output "session" {
  description = "Resolved cp9 session identity and AWS account scope."
  value = {
    account_id   = data.aws_caller_identity.current.account_id
    owner        = local.owner
    persona      = local.persona
    region       = local.target_region
    session_name = local.session_name
  }
}

output "tags" {
  description = "Common tags applied to taggable substrate resources."
  value       = local.common_tags
}

output "developer_role" {
  description = "cp9 developer role contract enforced by this substrate."
  value = {
    boundary_policy_arn = data.aws_iam_role.developer.permissions_boundary
    role_arn            = data.aws_iam_role.developer.arn
    role_name           = data.aws_iam_role.developer.name
  }
}

output "iam" {
  description = "Typed IAM output contract consumed by cp9 substrate_apply."
  value = local.iam_enabled ? {
    role_arn            = aws_iam_role.workload[0].arn
    role_name           = aws_iam_role.workload[0].name
    dataplane_role_arn  = local.premium_dataplane_role_enabled ? aws_iam_role.dataplane_manager[0].arn : null
    dataplane_role_name = local.premium_dataplane_role_enabled ? aws_iam_role.dataplane_manager[0].name : null
  } : null
}

output "remote_ec2_runtime" {
  description = "Session-owned EC2 instance-profile identity for the remote k3d control plane."
  value = local.remote_ec2_k3d_enabled ? {
    enabled               = true
    role_arn              = aws_iam_role.remote_runtime[0].arn
    role_name             = aws_iam_role.remote_runtime[0].name
    instance_profile_arn  = aws_iam_instance_profile.remote_runtime[0].arn
    instance_profile_name = aws_iam_instance_profile.remote_runtime[0].name
    power_policy_arn      = local.developer_power_policy_arn
    boundary_policy_arn   = local.developer_boundary_policy_arn
  } : null
}

output "o11y_platform_storage" {
  description = "Session-owned object storage required by the released O11Y regional server."
  value = local.o11y_platform_enabled ? {
    bucket = aws_s3_bucket.o11y_platform[0].bucket
    region = local.target_region
  } : null
}

output "metering" {
  description = "Session-owned Premium metering object storage and IAM contract."
  value = local.premium_metering_enabled ? {
    bucket              = aws_s3_bucket.metering[0].bucket
    read_write_role_arn = aws_iam_role.metering_read_write[0].arn
    writer_role_arn     = aws_iam_role.metering_writer[0].arn
  } : null
}

output "metadb" {
  description = "Typed metadb output contract consumed by cp9 metadb_seed."
  value = local.metadb_enabled ? {
    endpoint   = local.metadb_host
    port       = local.metadb_port
    database   = local.metadb_database
    user       = local.metadb_user
    secret_ref = aws_secretsmanager_secret.metadb[0].arn
  } : null
}

output "account_config_secret" {
  description = "Session account-service config secret consumed by the account server.secret startup fetch."
  value = local.metadb_enabled ? {
    name       = aws_secretsmanager_secret.account[0].name
    secret_ref = aws_secretsmanager_secret.account[0].arn
  } : null
}

output "iam_role_arn" {
  description = "Compatibility scalar IAM role ARN output."
  value       = local.iam_enabled ? aws_iam_role.workload[0].arn : null
}

output "iam_role_name" {
  description = "Compatibility scalar IAM role name output."
  value       = local.iam_enabled ? aws_iam_role.workload[0].name : null
}

output "dataplane_role_arn" {
  description = "Compatibility scalar Premium dataplane manager role ARN output."
  value       = local.premium_dataplane_role_enabled ? aws_iam_role.dataplane_manager[0].arn : null
}

output "dataplane_role_name" {
  description = "Compatibility scalar Premium dataplane manager role name output."
  value       = local.premium_dataplane_role_enabled ? aws_iam_role.dataplane_manager[0].name : null
}

output "metadb_endpoint" {
  description = "Compatibility scalar metadb endpoint output."
  value       = local.metadb_enabled ? local.metadb_host : null
}

output "metadb_port" {
  description = "Compatibility scalar metadb port output."
  value       = local.metadb_enabled ? local.metadb_port : null
}

output "metadb_database" {
  description = "Compatibility scalar metadb database output."
  value       = local.metadb_enabled ? local.metadb_database : null
}

output "metadb_user" {
  description = "Compatibility scalar metadb user output."
  value       = local.metadb_enabled ? local.metadb_user : null
}

output "metadb_secret_ref" {
  description = "Compatibility scalar metadb secret reference output."
  value       = local.metadb_enabled ? aws_secretsmanager_secret.metadb[0].arn : null
}

output "provider_credential_secret_names" {
  description = "Provider credential secret names cp9 can materialize into app-delivery patches."
  value       = var.provider_credential_secret_names
}

output "secret_refs" {
  description = "Named AWS secret references emitted by the substrate."
  value = local.metadb_enabled ? {
    metadb  = aws_secretsmanager_secret.metadb[0].arn
    account = aws_secretsmanager_secret.account[0].arn
  } : {}
}

