@tesouro/embedded-components-react 0.2.266 → 0.2.269

package/README.md

@@ -107,18 +107,19 @@ App-level provider. Resolves `baseUrl` / `widgetToken` / `organizationId` (falli
 
 #### Props
 
-| Prop                            | Type                                         | Description                                                                                                                                                                                                                                                                                                                                        |
-| ------------------------------- | -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `baseUrl`                       | `string`                                     | Base URL of the Tesouro embedded API (e.g. `"https://api.tesouro.com"`). Falls back to `global.baseUrl` when omitted.                                                                                                                                                                                                                              |
-| `widgetToken`                   | `string \| null`                             | Bearer token for widget auth. Falls back to `global.widgetToken` when omitted. Pass `null` to suppress auth.                                                                                                                                                                                                                                       |
-| `organizationId`                | `string \| null`                             | Org ID forwarded to data-access hooks. Falls back to `global.organizationId` when omitted; if still unset, defaults to `initResponse.organizationId` once the fetch resolves. Pass `null` to clear org scoping (never falls back).                                                                                                                 |
-| `configClient`                  | `(client: EmbeddedClient) => EmbeddedClient` | Optional post-creation hook for the HTTP client. Called after the built-in auth interceptor. Falls back to `global.configClient`.                                                                                                                                                                                                                  |
-| `linkComponent`                 | `LinkComponent`                              | Host link component widgets use to render navigational links. Falls back to `global.linkComponent`.                                                                                                                                                                                                                                                |
-| `uiFramework`                   | `'shadcn' \| 'tecton' \| null`               | UI framework the widget UI layer renders with for this tree. Falls back to `global.uiFramework`, then to `'shadcn'`. See UI framework selection.                                                                                                                                                         |
-| `implementation`                | `'native' \| 'monite' \| null`               | Which implementation the widgets render with for this tree. Falls back to `global.implementation`, then to `'native'`. See Implementation selection.                                                                                                                                                   |
-| `analytics`                     | `boolean`                                    | Enables anonymous analytics for this provider tree (default `true`). `RootWidgetProvider` is the analytics owner; set `false` to disable capture and skip loading PostHog.                                                                                                                                                                         |
-| `unstable_initResponseOverride` | `WidgetInitResponse`                         | First-party hosts only. Skips the `GET /api/widget-gateway/init` fetch and exposes this host-authored object as `initResponse` to the subtree. Use when the host authenticates users directly against the Tesouro issuer and passes the user's bearer access token as `widgetToken`. Embed integrations minting widget JWEs must leave this unset. |
-| `children`                      | `ReactNode`                                  | The React subtree that consumes the widget context.                                                                                                                                                                                                                                                                                                |
+| Prop                            | Type                                         | Description                                                                                                                                                                                                                                                                                                                                                                      |
+| ------------------------------- | -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `baseUrl`                       | `string`                                     | Base URL of the Tesouro embedded API (e.g. `"https://api.tesouro.com"`). Falls back to `global.baseUrl` when omitted.                                                                                                                                                                                                                                                            |
+| `widgetToken`                   | `string \| null`                             | Bearer token for widget auth. Falls back to `global.widgetToken` when omitted. Pass `null` to suppress auth.                                                                                                                                                                                                                                                                     |
+| `organizationId`                | `string \| null`                             | Org ID forwarded to data-access hooks. Falls back to `global.organizationId` when omitted; if still unset, defaults to `initResponse.organizationId` once the fetch resolves. Pass `null` to clear org scoping (never falls back).                                                                                                                                               |
+| `configClient`                  | `(client: EmbeddedClient) => EmbeddedClient` | Optional post-creation hook for the HTTP client. Called after the built-in auth and gateway-routing interceptors. Falls back to `global.configClient`.                                                                                                                                                                                                                           |
+| `gatewayRouting`                | `boolean`                                    | Overrides widget-gateway routing (the `/api/widget-gateway/proxy` path prefix plus the `X-Widget-Token` header). Unset, routing applies per request when the request origin is a known Tesouro API host; `true` forces it on (e.g. a custom domain in front of the gateway), `false` forces it off (a host that routes its own requests). Falls back to `global.gatewayRouting`. |
+| `linkComponent`                 | `LinkComponent`                              | Host link component widgets use to render navigational links. Falls back to `global.linkComponent`.                                                                                                                                                                                                                                                                              |
+| `uiFramework`                   | `'shadcn' \| 'tecton' \| null`               | UI framework the widget UI layer renders with for this tree. Falls back to `global.uiFramework`, then to `'shadcn'`. See UI framework selection.                                                                                                                                                                                       |
+| `implementation`                | `'native' \| 'monite' \| null`               | Which implementation the widgets render with for this tree. Falls back to `global.implementation`, then to `'native'`. See Implementation selection.                                                                                                                                                                                 |
+| `analytics`                     | `boolean`                                    | Enables anonymous analytics for this provider tree (default `true`). `RootWidgetProvider` is the analytics owner; set `false` to disable capture and skip loading PostHog.                                                                                                                                                                                                       |
+| `unstable_initResponseOverride` | `WidgetInitResponse`                         | First-party hosts only. Skips the `GET /api/widget-gateway/init` fetch and exposes this host-authored object as `initResponse` to the subtree. Use when the host authenticates users directly against the Tesouro issuer and passes the user's bearer access token as `widgetToken`. Embed integrations minting widget JWEs must leave this unset.                               |
+| `children`                      | `ReactNode`                                  | The React subtree that consumes the widget context.                                                                                                                                                                                                                                                                                                                              |
 
