/**
 * Opportunistic HashiCorp Vault AppRole secret loader.
 *
 * Reads Proxmox API credentials from a Vault KV v2 path using AppRole auth.
 * Only runs if NAS_VAULT_ADDR, NAS_VAULT_ROLE_ID, and NAS_VAULT_SECRET_ID
 * are all set in the environment.
 *
 * If Vault is unreachable or credentials are wrong, the loader fails silently
 * (logs a warning to stderr) and falls back to whatever environment variables
 * are already set. This is intentional — the MCP server should still start
 * even without Vault connectivity.
 *
 * Usage in index.ts:
 *   await loadFromVault({
 *     kvPath: "mcp-proxmox/config",
 *     mapping: {
 *       url: "PROXMOX_API_URL",
 *       token_id: "PROXMOX_TOKEN_ID",
 *       token_secret: "PROXMOX_TOKEN_SECRET",
 *     },
 *   });
 */
export interface VaultLoaderOptions {
    kvPath: string;
    mapping: Record<string, string>;
    env?: NodeJS.ProcessEnv;
    fetchImpl?: typeof fetch;
}
export declare function loadFromVault(options: VaultLoaderOptions): Promise<void>;
//# sourceMappingURL=vault-loader.d.ts.map