@edge-markets/connect-node 1.9.0 → 1.10.0

package/README.md

@@ -92,7 +92,9 @@ Supported environment variables:
 | `EDGE_PARTNER_CLIENT_SECRET` | Partner machine-to-machine client secret for webhook sync |
 | `EDGE_MTLS_CERT` / `EDGE_MTLS_CERT_PATH` | Client certificate PEM or file path |
 | `EDGE_MTLS_KEY` / `EDGE_MTLS_KEY_PATH` | Client private key PEM or file path |
-| `EDGE_MTLS_CA` / `EDGE_MTLS_CA_PATH` | Optional extra server trust root PEM or file path |
+| `EDGE_SERVER_CA_PEM` / `EDGE_SERVER_CA_PEM_PATH` | Optional extra server trust root PEM or file path |
+| `EDGE_MTLS_CA` / `EDGE_MTLS_CA_PATH` | Legacy alias for optional extra server trust root PEM or file path |
+| `EDGE_REQUIRE_MTLS` | Set to `true` to fail startup unless client cert and key are configured |
 | `EDGE_TIMEOUT_MS` | Optional request timeout in milliseconds |
 
 Use inline PEMs with escaped newlines (`\n`) or file paths. If both are set,

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import * as node_https from 'node:https';
 import { EdgeEnvironment, TransferCategory, Transfer, VerificationSession, TransferType, TransferStatus, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSessionStatusResponse, EdgeTokens, EdgeWebhookEvent, EdgeWebhookEventType } from '@edge-markets/connect';
-export { Balance, BaseWebhookEvent, ConsentRevokedEventData, CreateVerificationSessionRequest, EDGE_WEBHOOK_EVENT_TYPES, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, EdgeValidationError, EdgeWebhookEvent, EdgeWebhookEventType, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferCompletedEventData, TransferExpiredEventData, TransferFailedEventData, TransferList, TransferListItem, TransferProcessingEventData, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
+export { ACTIVE_EDGE_SCOPES, Balance, BaseWebhookEvent, ConsentRevokedEventData, CreateVerificationSessionRequest, EDGE_CONNECT_FEATURE_UNAVAILABLE_MESSAGE, EDGE_WEBHOOK_EVENT_TYPES, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeFeatureUnavailableError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, EdgeValidationError, EdgeWebhookEvent, EdgeWebhookEventType, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferCompletedEventData, TransferExpiredEventData, TransferFailedEventData, TransferList, TransferListItem, TransferProcessingEventData, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isFeatureUnavailableError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
 
 type RequestEndpoint = 'connect_api' | 'oauth_token' | 'partner_webhook_sync';
 interface RequestInfo {
@@ -175,14 +175,13 @@ declare class EdgeUserClient {
         revoked: boolean;
     }>;
     /**
-     * Creates an EDGE-hosted transfer verification session.
-     * Returns a `verificationUrl` to open in an iframe or popup.
-     * The handoff token is single-use and expires in 120 seconds.
+     * Reserved for a future transfer release.
+     * Currently throws EdgeFeatureUnavailableError before validation or network I/O.
      */
     createVerificationSession(transferId: string, options: CreateVerificationSessionRequest): Promise<VerificationSession>;
     /**
-     * Polls the status of a verification session.
-     * Use as an alternative to postMessage events.
+     * Reserved for a future transfer release.
+     * Currently throws EdgeFeatureUnavailableError before validation or network I/O.
      */
     getVerificationSessionStatus(transferId: string, sessionId: string): Promise<VerificationSessionStatusResponse>;
 }

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as node_https from 'node:https';
 import { EdgeEnvironment, TransferCategory, Transfer, VerificationSession, TransferType, TransferStatus, User, VerifyIdentityOptions, VerifyIdentityResult, Balance, ListTransfersParams, TransferList, CreateVerificationSessionRequest, VerificationSessionStatusResponse, EdgeTokens, EdgeWebhookEvent, EdgeWebhookEventType } from '@edge-markets/connect';
-export { Balance, BaseWebhookEvent, ConsentRevokedEventData, CreateVerificationSessionRequest, EDGE_WEBHOOK_EVENT_TYPES, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, EdgeValidationError, EdgeWebhookEvent, EdgeWebhookEventType, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferCompletedEventData, TransferExpiredEventData, TransferFailedEventData, TransferList, TransferListItem, TransferProcessingEventData, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
+export { ACTIVE_EDGE_SCOPES, Balance, BaseWebhookEvent, ConsentRevokedEventData, CreateVerificationSessionRequest, EDGE_CONNECT_FEATURE_UNAVAILABLE_MESSAGE, EDGE_WEBHOOK_EVENT_TYPES, EdgeApiError, EdgeAuthenticationError, EdgeConsentRequiredError, EdgeEnvironment, EdgeError, EdgeFeatureUnavailableError, EdgeIdentityVerificationError, EdgeInsufficientScopeError, EdgeNetworkError, EdgeNotFoundError, EdgeTokenExchangeError, EdgeTokens, EdgeValidationError, EdgeWebhookEvent, EdgeWebhookEventType, ListTransfersParams, SdkGeolocation, TRANSFER_CATEGORIES, Transfer, TransferCategory, TransferCompletedEventData, TransferExpiredEventData, TransferFailedEventData, TransferList, TransferListItem, TransferProcessingEventData, TransferStatus, TransferType, User, UserAddress, VerificationSession, VerificationSessionStatus, VerificationSessionStatusResponse, VerifyIdentityAddress, VerifyIdentityOptions, VerifyIdentityResult, VerifyIdentityScores, getEnvironmentConfig, isApiError, isAuthenticationError, isConsentRequiredError, isEdgeError, isFeatureUnavailableError, isIdentityVerificationError, isNetworkError, isProductionEnvironment } from '@edge-markets/connect';
 
 type RequestEndpoint = 'connect_api' | 'oauth_token' | 'partner_webhook_sync';
 interface RequestInfo {
@@ -175,14 +175,13 @@ declare class EdgeUserClient {
         revoked: boolean;
     }>;
     /**
-     * Creates an EDGE-hosted transfer verification session.
-     * Returns a `verificationUrl` to open in an iframe or popup.
-     * The handoff token is single-use and expires in 120 seconds.
+     * Reserved for a future transfer release.
+     * Currently throws EdgeFeatureUnavailableError before validation or network I/O.
      */
     createVerificationSession(transferId: string, options: CreateVerificationSessionRequest): Promise<VerificationSession>;
     /**
-     * Polls the status of a verification session.
-     * Use as an alternative to postMessage events.
+     * Reserved for a future transfer release.
+     * Currently throws EdgeFeatureUnavailableError before validation or network I/O.
      */
     getVerificationSessionStatus(transferId: string, sessionId: string): Promise<VerificationSessionStatusResponse>;
 }

