import { cors } from "hono/cors";

//#region src/middleware/cors.d.ts
type CorsOptions = Parameters<typeof cors>[0];
/**
 * Extract the base domain from a hostname (e.g., 'app.preview.inkeep.com' -> 'preview.inkeep.com')
 */
declare function getBaseDomain(hostname: string): string;
/**
 * Extract the registrable domain (eTLD+1) from a hostname.
 * e.g., 'api.agents.inkeep.com' -> 'inkeep.com', 'app.inkeep.com' -> 'inkeep.com'
 */
declare function getRootDomain(hostname: string): string;
/**
 * Check if a request origin is allowed for CORS
 * Development: Allow any localhost origin
 * Production: Allow same base domain, same root domain (when UI URL is configured), or configured UI URL
 */
declare function isOriginAllowed(origin: string | undefined): origin is string;
/**
 * CORS configuration for auth routes (Better Auth, session endpoints)
 */
declare const authCorsConfig: CorsOptions;
/**
 * CORS configuration for default API routes
 */
declare const defaultCorsConfig: CorsOptions;
/**
 * CORS configuration for playground routes
 */
declare const playgroundCorsConfig: CorsOptions;
/**
 * CORS configuration for run routes (streaming, more permissive)
 */
declare const runCorsConfig: CorsOptions;
/**
 * CORS configuration for SigNoz proxy routes
 */
declare const signozCorsConfig: CorsOptions;
/**
 * CORS configuration for the Credential Gateway's public platform catalog endpoint
 * (`GET /credential-gateway/.well-known/platforms`).
 *
 * This is the only credential-gateway endpoint browsers are allowed to hit — it
 * is consumed by Support Copilot browser extensions to discover supported
 * platforms and their URL matchers. Public, cacheable, and carries no credentials.
 */
declare const credentialGatewayCatalogCorsConfig: CorsOptions;
/**
 * CORS configuration for the Credential Gateway token-exchange endpoint
 * (`POST /credential-gateway/token`) and any other non-catalog routes under
 * `/credential-gateway/*`.
 *
 * Server-to-server only. `origin: () => null` causes the CORS middleware to
 * reject every browser origin. Server-side callers (e.g. the Copilot backend
 * performing RFC 8693 token exchange) are not subject to CORS and bypass this
 * middleware at the HTTP layer.
 */
declare const credentialGatewayCorsConfig: CorsOptions;
/**
 * CORS configuration for work-apps routes (Slack, etc.)
 * Needs to allow cross-origin requests with credentials for dashboard integration
 */
declare const workAppsCorsConfig: CorsOptions;
//#endregion
export { authCorsConfig, credentialGatewayCatalogCorsConfig, credentialGatewayCorsConfig, defaultCorsConfig, getBaseDomain, getRootDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig, workAppsCorsConfig };