/**
 * @oxpulse/chat-widget — iframe embed entry point.
 *
 * This module is the entry point for the sandboxed iframe loaded at
 * `${baseUrl}/widget/embed.html`. It:
 *   1. Reads `?origin=` query param and initialises postMessage security (M1+M2).
 *   2. Listens for the 'init' postMessage from the parent page.
 *   3. Runs the origin check with the received config.
 *   4. Mounts the widget inside the iframe's DOM.
 *   5. Relays widget events back to the parent via postMessage.
 *
 * The iframe is always sandboxed (allow-scripts allow-same-origin) —
 * the parent element.ts enforces this via the sandbox attribute.
 */
/**
 * Apply a refreshed JWT to the live iframe session IN PLACE.
 *
 * Updates the session token without re-running init / origin-check / reload, so
 * the widget is not remounted. It is reached only through the origin-gated
 * `onParentMessage` listener, so the JWT here has already passed the
 * parent-origin check.
 *
 * W2.2 security fix: the refreshed JWT is re-validated against the live session
 * before swapping — `aud_origins` must match the original token's set, so a
 * crafted refresh-token cannot silently downgrade or re-scope the live session.
 *
 * When the inner chat client is mounted here (W2.2), this is where its JWT is
 * rotated: `SDKChatClient` holds its JWT in a `readonly` private field with no
 * setter, so a rotation is a re-subscribe with a freshly-constructed client (a
 * minimal SSE reconnect that keeps the iframe document + scroll) — never a full
 * widget remount.
 *
 * On validation failure, the live session is left untouched (the stale JWT
 * remains) and an error is relayed to the parent — the host can then mint a
 * correct refresh token and retry.
 */
export declare function applyRefreshedToken(jwt: string): void;
/**
 * @internal Test-only observation hook — the JWT currently applied to the live
 * iframe session. Not re-exported from index.ts; not part of the public API.
 *
 * Inert outside the test runner: `globalThis.process` is undefined in a browser
 * bundle and NODE_ENV is only 'test' under vitest, so a production iframe bundle
 * never returns the live bearer JWT from this export.
 */
export declare function __getLiveJwt(): string | null;
/**
 * Bootstrap the iframe-mode widget.
 *
 * Waits for the 'init' message from the parent, then:
 * - Runs origin check
 * - Renders placeholder (W2.2 will mount real UI)
 * - Relays events to parent
 */
export declare function initIframe(): void;
//# sourceMappingURL=iframe.d.ts.map