emit assetsBase and the API-base global into the direct-JS embed snippet

internal/generate-tree.mjs

@@ -882,9 +882,32 @@ function scanBundles() {
       const iframeEmbed =
         `<iframe src="${iframeUrl}?utm_source=YOUR_SOURCE" width="100%" height="600" ` +
         `style="border:none;border-radius:12px;" allowfullscreen></iframe>`
+      // ★ THE SNIPPET MUST CARRY assetsBase + apiBaseUrl (BUG-EMBED-SCRIPT-SNIPPET-OMITS-…).
+      // MEASURED 2026-09-20: pasting the old snippet onto a FOREIGN HOST PAGE mounted the element
+      // (defined + shadow root + full height) and rendered NO MAP — two 404s, because relative asset
+      // and API paths resolve against the HOST's document, not the bundle's.
+      // THE ASYMMETRY, and why deploy-1 never had this problem: an IFRAME carries its OWN document
+      // base, so the leaf page's relative paths resolve; a DIRECT-JS embed executes in the host's
+      // document, so they do not. Same bundle, same snippet, different containing document.
+      // Emit the CONFIGURED values when the build sets them (assetsBaseUrl / apiBaseUrl), otherwise a
+      // PLACEHOLDER in the established style of YOUR_MAPBOX_TOKEN / YOUR_SOURCE — so the snippet stays
+      // honest for a same-root drop and becomes CORRECT for a partner who fills them in.
+      // ★ assetsBase goes in the PROFILE-CONFIG; the API base does NOT — it is a WINDOW GLOBAL.
+      // Verified in library/api/apiBaseUrl.js: getApiBaseUrl() reads ONLY window.MAP_APP_API_URL or
+      // the build-time VITE_API_BASE_URL. There is no profile-config path, so emitting an
+      // `apiBaseUrl` key here would look correct and do NOTHING (measured: the data call still 404'd).
+      // Same modular pattern as window.MAP_TOKEN_URL — a host-settable global, no rebuild needed.
+      const embedCfg = {
+        profile: profileName,
+        tk: 'YOUR_MAPBOX_TOKEN',
+        utmSource: 'YOUR_SOURCE',
+        assetsBase: DEST_CONFIG.assetsBaseUrl || 'YOUR_TREE_URL/assets',
+      }
+      const apiBase = DEST_CONFIG.apiBaseUrl || 'YOUR_API_BASE_URL'
       const scriptEmbed =
+        `<script>window.MAP_APP_API_URL=${JSON.stringify(apiBase)};<\/script>\n` +
         `<script src="${scriptUrl}"${integrity ? ` integrity="${integrity}" crossorigin="anonymous"` : ''}><\/script>\n` +
-        `<${tag} profile-config='{"profile":"${profileName}","tk":"YOUR_MAPBOX_TOKEN","utmSource":"YOUR_SOURCE"}'></${tag}>`
+        `<${tag} profile-config='${JSON.stringify(embedCfg)}'></${tag}>`
 
       // Preconfigured instances: ONE parameterized profile → N preset render
       // targets, declared in <something>.instances.json next to the .vue. Each