const DEFAULT_LEASE_TTL_MS = 20 * 60 * 1_000;

const RETRY_BACKOFF_MS = [500, 1_000, 2_000, 4_000, 5_000] as const;

const RETRYABLE_ACQUIRE_CODES = new Set(["POOL_EXHAUSTED", "NO_CREDENTIAL_AVAILABLE"]);

const CHUNKED_PAYLOAD_MARKER = "__openclawQaCredentialPayloadChunksV1";

const convexAcquireSuccessSchema = z.object({

status: z.literal("ok"),

status: z.literal("ok"),

});

const convexPayloadChunkSuccessSchema = z.object({

status: z.literal("ok"),

data: z.string(),

});

type ConvexCredentialBrokerConfig = {

acquireTimeoutMs: number;

acquireUrl: string;

httpTimeoutMs: number;

leaseTtlMs: number;

ownerId: string;

payloadChunkUrl: string;

releaseUrl: string;

role: QaCredentialRole;

};

),

acquireUrl: joinQaCredentialEndpoint(baseUrl, endpointPrefix, "acquire"),

heartbeatUrl: joinQaCredentialEndpoint(baseUrl, endpointPrefix, "heartbeat"),

payloadChunkUrl: joinQaCredentialEndpoint(baseUrl, endpointPrefix, "payload-chunk"),

releaseUrl: joinQaCredentialEndpoint(baseUrl, endpointPrefix, "release"),

};

}

function parseChunkedPayloadMarker(payload: unknown) {

if (!payload || typeof payload !== "object" || Array.isArray(payload)) {

return null;

}

const record = payload as Record<string, unknown>;

if (record[CHUNKED_PAYLOAD_MARKER] !== true) {

return null;

}

if (

typeof record.chunkCount !== "number" ||

!Number.isInteger(record.chunkCount) ||

record.chunkCount < 1

) {

throw new Error("Chunked credential payload marker has an invalid chunkCount.");

}

if (

typeof record.byteLength !== "number" ||

!Number.isInteger(record.byteLength) ||

record.byteLength < 0

) {

throw new Error("Chunked credential payload marker has an invalid byteLength.");

}

return {

chunkCount: record.chunkCount,

byteLength: record.byteLength,

};

}

function toBrokerError(params: {

payload: unknown;

fallback: string;

return payload;

}

async function resolveConvexCredentialPayload(params: {

acquired: z.infer<typeof convexAcquireSuccessSchema>;

config: ConvexCredentialBrokerConfig;

fetchImpl: typeof fetch;

kind: string;

}) {

const marker = parseChunkedPayloadMarker(params.acquired.payload);

if (!marker) {

return params.acquired.payload;

}

const chunks: string[] = [];

for (let index = 0; index < marker.chunkCount; index += 1) {

const payload = await postConvexBroker({

fetchImpl: params.fetchImpl,

timeoutMs: params.config.httpTimeoutMs,

authToken: params.config.authToken,

url: params.config.payloadChunkUrl,

body: {

kind: params.kind,

ownerId: params.config.ownerId,

actorRole: params.config.role,

credentialId: params.acquired.credentialId,

leaseToken: params.acquired.leaseToken,

index,

},

});

const parsed = convexPayloadChunkSuccessSchema.parse(payload);

chunks.push(parsed.data);

}

const serialized = chunks.join("");

if (serialized.length !== marker.byteLength) {

throw new Error("Chunked credential payload length mismatch.");

}

return JSON.parse(serialized) as unknown;

}

function computeAcquireBackoffMs(params: {

attempt: number;

randomImpl: () => number;

};

let parsedPayload: TPayload;

try {

parsedPayload = opts.parsePayload(acquired.payload);

const resolvedPayload = await resolveConvexCredentialPayload({

acquired,

config,

fetchImpl,

kind: opts.kind,

});

parsedPayload = opts.parsePayload(resolvedPayload);

} catch (error) {

try {

await releaseLease();