Function refreshConnectionToken

packages/core/sdk/src/executor.ts:1946–1976

(
      row: ConnectionRow,
      provider: CredentialProvider,
      trigger: RefreshTrigger = "proactive",
    )

      );

    const refreshConnectionToken = (
      row: ConnectionRow,
      provider: CredentialProvider,
      trigger: RefreshTrigger = "proactive",
    ): Effect.Effect<string | null, StorageFailure | CredentialResolutionError> =>
      // Share a single refresh per connection so concurrent resolves of the same
      // connection all await one refresh-token grant (the AS rotates the refresh
      // token; parallel grants would race on a consumed token — v1's refresh
      // deferred-map). The gate is cleared once the refresh settles so a later
      // expiry can refresh again.
      Effect.gen(function* () {
        const key = connectionKey(row);
        // Joining an in-flight grant is correct for BOTH triggers: whatever
        // that peer mints is newer than the token this fiber just saw rejected,
        // which is exactly what a reactive retry wants. The gate is cleared on
        // settle, so a 401 arriving after a refresh completed starts a fresh
        // grant rather than replaying the stale memoized one.
        const existing = refreshInFlight.get(key);
        if (existing) return yield* existing;
        // `Effect.cached` memoizes the grant onto a deferred: it runs once and
        // replays to every awaiter sharing this entry.
        const memoized = yield* Effect.cached(performTokenRefresh(row, provider, trigger));
        const gated = memoized.pipe(
          Effect.ensuring(Effect.sync(() => refreshInFlight.delete(key))),
        );
        // Re-check after building (a peer fiber may have registered first while
        // we built ours) so everyone converges on the same shared grant.
        const winner = refreshInFlight.get(key) ?? gated;
        if (winner === gated) refreshInFlight.set(key, gated);
        return yield* winner;
      });

    // Resolve every named input of a connection (`variable → value`). A
    // single-secret connection yields `{ token: <value> }`; an apiKey method with