output "alb_dns_name" {
  description = "Public DNS of the ALB. Use this when `domain_name` is empty."
  value       = aws_lb.main.dns_name
}

output "api_url" {
  description = "Control plane URL. When `domain_name` is set, https://api.<domain>; otherwise the ALB DNS over HTTP."
  value       = local.has_domain ? "https://${local.api_fqdn}" : "http://${aws_lb.main.dns_name}"
}

output "data_url" {
  description = "Data plane URL. When `domain_name` is set, https://data.<domain>; otherwise the ALB DNS with /plane path prefix."
  value       = local.has_domain ? "https://${local.data_fqdn}" : "http://${aws_lb.main.dns_name}/plane"
}

output "ecr_control_repository" {
  description = "ECR repository URI for the control plane image. Empty when the stack does not own its ECR (create_ecr_repos=false)."
  value       = var.create_ecr_repos ? aws_ecr_repository.control[0].repository_url : ""
}

output "ecr_plane_repository" {
  description = "ECR repository URI for the data plane image. Empty when the stack does not own its ECR (create_ecr_repos=false)."
  value       = var.create_ecr_repos ? aws_ecr_repository.plane[0].repository_url : ""
}

output "rds_endpoint" {
  description = "RDS Postgres host (internal to the VPC; not publicly reachable)."
  value       = aws_db_instance.main.address
}

output "payloads_bucket" {
  description = "S3 bucket holding archive-tier payloads."
  value       = aws_s3_bucket.payloads.bucket
}

output "vpc_id" {
  description = "Dedicated VPC id."
  value       = aws_vpc.main.id
}

output "ecs_cluster_name" {
  description = "ECS cluster name used for live status checks."
  value       = aws_ecs_cluster.main.name
}

output "control_service_name" {
  description = "Control-plane ECS service name used for live status checks."
  value       = aws_ecs_service.control.name
}

output "plane_service_name" {
  description = "Data-plane ECS service name used for live status checks."
  value       = aws_ecs_service.plane.name
}

output "database_url_secret_arn" {
  description = "Secrets Manager ARN containing the Postgres connection string."
  value       = aws_secretsmanager_secret.database_url.arn
}

output "token_signing_secret_arn" {
  description = "Secrets Manager ARN for the HMAC signing secret shared by both planes."
  value       = aws_secretsmanager_secret.token_signing.arn
}