import type { Plugin } from './app';
/** CORS configuration. Sensible permissive defaults; tighten `origin` for prod. */
export interface CorsOptions {
    /**
     * Allowed origin(s):
     * - `true` (default) reflects the request's `Origin`.
     * - a string sets it verbatim (e.g. `"*"` or `"https://app.example.com"`).
     * - an array or predicate reflects the origin only when it matches.
     * - `false` disables CORS headers.
     */
    origin?: string | string[] | boolean | ((origin: string) => boolean);
    /**
     * Sets `Access-Control-Allow-Methods` on preflight responses. Default:
     * `GET, HEAD, PUT, PATCH, POST, DELETE, OPTIONS`.
     */
    methods?: string[];
    /**
     * Sets `Access-Control-Allow-Headers` on preflight responses; when omitted,
     * reflects the request's `Access-Control-Request-Headers` verbatim.
     */
    allowedHeaders?: string[];
    /**
     * Sets `Access-Control-Expose-Headers` on actual (non-preflight) responses,
     * naming which response headers browser JS may read. Omitted, the header is
     * left off (only the CORS-safelisted response headers are readable).
     */
    exposedHeaders?: string[];
    /**
     * When `true`, sets `Access-Control-Allow-Credentials: true` on both preflight
     * and responses so the browser sends cookies / `Authorization`. Default
     * `false`. Incompatible with a wildcard `origin: "*"` — reflect a specific
     * origin instead, or the browser rejects the response.
     */
    credentials?: boolean;
    /**
     * Seconds a browser may cache this preflight result (`Access-Control-Max-Age`).
     * Omitted, the header is left off and the browser uses its own short default.
     */
    maxAge?: number;
}
/**
 * A CORS plugin: handles preflight (`OPTIONS`) requests and adds CORS headers to
 * responses. Register it via `createApp({ plugins: [cors(...)] })` or
 * `app.register(cors(...))`.
 *
 * ```ts
 * const app = await createApp({
 *   controllers: [...],
 *   plugins: [cors({ origin: "https://app.example.com", credentials: true })],
 * });
 * ```
 *
 * @param options - CORS behavior; unset fields keep the permissive defaults
 *   (reflect the request `Origin`, standard method set, reflect requested
 *   headers, no credentials)
 * @returns a plugin that answers preflight requests and adds CORS response headers
 */
export declare function cors(options?: CorsOptions): Plugin;
//# sourceMappingURL=cors.d.ts.map