/**
 * Doppler CLI delegate. ce never touches Doppler's API or tokens directly —
 * the doppler CLI handles auth (interactive `doppler login` locally,
 * `DOPPLER_TOKEN` env var in CI/VPS) and ce just shells out for the values.
 *
 * One call per build emits a flat key→value map that ce drops into the
 * `secrets.*` namespace. Errors fall into three buckets, each with an
 * actionable message rather than a raw `execSync` ENOENT/exit-1 stack:
 *
 *   - binary missing      → "doppler not installed; brew install ..."
 *   - auth failure        → "doppler login or set DOPPLER_TOKEN"
 *   - config not found    → "no doppler config '<name>' for project '<p>'"
 */
export interface DopplerDownloadOptions {
    /** Doppler project name. Omit to defer to local `.doppler.yaml` or DOPPLER_TOKEN scope. */
    project?: string;
    /** Doppler config name (e.g., "dev_local", "prd_main"). Required when project is set. */
    config: string;
    /** Override the binary path for testing (defaults to `doppler` on PATH). */
    binary?: string;
    /** Inject extra env (used by tests to scope DOPPLER_TOKEN per call). */
    env?: NodeJS.ProcessEnv;
}
export declare class DopplerError extends Error {
    readonly kind: 'missing-binary' | 'auth' | 'config' | 'unknown';
    constructor(message: string, kind: 'missing-binary' | 'auth' | 'config' | 'unknown');
}
/**
 * Shell out to `doppler secrets download` and return the parsed JSON map.
 *
 * Flag choice rationale:
 *   --format json   → predictable parse; --format=docker would also work
 *                     but adds export-statement noise to strip
 *   --no-file       → write to stdout instead of dropping a .env file
 *                     in cwd (we want in-memory, no side effects)
 *   --silent        → suppress doppler's own status output on stderr so
 *                     ce's log isn't cluttered
 */
export declare function dopplerDownload(opts: DopplerDownloadOptions): Record<string, string>;
//# sourceMappingURL=doppler.d.ts.map