Self-hosted hotel widget — zero third-party JS on your domain

Why self-host?

• Content Security Policy. No script-src exception for an external domain.
• Supply chain. You pin the widget version. We can't push a new build to your users without you re-deploying.
• Performance. One less DNS lookup, one less TLS handshake.
• Privacy posture. No third-party cookies set on your domain (we use a partner-key URL parameter for attribution instead).

How to install

# npm
npm install @impt/oss-hotels-widget

# yarn
yarn add @impt/oss-hotels-widget

# Then in your bundle:
import { mountHotelsWidget } from '@impt/oss-hotels-widget';
mountHotelsWidget(document.getElementById('hotels'), { partnerKey: '...' });

What still calls home

The bundled widget still makes API calls to swarm.impt.io/api/widget/* for inventory and attribution. That endpoint accepts CORS from any origin so your domain is fine — but it is the only network dependency.

SRI & CSP

For organisations that audit JS supply chain: every npm release is signed with a Sigstore-style attestation. SHA-256 hashes published on the GitHub release page so you can pin SRI in CI.