The host page embeds a guest and drives it over
postMessage. The guest runs @bfm/event-bus
(EventBus + HostBridge) to validate, route, and reply.
Send custom messages, run the handshake, and trip the security limits — the
guest panel shows the library's introspection live.
The guest must run HostBridge to respond. Default is the bundled
guest on a cross-origin domain. The host passes its origin via
?host= so the guest allowlists it.
Quick presets:
Watch the guest panel — its onSecurityEvent fires and the
rejection counters tick up.