package/dist/index.js

@@ -30,25 +30,28 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACTIVE_EDGE_SCOPES: () => import_connect16.ACTIVE_EDGE_SCOPES,
   CONNECT_TRANSFER_DIRECTIONS: () => CONNECT_TRANSFER_DIRECTIONS,
-  EDGE_WEBHOOK_EVENT_TYPES: () => import_connect15.EDGE_WEBHOOK_EVENT_TYPES,
-  EdgeApiError: () => import_connect14.EdgeApiError,
-  EdgeAuthenticationError: () => import_connect14.EdgeAuthenticationError,
+  EDGE_CONNECT_FEATURE_UNAVAILABLE_MESSAGE: () => import_connect15.EDGE_CONNECT_FEATURE_UNAVAILABLE_MESSAGE,
+  EDGE_WEBHOOK_EVENT_TYPES: () => import_connect16.EDGE_WEBHOOK_EVENT_TYPES,
+  EdgeApiError: () => import_connect15.EdgeApiError,
+  EdgeAuthenticationError: () => import_connect15.EdgeAuthenticationError,
   EdgeConnectServer: () => EdgeConnectServer,
-  EdgeConsentRequiredError: () => import_connect14.EdgeConsentRequiredError,
-  EdgeError: () => import_connect14.EdgeError,
-  EdgeIdentityVerificationError: () => import_connect14.EdgeIdentityVerificationError,
-  EdgeInsufficientScopeError: () => import_connect14.EdgeInsufficientScopeError,
-  EdgeNetworkError: () => import_connect14.EdgeNetworkError,
-  EdgeNotFoundError: () => import_connect14.EdgeNotFoundError,
-  EdgeTokenExchangeError: () => import_connect14.EdgeTokenExchangeError,
+  EdgeConsentRequiredError: () => import_connect15.EdgeConsentRequiredError,
+  EdgeError: () => import_connect15.EdgeError,
+  EdgeFeatureUnavailableError: () => import_connect15.EdgeFeatureUnavailableError,
+  EdgeIdentityVerificationError: () => import_connect15.EdgeIdentityVerificationError,
+  EdgeInsufficientScopeError: () => import_connect15.EdgeInsufficientScopeError,
+  EdgeNetworkError: () => import_connect15.EdgeNetworkError,
+  EdgeNotFoundError: () => import_connect15.EdgeNotFoundError,
+  EdgeTokenExchangeError: () => import_connect15.EdgeTokenExchangeError,
   EdgeTokenVault: () => EdgeTokenVault,
   EdgeUserClient: () => EdgeUserClient,
   EdgeUserSession: () => EdgeUserSession,
-  EdgeValidationError: () => import_connect14.EdgeValidationError,
+  EdgeValidationError: () => import_connect15.EdgeValidationError,
   EdgeWebhookInbox: () => EdgeWebhookInbox,
   EdgeWebhookReconciler: () => EdgeWebhookReconciler,
-  TRANSFER_CATEGORIES: () => import_connect15.TRANSFER_CATEGORIES,
+  TRANSFER_CATEGORIES: () => import_connect16.TRANSFER_CATEGORIES,
   assertSameTransferIntent: () => assertSameTransferIntent,
   assertTransferEventMatchesIntent: () => assertTransferEventMatchesIntent,
   assertWebhookMatchesTransfer: () => assertWebhookMatchesTransfer,
@@ -68,16 +71,17 @@ __export(index_exports, {
   getConnectTransferDirection: () => getConnectTransferDirection,
   getEdgeWebhookRawBody: () => getEdgeWebhookRawBody,
   getEdgeWebhookSignatureHeader: () => getEdgeWebhookSignatureHeader,
-  getEnvironmentConfig: () => import_connect15.getEnvironmentConfig,
-  isApiError: () => import_connect14.isApiError,
-  isAuthenticationError: () => import_connect14.isAuthenticationError,
-  isConsentRequiredError: () => import_connect14.isConsentRequiredError,
-  isEdgeError: () => import_connect14.isEdgeError,
+  getEnvironmentConfig: () => import_connect16.getEnvironmentConfig,
+  isApiError: () => import_connect15.isApiError,
+  isAuthenticationError: () => import_connect15.isAuthenticationError,
+  isConsentRequiredError: () => import_connect15.isConsentRequiredError,
+  isEdgeError: () => import_connect15.isEdgeError,
   isEdgeTokenVaultEnvelope: () => isEdgeTokenVaultEnvelope,
   isEdgeWebhookEvent: () => isEdgeWebhookEvent,
-  isIdentityVerificationError: () => import_connect14.isIdentityVerificationError,
-  isNetworkError: () => import_connect14.isNetworkError,
-  isProductionEnvironment: () => import_connect15.isProductionEnvironment,
+  isFeatureUnavailableError: () => import_connect15.isFeatureUnavailableError,
+  isIdentityVerificationError: () => import_connect15.isIdentityVerificationError,
+  isNetworkError: () => import_connect15.isNetworkError,
+  isProductionEnvironment: () => import_connect16.isProductionEnvironment,
   isTransferWebhookEvent: () => isTransferWebhookEvent,
   mapTransferStatusToPartnerState: () => mapTransferStatusToPartnerState,
   moneyAmountsEqual: () => moneyAmountsEqual,
@@ -96,7 +100,10 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/edge-connect-server.ts
-var import_connect4 = require("@edge-markets/connect");
+var import_connect5 = require("@edge-markets/connect");
+
+// src/edge-user-client.ts
+var import_connect3 = require("@edge-markets/connect");
 
 // src/transfer-helpers.ts
 var import_connect = require("@edge-markets/connect");
@@ -194,6 +201,7 @@ function mapTransferStatusToPartnerState(status, mapping) {
   return partnerState;
 }
 async function startTransferVerification(client, options) {
+  assertTransferFeatureAvailable();
   const origin = typeof options.origin === "string" ? options.origin.trim() : "";
   if (!origin) {
     throw new import_connect.EdgeValidationError("Verification origin is required", {
@@ -213,6 +221,14 @@ async function startTransferVerification(client, options) {
   const verificationSession = await client.createVerificationSession(transferId, { origin });
   return { transfer, verificationSession };
 }
+function assertTransferFeatureAvailable() {
+  if (!isTransferFeatureAvailable()) {
+    throw new import_connect.EdgeFeatureUnavailableError();
+  }
+}
+function isTransferFeatureAvailable() {
+  return false;
+}
 function parseMoneyToCents(value, field, options = {}) {
   let input;
   if (typeof value === "number") {
@@ -334,6 +350,7 @@ var EdgeUserClient = class {
     return this.server._apiRequest("GET", "/balance", this.accessToken);
   }
   async initiateTransfer(options) {
+    assertTransferFeatureAvailable2();
     validateTransferOptions(options);
     const body = {
       type: options.type,
@@ -346,13 +363,16 @@ var EdgeUserClient = class {
     return this.server._apiRequest("POST", "/transfer", this.accessToken, body);
   }
   async startTransferVerification(options) {
+    assertTransferFeatureAvailable2();
     return startTransferVerification(this, options);
   }
   async getTransfer(transferId) {
+    assertTransferFeatureAvailable2();
     validateTransferId(transferId);
     return this.server._apiRequest("GET", `/transfer/${encodeURIComponent(transferId)}`, this.accessToken);
   }
   async listTransfers(params) {
+    assertTransferFeatureAvailable2();
     const queryParams = new URLSearchParams();
     if (params?.limit) queryParams.set("limit", String(params.limit));
     if (params?.offset) queryParams.set("offset", String(params.offset));
@@ -365,11 +385,11 @@ var EdgeUserClient = class {
     return this.server._apiRequest("DELETE", "/consent", this.accessToken);
   }
   /**
-   * Creates an EDGE-hosted transfer verification session.
-   * Returns a `verificationUrl` to open in an iframe or popup.
-   * The handoff token is single-use and expires in 120 seconds.
+   * Reserved for a future transfer release.
+   * Currently throws EdgeFeatureUnavailableError before validation or network I/O.
    */
   async createVerificationSession(transferId, options) {
+    assertTransferFeatureAvailable2();
     validateTransferId(transferId);
     return this.server._apiRequest(
       "POST",
@@ -379,10 +399,11 @@ var EdgeUserClient = class {
     );
   }
   /**
-   * Polls the status of a verification session.
-   * Use as an alternative to postMessage events.
+   * Reserved for a future transfer release.
+   * Currently throws EdgeFeatureUnavailableError before validation or network I/O.
    */
   async getVerificationSessionStatus(transferId, sessionId) {
+    assertTransferFeatureAvailable2();
     validateTransferId(transferId);
     return this.server._apiRequest(
       "GET",
@@ -391,6 +412,14 @@ var EdgeUserClient = class {
     );
   }
 };
+function assertTransferFeatureAvailable2() {
+  if (!isTransferFeatureAvailable2()) {
+    throw new import_connect3.EdgeFeatureUnavailableError();
+  }
+}
+function isTransferFeatureAvailable2() {
+  return false;
+}
 
 // src/mle.ts
 var import_crypto = require("crypto");
@@ -529,28 +558,28 @@ function validateMtlsConfig(config) {
 }
 
 // src/session.ts
-var import_connect3 = require("@edge-markets/connect");
+var import_connect4 = require("@edge-markets/connect");
 var EdgeUserSession = class {
   constructor(options) {
     this.refreshPromise = null;
     if (!options.edge?.forUser || !options.edge?.refreshTokens) {
-      throw new import_connect3.EdgeValidationError("EdgeUserSession requires an EdgeConnectServer instance", {
+      throw new import_connect4.EdgeValidationError("EdgeUserSession requires an EdgeConnectServer instance", {
         edge: ["Provide edge.forUser and edge.refreshTokens"]
       });
     }
     const subjectId = typeof options.subjectId === "string" ? options.subjectId.trim() : "";
     if (!subjectId) {
-      throw new import_connect3.EdgeValidationError("EdgeUserSession subjectId is required", {
+      throw new import_connect4.EdgeValidationError("EdgeUserSession subjectId is required", {
         subjectId: ["Required"]
       });
     }
     if (!options.tokenStore?.load || !options.tokenStore?.save) {
-      throw new import_connect3.EdgeValidationError("EdgeUserSession tokenStore is required", {
+      throw new import_connect4.EdgeValidationError("EdgeUserSession tokenStore is required", {
         tokenStore: ["Provide load(subjectId) and save(subjectId, value, context)"]
       });
     }
     if (options.refreshSkewMs !== void 0 && (!Number.isFinite(options.refreshSkewMs) || options.refreshSkewMs < 0)) {
-      throw new import_connect3.EdgeValidationError("refreshSkewMs must be a non-negative number", {
+      throw new import_connect4.EdgeValidationError("refreshSkewMs must be a non-negative number", {
         refreshSkewMs: ["Must be greater than or equal to 0"]
       });
     }
@@ -603,13 +632,13 @@ var EdgeUserSession = class {
   async loadTokens() {
     const value = await this.tokenStore.load(this.subjectId);
     if (!value) {
-      throw new import_connect3.EdgeAuthenticationError("No EDGE tokens are stored for this subject", {
+      throw new import_connect4.EdgeAuthenticationError("No EDGE tokens are stored for this subject", {
         subjectId: this.subjectId
       });
     }
     if (typeof value === "string") {
       if (!this.tokenVault) {
-        throw new import_connect3.EdgeAuthenticationError("Encrypted EDGE token envelope loaded but no tokenVault was configured", {
+        throw new import_connect4.EdgeAuthenticationError("Encrypted EDGE token envelope loaded but no tokenVault was configured", {
           subjectId: this.subjectId
         });
       }
@@ -695,7 +724,7 @@ function validateTokens(tokens) {
     }
   }
   if (Object.keys(errors).length > 0) {
-    throw new import_connect3.EdgeValidationError("Invalid EDGE token payload", errors);
+    throw new import_connect4.EdgeValidationError("Invalid EDGE token payload", errors);
   }
 }
 
