# Outputs are the handoff to the runbook and to CI. Each one exists because something outside
# Terraform needs it; nothing is here just because it was available.

output "official_url" {
  description = "Where the official endpoint answers before DNS exists. Announce nothing until the security review."
  value       = "http://${aws_lb.official.dns_name}/mcp"
}

output "poc_url" {
  description = <<-EOT
    Where the partner POC answers. This is the value that replaces the Fly URL in the Workato
    connector, and the swap happens together with the bearer token in ONE change.
  EOT
  value       = "http://${aws_lb.poc.dns_name}/mcp"
}

output "deploy_role_arn" {
  description = "Assumed by GitHub Actions over OIDC. Goes in the workflow, not in a secret: it is an identifier, not a credential."
  value       = aws_iam_role.deploy.arn
}

output "ecr_repository_urls" {
  description = "Push targets for CI."
  value       = { for k, r in aws_ecr_repository.this : k => r.repository_url }
}

output "ecs_cluster_name" {
  value = aws_ecs_cluster.main.name
}

output "ecs_service_names" {
  description = "For `aws ecs update-service` in CI and for scaling staging by hand."
  value = {
    official_prod = aws_ecs_service.official_prod.name
    staging       = aws_ecs_service.staging.name
    poc           = aws_ecs_service.poc.name
  }
}

output "log_groups" {
  description = "Where to read when something is wrong."
  value       = { for k, g in aws_cloudwatch_log_group.service : k => g.name }
}

output "secret_names" {
  description = <<-EOT
    Containers created by this stack. VALUES are set outside Terraform, by hand, so that nothing
    sensitive enters state. Every one of these starts as a visible placeholder and the service will
    refuse to start until it holds a real value.
  EOT
  value       = sort(keys(local.secrets))
}