@smallstack/web-component-bridge-protocol

The typed postMessage protocol between the smallstack Business Platform host page and a sandboxed third-party web component. This is the single source of truth for the bridge envelope, constants, payload types, and the createBridgeMessage / parseBridgeMessage codec — a tiny, zero-dependency module both sides depend on:

• Platform — @smallstack/shared (in smallstack/business-platform) will re-export this module once it adopts the package (a follow-up to the initial publish); the host page and host-side bridge use it. Until then the platform keeps its own copy.
• SDK — @smallstack/web-component-sdk depends on it; the component-side client and mock host use it.

Release rule (protocol version ⇄ semver major)

The package's semver major equals WEB_COMPONENT_BRIDGE_PROTOCOL_VERSION.

Any breaking change to the wire envelope (message types, payload shapes, validation) is a major bump here, which forces a major bump of every consumer:

1. Bump WEB_COMPONENT_BRIDGE_PROTOCOL_VERSION and this package's major.
2. Publish the new major.
3. Bump @smallstack/web-component-sdk's major to match (SDK 1.x ⇄ protocol 1) and update its dependency range.
4. Bump the dependency range in @smallstack/shared (smallstack/business-platform).

Because a stale bundle carries the old version, parseBridgeMessage rejects it — a protocol mismatch fails loudly at the boundary instead of subtly.

Usage

import {
	createBridgeMessage,
	parseBridgeMessage,
	WEB_COMPONENT_BRIDGE_PROTOCOL_VERSION
} from "@smallstack/web-component-bridge-protocol";

const message = createBridgeMessage(nonce, "resize", { height: 120 });
const parsed = parseBridgeMessage(event.data, { nonce }); // null if invalid