diff --git a/auth/index.html b/auth/index.html
index 2682dad..e490e49 100644
--- a/auth/index.html
+++ b/auth/index.html
@@ -158,26 +158,186 @@ <h2>Message log</h2>
       window.isInitEmbeddedKeyRunByDomContentLoaded = false;
       window.TKHQ = (function () {
         /** constant for LocalStorage */
-        var TURNKEY_EMBEDDED_KEY = "TURNKEY_EMBEDDED_KEY";
+        // Legacy fixed key name — never migrated; purged on first init.
+        var LEGACY_EMBEDDED_KEY = "TURNKEY_EMBEDDED_KEY";
+        // V2 origin-scoped key prefix.
+        var ORIGIN_SCOPED_EMBEDDED_KEY_PREFIX = "TURNKEY_EMBEDDED_KEY_V2";
         var TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS = 1000 * 60 * 60 * 48; // 48 hours in milliseconds
 
         var parentFrameMessageChannelPort = null;
 
+        // Target origin for window.parent.postMessage in legacy mode.
+        // Starts as "*" (only for PUBLIC_KEY_READY before any origin is known).
+        // Set to the bound parent origin on the first valid legacy message so
+        // subsequent outbound responses are delivered only to that origin.
+        var parentFrameTargetOrigin = "*";
+
         /**
-         * Creates a new public/private key pair and persists it in localStorage
-         * @return boolean indicating whether an embedded key has been set
+         * Embedded-key state for this document.
+         * Two modes:
+         *   { mode: "persistent", storageKey } -- key lives in localStorage scoped to the
+         *     browser-authenticated parent origin (or this document's own origin in standalone).
+         *   { mode: "ephemeral", key } -- key lives in memory only. Used for legacy
+         *     (@turnkey/iframe-stamper < 2.1.0) parents so a malicious embedder can never
+         *     obtain a key that decrypts another application's bundles (INT-697).
+         */
+        var embeddedKeyState = null;
+
+        /**
+         * Validates that a parent origin string is non-empty, non-opaque, and
+         * a valid serialized origin (scheme + host + optional port only).
+         * @param {string} parentOrigin
+         * @returns {string} the validated origin
+         */
+        var validateParentOrigin = function (parentOrigin) {
+          if (
+            typeof parentOrigin !== "string" ||
+            parentOrigin.length === 0 ||
+            parentOrigin === "null"
+          ) {
+            throw new Error("a non-opaque parent origin is required");
+          }
+          var parsedOrigin = new URL(parentOrigin).origin;
+          if (parsedOrigin !== parentOrigin) {
+            throw new Error("invalid parent origin: " + parentOrigin);
+          }
+          return parsedOrigin;
+        };
+
+        /**
+         * Purge the legacy global key so old bundles encrypted to it can no longer be
+         * replayed. Never migrate it: migration would preserve the cross-origin replay
+         * vulnerability for bundles encrypted before this change.
+         */
+        var purgeLegacyEmbeddedKey = function () {
+          window.localStorage.removeItem(LEGACY_EMBEDDED_KEY);
+        };
+
+        /**
+         * Creates (if needed) the persistent embedded key scoped to the given parent
+         * origin and persists it in localStorage. Must be called with a valid,
+         * non-opaque origin string (e.g. "https://app.example.com").
+         * A document can bind to exactly one parent origin; an ephemeral key, if any,
+         * is superseded.
+         * @param {string} parentOrigin
+         * @param {number} [ttl] expiry in milliseconds; defaults to TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS (48 h)
+         * @return boolean indicating whether a new key was generated
          */
         var initEmbeddedKey = async function (
+          parentOrigin,
           ttl = TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
         ) {
-          var retrievedKey = await getEmbeddedKey();
-          if (retrievedKey === null) {
-            var targetKey = await generateTargetKey();
-            setEmbeddedKey(targetKey, ttl);
-            return true;
-          } else {
-            return false;
-            // Nothing to do, key is correctly initialized!
+          var validatedOrigin = validateParentOrigin(parentOrigin);
+
+          // If already bound to a persistent key for a DIFFERENT origin, refuse.
+          if (
+            embeddedKeyState !== null &&
+            embeddedKeyState.mode === "persistent" &&
+            embeddedKeyState.origin !== validatedOrigin
+          ) {
+            throw new Error(
+              "parent origin is already bound to " +
+                embeddedKeyState.origin +
+                "; refusing " +
+                validatedOrigin
+            );
+          }
+
+          // If already initializing or initialized for the same origin, await
+          // the existing ready promise so concurrent callers serialise on it.
+          if (
+            embeddedKeyState !== null &&
+            embeddedKeyState.mode === "persistent" &&
+            embeddedKeyState.origin === validatedOrigin
+          ) {
+            return await embeddedKeyState.ready;
+          }
+
+          purgeLegacyEmbeddedKey();
+
+          var storageKey =
+            ORIGIN_SCOPED_EMBEDDED_KEY_PREFIX +
+            ":" +
+            encodeURIComponent(validatedOrigin);
+
+          // Retain the previous state so we can roll back on storage failure.
+          var previousState = embeddedKeyState;
+
+          var state = {
+            mode: "persistent",
+            origin: validatedOrigin,
+            storageKey: storageKey,
+          };
+
+          // Activate the new state synchronously so concurrent ephemeral inits
+          // cannot clobber it. `ready` resolves once the key is persisted;
+          // concurrent readers must await it before calling getEmbeddedKey.
+          // On rejection, roll back to previousState so a retry is possible.
+          state.ready = (async function () {
+            var retrievedKey = getItemWithExpiry(storageKey);
+            if (retrievedKey === null) {
+              var targetKey = await generateTargetKey();
+              setItemWithExpiry(storageKey, JSON.stringify(targetKey), ttl);
+            }
+          })().catch(function (error) {
+            if (embeddedKeyState === state) {
+              embeddedKeyState = previousState;
+            }
+            throw error;
+          });
+
+          embeddedKeyState = state;
+          return await state.ready;
+        };
+
+        /**
+         * Creates (if needed) an in-memory embedded key unique to this document, for
+         * legacy (@turnkey/iframe-stamper < 2.1.0) parents. No-ops if a persistent
+         * origin-scoped key is already active (i.e. the MessageChannel handshake
+         * completed first). If a persistent key is in-flight (state.ready not yet
+         * resolved), awaits it so callers can read the key once persisted; if the
+         * persistent init fails and rolls itself back, the ephemeral key takes over.
+         */
+        var initEphemeralEmbeddedKey = async function () {
+          // If a persistent state is already active (including in-flight), wait
+          // for the ready promise so callers can read the key once persisted.
+          if (
+            embeddedKeyState !== null &&
+            embeddedKeyState.mode === "persistent"
+          ) {
+            try {
+              return await embeddedKeyState.ready;
+            } catch (_e) {
+              // Persistent init failed and rolled back; fall through to ephemeral.
+            }
+          }
+          // No-op if we already have an ephemeral key.
+          if (
+            embeddedKeyState !== null &&
+            embeddedKeyState.mode === "ephemeral" &&
+            embeddedKeyState.key !== null
+          ) {
+            return;
+          }
+          purgeLegacyEmbeddedKey();
+          var generatedKey = await generateTargetKey();
+          // Re-check: a concurrent MessageChannel handshake may have activated a
+          // persistent state while generation was in flight; it must not be
+          // clobbered. Wait for it so callers can read the key; if it fails and
+          // rolls itself back, the ephemeral key takes over below.
+          var latestState = embeddedKeyState;
+          if (latestState !== null && latestState.mode === "persistent") {
+            try {
+              return await latestState.ready;
+            } catch (_e) {
+              // fall through to the ephemeral key
+            }
+          }
+          if (
+            embeddedKeyState === null ||
+            embeddedKeyState.mode !== "persistent"
+          ) {
+            embeddedKeyState = { mode: "ephemeral", key: generatedKey };
           }
         };
 
