fix(iframe): [PKG-IFRAME-03] release failed setup and bind message peers

packages/artplayer-tool-iframe/ARCHITECTURE.md

@@ -5,6 +5,9 @@ message listener, child injection/execution protocol and public callbacks.
 `src/requests.ts` owns request IDs, pending promises, injection polling and
 settlement/cancellation. Its host interface uses only the iframe, registry and
 two lifecycle flags; it does not depend on ArtPlayer or import the entry class.
+`src/connection.ts` owns listener acquisition/release and ensures request
+cancellation runs even if listener removal throws. `src/protocol.ts` checks the
+selected window peer and packet shape before either public receiver processes it.
 
 The entry initializes the same seven enumerable, writable fields in the same
 order. Internal request ownership lives in a module WeakMap, keeping instance
@@ -30,6 +33,10 @@ including failures reached from polling. `destroy()` first marks the instance
 destroyed, removes its listener, then immediately rejects both sent and waiting
 requests with `The instance has been destroyed`. Saved listener/timer callbacks
 become inert. Repeated destroy is harmless. There is no implicit request timeout.
+If constructor setup fails, it marks the partial instance destroyed, releases
+the acquired listener and cancels reentrant requests, preserving the original
+setup error even if cleanup also fails. The listener receiver and owning window
+are captured on acquisition; connection ownership is removed before releasing it.
 
 These are deliberate defect corrections: callers holding a promise during
 destroy must handle rejection; previously sent requests remained pending forever.
@@ -46,10 +53,24 @@ the async handler; resolver commits await the result. Execution errors still
 send an error packet and reject the handler. Expression arrow functions, closure
 capture and CSP restrictions have not been replaced with a new RPC protocol.
 
-This checkpoint does not fix navigation/reinjection, malformed message handling
-or source/origin validation. The executable commit protocol is not a sandbox;
-the current listener still accepts messages from unrelated windows. IFRAME-LIFE-01
-and IFRAME-TRUST-01 remain open. Continue in PKG-IFRAME-03/05 before release.
+Both receivers ignore malformed payloads (a non-null object with a string `type`
+is required, including an empty string). The parent accepts native messages only
+from the configured iframe's contentWindow; the child accepts them only from
+window.parent. Public direct onMessage calls with a missing/null source remain
+available to local callers. Same-page script or privileged injection is not
+isolated by this check. Generic response types and commit payload error handling
+are unchanged after the peer/envelope check.
+
+The initial URL's origin is deliberately not pinned: redirects and sandboxed
+opaque-origin children still communicate with their selected parent. The peer's
+content and the embedding parent must be trusted; executable commit is not a
+sandbox or a parent-origin allowlist. Upgrading one side does not secure the
+unchanged historical receiver on the other side. See the independent decision in
+[iframe-message-boundary.md](../../refactor/iframe-message-boundary.md).
+
+Navigation/reinjection remains unfinished. A child can inject before iframe load;
+blindly resetting state on load would lose a valid handshake. IFRAME-LIFE-01 and
+IFRAME-TRUST-01 remain open for complete lifecycle/integration and release review.
 
 Public declarations remain in `types/artplayer-tool-iframe.d.ts`; source typing
 does not yet establish historical declaration/entry compatibility. PKG-IFRAME-04
@@ -67,6 +88,10 @@ publication is implied by this source migration.
   generated docs copies. Never hand-edit those files.
 - `yarn test:browser test/browser/iframe.spec.js`: real same/cross-origin windows
   in Chromium, Firefox and WebKit. This tool-only fixture creates no player.
+- `yarn test:browser test/browser/iframe-boundaries.spec.js`: native peer rejection,
+  malformed packets, actual HTTP redirects, opaque sandbox and normal new/old
+  parent-child wire combinations. `ARTPLAYER_IFRAME_BOUNDARIES_ONLY=1` omits the
+  mixed-version controls when reproducing a candidate boundary failure.
 - Set `ARTPLAYER_IFRAME_LIFECYCLE_ONLY=1` for candidate lifecycle browser rows;
   `ARTPLAYER_IFRAME_ARTIFACT` selects an actual built file. For an unchanged
   candidate test against the old workspace, set `ARTPLAYER_IFRAME_BASELINE=1`.

