<?php
/**
 * BaseCloud Boost — Default Configuration
 *
 * Returns the full default options array.
 * This file is included by Activator to seed first-run defaults.
 *
 * @package BaseCloud\Boost
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

return [
	// ── Page Cache ────────────────────────────────────────────────────────────
	'cache_enabled'         => true,
	'cache_lifetime'        => 604800,   // 7 days. Freshness comes from event-driven purging (save_post, menus, theme, builder saves…), not from expiry — a long TTL only affects pages where NOTHING changed, and avoids needless re-misses every 24h. Existing saved values are never migrated.
	'cache_mobile_separate' => false,    // Separate cache for mobile devices — only needed for a separate mobile theme/AMP; responsive themes should leave this off (one cache per URL = higher hit rate)
	'cache_logged_in'       => false,    // Never cache logged-in users
	'cache_query_strings'   => false,    // Avoid caching dynamic query-string requests
	'exclude_urls'          => '',       // Newline-separated URL patterns
	'exclude_cookies'       => '',       // Newline-separated cookie names
	'cache_warm_on_purge'   => true,     // Re-warm single URL immediately after targeted purge

	// ── Cache Variance (per-visitor cached variants) ──────────────────────────
	// Fixes "wrong currency / wrong country content" on cached pages. Instead of
	// one frozen HTML file per URL, Boost can store a separate cached variant per
	// country and per cookie value, so geolocation/currency switching keeps working
	// while the page is still served from cache. See includes/Core/Cache_Context.php.
	'cache_vary_by_country' => false,    // Store a separate cached page per visitor country
	'vary_cookies'          => '',       // Newline-separated cookie names that create cache variants (e.g. currency/geo cookies)

	// ── File Optimization ─────────────────────────────────────────────────────
	'minify_html'           => true,
	'minify_css'            => true,
	'combine_css'           => false,    // Merge CSS → fewer HTTP requests. Test thoroughly.
	'minify_js'             => true,
	'minify_inline_js'      => false,    // ADVANCED/RISKY: also minify inline <script> blocks. Near-zero gain post-gzip; every builder/form/theme inline init rides through the minifier. Off by default.
	'combine_js'            => false,    // Merge JS → fewer HTTP requests. Test thoroughly.
	'defer_js'              => true,     // Run JS through the order-safe loader at DOMContentLoaded
	'delay_js'              => true,     // Run JS through the order-safe loader on first interaction → biggest TBT/PSI win
	'delay_js_safe_mode'    => true,     // SAFE: defer/delay ONLY known third-party scripts (analytics/pixels/chat); never the site's own JS (sliders/forms/builders). Off = aggressive "delay all except excludes".
	'delay_js_excludes'     => '',       // Patterns for scripts to skip delay (one per line)
	'exclude_js'            => '',       // Patterns for JS files to skip (one per line)
	'exclude_css'           => '',       // Patterns for CSS files to skip (one per line)
	'lazy_css'              => false,    // Async-load non-critical stylesheets (advanced)

	// ── Media ─────────────────────────────────────────────────────────────────
	'lazy_load_images'      => true,
	'lazy_load_iframes'     => true,
	'lazy_load_videos'      => true,     // Set preload="none" on <video> tags
	'serve_webp'            => true,     // Serve WebP when available — the safe modern-format standard
	'serve_avif'            => false,    // OFF by default since 1.3.5. AVIF proved fragile in the field (bfap.co.za: encoder emitted complete-but-undecodable files → blank images) and needs a same-host decoder to validate. WebP delivers most of the win with none of the risk. Opt-in for hosts with a proven AVIF pipeline; existing installs are migrated off once (Core\Upgrade), and a deliberate re-enable sticks.
	'optimize_images'       => true,
	'compress_images'       => true,     // Generate WebP copies of JPEG/PNG uploads (non-destructive)
	'compression_quality'   => 82,       // WebP quality 40–100 (82 = visually lossless)
	'lazy_exclude'          => '',       // Above-the-fold images to never lazy-load (URL fragments or class names, one per line)
	'lazy_skip_count'       => 2,        // Leading in-flow content images kept EAGER (not lazy-loaded): the hero plus the next (N−1) above-the-fold images. Stops PSI's "LCP image was lazy-loaded" when the hero is not the very first <img>. 0 = only the hero. Below-fold images get loading=lazy + fetchpriority=low so the hero keeps the bandwidth.
	'auto_sizes'            => true,     // sizes="auto, …" on lazy responsive images (the WP 6.7 core mechanism, applied for older WP + builder markup): browsers download the srcset candidate matching the RENDERED width — smaller image bytes on phones (PSI "Properly size images"). Legacy browsers ignore the auto token; never applied twice.

