schematichq 1.5.2 → 1.5.3

data/lib/schematic/credits/leases/server_check.rb

@@ -0,0 +1,237 @@
+# frozen_string_literal: true
+
+require "securerandom"
+require "time"
+
+module Schematic
+  module Credits
+    module Leases
+      # Everything a server-mode check needs. reservation_ttl_ms is how far out
+      # the hold's expires_at is set, and default_value resolves the caller's
+      # default for the flag, which the fail-open branch returns because there
+      # is no local engine to re-run.
+      ServerCheckDeps = Struct.new(:features, :credits, :logger, :reservation_ttl_ms, :default_value, :clock,
+                                   keyword_init: true)
+
+      # Mirrors the reason the API returns on a 200 with value false for the
+      # same denial, so a caller matching on reason has one string to match
+      # either way.
+      INSUFFICIENT_CREDITS_REASON = "Insufficient credits"
+
+      # Drive a single check with usage set, in server mode.
+      #
+      # One check-and-reserve call does everything the client path spreads
+      # across a lease acquire, a local reserve, and a rules evaluation: the
+      # server evaluates the flag against the company's real balance, applies
+      # the preflight cost, and takes the hold in the same round trip. There is
+      # no lease, no local store, and no rules engine involved.
+      #
+      # The failure contract differs from client mode in one place. fail-open
+      # there means re-run the engine with the credit balance assumed
+      # sufficient, so plan targeting and every non-credit condition still
+      # apply. Server mode has no local engine to re-run, since the call that
+      # would have answered is the one that failed, so fail-open returns the
+      # caller's default value instead. fail-closed denies, same as client mode.
+      #
+      # No flag_check event is enqueued here: the server logs the flag check for
+      # check-and-reserve itself, the same way the REST check path does.
+      def self.check_with_server_reservation(deps, key, eval_ctx, options, &fallback)
+        ServerCheck.new(deps, key, eval_ctx, options, fallback).run
+      end
+
+      class ServerCheck
+        def initialize(deps, key, eval_ctx, options, fallback)
+          @deps = deps
+          @key = key
+          @eval_ctx = eval_ctx || {}
+          @options = options || {}
+          @fallback = fallback
+          @logger = deps.logger
+          @clock = deps.clock || DEFAULT_CLOCK
+          @on_failure = Leases.resolve_failure_mode(@options[:on_acquire_failure], @logger)
+          # One key for this check, minted before the call rather than per
+          # attempt: check-and-reserve takes a hold, so a 502 arriving after the
+          # API committed one would otherwise have the retry take a second and
+          # park the first until its TTL. Sharing the key across attempts makes
+          # the server return the hold it already took.
+          @idempotency_key = SecureRandom.uuid
+        end
+
+        def run
+          usage = @options[:usage]
+          # The same guard as the client path: a malformed usage must never
+          # reach the wire. NaN slips through every numeric comparison, so the
+          # server would size a hold off a value no comparison can reject.
+          unless Leases.valid_quantity?(usage)
+            @logger.error(
+              "Server reservation: invalid usage #{usage.inspect} for flag #{@key}, " \
+              "must be a finite non-negative number"
+            )
+            return failure_result("invalid_usage")
+          end
+
+          if usage.zero?
+            @logger.debug("Server reservation: usage is 0 for flag #{@key}, nothing to reserve, using plain check")
+            return @fallback.call
+          end
+
+          data = call_api
+          return data if data.is_a?(CheckResult)
+
+          build_result(data)
+        end
+
+        private
+
+        def call_api
+          response = @deps.features.check_and_reserve_flag(request_options: request_options, **request_body)
+          response.data
+        rescue StandardError => e
+          # A 402 is the server's definitive answer, not a can't-gate: it knows
+          # the credits are not there. Deny regardless of the failure mode,
+          # since failing open here would hand out credit the balance cannot
+          # cover. check-and-reserve itself answers 200 with value false for
+          # insufficient credits; this is defensive.
+          return payment_required_result(e) if payment_required?(e)
+
+          @logger.error("Server reservation: check-and-reserve for flag #{@key} failed: #{e.message}")
+          failure_result("server_reservation_failed")
+        end
+
+        def request_body
+          # The request body's quantity is an integer, so a fractional usage
+          # would truncate and the server would size the hold below the work
+          # about to run. Round up, and size the preflight from the same number
+          # so the flag is evaluated against the quantity actually held.
