output "buckets" {
  description = "GCS buckets that receive extracted Parquet, manifests, and runtime logs."
  value = {
    for name, bucket in google_storage_bucket.extract : name => bucket.url
  }
}

output "default_pipeline_image" {
  description = "Default Artifact Registry image URI used by Cloud Run when var.pipeline_image is null."
  value       = local.pipeline_image
}

output "bigquery_datasets" {
  description = "BigQuery datasets provisioned per source and layer."
  value = {
    for key, dataset in google_bigquery_dataset.datasets : key => dataset.dataset_id
  }
}

output "cloud_run_extract_jobs" {
  description = "Cloud Run extract job names. Credentialed extract jobs are listed only when enabled_credentialed_extract_sources includes the source."
  value = {
    for name, job in google_cloud_run_v2_job.extract : name => job.name
  }
}

output "cloud_run_load_jobs" {
  description = "Cloud Run load job names."
  value = {
    for name, job in google_cloud_run_v2_job.load : name => job.name
  }
}

output "cloud_run_pipeline_jobs" {
  description = "Combined extract-and-load Cloud Run job names."
  value = {
    for name, job in google_cloud_run_v2_job.pipeline : name => job.name
  }
}

output "source_dsn_secret_names" {
  description = "DSN secrets for sources that connect directly to MySQL-compatible databases."
  value = {
    for name, source in local.dsn_sources : name => google_secret_manager_secret.tidb_source_dsn[name].secret_id
  }
}

output "tidb_secret_names" {
  description = "Secrets that need user-supplied versions for TiDB Cloud sources. The GCS writer key is generated by Terraform."
  value = {
    for name, source in local.tidbcloud_sources : name => {
      source_dsn  = google_secret_manager_secret.tidb_source_dsn[name].secret_id
      public_key  = google_secret_manager_secret.tidb_public_key[name].secret_id
      private_key = google_secret_manager_secret.tidb_private_key[name].secret_id
      gcs_key     = google_secret_manager_secret.tidb_gcs_writer_key[name].secret_id
    }
  }
}

output "github_workload_identity_provider" {
  description = "Value for the GitHub repo secret GCP_WORKLOAD_IDENTITY_PROVIDER."
  value       = google_iam_workload_identity_pool_provider.github.name
}

output "github_deployer_service_account" {
  description = "Value for the GitHub repo secret GCP_DEPLOY_SERVICE_ACCOUNT."
  value       = google_service_account.deployer.email
}

output "month_end_arr_outbound_job" {
  description = "Cloud Run Job that writes Month End ARR records into NexusCRM."
  value       = try(google_cloud_run_v2_job.month_end_arr_outbound[0].name, null)
}

output "outbound_runtime_service_account" {
  description = "Service account to grant Viewer access when a source table is backed by a Google Sheet."
  value       = google_service_account.outbound_runtime.email
}

output "nexuscrm_outbound_secret_names" {
  description = "Secrets that require user-supplied Connected App credential versions before validation or writes."
  value = {
    project       = local.outbound_secret_project
    client_id     = local.outbound_client_id_secret
    client_secret = local.outbound_client_secret_secret
  }
}

output "netsuite_revenue_nexuscrm_api_job" {
  description = "Separate NexusCRM API resources. Null/empty by default; this target is intentionally absent from the ordinary main deploy allowlist."
  value = {
    job              = try(google_cloud_run_v2_job.netsuite_revenue_to_nexuscrm[0].name, null)
    scheduler        = try(google_cloud_scheduler_job.netsuite_revenue_to_nexuscrm[0].name, null)
    runtime_identity = try(google_service_account.netsuite_revenue_runtime[0].email, null)
    candidate_bucket = try(google_storage_bucket.netsuite_revenue_candidate[0].url, null)
    secret_names     = { for name, secret in google_secret_manager_secret.netsuite_revenue_api : name => secret.secret_id }
  }
}