@coras-io/embed 0.1.0 → 0.1.2

package/dist/helpers/helpers.d.ts

@@ -1,4 +1,4 @@
-import { SupportedLocales } from "../core/types/index.js";
+import type { SupportedLocales } from "../core/types/index.js";
 export declare function getLocale(fallbackLocale?: string | string[]): SupportedLocales;
 export declare function isLocaleSupported(locale: string): boolean;
 export declare const getCurrency: (locale: string) => "AED" | "ALL" | "AUD" | "CAD" | "CHF" | "CNY" | "DKK" | "EUR" | "GBP" | "HRK" | "HUF" | "IDR" | "ISK" | "JPY" | "MAD" | "MYR" | "NOK" | "PHP" | "PLN" | "SEK" | "SGD" | "THB" | "TRY" | "USD" | "VND";

package/dist/index.js

@@ -1,6 +1,6 @@
 // Public SDK entry point.
 //
-// The package root exposes the SDK only — never page classes, providers,
+// The package root exposes the SDK only - never page classes, providers,
 // contexts, or other internals (ADR 0001). The page custom elements are
 // implementation details and are loaded lazily by `mount()`; importing this
 // module must not pull in Stripe, Coinbase, viem, seats.io, or page UI.

package/dist/mixins/base.mixin.d.ts

@@ -1,10 +1,10 @@
-import { SupportedCurrencies, SupportedLocales } from "../core/types/index.js";
-import { LitElement } from "lit";
+import type { SupportedCurrencies, SupportedLocales } from "../core/types/index.js";
+import type { LitElement } from "lit";
 import type { paths } from "../core/types/api-schema.js";
-import { Client } from "openapi-fetch";
-import { Constructor } from "../contexts/utils.js";
-import { PageDispatchInput } from "../contexts/events.context.js";
-import { PageParamsEvent } from "../core/pages.js";
+import { type Client } from "openapi-fetch";
+import type { Constructor } from "../contexts/utils.js";
+import { type PageDispatchInput } from "../contexts/events.context.js";
+import type { PageParamsEvent } from "../core/pages.js";
 type BaseMixinProperties<CustomPageContext extends PageParamsEvent> = {
     apiHost: string;
     distributorID: string;

package/dist/mixins/base.mixin.js

@@ -4,7 +4,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import createClient from "openapi-fetch";
+import createClient, {} from "openapi-fetch";
 import { property } from "lit/decorators.js";
 import { bookingSessionMiddleware } from "../core/api/middlewares/booking-session/booking-session.js";
 import { errorHandlerMiddleware } from "../core/api/middlewares/error-handler/error-handler.js";
@@ -25,7 +25,7 @@ export const BaseMixin = (superClass) => {
             super(...rest);
             this.apiHost = "";
             this.distributorID = "";
-            this.assetsURL = "images.coras.io";
+            this.assetsURL = "";
             this.currency = DEFAULT_CURRENCY;
             this.currencies = [...supportedCurrencies];
             this.locale = DEFAULT_LOCALE;

package/dist/mixins/coinbase-chains.d.ts

@@ -0,0 +1 @@
+export { base, baseSepolia } from "viem/chains";

package/dist/mixins/coinbase-chains.js

@@ -0,0 +1,7 @@
+// The two chains we support, re-exported so the crypto flow can dynamically
+// import *this* module instead of `viem/chains` directly. That keeps the chain
+// configs in a deferred chunk (off the eager payment page) while still letting
+// the bundler tree-shake the rest of viem's chain barrel: the re-export is
+// static, so only `base`/`baseSepolia` (and their formatters) are pulled in,
+// whereas a dynamic `import("viem/chains")` would bundle every chain.
+export { base, baseSepolia } from "viem/chains";

package/dist/mixins/coinbase.mixin.d.ts

@@ -1,6 +1,6 @@
-import { LitElement } from "lit";
-import { Constructor } from "../contexts/utils.js";
-import { type Hash } from "viem";
+import type { LitElement } from "lit";
+import type { Constructor } from "../contexts/utils.js";
+import type { Hash } from "viem";
 /**
  * Coinbase user session data
  */
@@ -56,7 +56,7 @@ export interface CoinbaseMixinInterface {
     getCoinbaseAccessToken(): Promise<string | null>;
 }
 /**
- * Zero address constant — transfers to this address permanently burn tokens.
+ * Zero address constant - transfers to this address permanently burn tokens.
  */
 declare const ZERO_ADDRESS: "0x0000000000000000000000000000000000000000";
 /**