packages/artplayer-tool-iframe/dist/artplayer-tool-iframe.js

@@ -4,4 +4,4 @@
  * (c) 2017-2026 Harvey Zhao
  * Released under the MIT License.
  */
-!function(e,t){"object"===typeof exports&&"undefined"!==typeof module?module.exports=t():"function"==typeof define&&define.amd?(e.ArtplayerToolIframe=t(),define(function(){return e.ArtplayerToolIframe})):(e="undefined"!==typeof globalThis?globalThis:e||self).ArtplayerToolIframe=t()}(this,function(){"use strict";const e=new WeakMap;let t=0;class s{static get iframe(){return window.top!==window}static postMessage({type:e,data:t,id:o=0}){if(!s.iframe)throw new Error('The "ArtplayerToolIframe.postMessage" method can only be used in iframe');window.parent.postMessage({type:e,data:t,id:o},"*")}static async onMessage(e){if(!s.iframe)throw new Error('The "ArtplayerToolIframe.onMessage" method can only be used in iframe');const{type:t,data:o,id:i}=e.data;if("commit"===t)try{if(o.match(/\bresolve\((.*?)\)/)){const e=`return new Promise(function(resolve){\n${o}\n})`,t=await new Function(e)();s.postMessage({type:"response",data:t,id:i})}else{const e=new Function(o)();s.postMessage({type:"response",data:e,id:i})}}catch(r){throw s.postMessage({type:"error",data:r.message,id:i}),r}}static inject(){if(!s.iframe)throw new Error('The "ArtplayerToolIframe.inject" method can only be used in iframe');s.postMessage({type:"inject"}),window.addEventListener("message",s.onMessage)}constructor({iframe:e,url:t}){if(e instanceof HTMLIFrameElement===!1)throw new TypeError('"option.iframe" needs to be a HTMLIFrameElement');if("string"!==typeof t)throw new TypeError('"option.url" needs to be a string');this.url=t,this.$iframe=e,this.promises={},this.injected=!1,this.destroyed=!1,this.messageCallback=()=>null,this.onMessage=this.onMessage.bind(this),window.addEventListener("message",this.onMessage),this.$iframe.src=this.url}onMessage(e){if(this.destroyed)return;const{type:t,data:s,id:o}=e.data;if("inject"===t)this.injected=!0;void 0!==o&&Object.prototype.hasOwnProperty.call(this.promises,o)&&this.promises[o]&&("error"===t?this.promises[o].reject(new Error(s)):this.promises[o].resove(s),delete this.promises[o]),this.messageCallback&&this.messageCallback({type:t,data:s})}postMessage(s){return function(s,{type:o,data:i}){return new Promise((r,n)=>{if(s.destroyed)return void n(new Error("The instance has been destroyed"));const a=e.get(s)||new Set;e.set(s,a);const d=t=>!!a.delete(t)&&(void 0!==t.timer&&clearTimeout(t.timer),void 0!==t.id&&delete s.promises[t.id],a.size||e.delete(s),!0),c={callbacks:{resove(e){d(c)&&r(e)},reject(e){d(c)&&n(e)}}};a.add(c);const l=()=>{if(c.timer=void 0,a.has(c))if(s.destroyed)c.callbacks.reject(new Error("The instance has been destroyed"));else try{if(s.injected){const e=Math.max(Date.now(),t+1);t=e,c.id=e,s.promises[e]=c.callbacks,s.$iframe.contentWindow.postMessage({type:o,data:i,id:e},"*")}else c.timer=setTimeout(l,200)}catch(e){c.callbacks.reject(e)}};l()})}(this,s)}commit(e){if("function"!==typeof e)throw new TypeError('"commit.callback" needs to be a function');const t=e.toString(),s=t.substring(t.indexOf("{")+1,t.lastIndexOf("}"));return this.postMessage({type:"commit",data:s})}message(e){if("function"!==typeof e)throw new TypeError('"message.callback" needs to be a function');this.messageCallback=e}destroy(){this.destroyed=!0,window.removeEventListener("message",this.onMessage),function(t){const s=e.get(t);if(s)for(const e of[...s])e.callbacks.reject(new Error("The instance has been destroyed"))}(this)}}return s});
