Widget events

The iframe reports what happens inside it to the parent page with window.postMessage. Use it to resize the frame, refresh your own views, or show a toast, without waiting for a webhook.

Message shape

{ "source": "missless-social", "event": "post.created", "data": {} }

Every message has source: "missless-social". Check it, and check event.origin, before you read anything else.

Events

Event	When	data
ready	The surface has loaded and authenticated	{ surface, workspace }
resize	The content height changed	{ height } in CSS pixels
post.created	A post was created in the composer, whether published now, scheduled or saved as draft	the post
post.updated	A post was edited, rescheduled or retried from the calendar	the post
post.deleted	A post was cancelled or deleted from the calendar	{ id }
account.connected	The user came back from the connect flow with a new account	the account
conversation.replied	A reply was sent from the inbox surface	{ conversation, message }

The post, account, conversation and message objects are the same shapes as on the API.

ready is also the moment to stop showing your own placeholder. If it never arrives, the session is probably expired or minted for another surface.

Listener

window.addEventListener('message', (e) => {
  if (e.origin !== 'https://social.missless.tel') return;
  const msg = e.data;
  if (!msg || msg.source !== 'missless-social') return;

  switch (msg.event) {
    case 'ready':
      hidePlaceholder();
      break;
    case 'resize':
      frame.style.height = msg.data.height + 'px';
      break;
    case 'post.created':
    case 'post.updated':
    case 'post.deleted':
      refreshCalendar();
      break;
    case 'account.connected':
      toast(`Connected ${msg.data.network}: ${msg.data.username}`);
      break;
    case 'conversation.replied':
      markThreadAnswered(msg.data.conversation.id);
      break;
  }
});

What the messages are not

They are a UI convenience, sent from the user’s browser. Do not treat them as the source of truth for your data: a user could post a fake message to your page. Update your own records from webhooks or from the API, and use the widget messages to decide when to refetch.

The parent page cannot send messages into the iframe. There is no command channel; everything the widget does is driven by the user inside it, or by the session you minted.