+    skipped: boolean;
+    reason?: 'already_running' | 'empty_page_with_has_more' | 'max_pages_reached';
+}
+declare class EdgeWebhookReconciler {
+    private readonly options;
+    private running;
+    constructor(options: WebhookReconcilerOptions);
+    run(): Promise<WebhookReconcilerRunResult>;
+    private runInternal;
+}
+declare function createWebhookReconciler(options: WebhookReconcilerOptions): EdgeWebhookReconciler;
+
+/**
+ * Options for {@link EdgeConnectServer.syncWebhookEvents}.
+ */
+interface SyncWebhookEventsOptions {
+    /**
+     * Cursor token. Pass the `id` of the last event you successfully processed
+     * to receive only newer events. Omit on the first call to start from the
+     * beginning of the 30-day server-side lookback window.
+     */
+    afterEventId?: string;
+    /**
+     * Maximum events per page (1–100). Defaults to 20 server-side.
+     */
+    limit?: number;
+}
+/**
+ * Result of {@link EdgeConnectServer.syncWebhookEvents}. Field names are
+ * normalized to camelCase from the wire format (`has_more` → `hasMore`).
+ */
+interface SyncWebhookEventsResult {
+    /**
+     * Events newer than the supplied cursor, in ascending order. Each event
+     * is the unwrapped {@link EdgeWebhookEvent} payload (the SDK strips the
+     * sync API's outer envelope).
+     */
+    events: EdgeWebhookEvent[];
+    /**
+     * `true` if more events are available beyond this page. Loop while this
+     * is truthy, advancing your cursor to the `id` of the last processed event.
+     */
+    hasMore: boolean;
+}
 declare class EdgeConnectServer {
     private readonly config;
     private readonly apiBaseUrl;
+    private readonly partnerApiBaseUrl;
     private readonly oauthBaseUrl;
     private readonly timeout;
     private readonly retryConfig;
     private readonly httpsAgent;
     private readonly dispatcher;
+    private partnerTokenCache;
     static getInstance(config: EdgeConnectServerConfig): EdgeConnectServer;
     static clearInstances(): void;
     constructor(config: EdgeConnectServerConfig);
@@ -112,10 +311,84 @@ declare class EdgeConnectServer {
      * or per user session and discard it when the token changes.
      */
     forUser(accessToken: string): EdgeUserClient;
+    createUserSession(options: Omit<EdgeUserSessionOptions, 'edge'>): EdgeUserSession;
     exchangeCode(code: string, codeVerifier: string, redirectUri?: string): Promise<EdgeTokens>;
     refreshTokens(refreshToken: string): Promise<EdgeTokens>;
     /** @internal Called by {@link EdgeUserClient} — not part of the public API. */
     _apiRequest<T>(method: string, path: string, accessToken: string, body?: unknown): Promise<T>;
+    /**
+     * Reconcile webhook events from the partner sync endpoint.
+     *
+     * Use this from a scheduled cron (every ~5 minutes is typical) to catch
+     * events your primary webhook receiver missed — partner downtime, retry
+     * exhaustion, dead-letter queue. This is the third reliability layer
+     * ("Leg 3") on top of HTTP delivery + DLQ.
+     *
+     * **Authentication.** This method uses the OAuth `client_credentials`
+     * grant against {@link EdgeConnectServerConfig.partnerClientId} and
+     * {@link EdgeConnectServerConfig.partnerClientSecret}. The token is
+     * cached internally and refreshed automatically.
+     *
+     * **Pagination.** Pass `afterEventId` with the last `id` you processed.
+     * Loop while `hasMore` is true. The server enforces a 30-day lookback;
+     * cursors older than 30 days return events from 30 days ago, not an error.