 ### `WidgetProvider`
 
@@ -132,6 +133,7 @@ Mid-tree or standalone provider. With no props it is a transparent pass-through
 | `widgetToken`    | `string \| null`                                   | Override the widget token for this subtree. Triggers a new `/api/widget-gateway/init` fetch. Pass `null` to suppress auth at this level. When omitted, inherits from parent.                                                                                                                                                |
 | `organizationId` | `string \| null`                                   | Override the org ID for this subtree. Does **not** trigger a re-fetch on its own. When omitted, inherits from parent; if unset through the whole cascade, defaults to this level's `initResponse.organizationId` (an ancestor's explicit org wins over it). Pass `null` to explicitly clear org scoping (never falls back). |
 | `configClient`   | `(client: EmbeddedClient) => EmbeddedClient`       | Optional post-creation hook for the scoped HTTP client. Only called when this provider creates its own client (i.e. not in pass-through mode). When omitted, inherits from parent.                                                                                                                                          |
+| `gatewayRouting` | `boolean`                                          | Overrides widget-gateway routing (the `/api/widget-gateway/proxy` path prefix plus the `X-Widget-Token` header) for this subtree's scoped client. Unset, routing applies per request when the request origin is a known Tesouro API host; `true` forces it on, `false` forces it off. When omitted, inherits from parent.   |
 | `linkComponent`  | `LinkComponent`                                    | Override the host link component for this subtree. When omitted, inherits from parent.                                                                                                                                                                                                                                      |
 | `uiFramework`    | `'shadcn' \| 'tecton' \| null`                     | Override the UI framework for this subtree. When omitted (or `null`), inherits the nearest ancestor's selection, defaulting to `'shadcn'`. See UI framework selection.                                                                                                            |
 | `implementation` | `'native' \| 'monite' \| null`                     | Override the implementation for this subtree. When omitted (or `null`), inherits the nearest ancestor's selection, defaulting to `'native'`. See Implementation selection.                                                                                                      |
@@ -164,6 +166,7 @@ Bundles `WidgetTokenRefreshProvider` + `RootWidgetProvider` and wires the live t
 | `baseUrl`                       | `RootWidgetProvider`         | Falls back to the global store when omitted.                                                                                                     |
 | `organizationId`                | `RootWidgetProvider`         | Pass `null` to clear the org scope; falls back to the global store when omitted.                                                                 |
 | `configClient`                  | `RootWidgetProvider`         | Optional post-creation hook for the scoped HTTP client.                                                                                          |
+| `gatewayRouting`                | `RootWidgetProvider`         | Overrides widget-gateway routing; unset, it applies per request when the request origin is a known Tesouro API host.                             |
 | `linkComponent`                 | `RootWidgetProvider`         | Component used in place of plain `<a>` tags inside widgets.                                                                                      |
 | `uiFramework`                   | `RootWidgetProvider`         | `'shadcn'` (default) or `'tecton'`; inherits down the provider cascade.                                                                          |
 | `implementation`                | `RootWidgetProvider`         | `'native'` (default) or `'monite'`; inherits down the provider cascade.                                                                          |

package/dist/experimental/WidgetSuite.d.ts

@@ -506,6 +506,30 @@ interface WidgetConfigInput {
      * ```
      */
     configClient?: (client: EmbeddedClient) => EmbeddedClient;
+    /**
+     * Overrides the widget-gateway routing decision for the scoped HTTP client.
+     *
+     * Any caller reaching the Tesouro API with a widget token must route data
+     * requests through the widget gateway: prefix the path with
+     * `/api/widget-gateway/proxy` and carry the token as `X-Widget-Token`. The
+     * provider applies both automatically per request when the request origin is
+     * a known Tesouro API host (`WIDGET_GATEWAY_HOSTS`, derived from the
+     * generated `ClientOptions['baseUrl']`); `/api/widget-gateway/*` paths (the
+     * init round-trip) always pass through untouched.
+     *
+     * - `undefined` — decide from the request origin, as above. Inherits from
+     *   the nearest ancestor or global store like every other config field.
+     * - `true` — always apply the rewrite, even for an unlisted base URL (e.g. a
+     *   custom domain in front of the gateway).
+     * - `false` — never apply it. For hosts that route widget requests their own
+     *   way, such as a same-origin BFF whose `configClient` retargets every
+     *   request.
+     *
+     * Independent of {@link configClient}: a host that only adds a header keeps
+     * the built-in routing, and the built-in interceptor runs before any
+     * `configClient` interceptor.
+     */
+    gatewayRouting?: boolean;
     /**
      * Component the embedded widgets should render in place of plain `<a>` tags.
      *
@@ -817,7 +841,7 @@ interface WidgetSuiteProps extends WidgetProviderProps {
  * deep-linking, and is deliberately not invented on an experimental export
  * before a host asks for it.
  */
-declare function WidgetSuite({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: WidgetSuiteProps): React.JSX.Element;
+declare function WidgetSuite({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: WidgetSuiteProps): React.JSX.Element;
 
