/**
 * Opportunistic HashiCorp Vault AppRole secret loader.
 *
 * Reads PostgreSQL credentials from a Vault KV v2 path using AppRole auth.
 * Only runs if NAS_VAULT_ADDR, NAS_VAULT_ROLE_ID, and NAS_VAULT_SECRET_ID
 * are all set in the environment.
 *
 * If Vault is unreachable or credentials are wrong, the loader fails silently
 * (logs a warning to stderr) and falls back to whatever environment variables
 * are already set. This is intentional — the MCP server should still start
 * even without Vault connectivity.
 *
 * Usage in index.ts:
 *   await loadFromVault({
 *     kvPath: "postgres/nas-keycloak",
 *     mapping: {
 *       connection_string: "POSTGRES_CONNECTION_STRING",
 *       host: "PGHOST",
 *       port: "PGPORT",
 *       user: "PGUSER",
 *       password: "PGPASSWORD",
 *       database: "PGDATABASE",
 *     },
 *   });
 */
export interface VaultLoaderOptions {
    kvPath: string;
    mapping: Record<string, string>;
    env?: NodeJS.ProcessEnv;
    fetchImpl?: typeof fetch;
}
export declare function loadFromVault(options: VaultLoaderOptions): Promise<void>;
//# sourceMappingURL=vault-loader.d.ts.map