	// ── Video Facade ──────────────────────────────────────────────────────────
	'video_facade'          => false,    // Replace YouTube/Vimeo iframes with click-to-play facade. OPT-IN since 1.3.8: replacing the player is aggressive (breaks under restrictive Permissions-Policy headers, changes UX to two-click, conflicts with builder video widgets) — fleet reported "videos not playing" 2026-07-28. Correctness beats speed.
	'serve_webm'            => true,     // Prefer a .webm sibling for self-hosted MP4 <source> videos when one exists on disk (same trusted pattern as WebP image siblings — Boost never transcodes video; drop a WebM copy next to the MP4 and it is served to supporting browsers automatically)

	// ── Fonts ─────────────────────────────────────────────────────────────────
	'google_fonts_optimize' => true,     // Add font-display=swap to all Google Fonts URLs
	'google_fonts_async'    => false,    // Async-load Google Fonts (removes render-blocking request)
	'self_host_fonts'       => false,    // Download Google Fonts + serve locally (removes third-party render-blocking requests)

	// ── Preload & Prefetch ────────────────────────────────────────────────────
	'preload_on_purge'      => true,
	'preload_interval'      => 'daily',
	'preload_links'         => true,     // Speculative prefetch on hover
	'prefetch_dns'          => '',       // Custom DNS prefetch domains (one per line)
	'preload_fonts'         => '',       // Font file URLs to preload (one per line)
	'preload_key_requests'  => '',       // Critical CSS/JS/font URLs to preload (one per line)
	'preload_lcp_image'     => true,     // Auto-detect the hero/LCP image (first content <img>, inline background-image, slider first slide, or a section background declared in the page's own inline <style>/combined CSS) and preload it with fetchpriority=high. Works with Combine CSS on OR off. Not confident = no preload (never guesses; logs a hint under WP_DEBUG_LOG). Per-page override: post meta `bcboost_lcp_image` (image URL) or the BCBOOST_lcp_image_url filter — use it when the hero background lives only in an external stylesheet.
	'critical_css'          => '',       // Global above-the-fold CSS to inline in <head> — the SITE-WIDE FALLBACK. Per-template critical CSS (front page, posts, pages, product, archive) lives in its own store (Optimizer\Critical_CSS) and takes precedence.
	'critical_css_auto'     => false,    // OFF by default — the user must opt in. Built-in (Beta) critical-CSS generator: pure-PHP above-the-fold selector extraction (no Node/Chrome/service needed). Fills the per-template store via the Generate button; NEVER auto-enables Critical CSS inlining or Async CSS — those stay separate user choices. A configured remote endpoint below always takes precedence (higher fidelity).
	'critical_css_remote_endpoint' => '', // OFF by default. Optional URL of a critical-CSS generation service (BaseCloud-hosted). When set, an admin "Generate" button requests critical CSS for each template's representative URL. Responses are size-capped and sanitized (no markup, no @import). Filter: BCBOOST_critical_css_endpoint.