 export { WIDGET_SUITE_CONTENT_LABELS_EN, WIDGET_SUITE_DEFAULT_SECTIONS, WIDGET_SUITE_DISCLOSURE_LABELS_EN, WIDGET_SUITE_SECTION_LABELS_EN, WIDGET_SUITE_SECTION_TITLE_LABELS_EN, WIDGET_SUITE_SHELL_LABELS_EN, WidgetSuite, WidgetSuiteSectionId };
 export type { AcceptDisclosuresLinks, PartialDeep, WidgetSuiteContentLabels, WidgetSuiteDisclosureLabels, WidgetSuiteProps, WidgetSuiteSectionLabels, WidgetSuiteSectionTitleLabels, WidgetSuiteShellLabels };

package/dist/experimental/index.d.ts

@@ -506,6 +506,30 @@ interface WidgetConfigInput {
      * ```
      */
     configClient?: (client: EmbeddedClient) => EmbeddedClient;
+    /**
+     * Overrides the widget-gateway routing decision for the scoped HTTP client.
+     *
+     * Any caller reaching the Tesouro API with a widget token must route data
+     * requests through the widget gateway: prefix the path with
+     * `/api/widget-gateway/proxy` and carry the token as `X-Widget-Token`. The
+     * provider applies both automatically per request when the request origin is
+     * a known Tesouro API host (`WIDGET_GATEWAY_HOSTS`, derived from the
+     * generated `ClientOptions['baseUrl']`); `/api/widget-gateway/*` paths (the
+     * init round-trip) always pass through untouched.
+     *
+     * - `undefined` — decide from the request origin, as above. Inherits from
+     *   the nearest ancestor or global store like every other config field.
+     * - `true` — always apply the rewrite, even for an unlisted base URL (e.g. a
+     *   custom domain in front of the gateway).
+     * - `false` — never apply it. For hosts that route widget requests their own
+     *   way, such as a same-origin BFF whose `configClient` retargets every
+     *   request.
+     *
+     * Independent of {@link configClient}: a host that only adds a header keeps
+     * the built-in routing, and the built-in interceptor runs before any
+     * `configClient` interceptor.
+     */
+    gatewayRouting?: boolean;
     /**
      * Component the embedded widgets should render in place of plain `<a>` tags.
      *
@@ -817,7 +841,7 @@ interface WidgetSuiteProps extends WidgetProviderProps {
  * deep-linking, and is deliberately not invented on an experimental export
  * before a host asks for it.
  */
-declare function WidgetSuite({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: WidgetSuiteProps): React.JSX.Element;
+declare function WidgetSuite({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: WidgetSuiteProps): React.JSX.Element;
 
 export { WIDGET_SUITE_CONTENT_LABELS_EN, WIDGET_SUITE_DEFAULT_SECTIONS, WIDGET_SUITE_DISCLOSURE_LABELS_EN, WIDGET_SUITE_SECTION_LABELS_EN, WIDGET_SUITE_SECTION_TITLE_LABELS_EN, WIDGET_SUITE_SHELL_LABELS_EN, WidgetSuite, WidgetSuiteSectionId };
 export type { AcceptDisclosuresLinks, PartialDeep, WidgetSuiteContentLabels, WidgetSuiteDisclosureLabels, WidgetSuiteProps, WidgetSuiteSectionLabels, WidgetSuiteSectionTitleLabels, WidgetSuiteShellLabels };