+          quantity = Leases.wire_quantity(@options[:usage])
+          body = {
+            key: @key,
+            quantity: quantity,
+            expires_at: (@clock.call + (@deps.reservation_ttl_ms / 1000.0)).utc.iso8601
+          }
+          company = @eval_ctx[:company] || @eval_ctx["company"]
+          user = @eval_ctx[:user] || @eval_ctx["user"]
+          body[:company] = company if company && !company.empty?
+          body[:user] = user if user && !user.empty?
+          preflight = Leases.build_preflight_options(@options.merge(usage: quantity))
+          body[:preflight] = preflight if preflight
+          body[:idempotency_key] = @idempotency_key
+          body
+        end
+
+        # Only the timeout is set here. The call keeps the client's default
+        # retry policy, which the idempotency key makes safe.
+        def request_options
+          return {} if @options[:timeout_ms].nil?
+
+          { timeout_in_seconds: @options[:timeout_ms] / 1000.0 }
+        end
+
+        def build_result(data)
+          base = CheckResult.new(
+            allowed: data.value, value: data.value, reason: data.reason, entitlement: data.entitlement,
+            flag_key: data.flag || @key, flag_id: data.flag_id, error: data.error
+          )
+          held = data.reservation
+          # No reservation comes back when the flag denied, the credits were
+          # insufficient (a 200 with value false), or the feature is not
+          # credit-metered. Nothing was held, so there is nothing to release.
+          return base if !data.value || held.nil?
+
+          # The settling track event is named by the event subtype; the caller's
+          # explicit one wins, otherwise the server names it on the hold. With
+          # neither, the hold could never be settled.
+          event_subtype = @options[:event_subtype] || held.event_subtype
+          return release_unsettleable(held, base) if event_subtype.nil? || event_subtype.empty?
+
+          CheckResult.new(
+            allowed: true, value: true, reason: data.reason, entitlement: data.entitlement,
+            flag_key: data.flag || @key, flag_id: data.flag_id,
+            reservation: reservation_from(held, event_subtype)
+          )
+        end
+
+        def reservation_from(held, event_subtype)
+          Reservation.new(
+            id: held.id,
+            # No lease exists in server mode; mirror the id so the field stays
+            # populated and a handle round-trips through code that reads it.
+            lease_id: held.id,
+            mode: :server,
+            company_id: held.company_id,
+            credit_type_id: held.credit_type_id,
+            event_subtype: event_subtype,
+            quantity_reserved: held.quantity_reserved,
+            credits_reserved: held.credits_reserved,
+            consumption_rate: held.consumption_rate,
+            expires_at: parse_time(held.expires_at),
+            eval_ctx: @eval_ctx
+          )
+        end
+
+        def release_unsettleable(held, base)
+          @logger.error(
+            "Server reservation: reservation #{held.id} for flag #{@key} has no event subtype, " \
+            "releasing, it could never be settled"
+          )
+          begin
+            @deps.credits.release_credit_reservation(reservation_id: held.id)
+          rescue StandardError => e
+            @logger.warn(
+              "Server reservation: failed to release #{held.id} (#{e.message}); its hold is refunded when it expires"
+            )
+          end
+          return failure_result("missing_event_subtype") if @on_failure == :fail_closed
+
+          # Fail-open means assume the credits are there, and the server has
+          # already evaluated the flag and allowed this check. Only the settle
+          # is impossible, so keep the server's verdict rather than falling back
+          # to the caller's default, which could deny what the server allowed.
+          CheckResult.new(
+            allowed: base.allowed, value: base.value, reason: base.reason, entitlement: base.entitlement,
+            flag_key: base.flag_key, flag_id: base.flag_id, error: "missing_event_subtype"
+          )
+        end
+
+        # Resolve a can't-gate outcome. fail-closed denies; fail-open returns
+        # the caller's default value, since there is no local engine to
+        # re-evaluate with an assumed-sufficient balance the way client mode
+        # does.
+        def failure_result(reason)
+          return CheckResult.new(allowed: false, value: false, reason: reason, flag_key: @key, error: reason) if @on_failure == :fail_closed
+
+          value = @deps.default_value.call
+          CheckResult.new(allowed: value, value: value, reason: "#{reason}_fail_open", flag_key: @key, error: reason)
+        end
+
+        # The generated client has no 402-specific error class, so a payment
+        # required arrives as a ClientError carrying the status code.