+!function(e,t){"object"===typeof exports&&"undefined"!==typeof module?module.exports=t():"function"==typeof define&&define.amd?(e.ArtplayerToolIframe=t(),define(function(){return e.ArtplayerToolIframe})):(e="undefined"!==typeof globalThis?globalThis:e||self).ArtplayerToolIframe=t()}(this,function(){"use strict";const e=new WeakMap;let t=0;const s=new WeakMap;function o(t){const o=s.get(t);s.delete(t);try{o?.()}finally{!function(t){const s=e.get(t);if(s)for(const e of[...s])e.callbacks.reject(new Error("The instance has been destroyed"))}(t)}}function r(e,t){if(void 0!==e.source&&null!==e.source&&e.source!==t)return!1;const s=e.data;return"object"===typeof s&&null!==s&&"type"in s&&"string"===typeof s.type}class n{static get iframe(){return window.top!==window}static postMessage({type:e,data:t,id:s=0}){if(!n.iframe)throw new Error('The "ArtplayerToolIframe.postMessage" method can only be used in iframe');window.parent.postMessage({type:e,data:t,id:s},"*")}static async onMessage(e){if(!n.iframe)throw new Error('The "ArtplayerToolIframe.onMessage" method can only be used in iframe');if(!r(e,window.parent))return;const{type:t,data:s,id:o}=e.data;if("commit"===t)try{if(s.match(/\bresolve\((.*?)\)/)){const e=`return new Promise(function(resolve){\n${s}\n})`,t=await new Function(e)();n.postMessage({type:"response",data:t,id:o})}else{const e=new Function(s)();n.postMessage({type:"response",data:e,id:o})}}catch(i){throw n.postMessage({type:"error",data:i.message,id:o}),i}}static inject(){if(!n.iframe)throw new Error('The "ArtplayerToolIframe.inject" method can only be used in iframe');n.postMessage({type:"inject"}),window.addEventListener("message",n.onMessage)}constructor({iframe:e,url:t}){if(e instanceof HTMLIFrameElement===!1)throw new TypeError('"option.iframe" needs to be a HTMLIFrameElement');if("string"!==typeof t)throw new TypeError('"option.url" needs to be a string');this.url=t,this.$iframe=e,this.promises={},this.injected=!1,this.destroyed=!1,this.messageCallback=()=>null,this.onMessage=this.onMessage.bind(this);try{!function(e){const t=window,o=e.onMessage;s.set(e,()=>t.removeEventListener("message",o)),t.addEventListener("message",o),e.$iframe.src=e.url}(this)}catch(r){this.destroyed=!0;try{o(this)}catch{}throw r}}onMessage(e){if(this.destroyed||!r(e,this.$iframe.contentWindow))return;const{type:t,data:s,id:o}=e.data;if("inject"===t)this.injected=!0;void 0!==o&&Object.prototype.hasOwnProperty.call(this.promises,o)&&this.promises[o]&&("error"===t?this.promises[o].reject(new Error(s)):this.promises[o].resove(s),delete this.promises[o]),this.messageCallback&&this.messageCallback({type:t,data:s})}postMessage(s){return function(s,{type:o,data:r}){return new Promise((n,i)=>{if(s.destroyed)return void i(new Error("The instance has been destroyed"));const a=e.get(s)||new Set;e.set(s,a);const c=t=>!!a.delete(t)&&(void 0!==t.timer&&clearTimeout(t.timer),void 0!==t.id&&delete s.promises[t.id],a.size||e.delete(s),!0),d={callbacks:{resove(e){c(d)&&n(e)},reject(e){c(d)&&i(e)}}};a.add(d);const l=()=>{if(d.timer=void 0,a.has(d))if(s.destroyed)d.callbacks.reject(new Error("The instance has been destroyed"));else try{if(s.injected){const e=Math.max(Date.now(),t+1);t=e,d.id=e,s.promises[e]=d.callbacks,s.$iframe.contentWindow.postMessage({type:o,data:r,id:e},"*")}else d.timer=setTimeout(l,200)}catch(e){d.callbacks.reject(e)}};l()})}(this,s)}commit(e){if("function"!==typeof e)throw new TypeError('"commit.callback" needs to be a function');const t=e.toString(),s=t.substring(t.indexOf("{")+1,t.lastIndexOf("}"));return this.postMessage({type:"commit",data:s})}message(e){if("function"!==typeof e)throw new TypeError('"message.callback" needs to be a function');this.messageCallback=e}destroy(){this.destroyed=!0,o(this)}}return n});