@@ -185,6 +345,34 @@ <h2>Message log</h2>
           parentFrameMessageChannelPort = port;
         };
 
+        /**
+         * Restricts outbound window.parent.postMessage calls to the given origin.
+         * Called once the first valid legacy message binds the parent origin so that
+         * subsequent responses cannot be intercepted by a replacement page.
+         * @param {string} origin
+         */
+        var setParentFrameOrigin = function (origin) {
+          if (typeof origin !== "string" || origin.length === 0) {
+            throw new Error(
+              "a canonical, non-opaque parent frame origin is required"
+            );
+          }
+          var parsedOrigin;
+          try {
+            parsedOrigin = new URL(origin).origin;
+          } catch (_e) {
+            throw new Error(
+              "a canonical, non-opaque parent frame origin is required"
+            );
+          }
+          if (parsedOrigin === "null" || parsedOrigin !== origin) {
+            throw new Error(
+              "a canonical, non-opaque parent frame origin is required"
+            );
+          }
+          parentFrameTargetOrigin = parsedOrigin;
+        };
+
         /*
          * Generate a key to encrypt to and export it as a JSON Web Key.
          */
@@ -203,10 +391,18 @@ <h2>Message log</h2>
 
         /**
          * Gets the current embedded private key JWK.
+         * Reads from ephemeral memory or origin-scoped localStorage depending on state.
          * @return `null` if not found.
          */
         var getEmbeddedKey = function () {
-          var jwtKey = getItemWithExpiry(TURNKEY_EMBEDDED_KEY);
+          if (embeddedKeyState === null) {
+            return null;
+          }
+          if (embeddedKeyState.mode === "ephemeral") {
+            return embeddedKeyState.key || null;
+          }
+          // persistent mode
+          var jwtKey = getItemWithExpiry(embeddedKeyState.storageKey);
           if (!jwtKey) {
             return null;
           } else {
@@ -215,7 +411,8 @@ <h2>Message log</h2>
         };
 
         /**
-         * Sets the current embedded private key JWK in local storage.
+         * Sets the current embedded private key JWK.
+         * Writes to ephemeral memory or origin-scoped localStorage depending on state.
          * @param {string} targetKey the private key JWK
          * @param {number} ttl (optional) if unset, default to TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
          */
@@ -223,18 +420,34 @@ <h2>Message log</h2>
           targetKey,
           ttl = TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
         ) {
+          if (embeddedKeyState === null) {
+            throw new Error("embedded key has not been initialized");
+          }
+          if (embeddedKeyState.mode === "ephemeral") {
+            embeddedKeyState.key = targetKey;
+            return;
+          }
+          // persistent mode
           return setItemWithExpiry(
-            TURNKEY_EMBEDDED_KEY,
+            embeddedKeyState.storageKey,
             JSON.stringify(targetKey),
             ttl
           );
         };
 
         /**
-         * Removes the embedded key from local storage.
+         * Removes the embedded key from its current storage location.
          */
         var resetEmbeddedKey = function () {
-          window.localStorage.removeItem(TURNKEY_EMBEDDED_KEY);
+          if (embeddedKeyState === null) {
+            return;
+          }
+          if (embeddedKeyState.mode === "ephemeral") {
+            embeddedKeyState.key = null;
+            return;
+          }
+          // persistent mode
+          window.localStorage.removeItem(embeddedKeyState.storageKey);
         };
 
         /**
@@ -555,13 +768,7 @@ <h2>Message log</h2>
           if (parentFrameMessageChannelPort) {
             parentFrameMessageChannelPort.postMessage(message);
           } else if (window.parent !== window) {
-            window.parent.postMessage(
-              {
-                type: type,
-                value: value,
-              },
-              "*"
-            );
+            window.parent.postMessage(message, parentFrameTargetOrigin);
           }
           logMessage(`⬆️ Sent message ${type}: ${value}`);
         };
@@ -1018,8 +1225,25 @@ <h2>Message log</h2>
          * End of private crypto implementation for P256 public key derivation from a private key.
          *********************************************************************************************/
 
