Script-tag embed

The customer hosts the player themselves: a container div and loader.min.js, which injects the bundle into this page. Materially different for identity, and the difference is not subtle.

Player runs on	this page’s own origin — first-party, in the customer’s document
Config comes from	data-* attributes only. standAlone() never runs, so query params are not read
Sign-in transport	iframe on the Resi origin, nested in a first-party page
This page can read the viewer id	yes — unavoidably; see below

The markup

<div
  id="resi-video-player"
  data-embed-id="…"
  data-type="event"
  data-autoplay="false"
  data-identify-viewer="required"></div>

<script src="https://control.jefflowery.dev/webplayer/loader.min.js"></script>

Expected

• No data-resi-body, so isInOwnFrame() is false and standAlone() is skipped. The mode switch above sets data-identify-viewer directly rather than passing a query param.
• The sign-in page builds its postMessage target from the origin of the window running the player — which here is the customer’s. So the result is delivered to this page.
• That is correct behaviour, not a leak: the customer is executing our bundle in their own document, so anything the bundle can see, their scripts can see. The no-wildcard rule still matters — it is what keeps the other five cases clean.
• Storage for the nested sign-in frame is partitioned under this site, so the Safari paths behave as they do in an iframe embed.

Messages reaching this page

Every postMessage delivered to this window, newest last, with repeats collapsed. In this case:

• A red [VIEWER ID] line after signing in, from control.jefflowery.dev. On this page only, that is the design. It is also the only place in these six where you can read the message the flow actually sends.
• Nothing on load. No page.min.js here, so no PING_PLAYER and no handshake.
• The sign-in frame is a child of this page, so its origin shows as cross-origin even though the player is first-party.

Messages tagged [this page] come from this document’s own origin and are hidden by default. They are browser extensions: password managers, React DevTools and the like all inject content scripts that post on this page’s behalf. Nothing from the player or the sign-in page can appear under that tag.