/**
 * Minimal structural view of the `node-vault` client's KV read: it returns
 * `{ data: ... }` (KV v1) or `{ data: { data: ... } }` (KV v2). Kept as an
 * interface so tests inject a fake and neither `node-vault` nor a real
 * Vault/VPN is needed. `read` returns `unknown` so callers narrow structurally
 * (no `as` cast at the boundary).
 */
export interface VaultReader {
    read(secretPath: string): Promise<unknown>;
}
export interface ResolveE2EPasswordOptions {
    /** Process env to read (env-first precedence). Defaults to `process.env`. */
    env?: NodeJS.ProcessEnv;
    /**
     * Vault client factory (local path). Returns `undefined` when Vault can't be
     * reached/authenticated (e.g. no `~/.vault-token`). Defaults to a `node-vault`
     * client using the local token, matching `libs/server/vault`.
     */
    createVault?: (env: NodeJS.ProcessEnv) => Promise<VaultReader | undefined>;
}
/**
 * Clears the in-memory resolved-password cache. The cache is a module-level
 * singleton that lives for the whole process, so a resolved value would
 * otherwise leak across calls (and across test cases). Call this between tests
 * to keep each `resolveE2EPassword` call independent.
 */
export declare const resetE2EPasswordCache: () => void;
/**
 * Resolves an account's E2E password by name.
 *
 * Order: env variable `E2E_PW_<SLUG>` (CI path, never touches Vault) -> Vault
 * field `<slug>` (local path). Throws a clear, account-named, redacted error on
 * miss. The password is never included in any error/diagnostic (on failure there
 * is no resolved value to leak).
 *
 * @param username - Account identifier from the fixture (`auth.json` `username`).
 * @param options - Process env and Vault-client seams.
 * @returns {Promise<string>} The resolved password.
 * @throws when the fixture is a placeholder, or neither env nor Vault yields a value.
 */
export declare const resolveE2EPassword: (username: string, options?: ResolveE2EPasswordOptions) => Promise<string>;