package/dist/index.css

@@ -155,6 +155,10 @@
     container-type: inline-size;
     container-name: field-group;
   }
+  .ttw\:\@container\/line-item {
+    container-type: inline-size;
+    container-name: line-item;
+  }
   .ttw\:\@container\/widget {
     container-type: inline-size;
     container-name: widget;
@@ -353,6 +357,12 @@
   .ttw\:order-last {
     order: 9999;
   }
+  .ttw\:col-span-1 {
+    grid-column: span 1 / span 1;
+  }
+  .ttw\:col-span-3 {
+    grid-column: span 3 / span 3;
+  }
   .ttw\:col-start-2 {
     grid-column-start: 2;
   }
@@ -1624,9 +1634,6 @@
   .ttw\:grid-cols-3 {
     grid-template-columns: repeat(3, minmax(0, 1fr));
   }
-  .ttw\:grid-cols-4 {
-    grid-template-columns: repeat(4, minmax(0, 1fr));
-  }
   .ttw\:grid-cols-\[0_1fr\] {
     grid-template-columns: 0 1fr;
   }
@@ -1958,6 +1965,10 @@
     border-top-left-radius: calc(var(--ttw-radius) - 2px);
     border-bottom-left-radius: calc(var(--ttw-radius) - 2px);
   }
+  .ttw\:rounded-l-none {
+    border-top-left-radius: 0;
+    border-bottom-left-radius: 0;
+  }
   .ttw\:rounded-tl-\[14px\] {
     border-top-left-radius: 14px;
   }
@@ -1968,6 +1979,10 @@
     border-top-right-radius: calc(var(--ttw-radius) - 2px);
     border-bottom-right-radius: calc(var(--ttw-radius) - 2px);
   }
+  .ttw\:rounded-r-none {
+    border-top-right-radius: 0;
+    border-bottom-right-radius: 0;
+  }
   .ttw\:rounded-tr-\[14px\] {
     border-top-right-radius: 14px;
   }
@@ -2817,9 +2832,6 @@
   .ttw\:pt-6 {
     padding-top: calc(var(--ttw-spacing) * 6);
   }
-  .ttw\:pt-7 {
-    padding-top: calc(var(--ttw-spacing) * 7);
-  }
   .ttw\:pt-8 {
     padding-top: calc(var(--ttw-spacing) * 8);
   }
@@ -2949,9 +2961,6 @@
   .ttw\:text-right {
     text-align: right;
   }
-  .ttw\:align-baseline {
-    vertical-align: baseline;
-  }
   .ttw\:align-middle {
     vertical-align: middle;
   }
@@ -4572,6 +4581,28 @@
   .ttw\:has-\[\:disabled\]\:opacity-60:has(:is(:disabled)) {
     opacity: 60%;
   }
+  .ttw\:has-\[\:focus-visible\]\:border-ring:has(:is(:focus-visible)) {
+    border-color: var(--ttw-ring);
+  }
+  .ttw\:has-\[\:focus-visible\]\:ring-\[3px\]:has(:is(:focus-visible)) {
+    --tw-ring-shadow: var(--tw-ring-inset,) 0 0 0 calc(3px + var(--tw-ring-offset-width)) var(--tw-ring-color, currentcolor);
+    box-shadow: var(--tw-inset-shadow), var(--tw-inset-ring-shadow), var(--tw-ring-offset-shadow), var(--tw-ring-shadow), var(--tw-shadow);
+  }
+  .ttw\:has-\[\:focus-visible\]\:ring-ring\/50:has(:is(:focus-visible)) {
+    --tw-ring-color: var(--ttw-ring);
+    @supports (color: color-mix(in lab, red, red)) {
+      --tw-ring-color: color-mix(in oklab, var(--ttw-ring) 50%, transparent);
+    }
+  }
+  .ttw\:has-\[\[aria-invalid\=true\]\]\:border-destructive:has(:is([aria-invalid=true])) {
+    border-color: var(--ttw-destructive);
+  }
+  .ttw\:has-\[\[aria-invalid\=true\]\]\:ring-destructive\/20:has(:is([aria-invalid=true])) {
+    --tw-ring-color: var(--ttw-destructive);
+    @supports (color: color-mix(in lab, red, red)) {
+      --tw-ring-color: color-mix(in oklab, var(--ttw-destructive) 20%, transparent);
+    }
+  }
   .ttw\:has-\[\[data-slot\=input-group-control\]\:focus-visible\]\:border-ring:has(:is([data-slot=input-group-control]:focus-visible)) {
     border-color: var(--ttw-ring);
   }
@@ -5453,6 +5484,11 @@
       align-items: flex-start;
     }
   }
+  @container line-item (width >= 32rem) {
+    .ttw\:\@lg\/line-item\:grid-cols-6 {
+      grid-template-columns: repeat(6, minmax(0, 1fr));
+    }
+  }
   .ttw\:dark\:border-input:is(.dark *) {
     border-color: var(--ttw-input);
   }

package/dist/index.d.ts

@@ -622,6 +622,30 @@ interface WidgetConfigInput {
      * ```
      */
     configClient?: (client: EmbeddedClient) => EmbeddedClient;
+    /**
+     * Overrides the widget-gateway routing decision for the scoped HTTP client.
+     *
+     * Any caller reaching the Tesouro API with a widget token must route data
+     * requests through the widget gateway: prefix the path with
+     * `/api/widget-gateway/proxy` and carry the token as `X-Widget-Token`. The
+     * provider applies both automatically per request when the request origin is
+     * a known Tesouro API host (`WIDGET_GATEWAY_HOSTS`, derived from the
+     * generated `ClientOptions['baseUrl']`); `/api/widget-gateway/*` paths (the
+     * init round-trip) always pass through untouched.
+     *
+     * - `undefined` — decide from the request origin, as above. Inherits from
+     *   the nearest ancestor or global store like every other config field.
+     * - `true` — always apply the rewrite, even for an unlisted base URL (e.g. a
+     *   custom domain in front of the gateway).
+     * - `false` — never apply it. For hosts that route widget requests their own
+     *   way, such as a same-origin BFF whose `configClient` retargets every
+     *   request.
+     *
+     * Independent of {@link configClient}: a host that only adds a header keeps
+     * the built-in routing, and the built-in interceptor runs before any
+     * `configClient` interceptor.
+     */
+    gatewayRouting?: boolean;
     /**
      * Component the embedded widgets should render in place of plain `<a>` tags.
      *
@@ -975,7 +999,7 @@ interface RootWidgetProviderProps extends WidgetProviderBaseProps {
  * @see {@link useWidgetConfig} to read the resolved config in descendants
  * @see {@link setGlobalWidgetConfig} to push config imperatively from outside React
  */
-declare function RootWidgetProvider({ children, baseUrl, widgetToken, organizationId, configClient, linkComponent, uiFramework, implementation, analytics, unstable_initResponseOverride, }: PropsWithChildren<RootWidgetProviderProps>): React.JSX.Element;
+declare function RootWidgetProvider({ children, baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, uiFramework, implementation, analytics, unstable_initResponseOverride, }: PropsWithChildren<RootWidgetProviderProps>): React.JSX.Element;
 
