/**
 * The fetch half of the connector: credentials, pagination, and what went
 * missing.
 *
 * The transformation lives in `@trazum/core`, where it is testable without a
 * network. This module does the part that touches the outside world, and it
 * is written under three rules the rest of the product does not need:
 *
 * **A credential is borrowed, never held.** Keys are read from the environment
 * at the moment of the call and never written to a config, a cache, a report
 * or an error message. `redact` runs over everything that can reach a terminal
 * — a key pasted into a CI log by an error handler is a key that has to be
 * rotated, and the tool that leaked it is the tool that promised to save money.
 *
 * **The endpoint is not user-supplied.** Each provider has one fixed base URL
 * compiled in. Trazum's SSRF story has been, since 1.14, that a request body
 * must never *name* a host — it selects one. A usage connector that accepted
 * `--base-url` would hand that property back for the convenience of a
 * self-hosted proxy nobody has asked for yet.
 *
 * **A partial pull is a partial pull, out loud.** Rate limits, page caps and
 * windows the provider has aged out all return what was gathered, with the
 * gap named. A bill quietly short by an unknown amount is the failure this
 * repository refuses everywhere it can occur, and a paginated API is exactly
 * where it occurs.
 */
import type { ConnectorDescriptor, ConnectorPull } from '@trazum/core';
export interface CredentialSource {
    /** The environment variable the key came from — the *name*, never the value. */
    variable: string;
}
/**
 * Finds the credential without ever returning it to a caller that might print
 * it: the key stays inside this module, and the caller gets the variable name.
 */
export declare function findCredential(descriptor: ConnectorDescriptor, env: Record<string, string | undefined>): {
    key: string;
    source: CredentialSource;
} | null;
/**
 * Removes credential material from anything on its way to a terminal.
 *
 * Two layers on purpose. The exact key is redacted because we hold it; the
 * shapes are redacted because an error body may quote a *different* key —
 * the one the caller mistyped, a key from a proxy's log line — and a leak
 * through somebody else's error message is still a leak through Trazum's
 * output.
 */
export declare function redact(text: string, key?: string): string;
export interface FetchUsageOptions {
    descriptor: ConnectorDescriptor;
    fromMs: number;
    toMs: number;
    env: Record<string, string | undefined>;
    /** Injected so the whole path is testable without a network. */
    fetchImpl?: typeof fetch;
}
export interface FetchUsageResult {
    pull: ConnectorPull;
    source: CredentialSource;
    pages: number;
}
/**
 * Pulls a window of usage, page by page, and reports what it could not get.
 *
 * Returns whatever was gathered when a page fails partway through: half a
 * month with the gap named beats an exception that throws away the half that
 * arrived, and beats a total that silently describes less traffic than the
 * caller asked about.
 */
export declare function fetchProviderUsage(options: FetchUsageOptions): Promise<FetchUsageResult>;
//# sourceMappingURL=connect.d.ts.map