@pi-outpost/embed 0.7.0 → 0.9.0

package/README.md

@@ -38,6 +38,17 @@ widget.unmount(); // tear down the React tree
 
 `mount(container, options?)` returns `{ unmount(), setTheme(theme) }`. The container itself stays in the DOM after `unmount()`, with an empty shadow root.
 
+### Which theme wins
+
+Strongest first:
+
+1. `setTheme()`, a `{ type: "pi-outpost:set-theme", theme }` message, or the reader using the widget's own toggle — whatever was chosen while it was on screen;
+2. the `theme` you pass to `mount()`. Naming it means you get it: a reader who once used the toggle on this origin does not overrule the page that embeds the widget;
+3. a theme this browser remembered from an earlier visit;
+4. the server's `branding.defaultTheme`, itself falling back to `"system"`.
+
+So pass `theme` when your page has a look the widget has to match, and leave it out when the deployment's own `branding.defaultTheme` should decide.
+
 ## Server-rendered apps
 
 Importing the package is safe anywhere, but `mount()` needs a real DOM: it attaches a shadow root to the element you give it. In Next.js, Remix or Astro, call it from an effect (client-side only):
@@ -53,10 +64,9 @@ In Next.js, the component doing this must be a client component (`"use client"`)
 
 ## Server-side configuration
 
-Two things to set on the pi-outpost server, whatever the deployment topology:
+Configure this on the pi-outpost server, whatever the deployment topology:
 
-- **`server.allowedOrigins`** — the widget's WebSocket carries the *host page's* origin (e.g. `https://your-app.example.com`), not pi-outpost's own. Add it explicitly; even same-domain deployments need this (only `localhost`/`127.0.0.1` are trusted automatically).
-- **CORS** — `/branding` and `/health` are plain HTTP endpoints with no CORS headers. They work with zero extra config when the widget and the backend share an origin (recommended: reverse-proxy pi-outpost under your own domain). A genuinely cross-origin deployment needs a CORS layer in front.
+- **`server.allowedOrigins`** — the widget carries the *host page's* origin (e.g. `https://your-app.example.com`), not pi-outpost's own. Add it explicitly; even same-domain deployments need this (only `localhost`/`127.0.0.1` are trusted automatically). Listing it is all a cross-origin mount needs: the server answers those origins with the CORS headers the browser requires on every HTTP route, and applies the same allowlist to the WebSocket handshake. It grants no authority of its own — a token-protected route still wants its token.
 
 ## License
 

package/dist/{PdfViewer-B7zZlWXk.js → PdfViewer-Bgsp04sQ.js}

@@ -1,4 +1,4 @@
-import { i as e } from "./workspacePath-CZQ7Q2Vh.js";
+import { a as e } from "./workspacePath-BntMOlpq.js";
 import { useCallback as t, useEffect as n, useRef as r, useState as i } from "react";
 import { Fragment as a, jsx as o, jsxs as s } from "react/jsx-runtime";
 //#region ../ui/src/components/PdfViewer.tsx