/**
 * Opportunistic HashiCorp Vault AppRole secret loader.
 *
 * If `NAS_VAULT_ADDR` + `NAS_VAULT_ROLE_ID` + `NAS_VAULT_SECRET_ID` are set in
 * the environment, this module logs in via AppRole, reads a KV v2 secret, and
 * populates mapped keys into `process.env` — but only for env vars that are
 * not already set. This means `process.env` (explicit shell/MCP config) takes
 * precedence over Vault, which in turn takes precedence over `MCP_SECRETS_FILE`.
 *
 * Fully backwards compatible: if `NAS_VAULT_ADDR` is unset the loader is a
 * silent no-op. On any Vault error (network, auth, missing path, malformed
 * response) a single-line warning is written to stderr and the caller
 * continues with whatever env vars are already populated — the server will
 * then fail later with its usual "missing required env var" message.
 *
 * Security: secret values are NEVER logged. The KV path name may appear in
 * stderr diagnostics. No runtime dependencies — uses global `fetch` (Node 20+).
 */
export interface VaultLoaderOptions {
    /**
     * KV v2 path to read, e.g. "opnsense/bifrost". The loader will GET
     * `<addr>/v1/<mount>/data/<path>`.
     */
    kvPath: string;
    /**
     * Map of KV secret key → target environment variable name.
     * Only env vars that are currently undefined / empty will be populated.
     */
    mapping: Record<string, string>;
    /** Optional process.env override (for tests). */
    env?: NodeJS.ProcessEnv;
    /** Optional fetch override (for tests). */
    fetchImpl?: typeof fetch;
}
/**
 * Log in via AppRole and fetch a KV v2 secret, populating mapped env vars.
 *
 * Silent no-op unless `NAS_VAULT_ADDR`, `NAS_VAULT_ROLE_ID`, and
 * `NAS_VAULT_SECRET_ID` are all set.
 */
export declare function loadFromVault(options: VaultLoaderOptions): Promise<void>;
//# sourceMappingURL=vault-loader.d.ts.map