Function produceConnectionTools

packages/core/sdk/src/executor.ts:2495–2698

(
      integrationRow: IntegrationRow,
      ref: ConnectionRef,
      mode: "explicit" | "background" = "explicit",
    )

      result.incompleteReason ?? "plugin returned an incomplete tool catalog";

    const produceConnectionTools = (
      integrationRow: IntegrationRow,
      ref: ConnectionRef,
      mode: "explicit" | "background" = "explicit",
    ): Effect.Effect<readonly Tool[], IntegrationNotFoundError | StorageFailure> =>
      Effect.gen(function* () {
        const runtime = runtimes.get(integrationRow.plugin_id);
        const keys = yield* Effect.try({
          try: () => ownedKeys(ref.owner),
          catch: (cause) => storageFailureFromUnknown("invalid owner", cause),
        });
        const owner = ref.owner;
        const where = (b: AnyCb) =>
          b.and(
            byOwner(owner)(b),
            b("integration", "=", String(ref.integration)),
            b("connection", "=", String(ref.name)),
          );
        const connectionWhere = (b: AnyCb) =>
          b.and(
            byOwner(owner)(b),
            b("integration", "=", String(ref.integration)),
            b("name", "=", String(ref.name)),
          );
        const isToolSyncHealth = (health: HealthCheckResult | null): boolean =>
          health?.detail?.startsWith(toolSyncHealthDetailPrefix) === true;
        const syncedSet = (row: ConnectionRow | null) => {
          const health = row ? Option.getOrNull(decodeLastHealth(row.last_health)) : null;
          return isToolSyncHealth(health)
            ? { tools_synced_at: Date.now(), last_health: null, updated_at: new Date() }
            : { tools_synced_at: Date.now() };
        };
        // Every exit stamps the sync time — including the cleanup paths that
        // produce zero tools — so the stale-catalog check (`config_revised_at`
        // vs `tools_synced_at`) doesn't re-attempt this connection per read.
        // Successful syncs also clear stale sync-failure health records, while
        // preserving genuine health-check outcomes.
        const stampSynced = (row: ConnectionRow | null) =>
          core.updateMany("connection", {
            where: connectionWhere,
            set: syncedSet(row),
          });
        const stampSyncedWithHealth = (reason: string) =>
          core.updateMany("connection", {
            where: connectionWhere,
            set: {
              tools_synced_at: Date.now(),
              last_health: toolSyncHealth(reason),
              updated_at: new Date(),
            },
          });

        // Defense in depth (and cleanup for rows created before the create-time
        // guard, or emptied by an external edit): a credentialed non-OAuth
        // connection with no bound credential inputs can never resolve a value,
        // so never advertise tools for it — every call would fail with
        // `connection_value_missing`. OAuth connections resolve via refresh and
        // carry their token outside `item_ids`; no-auth (`"none"` template)