@@ -886,7 +915,7 @@ var EdgeConnectServer = class _EdgeConnectServer {
       throw new Error("EdgeConnectServer: environment is required");
     }
     this.config = config;
-    const envConfig = (0, import_connect4.getEnvironmentConfig)(config.environment);
+    const envConfig = (0, import_connect5.getEnvironmentConfig)(config.environment);
     this.apiBaseUrl = config.apiBaseUrl || envConfig.apiBaseUrl;
     this.partnerApiBaseUrl = stripTrailingSlash(config.partnerApiBaseUrl || derivePartnerApiBaseUrl(this.apiBaseUrl));
     this.oauthBaseUrl = config.oauthBaseUrl || envConfig.oauthBaseUrl;
@@ -931,7 +960,7 @@ var EdgeConnectServer = class _EdgeConnectServer {
    */
   forUser(accessToken) {
     if (!accessToken) {
-      throw new import_connect4.EdgeAuthenticationError("accessToken is required when calling forUser()");
+      throw new import_connect5.EdgeAuthenticationError("accessToken is required when calling forUser()");
     }
     return new EdgeUserClient(this, accessToken);
   }
@@ -968,8 +997,8 @@ var EdgeConnectServer = class _EdgeConnectServer {
       const data = await response.json();
       return this.parseTokenResponse(data);
     } catch (error) {
-      if (error instanceof import_connect4.EdgeError) throw error;
-      throw new import_connect4.EdgeNetworkError("Failed to exchange code", error);
+      if (error instanceof import_connect5.EdgeError) throw error;
+      throw new import_connect5.EdgeNetworkError("Failed to exchange code", error);
     }
   }
   async refreshTokens(refreshToken) {
@@ -995,7 +1024,7 @@ var EdgeConnectServer = class _EdgeConnectServer {
       );
       if (!response.ok) {
         const error = await response.json().catch(() => ({}));
-        throw new import_connect4.EdgeAuthenticationError(
+        throw new import_connect5.EdgeAuthenticationError(
           error.message || error.error_description || "Token refresh failed. User may need to reconnect.",
           { tokenError: error }
         );
@@ -1003,8 +1032,8 @@ var EdgeConnectServer = class _EdgeConnectServer {
       const data = await response.json();
       return this.parseTokenResponse(data, refreshToken);
     } catch (error) {
-      if (error instanceof import_connect4.EdgeError) throw error;
-      throw new import_connect4.EdgeNetworkError("Failed to refresh tokens", error);
+      if (error instanceof import_connect5.EdgeError) throw error;
+      throw new import_connect5.EdgeNetworkError("Failed to refresh tokens", error);
     }
   }
   /** @internal Called by {@link EdgeUserClient} — not part of the public API. */
@@ -1046,14 +1075,14 @@ var EdgeConnectServer = class _EdgeConnectServer {
         if (mleEnabled && typeof rawResponseBody?.jwe === "string") {
           responseBody = decryptMle(rawResponseBody.jwe, mleConfig);
         } else if (!mleEnabled && typeof rawResponseBody?.jwe === "string") {
-          throw new import_connect4.EdgeApiError(
+          throw new import_connect5.EdgeApiError(
             "mle_required",
             "The API responded with message-level encryption. Enable MLE in SDK config.",
             response.status,
             rawResponseBody
           );
         } else if (mleEnabled && mleConfig?.strictResponseEncryption !== false && response.ok && typeof rawResponseBody?.jwe !== "string") {
-          throw new import_connect4.EdgeApiError(
+          throw new import_connect5.EdgeApiError(
             "mle_response_missing",
             "Expected encrypted response payload but received plaintext.",
             response.status,
@@ -1071,8 +1100,8 @@ var EdgeConnectServer = class _EdgeConnectServer {
         }
         return responseBody;
       } catch (error) {
-        if (error instanceof import_connect4.EdgeError) {
-          if (!(error instanceof import_connect4.EdgeNetworkError) || attempt >= this.retryConfig.maxRetries) {
+        if (error instanceof import_connect5.EdgeError) {
+          if (!(error instanceof import_connect5.EdgeNetworkError) || attempt >= this.retryConfig.maxRetries) {
             throw error;
           }
           lastError = error;
@@ -1080,11 +1109,11 @@ var EdgeConnectServer = class _EdgeConnectServer {
         }
         lastError = error;
         if (attempt >= this.retryConfig.maxRetries) {
-          throw new import_connect4.EdgeNetworkError(`API request failed: ${method} ${path}`, lastError);
+          throw new import_connect5.EdgeNetworkError(`API request failed: ${method} ${path}`, lastError);
         }
       }
     }
-    throw new import_connect4.EdgeNetworkError(
+    throw new import_connect5.EdgeNetworkError(
       `API request failed after ${this.retryConfig.maxRetries} retries: ${method} ${path}`,
       lastError
     );
@@ -1128,10 +1157,10 @@ var EdgeConnectServer = class _EdgeConnectServer {
    */
   async syncWebhookEvents(options = {}) {
     if (!this.config.partnerClientId) {
-      throw new import_connect4.EdgeAuthenticationError("syncWebhookEvents requires `partnerClientId` in EdgeConnectServer config");
+      throw new import_connect5.EdgeAuthenticationError("syncWebhookEvents requires `partnerClientId` in EdgeConnectServer config");
     }
     if (!this.config.partnerClientSecret) {
-      throw new import_connect4.EdgeAuthenticationError("syncWebhookEvents requires `partnerClientSecret` in EdgeConnectServer config");
+      throw new import_connect5.EdgeAuthenticationError("syncWebhookEvents requires `partnerClientSecret` in EdgeConnectServer config");
     }
     const normalizedOptions = this.normalizeSyncWebhookEventsOptions(options);
     const url = this.buildSyncUrl(normalizedOptions);
@@ -1162,7 +1191,7 @@ var EdgeConnectServer = class _EdgeConnectServer {
           endpoint: "partner_webhook_sync",
           attempt
         });
-        throw new import_connect4.EdgeAuthenticationError(
+        throw new import_connect5.EdgeAuthenticationError(
           body.message || "Partner token rejected after refresh \u2014 check partnerClientId/Secret",
           body
         );
@@ -1179,7 +1208,7 @@ var EdgeConnectServer = class _EdgeConnectServer {
         endpoint: "partner_webhook_sync",
         attempt
       });
-      throw new import_connect4.EdgeApiError(
+      throw new import_connect5.EdgeApiError(
         body.error || "sync_failed",
         body.message || `syncWebhookEvents failed with status ${response.status}`,
         response.status,
@@ -1225,7 +1254,7 @@ var EdgeConnectServer = class _EdgeConnectServer {
     }
     if (options.limit !== void 0) {
       if (!Number.isInteger(options.limit) || options.limit < SYNC_WEBHOOK_EVENTS_MIN_LIMIT || options.limit > SYNC_WEBHOOK_EVENTS_MAX_LIMIT) {
-        throw new import_connect4.EdgeApiError(
+        throw new import_connect5.EdgeApiError(
           "invalid_sync_options",
           `syncWebhookEvents limit must be an integer between ${SYNC_WEBHOOK_EVENTS_MIN_LIMIT} and ${SYNC_WEBHOOK_EVENTS_MAX_LIMIT}`,
           400,
@@ -1295,11 +1324,11 @@ var EdgeConnectServer = class _EdgeConnectServer {
       } catch (error) {
         lastError = error;
         if (attempt >= this.retryConfig.maxRetries) {
-          throw new import_connect4.EdgeNetworkError("syncWebhookEvents network failure", lastError);
+          throw new import_connect5.EdgeNetworkError("syncWebhookEvents network failure", lastError);
         }
       }
     }
-    throw new import_connect4.EdgeNetworkError(
+    throw new import_connect5.EdgeNetworkError(
       `syncWebhookEvents network failure after ${this.retryConfig.maxRetries} retries`,
       lastError
     );
@@ -1347,7 +1376,7 @@ var EdgeConnectServer = class _EdgeConnectServer {
         this.dispatcher
       );
     } catch (error) {
-      throw new import_connect4.EdgeNetworkError("Partner token request network failure", error);
+      throw new import_connect5.EdgeNetworkError("Partner token request network failure", error);
     }
     const durationMs = Date.now() - startTime;
     const data = await response.json().catch(() => ({}));
@@ -1360,13 +1389,13 @@ var EdgeConnectServer = class _EdgeConnectServer {
       endpoint: "oauth_token"
     });
     if (!response.ok) {
-      throw new import_connect4.EdgeAuthenticationError(
+      throw new import_connect5.EdgeAuthenticationError(
         data.message || data.error_description || `Partner token request failed with status ${response.status}`,
         data
       );
     }
     if (!data.access_token || typeof data.expires_in !== "number") {
-      throw new import_connect4.EdgeAuthenticationError("Partner token response missing access_token or expires_in");
+      throw new import_connect5.EdgeAuthenticationError("Partner token response missing access_token or expires_in");
     }
     this.partnerTokenCache = {
       token: data.access_token,
@@ -1441,37 +1470,37 @@ var EdgeConnectServer = class _EdgeConnectServer {
     const errorCode = error.error;
     const errorMessage = error.message || error.error_description;
     if (errorCode === "invalid_grant" || errorMessage?.includes("Invalid or expired")) {
-      return new import_connect4.EdgeTokenExchangeError("Authorization code is invalid, expired, or already used. Please try again.", {
+      return new import_connect5.EdgeTokenExchangeError("Authorization code is invalid, expired, or already used. Please try again.", {
         edgeBoostError: error
       });
     }
     if (errorCode === "invalid_client" || errorMessage?.includes("Invalid client")) {
-      return new import_connect4.EdgeAuthenticationError("Invalid client credentials. Check your client ID and secret.", {
+      return new import_connect5.EdgeAuthenticationError("Invalid client credentials. Check your client ID and secret.", {
         edgeBoostError: error
       });
     }
     if (errorMessage?.includes("code_verifier") || errorMessage?.includes("PKCE")) {
-      return new import_connect4.EdgeTokenExchangeError("PKCE verification failed. Please try again.", { edgeBoostError: error });
+      return new import_connect5.EdgeTokenExchangeError("PKCE verification failed. Please try again.", { edgeBoostError: error });
     }
-    return new import_connect4.EdgeTokenExchangeError(errorMessage || "Failed to exchange authorization code", {
+    return new import_connect5.EdgeTokenExchangeError(errorMessage || "Failed to exchange authorization code", {
       edgeBoostError: error,
       statusCode: status
     });
   }
   async handleApiErrorFromBody(error, status, path) {
     if (status === 401) {
-      return new import_connect4.EdgeAuthenticationError(error.message || "Access token is invalid or expired", error);
+      return new import_connect5.EdgeAuthenticationError(error.message || "Access token is invalid or expired", error);
     }
     if (status === 403) {
       if (error.error === "consent_required") {
-        return new import_connect4.EdgeConsentRequiredError(
+        return new import_connect5.EdgeConsentRequiredError(
           this.config.clientId,
           error.consentUrl,
           error.message
         );
       }
       if (error.error === "insufficient_scope" || error.error === "insufficient_consent") {
-        return new import_connect4.EdgeInsufficientScopeError(
+        return new import_connect5.EdgeInsufficientScopeError(
           error.missing_scopes || error.missingScopes || [],
           error.message
         );
@@ -1493,15 +1522,15 @@ var EdgeConnectServer = class _EdgeConnectServer {
       } else if (path.includes("/transfer")) {
         resourceType = "Transfer";
       }
-      return new import_connect4.EdgeNotFoundError(resourceType, resourceId);
+      return new import_connect5.EdgeNotFoundError(resourceType, resourceId);
     }
     if (status === 422 && error.error === "identity_verification_failed") {
-      return new import_connect4.EdgeIdentityVerificationError(
+      return new import_connect5.EdgeIdentityVerificationError(
         error.fieldErrors || {},
         error.message
       );
     }
-    return new import_connect4.EdgeApiError(
+    return new import_connect5.EdgeApiError(
       error.error || "api_error",
       error.message || error.error_description || `Request failed with status ${status}`,
       status,
@@ -1511,9 +1540,9 @@ var EdgeConnectServer = class _EdgeConnectServer {
 };
 