package/dist/mixins/coinbase.mixin.js

@@ -5,8 +5,12 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { state } from "lit/decorators.js";
-import { base, baseSepolia } from "viem/chains";
-import { createPublicClient, http, encodeFunctionData, parseUnits, formatUnits, isAddress, } from "viem";
+// Only the lightweight, synchronously-needed helpers are imported statically
+// (via `viem/utils`, which pulls no client/transport/RPC code). The heavy
+// public-client machinery and the chain configs (`./coinbase-chains.js`) are
+// dynamically imported inside `initCoinbase`/`transferTokens`, so a payment page
+// that never enters the crypto flow does not eagerly bundle them.
+import { formatUnits, isAddress } from "viem/utils";
 /**
  * ERC-20 ABI for balance and transfer operations
  */
@@ -61,7 +65,7 @@ const TOKEN_DECIMALS = 18;
  */
 const MAX_TRANSFER_AMOUNT = 1_000_000;
 /**
- * Zero address constant — transfers to this address permanently burn tokens.
+ * Zero address constant - transfers to this address permanently burn tokens.
  */
 const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
 /**
@@ -189,7 +193,7 @@ export const CoinbaseMixin = (Base) => {
                 console.error("CDP Project ID must be a valid UUID");
                 return false;
             }
-            // Validate addresses — misconfigured zero-address defaults would irreversibly burn tokens
+            // Validate addresses - misconfigured zero-address defaults would irreversibly burn tokens
             try {
                 assertNonZeroAddress(this.recipientAddress, "Recipient address");
                 assertNonZeroAddress(this.tokenContractAddress, "Token contract address");
@@ -200,7 +204,12 @@ export const CoinbaseMixin = (Base) => {
             }
             this._initPromise = (async () => {
                 try {
-                    this._cdpCore = (await import("@coinbase/cdp-core"));
+                    const [cdpCore, { createPublicClient, http }, { base, baseSepolia }] = await Promise.all([
+                        import("@coinbase/cdp-core"),
+                        import("viem"),
+                        import("./coinbase-chains.js"),
+                    ]);
+                    this._cdpCore = cdpCore;
                     // createOnLogin: "smart" ensures new users get a smart account for gas-sponsored transactions
                     await this._cdpCore.initialize({
                         projectId: pid,
@@ -625,7 +634,7 @@ export const CoinbaseMixin = (Base) => {
                     error: "User not authenticated",
                 };
             }
-            // Runtime guard — misconfigured zero-address would irreversibly burn tokens
+            // Runtime guard - misconfigured zero-address would irreversibly burn tokens
             try {
                 assertNonZeroAddress(this.recipientAddress, "Recipient address");
                 assertNonZeroAddress(this.tokenContractAddress, "Token contract address");
@@ -668,6 +677,9 @@ export const CoinbaseMixin = (Base) => {
             try {
                 this.isTransferPending = true;
                 this.pendingTransferAmount = amount;
+                // viem is already evaluated (loaded during initCoinbase), so this
+                // resolves from the module cache without a second network round-trip.
+                const { parseUnits, encodeFunctionData } = await import("viem");
                 const amountInWei = parseUnits(amount, TOKEN_DECIMALS);
                 const data = encodeFunctionData({
                     abi: ERC20_ABI,
@@ -915,7 +927,7 @@ export const CoinbaseMixin = (Base) => {
         }
         disconnectedCallback() {
             // Clean up local state so initCoinbase() can re-initialize on reconnect.
-            // Don't sign out — session persists in CDP SDK storage.
+            // Don't sign out - session persists in CDP SDK storage.
             if (this._mfaListenerUnsubscribe) {
                 this._mfaListenerUnsubscribe();
                 this._mfaListenerUnsubscribe = null;

package/dist/mixins/error-modal.mixin.d.ts

@@ -1,8 +1,8 @@
-import { LitElement } from "lit";
+import { type LitElement } from "lit";
 import "../components/dialog/dialog.js";
 import "../components/icon/icon.js";
 import "../components/button/button.js";
-import { Constructor } from "../contexts/utils.js";
+import type { Constructor } from "../contexts/utils.js";
 export interface ErrorModalMixinInterface {
     showErrorModalOnce(): void;
     resetErrorModalGuard(): void;

