import { BaseSubgraph } from "@powerhousedao/reactor-api";
import type { DocumentNode } from "graphql";
/**
 * GraphQL surface for tenant env vars + secrets.
 *
 * Reads/writes go through the encrypted Postgres tables; on every write
 * the resolvers `pg_notify('vetra_secrets_changed', tenantId)` so the
 * standalone `secrets-controller` pod (see `/secrets-controller`) can
 * reconcile that tenant's `<tenantId>-env` ConfigMap and
 * `<tenantId>-secrets` Secret in the tenant namespace.
 *
 * History note: between commits e98be36 and the standalone-controller
 * restoration in May 2026, this subgraph also embedded the reconcile
 * loop directly. The management switchboard's ServiceAccount has no
 * cross-namespace RBAC, so every reconcile attempt failed and no
 * tenant ever saw its secrets reach a pod. The reconciler now lives in
 * its own deployment with its own ClusterRole; this subgraph is a
 * pure GraphQL service again.
 */
export declare class VetraCloudSecretsSubgraph extends BaseSubgraph {
    name: string;
    typeDefs: DocumentNode;
    resolvers: Record<string, unknown>;
    additionalContextFields: {};
    onSetup(): Promise<void>;
}
//# sourceMappingURL=index.d.ts.map