 // src/env.ts
-var import_connect5 = require("@edge-markets/connect");
+var import_connect6 = require("@edge-markets/connect");
 var import_node_fs2 = __toESM(require("fs"));
-var ENVIRONMENT_NAMES = new Set(Object.keys(import_connect5.EDGE_ENVIRONMENTS));
+var ENVIRONMENT_NAMES = new Set(Object.keys(import_connect6.EDGE_ENVIRONMENTS));
 function readEnv(env, name) {
   const value = env[name];
   if (typeof value !== "string") return void 0;
@@ -1546,7 +1575,7 @@ function readPemValue(env, valueName, pathName, warnings) {
     return normalizePem(import_node_fs2.default.readFileSync(filePath, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    throw new import_connect5.EdgeValidationError(`Failed to read ${pathName}`, {
+    throw new import_connect6.EdgeValidationError(`Failed to read ${pathName}`, {
       [pathName]: [`Unable to read PEM file "${filePath}": ${message}`]
     });
   }
@@ -1554,19 +1583,29 @@ function readPemValue(env, valueName, pathName, warnings) {
 function readEnvironment(env) {
   const value = readEnv(env, "EDGE_ENVIRONMENT") || "staging";
   if (!ENVIRONMENT_NAMES.has(value)) {
-    throw new import_connect5.EdgeValidationError("Invalid EDGE_ENVIRONMENT", {
+    throw new import_connect6.EdgeValidationError("Invalid EDGE_ENVIRONMENT", {
       EDGE_ENVIRONMENT: [`Must be one of: ${Array.from(ENVIRONMENT_NAMES).join(", ")}`]
     });
   }
   return value;
 }
+function readBooleanEnv(env, name) {
+  const value = readEnv(env, name);
+  if (!value) return void 0;
+  const normalized = value.toLowerCase();
+  if (["true", "1", "yes"].includes(normalized)) return true;
+  if (["false", "0", "no"].includes(normalized)) return false;
+  throw new import_connect6.EdgeValidationError(`Invalid ${name}`, {
+    [name]: ["Must be one of: true, false, 1, 0, yes, no"]
+  });
+}
 function readTimeout(env, override) {
   if (override !== void 0) return override;
   const value = readFirstEnv(env, ["EDGE_TIMEOUT_MS", "EDGE_REQUEST_TIMEOUT_MS"]);
   if (!value) return void 0;
   const timeout = Number(value);
   if (!Number.isInteger(timeout) || timeout <= 0) {
-    throw new import_connect5.EdgeValidationError("Invalid EDGE_TIMEOUT_MS", {
+    throw new import_connect6.EdgeValidationError("Invalid EDGE_TIMEOUT_MS", {
       EDGE_TIMEOUT_MS: ["Must be a positive integer number of milliseconds"]
     });
   }
@@ -1575,10 +1614,15 @@ function readTimeout(env, override) {
 function buildMtlsConfig(env, requireMtls, warnings) {
   const cert = readPemValue(env, "EDGE_MTLS_CERT", "EDGE_MTLS_CERT_PATH", warnings);
   const key = readPemValue(env, "EDGE_MTLS_KEY", "EDGE_MTLS_KEY_PATH", warnings);
-  const ca = readPemValue(env, "EDGE_MTLS_CA", "EDGE_MTLS_CA_PATH", warnings);
+  const serverCa = readPemValue(env, "EDGE_SERVER_CA_PEM", "EDGE_SERVER_CA_PEM_PATH", warnings);
+  const hasLegacyCa = !!readFirstEnv(env, ["EDGE_MTLS_CA", "EDGE_MTLS_CA_PATH"]);
+  if (serverCa && hasLegacyCa) {
+    warnings.push("EDGE_SERVER_CA_PEM and EDGE_MTLS_CA are both set; using EDGE_SERVER_CA_PEM");
+  }
+  const ca = serverCa || readPemValue(env, "EDGE_MTLS_CA", "EDGE_MTLS_CA_PATH", warnings);
   if (!cert && !key && !ca) {
     if (requireMtls) {
-      throw new import_connect5.EdgeValidationError("mTLS is required but no EDGE_MTLS_CERT or EDGE_MTLS_KEY was provided", {
+      throw new import_connect6.EdgeValidationError("mTLS is required but no EDGE_MTLS_CERT or EDGE_MTLS_KEY was provided", {
         EDGE_MTLS_CERT: ["Required when requireMtls is true"],
         EDGE_MTLS_KEY: ["Required when requireMtls is true"]
       });
@@ -1586,7 +1630,7 @@ function buildMtlsConfig(env, requireMtls, warnings) {
     return void 0;
   }
   if (!cert || !key) {
-    throw new import_connect5.EdgeValidationError("Incomplete mTLS configuration", {
+    throw new import_connect6.EdgeValidationError("Incomplete mTLS configuration", {
       EDGE_MTLS_CERT: cert ? [] : ["Required when mTLS is configured"],
       EDGE_MTLS_KEY: key ? [] : ["Required when mTLS is configured"]
     });
@@ -1600,7 +1644,7 @@ function buildMtlsConfig(env, requireMtls, warnings) {
 }
 function inferMtlsRequirement(environment, apiBaseUrl) {
   if (environment === "staging" || environment === "production") return true;
-  const resolvedApiBaseUrl = apiBaseUrl || (0, import_connect5.getEnvironmentConfig)(environment).apiBaseUrl;
+  const resolvedApiBaseUrl = apiBaseUrl || (0, import_connect6.getEnvironmentConfig)(environment).apiBaseUrl;
   try {
     const host = new URL(resolvedApiBaseUrl).host;
     return host === "connect-staging.edgeboost.io" || host === "connect.edgeboost.io";
@@ -1614,7 +1658,7 @@ function createEdgeConnectServerFromEnv(options = {}) {
   const environment = readEnvironment(env);
   const apiBaseUrl = readEnv(env, "EDGE_API_BASE_URL");
   const mtlsRequiredByTarget = inferMtlsRequirement(environment, apiBaseUrl);
-  const requireMtls = options.requireMtls ?? false;
+  const requireMtls = options.requireMtls ?? readBooleanEnv(env, "EDGE_REQUIRE_MTLS") ?? false;
   const mtls = buildMtlsConfig(env, requireMtls, warnings);
   const timeout = readTimeout(env, options.timeout);
   const clientId = readFirstEnv(env, ["EDGE_CLIENT_ID", "EDGE_CONNECT_CLIENT_ID"]) || "";
@@ -1627,7 +1671,7 @@ function createEdgeConnectServerFromEnv(options = {}) {
   if (!clientId) validationErrors.EDGE_CLIENT_ID = ["Required"];
   if (!clientSecret) validationErrors.EDGE_CLIENT_SECRET = ["Required"];
   if (Object.keys(validationErrors).length > 0) {
-    throw new import_connect5.EdgeValidationError("Missing required EDGE Connect environment variables", validationErrors);
+    throw new import_connect6.EdgeValidationError("Missing required EDGE Connect environment variables", validationErrors);
   }
   if (mtlsRequiredByTarget && !mtls) {
     warnings.push(
@@ -1666,32 +1710,35 @@ function createEdgeConnectServerFromEnv(options = {}) {
 }
 
