/**
 * vetra-secrets-controller — standalone Node service that materializes the
 * env-vars and secrets configured per tenant (encrypted in Postgres,
 * managed via the vetra-cloud-secrets GraphQL subgraph) into Kubernetes
 * `<tenantId>-env` ConfigMaps and `<tenantId>-secrets` Secrets in each
 * tenant namespace.
 *
 * Why a standalone pod (vs. the embedded reconciler that lived in
 * switchboard between commits e98be36 and the restoration this file is
 * part of): the management switchboard's ServiceAccount has no
 * cross-namespace RBAC, so its embedded reconcile loop logged
 * "namespace missing or RBAC not applied; skipping" for every tenant
 * and no env actually received its values. This controller has its own
 * ServiceAccount + ClusterRole that grants get/list/create/update/patch
 * on Secrets and ConfigMaps cluster-wide, and does nothing else.
 *
 * Loop:
 *   1. Startup full sweep — every tenant in the DB gets reconciled once.
 *   2. LISTEN on `vetra_secrets_changed` — every NOTIFY (emitted by the
 *      subgraph mutations) triggers a single-tenant reconcile.
 *   3. Safety-net 5-min full sweep — covers anything missed (dropped
 *      notification, listener reconnect window).
 *   4. SIGTERM/SIGINT shutdown — closes listener, db pool, health
 *      server.
 */
export {};
//# sourceMappingURL=main.d.ts.map