packages/artplayer-tool-iframe/dist/artplayer-tool-iframe.legacy.js

@@ -4,4 +4,4 @@
  * (c) 2017-2026 Harvey Zhao
  * Released under the MIT License.
  */
-!function(e,t){"object"===typeof exports&&"undefined"!==typeof module?module.exports=t():"function"==typeof define&&define.amd?(e.ArtplayerToolIframe=t(),define(function(){return e.ArtplayerToolIframe})):(e="undefined"!==typeof globalThis?globalThis:e||self).ArtplayerToolIframe=t()}(this,function(){"use strict";const e=new WeakMap;let t=0;class s{static get iframe(){return window.top!==window}static postMessage({type:e,data:t,id:o=0}){if(!s.iframe)throw new Error('The "ArtplayerToolIframe.postMessage" method can only be used in iframe');window.parent.postMessage({type:e,data:t,id:o},"*")}static onMessage(e){return t=this,o=null,r=function*(){if(!s.iframe)throw new Error('The "ArtplayerToolIframe.onMessage" method can only be used in iframe');const{type:t,data:o,id:r}=e.data;if("commit"===t)try{if(o.match(/\bresolve\((.*?)\)/)){const e=`return new Promise(function(resolve){\n${o}\n})`,t=yield new Function(e)();s.postMessage({type:"response",data:t,id:r})}else{const e=new Function(o)();s.postMessage({type:"response",data:e,id:r})}}catch(i){throw s.postMessage({type:"error",data:i.message,id:r}),i}},new Promise((e,s)=>{var i=e=>{try{a(r.next(e))}catch(t){s(t)}},n=e=>{try{a(r.throw(e))}catch(t){s(t)}},a=t=>t.done?e(t.value):Promise.resolve(t.value).then(i,n);a((r=r.apply(t,o)).next())});var t,o,r}static inject(){if(!s.iframe)throw new Error('The "ArtplayerToolIframe.inject" method can only be used in iframe');s.postMessage({type:"inject"}),window.addEventListener("message",s.onMessage)}constructor({iframe:e,url:t}){if(e instanceof HTMLIFrameElement===!1)throw new TypeError('"option.iframe" needs to be a HTMLIFrameElement');if("string"!==typeof t)throw new TypeError('"option.url" needs to be a string');this.url=t,this.$iframe=e,this.promises={},this.injected=!1,this.destroyed=!1,this.messageCallback=()=>null,this.onMessage=this.onMessage.bind(this),window.addEventListener("message",this.onMessage),this.$iframe.src=this.url}onMessage(e){if(this.destroyed)return;const{type:t,data:s,id:o}=e.data;if("inject"===t)this.injected=!0;void 0!==o&&Object.prototype.hasOwnProperty.call(this.promises,o)&&this.promises[o]&&("error"===t?this.promises[o].reject(new Error(s)):this.promises[o].resove(s),delete this.promises[o]),this.messageCallback&&this.messageCallback({type:t,data:s})}postMessage(s){return function(s,{type:o,data:r}){return new Promise((i,n)=>{if(s.destroyed)return void n(new Error("The instance has been destroyed"));const a=e.get(s)||new Set;e.set(s,a);const d=t=>!!a.delete(t)&&(void 0!==t.timer&&clearTimeout(t.timer),void 0!==t.id&&delete s.promises[t.id],a.size||e.delete(s),!0),c={callbacks:{resove(e){d(c)&&i(e)},reject(e){d(c)&&n(e)}}};a.add(c);const l=()=>{if(c.timer=void 0,a.has(c))if(s.destroyed)c.callbacks.reject(new Error("The instance has been destroyed"));else try{if(s.injected){const e=Math.max(Date.now(),t+1);t=e,c.id=e,s.promises[e]=c.callbacks,s.$iframe.contentWindow.postMessage({type:o,data:r,id:e},"*")}else c.timer=setTimeout(l,200)}catch(e){c.callbacks.reject(e)}};l()})}(this,s)}commit(e){if("function"!==typeof e)throw new TypeError('"commit.callback" needs to be a function');const t=e.toString(),s=t.substring(t.indexOf("{")+1,t.lastIndexOf("}"));return this.postMessage({type:"commit",data:s})}message(e){if("function"!==typeof e)throw new TypeError('"message.callback" needs to be a function');this.messageCallback=e}destroy(){this.destroyed=!0,window.removeEventListener("message",this.onMessage),function(t){const s=e.get(t);if(s)for(const e of[...s])e.callbacks.reject(new Error("The instance has been destroyed"))}(this)}}return s});
