output "token" {
  description = "Valeur du token Cloudflare"
  value       = cloudflare_account_token.token.value
  sensitive   = true
}

output "token_id" {
  description = "ID du token Cloudflare (sert de Access Key ID pour R2 si bucket défini)"
  value       = cloudflare_account_token.token.id
}

output "token_sha256" {
  description = "SHA-256 du token Cloudflare (sert de Secret Access Key pour R2 si bucket défini)"
  value       = sha256(cloudflare_account_token.token.value)
  sensitive   = true
}

output "r2_credentials" {
  description = "Credentials R2 si bucket configuré (AccessKeyId, SecretAccessKey)"
  value = var.bucket != null ? {
    access_key_id     = cloudflare_account_token.token.id
    secret_access_key = sha256(cloudflare_account_token.token.value)
  } : null
  sensitive = true
}

output "permissions" {
  description = "Liste des permissions introuvables (si existantes)"
  value       = compact(concat(local.selected_account_permissions, local.selected_bucket_permissions))
}

output "resources" {
  description = "Map des resources assignées au token"
  value       = keys(merge(local.account_resource, local.bucket_resource))
}