 /**
  * Props for {@link WidgetProvider}.
@@ -1407,7 +1431,7 @@ type AcceptDisclosuresWidgetProps = WidgetProviderProps & InnerProps;
  * neither, and the same init refresh clears the gate that mounted this. See
  * `WidgetSuite`, which mounts it as its acceptance state.
  */
-declare function AcceptDisclosuresWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: AcceptDisclosuresWidgetProps): React.JSX.Element;
+declare function AcceptDisclosuresWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: AcceptDisclosuresWidgetProps): React.JSX.Element;
 
 interface Labels$6 {
     title: string;
@@ -1544,7 +1568,7 @@ interface BankAccountsWidgetProps extends WidgetProviderProps {
     /** Called when the user opens account details or goes back to the list. */
     onSelectedAccountIdChange?: (accountId: string | null) => void;
 }
-declare function BankAccountsWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: BankAccountsWidgetProps): React.JSX.Element;
+declare function BankAccountsWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: BankAccountsWidgetProps): React.JSX.Element;
 
 /**
  * Action handlers for custom payment flows in payable operations.
@@ -1954,7 +1978,7 @@ interface CardDetailsWidgetProps extends WidgetProviderProps {
  * Both placements are covered by specs, because they take different code paths
  * through the provider and this export exists for the standalone one.
  */
-declare function CardDetailsWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: CardDetailsWidgetProps): React.JSX.Element;
+declare function CardDetailsWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: CardDetailsWidgetProps): React.JSX.Element;
 
 type PartialDeep$2<T> = {
     [K in keyof T]?: T[K] extends object ? PartialDeep$2<T[K]> : T[K];
@@ -2063,7 +2087,7 @@ type CreateCardWidgetProps = WidgetProviderProps & {
  * Self-contained Create Card widget. Issues a debit card via the Embed API and
  * drives setup → preparing → success with sonner toasts for the mutation.
  */
-declare function CreateCardWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: CreateCardWidgetProps): React.JSX.Element;
+declare function CreateCardWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: CreateCardWidgetProps): React.JSX.Element;
 
 /** Opaque UI format values — mapped to API `DebitCardType` in the feature. */
 declare const CardFormatValue: {
@@ -2283,7 +2307,7 @@ interface CardsWidgetProps extends WidgetProviderProps {
  * inside `WidgetProvider`'s subtree, which is what the data-access hooks read
  * their client, org and token from.
  */
-declare function CardsWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: CardsWidgetProps): React.JSX.Element;
+declare function CardsWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: CardsWidgetProps): React.JSX.Element;
 