package/dist/mixins/location-search/location-search.d.ts

@@ -1,7 +1,7 @@
-import { LitElement } from "lit";
-import { LocationSearchMixinInterface } from "./types.js";
+import { type LitElement } from "lit";
+import type { LocationSearchMixinInterface } from "./types.js";
 import "../../components/dropdown/dropdown.js";
 import "../../components/locations-results/locations-results.js";
 import "../../components/input-field/input-field.js";
-import { Constructor } from "../../contexts/utils.js";
+import type { Constructor } from "../../contexts/utils.js";
 export declare const LocationSearchMixin: <T extends Constructor<LitElement>>(superClass: T) => Constructor<LocationSearchMixinInterface> & T;

package/dist/mixins/location-search/location-search.js

@@ -4,7 +4,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-import { html } from "lit";
+import { html, } from "lit";
 import { property, state } from "lit/decorators.js";
 import { consume } from "@lit/context";
 import { classMap } from "lit/directives/class-map.js";

package/dist/mixins/location-search/types.d.ts

@@ -1,5 +1,5 @@
-import { TemplateResult } from "lit";
-import { components } from "../../core/types/api-schema.js";
+import type { TemplateResult } from "lit";
+import type { components } from "../../core/types/api-schema.js";
 export declare class LocationSearchMixinInterface {
     country: string;
     city: string;

package/dist/mixins/overlay/overlay-mixin.d.ts

@@ -1,4 +1,4 @@
-import { LitElement } from "lit";
+import { type LitElement } from "lit";
 import "../../components/overlay/overlay.js";
-import { OverlayMixinInterface, Constructor } from "./types.js";
+import type { OverlayMixinInterface, Constructor } from "./types.js";
 export declare const OverlayMixin: <T extends Constructor<LitElement>>(superClass: T) => Constructor<OverlayMixinInterface> & T;

package/dist/mixins/overlay/types.d.ts

@@ -1,4 +1,4 @@
-import { TemplateResult } from "lit";
+import type { TemplateResult } from "lit";
 export type Constructor<T> = new (...args: any[]) => T;
 export declare class OverlayMixinInterface {
     open: boolean;

package/dist/mixins/points/points.d.ts

@@ -1,3 +1,3 @@
-import { LitElement } from "lit";
-import { Constructor, PointsMixinInterface } from "./types.js";
+import type { LitElement } from "lit";
+import type { Constructor, PointsMixinInterface } from "./types.js";
 export declare const PointsMixin: <T extends Constructor<LitElement>>(superClass: T) => Constructor<PointsMixinInterface> & T;

package/dist/mixins/points/types.d.ts

@@ -1,4 +1,4 @@
-import { CalculateRewardPoints } from "../../core/types/index.js";
+import type { CalculateRewardPoints } from "../../core/types/index.js";
 export type Constructor<T> = new (...args: any[]) => T;
 export declare class PointsMixinInterface {
     pointsLogoUrl: string;

package/dist/mixins/search-mixin/search-mixin.d.ts

@@ -1,4 +1,4 @@
-import { LitElement } from "lit";
-import { SearchMixinInterface } from "./types.js";
-import { Constructor } from "../../contexts/utils.js";
+import type { LitElement } from "lit";
+import type { SearchMixinInterface } from "./types.js";
+import type { Constructor } from "../../contexts/utils.js";
 export declare const SearchMixin: <T extends Constructor<LitElement>>(superClass: T) => Constructor<SearchMixinInterface> & T;

package/dist/mixins/search-mixin/types.d.ts

@@ -1,5 +1,5 @@
-import { Task } from "@lit/task";
-import { components } from "../../core/types/api-schema.js";
+import type { Task } from "@lit/task";
+import type { components } from "../../core/types/api-schema.js";
 export declare class SearchMixinInterface {
     searchTask: Task<readonly [string, string | undefined], components["schemas"]["SearchGetResponse"] | undefined>;
     getSearchTerm(): string;

