locals {
  # SSE algorithm: KMS when a CMK ARN is supplied, else AES256 (SSE-S3).
  # This is the default the adapter previously hardcoded (adapter.py:225-228, 289-297).
  sse_algorithm = var.kms_key_arn != null ? "aws:kms" : "AES256"

  # Tags: merge caller-supplied tags with the module defaults.
  tags = merge(
    {
      "acdl:owner"       = "acdl"
      "acdl:environment" = "dev"
    },
    var.tags
  )
}