+        def payment_required?(error)
+          error.respond_to?(:code) && error.code.to_i == 402
+        end
+
+        def payment_required_result(error)
+          CheckResult.new(
+            allowed: false, value: false, reason: INSUFFICIENT_CREDITS_REASON, flag_key: @key,
+            error: api_error_message(error)
+          )
+        end
+
+        # A response error's message is the raw body, which carries the API's
+        # own error string when it is JSON.
+        def api_error_message(error)
+          parsed = JSON.parse(error.message.to_s)
+          parsed.is_a?(Hash) && parsed["error"] ? parsed["error"] : error.message
+        rescue StandardError
+          error.message
+        end
+
+        def parse_time(value)
+          Leases.parse_api_time(value)
+        rescue StandardError
+          @clock.call
+        end
+      end
+    end
+  end
+end

data/lib/schematic/credits/leases/track.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Schematic
+  module Credits
+    module Leases
+      # What a settle did locally, and what it owes the server.
+      #
+      # settled_locally is true when the hold was still open and this call
+      # debited the consumed slice and refunded the rest. False when it had
+      # already been swept at its TTL, already settled, or the store was
+      # unreachable: the lease balance was not touched here, so it reads high
+      # until the lease rolls over, and the event is a recovery emit.
+      SettleOutcome = Struct.new(:track, :settled_locally, keyword_init: true)
+
+      # Consume a reservation against its lease and build the event that bills
+      # it.
+      #
+      # The event is built from the caller-held handle rather than the store, so
+      # the usage is still billed once the hold has been swept. Only the local
+      # bookkeeping clamps to the reserved amount; the event carries the
+      # unclamped actual, because the server is the source of truth for real
+      # consumption.
+      def self.consume_reservation_and_build_event(reservations, reservation, actual_quantity, traits: nil)
+        # Rounded up for the same reason the hold is (see check_with_lease), and
+        # through the same helper the event's quantity uses: the debit has to
+        # move the local ledger by exactly what the Track event bills.
+        consumed = reservations.consume(
+          reservation.id, Leases.wire_quantity(actual_quantity) * reservation.consumption_rate
+        )
+        SettleOutcome.new(
+          track: build_reservation_track_event(reservation, actual_quantity, traits: traits),
+          settled_locally: !consumed.nil?
+        )
+      end
+
+      # Build the track event for a reservation from the handle alone, with no
+      # store access, so the client can still bill the usage when the local
+      # settle fails against an unreachable store.
+      def self.build_reservation_track_event(reservation, actual_quantity, traits: nil)
+        # Whole event units, the same rounding the hold and the settle debit
+        # use: the API rejects a non-integer quantity during processing, and
+        # the local ledger has to move by what this event bills.
+        body = { event: reservation.event_subtype, quantity: Leases.wire_quantity(actual_quantity) }
+        if reservation.server_mode?
+          # The hold lives on the server, so the event settles it by id. Never
+          # send lease_id too: the server prefers it when both are set, and
+          # there is no lease here for it to route through.
+          body[:reservation_id] = reservation.id
+        else
+          # Routes the server-side credit consumption through the lease's
+          # sub-ledger instead of decrementing the grant again, which the
+          # acquire already pre-debited. Without this the grant double-debits
+          # and eventually starves redemptions mid-session.
+          body[:lease_id] = reservation.lease_id
+        end
+        eval_ctx = reservation.eval_ctx || {}
+        company = eval_ctx[:company] || eval_ctx["company"]
+        user = eval_ctx[:user] || eval_ctx["user"]
+        body[:company] = company if company && !company.empty?
+        body[:user] = user if user && !user.empty?
+        body[:traits] = traits if traits
+        body
+      end
+    end
+  end
+end

data/lib/schematic/credits/leases/types.rb

@@ -0,0 +1,329 @@
+# frozen_string_literal: true
+
+require "time"
+
+module Schematic
+  module Credits
+    # Client-side credit leases, reservations, and preflight checks.
+    #
+    # A credit-metered feature is gated without a wire call per check: the SDK
+    # leases a tranche of credits per (company, credit type), carves a
+    # reservation out of it at check time, and settles the reservation against
+    # the actual usage when the work finishes. See conformance/SPEC.md at the
+    # repo root for the full model; the vectors there pin the semantics every
+    # Schematic SDK shares.