 interface AddressFieldGroupLabels {
     line1: string;
@@ -2554,7 +2578,7 @@ type CounterpartsWidgetProps = WidgetProviderProps & CounterpartsWidgetOwnProps;
  * />
  * ```
  */
-declare function CounterpartsWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: CounterpartsWidgetProps): React.JSX.Element;
+declare function CounterpartsWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: CounterpartsWidgetProps): React.JSX.Element;
 
 interface Labels$4 {
     title: string;
@@ -2598,7 +2622,7 @@ interface ExpenseManagementWidgetProps extends WidgetProviderProps {
     policiesContent?: ReactNode;
     requirementsContent?: ReactNode;
 }
-declare function ExpenseManagementWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: ExpenseManagementWidgetProps): React.JSX.Element;
+declare function ExpenseManagementWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: ExpenseManagementWidgetProps): React.JSX.Element;
 
 type ExpenseApprovalPoliciesWidgetProps = WidgetProviderProps & {
     /** @deprecated Use `widgetToken` instead */
@@ -2606,7 +2630,7 @@ type ExpenseApprovalPoliciesWidgetProps = WidgetProviderProps & {
     /** @deprecated Use `organizationId` instead */
     orgId?: string | null;
 };
-declare function ExpenseApprovalPoliciesWidget({ token, orgId, widgetToken, organizationId, baseUrl, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, }?: ExpenseApprovalPoliciesWidgetProps): React.JSX.Element;
+declare function ExpenseApprovalPoliciesWidget({ token, orgId, widgetToken, organizationId, baseUrl, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, }?: ExpenseApprovalPoliciesWidgetProps): React.JSX.Element;
 
 type ExpenseRequirementsWidgetProps = WidgetProviderProps & {
     /** @deprecated Use `widgetToken` instead */
@@ -2614,7 +2638,7 @@ type ExpenseRequirementsWidgetProps = WidgetProviderProps & {
     /** @deprecated Use `organizationId` instead */
     orgId?: string | null;
 };
-declare function ExpenseRequirementsWidget({ token, orgId, widgetToken, organizationId, baseUrl, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, }?: ExpenseRequirementsWidgetProps): React.JSX.Element;
+declare function ExpenseRequirementsWidget({ token, orgId, widgetToken, organizationId, baseUrl, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, }?: ExpenseRequirementsWidgetProps): React.JSX.Element;
 
 interface BalancesWidgetLabels {
     /** Card header title (e.g. next to the building icon) */
@@ -3069,7 +3093,7 @@ type ChartOfAccountsWidgetProps = WidgetProviderProps & TableProps & ChartOfAcco
  * />
  * ```
  */
-declare function ChartOfAccountsWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, analytics, errorFallback, onError, ...tableProps }: ChartOfAccountsWidgetProps): React.JSX.Element;
+declare function ChartOfAccountsWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, analytics, errorFallback, onError, ...tableProps }: ChartOfAccountsWidgetProps): React.JSX.Element;
 
 /**
  * Static FAQ content for the Help widget.
@@ -3177,12 +3201,12 @@ type HelpWidgetProps = WidgetProviderProps & HelpContentProps;
  * <HelpWidget bankName="Acme Bank" contactUrl="https://acme.example/support" />
  * ```
  */
-declare function HelpWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...contentProps }: HelpWidgetProps): React.JSX.Element;
+declare function HelpWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...contentProps }: HelpWidgetProps): React.JSX.Element;
 
 type ReceivablesWidgetMoniteProps = MoniteRegionProviderProps & Omit<ReceivablesProps, 'pageTitleComponent' | 'initialView' | 'initialCounterpartId'> & {
     pageTitleComponent?: ReceivablesProps['pageTitleComponent'];
 };
-declare function ReceivablesWidgetMonite({ baseUrl, widgetToken, organizationId, configClient, linkComponent, errorFallback, onError, finopsThemeColors, analytics, pageTitleComponent, uiFramework, ...receivablesProps }: ReceivablesWidgetMoniteProps): React.JSX.Element;
+declare function ReceivablesWidgetMonite({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, errorFallback, onError, finopsThemeColors, analytics, pageTitleComponent, uiFramework, ...receivablesProps }: ReceivablesWidgetMoniteProps): React.JSX.Element;
 
 interface ProductFormSheetLabels {
     createTitle: string;
@@ -3507,7 +3531,7 @@ interface ReceivablesWidgetOwnProps {
 }
 type ReceivablesWidgetProps = WidgetProviderProps & ReceivablesWidgetOwnProps;
 
-declare function ReceivablesWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: ReceivablesWidgetProps): React.JSX.Element;
+declare function ReceivablesWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: ReceivablesWidgetProps): React.JSX.Element;
 
 interface Labels$3 {
     title: string;
@@ -3589,7 +3613,7 @@ interface LinkedAccountsWidgetProps extends WidgetProviderProps {
     labels?: Partial<Labels$3>;
     featureLabels?: Partial<FeatureLabels$4>;
 }
-declare function LinkedAccountsWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: LinkedAccountsWidgetProps): React.JSX.Element;
+declare function LinkedAccountsWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: LinkedAccountsWidgetProps): React.JSX.Element;
 
 interface AdditionalOwnersLabels {
     heading: string;
@@ -3893,7 +3917,7 @@ interface BankAccountOnboardingWidgetInnerProps {
     onOpenChange?: (open: boolean) => void;
 }
 type BankAccountOnboardingWidgetProps = WidgetProviderProps & BankAccountOnboardingWidgetInnerProps;
-declare function BankAccountOnboardingWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: BankAccountOnboardingWidgetProps): React.JSX.Element;
+declare function BankAccountOnboardingWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: BankAccountOnboardingWidgetProps): React.JSX.Element;
 
 /**
  * Co-located user-facing strings for the products widget UI. Each component
@@ -3991,7 +4015,7 @@ type ProductsWidgetProps = WidgetProviderProps & ProductsWidgetOwnProps;
  * <ProductsWidget baseUrl="https://api.tesouro.com" widgetToken="wt_..." organizationId="org_..." />
  * ```
  */
-declare function ProductsWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: ProductsWidgetProps): React.JSX.Element;
+declare function ProductsWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: ProductsWidgetProps): React.JSX.Element;
 
 interface Labels$2 {
     loadingLabel: string;
@@ -4032,7 +4056,7 @@ interface ProfileWidgetProps extends WidgetProviderProps {
      */
     contactUrl?: string;
 }
-declare function ProfileWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: ProfileWidgetProps): React.JSX.Element;
+declare function ProfileWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: ProfileWidgetProps): React.JSX.Element;
 
