/**
 * Is this backend willing to receive a `traceparent` header?
 *
 * Why this exists at all: joining a browser span to a backend span means
 * attaching `traceparent` to the outgoing request. On a cross-origin request
 * that turns it into a preflighted request, and if the backend's
 * `Access-Control-Allow-Headers` does not cover `traceparent`, the browser
 * refuses to send the request AT ALL. The customer loses the API call, not just
 * the correlation. That failure mode is why Sentry defaults to same-origin only
 * and why Datadog ships its equivalent option with no default.
 *
 * So we ask first. We cannot read `Access-Control-Allow-Headers` from
 * JavaScript — it is not an exposed response header — but we do not need to.
 * We only need the browser's verdict on the preflight, and the browser gives us
 * that for free: a rejected preflight rejects the `fetch`, while an accepted one
 * resolves with whatever status the server returned, 404 very much included.
 */
/**
 * A path chosen to be uninteresting. We expect a 404 and that is a pass — the
 * only thing being tested is whether the preflight cleared.
 */
export declare const PROBE_PATH = "/.well-known/onepatch-rum-probe";
export type BackendCheck = {
    origin: string;
    /** True when the browser let a `traceparent`-bearing request through. */
    allowed: boolean;
    detail: string;
};
export type FetchLike = (input: string, init?: RequestInit) => Promise<{
    status: number;
}>;
/**
 * Decide, from up to three deliberately boring cross-origin GETs, whether this
 * origin can safely be sent `traceparent`.
 *
 * The first probe is the obvious one. The other two exist because of a sharp
 * asymmetry in CORS: a response of `Access-Control-Allow-Headers: *` satisfies a
 * request that sends no credentials, but is *illegal* for one that does. So a
 * single credential-less probe can pass against a backend where propagating
 * would still break the app's real, cookie-bearing requests.
 *
 * Rather than guess, we ask whether credentialed requests reach this origin at
 * all:
 *
 *  1. `traceparent`, no credentials — fails: the header is not allowed. Stop.
 *  2. credentials, no custom header — fails: this origin cannot receive
 *     credentialed requests from this page in the first place (an origin
 *     answering `Access-Control-Allow-Origin: *` cannot, by rule), so the app is
 *     not making any, and there is nothing for propagation to break. Connect.
 *  3. credentials *and* `traceparent` — fails where step 2 passed: credentialed
 *     requests do reach this origin, but not carrying `traceparent`. This is the
 *     wildcard trap, and the only safe answer is to leave the origin alone.
 *
 * Nothing here can distinguish "the preflight was refused" from "the host is
 * unreachable", and both lead to the same decision, so we do not pretend to.
 */
export declare function checkBackend(origin: string, fetchImpl: FetchLike, timeoutMs?: number): Promise<BackendCheck>;
/**
 * Match a whole origin and everything under it. Origins go through `RegExp`
 * rather than a plain string because OpenTelemetry compares string matchers by
 * strict equality against the full request URL, which would only ever match a
 * bare origin with no path.
 */
export declare function originMatcher(origin: string): RegExp;
//# sourceMappingURL=probe.d.ts.map