+    module Leases
+      # Durations are milliseconds throughout, matching the names and units the
+      # other SDKs use so one set of numbers configures a mixed fleet.
+
+      DEFAULT_LEASE_DURATION_MS = 5 * 60 * 1000
+      DEFAULT_RESERVATION_TTL_MS = 60 * 1000
+      # The API rejects a hold whose expires_at is more than an hour out, so a
+      # larger reservation TTL would fail every server-mode check. The SDK
+      # clamps to this instead.
+      MAX_RESERVATION_TTL_MS = 60 * 60 * 1000
+      # The API measures that hour against its own clock while the SDK computes
+      # expires_at against the caller's, so a client running ahead would be
+      # rejected at exactly the cap. Hold this much back from it.
+      RESERVATION_TTL_SKEW_ALLOWANCE_MS = 60 * 1000
+      DEFAULT_LEASE_SIZE = 10_000
+      DEFAULT_LOW_WATER_MARK = 0.25
+      DEFAULT_SWEEP_INTERVAL_MS = 1000
+      # How long prewarm is willing to wait for a freshly identified company to
+      # surface in the datastream cache before giving up. Long enough to cover
+      # the buffer-flush, server-ingest, datastream-push round trip for a new
+      # company; short enough that a misconfigured caller does not hang.
+      DEFAULT_PREWARM_RESOLVE_TIMEOUT_MS = 5000
+      DEFAULT_PREWARM_POLL_INTERVAL_MS = 100
+      # How long close waits for in-flight lease work to land before giving up
+      # on it. Bounded on purpose: a shutdown that hangs is worse than a hold
+      # the server expires at DEFAULT_LEASE_DURATION_MS.
+      SHUTDOWN_DRAIN_TIMEOUT_MS = 5000
+
+      # How many in-flight extends one caller will wait out before issuing its
+      # own. Two covers the case the single flight was written for: the flight a
+      # caller joins, and the follow-up another caller registers while it was
+      # waiting.
+      MAX_EXTEND_JOINS = 2
+
+      # Balance substituted for a fail-open evaluation: large enough that the
+      # credit gate always passes, and the same figure the other SDKs use so a
+      # shared vector can name it.
+      FAIL_OPEN_BALANCE = (2**53) - 1
+
+      # Where a credit hold lives for a check that passes usage.
+      # :client - local leases over DataStream.
+      # :server - one check-and-reserve API call per check.
+      # :auto   - client when DataStream is enabled, server otherwise.
+      MODES = %i[client server auto].freeze
+
+      # What to do when a lease cannot be acquired or reserved against.
+      # :fail_open   - re-run the engine with the credit balance assumed
+      #                sufficient, so non-credit rules still apply.
+      # :fail_closed - deny, because the gate cannot gate.
+      FAILURE_MODES = %i[fail_open fail_closed].freeze
+
+      # Reads the current time. Every store and the lease manager take one so
+      # tests and the conformance runner can drive a virtual clock instead of
+      # wall time.
+      DEFAULT_CLOCK = -> { Time.now }
+
+      # Convert a caller-supplied mode to a symbol, accepting the hyphenated
+      # spellings the other SDKs use ("fail-open") so one config shape travels.
+      def self.normalize_symbol(value)
+        return nil if value.nil?
+
+        value.to_s.tr("-", "_").downcase.to_sym
+      end
+
+      # How long stop waits for the sweeper to finish what it is doing before
+      # killing it. Long enough for a sweep already past its claim to land its
+      # refund, short enough that close stays prompt.
+      SWEEP_STOP_JOIN_MS = 100
+
+      # Resolve a caller's on_acquire_failure, or fail closed.
+      #
+      # An unrecognized value must not read as fail-open: the branches all test
+      # for :fail_closed, so a typo would quietly turn the safe default into the
+      # permissive one on every check. Name the value in the warning, since a
+      # silent downgrade of a gate is the thing worth telling someone about.
+      def self.resolve_failure_mode(value, logger = nil)
+        return :fail_closed if value.nil?
+
+        mode = normalize_symbol(value)
+        return mode if FAILURE_MODES.include?(mode)
+
+        logger&.warn(
+          "Unrecognized on_acquire_failure #{value.inspect}; expected one of " \
+          "#{FAILURE_MODES.join(" or ")}. Failing closed."
+        )
+        :fail_closed
+      end
+
+      # Whether a caller-supplied quantity can size a credit hold. NaN is the
+      # dangerous case: it slips through every numeric comparison, and a NaN
+      # balance would approve every later reserve on a possibly shared lease.