+        /**
+         * Returns the origin to which this document's embedded key is currently bound,
+         * or null if the key is ephemeral or not yet initialized.
+         * @return {string|null}
+         */
+        var getBoundOrigin = function () {
+          if (
+            embeddedKeyState !== null &&
+            embeddedKeyState.mode === "persistent"
+          ) {
+            return embeddedKeyState.origin;
+          }
+          return null;
+        };
+
         return {
           initEmbeddedKey,
+          initEphemeralEmbeddedKey,
+          getBoundOrigin,
           getEmbeddedKey,
           generateTargetKey,
           setItemWithExpiry,
@@ -1034,6 +1258,7 @@ <h2>Message log</h2>
           convertEcdsaIeee1363ToDer,
           sendMessageUp,
           setParentFrameMessageChannelPort,
+          setParentFrameOrigin,
           logMessage,
           base64urlEncode,
           base64urlDecode,
@@ -1043,6 +1268,7 @@ <h2>Message log</h2>
           uint8arrayToHexString,
           uint8arrayFromHexString,
           additionalAssociatedData,
+          TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS,
         };
       })();
     </script>
@@ -1163,8 +1389,17 @@ <h2>Message log</h2>
       document.addEventListener(
         "DOMContentLoaded",
         async function () {
-          // Initialize embedded key. Currently don't need to use the return value.
-          await TKHQ.initEmbeddedKey();
+          if (window.parent === window) {
+            // Standalone mode: persist key scoped to this document's own origin.
+            await TKHQ.initEmbeddedKey(window.location.origin);
+          } else {
+            // Embedded mode: create an ephemeral document-scoped key for legacy
+            // (@turnkey/iframe-stamper < 2.1.0) clients, which passively wait for
+            // PUBLIC_KEY_READY. Modern clients supersede it during the MessageChannel
+            // handshake below with a persistent key scoped to their browser-authenticated
+            // origin (INT-697).
+            await TKHQ.initEphemeralEmbeddedKey();
+          }
           window.isInitEmbeddedKeyRunByDomContentLoaded = true;
 
           var embeddedKeyJwk = await TKHQ.getEmbeddedKey();
@@ -1172,18 +1407,73 @@ <h2>Message log</h2>
           var targetPubHex = TKHQ.uint8arrayToHexString(targetPubBuf);
           document.getElementById("embedded-key").value = targetPubHex;
 
-          window.addEventListener("message", messageEventListener, {
-            capture: false,
-            signal: messageListenerController.signal,
-          });
-
-          addDOMEventListeners();
-
-          TKHQ.sendMessageUp("PUBLIC_KEY_READY", targetPubHex);
+          if (window.parent === window) {
+            // Standalone mode: DOM forms drive the flow by posting messages to
+            // this same window. Add DOM form listeners and accept only self-posts.
+            addDOMEventListeners();
+            window.addEventListener(
+              "message",
+              async function (event) {
+                if (event.source !== window) {
+                  return;
+                }
+                await messageEventListener(event);
+              },
+              {
+                capture: false,
+                signal: messageListenerController.signal,
+              }
+            );
+          } else {
+            // Announce the ephemeral public key for legacy clients that don't use
+            // MessageChannel (they passively wait for this event).
+            TKHQ.sendMessageUp("PUBLIC_KEY_READY", targetPubHex);
+          }
         },
         false
       );
 
+      // Origin of a legacy (@turnkey/iframe-stamper < 2.1.0) parent, bound on its
+      // first valid message. A document belongs to exactly one embedder for its
+      // lifetime, so every subsequent message must come from the same origin.
+      let legacyParentOrigin = null;
+
+      // The legacy messageEventListener wrapper enforces source+origin checks.
+      // Only active in embedded mode (window.parent !== window).
+      if (window.parent !== window) {
+        window.addEventListener(
+          "message",
+          async function (event) {
+            if (!event.data || !event.data["type"]) {
+              return;
+            }
+            // Channel establishment is owned by the handshake listener below.
+            if (event.data["type"] === "TURNKEY_INIT_MESSAGE_CHANNEL") {
+              return;
+            }
+            // Only the direct parent, with a real (non-opaque) origin, may drive
+            // the legacy path.
+            if (event.source !== window.parent) {
+              return;
+            }
+            if (!event.origin || event.origin === "null") {
+              return;
+            }
+            if (legacyParentOrigin === null) {
+              legacyParentOrigin = event.origin;
+              // Restrict outbound responses to this origin so they cannot be
+              // intercepted by a replacement page navigated in while an async
+              // request is in flight (Comment 3 fix).
+              TKHQ.setParentFrameOrigin(event.origin);
+            } else if (event.origin !== legacyParentOrigin) {
+              return;
+            }
+            await messageEventListener(event);
+          },
+          { capture: false, signal: messageListenerController.signal }
+        );
+      }
+
       window.addEventListener(
         "message",
         async function (event) {
@@ -1192,12 +1482,26 @@ <h2>Message log</h2>
            * The parent frame sends a TURNKEY_INIT_MESSAGE_CHANNEL event with the MessagePort.
            * If we receive this event, we want to remove the message event listener that was added in the DOMContentLoaded event to avoid processing messages twice.
            * We persist the MessagePort so we can use it to communicate with the parent window in subsequent calls to TKHQ.sendMessageUp
+           *
+           * Vuln A fix: Validate event.source, event.origin, and ports.length.
            */
           if (
             event.data &&
             event.data["type"] == "TURNKEY_INIT_MESSAGE_CHANNEL" &&
-            event.ports?.[0]
+            event.source === window.parent &&
+            event.origin &&
+            event.origin !== "null" &&
+            event.ports?.length === 1
           ) {
+            // A legacy-bound document may upgrade to the MessageChannel protocol,
+            // but never on behalf of a different origin.
+            if (
+              legacyParentOrigin !== null &&
+              legacyParentOrigin !== event.origin
+            ) {
+              return;
+            }
+
             // Synchronously check-and-set the flag before any await. This prevents
             // a second concurrent invocation from racing through while the first is
             // suspended at an await, which would allow multiple origins to establish
@@ -1207,15 +1511,9 @@ <h2>Message log</h2>
             }
             channelEstablished = true;
 
-            // remove the message event listener that was added in the DOMContentLoaded event
-            messageListenerController.abort();
-
             iframeMessagePort = event.ports[0];
-            iframeMessagePort.onmessage = messageEventListener;
 
-            TKHQ.setParentFrameMessageChannelPort(iframeMessagePort);
-
-            let iframeKeyTtl = TKHQ.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS;
+            var iframeKeyTtl = TKHQ.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS;
             if (
               event.data.dangerouslyOverrideIframeKeyTtl &&
               typeof event.data.dangerouslyOverrideIframeKeyTtl === "number" &&
@@ -1224,25 +1522,38 @@ <h2>Message log</h2>
               iframeKeyTtl = event.data.dangerouslyOverrideIframeKeyTtl;
             }
 