 type ReceiptMatchWidgetProps = WidgetProviderProps & {
     isOpen?: boolean;
@@ -4041,7 +4065,7 @@ type ReceiptMatchWidgetProps = WidgetProviderProps & {
     targetTransactionId?: string;
     onSingleTransactionUpdate?: () => void;
 };
-declare function ReceiptMatchWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, isOpen, preSelectedReceiptIds, onClose, targetTransactionId, onSingleTransactionUpdate, }: ReceiptMatchWidgetProps): React.JSX.Element;
+declare function ReceiptMatchWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, isOpen, preSelectedReceiptIds, onClose, targetTransactionId, onSingleTransactionUpdate, }: ReceiptMatchWidgetProps): React.JSX.Element;
 
 interface Labels$1 {
     title: string;
@@ -4147,7 +4171,7 @@ interface SettingsWidgetProps extends MoniteRegionProviderProps {
     tagsContent?: ReactNode;
     invoiceContent?: ReactNode;
 }
-declare function SettingsWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, finopsThemeColors, analytics, ...innerProps }: SettingsWidgetProps): React.JSX.Element;
+declare function SettingsWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, finopsThemeColors, analytics, ...innerProps }: SettingsWidgetProps): React.JSX.Element;
 
 /**
  * Co-located user-facing strings for the tags widget UI. Each component takes a
@@ -4236,7 +4260,7 @@ type TagsWidgetProps = WidgetProviderProps & TagsWidgetOwnProps;
  * <TagsWidget baseUrl="https://api.tesouro.com" widgetToken="wt_..." organizationId="org_..." />
  * ```
  */
-declare function TagsWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: TagsWidgetProps): React.JSX.Element;
+declare function TagsWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: TagsWidgetProps): React.JSX.Element;
 
 interface Labels {
     title: string;
@@ -4486,7 +4510,7 @@ interface TeamWidgetProps extends WidgetProviderProps {
      */
     acceptInviteRedirectUri?: string;
 }
-declare function TeamWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: TeamWidgetProps): React.JSX.Element;
+declare function TeamWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: TeamWidgetProps): React.JSX.Element;
 
 interface TransfersWidgetLabels {
     widgetTitle: string;

package/dist/index.js

@@ -15,7 +15,7 @@ import "./lib/AcceptDisclosuresWidget.js";
 import { BankAccountsWidget as x } from "./libs/tesouro-embedded-components-react/bank-accounts-widget/feature/dist/index8.js";
 import "./lib/BankAccountsWidget.js";
 import { CounterpartsWidget as S } from "./libs/tesouro-embedded-components-react/counterparts-widget/feature/dist/index8.js";
-import { BillPayWidget as C } from "./libs/tesouro-embedded-components-react/bill-pay-widget/feature/dist/index28.js";
+import { BillPayWidget as C } from "./libs/tesouro-embedded-components-react/bill-pay-widget/feature/dist/index30.js";
 import "./lib/BillPayWidget.js";
 import { CardDetailsWidget as w } from "./libs/tesouro-embedded-components-react/card-details-widget/feature/dist/index6.js";
 import { CardFormatValue as T } from "./libs/tesouro-embedded-components-react/create-card-widget/feature/dist/index3.js";

package/dist/lib/AcceptDisclosuresWidget.d.ts

@@ -529,6 +529,30 @@ interface WidgetConfigInput {
      * ```
      */
     configClient?: (client: EmbeddedClient) => EmbeddedClient;
+    /**
+     * Overrides the widget-gateway routing decision for the scoped HTTP client.
+     *
+     * Any caller reaching the Tesouro API with a widget token must route data
+     * requests through the widget gateway: prefix the path with
+     * `/api/widget-gateway/proxy` and carry the token as `X-Widget-Token`. The
+     * provider applies both automatically per request when the request origin is
+     * a known Tesouro API host (`WIDGET_GATEWAY_HOSTS`, derived from the
+     * generated `ClientOptions['baseUrl']`); `/api/widget-gateway/*` paths (the
+     * init round-trip) always pass through untouched.
+     *
+     * - `undefined` — decide from the request origin, as above. Inherits from
+     *   the nearest ancestor or global store like every other config field.
+     * - `true` — always apply the rewrite, even for an unlisted base URL (e.g. a
+     *   custom domain in front of the gateway).
+     * - `false` — never apply it. For hosts that route widget requests their own
+     *   way, such as a same-origin BFF whose `configClient` retargets every
+     *   request.
+     *
+     * Independent of {@link configClient}: a host that only adds a header keeps
+     * the built-in routing, and the built-in interceptor runs before any
+     * `configClient` interceptor.
+     */
+    gatewayRouting?: boolean;
     /**
      * Component the embedded widgets should render in place of plain `<a>` tags.
      *
@@ -685,7 +709,7 @@ type AcceptDisclosuresWidgetProps = WidgetProviderProps & InnerProps;
  * neither, and the same init refresh clears the gate that mounted this. See
