/**
 * Build a CORS decision function.
 *
 *   const check = cors({ origin: ['https://app.example.com'], credentials: true })
 *
 *   // In your framework middleware:
 *   const d = check({
 *     method: req.method,
 *     origin: req.headers.origin,
 *     requestMethod: req.headers['access-control-request-method'],
 *     requestHeaders: req.headers['access-control-request-headers'],
 *   })
 *   for (const [k, v] of Object.entries(d.headers)) res.setHeader(k, v)
 *   if (d.preflight) { res.statusCode = d.status; res.end(); return }
 *   if (!d.allowed) { res.statusCode = 403; res.end(); return }
 *
 * The returned function is pure — no state, safe to reuse across requests
 * and across workers. When the configured `origin` predicate is async
 * (returns a Promise), `check()` returns `Promise<CorsDecision>`; for sync
 * predicates it stays synchronous so hot paths don't pay a needless await.
 *
 * @param {CorsOptions} [options]
 * @returns {(input: CorsInput) => CorsDecision | Promise<CorsDecision>}
 */
declare function cors(options?: CorsOptions): (input: CorsInput) => CorsDecision | Promise<CorsDecision>;
type OriginMatcher = string | RegExp;
type CorsOptions = {
    /**
     * Which origins are allowed to make cross-origin requests.
     * - `true`  → reflect any origin (echoes back the request's `Origin`).
     * - `false` → CORS disabled; every cross-origin request is denied.
     * - string  → exact match against the request's `Origin`.
     * - RegExp  → pattern match.
     * - Array   → any-of match against the entries.
     * - Function → sync or async predicate; return true (or resolve to true) to allow.
     * When the predicate is async, `check()` returns a Promise<CorsDecision>;
     * for sync predicates it stays sync so consumers pay no async cost.
     */
    origin?: boolean | OriginMatcher | OriginMatcher[] | ((origin: string | undefined) => boolean | Promise<boolean>) | undefined;
    /**
     * Comma-separated string or array. Default:
     * `['GET','HEAD','PUT','PATCH','POST','DELETE']`. Sent as
     * `Access-Control-Allow-Methods` on preflight only.
     */
    methods?: string | string[] | undefined;
    /**
     * Headers the browser may include on the actual request. Default `true` =
     * echo the request's `Access-Control-Request-Headers`. Sent on preflight.
     */
    allowedHeaders?: string | true | string[] | undefined;
    /**
     * Response headers the browser may read via `getResponseHeader()`. Sent
     * on the actual response.
     */
    exposedHeaders?: string | string[] | undefined;
    /**
     * When true, sets `Access-Control-Allow-Credentials: true`. Requires an
     * exact-echoed origin — cannot be combined with the `*` wildcard.
     */
    credentials?: boolean | undefined;
    /**
     * Seconds the browser may cache the preflight decision. Sent on preflight.
     */
    maxAge?: number | undefined;
    /**
     * HTTP status to end a preflight response with. Some legacy setups need
     * 200 instead — Chrome accepts either.
     */
    optionsSuccessStatus?: number | undefined;
};
type CorsInput = {
    /**
     * Request method (e.g. 'GET', 'OPTIONS').
     */
    method: string;
    /**
     * Value of the request's `Origin` header.
     */
    origin: string | undefined;
    /**
     * `Access-Control-Request-Method` on preflight.
     */
    requestMethod?: string | undefined;
    /**
     * `Access-Control-Request-Headers` on preflight.
     */
    requestHeaders?: string | undefined;
};
type CorsDecision = {
    /**
     *   CORS response headers to merge onto the response.
     */
    headers: Record<string, string>;
    /**
     * Origin passed the policy check.
     */
    allowed: boolean;
    /**
     * Request was an OPTIONS preflight.
     */
    preflight: boolean;
    /**
     * Suggested response status for preflight.
     */
    status?: number | undefined;
};

export { cors };
export type { CorsDecision, CorsInput, CorsOptions, OriginMatcher };