Iframe embed

The customer drops a Resi-hosted player page into an iframe. The most common embed, and the one the sign-in flow is designed around.

Player runs on	`control.jefflowery.dev` — third-party to this page
Config comes from	query params on the frame src, mapped to `data-*` by `standAlone()`
Sign-in transport	iframe, escalating to a popup when storage is unreachable
This page can read the viewer id	no — the result is addressed to the player’s origin

The markup

<iframe
  src="https://control.jefflowery.dev/webplayer/video?identifyViewer=required&id=…&type=event"
  allow="autoplay; fullscreen"
  allowfullscreen="true"
  title="Resi player"></iframe>

Expected

Inside the frame, video.html carries data-resi-body, so isInOwnFrame() is true — but window.self !== window.top, so it is not standalone.
Under auth required, sign-in renders before playback. Chrome partitions the frame’s storage under this site, so the flow probes storage and escalates to a popup only when it is unreachable.
Safari with “Prevent cross-site tracking” (the default) fails the probe and shows “Continue in a new window”.
Safari with “Block all cookies” shows the storage-blocked message instead of offering a window. Nothing escapes that setting — the provider’s own login page needs cookies.
No viewer id in the log below.

Messages reaching this page

Legitimate traffic from the player origin appears here: PLAYER_READY and fullscreen requests, which are the player’s documented contract with the embedding page. The sign-in result is not part of it — a red [VIEWER ID] line would mean the message went out with a wildcard target.

include same-origin messages (browser extensions)

nothing yet