@basis-theory/web-elements 3.0.0-beta.3 → 3.0.0-beta.4

package/dist/{index-BBfuUaLw.js → index-BOedIhUN.js}

@@ -162,7 +162,7 @@ const BasisTheoryError = (code, message, details) => {
   return error;
 };
 const ValidationError = (message, field, details) => {
-  const error = createBasisTheoryError("VALIDATION_ERROR", message, details);
+  const error = createBasisTheoryError("VALIDATION_ERROR", message, field ? { field, ...details } : details);
   error.name = "ValidationError";
   error.field = field;
   return error;
@@ -185,6 +185,202 @@ const ConfigurationError = (message, details) => {
 };
 const log = (action, metadata) => {
 };
+const ALLOWED_PROXY_SCHEMES = /* @__PURE__ */ new Set(["https:"]);
+const ALLOWED_METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+]);
+const FORBIDDEN_PROXY_HEADERS = /* @__PURE__ */ new Set([
+  // Request smuggling prevention
+  "host",
+  "content-length",
+  "transfer-encoding",
+  "te",
+  "trailer",
+  // Connection manipulation prevention
+  "connection",
+  "upgrade",
+  "keep-alive",
+  "proxy-connection",
+  // Proxy bypass prevention
+  "via",
+  "proxy-authorization",
+  // BasisTheory credential protection
+  "bt-api-key",
+  "bt-proxy-key",
+  "bt-proxy-url",
+  "bt-idempotency-key",
+  // Forwarded headers
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-real-ip",
+  // SDK owns serialization format — body is always JSON.stringify'd
+  "content-type"
+]);
+const validateProxyHeaders = (headers) => {
+  if (!headers)
+    return;
+  for (const [key, value] of Object.entries(headers)) {
+    if (/[\r\n]/.test(value)) {
+      throw ValidationError(`Header '${key}' value contains illegal CRLF`, "headers");
+    }
+    if (/[\r\n]/.test(key)) {
+      throw ValidationError(`Header name '${key}' contains illegal CRLF`, "headers");
+    }
+    if (FORBIDDEN_PROXY_HEADERS.has(key.toLowerCase().trim())) {
+      throw ValidationError(`Header '${key}' is not allowed in proxy requests`, "headers");
+    }
+  }
+};
+const parseIPv4 = (hostname) => {
+  const clean = hostname.replace(/^\[|\]$/g, "");
+  if (/^(0x[\da-f]+|\d+)$/i.test(clean)) {
+    const num = clean.toLowerCase().startsWith("0x") ? parseInt(clean, 16) : parseInt(clean, 10);
+    if (num >= 0 && num <= 4294967295) {
+      return [
+        num >>> 24 & 255,
+        num >>> 16 & 255,
+        num >>> 8 & 255,
+        num & 255
+      ];
+    }
+    return null;
+  }
+  const parts = clean.split(".");
+  if (parts.length !== 4) {
+    return null;
+  }
+  const octets = [];
+  for (const part of parts) {
+    let value;
+    if (part.toLowerCase().startsWith("0x")) {
+      value = parseInt(part, 16);
+    } else if (part.startsWith("0") && part.length > 1 && !/[89]/.test(part)) {
+      value = parseInt(part, 8);
+    } else {
+      value = parseInt(part, 10);
+    }
+    if (isNaN(value) || value < 0 || value > 255) {
+      return null;
+    }
+    octets.push(value);
+  }
+  return octets;
+};
+const isPrivateIPv4 = (octets) => {
+  const a = octets[0];
+  const b = octets[1];
+  if (a === void 0 || b === void 0)
+    return true;
+  if (a === 127)
+    return true;
+  if (a === 10)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 0)
+    return true;
+  return false;
+};
+const isBlockedIPv6 = (hostname) => {
+  const clean = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (clean === "::1" || clean === "0:0:0:0:0:0:0:1" || clean === "0000:0000:0000:0000:0000:0000:0000:0001") {
+    return true;
+  }
+  if (clean.startsWith("fe8") || clean.startsWith("fe9") || clean.startsWith("fea") || clean.startsWith("feb")) {
+    return true;
+  }
+  if (clean.startsWith("fc") || clean.startsWith("fd")) {
+    return true;
+  }
+  const ipv4MappedDotted = clean.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (ipv4MappedDotted) {
+    const ipv4Part = ipv4MappedDotted[1];
+    if (ipv4Part) {
+      const ipv4Octets = parseIPv4(ipv4Part);
+      if (ipv4Octets && isPrivateIPv4(ipv4Octets)) {
+        return true;
+      }
+    }
+  }
+  const ipv4MappedHex = clean.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (ipv4MappedHex) {
+    const highPart = ipv4MappedHex[1];
+    const lowPart = ipv4MappedHex[2];