package/dist/sdk/chrome.js

@@ -1,11 +1,12 @@
 import { safeUrl } from "@coras-io/brand-tokens";
+import { once } from "./once.js";
 const SLOT_TAGS = {
     navbar: "coras-navbar",
     footer: "coras-footer",
 };
 const chromeLoaders = {
-    navbar: () => import("../containers/navbar/navbar.js"),
-    footer: () => import("../containers/footer/footer.js"),
+    navbar: once(() => import("../containers/navbar/navbar.js")),
+    footer: once(() => import("../containers/footer/footer.js")),
 };
 function normalizeChrome(chrome) {
     if (chrome === undefined || chrome === false) {
@@ -70,13 +71,16 @@ async function createSlotElement(slot, spec, logo) {
  */
 export async function createChrome(chrome, options) {
     const normalized = normalizeChrome(chrome);
-    const elements = [];
+    // Load both slots concurrently; each dynamically imports its own module.
     // `theme.logo` is the public config and skips BrandConfig validation, so gate
     // it here at the SDK boundary: an unsafe URL yields "" and renders no logo.
-    const navbar = await createSlotElement("navbar", normalized.navbar, safeUrl(options?.logo));
+    const [navbar, footer] = await Promise.all([
+        createSlotElement("navbar", normalized.navbar, safeUrl(options?.logo)),
+        createSlotElement("footer", normalized.footer),
+    ]);
+    const elements = [];
     if (navbar)
         elements.push(navbar);
-    const footer = await createSlotElement("footer", normalized.footer);
     if (footer)
         elements.push(footer);
     return elements;

package/dist/sdk/diagnostics.d.ts

@@ -0,0 +1,9 @@
+import type { CorasConfig, CorasLogger } from "./types.js";
+export type Diagnostics = {
+    /** Warn once per `code`. No-op if nothing consumes diagnostics. */
+    warn: (code: string, message: string, data?: unknown) => void;
+    /** True when either channel would surface a warning (logger or strict). */
+    readonly active: boolean;
+};
+export declare function createDiagnostics(logger: CorasLogger | undefined, strict: boolean): Diagnostics;
+export declare function themeHasNoColours(theme: CorasConfig["theme"]): boolean;

package/dist/sdk/diagnostics.js

@@ -0,0 +1,25 @@
+export function createDiagnostics(logger, strict) {
+    const hasLogger = typeof logger?.warn === "function";
+    const active = hasLogger || strict;
+    const seen = new Set();
+    return {
+        active,
+        warn(code, message, data) {
+            if (!active || seen.has(code))
+                return;
+            seen.add(code);
+            logger?.warn?.(message, data);
+            if (strict) {
+                if (data !== undefined)
+                    console.warn(`[coras] ${message}`, data);
+                else
+                    console.warn(`[coras] ${message}`);
+            }
+        },
+    };
+}
+// A theme with no brand colours means the mount falls back to Coras defaults -
+// almost always a sign the host forgot to pass its `brand.json` as `config.theme`.
+export function themeHasNoColours(theme) {
+    return theme?.primary == null && theme?.secondary == null;
+}

