Function buildRemoteSessionLease

src/auth/runtime/leases.ts:270–315

(
  params: {
    nowMs?: number
    organizationUuid?: string | null
    providerMode?: Exclude<LeaseProviderMode, 'third_party_provider'>
    session: ResolvedAuthSession
    sessionId?: string | null
  },
)

}

export function buildRemoteSessionLease(
  params: {
    nowMs?: number
    organizationUuid?: string | null
    providerMode?: Exclude<LeaseProviderMode, 'third_party_provider'>
    session: ResolvedAuthSession
    sessionId?: string | null
  },
): IssuedRuntimeLease {
  const issuedAt = params.nowMs ?? Date.now()
  const sessionId = params.sessionId ?? null
  const providerMode = params.providerMode ?? 'noumena_managed'

  return {
    leaseKind: 'remote_session',
    leaseId: `remote_session:${sessionId ?? 'pending'}:${params.organizationUuid ?? params.session.identity.organizationUuid ?? 'no-org'}`,
    sessionId,
    state: 'usable',
    renewable: false,
    renewalOwner: 'none',
    issuedAt,
    expiresAt: params.session.accessTokenExpiresAt,
    renewAfter: null,
    graceUntil: null,
    organizationUuid:
      params.organizationUuid ?? params.session.identity.organizationUuid,
    capabilities: ['remote_session', 'inference'],
    executionTarget: 'remote',
    providerMode,
    degradationMode: 'resume_required',
    recoveryMessage:
      'Remote runtime lease expired. Resume or recreate the remote session to continue.',
    metadata: {
      principalKind: params.session.principalKind,
      principalSource: params.session.principalSource,
      tokenTransport:
        providerMode === 'byok' ? 'static_api_key_env' : 'oauth_env',
      accessTokenEnvVarName:
        providerMode === 'byok' ? null : 'NCODE_OAUTH_TOKEN',
      apiKeyEnvVarName:
        providerMode === 'byok'
          ? (params.session.rawApiKeySource ?? 'ANTHROPIC_API_KEY')
          : null,
    },
  }
}

export function buildSessionIngressLease(
  params: {