-            var embeddedKeyJwk = await TKHQ.getEmbeddedKey();
-
-            // If the embedded key is not initialized or not available, reset it
-            if (
-              !(window.isInitEmbeddedKeyRunByDomContentLoaded && embeddedKeyJwk)
-            ) {
-              await TKHQ.resetEmbeddedKey();
-              document.getElementById("embedded-key").value = "";
-              await TKHQ.initEmbeddedKey(iframeKeyTtl);
+            var targetPubHex;
+            try {
+              // Vuln B fix: Supersede the ephemeral key (if any) with a persistent
+              // key scoped to the browser-authenticated parent origin (INT-697).
+              // Honour the caller's TTL override, if provided and valid.
+              await TKHQ.initEmbeddedKey(event.origin, iframeKeyTtl);
+              var embeddedKeyJwk = await TKHQ.getEmbeddedKey();
+              var targetPubBuf = await TKHQ.p256JWKPrivateToPublic(
+                embeddedKeyJwk
+              );
+              targetPubHex = TKHQ.uint8arrayToHexString(targetPubBuf);
+            } catch (e) {
+              // Key setup failed (e.g. blocked third-party storage). Roll back so
+              // the parent can retry the handshake, and keep the legacy/standalone
+              // listener alive so the frame stays functional in the meantime.
+              channelEstablished = false;
+              iframeMessagePort.postMessage({
+                type: "ERROR",
+                value: e.toString(),
+              });
+              return;
             }
 
-            // Re-fetch embedded key
-            embeddedKeyJwk = await TKHQ.getEmbeddedKey();
-            var targetPubBuf = await TKHQ.p256JWKPrivateToPublic(
-              embeddedKeyJwk
-            );
-            var targetPubHex = TKHQ.uint8arrayToHexString(targetPubBuf);
+            // Commit: the MessagePort carries all requests from here on; stop
+            // accepting legacy/standalone window messages.
+            messageListenerController.abort();
+
+            TKHQ.setParentFrameMessageChannelPort(iframeMessagePort);
             document.getElementById("embedded-key").value = targetPubHex;
 
+            iframeMessagePort.onmessage = messageEventListener;
+
             TKHQ.sendMessageUp("PUBLIC_KEY_READY", targetPubHex);
 
             // remove the listener for TURNKEY_INIT_MESSAGE_CHANNEL after it's been processed
@@ -1331,10 +1642,19 @@ <h2>Message log</h2>
 
       /**
        * Function triggered when INIT_EMBEDDED_KEY event is received.
+       * Re-initializes the embedded key using the current mode/origin binding.
        * @param {string} requestId: idempotency key
        */
       var onInitEmbeddedKey = async function (requestId) {
-        await TKHQ.initEmbeddedKey();
+        // Re-use the bound origin if we're in persistent mode, otherwise ephemeral.
+        var boundOrigin = TKHQ.getBoundOrigin();
+        if (boundOrigin !== null) {
+          await TKHQ.initEmbeddedKey(boundOrigin);
+        } else if (window.parent === window) {
+          await TKHQ.initEmbeddedKey(window.location.origin);
+        } else {
+          await TKHQ.initEphemeralEmbeddedKey();
+        }
         var embeddedKeyJwk = await TKHQ.getEmbeddedKey();
         var targetPubBuf = await TKHQ.p256JWKPrivateToPublic(embeddedKeyJwk);
         var targetPubHex = TKHQ.uint8arrayToHexString(targetPubBuf);
diff --git a/auth/index.test.js b/auth/index.test.js
index caa8141..2126844 100644
--- a/auth/index.test.js
+++ b/auth/index.test.js
@@ -6,6 +6,20 @@ import * as crypto from "crypto";
 
 const html = fs.readFileSync(path.resolve(__dirname, "./index.html"), "utf8");
 
+// Extract the body of the <script type="module"> block so we can evaluate it
+// directly in JSDOM window contexts (JSDOM does not handle ES module imports).
+// We strip the `import` statement and inject a stub for `hpke` instead.
+const MODULE_SCRIPT_BODY = (() => {
+  const match = html.match(
+    /<script type="module">([\s\S]*?)<\/script>\s*<\/body>/
+  );
+  if (!match) {
+    throw new Error("Could not extract module script from index.html");
+  }
+  // Remove the `import * as hpke from ...` line; we inject a stub below.
+  return match[1].replace(/^\s*import\s+\*\s+as\s+hpke.*?;\s*\n/m, "");
+})();
+
 let dom;
 let TKHQ;
 
@@ -51,25 +65,119 @@ describe("TKHQ", () => {
     expect(item).toBeNull();
   });
 
-  it("gets and sets embedded key in localStorage", async () => {
-    expect(TKHQ.getEmbeddedKey()).toBe(null);
+  it("gets and sets embedded key (after init)", async () => {
+    // Must init with an origin before set/get
+    await TKHQ.initEmbeddedKey("http://localhost");
+    expect(TKHQ.getEmbeddedKey()).not.toBeNull();
 
-    // Set a dummy "key"
+    // Override with a dummy key
     TKHQ.setEmbeddedKey({ foo: "bar" });
     expect(TKHQ.getEmbeddedKey()).toEqual({ foo: "bar" });
   });
 
+  it("returns null for getEmbeddedKey before init", async () => {
+    expect(TKHQ.getEmbeddedKey()).toBe(null);
+  });
+
   it("inits embedded key and is idempotent", async () => {
     expect(TKHQ.getEmbeddedKey()).toBe(null);
-    await TKHQ.initEmbeddedKey();
+    await TKHQ.initEmbeddedKey("http://localhost");
     var generatedKey = TKHQ.getEmbeddedKey();
     expect(generatedKey).not.toBeNull();
 
     // This should have no effect; generated key should stay the same
-    await TKHQ.initEmbeddedKey();
+    await TKHQ.initEmbeddedKey("http://localhost");
     expect(TKHQ.getEmbeddedKey()).toEqual(generatedKey);
   });
 
