/**
 * Session-replay bridge — the half that runs INSIDE the owner's app.
 *
 * The builder frames the generated site from `*.proyecta.space` while the
 * cockpit itself is `app.proyecta.dev`. A recorder cannot read across origins,
 * so every replay of a build session showed an EMPTY BOX where the owner was
 * watching their site appear — the one thing the session is about.
 *
 * PostHog's supported fix for that is rrweb's cross-origin iframe mode
 * (https://posthog.com/docs/session-replay/iframes): the recorder inside the
 * frame does not upload anything of its own — it `postMessage`s its events to
 * the parent, which merges them into the ONE recording it is already making.
 * Both sides must opt in; the cockpit half is
 * `session_recording.recordCrossOriginIframes` in `@proyecta/browser-logger`
 * plus `usePreviewReplayBridge` in `apps/proyecta-app`.
 *
 * Three properties of the design are deliberate:
 *
 *  1. **No dependency, and no second SDK in the owner's app.** The recorder is
 *     fetched from the URL the COCKPIT hands us, which is the very bundle the
 *     cockpit's own posthog-js already loaded (`/ph-api/static/…/recorder.js`).
 *     Both frames therefore run the byte-identical recorder version, and the
 *     generated app gains no npm dependency, no token, and nothing at all in a
 *     production build — this script only exists on the dev server.
 *  2. **The cockpit decides whether to record, never this script.** Nothing
 *     starts until a trusted parent says "start". Consent, the `replay-enabled`
 *     kill switch, the staff exclusion and the thumbnail-browser exclusion all
 *     live in one place, on the parent, and this frame inherits every one of
 *     them by staying silent until told.
 *  3. **The trust check is here, not only there.** rrweb posts its events with
 *     a `'*'` target origin, so any page that framed a preview would receive
 *     them. Refusing to start for an untrusted parent is what keeps the owner's
 *     DOM from travelling to a site that merely embedded their preview URL.
 */
/**
 * Parent origins allowed to start a recording in this document: the cockpit
 * (`app.proyecta.dev`, and any other `*.proyecta.dev` host) plus the loopback
 * and private-LAN hosts a developer runs it on.
 *
 * ⚠️ The apex `proyecta.dev` is deliberately NOT matched — the marketing site
 * never frames a preview, so nothing legitimate is lost by refusing it.
 */
export declare const COCKPIT_ORIGIN_PATTERN: RegExp;
/** The `source` every message of this protocol carries, both directions. */
export declare const REPLAY_BRIDGE_MESSAGE_SOURCE = "proyecta-replay";
/**
 * The injected script. Plain ES5-ish browser JS on purpose: it is concatenated
 * into the dev bootstrap module and runs before the app's own code, in whatever
 * browser the owner is holding.
 */
export declare const REPLAY_BRIDGE_SCRIPT: string;
//# sourceMappingURL=replay-bridge.d.ts.map