Function performTokenRefresh

packages/core/sdk/src/executor.ts:1829–2085

(
      row: ConnectionRow,
      provider: CredentialProvider,
      trigger: RefreshTrigger,
    )

    // Perform the actual refresh-token grant and persist the rotated material.
    const performTokenRefresh = (
      row: ConnectionRow,
      provider: CredentialProvider,
      trigger: RefreshTrigger,
    ): Effect.Effect<string | null, StorageFailure | CredentialResolutionError> =>
      Effect.gen(function* () {
        const owner = row.owner as Owner;
        const reauth = (message: string): CredentialResolutionError =>
          new CredentialResolutionError({
            owner,
            integration: IntegrationSlug.make(row.integration),
            name: ConnectionName.make(row.name),
            message,
            reauthRequired: true,
          });

        // A recorded invalid_grant is the AS's standing verdict on this grant:
        // re-sending it cannot succeed, so don't. Fail as reauth-required
        // without a token request — the reconnect mint rewrites
        // `provider_state` and thereby re-arms refresh. Without this gate a
        // dead connection re-sent its dead grant on every proactive cycle,
        // indefinitely (owner.com's Datadog connections: 100+ identical
        // rejections over two days, surfacing nothing).
        const reauthState = oauthReauthRequiredFromProviderState(row.provider_state);
        if (reauthState !== null) {
          yield* Effect.annotateCurrentSpan({ "executor.oauth.refresh.skipped_known_dead": true });
          const recordedHealth = Option.getOrNull(decodeLastHealth(row.last_health));
          const recordedDetail =
            reauthState.oauthReauthRequiredDetail ??
            (recordedHealth?.status === "expired" ? recordedHealth.detail : undefined);
          const detail =
            recordedDetail === undefined
              ? "The authorization server rejected this connection's refresh token (invalid_grant). Reconnect to continue."
              : recordedDetail.endsWith("Reconnect to continue.")
                ? recordedDetail
                : `${recordedDetail} Reconnect to continue.`;
          return yield* reauth(detail);
        }

        // Load the backing app. A `first-party:` slug resolves from host config
        // (deployment-owned identity, in-memory secret); a stored slug loads by
        // the owner STORED on the connection (a Personal connection may be
        // backed by a shared Workspace app) — no derivation — with its secret
        // resolved out of the credential provider by item id.
        const clientSlug = String(row.oauth_client);
        const clientRow: RefreshClient | null = yield* Effect.gen(function* () {
          if (isFirstPartyOAuthClientSlug(clientSlug)) {
            const firstParty = firstPartyOAuthBySlug.get(clientSlug);
            if (!firstParty) return null;
            return {
              clientId: firstParty.clientId,
              clientSecret: firstParty.clientSecret,
              tokenUrl: firstParty.tokenUrl,
              grant: "authorization_code",
              resource: null,
            } satisfies RefreshClient;
          }
          const clientOwner = (row.oauth_client_owner ?? row.owner) as Owner;