package/dist/sdk/mount.js

@@ -1,5 +1,6 @@
 import { fireEvent } from "../core/events.js";
 import { DEFAULT_CURRENCY, DEFAULT_LOCALE } from "../views/constants.js";
+import { createDiagnostics, themeHasNoColours } from "./diagnostics.js";
 import { attachCallbackBridge, } from "./element-adapter.js";
 import { createChrome } from "./chrome.js";
 import { applyConfig, applyParams, captureParamDefaults, defaultPageRegistry, } from "./page-registry.js";
@@ -25,6 +26,15 @@ export function createMountWith(registry) {
         const strict = options.strict === true;
         const preview = options.preview === true;
         const container = options.container;
+        // Dev-time diagnostics (see diagnostics.ts): active only when a logger is
+        // wired or `strict` is on, so production stays silent.
+        const diagnostics = createDiagnostics(options.logger, strict);
+        // Mounting a second app into a container that already holds one silently
+        // stacks two mounts - a common cause of "it renders twice" in effects that
+        // forget to unmount.
+        if (diagnostics.active &&
+            container.querySelector(":scope > [data-coras-root]"))
+            diagnostics.warn("double-mount", "mount() was called on a container that already holds a Coras mount. Call app.unmount() before mounting again, or mount into a fresh element.");
         const root = document.createElement("div");
         root.setAttribute("data-coras-root", "");
         // Token system is defined on the container scope and inherits into every
@@ -35,6 +45,8 @@ export function createMountWith(registry) {
         let currentConfig = validated.config;
         let currentParams = validated.params;
         let currentChrome = options.chrome;
+        if (themeHasNoColours(currentConfig.theme))
+            diagnostics.warn("no-theme", "config.theme has no brand colours (primary/secondary); Coras will render with default styling. Pass your brand.json as config.theme to apply your brand.");
         applyTheme(root, currentConfig.theme);
         applyColorScheme(root, currentConfig.colorScheme);
         root.dataset.corasPage = currentPage;
@@ -156,6 +168,36 @@ export function createMountWith(registry) {
             });
         }
         startRender(currentPage);
+        // Post-render diagnostics: run only when something consumes them. The assets
+        // probe confirms icons actually load; the fit check catches a container that
+        // clips the managed page (e.g. a leftover starter-template `#root`).
+        if (diagnostics.active) {
+            const assetsUrl = currentConfig.assetsUrl;
+            void (async () => {
+                const url = `${assetsUrl}/icons.svg`;
+                try {
+                    const res = await fetch(url);
+                    const type = res.headers.get("content-type") ?? "";
+                    if (!res.ok || !/svg|xml/i.test(type))
+                        diagnostics.warn("assets-unreachable", `Coras icons could not be loaded from ${url} (status ${res.status}). Set config.assetsUrl to a valid Coras asset origin.`);
+                }
+                catch {
+                    diagnostics.warn("assets-unreachable", `Coras icons could not be loaded from ${url}. Set config.assetsUrl to a reachable Coras asset origin.`);
+                }
+            })();
+            void ready
+                .then(() => {
+                // Only meaningful with managed chrome (the page owns the width). With
+                // `chrome: false` a narrow container is the host's deliberate choice.
+                if (chromeElements.length === 0)
+                    return;
+                const width = root.getBoundingClientRect().width;
+                const viewport = root.ownerDocument.defaultView?.innerWidth ?? 0;
+                if (viewport && width > 0 && width < viewport * 0.9)
+                    diagnostics.warn("constrained-container", `The Coras page rendered at ${Math.round(width)}px inside a ${viewport}px viewport. With managed chrome the page expects the full width - an ancestor (often a leftover starter-template \`#root\` with max-width or centering) is constraining it. Let the container fill the page, or pass chrome: false if you are embedding into an existing layout.`);
+            })
+                .catch(() => undefined);
+        }
         function applyUpdate(patch) {
             if (destroyed)
                 return;

package/dist/sdk/once.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Memoize a zero-arg async factory so concurrent callers share one in-flight
+ * promise. Used to wrap the lazy `import()` loaders: `mount()` and `prefetch()`
+ * can request the same page (or chrome) module at once, and browser module
+ * evaluation is already cached, but without this each call still allocates a
+ * fresh import promise. A rejected load is not cached, so a failed module
+ * (offline, chunk 404) can be retried on the next call.
+ */
+export declare function once<T>(factory: () => Promise<T>): () => Promise<T>;

package/dist/sdk/once.js

@@ -0,0 +1,18 @@
+/**
+ * Memoize a zero-arg async factory so concurrent callers share one in-flight
+ * promise. Used to wrap the lazy `import()` loaders: `mount()` and `prefetch()`
+ * can request the same page (or chrome) module at once, and browser module
+ * evaluation is already cached, but without this each call still allocates a
+ * fresh import promise. A rejected load is not cached, so a failed module
+ * (offline, chunk 404) can be retried on the next call.
+ */
+export function once(factory) {
+    let inFlight;
+    return () => {
+        inFlight ??= factory().catch((error) => {
+            inFlight = undefined;
+            throw error;
+        });
+        return inFlight;
+    };
+}

package/dist/sdk/page-registry.d.ts

@@ -19,8 +19,8 @@ export declare function applyConfig(element: ConfigurableElement, config: CorasC
 /**
  * Snapshot the element's default values for every param the page exposes. Taken
  * right after creation (before any params are applied) so a later update can
- * reset a param the host no longer provides back to its default — i.e. "clear"
- * it — instead of leaving the stale value in place.
+ * reset a param the host no longer provides back to its default - i.e. "clear"
+ * it - instead of leaving the stale value in place.
  */
 export declare function captureParamDefaults(element: ConfigurableElement, entry: PageEntry): Record<string, unknown>;
 /**

