namespace ZB.MOM.WW.MxGateway.Server.Configuration;

public sealed class WorkerOptions
{
    /// <summary>The path to the worker executable.</summary>
    public string ExecutablePath { get; init; } =
        @"src\ZB.MOM.WW.MxGateway.Worker\bin\x86\Release\ZB.MOM.WW.MxGateway.Worker.exe";

    /// <summary>The working directory for the worker process, or null to inherit.</summary>
    public string? WorkingDirectory { get; init; }

    /// <summary>The required processor architecture for the worker.</summary>
    public WorkerArchitecture RequiredArchitecture { get; init; } = WorkerArchitecture.X86;

    /// <summary>The maximum time in seconds for the worker to start.</summary>
    public int StartupTimeoutSeconds { get; init; } = 30;

    /// <summary>The number of retry attempts for the startup probe.</summary>
    public int StartupProbeRetryAttempts { get; init; } = 3;

    /// <summary>The delay in milliseconds between startup probe retries.</summary>
    public int StartupProbeRetryDelayMilliseconds { get; init; } = 250;

    /// <summary>The timeout in milliseconds for connecting to the worker pipe.</summary>
    public int PipeConnectAttemptTimeoutMilliseconds { get; init; } = 2000;

    /// <summary>
    /// Bounded wait, in milliseconds, the worker holds a WriteSecured/WriteSecured2
    /// reply for the matching MXAccess OnWriteComplete callback so the reply's
    /// statuses carry the real commit outcome. 0 disables the wait. Deployments
    /// raising this above consumer write-timeout budgets (e.g. OtOpcUa's 2 s Tier A
    /// write resilience timeout) must raise those in step.
    /// </summary>
    public int WriteCompletionWaitMilliseconds { get; init; } = 1500;

    /// <summary>
    ///     Capacity of the worker's outbound MXAccess event queue, in events.
    ///     Default 10,000; must be between 1,000 and 1,000,000. This is
    ///     headroom, not a throttle: the queue has no drop policy, so a burst
    ///     that fills it faults the session with a <c>QueueOverflow</c> worker
    ///     fault. Raise it for sessions whose subscription set can outrun the
    ///     drain loop (large advise sets, slow event consumers). Conveyed to
    ///     the worker through the <c>MXGATEWAY_EVENT_QUEUE_CAPACITY</c>
    ///     environment variable.
    /// </summary>
    public int EventQueueCapacity { get; init; } = 10000;

    /// <summary>The maximum time in seconds for graceful shutdown.</summary>
    public int ShutdownTimeoutSeconds { get; init; } = 10;

    /// <summary>The interval in seconds for worker heartbeats.</summary>
    public int HeartbeatIntervalSeconds { get; init; } = 5;

    /// <summary>The grace period in seconds after a heartbeat before considering the worker unresponsive.</summary>
    public int HeartbeatGraceSeconds { get; init; } = 15;

    /// <summary>
    /// The maximum worker-frame (pipe) message size in bytes. Must stay at least
    /// <see cref="Workers.WorkerFrameProtocolOptions.EnvelopeOverheadReserveBytes"/> above
    /// <see cref="ProtocolOptions.MaxGrpcMessageBytes"/> so a maximally-sized accepted gRPC payload
    /// still fits one worker frame; the gateway conveys this value to the worker in the
    /// handshake (<c>GatewayHello.max_frame_bytes</c>). Default is the 16 MB public gRPC cap
    /// plus that reserve.
    /// </summary>
    public int MaxMessageBytes { get; init; } =
        (16 * 1024 * 1024) + Workers.WorkerFrameProtocolOptions.EnvelopeOverheadReserveBytes;
}