import type { CORSConfig, CORSValidationResult, SyncCORSConfig } from "./types.js";
export type NormalizedCORSConfig = boolean | CORSConfig;
export type CORSConfigNormalizationResult = {
    valid: true;
    config: NormalizedCORSConfig;
} | {
    valid: false;
    error: string;
};
/**
 * Snapshot a short array without invoking iterators, indexed accessors, or
 * proxy `get` traps. Every proxy-sensitive reflection operation is guarded so
 * revoked and otherwise hostile proxies become a deterministic invalid value.
 */
export declare function snapshotCORSArray(value: unknown, maxLength: number): unknown[] | null;
/**
 * Snapshot and validate an untrusted runtime CORS policy.
 *
 * The schema protects configuration loaded through the normal config path, but
 * public response helpers can be called with arbitrary JavaScript values. This
 * is the single runtime contract used by those boundaries.
 */
export declare function normalizeCORSConfig(config: unknown): CORSConfigNormalizationResult;
export declare function validateNormalizedOrigin(requestOrigin: unknown, config: NormalizedCORSConfig): Promise<CORSValidationResult>;
export declare function validateNormalizedOriginSync(requestOrigin: unknown, config: NormalizedCORSConfig): CORSValidationResult;
export declare function corsOriginForTelemetry(requestOrigin: unknown): string;
/** Validate origin against CORS configuration. */
export declare function validateOrigin(requestOrigin: unknown, config?: boolean | CORSConfig): Promise<CORSValidationResult>;
/** Synchronous origin validation. Promise-returning values still fail closed at runtime. */
export declare function validateOriginSync(requestOrigin: unknown, config?: boolean | SyncCORSConfig): CORSValidationResult;
/** Validate CORS configuration for security issues. */
export declare function validateCORSConfig(config?: boolean | CORSConfig): {
    valid: boolean;
    error?: string;
};
//# sourceMappingURL=validators.d.ts.map