package/dist/sdk/page-registry.js

@@ -1,3 +1,4 @@
+import { once } from "./once.js";
 /** Identity map helper for params whose public name equals the element property. */
 function identity(...keys) {
     return Object.fromEntries(keys.map((key) => [key, key]));
@@ -5,7 +6,7 @@ function identity(...keys) {
 export const defaultPageRegistry = {
     landing: {
         tagName: "coras-landing-page",
-        load: () => import("../views/landing-page/landing-page.js"),
+        load: once(() => import("../views/landing-page/landing-page.js")),
         // Public `sort` maps to the internal `sorting` property.
         paramToProperty: {
             ...identity("country", "city", "startDate", "endDate", "duration", "price", "categories"),
@@ -14,28 +15,28 @@ export const defaultPageRegistry = {
     },
     search: {
         tagName: "coras-search-page",
-        load: () => import("../views/search-page/search-page.js"),
+        load: once(() => import("../views/search-page/search-page.js")),
         paramToProperty: identity("search", "startDate"),
     },
     details: {
         tagName: "coras-details-page",
-        load: () => import("../views/details-page/details-page.js"),
+        load: once(() => import("../views/details-page/details-page.js")),
         // Public `id` maps to the internal `attractionId` property.
         paramToProperty: { id: "attractionId", date: "date" },
     },
     payment: {
         tagName: "coras-payment-page",
-        load: () => import("../views/payment-page/payment-page.js"),
+        load: once(() => import("../views/payment-page/payment-page.js")),
         paramToProperty: identity("metadata"),
     },
     help: {
         tagName: "coras-help-page",
-        load: () => import("../views/help-page/help-page.js"),
+        load: once(() => import("../views/help-page/help-page.js")),
         paramToProperty: identity("content"),
     },
     "suggestion-widget": {
         tagName: "coras-suggestion-widget",
-        load: () => import("../views/suggestion-widget/suggestion-widget.js"),
+        load: once(() => import("../views/suggestion-widget/suggestion-widget.js")),
         paramToProperty: identity("limit", "showExploreCard", "country", "city"),
     },
 };
@@ -43,8 +44,7 @@ export const defaultPageRegistry = {
 export function applyConfig(element, config) {
     element.apiHost = config.apiUrl;
     element.distributorID = config.distributorId;
-    if (config.assetsUrl != null)
-        element.assetsURL = config.assetsUrl;
+    element.assetsURL = config.assetsUrl;
     if (config.locale != null)
         element.locale = config.locale;
     if (config.allowedLocales != null)
@@ -60,8 +60,8 @@ export function applyConfig(element, config) {
 /**
  * Snapshot the element's default values for every param the page exposes. Taken
  * right after creation (before any params are applied) so a later update can
- * reset a param the host no longer provides back to its default — i.e. "clear"
- * it — instead of leaving the stale value in place.
+ * reset a param the host no longer provides back to its default - i.e. "clear"
+ * it - instead of leaving the stale value in place.
  */
 export function captureParamDefaults(element, entry) {
     const defaults = {};

package/dist/sdk/theme.js

@@ -29,7 +29,7 @@ export function applyTheme(element, theme) {
         return;
     // Each themeable var is emitted as a `light-dark()` pair (or a single value
     // when the field has no dark variant) via the shared engine, which sanitizes
-    // both sides — an invalid value yields "" and is skipped, so the Coras default
+    // both sides - an invalid value yields "" and is skipped, so the Coras default
     // (itself a light-dark pair) shows through. The dark side falls back to the
     // Coras dark default when the brand sets only the light value.
     const dark = (theme.dark ?? {});