+    if (!highPart || !lowPart) {
+      return true;
+    }
+    const high = parseInt(highPart, 16);
+    const low = parseInt(lowPart, 16);
+    const octets = [
+      high >>> 8 & 255,
+      high & 255,
+      low >>> 8 & 255,
+      low & 255
+    ];
+    if (isPrivateIPv4(octets)) {
+      return true;
+    }
+  }
+  return false;
+};
+const validateSsrfProtection = (parsed) => {
+  const hostname = parsed.hostname.toLowerCase();
+  if (parsed.username || parsed.password) {
+    throw ValidationError("URL must not contain userinfo (username/password)", "url");
+  }
+  if (hostname === "localhost") {
+    throw ValidationError("URL must not target localhost", "url");
+  }
+  if (hostname.startsWith("[") || isBlockedIPv6(hostname)) {
+    if (isBlockedIPv6(hostname)) {
+      throw ValidationError("URL must not target loopback or link-local IPv6 addresses", "url");
+    }
+  }
+  const ipv4Octets = parseIPv4(hostname);
+  if (ipv4Octets && isPrivateIPv4(ipv4Octets)) {
+    throw ValidationError("URL must not target private or internal IP addresses", "url");
+  }
+};
+const validateProxyUrl = (url) => {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw ValidationError("Invalid URL format", "url");
+  }
+  if (!ALLOWED_PROXY_SCHEMES.has(parsed.protocol)) {
+    throw ValidationError(`URL scheme '${parsed.protocol}' is not allowed. Only https: is permitted`, "url");
+  }
+  validateSsrfProtection(parsed);
+};
+const validateProxyTarget = (url, proxyKey) => {
+  const hasUrl = typeof url === "string" && url.length > 0;
+  const hasKey = typeof proxyKey === "string" && proxyKey.length > 0;
+  if (hasUrl === hasKey) {
+    throw ValidationError("Specify exactly one of url or proxyKey", "url/proxyKey");
+  }
+  if (hasUrl) {
+    validateProxyUrl(url);
+  }
+};
+const validateProxyOptions = (options) => {
+  if (options !== void 0 && (typeof options !== "object" || options === null)) {
+    throw ValidationError("Proxy options must be a plain object", "options");
+  }
+  if ((options == null ? void 0 : options.method) !== void 0 && !ALLOWED_METHODS.has(options.method)) {
+    throw ValidationError(`Method '${options.method}' is not allowed`, "method");
+  }
+  validateProxyTarget(options == null ? void 0 : options.url, options == null ? void 0 : options.proxyKey);
+  validateProxyHeaders(options == null ? void 0 : options.headers);
+};
 const DEFAULT_RETRY_CONFIG = {
   maxRetries: 2,
   initialDelay: 500,
@@ -298,9 +494,10 @@ const createPostMessageClient = (iframe, config) => {
       iframe.contentWindow.postMessage({ type, nonce, timestamp, payload }, config.targetOrigin);
     });
   };
-  const sendRequest = async (type, payload) => {
+  const sendRequest = async (type, payload, options) => {
+    const maxRetries = (options == null ? void 0 : options.retries) !== void 0 ? options.retries : retryConfig.maxRetries;
     let lastError = null;
-    for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
       try {
         return await sendRequestOnce(type, payload);
       } catch (error) {
@@ -316,11 +513,11 @@ const createPostMessageClient = (iframe, config) => {
           });
           throw error;
         }
-        if (attempt < retryConfig.maxRetries) {
+        if (attempt < maxRetries) {
           const delay = getRetryDelay(attempt, retryConfig);
           log2("Retrying request", {
             attempt: attempt + 1,
-            maxRetries: retryConfig.maxRetries,
+            maxRetries,
             delayMs: delay,
             error: errorMessage
           });
@@ -328,7 +525,7 @@ const createPostMessageClient = (iframe, config) => {
         }
       }
     }
-    throw lastError || new Error(`Request failed after ${retryConfig.maxRetries} retries: ${type}`);
+    throw lastError || new Error(`Request failed after ${maxRetries} retries: ${type}`);
   };
   const ping = async (timeout = 1e3) => {
     const start = Date.now();
@@ -405,7 +602,7 @@ const createIframe = (config) => {
   iframe.src = config.src;
   iframe.setAttribute("sandbox", config.sandbox);
   iframe.title = config.title;
-  iframe.setAttribute("allow", "payment *");
+  iframe.setAttribute("allow", config.allow ?? "payment *");