 // src/error-adapter.ts
-var import_connect6 = require("@edge-markets/connect");
+var import_connect7 = require("@edge-markets/connect");
 function toEdgeHttpError(error) {
   const body = toEdgeProblemJson(error);
   return { status: body.status, body };
 }
 function toEdgeProblemJson(error) {
-  if (error instanceof import_connect6.EdgeConsentRequiredError) {
+  if (error instanceof import_connect7.EdgeConsentRequiredError) {
     return problem(error, "Consent required", error.statusCode ?? 403, {
       clientId: error.clientId,
       consentUrl: error.consentUrl
     });
   }
-  if (error instanceof import_connect6.EdgeValidationError) {
+  if (error instanceof import_connect7.EdgeValidationError) {
     return problem(error, "Validation failed", error.statusCode ?? 400, {
       validationErrors: error.validationErrors
     });
   }
-  if (error instanceof import_connect6.EdgeIdentityVerificationError) {
+  if (error instanceof import_connect7.EdgeIdentityVerificationError) {
     return problem(error, "Identity verification failed", error.statusCode ?? 422, {
       fieldErrors: error.fieldErrors
     });
   }
-  if (error instanceof import_connect6.EdgeNetworkError) {
+  if (error instanceof import_connect7.EdgeFeatureUnavailableError) {
+    return problem(error, "Feature unavailable", error.statusCode ?? 501);
+  }
+  if (error instanceof import_connect7.EdgeNetworkError) {
     return problem(error, "EDGE network error", error.statusCode ?? 502);
   }
-  if (error instanceof import_connect6.EdgeError) {
+  if (error instanceof import_connect7.EdgeError) {
     return problem(error, edgeTitle(error), error.statusCode ?? 500, error.details);
   }
   const message = error instanceof Error ? error.message : "Unexpected error";
@@ -1718,10 +1765,10 @@ function edgeTitle(error) {
 }
 
 // src/http-helpers.ts
-var import_connect8 = require("@edge-markets/connect");
+var import_connect9 = require("@edge-markets/connect");
 
 // src/webhook-parser.ts
-var import_connect7 = require("@edge-markets/connect");
+var import_connect8 = require("@edge-markets/connect");
 
 // src/webhook-signing.ts
 var import_node_crypto2 = __toESM(require("crypto"));
@@ -1753,23 +1800,23 @@ function verifyWebhookSignature(header, body, secret, options = {}) {
 }
 
 // src/webhook-parser.ts
-var EVENT_TYPES = new Set(import_connect7.EDGE_WEBHOOK_EVENT_TYPES);
+var EVENT_TYPES = new Set(import_connect8.EDGE_WEBHOOK_EVENT_TYPES);
 var TRANSFER_TYPES = /* @__PURE__ */ new Set(["debit", "credit"]);
 function parseAndVerifyWebhook(options) {
   const body = normalizeRawBody(options.rawBody);
   const header = normalizeSignatureHeader(options.signatureHeader);
   const signatureTimestamp = extractWebhookSignatureTimestamp(header);
   if (!header || !signatureTimestamp) {
-    throw new import_connect7.EdgeAuthenticationError("Missing or malformed EDGE webhook signature");
+    throw new import_connect8.EdgeAuthenticationError("Missing or malformed EDGE webhook signature");
   }
   if (!verifyWebhookSignature(header, body, options.secret, { toleranceSeconds: options.toleranceSeconds })) {
-    throw new import_connect7.EdgeAuthenticationError("Invalid EDGE webhook signature");
+    throw new import_connect8.EdgeAuthenticationError("Invalid EDGE webhook signature");
   }
   let parsed;
   try {
     parsed = JSON.parse(body);
   } catch {
-    throw new import_connect7.EdgeValidationError("EDGE webhook body must be valid JSON", {
+    throw new import_connect8.EdgeValidationError("EDGE webhook body must be valid JSON", {
       rawBody: ["Unable to parse JSON after signature verification"]
     });
   }
@@ -1802,7 +1849,7 @@ function isEdgeWebhookEvent(value) {
 function validateEdgeWebhookEvent(value) {
   const errors = {};
   if (!isRecord(value)) {
-    throw new import_connect7.EdgeValidationError("EDGE webhook event must be an object", {
+    throw new import_connect8.EdgeValidationError("EDGE webhook event must be an object", {
       event: ["Expected JSON object"]
     });
   }
@@ -1814,7 +1861,7 @@ function validateEdgeWebhookEvent(value) {
     errors.id = ["Required string"];
   }
   if (typeof type !== "string" || !EVENT_TYPES.has(type)) {
-    errors.type = [`Must be one of: ${import_connect7.EDGE_WEBHOOK_EVENT_TYPES.join(", ")}`];
+    errors.type = [`Must be one of: ${import_connect8.EDGE_WEBHOOK_EVENT_TYPES.join(", ")}`];
   }
   if (typeof createdAt !== "string" || !createdAt.trim() || Number.isNaN(Date.parse(createdAt))) {
     errors.created_at = ["Required ISO 8601 timestamp string"];
@@ -1826,7 +1873,7 @@ function validateEdgeWebhookEvent(value) {
     validateKnownEventData(type, data, errors);
   }
   if (Object.keys(errors).length > 0) {
-    throw new import_connect7.EdgeValidationError("Invalid EDGE webhook event", errors);
+    throw new import_connect8.EdgeValidationError("Invalid EDGE webhook event", errors);
   }
   return value;
 }
@@ -1854,7 +1901,7 @@ function validateKnownEventData(type, data, errors) {
       return;
     default: {
       const exhaustive = type;
-      throw new import_connect7.EdgeValidationError("Unsupported EDGE webhook event type", {
+      throw new import_connect8.EdgeValidationError("Unsupported EDGE webhook event type", {
         type: [`Unsupported event type: ${exhaustive}`]
       });
     }
@@ -1887,7 +1934,7 @@ function normalizeRawBody(rawBody) {
   if (Buffer.isBuffer(rawBody) || rawBody instanceof Uint8Array) {
     return Buffer.from(rawBody).toString("utf8");
   }
-  throw new import_connect7.EdgeValidationError("EDGE webhook raw body is required", {
+  throw new import_connect8.EdgeValidationError("EDGE webhook raw body is required", {
     rawBody: ["Pass the raw UTF-8 request body, not a parsed JSON object"]
   });
 }
@@ -1908,7 +1955,7 @@ function getEdgeWebhookRawBody(request) {
   if (typeof request.rawBody === "string" || Buffer.isBuffer(request.rawBody) || request.rawBody instanceof Uint8Array) {
     return request.rawBody;
   }
-  throw new import_connect8.EdgeValidationError("EDGE webhook raw body is required", {
+  throw new import_connect9.EdgeValidationError("EDGE webhook raw body is required", {
     rawBody: [
       "Configure your framework to expose the raw UTF-8 request body before JSON parsing. Parsed JSON bodies cannot be used for HMAC verification."
     ]
@@ -1935,7 +1982,7 @@ function parseWebhookHttpRequest(options) {
 }
 