+  it("inits ephemeral key and stores in memory only", async () => {
+    expect(TKHQ.getEmbeddedKey()).toBe(null);
+    await TKHQ.initEphemeralEmbeddedKey();
+    var ephemeralKey = TKHQ.getEmbeddedKey();
+    expect(ephemeralKey).not.toBeNull();
+
+    // Should NOT be in localStorage
+    var lsKeys = Object.keys(dom.window.localStorage);
+    var hasPersistedKey = lsKeys.some((k) =>
+      k.startsWith("TURNKEY_EMBEDDED_KEY_V2")
+    );
+    expect(hasPersistedKey).toBe(false);
+  });
+
+  it("persistent key is stored in origin-scoped localStorage key", async () => {
+    await TKHQ.initEmbeddedKey("http://localhost");
+    // Key should be stored under a V2 scoped name, not the legacy name
+    expect(dom.window.localStorage.getItem("TURNKEY_EMBEDDED_KEY")).toBeNull();
+    var lsKeys = Object.keys(dom.window.localStorage);
+    var scopedKey = lsKeys.find((k) => k.startsWith("TURNKEY_EMBEDDED_KEY_V2"));
+    expect(scopedKey).toBeTruthy();
+    expect(scopedKey).toContain(encodeURIComponent("http://localhost"));
+  });
+
+  it("different parent origins produce different embedded keys", async () => {
+    // Origin A
+    await TKHQ.initEmbeddedKey("http://app-a.example.com");
+    var keyA = TKHQ.getEmbeddedKey();
+    expect(keyA).not.toBeNull();
+
+    // Simulate a second document (fresh JSDOM) for origin B
+    var dom2 = new JSDOM(html, {
+      runScripts: "dangerously",
+      url: "http://localhost",
+    });
+    Object.defineProperty(dom2.window, "crypto", {
+      value: crypto.webcrypto,
+    });
+    var TKHQ2 = dom2.window.TKHQ;
+
+    await TKHQ2.initEmbeddedKey("http://app-b.example.com");
+    var keyB = TKHQ2.getEmbeddedKey();
+    expect(keyB).not.toBeNull();
+
+    // The keys should be different (different origins => different localStorage slots)
+    expect(JSON.stringify(keyA)).not.toEqual(JSON.stringify(keyB));
+  });
+
+  it("refuses to bind to a second persistent origin", async () => {
+    await TKHQ.initEmbeddedKey("http://first.example.com");
+    await expect(
+      TKHQ.initEmbeddedKey("http://second.example.com")
+    ).rejects.toThrow("parent origin is already bound");
+  });
+
+  it("rejects invalid origin in initEmbeddedKey", async () => {
+    await expect(TKHQ.initEmbeddedKey("null")).rejects.toThrow(
+      "a non-opaque parent origin is required"
+    );
+    await expect(TKHQ.initEmbeddedKey("")).rejects.toThrow(
+      "a non-opaque parent origin is required"
+    );
+    await expect(TKHQ.initEmbeddedKey()).rejects.toThrow(
+      "a non-opaque parent origin is required"
+    );
+  });
+
+  it("purges legacy TURNKEY_EMBEDDED_KEY on init", async () => {
+    // Plant a legacy key
+    dom.window.localStorage.setItem(
+      "TURNKEY_EMBEDDED_KEY",
+      JSON.stringify({ value: "old", expiry: Date.now() + 9999999 })
+    );
+    await TKHQ.initEmbeddedKey("http://localhost");
+    expect(dom.window.localStorage.getItem("TURNKEY_EMBEDDED_KEY")).toBeNull();
+  });
+
+  it("getBoundOrigin returns null before init and origin after init", async () => {
+    expect(TKHQ.getBoundOrigin()).toBeNull();
+    await TKHQ.initEmbeddedKey("https://test.example.com");
+    expect(TKHQ.getBoundOrigin()).toBe("https://test.example.com");
+  });
+
+  it("getBoundOrigin returns null for ephemeral key", async () => {
+    await TKHQ.initEphemeralEmbeddedKey();
+    expect(TKHQ.getBoundOrigin()).toBeNull();
+  });
+
   it("generates P256 keys", async () => {
     let key = await TKHQ.generateTargetKey();
     expect(key.kty).toEqual("EC");
@@ -280,3 +388,553 @@ describe("TKHQ", () => {
     expect(true).toBe(true);
   });
 });
+
+// ─── Helpers shared by the integration describe blocks below ─────────────────
+
+/**
+ * Build a new JSDOM with a simulated parent window so that the frame runs in
+ * "embedded" mode (window.parent !== window).  The returned `teardown` must be
+ * called in afterEach to restore globals.
+ *
+ * The <script type="module"> body is evaluated synchronously (JSDOM does not
+ * handle ES-module imports) after injecting a stub for `hpke` so the listener
+ * setup code runs without a real HPKE implementation.
+ *
+ * Spies are installed on window.TKHQ BEFORE the module script eval so that
+ * any async callbacks that fire during or immediately after the eval (e.g. the
+ * DOMContentLoaded PUBLIC_KEY_READY broadcast) go through the mocks and are
+ * included in the assertion counts.  Callers can replace mock implementations
+ * per-test after receiving the dom.
+ */
+function buildEmbeddedDom() {
+  const d = new JSDOM(html, {
+    runScripts: "dangerously",
+    url: "http://localhost",
+  });
+
+  const parentWindow = { postMessage: jest.fn() };
+  Object.defineProperty(d.window, "parent", {
+    configurable: true,
+    value: parentWindow,
+  });
+  Object.defineProperty(d.window, "crypto", { value: crypto.webcrypto });
+
+  // Provide globals that the module script body references.
+  global.window = d.window;
+  global.document = d.window.document;
+  global.localStorage = d.window.localStorage;
+  global.crypto = crypto.webcrypto;
+  global.AbortController = d.window.AbortController;
+
+  // Install spies on TKHQ BEFORE eval so the DOMContentLoaded async callback
+  // (which calls initEphemeralEmbeddedKey then sendMessageUp) goes through the
+  // mocks.  This prevents spurious sendMessageUp counts in tests.
+  jest.spyOn(d.window.TKHQ, "initEmbeddedKey").mockResolvedValue(undefined);
+  jest
+    .spyOn(d.window.TKHQ, "initEphemeralEmbeddedKey")
+    .mockResolvedValue(undefined);
+  jest
+    .spyOn(d.window.TKHQ, "getEmbeddedKey")
+    .mockReturnValue({ kty: "EC", crv: "P-256" });
+  jest
+    .spyOn(d.window.TKHQ, "p256JWKPrivateToPublic")
+    .mockResolvedValue(new Uint8Array(65).fill(0x04));
+  jest
+    .spyOn(d.window.TKHQ, "uint8arrayToHexString")
+    .mockReturnValue("aabbccdd");
+  jest
+    .spyOn(d.window.TKHQ, "setParentFrameMessageChannelPort")
+    .mockImplementation(() => {});