+     *
+     * @example
+     * ```typescript
+     * let cursor: string | undefined = await loadCursorFromDb()
+     *
+     * while (true) {
+     *   const { events, hasMore } = await edge.syncWebhookEvents({ afterEventId: cursor })
+     *   for (const event of events) {
+     *     await processEvent(event)
+     *     cursor = event.id
+     *   }
+     *   if (events.length > 0) await saveCursorToDb(cursor!)
+     *   if (!hasMore) break
+     * }
+     * ```
+     *
+     * @throws {EdgeAuthenticationError} If partner credentials are missing
+     *         or the partner token cannot be obtained / refreshed
+     * @throws {EdgeNetworkError} On network failure
+     * @throws {EdgeApiError} For other non-2xx responses after retries
+     */
+    syncWebhookEvents(options?: SyncWebhookEventsOptions): Promise<SyncWebhookEventsResult>;
+    /**
+     * Creates a cursor-based webhook reconciler bound to this SDK instance.
+     *
+     * Use this from cron jobs to process events returned by
+     * {@link EdgeConnectServer.syncWebhookEvents} without hand-writing
+     * pagination, cursor advancement, or process-level concurrency guards.
+     */
+    createWebhookReconciler(options: Omit<WebhookReconcilerOptions, 'edge'>): EdgeWebhookReconciler;
+    /**
+     * Builds the sync URL with normalized query parameters.
+     */
+    private normalizeSyncWebhookEventsOptions;
+    private buildSyncUrl;
+    /**
+     * Issues a GET to the sync endpoint with the partner Bearer token. Kept
+     * separate from `_apiRequest` because partner tokens have a different
+     * lifecycle (process-wide, client_credentials) than user tokens.
+     */
+    private partnerFetch;
+    /**
+     * Fetches (or returns the cached) partner token via the
+     * `client_credentials` grant. Caches with a 60s safety margin so the
+     * token is renewed *before* the server-side expiry, never racing it.
+     *
+     * Side-effects: writes `this.partnerTokenCache` on success.
+     */
+    private getPartnerToken;
+    /**
+     * @internal Test-only: clears the cached partner token so the next call
+     * to `syncWebhookEvents` re-fetches it. Not part of the public API.
+     */
+    _resetPartnerTokenCache(): void;
+    private redactPartnerTokenResponseBody;
+    private redactPartnerSyncResponseBody;
+    private drainResponseBody;
     private getRetryDelay;
     private sleep;
     private fetchWithTimeout;
@@ -124,4 +397,169 @@ declare class EdgeConnectServer {
     private handleApiErrorFromBody;
 }
 
-export { EdgeConnectServer, type EdgeConnectServerConfig, EdgeUserClient, type MtlsConfig, type RequestInfo, type ResponseInfo, type RetryConfig, type TransferOptions };
+type EdgeConnectEnv = Record<string, string | undefined>;
+interface CreateEdgeConnectServerFromEnvOptions {
+    env?: EdgeConnectEnv;
+    requireMtls?: boolean;
+    timeout?: number;
+    retry?: RetryConfig;
+    onRequest?: (info: RequestInfo) => void;
+    onResponse?: (info: ResponseInfo) => void;
+    mle?: EdgeConnectServerConfig['mle'];
+}
+interface EdgeConnectServerFromEnvCapabilities {
+    mtlsEnabled: boolean;
+    webhookSyncConfigured: boolean;
+    customApiBaseUrl: boolean;
+    customOAuthBaseUrl: boolean;
+    customPartnerApiBaseUrl: boolean;
+}
+interface EdgeConnectServerFromEnvResult {
+    server: EdgeConnectServer;
+    config: EdgeConnectServerConfig;
+    capabilities: EdgeConnectServerFromEnvCapabilities;
+    warnings: string[];
+}
+declare function createEdgeConnectServerFromEnv(options?: CreateEdgeConnectServerFromEnvOptions): EdgeConnectServerFromEnvResult;
