serverlessoperator

type Config struct {
	// OperatorName is the operator name the sessions register as.
	OperatorName string

	// LinkName labels metrics with how the core reaches the engine: grpc or engine.
	LinkName string

	DefaultSlots int32
	DurableSlots int32

	// EndpointPartitionCount is the endpoint_partition_count a tenant's v1_serverless_tenant row is
	// created with, in MinEndpointPartitionCount to MaxEndpointPartitionCount. A tenant's endpoints
	// hash over its partition count into lease units, so a count above 1 lets several processes
	// serve one tenant. The row is created by the API server with the tenant's first endpoint and
	// read whenever an endpoint is assigned a partition; a later change to this value applies only
	// to tenants first seen after it, and existing endpoints keep their partition.
	EndpointPartitionCount int32

	// LeaseTTL is how long a process row stays live after a heartbeat.
	LeaseTTL          time.Duration
	HeartbeatInterval time.Duration
	RebalanceInterval time.Duration

	// ShedHysteresis is the fraction above fair share a process tolerates before shedding.
	ShedHysteresis float64

	// DrainTimeout bounds how long in-flight deliveries are awaited when a unit is lost or the
	// process stops.
	DrainTimeout time.Duration

	// RoutingRefreshInterval is the incremental (updated_at based) routing cache refresh
	// cadence; RoutingFullReloadInterval is how often the cache is reconciled against the
	// tenant's endpoint ids and versions (spread by up to ten percent per tenant), which is
	// what drops hard-deleted endpoints.
	RoutingRefreshInterval    time.Duration
	RoutingFullReloadInterval time.Duration

	// HealthcheckTimeout bounds one healthcheck request; HealthcheckConcurrency caps
	// healthchecks process-wide and HealthcheckTenantConcurrency caps them per tenant inside
	// that limit, so one tenant's slow endpoints cannot hold every slot.
	HealthcheckTimeout           time.Duration
	HealthcheckConcurrency       int
	HealthcheckTenantConcurrency int

	// HealthcheckApplyTimeout bounds the application of one changed catalog: the workflow
	// puts, the action delta and the registered_actions write.
	HealthcheckApplyTimeout time.Duration

	// MaxWorkflowsPerEndpoint and MaxActionsPerEndpoint cap what one healthcheck may
	// advertise; a catalog over either cap is refused and the endpoint marked with the error.
	MaxWorkflowsPerEndpoint int
	MaxActionsPerEndpoint   int

	// MaintenanceConcurrency is how many tenants a maintenance pass refreshes at once.
	MaintenanceConcurrency int

	// LeaseMaxClaimPerTick caps how many lease units one rebalance tick claims; the process's
	// share of the claimable units is taken up to this many, in statements of the leaser's
	// claim batch.
	LeaseMaxClaimPerTick int32

	// WSMaxFrameBytes and WSPingInterval configure the durable websocket relay (a later
	// phase); they are carried here so the binary's env binding is complete.
	WSMaxFrameBytes int64
	WSPingInterval  time.Duration

	// HealthPort serves /healthz, /readyz and /metrics. Zero disables the server.
	HealthPort int

	// WSMaxUpgradeHeaderBytes bounds an endpoint's websocket upgrade response head, which is
	// parsed before WSMaxFrameBytes applies.
	WSMaxUpgradeHeaderBytes int64

	// WSMaxQueuedBytes bounds the encoded frames one relay retains for an endpoint that reads
	// slower than the engine answers; crossing it closes the socket with backpressure.
	WSMaxQueuedBytes int64

	// WSMaxStreams caps the engine streams one socket may hold open at once through
	// stream_open frames.
	WSMaxStreams int

	// WSMaxRunsPerStream caps the workflow runs one SubscribeToWorkflowRuns stream opened
	// over a socket may await at once; a subscription past it closes the stream with
	// ResourceExhausted.
	WSMaxRunsPerStream int
}

type Deps struct {
	Repo repository.ServerlessRepository

	// Host opens the engine session of each served tenant.
	Host operator.Host

	// WorkerName names the worker rows the sessions back; empty means the operator name.
	// Only a host that can name workers accepts it (the in-process host does, the gRPC host
	// refuses), so it is set by the engine wiring only.
	WorkerName string

	Encryption encryption.EncryptionService
	Sender     RequestSender
	Logger     *zerolog.Logger
	Version    string
	Hostname   string
	Config     Config
	ProcessId  uuid.UUID
}

type RequestSender interface {
	Deliver(ctx context.Context, method, endpoint string, body []byte, headers http.Header) (*safeclient.DeliveryResult, error)
}