   iframe.setAttribute("importance", "high");
   iframe.style.opacity = "0";
   return iframe;
@@ -444,7 +641,9 @@ const createEventDispatcher = (config) => {
           bin: payload.bin,
           cvvLengths: payload.cvvLengths,
           potentialBrands: payload.potentialBrands,
-          matchStrength: payload.matchStrength
+          matchStrength: payload.matchStrength,
+          networks: payload.networks,
+          selectedNetwork: payload.selectedNetwork
         };
         dispatch("change", cardDetail);
       } else if (elementType === "card") {
@@ -453,27 +652,47 @@ const createEventDispatcher = (config) => {
           cardBrand: payload.cardBrand,
           last4: payload.last4,
           bin: payload.bin,
+          networks: payload.networks,
+          selectedNetwork: payload.selectedNetwork,
           errors: payload.errors || null
         });
       } else {
         dispatch("change", changeDetail);
       }
     });
+    client.subscribe(
+      "EVENT_NETWORK_CHANGED",
+      (payload) => {
+        if (elementType !== "cardNumber" && elementType !== "card") {
+          return;
+        }
+        const detail = {
+          network: payload.network,
+          previousNetwork: payload.previousNetwork,
+          availableNetworks: payload.availableNetworks ?? [],
+          selectionMode: payload.selectionMode ?? "auto"
+        };
+        dispatch("networkChanged", detail);
+      }
+    );
     client.subscribe("EVENT_FOCUS", () => {
       dispatch("focus", {});
     });
     client.subscribe("EVENT_BLUR", () => {
       dispatch("blur", {});
     });
-    client.subscribe("EVENT_ERROR", (payload) => {
-      dispatch("error", {
-        code: payload.code,
-        message: payload.message,
-        status: payload.status,
-        validationErrors: payload.validationErrors,
-        metadata: payload.metadata || {}
-      });
-    });
+    client.subscribe(
+      "EVENT_ERROR",
+      (payload) => {
+        dispatch("error", {
+          code: payload.code,
+          message: payload.message,
+          status: payload.status,
+          validationErrors: payload.validationErrors,
+          metadata: payload.metadata || {}
+        });
+      }
+    );
   };
   const dispatchError = (code, message, error) => {
     dispatch("error", {
@@ -490,7 +709,7 @@ const createEventDispatcher = (config) => {
     dispatchError
   };
 };
-const createCardNumberElement = (apiKey, sdkConfig, options = {}, coordinatorElementId, ensureCoordinatorReady) => {
+const createCardNumberElement = (apiKey, sdkConfig, options = {}, coordinatorElementId, ensureCoordinatorReady, notifyCoordinatorElementUnmount) => {
   let iframe = null;
   let client = null;
   let mounter = null;
@@ -511,6 +730,12 @@ const createCardNumberElement = (apiKey, sdkConfig, options = {}, coordinatorEle
       eventTarget
     });
     eventDispatcher.setupSubscriptions();
+    client.subscribe("EVENT_CONTENT_HEIGHT", (payload) => {
+      const h = payload == null ? void 0 : payload.heightPx;
+      if (iframe && typeof h === "number" && h > 0) {
+        iframe.style.height = `${Math.ceil(h)}px`;
+      }
+    });
   };
   return {
     id,
@@ -587,7 +812,9 @@ const createCardNumberElement = (apiKey, sdkConfig, options = {}, coordinatorEle
           placeholder: options.placeholder,
           disabled: options.disabled,
           readOnly: options.readOnly,
-          debug: sdkConfig.debug
+          debug: sdkConfig.debug,
+          binLookup: options.binLookup,
+          coBadge: options.coBadge
         });
         if (iframe) iframe.style.opacity = "1";
       } catch (error) {
@@ -617,16 +844,17 @@ const createCardNumberElement = (apiKey, sdkConfig, options = {}, coordinatorEle
       if (!isMounted) {
         throw ElementError("Element is not mounted");
       }
-      if (client) {
-        client.sendRequest("CMD_CLEAR_CACHE", {}).catch((error) => {
-          log("Failed to send clear cache command", {
-            error: error.message
-          });
+      notifyCoordinatorElementUnmount(id).catch((error) => {
+        log("Failed to notify coordinator of element unmount", {
+          error: error.message
         });
+      });
+      if (client) {
