/**
 * Fail-fast guard against 1Password Secrets Injector misses.
 *
 * The injector is a mutating webhook with failurePolicy: Ignore, so a pod that
 * reschedules while the webhook is briefly unavailable starts WITHOUT the
 * `op run` wrapper. Its op:// secret refs are then never resolved and reach the
 * app as the literal string "op://vault/item/field" — Postgres rejects auth,
 * keys fail to parse, etc., while the pod itself looks Running. The only signal
 * has historically been downstream errors/pages (hit cron-server, relayer, and
 * admin in prod multiple times). Diagnose an individual pod with:
 *   kubectl exec <pod> -- sh -c 'tr "\0" " " </proc/1/cmdline'
 * (injected iff PID1 is `/op/bin/op run -- <cmd>`; printenv is NOT reliable
 * because `op run` resolves refs per-process).
 *
 * Call this right after config/env load with the required secrets. If any is
 * still an unresolved op:// ref we log the offending keys and exit(1) so the
 * pod CrashLoops visibly (and alertably) instead of serving broken. Fix is a
 * `kubectl rollout restart` once the injector is back — NOT flipping the
 * webhook to failurePolicy: Fail, which would block all scheduling while the
 * injector is down (worse availability tradeoff).
 *
 * Pass a name -> value map so the log names exactly which keys were missed.
 * Non-string values are ignored (convict's keypair/pubkey formats already throw
 * on an op:// ref at coercion time, so they self-guard).
 */
export declare function assertNoUnresolvedSecrets(secrets: Record<string, unknown>): void;
//# sourceMappingURL=assertSecrets.d.ts.map