THREE.JS / FOUNDATIONS 320
A graph editor is a protocol boundary.
The official TSL editor is an iframe peer. Exercise the host handshake, exact source/origin checks, request IDs, response timeouts, graph events, and teardown without executing remote editor code.
A served same-origin support iframe will act as a deterministic editor peer; no remote URL or imported code is executed.
- peer
- —
- origin
- —
- handshake
- —
- pending
- —
- responses
- —
- events
- —
- rejected
- —
- timeouts
- —
- backend
- —
- timing
- NOT RUN
The peer returns inert fixture payloads; the host never evaluates code from the bridge.
Accept only the expected source window, exact origin, protocol, and session nonce.
Every command has a request ID, one response, and a bounded timeout.
Release clears timers, removes the listener, removes the support iframe, and disposes the renderer.
No protocol events yet.
The hidden peer is a same-origin local support iframe so the browser still performs real window.postMessage routing. The remote TSL Graph editor remains an intentionally untrusted integration boundary, not a dependency of this lab.
Sources: official TSL editor example · WebGPURenderer docs · postMessage security guidance
LAB 320 / TSL GRAPH EDITOR BRIDGE