 // src/identity.ts
-var import_connect9 = require("@edge-markets/connect");
+var import_connect10 = require("@edge-markets/connect");
 var DEFAULT_IDENTITY_POLICY = {
   minNameScore: 70,
   minAddressScore: 65,
@@ -1963,7 +2010,7 @@ function buildVerifyIdentityPayload(profile) {
     errors.address = ["At least one address field is required"];
   }
   if (Object.keys(errors).length > 0) {
-    throw new import_connect9.EdgeValidationError("Partner identity profile is incomplete", errors);
+    throw new import_connect10.EdgeValidationError("Partner identity profile is incomplete", errors);
   }
   return payload;
 }
@@ -2000,7 +2047,7 @@ function validatePolicy(policy) {
   if (!isScore(policy.minNameScore)) errors.minNameScore = ["Must be between 0 and 100"];
   if (!isScore(policy.minAddressScore)) errors.minAddressScore = ["Must be between 0 and 100"];
   if (Object.keys(errors).length > 0) {
-    throw new import_connect9.EdgeValidationError("Invalid identity policy", errors);
+    throw new import_connect10.EdgeValidationError("Invalid identity policy", errors);
   }
 }
 function isScore(value) {
@@ -2017,7 +2064,7 @@ function firstNonEmpty(...values) {
 }
 
 // src/session-store.ts
-var import_connect10 = require("@edge-markets/connect");
+var import_connect11 = require("@edge-markets/connect");
 function createSessionTokenRecord(subjectId, tokens, tokenVault, options = {}) {
   const normalizedSubjectId = normalizeRequiredString(subjectId, "subjectId");
   validateTokens2(tokens);
@@ -2033,7 +2080,7 @@ function createSessionTokenRecord(subjectId, tokens, tokenVault, options = {}) {
 }
 function parseSessionTokenRecord(record) {
   if (!isRecord2(record)) {
-    throw new import_connect10.EdgeValidationError("EDGE session token record must be an object", {
+    throw new import_connect11.EdgeValidationError("EDGE session token record must be an object", {
       record: ["Expected object"]
     });
   }
@@ -2056,7 +2103,7 @@ function encryptLegacySessionTokens(legacyRecord, tokenVault, options) {
   const accessToken = normalizeRequiredString(legacyRecord.accessToken, "accessToken");
   const refreshToken = normalizeRequiredString(legacyRecord.refreshToken, "refreshToken");
   if (!options.allowPlaintext && !tokenVault.isEncrypted(accessToken) && !tokenVault.isEncrypted(refreshToken)) {
-    throw new import_connect10.EdgeValidationError("Plaintext token migration requires allowPlaintext: true", {
+    throw new import_connect11.EdgeValidationError("Plaintext token migration requires allowPlaintext: true", {
       allowPlaintext: ["Set allowPlaintext only inside an explicit migration path"]
     });
   }
@@ -2080,7 +2127,7 @@ function normalizeSessionExpiresAt(value) {
   if (value instanceof Date) {
     const time = value.getTime();
     if (!Number.isFinite(time) || time <= 0) {
-      throw new import_connect10.EdgeValidationError("Invalid EDGE session expiresAt", {
+      throw new import_connect11.EdgeValidationError("Invalid EDGE session expiresAt", {
         expiresAt: ["Date must be valid"]
       });
     }
@@ -2089,7 +2136,7 @@ function normalizeSessionExpiresAt(value) {
   if (typeof value === "string") {
     const trimmed = value.trim();
     if (!trimmed) {
-      throw new import_connect10.EdgeValidationError("Invalid EDGE session expiresAt", {
+      throw new import_connect11.EdgeValidationError("Invalid EDGE session expiresAt", {
         expiresAt: ["Required"]
       });
     }
@@ -2101,18 +2148,18 @@ function normalizeSessionExpiresAt(value) {
   }
   if (typeof value === "number" && Number.isFinite(value)) {
     if (!Number.isInteger(value) || value <= 0) {
-      throw new import_connect10.EdgeValidationError("Invalid EDGE session expiresAt", {
+      throw new import_connect11.EdgeValidationError("Invalid EDGE session expiresAt", {
         expiresAt: ["Must be a positive integer timestamp in milliseconds"]
       });
     }
     if (value < 1e10) {
-      throw new import_connect10.EdgeValidationError("Ambiguous EDGE session expiresAt", {
+      throw new import_connect11.EdgeValidationError("Ambiguous EDGE session expiresAt", {
         expiresAt: ["Use Unix milliseconds, not seconds"]
       });
     }
     return value;
   }
-  throw new import_connect10.EdgeValidationError("Invalid EDGE session expiresAt", {
+  throw new import_connect11.EdgeValidationError("Invalid EDGE session expiresAt", {
     expiresAt: ["Use Unix milliseconds, ISO string, or Date"]
   });
 }
@@ -2136,7 +2183,7 @@ function normalizeScopes(value) {
   if (typeof value === "string") {
     return splitScopes(value);
   }
-  throw new import_connect10.EdgeValidationError("Invalid EDGE session scopes", {
+  throw new import_connect11.EdgeValidationError("Invalid EDGE session scopes", {
     scopes: ["Expected array or space-delimited string"]
   });
 }
@@ -2145,7 +2192,7 @@ function splitScopes(value) {
 }
 function normalizeRequiredString(value, field) {
   if (typeof value !== "string" || !value.trim()) {
-    throw new import_connect10.EdgeValidationError("Invalid EDGE session token record", {
+    throw new import_connect11.EdgeValidationError("Invalid EDGE session token record", {
       [field]: ["Required string"]
     });
   }
@@ -2163,7 +2210,7 @@ function isRecord2(value) {
 }
 
 // src/token-vault.ts
-var import_connect11 = require("@edge-markets/connect");
+var import_connect12 = require("@edge-markets/connect");
 var import_node_crypto3 = __toESM(require("crypto"));
 var TOKEN_VAULT_VERSION = "edge_vault_v1";
 var IV_BYTES = 12;
@@ -2176,7 +2223,7 @@ var EdgeTokenVault = class {
     for (const [index, key] of (options.previousKeys ?? []).entries()) {
       const normalized = normalizeVaultKey(key, `previousKeys[${index}]`);
       if (this.keysById.has(normalized.id)) {
-        throw new import_connect11.EdgeValidationError("Duplicate token vault key ID", {
+        throw new import_connect12.EdgeValidationError("Duplicate token vault key ID", {
           keyId: [`Duplicate key ID "${normalized.id}"`]
         });
       }
@@ -2204,7 +2251,7 @@ var EdgeTokenVault = class {
     const parsed = parseEnvelope(envelope);
     const key = this.keysById.get(parsed.keyId);
     if (!key) {
-      throw new import_connect11.EdgeValidationError("Unknown token vault key ID", {
+      throw new import_connect12.EdgeValidationError("Unknown token vault key ID", {
         keyId: [`No key configured for "${parsed.keyId}"`]
       });
     }
@@ -2217,8 +2264,8 @@ var EdgeTokenVault = class {
       validateEdgeTokens(tokens);
       return tokens;
     } catch (error) {
-      if (error instanceof import_connect11.EdgeValidationError) throw error;
-      throw new import_connect11.EdgeValidationError("Failed to decrypt EDGE tokens", {
+      if (error instanceof import_connect12.EdgeValidationError) throw error;
+      throw new import_connect12.EdgeValidationError("Failed to decrypt EDGE tokens", {
         tokenEnvelope: ["Envelope is malformed, corrupted, or encrypted with a different key"]
       });
     }
@@ -2236,7 +2283,7 @@ function isEdgeTokenVaultEnvelope(value) {
 function normalizeVaultKey(input, fieldName) {
   const id = typeof input.id === "string" ? input.id.trim() : "";
   if (!id) {
-    throw new import_connect11.EdgeValidationError("Token vault key ID is required", {
+    throw new import_connect12.EdgeValidationError("Token vault key ID is required", {
       [`${fieldName}.id`]: ["Required"]
     });
   }
@@ -2267,7 +2314,7 @@ function normalizeKeyMaterial(input, fieldName) {
   }
   const key = candidates.find((candidate) => candidate.length === KEY_BYTES);
   if (!key) {
-    throw new import_connect11.EdgeValidationError("Token vault key must decode to 32 bytes", {
+    throw new import_connect12.EdgeValidationError("Token vault key must decode to 32 bytes", {
       [fieldName]: ["Provide a 32-byte key as base64, base64url, hex, Buffer, or Uint8Array"]
     });
   }
@@ -2298,18 +2345,18 @@ function validateEdgeTokens(tokens) {
     }
   }
   if (Object.keys(errors).length > 0) {
-    throw new import_connect11.EdgeValidationError("Invalid EDGE token payload", errors);
+    throw new import_connect12.EdgeValidationError("Invalid EDGE token payload", errors);
   }
 }
 function parseEnvelope(envelope) {
   if (typeof envelope !== "string") {
-    throw new import_connect11.EdgeValidationError("Token envelope must be a string", {
+    throw new import_connect12.EdgeValidationError("Token envelope must be a string", {
       tokenEnvelope: ["Expected string"]
     });
   }
   const parts = envelope.split(".");
   if (parts.length !== 5 || parts[0] !== TOKEN_VAULT_VERSION) {
-    throw new import_connect11.EdgeValidationError("Invalid EDGE token vault envelope", {
+    throw new import_connect12.EdgeValidationError("Invalid EDGE token vault envelope", {
       tokenEnvelope: [`Expected ${TOKEN_VAULT_VERSION}.<keyId>.<iv>.<tag>.<ciphertext>`]
     });
   }
@@ -2324,7 +2371,7 @@ function parseEnvelope(envelope) {
   if (tag.length !== TAG_BYTES) errors.tag = [`Must be ${TAG_BYTES} bytes`];
   if (ciphertext.length === 0) errors.ciphertext = ["Required"];
   if (Object.keys(errors).length > 0) {
-    throw new import_connect11.EdgeValidationError("Invalid EDGE token vault envelope", errors);
+    throw new import_connect12.EdgeValidationError("Invalid EDGE token vault envelope", errors);
   }
   return { keyId, iv, tag, ciphertext };
 }
@@ -2338,13 +2385,13 @@ function fromBase64Url2(value) {
 }
 