+  jest.spyOn(d.window.TKHQ, "sendMessageUp").mockImplementation(() => {});
+
+  // Inject a minimal hpke stub so the module body can be eval'd without the
+  // real vendor bundle.
+  d.window.hpke = {
+    DhkemP256HkdfSha256: function () {
+      return { importKey: jest.fn() };
+    },
+    HkdfSha256: function () {},
+    Aes256Gcm: function () {},
+    CipherSuite: function () {
+      return { createRecipientContext: jest.fn() };
+    },
+  };
+
+  // Run the module script body in the JSDOM window context.
+  d.window.eval(MODULE_SCRIPT_BODY);
+
+  function teardown() {
+    delete global.window;
+    delete global.document;
+    delete global.localStorage;
+    delete global.crypto;
+    delete global.AbortController;
+  }
+
+  return { dom: d, parentWindow, teardown };
+}
+
+/** Flush the microtask / macrotask queue so async handlers complete. */
+const flush = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+// ─── Channel-gate integration tests (Comment 1) ──────────────────────────────
+//
+// These tests dispatch real MessageEvents at the production window listener
+// that the <script type="module"> registers, verifying that the gate
+// conditions (source, origin, ports.length) are actually enforced by the
+// running code — not just checked as predicates against synthetic objects.
+
+describe("TURNKEY_INIT_MESSAGE_CHANNEL channel gate (real listener)", () => {
+  let d;
+  let parentWindow;
+  let teardown;
+
+  beforeEach(async () => {
+    ({ dom: d, parentWindow, teardown } = buildEmbeddedDom());
+    // Drain any async work queued during eval (e.g. DOMContentLoaded callback)
+    // so those calls are settled and isolated from the per-test assertions.
+    await flush();
+    // Reset call counts so per-test assertions start clean.
+    jest.clearAllMocks();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    teardown();
+  });
+
+  function makeInitEvent({
+    origin = "https://app.example.com",
+    source = null,
+    portsLength = 1,
+    dangerouslyOverrideIframeKeyTtl = undefined,
+  } = {}) {
+    // Default source is the simulated parent.
+    const resolvedSource = source === null ? parentWindow : source;
+    const port = { onmessage: null, postMessage: jest.fn() };
+    const ports = Array.from({ length: portsLength }, () => port);
+    const data = { type: "TURNKEY_INIT_MESSAGE_CHANNEL" };
+    if (dangerouslyOverrideIframeKeyTtl !== undefined) {
+      data.dangerouslyOverrideIframeKeyTtl = dangerouslyOverrideIframeKeyTtl;
+    }
+    const event = new d.window.MessageEvent("message", {
+      data,
+      ports,
+      origin,
+    });
+    Object.defineProperty(event, "source", { value: resolvedSource });
+    return { event, port };
+  }
+
+  it("processes a valid init event and calls initEmbeddedKey + sendMessageUp", async () => {
+    const { event } = makeInitEvent({ origin: "https://app.example.com" });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).toHaveBeenCalledWith(
+      "https://app.example.com",
+      d.window.TKHQ.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
+    );
+    expect(
+      d.window.TKHQ.setParentFrameMessageChannelPort
+    ).toHaveBeenCalledTimes(1);
+    expect(d.window.TKHQ.sendMessageUp).toHaveBeenCalledWith(
+      "PUBLIC_KEY_READY",
+      "aabbccdd"
+    );
+  });
+
+  it("rejects messages from non-parent sources (real listener enforces source check)", async () => {
+    const { event } = makeInitEvent({ source: {} }); // not parentWindow
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).not.toHaveBeenCalled();
+    expect(
+      d.window.TKHQ.setParentFrameMessageChannelPort
+    ).not.toHaveBeenCalled();
+  });
+
+  it("rejects messages with an opaque ('null') origin", async () => {
+    const { event } = makeInitEvent({ origin: "null" });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).not.toHaveBeenCalled();
+  });
+
+  it("rejects messages with an empty origin string", async () => {
+    const { event } = makeInitEvent({ origin: "" });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).not.toHaveBeenCalled();
+  });
+
+  it("rejects messages with zero ports (ports.length !== 1)", async () => {
+    const { event } = makeInitEvent({ portsLength: 0 });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).not.toHaveBeenCalled();
+  });
+
+  it("rejects messages with two ports (ports.length !== 1)", async () => {
+    const { event } = makeInitEvent({ portsLength: 2 });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).not.toHaveBeenCalled();
+  });
+
+  it("ignores a second TURNKEY_INIT_MESSAGE_CHANNEL while the first is pending (race guard)", async () => {
+    // Dispatch both events synchronously before any await resolves — the
+    // channelEstablished flag is set synchronously on the first, so the second
+    // is rejected even though the first handler has not yet awaited initEmbeddedKey.
+    const { event: event1 } = makeInitEvent({
+      origin: "https://app.example.com",
+    });
+    const { event: event2, port: port2 } = makeInitEvent({
+      origin: "https://malicious.example.com",
+    });
+
+    d.window.dispatchEvent(event1);
+    d.window.dispatchEvent(event2);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).toHaveBeenCalledTimes(1);
+    expect(d.window.TKHQ.initEmbeddedKey).toHaveBeenCalledWith(
+      "https://app.example.com",
+      d.window.TKHQ.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
+    );
+    expect(
+      d.window.TKHQ.setParentFrameMessageChannelPort
+    ).toHaveBeenCalledTimes(1);
+    expect(
+      d.window.TKHQ.setParentFrameMessageChannelPort
+    ).not.toHaveBeenCalledWith(port2);
+    expect(d.window.TKHQ.sendMessageUp).toHaveBeenCalledTimes(1);
+  });
+
+  it("rolls back channelEstablished and reports error when key init fails", async () => {
+    d.window.TKHQ.initEmbeddedKey.mockRejectedValueOnce(
+      new Error("storage blocked")
+    );
+
+    const { event: failedEvent, port: failedPort } = makeInitEvent({