+!function(e,t){"object"===typeof exports&&"undefined"!==typeof module?module.exports=t():"function"==typeof define&&define.amd?(e.ArtplayerToolIframe=t(),define(function(){return e.ArtplayerToolIframe})):(e="undefined"!==typeof globalThis?globalThis:e||self).ArtplayerToolIframe=t()}(this,function(){"use strict";const e=new WeakMap;let t=0;const s=new WeakMap;function o(t){const o=s.get(t);s.delete(t);try{null==o||o()}finally{!function(t){const s=e.get(t);if(s)for(const e of[...s])e.callbacks.reject(new Error("The instance has been destroyed"))}(t)}}function r(e,t){if(void 0!==e.source&&null!==e.source&&e.source!==t)return!1;const s=e.data;return"object"===typeof s&&null!==s&&"type"in s&&"string"===typeof s.type}class n{static get iframe(){return window.top!==window}static postMessage({type:e,data:t,id:s=0}){if(!n.iframe)throw new Error('The "ArtplayerToolIframe.postMessage" method can only be used in iframe');window.parent.postMessage({type:e,data:t,id:s},"*")}static onMessage(e){return t=this,s=null,o=function*(){if(!n.iframe)throw new Error('The "ArtplayerToolIframe.onMessage" method can only be used in iframe');if(!r(e,window.parent))return;const{type:t,data:s,id:o}=e.data;if("commit"===t)try{if(s.match(/\bresolve\((.*?)\)/)){const e=`return new Promise(function(resolve){\n${s}\n})`,t=yield new Function(e)();n.postMessage({type:"response",data:t,id:o})}else{const e=new Function(s)();n.postMessage({type:"response",data:e,id:o})}}catch(i){throw n.postMessage({type:"error",data:i.message,id:o}),i}},new Promise((e,r)=>{var n=e=>{try{a(o.next(e))}catch(t){r(t)}},i=e=>{try{a(o.throw(e))}catch(t){r(t)}},a=t=>t.done?e(t.value):Promise.resolve(t.value).then(n,i);a((o=o.apply(t,s)).next())});var t,s,o}static inject(){if(!n.iframe)throw new Error('The "ArtplayerToolIframe.inject" method can only be used in iframe');n.postMessage({type:"inject"}),window.addEventListener("message",n.onMessage)}constructor({iframe:e,url:t}){if(e instanceof HTMLIFrameElement===!1)throw new TypeError('"option.iframe" needs to be a HTMLIFrameElement');if("string"!==typeof t)throw new TypeError('"option.url" needs to be a string');this.url=t,this.$iframe=e,this.promises={},this.injected=!1,this.destroyed=!1,this.messageCallback=()=>null,this.onMessage=this.onMessage.bind(this);try{!function(e){const t=window,o=e.onMessage;s.set(e,()=>t.removeEventListener("message",o)),t.addEventListener("message",o),e.$iframe.src=e.url}(this)}catch(r){this.destroyed=!0;try{o(this)}catch(n){}throw r}}onMessage(e){if(this.destroyed||!r(e,this.$iframe.contentWindow))return;const{type:t,data:s,id:o}=e.data;if("inject"===t)this.injected=!0;void 0!==o&&Object.prototype.hasOwnProperty.call(this.promises,o)&&this.promises[o]&&("error"===t?this.promises[o].reject(new Error(s)):this.promises[o].resove(s),delete this.promises[o]),this.messageCallback&&this.messageCallback({type:t,data:s})}postMessage(s){return function(s,{type:o,data:r}){return new Promise((n,i)=>{if(s.destroyed)return void i(new Error("The instance has been destroyed"));const a=e.get(s)||new Set;e.set(s,a);const c=t=>!!a.delete(t)&&(void 0!==t.timer&&clearTimeout(t.timer),void 0!==t.id&&delete s.promises[t.id],a.size||e.delete(s),!0),d={callbacks:{resove(e){c(d)&&n(e)},reject(e){c(d)&&i(e)}}};a.add(d);const l=()=>{if(d.timer=void 0,a.has(d))if(s.destroyed)d.callbacks.reject(new Error("The instance has been destroyed"));else try{if(s.injected){const e=Math.max(Date.now(),t+1);t=e,d.id=e,s.promises[e]=d.callbacks,s.$iframe.contentWindow.postMessage({type:o,data:r,id:e},"*")}else d.timer=setTimeout(l,200)}catch(e){d.callbacks.reject(e)}};l()})}(this,s)}commit(e){if("function"!==typeof e)throw new TypeError('"commit.callback" needs to be a function');const t=e.toString(),s=t.substring(t.indexOf("{")+1,t.lastIndexOf("}"));return this.postMessage({type:"commit",data:s})}message(e){if("function"!==typeof e)throw new TypeError('"message.callback" needs to be a function');this.messageCallback=e}destroy(){this.destroyed=!0,o(this)}}return n});