         client.destroy();
         client = null;
       }
       if (mounter && iframe) {
+        iframe.style.height = "";
         mounter.unmount(iframe);
         iframe = null;
         mounter = null;
@@ -640,10 +868,23 @@ const createCardNumberElement = (apiKey, sdkConfig, options = {}, coordinatorEle
         throw ElementError("Element must be mounted before updating");
       }
       const updatePayload = {
-        placeholder: newOptions.placeholder,
-        disabled: newOptions.disabled,
-        readOnly: newOptions.readOnly
+        elementId: id
       };
+      if (newOptions.placeholder !== void 0) {
+        updatePayload.placeholder = newOptions.placeholder;
+      }
+      if (newOptions.disabled !== void 0) {
+        updatePayload.disabled = newOptions.disabled;
+      }
+      if (newOptions.readOnly !== void 0) {
+        updatePayload.readOnly = newOptions.readOnly;
+      }
+      if (newOptions.binLookup !== void 0) {
+        updatePayload.binLookup = newOptions.binLookup;
+      }
+      if (newOptions.coBadge !== void 0) {
+        updatePayload.coBadge = newOptions.coBadge;
+      }
       if (newOptions.themeMode !== void 0) {
         updatePayload.themeMode = newOptions.themeMode;
         updatePayload.theme = sdkConfig.theme;
@@ -669,6 +910,12 @@ const createCardNumberElement = (apiKey, sdkConfig, options = {}, coordinatorEle
       }
       client.sendRequest("CMD_CLEAR", {});
     },
+    setNetwork: async (network) => {
+      if (!isMounted || !client) {
+        throw ElementError("Element must be mounted before setNetwork");
+      }
+      await client.sendRequest("CMD_SET_NETWORK", { network });
+    },
     on: (eventType, listener) => {
       eventTarget.addEventListener(
         eventType,
@@ -681,7 +928,7 @@ const createCardNumberElement = (apiKey, sdkConfig, options = {}, coordinatorEle
     }
   };
 };
-const createCVVElement = (apiKey, sdkConfig, options = {}, coordinatorElementId, ensureCoordinatorReady) => {
+const createCVVElement = (apiKey, sdkConfig, options = {}, coordinatorElementId, ensureCoordinatorReady, notifyCoordinatorElementUnmount) => {
   let iframe = null;
   let client = null;
   let mounter = null;
@@ -804,12 +1051,12 @@ const createCVVElement = (apiKey, sdkConfig, options = {}, coordinatorElementId,
       if (!isMounted) {
         throw ElementError("Element is not mounted");
       }
-      if (client) {
-        client.sendRequest("CMD_CLEAR_CACHE", {}).catch((error) => {
-          log("Failed to send clear cache command", {
-            error: error.message
-          });
+      notifyCoordinatorElementUnmount(id).catch((error) => {
+        log("Failed to notify coordinator of element unmount", {
+          error: error.message
         });
+      });
+      if (client) {
         client.destroy();
         client = null;
       }
@@ -871,7 +1118,7 @@ const createCVVElement = (apiKey, sdkConfig, options = {}, coordinatorElementId,
     }
   };
 };
-const createExpiryElement = (apiKey, sdkConfig, options = {}, coordinatorElementId, ensureCoordinatorReady) => {
+const createExpiryElement = (apiKey, sdkConfig, options = {}, coordinatorElementId, ensureCoordinatorReady, notifyCoordinatorElementUnmount) => {
   let iframe = null;
   let client = null;
   let mounter = null;
@@ -993,12 +1240,12 @@ const createExpiryElement = (apiKey, sdkConfig, options = {}, coordinatorElement
       if (!isMounted) {
         throw ElementError("Element is not mounted");
       }
-      if (client) {
-        client.sendRequest("CMD_CLEAR_CACHE", {}).catch((error) => {
-          log("Failed to send clear cache command", {
-            error: error.message
-          });
+      notifyCoordinatorElementUnmount(id).catch((error) => {
+        log("Failed to notify coordinator of element unmount", {
+          error: error.message
         });
+      });
+      if (client) {
         client.destroy();
         client = null;
       }
@@ -1057,7 +1304,7 @@ const createExpiryElement = (apiKey, sdkConfig, options = {}, coordinatorElement
     }
   };
 };
-const createTextElement = (apiKey, sdkConfig, options = {}, coordinatorElementId, ensureCoordinatorReady) => {
