/**
 * CORS allowlist helpers for managed HTTP routes (`/connectors`, `/channels`).
 *
 * LangGraph applies `CORS_ALLOW_ORIGINS` to built-in Agent Server routes, but
 * GET responses from the custom `http.app` do not always receive those headers.
 * The managed app therefore adds CORS only on its own path prefixes so `/ok`
 * and other built-ins are not double-headed.
 *
 * `mda deploy` still derives `CORS_ALLOW_ORIGINS` from
 * {@link MDA_PUBLIC_APP_URL_ENV} plus optional {@link MDA_CORS_ORIGINS_ENV}.
 *
 * Subdomain policy: an allowlisted origin also permits **one** DNS label
 * beneath it (e.g. Cloudflare Pages previews under a project apex). Deeper
 * nesting is rejected. With credentialed CORS, do not put hosts that issue
 * attacker-reachable subdomains into {@link MDA_CORS_ORIGINS_ENV} / the public
 * app URL — a malicious page on such a subdomain could read `/connectors` and
 * `/channels` responses.
 */
export declare const MDA_PUBLIC_APP_URL_ENV = "MDA_PUBLIC_APP_URL";
/** Path prefixes that receive managed-app CORS (not built-in Agent Server routes). */
export declare const MDA_CORS_PATH_PREFIXES: readonly ["/connectors", "/channels"];
/**
 * Comma-separated extra browser origins allowed for managed HTTP CORS.
 * Each entry also trusts a single subdomain label; avoid multi-tenant hosts.
 */
export declare const MDA_CORS_ORIGINS_ENV = "MDA_CORS_ORIGINS";
/** Headers browser clients send on identity / connector fetches. */
export declare const MDA_CORS_ALLOW_HEADERS: readonly ["Authorization", "Content-Type", "Accept", "X-Api-Key", "x-api-key"];
export declare const MDA_CORS_ALLOW_METHODS: readonly ["GET", "POST", "PUT", "DELETE", "OPTIONS"];
export declare function isManagedCorsPath(path: string): boolean;
/** Exact origins configured for CORS (trailing slashes stripped). */
export declare function resolveCorsAllowlist(env?: NodeJS.ProcessEnv): string[];
/**
 * Return `requestOrigin` when it is allowed, otherwise `undefined`.
 * Allows exact allowlist matches and one-level subdomains of an allowlisted host.
 */
export declare function matchCorsOrigin(requestOrigin: string, allowlist: string[]): string | undefined;
//# sourceMappingURL=cors.d.ts.map