+
+interface EdgeProblemJson {
+    type: string;
+    title: string;
+    status: number;
+    detail: string;
+    code: string;
+    details?: Record<string, unknown>;
+}
+interface EdgeHttpError {
+    status: number;
+    body: EdgeProblemJson;
+}
+declare function toEdgeHttpError(error: unknown): EdgeHttpError;
+declare function toEdgeProblemJson(error: unknown): EdgeProblemJson;
+
+interface PartnerIdentityAddress {
+    street?: string | null;
+    line1?: string | null;
+    address1?: string | null;
+    city?: string | null;
+    state?: string | null;
+    zip?: string | null;
+    postalCode?: string | null;
+}
+interface PartnerIdentityProfile {
+    firstName?: string | null;
+    givenName?: string | null;
+    lastName?: string | null;
+    familyName?: string | null;
+    address?: PartnerIdentityAddress | null;
+}
+interface IdentityPolicy {
+    minNameScore?: number;
+    minAddressScore?: number;
+    requireZipMatch?: boolean;
+    requireApiVerified?: boolean;
+}
+interface IdentityPolicyEvaluation {
+    verified: boolean;
+    reasons: string[];
+    scores?: VerifyIdentityResult['scores'];
+}
+declare function buildVerifyIdentityPayload(profile: PartnerIdentityProfile): VerifyIdentityOptions;
+declare function evaluateIdentityResult(result: VerifyIdentityResult, policy?: IdentityPolicy): IdentityPolicyEvaluation;
+
+interface TransferWebhookIntent {
+    transferId: string;
+    type?: TransferType;
+    amount?: string | number;
+    status?: TransferStatus;
+}
+declare function isTransferWebhookEvent(event: EdgeWebhookEvent): event is Extract<EdgeWebhookEvent, {
+    type: `transfer.${string}`;
+}>;
+declare function assertTransferEventMatchesIntent(event: EdgeWebhookEvent, intent: TransferWebhookIntent): void;
+
+/**
+ * Webhook Signature Verification (SDK-001)
+ *
+ * HMAC-SHA256 verification for EDGE Connect webhook payloads.
+ *
+ * Signature header format: `t={timestamp},v1={hex_hmac}`
+ * Signed message: `{timestamp}.{raw_json_body}`
+ *
+ * The timestamp prefix prevents replay attacks — events older than the
+ * tolerance window (default 5 minutes) are rejected. The HMAC is verified
+ * with constant-time comparison to prevent timing attacks.
+ */
+/**
+ * Options for {@link verifyWebhookSignature}.
+ */
+interface VerifyWebhookSignatureOptions {
+    /**
+     * Maximum age of the signature timestamp, in seconds.
+     *
+     * Signatures older than this are rejected as potential replays.
+     * Defaults to 300 seconds (5 minutes), matching the producer.
+     */
+    toleranceSeconds?: number;
+}
+/**
+ * Verifies an EDGE Connect webhook signature.
+ *
+ * **Always pass the raw request body bytes** — never `JSON.stringify(req.body)`.
+ * Re-stringifying after the framework parses JSON will reorder keys, change
+ * whitespace, and silently break verification with no diagnostic. Capture
+ * the raw body via your framework's raw-body middleware:
+ *
+ * - Express: `express.raw({ type: 'application/json' })`
+ * - Fastify: built-in (use `request.rawBody`)
+ * - NestJS: `{ rawBody: true }` on `NestFactory.create` + `RawBodyRequest<Request>`
+ *
+ * @param header - The `X-Edge-Signature` header value (`t=...,v1=...`)
+ * @param body - The raw request body as a UTF-8 string (NOT a parsed object)
+ * @param secret - The partner's webhook signing secret
+ * @param options - Optional overrides
+ * @returns `true` if the signature is valid and within the tolerance window,
+ *          `false` otherwise. Never throws — malformed input returns `false`.