 // src/webhook-guards.ts
-var import_connect12 = require("@edge-markets/connect");
+var import_connect13 = require("@edge-markets/connect");
 function isTransferWebhookEvent(event) {
   return event.type.startsWith("transfer.");
 }
 function assertTransferEventMatchesIntent(event, intent) {
   if (!isTransferWebhookEvent(event)) {
-    throw new import_connect12.EdgeValidationError("Webhook event is not a transfer event", {
+    throw new import_connect13.EdgeValidationError("Webhook event is not a transfer event", {
       type: [`Received ${event.type}`]
     });
   }
@@ -2367,34 +2414,34 @@ function assertTransferEventMatchesIntent(event, intent) {
     }
   }
   if (Object.keys(errors).length > 0) {
-    throw new import_connect12.EdgeValidationError("Webhook transfer event does not match expected transfer intent", errors);
+    throw new import_connect13.EdgeValidationError("Webhook transfer event does not match expected transfer intent", errors);
   }
 }
 var assertWebhookMatchesTransfer = assertTransferEventMatchesIntent;
 
 // src/webhook-inbox.ts
-var import_connect13 = require("@edge-markets/connect");
+var import_connect14 = require("@edge-markets/connect");
 var import_node_crypto4 = __toESM(require("crypto"));
 var DEFAULT_PROCESSING_TIMEOUT_MS = 10 * 60 * 1e3;
 var EdgeWebhookInbox = class {
   constructor(options) {
     if (!options.store?.insert || !options.store?.find || !options.store?.markProcessing) {
-      throw new import_connect13.EdgeValidationError("EdgeWebhookInbox store is incomplete", {
+      throw new import_connect14.EdgeValidationError("EdgeWebhookInbox store is incomplete", {
         store: ["Provide insert, find, markProcessing, markProcessed, and markFailed callbacks"]
       });
     }
     if (!options.store.markProcessed || !options.store.markFailed) {
-      throw new import_connect13.EdgeValidationError("EdgeWebhookInbox store is incomplete", {
+      throw new import_connect14.EdgeValidationError("EdgeWebhookInbox store is incomplete", {
         store: ["Provide markProcessed and markFailed callbacks"]
       });
     }
     if (!options.processEvent) {
-      throw new import_connect13.EdgeValidationError("EdgeWebhookInbox processEvent callback is required", {
+      throw new import_connect14.EdgeValidationError("EdgeWebhookInbox processEvent callback is required", {
         processEvent: ["Required"]
       });
     }
     if (options.processingTimeoutMs !== void 0 && (!Number.isFinite(options.processingTimeoutMs) || options.processingTimeoutMs <= 0)) {
-      throw new import_connect13.EdgeValidationError("processingTimeoutMs must be positive", {
+      throw new import_connect14.EdgeValidationError("processingTimeoutMs must be positive", {
         processingTimeoutMs: ["Must be greater than 0"]
       });
     }
@@ -2554,7 +2601,7 @@ var EdgeWebhookInbox = class {
         status: result.record.status,
         source: options.source
       });
-      throw new import_connect13.EdgeValidationError("Duplicate webhook event payload does not match stored event", {
+      throw new import_connect14.EdgeValidationError("Duplicate webhook event payload does not match stored event", {
         eventId: [event.id]
       });
     }
@@ -2590,7 +2637,7 @@ function fingerprintWebhookEvent(event) {
 }
 function normalizeEventId(eventId) {
   if (typeof eventId !== "string" || !eventId.trim()) {
-    throw new import_connect13.EdgeValidationError("Webhook event ID is required", {
+    throw new import_connect14.EdgeValidationError("Webhook event ID is required", {
       eventId: ["Required"]
     });
   }
@@ -2607,17 +2654,20 @@ function stableStringify(value) {
 }
 
 // src/index.ts
-var import_connect14 = require("@edge-markets/connect");
 var import_connect15 = require("@edge-markets/connect");
+var import_connect16 = require("@edge-markets/connect");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACTIVE_EDGE_SCOPES,
   CONNECT_TRANSFER_DIRECTIONS,
+  EDGE_CONNECT_FEATURE_UNAVAILABLE_MESSAGE,
   EDGE_WEBHOOK_EVENT_TYPES,
   EdgeApiError,
   EdgeAuthenticationError,
   EdgeConnectServer,
   EdgeConsentRequiredError,
   EdgeError,
+  EdgeFeatureUnavailableError,
   EdgeIdentityVerificationError,
   EdgeInsufficientScopeError,
   EdgeNetworkError,
@@ -2656,6 +2706,7 @@ var import_connect15 = require("@edge-markets/connect");
   isEdgeError,
   isEdgeTokenVaultEnvelope,
   isEdgeWebhookEvent,
+  isFeatureUnavailableError,
   isIdentityVerificationError,
   isNetworkError,
   isProductionEnvironment,

package/dist/index.mjs

@@ -19,8 +19,12 @@ import {
   getEnvironmentConfig
 } from "@edge-markets/connect";
 
