import type { Middleware } from './types.js';
export interface CorsOptions {
    /**
     * Allowed origin(s). Pass `'*'` to allow any origin (cannot be combined with
     * `credentials: true`), a specific string, an array of allowed strings, or a
     * predicate function.
     *
     * **Security note for function form:** the callback receives the raw `Origin`
     * header - validate the full origin string, not just a suffix. Naive checks
     * like `o.endsWith('.example.com')` are bypassed by `evil.example.com.attacker.net`.
     * Prefer comparing against a whitelist or parsing with `new URL(origin)` and
     * checking `.hostname` exactly.
     */
    origin?: string | string[] | ((origin: string) => boolean);
    methods?: string[];
    allowedHeaders?: string[];
    exposedHeaders?: string[];
    credentials?: boolean;
    maxAge?: number;
}
export declare function cors(options?: CorsOptions): Middleware;
//# sourceMappingURL=cors.d.ts.map