import { n as __exportAll } from "./chunk-YKewjYmz.js";
import { t as gql } from "./lib-CETUvroH.js";
import { n as OpenBaoTransitClient, t as createSecretsService } from "./secrets-service-CgMFc9sS.js";
import { t as up } from "./migrations-CYRGWKah.js";
import { BaseSubgraph } from "@powerhousedao/reactor-api";
//#region subgraphs/vetra-cloud-secrets/schema.ts
const schema = gql`
  type Query {
    envVars(tenantId: String!): [EnvVar!]!
    secrets(tenantId: String!): [SecretEntry!]!
  }

  type Mutation {
    setEnvVar(tenantId: String!, key: String!, value: String!): EnvVar!
    deleteEnvVar(tenantId: String!, key: String!): Boolean!
    setSecret(tenantId: String!, key: String!, value: String!): SecretEntry!
    deleteSecret(tenantId: String!, key: String!): Boolean!
  }

  type EnvVar {
    key: String!
    value: String!
  }

  type SecretEntry {
    key: String!
  }
`;
//#endregion
//#region subgraphs/vetra-cloud-secrets/resolvers.ts
function createResolvers(db, transit) {
	const service = createSecretsService({
		db,
		transit
	});
	return {
		Query: {
			envVars: (_p, { tenantId }) => service.listEnvVars(tenantId),
			secrets: (_p, { tenantId }) => service.listSecretKeys(tenantId)
		},
		Mutation: {
			setEnvVar: (_p, { tenantId, key, value }) => service.setEnvVar(tenantId, key, value),
			deleteEnvVar: (_p, { tenantId, key }) => service.deleteEnvVar(tenantId, key),
			setSecret: (_p, { tenantId, key, value }) => service.setSecret(tenantId, key, value),
			deleteSecret: (_p, { tenantId, key }) => service.deleteSecret(tenantId, key)
		}
	};
}
//#endregion
//#region subgraphs/vetra-cloud-secrets/index.ts
var vetra_cloud_secrets_exports = /* @__PURE__ */ __exportAll({ VetraCloudSecretsSubgraph: () => VetraCloudSecretsSubgraph });
const DEFAULT_ROLE = "vetra-secrets";
/**
* GraphQL surface for tenant env vars + secrets.
*
* Reads/writes go through the encrypted Postgres tables; on every write
* the resolvers `pg_notify('vetra_secrets_changed', tenantId)` so the
* standalone `secrets-controller` pod (see `/secrets-controller`) can
* reconcile that tenant's `<tenantId>-env` ConfigMap and
* `<tenantId>-secrets` Secret in the tenant namespace.
*
* History note: between commits e98be36 and the standalone-controller
* restoration in May 2026, this subgraph also embedded the reconcile
* loop directly. The management switchboard's ServiceAccount has no
* cross-namespace RBAC, so every reconcile attempt failed and no
* tenant ever saw its secrets reach a pod. The reconciler now lives in
* its own deployment with its own ClusterRole; this subgraph is a
* pure GraphQL service again.
*/
var VetraCloudSecretsSubgraph = class extends BaseSubgraph {
	name = "vetra-cloud-secrets";
	typeDefs = schema;
	resolvers = {};
	additionalContextFields = {};
	async onSetup() {
		const db = await this.relationalDb.createNamespace("vetra-cloud-secrets");
		await up(db);
		const openbaoAddr = process.env.OPENBAO_ADDR;
		if (!openbaoAddr) throw new Error("[secrets] OPENBAO_ADDR is required — secrets cannot be encrypted without transit engine access");
		this.resolvers = createResolvers(db, new OpenBaoTransitClient({
			addr: openbaoAddr,
			role: process.env.OPENBAO_TRANSIT_ROLE ?? DEFAULT_ROLE,
			keyNamePrefix: process.env.OPENBAO_TRANSIT_KEY_PREFIX
		}));
	}
};
//#endregion
export { vetra_cloud_secrets_exports as n, VetraCloudSecretsSubgraph as t };

//# sourceMappingURL=vetra-cloud-secrets-BQjSbdg0.js.map