  * `WidgetSuite`, which mounts it as its acceptance state.
  */
-declare function AcceptDisclosuresWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: AcceptDisclosuresWidgetProps): React.JSX.Element;
+declare function AcceptDisclosuresWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: AcceptDisclosuresWidgetProps): React.JSX.Element;
 
 export { ACCEPT_DISCLOSURES_WIDGET_LABELS_EN, AcceptDisclosuresWidget };
 export type { AcceptDisclosuresLinks, AcceptDisclosuresWidgetLabels, AcceptDisclosuresWidgetProps };

package/dist/lib/BalancesWidget.d.ts

@@ -498,6 +498,30 @@ interface WidgetConfigInput {
      * ```
      */
     configClient?: (client: EmbeddedClient) => EmbeddedClient;
+    /**
+     * Overrides the widget-gateway routing decision for the scoped HTTP client.
+     *
+     * Any caller reaching the Tesouro API with a widget token must route data
+     * requests through the widget gateway: prefix the path with
+     * `/api/widget-gateway/proxy` and carry the token as `X-Widget-Token`. The
+     * provider applies both automatically per request when the request origin is
+     * a known Tesouro API host (`WIDGET_GATEWAY_HOSTS`, derived from the
+     * generated `ClientOptions['baseUrl']`); `/api/widget-gateway/*` paths (the
+     * init round-trip) always pass through untouched.
+     *
+     * - `undefined` — decide from the request origin, as above. Inherits from
+     *   the nearest ancestor or global store like every other config field.
+     * - `true` — always apply the rewrite, even for an unlisted base URL (e.g. a
+     *   custom domain in front of the gateway).
+     * - `false` — never apply it. For hosts that route widget requests their own
+     *   way, such as a same-origin BFF whose `configClient` retargets every
+     *   request.
+     *
+     * Independent of {@link configClient}: a host that only adds a header keeps
+     * the built-in routing, and the built-in interceptor runs before any
+     * `configClient` interceptor.
+     */
+    gatewayRouting?: boolean;
     /**
      * Component the embedded widgets should render in place of plain `<a>` tags.
      *

package/dist/lib/BankAccountOnboardingWidget.d.ts

@@ -744,6 +744,30 @@ interface WidgetConfigInput {
      * ```
      */
     configClient?: (client: EmbeddedClient) => EmbeddedClient;
+    /**
+     * Overrides the widget-gateway routing decision for the scoped HTTP client.
+     *
+     * Any caller reaching the Tesouro API with a widget token must route data
+     * requests through the widget gateway: prefix the path with
+     * `/api/widget-gateway/proxy` and carry the token as `X-Widget-Token`. The
+     * provider applies both automatically per request when the request origin is
+     * a known Tesouro API host (`WIDGET_GATEWAY_HOSTS`, derived from the
+     * generated `ClientOptions['baseUrl']`); `/api/widget-gateway/*` paths (the
+     * init round-trip) always pass through untouched.
+     *
+     * - `undefined` — decide from the request origin, as above. Inherits from
+     *   the nearest ancestor or global store like every other config field.
+     * - `true` — always apply the rewrite, even for an unlisted base URL (e.g. a
+     *   custom domain in front of the gateway).
+     * - `false` — never apply it. For hosts that route widget requests their own
+     *   way, such as a same-origin BFF whose `configClient` retargets every
+     *   request.
+     *
+     * Independent of {@link configClient}: a host that only adds a header keeps
+     * the built-in routing, and the built-in interceptor runs before any
+     * `configClient` interceptor.
+     */
+    gatewayRouting?: boolean;
     /**
      * Component the embedded widgets should render in place of plain `<a>` tags.
      *
@@ -923,7 +947,7 @@ interface BankAccountOnboardingWidgetInnerProps {
     onOpenChange?: (open: boolean) => void;
 }
 type BankAccountOnboardingWidgetProps = WidgetProviderProps & BankAccountOnboardingWidgetInnerProps;
-declare function BankAccountOnboardingWidget({ baseUrl, widgetToken, organizationId, configClient, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: BankAccountOnboardingWidgetProps): React.JSX.Element;
+declare function BankAccountOnboardingWidget({ baseUrl, widgetToken, organizationId, configClient, gatewayRouting, linkComponent, implementation, uiFramework, errorFallback, onError, analytics, ...innerProps }: BankAccountOnboardingWidgetProps): React.JSX.Element;
 
 export { ADDITIONAL_OWNERS_LABELS_EN, BUSINESS_DETAILS_LABELS_EN, BankAccountOnboardingWidget, PERSONAL_DETAILS_LABELS_EN, RESULT_LABELS_EN };
 export type { AdditionalOwner, AdditionalOwnersLabels, BankAccountOnboardingWidgetLabels, BankAccountOnboardingWidgetProps, BusinessDetailsLabels, BusinessDetailsValues, CompanyStructureValue, DisclosureLinks, MarketingWidgetContent, PersonalDetailsLabels, PersonalDetailsValues, ResultLabels };