/**
 * @module @arcis/node/middleware/cors
 * Safe CORS middleware with secure defaults
 */
import type { RequestHandler } from 'express';
/** CORS configuration options */
export interface CorsOptions {
    /**
     * Allowed origins. Can be:
     * - A string: exact match (e.g., 'https://example.com')
     * - An array: whitelist of allowed origins
     * - A RegExp: pattern match (use with care)
     * - A function: custom validation `(origin) => boolean`
     * - `true`: reflect the request origin (DANGEROUS — only for dev)
     *
     * Default: none (no origin allowed). You must explicitly set this.
     */
    origin: string | string[] | RegExp | ((origin: string) => boolean) | true;
    /** Allowed HTTP methods. Default: ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE'] */
    methods?: string[];
    /** Allowed headers. Default: ['Content-Type', 'Authorization'] */
    allowedHeaders?: string[];
    /** Headers exposed to the browser. Default: [] */
    exposedHeaders?: string[];
    /** Allow credentials (cookies, authorization headers). Default: false */
    credentials?: boolean;
    /** Preflight cache duration in seconds. Default: 600 (10 minutes) */
    maxAge?: number;
    /** Respond to preflight with 204 (no content). Default: true */
    preflightContinue?: boolean;
}
/**
 * Create safe CORS middleware.
 *
 * Unlike permissive CORS libraries, this enforces secure defaults:
 * - No wildcard `*` when credentials are enabled
 * - `null` origin is always blocked
 * - `Vary: Origin` is always set for proper caching
 * - You must explicitly configure allowed origins
 *
 * @param options - CORS configuration
 * @returns Express middleware
 *
 * @example
 * // Allow a single origin
 * app.use(safeCors({ origin: 'https://myapp.com' }));
 *
 * @example
 * // Allow multiple origins with credentials
 * app.use(safeCors({
 *   origin: ['https://myapp.com', 'https://admin.myapp.com'],
 *   credentials: true,
 * }));
 *
 * @example
 * // Development: allow all (NOT for production)
 * app.use(safeCors({ origin: true }));
 */
export declare function safeCors(options: CorsOptions): RequestHandler;
/**
 * Alias for safeCors
 * @see safeCors
 */
export declare const createCors: typeof safeCors;
//# sourceMappingURL=cors.d.ts.map