packages/artplayer-tool-iframe/dist/artplayer-tool-iframe.mjs

@@ -70,6 +70,29 @@ function cancelRequests(host) {
   for (const request of [...pending])
     request.callbacks.reject(new Error("The instance has been destroyed"));
 }
+const connections = /* @__PURE__ */ new WeakMap();
+function connect(host) {
+  const owner = window;
+  const receiver = host.onMessage;
+  connections.set(host, () => owner.removeEventListener("message", receiver));
+  owner.addEventListener("message", receiver);
+  host.$iframe.src = host.url;
+}
+function releaseConnection(host) {
+  const disconnect = connections.get(host);
+  connections.delete(host);
+  try {
+    disconnect?.();
+  } finally {
+    cancelRequests(host);
+  }
+}
+function acceptsMessage(event, peer) {
+  if (event.source !== void 0 && event.source !== null && event.source !== peer)
+    return false;
+  const data = event.data;
+  return typeof data === "object" && data !== null && "type" in data && typeof data.type === "string";
+}
 class ArtplayerToolIframe {
   static get iframe() {
     return window.top !== window;
@@ -91,6 +114,8 @@ class ArtplayerToolIframe {
     if (!ArtplayerToolIframe.iframe) {
       throw new Error('The "ArtplayerToolIframe.onMessage" method can only be used in iframe');
     }
+    if (!acceptsMessage(event, window.parent))
+      return;
     const { type, data, id } = event.data;
     switch (type) {
       case "commit":
@@ -133,11 +158,19 @@ ${data}
     this.destroyed = false;
     this.messageCallback = () => null;
     this.onMessage = this.onMessage.bind(this);
-    window.addEventListener("message", this.onMessage);
-    this.$iframe.src = this.url;
+    try {
+      connect(this);
+    } catch (error) {
+      this.destroyed = true;
+      try {
+        releaseConnection(this);
+      } catch {
+      }
+      throw error;
+    }
   }
   onMessage(event) {
-    if (this.destroyed)
+    if (this.destroyed || !acceptsMessage(event, this.$iframe.contentWindow))
       return;
     const { type, data, id } = event.data;
     switch (type) {
@@ -176,8 +209,7 @@ ${data}
   }
   destroy() {
     this.destroyed = true;
-    window.removeEventListener("message", this.onMessage);
-    cancelRequests(this);
+    releaseConnection(this);
   }
 }
 export {

