Function connectionValidate

packages/core/sdk/src/executor.ts:3369–3424

(
      input: ValidateConnectionInput,
    )

      );

    const connectionValidate = (
      input: ValidateConnectionInput,
    ): Effect.Effect<HealthCheckResult, IntegrationNotFoundError | StorageFailure> =>
      Effect.gen(function* () {
        const integrationRow = yield* findIntegrationRow(input.integration);
        if (!integrationRow) {
          return yield* new IntegrationNotFoundError({ slug: input.integration });
        }
        const runtime = runtimes.get(integrationRow.plugin_id);
        const check = runtime?.plugin.checkHealth;
        if (!runtime || !check) return unknownHealth();

        const values = yield* resolveInFlightValues(input);
        const record = rowToIntegrationRecord(
          integrationRow,
          describeAuthMethodsForRow(integrationRow),
        );
        const credential: ToolInvocationCredential = {
          owner: input.owner,
          integration: input.integration,
          // No connection exists yet (key-first); a synthetic name keeps the
          // credential shape whole. The probe authenticates on values+template,
          // not on this name (it only appears in upstream-error messages).
          connection: ConnectionName.make("(unsaved)"),
          template: input.template,
          value: values[PRIMARY_INPUT_VARIABLE] ?? null,
          values,
          config: record.config,
        };
        // Caller override (editor preview) wins; otherwise the declared spec
        // from the integration row. Nothing persists here: validate is the
        // key-first flow's dry run.
        const spec = input.spec ?? describeHealthCheckForRow(integrationRow) ?? undefined;
        const result = yield* foldPluginFailure(
          check({ ctx: runtime.ctx, integration: record, credential, spec }),
          `Validating credential for "${input.integration}" failed.`,
        );
        // Nothing persists here BY DESIGN, which makes this span the only
        // possible record of "what fraction of pasted credentials are rejected
        // at the door" — a signal the DB can never carry.
        yield* Effect.annotateCurrentSpan({
          "executor.health.status": result.status,
          ...(result.httpStatus !== undefined
            ? { "executor.health.http_status": result.httpStatus }
            : {}),
        });
        return result;
      }).pipe(
        Effect.withSpan("executor.connection.validate", {
          attributes: {
            "executor.tenant": tenant,
            ...(subject != null ? { "executor.subject": subject } : {}),
            "executor.integration": String(input.integration),
          },
        }),
      );

    // Clear the sync stamp so the next tools read re-produces this connection's