+      origin: "https://app.example.com",
+    });
+    d.window.dispatchEvent(failedEvent);
+    await flush();
+
+    // Error is reported on the offered port; no commit occurs.
+    expect(failedPort.postMessage).toHaveBeenCalledWith({
+      type: "ERROR",
+      value: expect.stringContaining("storage blocked"),
+    });
+    expect(
+      d.window.TKHQ.setParentFrameMessageChannelPort
+    ).not.toHaveBeenCalled();
+
+    // A retry handshake from the same parent must succeed.
+    const { event: retryEvent, port: retryPort } = makeInitEvent({
+      origin: "https://app.example.com",
+    });
+    d.window.dispatchEvent(retryEvent);
+    await flush();
+
+    expect(d.window.TKHQ.setParentFrameMessageChannelPort).toHaveBeenCalledWith(
+      retryPort
+    );
+    expect(d.window.TKHQ.sendMessageUp).toHaveBeenCalledWith(
+      "PUBLIC_KEY_READY",
+      "aabbccdd"
+    );
+  });
+
+  // ── dangerouslyOverrideIframeKeyTtl tests ──────────────────────────────────
+
+  it("passes default TTL to initEmbeddedKey when no override is provided", async () => {
+    const { event } = makeInitEvent({ origin: "https://app.example.com" });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).toHaveBeenCalledWith(
+      "https://app.example.com",
+      d.window.TKHQ.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
+    );
+  });
+
+  it("passes the custom TTL to initEmbeddedKey when dangerouslyOverrideIframeKeyTtl is a positive number", async () => {
+    const customTtl = 1000 * 60 * 60 * 2; // 2 hours
+    const { event } = makeInitEvent({
+      origin: "https://app.example.com",
+      dangerouslyOverrideIframeKeyTtl: customTtl,
+    });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).toHaveBeenCalledWith(
+      "https://app.example.com",
+      customTtl
+    );
+  });
+
+  it("ignores dangerouslyOverrideIframeKeyTtl of zero and falls back to default TTL", async () => {
+    const { event } = makeInitEvent({
+      origin: "https://app.example.com",
+      dangerouslyOverrideIframeKeyTtl: 0,
+    });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).toHaveBeenCalledWith(
+      "https://app.example.com",
+      d.window.TKHQ.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
+    );
+  });
+
+  it("ignores dangerouslyOverrideIframeKeyTtl of a negative number and falls back to default TTL", async () => {
+    const { event } = makeInitEvent({
+      origin: "https://app.example.com",
+      dangerouslyOverrideIframeKeyTtl: -5000,
+    });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).toHaveBeenCalledWith(
+      "https://app.example.com",
+      d.window.TKHQ.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
+    );
+  });
+
+  it("ignores dangerouslyOverrideIframeKeyTtl of a string and falls back to default TTL", async () => {
+    const { event } = makeInitEvent({
+      origin: "https://app.example.com",
+      dangerouslyOverrideIframeKeyTtl: "3600000",
+    });
+    d.window.dispatchEvent(event);
+    await flush();
+
+    expect(d.window.TKHQ.initEmbeddedKey).toHaveBeenCalledWith(
+      "https://app.example.com",
+      d.window.TKHQ.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
+    );
+  });
+});
+
+// ─── initEmbeddedKey readiness / rollback tests (Comment 2) ──────────────────
+
+describe("initEmbeddedKey readiness promise and storage-failure rollback", () => {
+  let dom2;
+  let TKHQ2;
+
+  beforeEach(() => {
+    dom2 = new JSDOM(html, {
+      runScripts: "dangerously",
+      url: "http://localhost",
+    });
+    Object.defineProperty(dom2.window, "crypto", { value: crypto.webcrypto });
+    TKHQ2 = dom2.window.TKHQ;
+  });
+
+  it("concurrent callers both see the key once the persistent init resolves", async () => {
+    // Start a persistent init for one origin.
+    const persistentInit = TKHQ2.initEmbeddedKey("https://app.turnkey.com");
+    // A concurrent ephemeral init must not clobber the in-flight persistent state.
+    await TKHQ2.initEphemeralEmbeddedKey();
+    // The key is readable (persistent key should be settled now).
+    expect(TKHQ2.getEmbeddedKey()).not.toBeNull();
+    await persistentInit;
+    // After the persistent init settles the key comes from localStorage.
+    expect(TKHQ2.getEmbeddedKey()).not.toBeNull();
+    expect(TKHQ2.getBoundOrigin()).toBe("https://app.turnkey.com");
+  });
+
+  it("ephemeral init that races persistent init yields the persistent key", async () => {
+    const ephemeralInit = TKHQ2.initEphemeralEmbeddedKey();
+    const persistentInit = TKHQ2.initEmbeddedKey("https://app.turnkey.com");
+    await ephemeralInit;
+
+    const key = TKHQ2.getEmbeddedKey();
+    expect(key).not.toBeNull();
+    await persistentInit;
+    // After both settle the bound origin is set — persistent won.
+    expect(TKHQ2.getBoundOrigin()).toBe("https://app.turnkey.com");
+    const scopedEntry = dom2.window.localStorage.getItem(
+      "TURNKEY_EMBEDDED_KEY_V2:" + encodeURIComponent("https://app.turnkey.com")
+    );
+    expect(scopedEntry).not.toBeNull();
+  });
+
+  it("rolls back to the previous ephemeral key when localStorage.setItem throws", async () => {
+    // Establish an ephemeral key first.
+    await TKHQ2.initEphemeralEmbeddedKey();
+    const ephemeralKey = TKHQ2.getEmbeddedKey();
+    expect(ephemeralKey).not.toBeNull();
+
+    // Force setItemWithExpiry (which calls localStorage.setItem) to throw.
+    const setItemSpy = jest
+      .spyOn(Object.getPrototypeOf(dom2.window.localStorage), "setItem")
+      .mockImplementation(() => {
+        throw new Error("storage blocked");
+      });
+
+    await expect(
+      TKHQ2.initEmbeddedKey("https://app.turnkey.com")
+    ).rejects.toThrow("storage blocked");
+
+    setItemSpy.mockRestore();
+
+    // The document fell back to the previous ephemeral key.
+    expect(TKHQ2.getEmbeddedKey()).toEqual(ephemeralKey);
+    expect(TKHQ2.getBoundOrigin()).toBeNull();
+
