/**
 * @oxpulse/chat-widget — bootstrap origin check.
 *
 * Decodes (but does NOT verify) the JWT, extracts the `aud_origins` claim,
 * and matches it against window.location.origin BEFORE any network call.
 *
 * Security note: signature verification is the server's responsibility.
 * The client-side check prevents accidental misconfiguration, not
 * malicious embed (an attacker can trivially bypass client-side JS).
 *
 * Origin-match semantics mirror crates/sdk/src/origin_match.rs (W1.1):
 *   - Case-insensitive host + scheme comparison
 *   - `*.example.com` or `https://*.example.com` = subdomain wildcard, https-only, single-level
 *   - `http://localhost:*` = port wildcard (requires a port — no-port does NOT match)
 *   - `https://example.com` = exact match
 *   - `validate_allowlist_entry` rules: malformed entries never match
 */
import { type WidgetConfig, type OriginCheckResult } from './types.js';
/** Minimal decoded JWT payload shape for our bootstrap check. */
interface JwtPayload {
    /** Allowed embed origins (glob patterns, e.g. "https://example.com", "http://localhost:*"). */
    aud_origins?: string[];
    /** Standard expiry (unix seconds). Client-side check; server is authoritative. */
    exp?: number;
    [key: string]: unknown;
}
/**
 * Decode JWT (Base64url → JSON) — no signature verification.
 *
 * Also checks the `exp` claim: if exp is in the past, throws WidgetError(JWT_EXPIRED).
 *
 * @throws WidgetError(JWT_MALFORMED) if the token is not a valid 3-part JWT.
 * @throws WidgetError(JWT_EXPIRED) if the exp claim is in the past.
 */
export declare function decodeJwtPayload(jwt: string): JwtPayload;
/**
 * Match an origin against a single pattern.
 *
 * Mirrors crates/sdk/src/origin_match.rs::matches semantics:
 *   - Case-insensitive (scheme + host)
 *   - `*.example.com` or `https://*.example.com` — subdomain wildcard, https-only, single-level
 *   - `http://localhost:*`  — port wildcard, REQUIRES actual port (no-port = no match)
 *   - `https://example.com` — exact match
 *   - Malformed entries → false (deny-loud)
 */
export declare function matchOriginPattern(origin: string, pattern: string): boolean;
/**
 * Check whether the current page origin is allowed by the JWT's aud_origins claim.
 *
 * Behaviour (M5 — security default):
 * - If aud_origins is missing and allowLegacyToken is false (default): DENY.
 * - If aud_origins is missing and allowLegacyToken is true: warn + pass-through.
 * - If aud_origins is empty array: deny all.
 * - Dev mode: localhost always passes when mode === 'inline' (or unset) and
 *   window.location.hostname === 'localhost'.
 * - Malformed patterns in aud_origins: console.warn + treated as never-match.
 *
 * @throws OriginNotAllowedError when origin is not in the allowlist.
 * @throws WidgetError(JWT_MALFORMED) when the JWT cannot be decoded.
 * @throws WidgetError(JWT_EXPIRED) when the JWT exp claim is in the past.
 */
export declare function checkOrigin(config: WidgetConfig): Promise<OriginCheckResult>;
export {};
//# sourceMappingURL=bootstrap.d.ts.map