fix(embed): use document.referrer origin for host_application

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Embed: derive `host_application` metadata from `document.referrer` so the parent page's origin is reported instead of the iframe host (`cdn.smileidentity.com`)
+
 ## [11.4.4] - 2026-05-27
 
 ### Changed

packages/embed/src/js/metadata/index.js

@@ -207,10 +207,24 @@ const getArchitectureFromWebGPU = async () => {
   }
 };
 
+const getHostApplication = () => {
+  // Reason: embed runs inside an iframe on cdn.smileidentity.com, so
+  // window.location is always our own origin. document.referrer is the
+  // parent page set by the browser (origin-only under default
+  // strict-origin-when-cross-origin policy), which is what we want.
+  if (document.referrer) {
+    try {
+      return new URL(document.referrer).origin;
+    } catch {
+      // fall through to self-origin fallback
+    }
+  }
+  return `${window.location.protocol}//${window.location.hostname}`;
+};
+
 export const initializeMetadata = async () => {
   metadata = [];
-  const hostApplication = `${window.location.protocol}//${window.location.hostname}`;
-  addMetadataEntry('host_application', hostApplication);
+  addMetadataEntry('host_application', getHostApplication());
 
   if (
     'ondeviceproximity' in window ||