@beignet/core/dist/server/hooks/cors.d.ts

Core framework primitives for Beignet

/**
 * CORS hook utilities for @beignet/core/server
 */
import type { HttpRequestLike, HttpResponseHeaders, ServerHook } from "../types.js";
/**
 * CORS configuration for `createCorsHooks(...)`.
 */
export interface CorsConfig {
    /**
     * Allowed origins. Use `"*"` only for non-credentialed requests.
     * Credentialed CORS requires an explicit origin allow-list.
     */
    origins?: string[] | "*";
    /**
     * Allowed HTTP methods.
     */
    methods?: string[];
    /**
     * Allowed request headers.
     */
    headers?: string[];
    /**
     * Additional response headers browser JavaScript may read. Beignet always
     * exposes its framework error-ownership header.
     */
    exposedHeaders?: string[];
    /**
     * Whether credentialed requests are allowed.
     */
    credentials?: boolean;
}
/**
 * Apply CORS response headers to a mutable header record.
 *
 * Credentialed CORS rejects wildcard origins. Use an explicit origin allow-list
 * when cookies or authorization headers are allowed cross-origin.
 */
export declare function applyCorsHeaders(headers: HttpResponseHeaders, req: HttpRequestLike, corsConfig: CorsConfig): void;
/**
 * Create CORS hooks for preflight and regular responses.
 *
 * CORS preflight requests short-circuit with a 204 response. Explicit
 * `OPTIONS` routes without `Access-Control-Request-Method` continue through the
 * normal route pipeline. All responses are decorated in `beforeSend`.
 */
export declare function createCorsHooks<Ctx>(config: CorsConfig): ServerHook<Ctx>;
//# sourceMappingURL=cors.d.ts.map