Browser events

Every message has v: 1 and an exact type.

Studio to parent

type SmoreHostMessage =
  | { v: 1; type: "smore:ready" }
  | {
      v: 1;
      type: "smore:scene-status";
      sceneId: string;
      status: "processing" | "ready" | "failed";
      version: number;
    }
  | {
      v: 1;
      type: "smore:reference-package";
      referencePackageId: string;
    }
  | {
      v: 1;
      type: "smore:error";
      code: string;
      message: string;
      requestId: string | null;
    };

smore:ready means authenticated bootstrap completed, the current scene was applied, the mode and theme are active, and allowed controls are interactive.

Parent to studio

type SmoreHostCommand = {
  v: 1;
  type: "smore:refresh";
  expectedVersion: number;
};

Send commands only with target origin https://embed.smore.video.

Validate both sides

window.addEventListener("message", (event) => {
  if (event.origin !== "https://embed.smore.video") return;
  if (event.source !== studio.contentWindow) return;
  if (!event.data || typeof event.data !== "object") return;
  if (event.data.v !== 1 || typeof event.data.type !== "string") return;

  // Handle only known fields for known message types.
});

Ignore unknown v1 message types and fields. Never accept scene data, media bytes, or credentials through postMessage; those are not part of the protocol.