import type { MiddlewareHandler } from "hono";
import type { VoyantBindings } from "../types.js";
/**
 * Resolve the exact origin to echo for a customer-realm request, or `null` to
 * fall back to the static allowlist. Runs before the db middleware, so it owns
 * any db access. Provided by the auth integration (`resolveCorsOrigin`).
 */
export type DynamicCorsOriginResolver = (c: Parameters<MiddlewareHandler<{
    Bindings: VoyantBindings;
}>>[0]) => Promise<string | null> | string | null;
export interface CorsOptions {
    /**
     * Per-storefront dynamic origin authorizer for the customer realm. When it
     * returns an origin, that specific origin is echoed with credentials — never
     * `*`. When it returns `null`, the request falls back to the static
     * `CORS_ALLOWLIST`. Only consulted for {@link CorsOptions.isDynamicPath}
     * matches, so admin/dash surfaces stay on the static allowlist.
     */
    resolveDynamicOrigin?: DynamicCorsOriginResolver;
    /** Whether a pathname is eligible for dynamic per-storefront CORS. */
    isDynamicPath?: (pathname: string) => boolean;
}
export declare function cors(options?: CorsOptions): MiddlewareHandler<{
    Bindings: VoyantBindings;
}>;