/**
 * Shared resource limits for CORS configuration and generated response headers.
 *
 * This module deliberately lives below both config and security so schema-time
 * and runtime validation use the same contract without introducing a cycle.
 */
export declare const MAX_CORS_ORIGIN_LENGTH = 2048;
export declare const MAX_CORS_ORIGIN_COUNT = 64;
export declare const MAX_CORS_ORIGIN_LIST_LENGTH = 8192;
export declare const MAX_CORS_TOKEN_LENGTH = 256;
export declare const MAX_CORS_TOKEN_COUNT = 64;
export declare const MAX_CORS_SERIALIZED_LIST_LENGTH = 4096;
export declare const MAX_CORS_MAX_AGE: number;
/** RFC 9110 token syntax shared by schema and runtime CORS validation. */
export declare const HTTP_TOKEN_PATTERN: RegExp;
export declare function isBoundedCorsOrigin(value: unknown): value is string;
export declare function isBoundedCorsOriginList(values: readonly unknown[]): values is readonly string[];
export declare function isBoundedCorsToken(value: unknown): value is string;
export declare function isBoundedCorsTokenList(values: readonly unknown[]): values is readonly string[];
export declare function isValidCorsMaxAge(value: unknown): value is number;
/**
 * Whether a response header is reserved for the dedicated CORS policy layer.
 *
 * Returns a plain boolean rather than a `value is string` predicate: the
 * narrowing that predicate implied was wrong in the negative branch, where it
 * told the compiler a non-matching value was not a string at all, collapsing
 * an ordinary header name to `never`.
 */
export declare function isCorsPolicyResponseHeaderName(value: unknown): boolean;
//# sourceMappingURL=cors-policy-limits.d.ts.map