Iframe embed

The customer drops a Resi-hosted player page into an iframe. The most common embed, and the one the sign-in flow is designed around.

Player runs on	control.jefflowery.dev — third-party to this page
Config comes from	query params on the frame src, mapped to data-* by standAlone()
Sign-in transport	iframe, escalating to a popup when storage is unreachable
This page can read the viewer id	no — the result is addressed to the player’s origin

The markup

<iframe
  src="https://control.jefflowery.dev/webplayer/video?identifyViewer=required&id=…&type=event"
  class="resi-video-frame"
  allow="autoplay; fullscreen"
  allowfullscreen="true"
  title="Resi player"></iframe>

Expected

• Inside the frame, video.html carries data-resi-body, so isInOwnFrame() is true — but window.self !== window.top, so it is not standalone.
• Under auth required, sign-in renders before playback. Chrome partitions the frame’s storage under this site, so the flow probes storage and escalates to a popup only when it is unreachable.
• Safari with “Prevent cross-site tracking” (the default) fails the probe and shows “Continue in a new window”.
• Safari with “Block all cookies” shows the storage-blocked message instead of offering a window. Nothing escapes that setting — the provider’s own login page needs cookies.
• Playback starting is the proof sign-in succeeded. The viewer id itself never reaches this page.

Messages reaching this page

Every postMessage delivered to this window, newest last, with repeats collapsed. In this case:

• Nothing at all, in the normal case. There is no page.min.js here, so nobody sends PING_PLAYER and the player has nothing to answer — the parent contract is opt-in. See the page script case for what it looks like when it runs.
• Nothing after signing in either. The sign-in page posts to the window running the player, which is the frame, not this page. That absence is the check: the counter for viewer ids must stay at zero.
• Extension chatter under [this page] if you tick the box. Not ours.

Messages tagged [this page] come from this document’s own origin and are hidden by default. They are browser extensions: password managers, React DevTools and the like all inject content scripts that post on this page’s behalf. Nothing from the player or the sign-in page can appear under that tag.