packages/artplayer-tool-iframe/src/connection.ts

@@ -0,0 +1,28 @@
+import type { Packet, RequestHost } from './requests'
+import { cancelRequests } from './requests'
+
+interface ConnectionHost extends RequestHost {
+  url: string
+  onMessage: (event: MessageEvent<Packet>) => void
+}
+
+const connections = new WeakMap<ConnectionHost, () => void>()
+
+export function connect(host: ConnectionHost): void {
+  const owner = window
+  const receiver = host.onMessage
+  connections.set(host, () => owner.removeEventListener('message', receiver))
+  owner.addEventListener('message', receiver)
+  host.$iframe.src = host.url
+}
+
+export function releaseConnection(host: ConnectionHost): void {
+  const disconnect = connections.get(host)
+  connections.delete(host)
+  try {
+    disconnect?.()
+  }
+  finally {
+    cancelRequests(host)
+  }
+}

packages/artplayer-tool-iframe/src/index.ts

@@ -1,5 +1,7 @@
 import type { Callbacks, Packet } from './requests'
-import { cancelRequests, postRequest } from './requests'
+import { connect, releaseConnection } from './connection'
+import { acceptsMessage } from './protocol'
+import { postRequest } from './requests'
 
 export default class ArtplayerToolIframe {
   declare url: string
@@ -33,6 +35,9 @@ export default class ArtplayerToolIframe {
       throw new Error('The "ArtplayerToolIframe.onMessage" method can only be used in iframe')
     }
 
+    if (!acceptsMessage(event, window.parent))
+      return
+
     const { type, data, id } = event.data
     switch (type) {
       case 'commit':
@@ -84,12 +89,23 @@ export default class ArtplayerToolIframe {
     this.destroyed = false
     this.messageCallback = () => null
     this.onMessage = this.onMessage.bind(this)
-    window.addEventListener('message', this.onMessage)
-    this.$iframe.src = this.url
+    try {
+      connect(this)
+    }
+    catch (error) {
+      this.destroyed = true
+      try {
+        releaseConnection(this)
+      }
+      catch {
+        // Preserve the original setup failure if cleanup also fails.
+      }
+      throw error
+    }
   }
 
   onMessage(event: MessageEvent<Packet>) {
-    if (this.destroyed)
+    if (this.destroyed || !acceptsMessage(event, this.$iframe.contentWindow))
       return
 
     const { type, data, id } = event.data
@@ -139,7 +155,6 @@ export default class ArtplayerToolIframe {
 
   destroy() {
     this.destroyed = true
-    window.removeEventListener('message', this.onMessage)
-    cancelRequests(this)
+    releaseConnection(this)
   }
 }

packages/artplayer-tool-iframe/src/protocol.ts

@@ -0,0 +1,8 @@
+import type { Packet } from './requests'
+
+export function acceptsMessage(event: MessageEvent<unknown>, peer: Window | null): event is MessageEvent<Packet> {
+  if (event.source !== undefined && event.source !== null && event.source !== peer)
+    return false
+  const data = event.data
+  return typeof data === 'object' && data !== null && 'type' in data && typeof data.type === 'string'
+}