output "runtime_patch_inputs" {
  description = "Compact object cp9 can translate into generated app-delivery/Tilt patch inputs."
  value = {
    aws = {
      account_id                 = data.aws_caller_identity.current.account_id
      dataplane_accounts         = local.dataplane_accounts
      dataplane_role_arn         = local.premium_dataplane_role_enabled ? aws_iam_role.dataplane_manager[0].arn : null
      session_product_pca_arn    = local.session_product_pca_enabled ? aws_acmpca_certificate_authority.session_product[0].arn : null
      session_product_pca_region = local.session_product_pca_enabled ? local.target_region : null
      profile                    = local.aws_profile
      region                     = local.target_region
      source_ecr_account_id      = local.source_ecr_account_id
      source_ecr_profile         = local.source_ecr_profile
      source_ecr_region          = local.source_ecr_region
      source_profile             = local.aws_source_profile
      workload_role_arn          = local.iam_enabled ? aws_iam_role.workload[0].arn : null
    }
    metadb = local.metadb_enabled ? {
      database             = local.metadb_database
      host                 = local.metadb_host
      password_secret_name = aws_secretsmanager_secret.metadb[0].name
      port                 = local.metadb_port
      username             = local.metadb_user
    } : null
    tags = local.common_tags
  }
}

output "session_cmk" {
  description = "Session-scoped KMS key every service uses to encrypt and decrypt control plane secrets."
  value = {
    arn    = aws_kms_key.session_cmk.arn
    region = local.target_region
  }
}

output "session_product_pca" {
  description = "Session-scoped ACM PCA used by every product line."
  value = local.session_product_pca_enabled ? {
    arn    = aws_acmpca_certificate_authority.session_product[0].arn
    region = local.target_region
  } : null
}

output "dedicated_public_dns" {
  description = "Session-scoped public DNS contract used by Dedicated SQL endpoints."
  value = {
    zone_id = data.aws_route53_zone.cp9.zone_id
    domain  = "${local.session_name}.${trimsuffix(data.aws_route53_zone.cp9.name, ".")}"
  }
}

output "cluster_certificates_storage" {
  description = "Session-scoped object storage used to distribute the common product CA."
  value = local.persona == "premium" ? {
    bucket = aws_s3_bucket.cluster_certificates_storage[0].bucket
    region = local.target_region
  } : null
}

output "starter_serverless_storage" {
  description = "Session-scoped object storage used by Premium Starter TiKV CSE/DFS substrate."
  value = local.starter_remote_eks_enabled ? {
    bucket = aws_s3_bucket.starter_serverless_storage[0].bucket
    prefix = local.starter_serverless_storage_prefix
    region = local.target_region
  } : null
}

output "starter_meta_plane" {
  description = "Shared Dev Full metadb connection and KMS contracts used by the real Starter meta and audit paths."
  value = local.starter_remote_eks_enabled ? {
    rds_secret_arn       = aws_secretsmanager_secret.starter_meta_database["audit"].arn
    infra_rds_secret_arn = aws_secretsmanager_secret.starter_meta_database["infra"].arn
    audit_kms_alias_arn  = aws_kms_alias.starter_audit_log[0].arn
    audit_key_ciphertext = data.aws_kms_ciphertext.starter_audit_log_key[0].ciphertext_blob
    cse_master_key_id    = aws_kms_alias.starter_cse[0].name
    cse_key_ciphertext   = data.aws_kms_ciphertext.starter_cse_master_key[0].ciphertext_blob
    cse_key_vendor       = "aws"
  } : null
  sensitive = true
}

output "remote_eks" {
  description = "Typed remote regional EKS substrate output consumed by Premium Starter."
  value = local.starter_remote_eks_enabled ? {
    enabled                    = true
    account_id                 = data.aws_caller_identity.current.account_id
    region                     = local.target_region
    cluster_name               = aws_eks_cluster.starter_remote[0].name
    cluster_arn                = aws_eks_cluster.starter_remote[0].arn
    endpoint                   = aws_eks_cluster.starter_remote[0].endpoint
    certificate_authority_data = aws_eks_cluster.starter_remote[0].certificate_authority[0].data
    kubeconfig_context         = aws_eks_cluster.starter_remote[0].name
    runtime_role_arn           = aws_iam_role.starter_remote_workload[0].arn
    vpc_id                     = aws_vpc.starter_remote[0].id
    node_subnet_ids            = aws_subnet.starter_remote[*].id
    endpoint_security_group_id = aws_security_group.starter_private_link_endpoint[0].id
    node_groups                = local.starter_remote_eks_node_groups
    private_link_discovery = {
      subnet_tag_key               = "type"
      subnet_tag_value             = "private"
      endpoint_security_group_name = aws_security_group.starter_private_link_endpoint[0].name
    }
  } : null
}

output "o11y_stub" {
  description = "Typed AWS-hosted o11y stub output consumed by Premium Starter."
  value = local.starter_o11y_stub_enabled ? {
    enabled        = true
    endpoint_url   = aws_lambda_function_url.starter_o11y_stub[0].function_url
    token          = random_password.starter_o11y_token[0].result
    evidence_table = aws_dynamodb_table.starter_o11y_evidence[0].name
    script_hash    = sha256(local.starter_o11y_stub_script)
  } : null
  sensitive = true
}

output "starter_source_image_repositories" {
  description = "Session-scoped ECR repository URLs for Starter remote source images."
  value = {
    for name, repo in aws_ecr_repository.starter_source : name => repo.repository_url
  }
}

output "starter_infra_cluster_table" {
  description = "Session-scoped DynamoDB table used by Premium Starter regional manager."
  value       = local.starter_infra_cluster_enabled ? aws_dynamodb_table.starter_infra_cluster[0].name : null
}

output "starter_cluster_queue_url" {
  description = "Session-scoped SQS queue URL used by Premium Starter regional manager cluster events."
  value       = local.starter_infra_cluster_enabled ? aws_sqs_queue.starter_cluster[0].url : null
}