import { NextFunction, Request, Response } from "express";
/**
 * Reflect-origin CORS for widget routes. Per-tenant allowlisting can't happen
 * here: browsers never send the API key on a preflight OPTIONS request, so
 * there's no tenant to check against yet. The actual security boundary is
 * `originValidation`, downstream, once apiKeyAuth has resolved a tenant.
 */
export declare function widgetCors(req: Request, res: Response, next: NextFunction): void;