Iframe embed + page script

The same iframe, plus the optional page.min.js. It is what makes fullscreen work when the frame sits inside a transformed or clipped container — and the only case where the parent legitimately exchanges messages with the player.

Player runs on	control.jefflowery.dev — third-party to this page
Config comes from	query params on the frame src, mapped to data-* by standAlone()
Sign-in transport	iframe, escalating to a popup when storage is unreachable
This page can read the viewer id	no — the result is addressed to the player’s origin
Extra on the customer page	page.min.js, which pings every .resi-video-frame and acts on the replies

The markup

<iframe
  src="https://control.jefflowery.dev/webplayer/video?identifyViewer=required&id=…&type=event"
  class="resi-video-frame"
  allow="autoplay; fullscreen"
  allowfullscreen="true"
  title="Resi player"></iframe>

<script src="https://control.jefflowery.dev/webplayer/page.min.js"></script>

Expected

• Sign-in behaves exactly as the plain iframe case. The page script has nothing to do with identity.
• class="resi-video-frame" is load-bearing here: broadcastToPlayers() selects on that class, so without it the ping never reaches the frame and the handshake silently never happens.
• Once the handshake completes the player knows the parent origin, which is what lets it request pseudo-fullscreen. Hit the fullscreen control to see those messages arrive.
• This is the page to compare against when a customer reports fullscreen broken but playback fine.

Messages reaching this page

Every postMessage delivered to this window, newest last, with repeats collapsed. In this case:

• PING_PLAYER under [this page] — the page script also posts to its own window, for the script-tag case where the player is not in a frame. Tick the box to see it. It repeats while it retries.
• PLAYER_READY from control.jefflowery.dev, tagged [player contract]. This is the handshake completing, and it is the one thing that should appear here on load.
• FULLSCREEN_ENTER and FULLSCREEN_EXIT from the player when you use the fullscreen control and pseudo-fullscreen applies.
• Still no viewer id. The counter stays at zero — a page script does not change where the sign-in result is addressed.

Messages tagged [this page] come from this document’s own origin and are hidden by default. They are browser extensions: password managers, React DevTools and the like all inject content scripts that post on this page’s behalf. Nothing from the player or the sign-in page can appear under that tag.