Function mintOAuthConnection

packages/core/sdk/src/executor.ts:2962–3092

(
      input: MintOAuthConnectionInput,
    )

    // by the OAuth service) + produce the connection's tools. Mirrors
    // `connectionsCreate`'s upsert + tool-production, stamping the OAuth columns.
    const mintOAuthConnection = (
      input: MintOAuthConnectionInput,
    ): Effect.Effect<Connection, StorageFailure> =>
      Effect.gen(function* () {
        const name = connectionIdentifier(String(input.name));
        yield* requireUserSubject(input.owner);
        const integrationRow = yield* findIntegrationRow(input.integration);
        if (!integrationRow) {
          return yield* new StorageError({
            message: `Integration not found: ${input.integration}`,
            cause: undefined,
          });
        }
        const keys = yield* Effect.try({
          try: () => ownedKeys(input.owner),
          catch: (cause) => storageFailureFromUnknown("invalid owner", cause),
        });
        const now = new Date();
        const ref: ConnectionRef = {
          owner: input.owner,
          integration: input.integration,
          name,
        };
        // Label precedence: an explicit (user-chosen) label always wins; a
        // derived label (OIDC claims) only FILLS an empty slot. Like
        // `description` below, a reconnect or token refresh must not erase a
        // label the user curated. Resolved once, used by every write below.
        let identityLabel: string | null = null;
        yield* transaction(
          Effect.gen(function* () {
            const existing = yield* findConnectionRow(ref);
            const existingLabel = existing?.identity_label?.trim() ? existing.identity_label : null;
            identityLabel =
              input.identityLabel ?? existingLabel ?? input.derivedIdentityLabel ?? null;
            const set: Record<string, unknown> = {
              template: String(input.template),
              provider: input.provider,
              item_ids: { [PRIMARY_INPUT_VARIABLE]: input.itemId },
              identity_label: identityLabel,
              oauth_client: String(input.oauthClient),
              oauth_client_owner: input.oauthClientOwner,
              refresh_item_id: input.refreshItemId,
              expires_at: input.expiresAt,
              oauth_scope: input.oauthScope,
              oauth_token_url: input.oauthTokenUrl ?? null,
              provider_state:
                input.missingOAuthScopes && input.missingOAuthScopes.length > 0
                  ? { missingOAuthScopes: input.missingOAuthScopes }
                  : null,
              // A re-mint replaces the grant, so any persisted verdict describes
              // a credential that no longer exists. Clear it rather than let a
              // pre-reconnect "expired" outlive the reconnect; the next health
              // check writes the verdict for the new grant.
              last_health: null,
              updated_at: now,
            };
            if (existing) {
              yield* core.updateMany("connection", {