+const createTextElement = (apiKey, sdkConfig, options = {}, coordinatorElementId, ensureCoordinatorReady, notifyCoordinatorElementUnmount) => {
   let iframe = null;
   let client = null;
   let mounter = null;
@@ -1207,12 +1454,12 @@ const createTextElement = (apiKey, sdkConfig, options = {}, coordinatorElementId
       if (!isMounted) {
         throw ElementError("Element is not mounted");
       }
-      if (client) {
-        client.sendRequest("CMD_CLEAR_CACHE", {}).catch((error) => {
-          log("Failed to send clear cache command", {
-            error: error.message
-          });
+      notifyCoordinatorElementUnmount(id).catch((error) => {
+        log("Failed to notify coordinator of element unmount", {
+          error: error.message
         });
+      });
+      if (client) {
         client.destroy();
         client = null;
       }
@@ -1540,7 +1787,7 @@ const validateSDKConfig = (options = {}) => {
   if (!["light", "dark", "auto"].includes(themeMode)) {
     throw ConfigurationError('themeMode must be "light", "dark", or "auto"');
   }
-  const finalBaseUrl = baseUrl || "https://js.basistheory.com/3.0.0-beta.3/elements";
+  const finalBaseUrl = baseUrl || "https://js.basistheory.com/3.0.0-beta.4/elements";
   const iframeOrigin = new URL(finalBaseUrl).origin;
   return {
     iframeOrigin,
@@ -1566,7 +1813,7 @@ const COMMON_ELEMENT_KEYS = /* @__PURE__ */ new Set([
   "readOnly"
 ]);
 const ELEMENT_TYPE_KEYS = {
-  cardNumber: /* @__PURE__ */ new Set([...COMMON_ELEMENT_KEYS]),
+  cardNumber: /* @__PURE__ */ new Set([...COMMON_ELEMENT_KEYS, "binLookup", "coBadge"]),
   cvv: /* @__PURE__ */ new Set([...COMMON_ELEMENT_KEYS, "cardBrand", "cvvLengths"]),
   // Internal coordination props
   expiry: /* @__PURE__ */ new Set([...COMMON_ELEMENT_KEYS]),
@@ -1585,7 +1832,15 @@ const ELEMENT_TYPE_KEYS = {
     "layout",
     "stackAt",
     "iconPosition",
-    "cardBrands"
+    "cardBrands",
+    "binLookup",
+    "coBadge"
+  ]),
+  copyButton: /* @__PURE__ */ new Set([
+    "allowClipboard",
+    "value",
+    "text",
+    "disabled"
   ])
 };
 const validateElementOptions = (type, options = {}) => {
@@ -1636,6 +1891,14 @@ const validateElementOptions = (type, options = {}) => {
       }
     }
   }
+  if (type === "copyButton") {
+    const copyOpts = options;
+    if (copyOpts.allowClipboard !== true) {
+      throw ConfigurationError(
+        "CopyButton requires allowClipboard: true. Clipboard access for raw card data may not be PCI compliant and must be explicitly enabled."
+      );
+    }
+  }
   if (type === "card") {
     const cardOptions = options;
     if (cardOptions.layout !== void 0) {
@@ -1679,14 +1942,41 @@ const BasisTheory = (apiKey, options = {}, queuedCommands) => {
   let coordinatorReadyPromise = null;
   let coordinatorInitStarted = false;
   let currentThemeMode = options.themeMode || "auto";
+  const notifyCoordinatorElementUnmount = async (elementId) => {
+    if (!coordinatorClient) {
+      log2("Cannot notify coordinator of unmount - coordinator not initialized", {
+        elementId
+      });
+      return;
+    }
+    try {
+      await coordinatorClient.sendRequest("CMD_BROADCAST_ELEMENT_UNMOUNT", {
+        elementId
+      });
+      log2("Notified coordinator of element unmount", { elementId });
+    } catch (error) {
+      log2("Failed to notify coordinator of element unmount", {
+        elementId,
+        error: error.message
+      });
+    }
+  };
   let cardElementFactory = null;
+  let copyButtonElementFactory = null;
   const lazyCardElement = async () => {
     if (!cardElementFactory) {
-      const module = await import("./create-card-DipDWgph.js");
+      const module = await import("./create-card-B5zEHyRg.js");
       cardElementFactory = module.createCardElement;
     }
     return cardElementFactory;
   };
+  const lazyCopyButtonElement = async () => {
+    if (!copyButtonElementFactory) {
+      const module = await import("./create-copy-button-DrAz8g0m.js");
+      copyButtonElementFactory = module.createCopyButtonElement;
+    }
+    return copyButtonElementFactory;
+  };
   const syncFactories = {
     cardNumber: createCardNumberElement,
     cvv: createCVVElement,
