import { Duration } from "../../core";
/**
 * @experimental
 */
export interface CorsOptions {
    /**
     * (experimental) Specifies the response status code returned from the OPTIONS method.
     *
     * @default 204
     * @experimental
     */
    readonly statusCode?: number;
    /**
     * (experimental) Specifies the list of origins that are allowed to make requests to this resource.
     *
     * If you wish to allow all origins, specify `Cors.ALL_ORIGINS` or
     * `[ * ]`.
     *
     * Responses will include the `Access-Control-Allow-Origin` response header.
     * If `Cors.ALL_ORIGINS` is specified, the `Vary: Origin` response header will
     * also be included.
     *
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
     * @experimental
     */
    readonly allowOrigins: string[];
    /**
     * (experimental) The Access-Control-Allow-Headers response header is used in response to a preflight request which includes the Access-Control-Request-Headers to indicate which HTTP headers can be used during the actual request.
     *
     * @default Cors.DEFAULT_HEADERS
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
     * @experimental
     */
    readonly allowHeaders?: string[];
    /**
     * (experimental) The Access-Control-Allow-Methods response header specifies the method or methods allowed when accessing the resource in response to a preflight request.
     *
     * If `ANY` is specified, it will be expanded to `Cors.ALL_METHODS`.
     *
     * @default Cors.ALL_METHODS
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
     * @experimental
     */
    readonly allowMethods?: string[];
    /**
     * (experimental) The Access-Control-Allow-Credentials response header tells browsers whether to expose the response to frontend JavaScript code when the request's credentials mode (Request.credentials) is "include".
     *
     * When a request's credentials mode (Request.credentials) is "include",
     * browsers will only expose the response to frontend JavaScript code if the
     * Access-Control-Allow-Credentials value is true.
     *
     * Credentials are cookies, authorization headers or TLS client certificates.
     *
     * @default false
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
     * @experimental
     */
    readonly allowCredentials?: boolean;
    /**
     * (experimental) The Access-Control-Max-Age response header indicates how long the results of a preflight request (that is the information contained in the Access-Control-Allow-Methods and Access-Control-Allow-Headers headers) can be cached.
     *
     * To disable caching altogether use `disableCache: true`.
     *
     * @default - browser-specific (see reference)
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
     * @experimental
     */
    readonly maxAge?: Duration;
    /**
     * (experimental) Sets Access-Control-Max-Age to -1, which means that caching is disabled.
     *
     * This option cannot be used with `maxAge`.
     *
     * @default - cache is enabled
     * @experimental
     */
    readonly disableCache?: boolean;
    /**
     * (experimental) The Access-Control-Expose-Headers response header indicates which headers can be exposed as part of the response by listing their names.
     *
     * If you want clients to be able to access other headers, you have to list
     * them using the Access-Control-Expose-Headers header.
     *
     * @default - only the 6 CORS-safelisted response headers are exposed:
     * Cache-Control, Content-Language, Content-Type, Expires, Last-Modified,
     * Pragma
     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers
     * @experimental
     */
    readonly exposeHeaders?: string[];
}
/**
 * @experimental
 */
export declare class Cors {
    /**
     * (experimental) All HTTP methods.
     *
     * @experimental
     */
    static readonly ALL_METHODS: string[];
    /**
     * (experimental) All origins.
     *
     * @experimental
     */
    static readonly ALL_ORIGINS: string[];
    /**
     * (experimental) The set of default headers allowed for CORS and useful for API Gateway.
     *
     * @experimental
     */
    static readonly DEFAULT_HEADERS: string[];
    private constructor();
}