+// src/edge-user-client.ts
+import { EdgeFeatureUnavailableError as EdgeFeatureUnavailableError2 } from "@edge-markets/connect";
+
 // src/transfer-helpers.ts
 import {
+  EdgeFeatureUnavailableError,
   EdgeValidationError
 } from "@edge-markets/connect";
 import crypto from "crypto";
@@ -117,6 +121,7 @@ function mapTransferStatusToPartnerState(status, mapping) {
   return partnerState;
 }
 async function startTransferVerification(client, options) {
+  assertTransferFeatureAvailable();
   const origin = typeof options.origin === "string" ? options.origin.trim() : "";
   if (!origin) {
     throw new EdgeValidationError("Verification origin is required", {
@@ -136,6 +141,14 @@ async function startTransferVerification(client, options) {
   const verificationSession = await client.createVerificationSession(transferId, { origin });
   return { transfer, verificationSession };
 }
+function assertTransferFeatureAvailable() {
+  if (!isTransferFeatureAvailable()) {
+    throw new EdgeFeatureUnavailableError();
+  }
+}
+function isTransferFeatureAvailable() {
+  return false;
+}
 function parseMoneyToCents(value, field, options = {}) {
   let input;
   if (typeof value === "number") {
@@ -257,6 +270,7 @@ var EdgeUserClient = class {
     return this.server._apiRequest("GET", "/balance", this.accessToken);
   }
   async initiateTransfer(options) {
+    assertTransferFeatureAvailable2();
     validateTransferOptions(options);
     const body = {
       type: options.type,
@@ -269,13 +283,16 @@ var EdgeUserClient = class {
     return this.server._apiRequest("POST", "/transfer", this.accessToken, body);
   }
   async startTransferVerification(options) {
+    assertTransferFeatureAvailable2();
     return startTransferVerification(this, options);
   }
   async getTransfer(transferId) {
+    assertTransferFeatureAvailable2();
     validateTransferId(transferId);
     return this.server._apiRequest("GET", `/transfer/${encodeURIComponent(transferId)}`, this.accessToken);
   }
   async listTransfers(params) {
+    assertTransferFeatureAvailable2();
     const queryParams = new URLSearchParams();
     if (params?.limit) queryParams.set("limit", String(params.limit));
     if (params?.offset) queryParams.set("offset", String(params.offset));
@@ -288,11 +305,11 @@ var EdgeUserClient = class {
     return this.server._apiRequest("DELETE", "/consent", this.accessToken);
   }
   /**
-   * Creates an EDGE-hosted transfer verification session.
-   * Returns a `verificationUrl` to open in an iframe or popup.
-   * The handoff token is single-use and expires in 120 seconds.
+   * Reserved for a future transfer release.
+   * Currently throws EdgeFeatureUnavailableError before validation or network I/O.
    */
   async createVerificationSession(transferId, options) {
+    assertTransferFeatureAvailable2();
     validateTransferId(transferId);
     return this.server._apiRequest(
       "POST",
@@ -302,10 +319,11 @@ var EdgeUserClient = class {
     );
   }
   /**
-   * Polls the status of a verification session.
-   * Use as an alternative to postMessage events.
+   * Reserved for a future transfer release.
+   * Currently throws EdgeFeatureUnavailableError before validation or network I/O.
    */
   async getVerificationSessionStatus(transferId, sessionId) {
+    assertTransferFeatureAvailable2();
     validateTransferId(transferId);
     return this.server._apiRequest(
       "GET",
@@ -314,6 +332,14 @@ var EdgeUserClient = class {
     );
   }
 };
+function assertTransferFeatureAvailable2() {
+  if (!isTransferFeatureAvailable2()) {
+    throw new EdgeFeatureUnavailableError2();
+  }
+}
+function isTransferFeatureAvailable2() {
+  return false;
+}
 
 // src/mle.ts
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv, publicEncrypt, privateDecrypt, constants } from "crypto";
@@ -1483,6 +1509,16 @@ function readEnvironment(env) {
   }
   return value;
 }
+function readBooleanEnv(env, name) {
+  const value = readEnv(env, name);
+  if (!value) return void 0;
+  const normalized = value.toLowerCase();
+  if (["true", "1", "yes"].includes(normalized)) return true;
+  if (["false", "0", "no"].includes(normalized)) return false;
+  throw new EdgeValidationError4(`Invalid ${name}`, {
+    [name]: ["Must be one of: true, false, 1, 0, yes, no"]
+  });
+}
 function readTimeout(env, override) {
   if (override !== void 0) return override;
   const value = readFirstEnv(env, ["EDGE_TIMEOUT_MS", "EDGE_REQUEST_TIMEOUT_MS"]);
@@ -1498,7 +1534,12 @@ function readTimeout(env, override) {
 function buildMtlsConfig(env, requireMtls, warnings) {
   const cert = readPemValue(env, "EDGE_MTLS_CERT", "EDGE_MTLS_CERT_PATH", warnings);
   const key = readPemValue(env, "EDGE_MTLS_KEY", "EDGE_MTLS_KEY_PATH", warnings);
-  const ca = readPemValue(env, "EDGE_MTLS_CA", "EDGE_MTLS_CA_PATH", warnings);
+  const serverCa = readPemValue(env, "EDGE_SERVER_CA_PEM", "EDGE_SERVER_CA_PEM_PATH", warnings);
+  const hasLegacyCa = !!readFirstEnv(env, ["EDGE_MTLS_CA", "EDGE_MTLS_CA_PATH"]);
+  if (serverCa && hasLegacyCa) {
+    warnings.push("EDGE_SERVER_CA_PEM and EDGE_MTLS_CA are both set; using EDGE_SERVER_CA_PEM");
+  }
+  const ca = serverCa || readPemValue(env, "EDGE_MTLS_CA", "EDGE_MTLS_CA_PATH", warnings);
   if (!cert && !key && !ca) {
     if (requireMtls) {
       throw new EdgeValidationError4("mTLS is required but no EDGE_MTLS_CERT or EDGE_MTLS_KEY was provided", {
@@ -1537,7 +1578,7 @@ function createEdgeConnectServerFromEnv(options = {}) {
   const environment = readEnvironment(env);
   const apiBaseUrl = readEnv(env, "EDGE_API_BASE_URL");
   const mtlsRequiredByTarget = inferMtlsRequirement(environment, apiBaseUrl);
-  const requireMtls = options.requireMtls ?? false;
+  const requireMtls = options.requireMtls ?? readBooleanEnv(env, "EDGE_REQUIRE_MTLS") ?? false;
   const mtls = buildMtlsConfig(env, requireMtls, warnings);
   const timeout = readTimeout(env, options.timeout);
   const clientId = readFirstEnv(env, ["EDGE_CLIENT_ID", "EDGE_CONNECT_CLIENT_ID"]) || "";
@@ -1592,6 +1633,7 @@ function createEdgeConnectServerFromEnv(options = {}) {
 import {
   EdgeConsentRequiredError as EdgeConsentRequiredError2,
   EdgeError as EdgeError2,
+  EdgeFeatureUnavailableError as EdgeFeatureUnavailableError3,
   EdgeIdentityVerificationError as EdgeIdentityVerificationError2,
   EdgeNetworkError as EdgeNetworkError2,
   EdgeValidationError as EdgeValidationError5
@@ -1617,6 +1659,9 @@ function toEdgeProblemJson(error) {
       fieldErrors: error.fieldErrors
     });
   }
+  if (error instanceof EdgeFeatureUnavailableError3) {
+    return problem(error, "Feature unavailable", error.statusCode ?? 501);
+  }
   if (error instanceof EdgeNetworkError2) {
     return problem(error, "EDGE network error", error.statusCode ?? 502);
   }
@@ -2541,10 +2586,12 @@ function stableStringify(value) {
 
 // src/index.ts
 import {
+  EDGE_CONNECT_FEATURE_UNAVAILABLE_MESSAGE,
   EdgeApiError as EdgeApiError2,
   EdgeAuthenticationError as EdgeAuthenticationError4,
   EdgeConsentRequiredError as EdgeConsentRequiredError3,
   EdgeError as EdgeError3,
+  EdgeFeatureUnavailableError as EdgeFeatureUnavailableError4,
   EdgeIdentityVerificationError as EdgeIdentityVerificationError3,
   EdgeInsufficientScopeError as EdgeInsufficientScopeError2,
   EdgeNetworkError as EdgeNetworkError3,
@@ -2555,23 +2602,28 @@ import {
   isAuthenticationError,
   isConsentRequiredError,
   isEdgeError,
+  isFeatureUnavailableError,
   isIdentityVerificationError,
   isNetworkError
 } from "@edge-markets/connect";
 import {
+  ACTIVE_EDGE_SCOPES,
   EDGE_WEBHOOK_EVENT_TYPES as EDGE_WEBHOOK_EVENT_TYPES2,
   TRANSFER_CATEGORIES,
   getEnvironmentConfig as getEnvironmentConfig3,
   isProductionEnvironment
 } from "@edge-markets/connect";
 export {
+  ACTIVE_EDGE_SCOPES,
   CONNECT_TRANSFER_DIRECTIONS,
+  EDGE_CONNECT_FEATURE_UNAVAILABLE_MESSAGE,
   EDGE_WEBHOOK_EVENT_TYPES2 as EDGE_WEBHOOK_EVENT_TYPES,
   EdgeApiError2 as EdgeApiError,
   EdgeAuthenticationError4 as EdgeAuthenticationError,
   EdgeConnectServer,
   EdgeConsentRequiredError3 as EdgeConsentRequiredError,
   EdgeError3 as EdgeError,
+  EdgeFeatureUnavailableError4 as EdgeFeatureUnavailableError,
   EdgeIdentityVerificationError3 as EdgeIdentityVerificationError,
   EdgeInsufficientScopeError2 as EdgeInsufficientScopeError,
   EdgeNetworkError3 as EdgeNetworkError,
@@ -2610,6 +2662,7 @@ export {
   isEdgeError,
   isEdgeTokenVaultEnvelope,
   isEdgeWebhookEvent,
+  isFeatureUnavailableError,
   isIdentityVerificationError,
   isNetworkError,
   isProductionEnvironment,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edge-markets/connect-node",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Server SDK for EDGE Connect token exchange and API calls",
   "author": "Edge Markets",
   "license": "MIT",
@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "undici": "^5.29.0",
-    "@edge-markets/connect": "^1.7.0"
+    "@edge-markets/connect": "^1.8.0"
   },
   "devDependencies": {
     "tsup": "^8.0.0",