+      def self.valid_quantity?(value)
+        value.is_a?(Numeric) && !value.to_f.nan? && value.to_f.finite? && value >= 0
+      end
+
+      # The local view of the one lease a (company, credit type) slot holds.
+      class LeaseEntry
+        attr_accessor :lease_id, :company_id, :credit_type_id, :granted_amount,
+                      :local_remaining_credits, :expires_at
+
+        def initialize(lease_id:, company_id:, credit_type_id:, granted_amount:, expires_at:,
+                       local_remaining_credits: nil)
+          @lease_id = lease_id
+          @company_id = company_id
+          @credit_type_id = credit_type_id
+          @granted_amount = granted_amount.to_f
+          @local_remaining_credits = (local_remaining_credits || granted_amount).to_f
+          @expires_at = expires_at
+        end
+
+        def dup
+          LeaseEntry.new(
+            lease_id: @lease_id,
+            company_id: @company_id,
+            credit_type_id: @credit_type_id,
+            granted_amount: @granted_amount,
+            local_remaining_credits: @local_remaining_credits,
+            expires_at: @expires_at
+          )
+        end
+
+        def expired?(now)
+          @expires_at.to_f <= now.to_f
+        end
+      end
+
+      # The post-debit balance a successful try_reserve returns, plus the id of
+      # the lease the credits actually came out of. The debit is not keyed by
+      # lease id, so the caller pins its reservation to this id and never to the
+      # one its acquire handed back.
+      ReserveResult = Struct.new(:balance, :lease_id)
+
+      # One credit hold carved out of a lease by a check. Returned to the caller
+      # from check and handed back to track_with_reservation.
+      class Reservation
+        attr_reader :id, :lease_id, :mode, :company_id, :credit_type_id, :event_subtype,
+                    :quantity_reserved, :credits_reserved, :consumption_rate, :expires_at, :eval_ctx
+
+        def initialize(id:, lease_id:, company_id:, credit_type_id:, event_subtype:,
+                       quantity_reserved:, credits_reserved:, consumption_rate:, expires_at:,
+                       eval_ctx: {}, mode: nil)
+          @id = id
+          @lease_id = lease_id
+          # :server means the API holds the credits and the settling track event
+          # routes by reservation_id; nil (or :client) means the hold is a local
+          # carve-out of a lease.
+          @mode = mode
+          @company_id = company_id
+          @credit_type_id = credit_type_id
+          @event_subtype = event_subtype
+          @quantity_reserved = quantity_reserved.to_f
+          @credits_reserved = credits_reserved.to_f
+          @consumption_rate = consumption_rate.to_f
+          @expires_at = expires_at
+          @eval_ctx = eval_ctx || {}
+        end
+
+        def server_mode?
+          @mode == :server
+        end
+
+        def to_h
+          {
+            id: @id,
+            lease_id: @lease_id,
+            mode: @mode,
+            company_id: @company_id,
+            credit_type_id: @credit_type_id,
+            event_subtype: @event_subtype,
+            quantity_reserved: @quantity_reserved,
+            credits_reserved: @credits_reserved,
+            consumption_rate: @consumption_rate,
+            expires_at: @expires_at,
+            eval_ctx: @eval_ctx
+          }
+        end
+      end
+
+      # Cast a usage onto the integer the wire carries. A hold can be sized from
+      # a fractional usage, but every quantity field on the API (the
+      # check-and-reserve ask, the preflight envelope, a track event) is an
+      # integer, and the generated models truncate a float onto it. A preflight
+      # asks an upper-bound question and a settle must not bill a partial unit
+      # as none, so a fraction rounds up in both directions.
+      # Float noise is shaved off before the rounding: (0.1 + 0.2) * 10 is
+      # 3.0000000000000004, and a bare ceil would bill that as 4.
+      ROUND_UP_TOLERANCE = 1e-9
+
+      def self.wire_quantity(value)
+        return value unless value.is_a?(Numeric)
+        return value if value.is_a?(Integer)
+        return value unless value.finite?
+
+        shaved = value - ROUND_UP_TOLERANCE
+        shaved.positive? ? shaved.ceil : value.ceil
+      end
+
+      # One shape for the matched entitlement whichever mode produced it.
+      #
+      # The WASM engine hands back a camelCase hash and the API hands back a
+      # generated model, so without this a caller reading result.entitlement
+      # would need one accessor for client mode and another for server mode.
