/**
 * Trust anchor for the modal registry's outbound (iframe → host) postMessage.
 *
 * `@trackunit/react-modal` is a standalone, reusable UI library that must not
 * depend on `iris-app-runtime` (see `modalStackRegistry.ts` for why the modal
 * stack bridge uses raw postMessage rather than penpal). So, exactly as the
 * dependency-free `iris-app-loader` does, the trusted-host-origin resolver is
 * duplicated here instead of imported.
 *
 * The `BRANDED_HOST_DOMAINS` list is the single security-relevant piece that
 * must stay in sync across all copies (this file, the loader copy, the runtime
 * core resolver, and `BrandedUrls` in
 * `libs/iris-app-sdk/iris-app-api/src/types/irisAppCspInput.ts`); a
 * `platform-test` (`branded-host-origins-in-sync.spec.ts`) fails the build on
 * drift.
 */
/**
 * Resolves the embedding host's origin from `document.referrer`, returning it
 * only when it is whitelisted; otherwise `undefined` (non-whitelisted, blank,
 * or unreadable referrer). Memoized on first call.
 */
export declare const getTrustedHostOrigin: () => string | undefined;
/** Test-only: clears the capture-once cache so a test can vary `document.referrer`. */
export declare const resetTrustedHostOriginCacheForTests: () => void;