@@ -1694,7 +1984,8 @@ const BasisTheory = (apiKey, options = {}, queuedCommands) => {
     text: createTextElement
   };
   const lazyFactories = {
-    card: lazyCardElement
+    card: lazyCardElement,
+    copyButton: lazyCopyButtonElement
   };
   const ensureCoordinatorInitialized = () => {
     if (coordinatorReadyPromise) {
@@ -1802,7 +2093,8 @@ const BasisTheory = (apiKey, options = {}, queuedCommands) => {
           config,
           elementOptions,
           localElementId,
-          ensureCoordinatorInitialized
+          ensureCoordinatorInitialized,
+          notifyCoordinatorElementUnmount
         );
       } else {
         let realElement = null;
@@ -1816,7 +2108,8 @@ const BasisTheory = (apiKey, options = {}, queuedCommands) => {
                 config,
                 elementOptions,
                 localElementId,
-                ensureCoordinatorInitialized
+                ensureCoordinatorInitialized,
+                notifyCoordinatorElementUnmount
               );
             })();
           }
@@ -1862,6 +2155,16 @@ const BasisTheory = (apiKey, options = {}, queuedCommands) => {
               };
             }
             return realElement.on(eventType, listener);
+          },
+          // Forward setValueRef for CopyButtonElement
+          setValueRef: async (refElement) => {
+            if (!realElement) {
+              await loadRealElement();
+            }
+            if (realElement && "setValueRef" in realElement && typeof realElement.setValueRef === "function") {
+              return realElement.setValueRef(refElement);
+            }
+            throw ElementError("setValueRef not available on this element type");
           }
         };
       }
@@ -2206,6 +2509,54 @@ const BasisTheory = (apiKey, options = {}, queuedCommands) => {
         }
       }
     },
+    proxy: (() => {
+      const invokeProxy = async (method, options2 = {}) => {
+        validateProxyOptions({ ...options2, method });
+        log2("proxy invoked", {
+          method,
+          hasUrl: !!options2.url,
+          hasProxyKey: !!options2.proxyKey
+        });
+        if (!coordinatorClient) {
+          log2("Waiting for coordinator initialization");
+          await initializeCoordinator();
+        }
+        if (!coordinatorClient) {
+          throw CoordinatorError("Coordinator failed to initialize");
+        }
+        const resolvedBody = options2.body !== void 0 ? resolveElementReferences(options2.body) : void 0;
+        try {
+          const result = await coordinatorClient.sendRequest(
+            "CMD_PROXY",
+            {
+              method,
+              url: options2.url,
+              proxyKey: options2.proxyKey,
+              headers: options2.headers,
+              body: resolvedBody,
+              includeResponseHeaders: options2.includeResponseHeaders
+            },
+            { retries: 0 }
+          );
+          log2("proxy successful", { method });
+          return result;
+        } catch (error) {
+          log2("proxy failed", {
+            method,
+            error: error.message
+          });
+          throw error;
+        }
+      };
+      const proxyVerb = (method) => (options2) => invokeProxy(method, options2 ?? {});
+      return {
+        get: proxyVerb("GET"),
+        post: proxyVerb("POST"),
+        put: proxyVerb("PUT"),
+        patch: proxyVerb("PATCH"),
+        delete: proxyVerb("DELETE")
+      };
+    })(),
     updateThemeMode: async (mode) => {
       log2("updateThemeMode called", {
         oldMode: currentThemeMode,
@@ -2299,13 +2650,14 @@ const BasisTheory = (apiKey, options = {}, queuedCommands) => {
 if (typeof window !== "undefined" && typeof document !== "undefined" && document.currentScript && !window.BasisTheory) {
   window.BasisTheory = BasisTheory;
 }
-const version = "3.0.0-beta.3";
-const buildDate = "2026-04-13T19:51:30.877Z";
+const version = "3.0.0-beta.4";
+const buildDate = "2026-06-09T15:35:24.276Z";
 if (typeof window !== "undefined") {
   window.__BasisTheorySDK__ = BasisTheory;
 }
 export {
   BasisTheory as B,
+  ConfigurationError as C,
   ElementError as E,
   createPostMessageClient as a,
   createEventDispatcher as b,