+      # Both become a snake_case, symbol-keyed Hash matching the field names on
+      # Schematic::Types::FeatureEntitlement, and metric_reset_at is parsed to a
+      # Time so a caller can compare it without knowing which mode it came from.
+      def self.normalize_entitlement(raw)
+        return nil if raw.nil?
+
+        hash = raw.is_a?(Hash) ? raw : entitlement_to_h(raw)
+        return nil if hash.nil?
+
+        normalized = deep_snake_case(hash)
+        reset_at = normalized[:metric_reset_at]
+        normalized[:metric_reset_at] = parse_reset_at(reset_at) unless reset_at.nil?
+        normalized
+      end
+
+      def self.entitlement_to_h(raw)
+        return raw.to_h if raw.respond_to?(:to_h)
+
+        nil
+      end
+      private_class_method :entitlement_to_h
+
+      def self.parse_reset_at(value)
+        parse_api_time(value)
+      rescue StandardError
+        value
+      end
+      private_class_method :parse_reset_at
+
+      # The API's timestamps are UTC, but Time.iso8601 reads one that carries
+      # no offset as host-local time, which would shift a lease's expiry by the
+      # host's UTC offset. A timestamp with no zone is read as UTC instead.
+      def self.parse_api_time(value)
+        return value.getutc if value.is_a?(Time)
+
+        text = value.to_s
+        text += "Z" if text.include?("T") && !text.match?(/(?:Z|[+-]\d{2}(?::?\d{2})?)\z/i)
+        Time.iso8601(text).utc
+      end
+
+      def self.deep_snake_case(value)
+        case value
+        when Hash
+          value.each_with_object({}) do |(key, inner), out|
+            out[key.to_s.gsub(/([a-z\d])([A-Z])/, '\1_\2').downcase.to_sym] = deep_snake_case(inner)
+          end
+        when Array
+          value.map { |inner| deep_snake_case(inner) }
+        else
+          value
+        end
+      end
+      private_class_method :deep_snake_case
+
+      # What a lease-aware check decided. `allowed` is what the caller gates on;
+      # `reservation` is present only when a hold was taken.
+      class CheckResult
+        attr_reader :allowed, :value, :reservation, :reason, :entitlement, :flag_key, :flag_id, :error
+
+        def initialize(allowed:, value:, reason:, flag_key:, reservation: nil, entitlement: nil,
+                       flag_id: nil, error: nil)
+          @allowed = allowed
+          @value = value
+          @reservation = reservation
+          @reason = reason
+          @entitlement = Leases.normalize_entitlement(entitlement)
+          @flag_key = flag_key
+          @flag_id = flag_id
+          @error = error
+        end
+
+        def allowed?
+          @allowed
+        end
+
+        def to_h
+          {
+            allowed: @allowed,
+            value: @value,
+            reservation: @reservation&.to_h,
+            reason: @reason,
+            entitlement: @entitlement,
+            flag_key: @flag_key,
+            flag_id: @flag_id,
+            error: @error
+          }.compact
+        end
+      end
+
+      # The four resolvable knobs for one credit type, after overrides and
+      # defaults.
+      ResolvedLeaseConfig = Struct.new(:lease_duration_ms, :reservation_ttl_ms, :lease_size, :low_water_mark,
+                                       keyword_init: true)
+
+      # Resolve the knobs for one credit type: the credit type's override wins,
+      # then the client-wide config, then the default.
+      def self.resolve_config(config, credit_type_id)
+        config ||= {}
+        overrides = config[:overrides] || {}
+        override = overrides[credit_type_id] || overrides[credit_type_id.to_s] ||
+                   overrides[credit_type_id.to_sym] || {}
+        ResolvedLeaseConfig.new(
+          lease_duration_ms: override[:default_lease_duration] || config[:default_lease_duration] ||
+            DEFAULT_LEASE_DURATION_MS,
+          reservation_ttl_ms: override[:default_reservation_ttl] || config[:default_reservation_ttl] ||
+            DEFAULT_RESERVATION_TTL_MS,
+          lease_size: override[:default_lease_size] || config[:default_lease_size] || DEFAULT_LEASE_SIZE,
+          low_water_mark: override[:low_water_mark] || config[:low_water_mark] || DEFAULT_LOW_WATER_MARK
+        )
+      end
+    end
+  end
+end