/**
 * Trust anchor for the child (Iris app) side of the penpal bridge.
 *
 * An Iris app runs inside an iframe whose parent is the host (manager) page.
 * Before this module the child connected with `allowedOrigins: ["*"]`, so any
 * page could embed an app and drive it through the bridge. We pin the
 * handshake to a *static whitelist* of Trackunit-controlled host domains — the
 * whitelist, not the attacker-influenceable `document.referrer`, is the trust
 * anchor.
 *
 * `document.referrer` is only used to *decide whether* we are confident enough
 * to enforce the whitelist: the iframe sets `<meta name="referrer"
 * content="strict-origin">`, so the referrer carries the embedding host's
 * origin. When that origin resolves to a whitelisted Trackunit host we pin
 * `allowedOrigins` to the whitelist; in every other case (non-whitelisted,
 * blank, or unreadable referrer) we fail closed with `[]` so no parent can
 * complete the handshake. There is deliberately no `["*"]` fallback — an
 * embedder could blank or spoof its own referrer, so a wildcard fallback would
 * re-open the exact unpinned path this module exists to close.
 *
 * The branded-domain list mirrors `BrandedUrls` in
 * `libs/iris-app-sdk/iris-app-api/src/types/irisAppCspInput.ts`. It is
 * duplicated here (as origin-matching RegExps rather than CSP `https://*.x`
 * patterns) because `iris-app-runtime-core` does not depend on `iris-app-api`
 * and adding that dependency for a static list isn't warranted. Keep the two
 * lists in sync.
 */
/**
 * The static whitelist of trusted host origins, suitable for direct use as
 * penpal `WindowMessenger.allowedOrigins` (which accepts `Array<string |
 * RegExp>` and tests each incoming message origin against the list).
 */
export declare const trustedHostOrigins: Array<string | RegExp>;
/**
 * Whether the given window origin belongs to a trusted Trackunit host.
 */
export declare const isWhitelistedHostOrigin: (origin: string) => boolean;
/**
 * Resolves the embedding host's origin from `document.referrer`, returning it
 * only when it is whitelisted; otherwise `undefined` (non-whitelisted, blank,
 * or unreadable referrer). The value is captured on the first call and
 * memoized for the lifetime of the document.
 */
export declare const getTrustedHostOrigin: () => string | undefined;
/**
 * The `allowedOrigins` to use for the child→host penpal handshake: the trusted
 * whitelist when the embedding host origin resolves to a whitelisted domain,
 * otherwise `[]` — fail closed. There is no `["*"]` fallback, so a parent that
 * isn't a whitelisted Trackunit host can never complete the handshake.
 */
export declare const getHostConnectorAllowedOrigins: () => Array<string | RegExp>;
/**
 * Test-only: clears the capture-once cache so each test can exercise a
 * different `document.referrer`. Not exported from the package index.
 */
export declare const resetTrustedHostOriginCacheForTests: () => void;