import type { Middleware } from "@nifrajs/core/server";
export interface CorsOptions {
    /** Allowed origin(s): `"*"`, an exact origin, a list, or a predicate. Default `"*"`. */
    readonly origin?: string | ReadonlyArray<string> | ((origin: string) => boolean);
    /** Methods advertised in the preflight response. Default the common verbs. */
    readonly methods?: ReadonlyArray<string>;
    /** Headers allowed on the actual request. Default: reflect the preflight's requested headers. */
    readonly allowedHeaders?: ReadonlyArray<string>;
    /** Response headers exposed to the browser. */
    readonly exposedHeaders?: ReadonlyArray<string>;
    /** Allow credentials (cookies / `Authorization`). Cannot be combined with `origin: "*"`. Default false. */
    readonly credentials?: boolean;
    /** Preflight cache duration, in seconds. */
    readonly maxAge?: number;
}
/**
 * CORS as a {@link Middleware}. Preflight (`OPTIONS` + `Access-Control-Request-Method`)
 * short-circuits to `204` via `onRequest`; the origin/credentials headers are added in
 * `onResponse`, so they also land on errors, 404s, and the preflight itself.
 *
 * Throws at construction if `credentials: true` is paired with `origin: "*"` - the
 * browser rejects that combination, so we fail loud instead of shipping dead CORS.
 */
export declare function cors(options?: CorsOptions): Middleware;
//# sourceMappingURL=cors.d.ts.map