	// ── Elementor Speed ───────────────────────────────────────────────────────
	// Elementor-specific optimizations (Optimizer\Elementor_Optimizer). All
	// buffer-level: Elementor re-adds assets that are dequeued at enqueue time,
	// so the output buffer is the only reliable layer. No-ops when Elementor is
	// not active. Elementor's own frontend JS/init order is NEVER touched.
	'elementor_speed'            => false, // Master toggle — OPT-IN for 1.3.7 (fleet-prove before default-on)
	'elementor_inline_post_css'  => true,  // Replace uploads/elementor/css/post-*.css links with inline <style> (same rules, same position, minus 4–27 render-blocking requests/page). Caps: 15KB/file, 120KB/page (filters BCBOOST_elementor_inline_css_max / _total_max). Over-cap or unreadable = link left untouched.
	'elementor_drop_unused_icons' => true, // Drop eicons/Font Awesome CSS links ONLY when the page provably has no icon usage and no lightbox/popup/video/carousel (runtime UI injects eicon-* classes). Uncertain = keep. Scripts never touched.
	'elementor_settings_advisor' => true,  // Read-only recommendations (font-display swap, Inline Font Icons, Element Caching conflict, lazy-bg conflict) rendered in the Elementor Speed card. Never auto-applies anything.
	'elementor_dom_warnings'     => true,  // Note in the advisor when a page's HTML exceeds ~400KB (huge DOM = slow INP). Boost never restructures DOM — advisory only.

	// ── Speculation Rules (Chrome 109+) ───────────────────────────────────────
	'speculation_rules'     => 'prefetch', // off | prefetch | prerender
	'speculation_eagerness' => 'moderate', // conservative | moderate | eager

	// ── Advanced ──────────────────────────────────────────────────────────────
	'gzip_compression'      => true,
	'browser_cache'         => true,
	'stale_while_revalidate' => true,    // Add stale-while-revalidate=86400 to Cache-Control
	'heartbeat_control'     => true,     // Throttle WP Heartbeat → less server load
	'heartbeat_interval'    => 60,       // seconds
	'disable_emojis'        => true,     // Remove WP emoji JS/CSS
	'disable_embeds'        => true,     // Remove oEmbed discovery overhead
	'disable_dashicons'     => true,     // Remove Dashicons CSS for non-logged-in visitors
	'remove_query_strings'  => false,    // LEGACY — off by default. Stripping ?ver= removes the cache-busting token, so browsers/CDNs keep serving old CSS/JS after an update (stale-site reports). No PSI benefit. When enabled, Boost now substitutes a filemtime-based ?ver= instead of removing it.
	'limit_post_revisions'  => 5,        // Keep DB lean
	'db_cleanup_schedule'   => 'off',    // Automatic database cleanup recurrence: off | daily | weekly
	'critical_css_enabled'  => false,    // Master switch for critical CSS inlining (per-URL/template store + global fallback). Also a precondition of the async-CSS gate (BCBOOST_async_css_active).
	'disable_xmlrpc'        => true,
	'resource_hints'        => true,     // Preconnect/dns-prefetch for common origins
	'auto_preconnect'       => true,     // Auto-preconnect the CDN host and the LCP hero image's origin so TCP/TLS is warm before the hero downloads. Pure resource hint — https + cross-origin only, capped. Rides the resource-hints output.
	'clean_head'            => true,     // Remove WP generator, shortlink, RSD, wlwmanifest

	// ── Admin Appearance (cosmetic only — never touches the front end) ───────
	'admin_theme'           => 'dark',      // Boost admin UI: dark | light (interface modes) | classic (drifting particles, dark) | video-boost / video-colours / video-fish-tank / video-goop / video-lava-lamp / video-zombies (looping ambient video, dark, admin-only). Legacy 'goop'/'minimal' values migrate to 'dark' via Admin_Controller::normalize_theme().
	'admin_color_primary'   => '#4ade80',   // Primary accent — buttons, toggles, success, active glow
	'admin_color_secondary' => '#8b5cf6',   // Secondary accent — purple highlights
	'admin_color_info'      => '#3b82f6',   // Info accent — blue highlights
	'admin_color_highlight' => '#22d3ee',   // Highlight accent — cyan details, focus rings