+ *
+ * @example
+ * ```typescript
+ * import { verifyWebhookSignature } from '@edge-markets/connect-node'
+ *
+ * app.post('/webhooks/edge', express.raw({ type: 'application/json' }), (req, res) => {
+ *   const ok = verifyWebhookSignature(
+ *     req.headers['x-edge-signature'] as string,
+ *     req.body.toString('utf8'),
+ *     process.env.EDGE_WEBHOOK_SECRET!,
+ *   )
+ *
+ *   if (!ok) return res.status(401).send('invalid signature')
+ *
+ *   const event = JSON.parse(req.body.toString('utf8'))
+ *   // ... process event
+ *   res.status(200).send('ok')
+ * })
+ * ```
+ */
+declare function verifyWebhookSignature(header: string, body: string, secret: string, options?: VerifyWebhookSignatureOptions): boolean;
+
+type EdgeWebhookRawBody = string | Buffer | Uint8Array;
+type EdgeWebhookSignatureHeader = string | string[] | undefined | null;
+interface ParseAndVerifyWebhookOptions extends VerifyWebhookSignatureOptions {
+    rawBody: EdgeWebhookRawBody;
+    signatureHeader: EdgeWebhookSignatureHeader;
+    secret: string;
+    receivedAt?: Date;
+}
+interface ParsedEdgeWebhook {
+    event: EdgeWebhookEvent;
+    eventId: string;
+    eventType: EdgeWebhookEventType;
+    signatureTimestamp: number;
+    receivedAt: Date;
+}
+declare function parseAndVerifyWebhook(options: ParseAndVerifyWebhookOptions): ParsedEdgeWebhook;
+declare function extractWebhookSignatureTimestamp(header: EdgeWebhookSignatureHeader): number | undefined;
+declare function isEdgeWebhookEvent(value: unknown): value is EdgeWebhookEvent;
+declare function validateEdgeWebhookEvent(value: unknown): EdgeWebhookEvent;
+
+export { type CreateEdgeConnectServerFromEnvOptions, type CreateTransferIdempotencyKeyOptions, type EdgeConnectEnv, EdgeConnectServer, type EdgeConnectServerConfig, type EdgeConnectServerFromEnvCapabilities, type EdgeConnectServerFromEnvResult, type EdgeHttpError, type EdgeProblemJson, type EdgeTokenStore, type EdgeTokenStoreSaveContext, type EdgeTokenStoreValue, EdgeTokenVault, type EdgeTokenVaultKey, type EdgeTokenVaultKeyMaterial, type EdgeTokenVaultOptions, EdgeUserClient, EdgeUserSession, type EdgeUserSessionOptions, type EdgeWebhookRawBody, EdgeWebhookReconciler, type EdgeWebhookSignatureHeader, type GetValidTokensOptions, type IdentityPolicy, type IdentityPolicyEvaluation, type MtlsConfig, type ParseAndVerifyWebhookOptions, type ParsedEdgeWebhook, type PartnerIdentityAddress, type PartnerIdentityProfile, type RequestInfo, type ResponseInfo, type RetryConfig, type StartTransferVerificationOptions, type StartTransferVerificationResult, type SyncWebhookEventsOptions, type SyncWebhookEventsResult, type TransferAmountLimits, type TransferIntent, type TransferOptions, type TransferWebhookIntent, type VerifyWebhookSignatureOptions, type WebhookReconcilerCursorStore, type WebhookReconcilerOptions, type WebhookReconcilerRunResult, assertSameTransferIntent, assertTransferEventMatchesIntent, buildVerifyIdentityPayload, createEdgeConnectServerFromEnv, createEdgeTokenVault, createEdgeUserSession, createTransferIdempotencyKey, createWebhookReconciler, evaluateIdentityResult, extractWebhookSignatureTimestamp, isEdgeTokenVaultEnvelope, isEdgeWebhookEvent, isTransferWebhookEvent, normalizeMoneyAmount, parseAndVerifyWebhook, startTransferVerification, toEdgeHttpError, toEdgeProblemJson, validateEdgeWebhookEvent, validateTransferAmount, verifyWebhookSignature };