Function buildLocalFirstPartyLease

src/auth/runtime/leases.ts:177–228

(
  session: ResolvedAuthSession,
  options: ResolveLeaseOptions = {},
)

}

export function buildLocalFirstPartyLease(
  session: ResolvedAuthSession,
  options: ResolveLeaseOptions = {},
): IssuedRuntimeLease | null {
  if (
    session.principalKind === 'none' ||
    session.providerAuthKind === 'third_party_provider' ||
    session.providerAuthKind === 'none'
  ) {
    return null
  }

  const issuedAt = options.nowMs ?? Date.now()
  const expiresAt = session.accessTokenExpiresAt
  const renewable = session.canRefresh
  const renewAfter =
    renewable && expiresAt !== null
      ? computeRenewAfter(issuedAt, expiresAt, LOCAL_RENEWAL_WINDOW_MS)
      : null
  const graceUntil =
    renewable && expiresAt !== null ? expiresAt + LOCAL_GRACE_WINDOW_MS : null
  const state = mapLocalLeaseState(session)

  return {
    leaseKind: 'local_first_party',
    leaseId: `local:${session.principalSource}:${session.identity.organizationUuid ?? 'no-org'}:${session.identity.accountUuid ?? 'no-account'}`,
    sessionId: null,
    state,
    renewable,
    renewalOwner: renewable ? 'local_runtime' : 'none',
    issuedAt,
    expiresAt,
    renewAfter,
    graceUntil,
    organizationUuid: session.identity.organizationUuid,
    capabilities:
      session.providerPlan.mode === 'byok_static_env'
        ? ['inference']
        : ['first_party_api', 'inference'],
    executionTarget: 'local',
    providerMode: mapProviderMode(session),
    degradationMode: mapLocalDegradationMode(state),
    recoveryMessage: session.recoveryMessage,
    metadata: {
      principalKind: session.principalKind,
      principalSource: session.principalSource,
      headersKind: session.headersKind,
      hasUsableToken: session.hasUsableToken,
      hasUsableApiKey: session.hasUsableApiKey,
    },
  }
}

export function buildBridgeWorkerLease(
  params: {