package/dist/sdk/types.d.ts

@@ -68,17 +68,17 @@ export type CorasTheme = BrandConfig;
  * its `dark` block the dark overrides; this picks which side the `light-dark()`
  * token pairs resolve to.
  *
- * - `"light"` (default) — always light, ignoring the host page.
- * - `"dark"` — always dark.
- * - `"system"` — follows the OS via `prefers-color-scheme`.
- * - `"inherit"` — follows the host page's own `color-scheme` (the SDK sets none),
+ * - `"light"` (default) - always light, ignoring the host page.
+ * - `"dark"` - always dark.
+ * - `"system"` - follows the OS via `prefers-color-scheme`.
+ * - `"inherit"` - follows the host page's own `color-scheme` (the SDK sets none),
  *   so the embed behaves like a native element on a light or dark site.
  */
 export type CorasColorScheme = "light" | "dark" | "system" | "inherit";
 export type CorasConfig = {
     apiUrl: string;
     distributorId: string;
-    assetsUrl?: string;
+    assetsUrl: string;
     locale?: SupportedLocales;
     allowedLocales?: SupportedLocales[];
     currency?: SupportedCurrencies;
@@ -109,11 +109,11 @@ export type CorasNavbarProps = {
  * the host owns, not the internal widget they sit beside, and use logical
  * `start`/`end` so they stay correct under RTL.
  *
- * - `brand`         — logo / home affordance (leading edge)
- * - `nav`           — primary navigation, after the brand
- * - `actions-start` — leading edge of the utility cluster, before the basket
- * - `actions-end`   — trailing edge of the utility cluster, before search
- * - `search`        — replaces the built-in search (requires `showSearch: false`)
+ * - `brand`         - logo / home affordance (leading edge)
+ * - `nav`           - primary navigation, after the brand
+ * - `actions-start` - leading edge of the utility cluster, before the basket
+ * - `actions-end`   - trailing edge of the utility cluster, before search
+ * - `search`        - replaces the built-in search (requires `showSearch: false`)
  */
 export type CorasNavbarSlotName = "brand" | "nav" | "actions-start" | "actions-end" | "search";
 /**
@@ -222,7 +222,7 @@ export type CorasMountOptions<P extends CorasPageName = CorasPageName> = {
      * tools (e.g. the Studio). Pages that would otherwise show an empty
      * or error state when there is nothing to check out instead render their full
      * form with actions disabled, so the chrome can be styled. Not for production
-     * hosts — a real customer with an empty basket should see the empty state.
+     * hosts - a real customer with an empty basket should see the empty state.
      */
     preview?: boolean;
 } & CorasCallbacks;

package/dist/sdk/validation.d.ts

@@ -14,8 +14,8 @@ export declare class CorasValidationError extends Error {
 export declare const PUBLIC_PAGES: readonly CorasPageName[];
 /**
  * Reject a page name outside the public set with a typed error. Shared by mount,
- * update, navigate and prefetch so every entry point fails the same way — and
- * before any state is mutated — instead of indexing the registry with an unknown
+ * update, navigate and prefetch so every entry point fails the same way - and
+ * before any state is mutated - instead of indexing the registry with an unknown
  * page and throwing a bare TypeError.
  */
 export declare function assertValidPage(page: unknown): asserts page is CorasPageName;

package/dist/sdk/validation.js

@@ -24,8 +24,8 @@ export const PUBLIC_PAGES = [
 ];
 /**
  * Reject a page name outside the public set with a typed error. Shared by mount,
- * update, navigate and prefetch so every entry point fails the same way — and
- * before any state is mutated — instead of indexing the registry with an unknown
+ * update, navigate and prefetch so every entry point fails the same way - and
+ * before any state is mutated - instead of indexing the registry with an unknown
  * page and throwing a bare TypeError.
  */
 export function assertValidPage(page) {
@@ -128,7 +128,7 @@ const BARE_HOSTNAME_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-
 /**
  * Asset URL must be one of:
  *   - an https URL (http allowed only for localhost),
- *   - a bare hostname like `images.coras.io[:port]`,
+ *   - a bare hostname like `assets.example.com[:port]`,
  *   - a root-relative path like `/assets`.
  * Rejected: protocol-relative URLs (`//host/x`), `javascript:` / `data:` URIs,
  * traversal-style paths. `assetsUrl` is interpolated straight into image and
@@ -220,10 +220,11 @@ export function validateConfig(config, strict) {
         config.distributorId.length === 0) {
         throw new CorasValidationError("invalid_config", "config.distributorId is required.", "config.distributorId");
     }
-    const normalized = { ...config };
-    if (config.assetsUrl != null) {
-        validateAssetsUrl(config.assetsUrl);
+    if (typeof config.assetsUrl !== "string" || config.assetsUrl.length === 0) {
+        throw new CorasValidationError("invalid_config", "config.assetsUrl is required.", "config.assetsUrl");
     }
+    validateAssetsUrl(config.assetsUrl);
+    const normalized = { ...config };
     if (config.theme != null) {
         validateTheme(config.theme, strict);
     }

package/dist/styles/tokens.css

@@ -1,4 +1,4 @@
-/* GENERATED by scripts/generate-tokens.mjs — do not edit by hand. */
+/* GENERATED by scripts/generate-tokens.mjs - do not edit by hand. */
 /* CSS-first four-tier token system (plan F-004, P-051..P-055). */
 
 @layer coras.palette, coras.brand, coras.semantic, coras.components;