> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withheadlight.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Postmessage protocol

# postMessage protocol (v1)

All messages include `v: 1`.

## Parent → iframe

| type        | Purpose                                                                        |
| ----------- | ------------------------------------------------------------------------------ |
| `render`    | Token plus full chart payload (replaces graph and resets ephemeral view state) |
| `focus`     | Focus a node by partner ID                                                     |
| `exclude`   | Hide nodes by partner ID list                                                  |
| `find`      | Search by name                                                                 |
| `resetView` | Restore the last rendered graph view                                           |

## iframe → parent

| type          | Purpose                                         |
| ------------- | ----------------------------------------------- |
| `ready`       | Handshake with no secrets                       |
| `rendered`    | Layout complete (`nodeCount`, `edgeCount` only) |
| `nodeClick`   | Partner-scoped node ID and node type            |
| `findResults` | Matching partner node IDs                       |
| `error`       | Structured error code                           |
| `resize`      | iframe content size changed                     |

## Hardening

* Compare `event.origin` to the token's `frameOrigin`
* Require `event.source === iframe.contentWindow`
* Pass an explicit `targetOrigin` to `postMessage`
* Ignore non-`render` commands until token verification succeeds