	// ── Security Headers ──────────────────────────────────────────────────────
	'security_headers'      => false,    // Add X-Content-Type-Options, X-Frame-Options, etc.
	'hsts_max_age'          => 31536000, // HSTS max-age in seconds (0 = disabled)
	'hsts_preload'          => false,    // Add preload directive to HSTS header

	// ── Varnish / Reverse-Proxy Cache ─────────────────────────────────────────
	'varnish_enabled'       => false,    // Mirror local purges to Varnish over HTTP (PURGE/BAN)
	'varnish_mode'          => 'self',   // Reverse-proxy type: self (self-managed VCL, PURGE/BAN) | cloudways (managed Varnish: URLPURGE + /?purgeall)
	'varnish_servers'       => '',       // Varnish server addresses host[:port], one per line (blank = site host; Cloudways = 127.0.0.1:8080)
	'varnish_purge_method'  => 'ban',    // Site-wide purge method (self mode only): ban (recommended) | purge

	// ── CDN / Cloudflare ──────────────────────────────────────────────────────
	'cdn_enabled'           => false,    // Purge Cloudflare edge cache on local purge
	'cloudflare_zone_id'    => '',       // Cloudflare Zone ID (dashboard → Overview)
	'cloudflare_api_token'  => '',       // API Token with Cache Purge permission
	'cdn_browser_ttl'       => 3600,     // max-age for browsers (seconds)
	'cdn_edge_ttl'          => 86400,    // s-maxage for CDN edge nodes (seconds)

	// ── CDN / BunnyCDN ────────────────────────────────────────────────────────
	'bunnycdn_enabled'      => false,    // Purge BunnyCDN pull zone cache on local purge
	'bunnycdn_api_key'      => '',       // Account API Key (bunny.net → Account → API)
	'bunnycdn_pull_zone_id' => '',       // Numeric Pull Zone ID (CDN → pull zone → General)
	'bunnycdn_hostname'     => '',       // Pull Zone hostname e.g. yourzone.b-cdn.net (enables URL rewriting)
	'bunnycdn_optimizer'    => false,    // Bunny Optimizer add-on active on the pull zone (edge does WebP/AVIF) → Boost stands down its own image-format conversion

	// ── Webhook ───────────────────────────────────────────────────────────────
	'webhook_enabled'       => false,    // Send metrics to a webhook URL
	'webhook_url'           => '',       // Webhook endpoint URL
	'webhook_on_purge'      => false,    // Also fire webhook on full cache purge
	'webhook_secret'        => '',       // Optional HMAC-SHA256 signing secret
	'webhook_schedule'      => 'daily',  // WP-Cron recurrence: hourly|twicedaily|daily|weekly

	// ── Lighthouse / PageSpeed ────────────────────────────────────────────────
	'lighthouse_webhook_enabled' => false,    // Enable Lighthouse webhook
	'lighthouse_webhook_url'     => '',       // Endpoint to receive Lighthouse JSON payloads
	'lighthouse_webhook_secret'  => '',       // Optional HMAC-SHA256 signing secret
	'lighthouse_psi_api_key'     => '',       // Google PageSpeed Insights API key (optional, avoids rate limits)
	'lighthouse_default_url'     => '',       // Default URL to audit (blank = site home)
	'lighthouse_schedule'        => 'daily',  // WP-Cron recurrence: hourly|twicedaily|daily|weekly

	// ── Fleet Ops (BaseCloud CRM REST API) ────────────────────────────────────
	'fleet_ops_enabled'          => false,    // Kill-switch: bcboost/v1 REST API answers 403 until enabled
	'fleet_ops_strict'           => false,    // Additionally require timestamp + nonce + HMAC signature per request
	'fleet_ops_key'              => '',       // Per-site pairing key (encrypted at rest, shown once, never exported)
];