+    // A retry succeeds now that storage is available again.
+    await TKHQ2.initEmbeddedKey("https://app.turnkey.com");
+    expect(TKHQ2.getBoundOrigin()).toBe("https://app.turnkey.com");
+    expect(TKHQ2.getEmbeddedKey()).not.toBeNull();
+  });
+
+  it("rolls back to null when there was no previous state and storage throws", async () => {
+    const setItemSpy = jest
+      .spyOn(Object.getPrototypeOf(dom2.window.localStorage), "setItem")
+      .mockImplementation(() => {
+        throw new Error("storage blocked");
+      });
+
+    await expect(
+      TKHQ2.initEmbeddedKey("https://app.turnkey.com")
+    ).rejects.toThrow("storage blocked");
+
+    setItemSpy.mockRestore();
+
+    // State rolled back to null: getEmbeddedKey returns null, getBoundOrigin null.
+    expect(TKHQ2.getEmbeddedKey()).toBeNull();
+    expect(TKHQ2.getBoundOrigin()).toBeNull();
+  });
+
+  it("stores the key with the default 48-hour TTL when no override is given", async () => {
+    const before = Date.now();
+    await TKHQ2.initEmbeddedKey("https://app.turnkey.com");
+    const after = Date.now();
+
+    const storageKey =
+      "TURNKEY_EMBEDDED_KEY_V2:" +
+      encodeURIComponent("https://app.turnkey.com");
+    const raw = dom2.window.localStorage.getItem(storageKey);
+    expect(raw).not.toBeNull();
+    const parsed = JSON.parse(raw);
+    // Expiry should be approximately now + 48 hours
+    const expectedTtl = TKHQ2.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS;
+    expect(parsed.expiry).toBeGreaterThanOrEqual(before + expectedTtl);
+    expect(parsed.expiry).toBeLessThanOrEqual(after + expectedTtl);
+  });
+
+  it("stores the key with the custom TTL when dangerouslyOverrideIframeKeyTtl is provided", async () => {
+    const customTtl = 1000 * 60 * 60 * 2; // 2 hours in ms
+    const before = Date.now();
+    await TKHQ2.initEmbeddedKey("https://app.turnkey.com", customTtl);
+    const after = Date.now();
+
+    const storageKey =
+      "TURNKEY_EMBEDDED_KEY_V2:" +
+      encodeURIComponent("https://app.turnkey.com");
+    const raw = dom2.window.localStorage.getItem(storageKey);
+    expect(raw).not.toBeNull();
+    const parsed = JSON.parse(raw);
+    // Expiry should be approximately now + 2 hours (not 48 hours)
+    expect(parsed.expiry).toBeGreaterThanOrEqual(before + customTtl);
+    expect(parsed.expiry).toBeLessThanOrEqual(after + customTtl);
+    // Confirm the custom TTL is significantly shorter than the default 48-hour TTL
+    expect(parsed.expiry).toBeLessThan(
+      before + TKHQ2.TURNKEY_EMBEDDED_KEY_TTL_IN_MILLIS
+    );
+  });
+});
+
+// ─── Outbound bound-origin tests (Comment 3) ─────────────────────────────────
+//
+// These tests exercise the real sendMessageUp implementation to verify it
+// routes window.parent.postMessage to the correct targetOrigin.  We must NOT
+// mock sendMessageUp itself here — only the crypto/storage helpers that would
+// cause side effects.
+
+describe("sendMessageUp uses bound legacy origin for outbound responses", () => {
+  let d;
+  let parentWindow;
+  let teardown;
+
+  beforeEach(async () => {
+    ({ dom: d, parentWindow, teardown } = buildEmbeddedDom());
+    // Drain DOMContentLoaded async work first.
+    await flush();
+    // Restore the sendMessageUp mock so the REAL implementation runs and we
+    // can inspect parentWindow.postMessage call arguments.
+    d.window.TKHQ.sendMessageUp.mockRestore();
+    // Also restore logMessage (called inside sendMessageUp) to avoid DOM errors.
+    jest.spyOn(d.window.TKHQ, "logMessage").mockImplementation(() => {});
+    // Clear call history from the flush above.
+    parentWindow.postMessage.mockClear();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    teardown();
+  });
+
+  function makeLegacyEvent(requestId, origin = "https://app.example.com") {
+    const event = new d.window.MessageEvent("message", {
+      data: { type: "GET_EMBEDDED_PUBLIC_KEY", requestId },
+      origin,
+    });
+    Object.defineProperty(event, "source", { value: parentWindow });
+    return event;
+  }
+
+  it("uses '*' for outbound messages before any legacy origin is bound", () => {
+    // Before any legacy message arrives parentFrameTargetOrigin is still "*".
+    d.window.TKHQ.sendMessageUp("PUBLIC_KEY_READY", "pubkey");
+    expect(parentWindow.postMessage).toHaveBeenCalledWith(
+      { type: "PUBLIC_KEY_READY", value: "pubkey" },
+      "*"
+    );
+  });
+
+  it("uses the bound origin for outbound responses after the first valid legacy message", async () => {
+    // Dispatch one legacy message — the listener binds legacyParentOrigin and
+    // calls TKHQ.setParentFrameOrigin(event.origin), updating parentFrameTargetOrigin.
+    d.window.dispatchEvent(makeLegacyEvent("req-1", "https://app.example.com"));
+    await flush();
+
+    // Clear calls accumulated while handling req-1.
+    parentWindow.postMessage.mockClear();
+
+    // A subsequent sendMessageUp must use the bound origin, not '*'.
+    d.window.TKHQ.sendMessageUp("EMBEDDED_PUBLIC_KEY", "pubkey2");
+    expect(parentWindow.postMessage).toHaveBeenCalledWith(
+      { type: "EMBEDDED_PUBLIC_KEY", value: "pubkey2" },
+      "https://app.example.com"
+    );
+    expect(parentWindow.postMessage).not.toHaveBeenCalledWith(
+      expect.anything(),
+      "*"
+    );
+  });
+
+  it("still restricts to bound origin when a second legacy message arrives from the same origin", async () => {
+    d.window.dispatchEvent(makeLegacyEvent("req-1", "https://app.example.com"));
+    await flush();
+
+    parentWindow.postMessage.mockClear();
+
+    d.window.dispatchEvent(makeLegacyEvent("req-2", "https://app.example.com"));
+    await flush();
+
+    // Every outbound call must use the bound origin — never "*".
+    expect(parentWindow.postMessage.mock.calls.length).toBeGreaterThan(0);
+    for (const call of parentWindow.postMessage.mock.calls) {
+      expect(call[1]).toBe("https://app.example.com");
+    }
+  });
+});