# SecureString parameters, KMS-encrypted with the AWS-managed alias/aws/ssm key.
# The secret VALUES are intentionally not in Terraform: each is set once,
# out of band, and Terraform ignores later value drift so plaintext never
# enters state:
#
#   aws ssm put-parameter --name /quber/ANTHROPIC_API_KEY \
#     --type SecureString --value '<key>' --overwrite
#   aws ssm put-parameter --name /quber/LOGFIRE_TOKEN \
#     --type SecureString --value '<token>' --overwrite
#   aws ssm put-parameter --name /quber/CC_LANGSMITH_API_KEY \
#     --type SecureString --value '<key>' --overwrite
#   aws ssm put-parameter --name /quber/ADE_API_KEY \
#     --type SecureString --value '<key>' --overwrite
#   aws ssm put-parameter --name /quber/TYPESAFE_API_KEY \
#     --type SecureString --value '<key>' --overwrite

resource "aws_ssm_parameter" "anthropic_api_key" {
  name  = "/quber/ANTHROPIC_API_KEY"
  type  = "SecureString"
  value = "REPLACE_ME"

  lifecycle {
    ignore_changes = [value]
  }
}

resource "aws_ssm_parameter" "logfire_token" {
  name  = "/quber/LOGFIRE_TOKEN"
  type  = "SecureString"
  value = "REPLACE_ME"

  lifecycle {
    ignore_changes = [value]
  }
}

# RunPod API key for the parse endpoint. Read at runtime by the trigger and
# join Lambdas (ssm:GetParameter), not injected into any task definition.
resource "aws_ssm_parameter" "runpod_api_key" {
  name  = "/quber/RUNPOD_API_KEY"
  type  = "SecureString"
  value = "REPLACE_ME"

  lifecycle {
    ignore_changes = [value]
  }
}

# LangSmith API key for the structured-extraction tracer. Tracing also requires
# the TRACE_TO_LANGSMITH flag and the CC_LANGSMITH_PROJECT name, which are not
# secret and are set as plaintext task-definition environment in ecs.tf.
resource "aws_ssm_parameter" "langsmith_api_key" {
  name  = "/quber/CC_LANGSMITH_API_KEY"
  type  = "SecureString"
  value = "REPLACE_ME"

  lifecycle {
    ignore_changes = [value]
  }
}

# Landing.AI ADE parse key for the standalone chart / rasterized-page
# extraction path. Not injected into any task definition yet. The parameter
# was created out of band before this resource existed, so a first apply
# needs: terraform import aws_ssm_parameter.ade_api_key /quber/ADE_API_KEY
resource "aws_ssm_parameter" "ade_api_key" {
  name  = "/quber/ADE_API_KEY"
  type  = "SecureString"
  value = "REPLACE_ME"

  lifecycle {
    ignore_changes = [value]
  }
}

# TypeSafe scoring API key for the playground's Jev chunk ranker. Injected
# into the playground task definition as TYPESAFE_API_KEY so switching the
# ranker on is a settings change alone.
resource "aws_ssm_parameter" "typesafe_api_key" {
  name  = "/quber/TYPESAFE_API_KEY"
  type  = "SecureString"
  value = "REPLACE_ME"

  lifecycle {
    ignore_changes = [value]
  }
}

# Playground database password. Set out of band before the first apply, then
# rotated onto the instance (see rds.tf). Injected into the playground task
# definition as POSTGRES_PASSWORD.
resource "aws_ssm_parameter" "postgres_password" {
  name  = "/quber/POSTGRES_PASSWORD"
  type  = "SecureString"
  value = "REPLACE_ME"

  lifecycle {
    ignore_changes = [value]
  }
}