Function mintOAuthConnection

packages/core/sdk/src/executor.ts:3316–3453

(
      input: MintOAuthConnectionInput,
    )

    // by the OAuth service) + produce the connection's tools. Mirrors
    // `connectionsCreate`'s upsert + tool-production, stamping the OAuth columns.
    const mintOAuthConnection = (
      input: MintOAuthConnectionInput,
    ): Effect.Effect<Connection, StorageFailure> =>
      Effect.gen(function* () {
        const name = connectionIdentifier(String(input.name));
        yield* requireUserSubject(input.owner);
        const integrationRow = yield* findIntegrationRow(input.integration);
        if (!integrationRow) {
          return yield* new StorageError({
            message: `Integration not found: ${input.integration}`,
            cause: undefined,
          });
        }
        const keys = yield* Effect.try({
          try: () => ownedKeys(input.owner),
          catch: (cause) => storageFailureFromUnknown("invalid owner", cause),
        });
        const now = new Date();
        const ref: ConnectionRef = {
          owner: input.owner,
          integration: input.integration,
          name,
        };
        // Label precedence: an explicit (user-chosen) label always wins; a
        // derived label (OIDC claims) only FILLS an empty slot. Like
        // `description` below, a reconnect or token refresh must not erase a
        // label the user curated. Resolved once, used by every write below.
        let identityLabel: string | null = null;
        // The core-owned per-connection state this mint writes WHOLESALE:
        // whatever a previous grant recorded (a stale reauth verdict, an old
        // missing-scope set) describes a credential that no longer exists.
        const nextProviderState = {
          ...(input.missingOAuthScopes === undefined || input.missingOAuthScopes.length === 0
            ? {}
            : { missingOAuthScopes: input.missingOAuthScopes }),
          ...(input.enterpriseManaged === undefined
            ? {}
            : { [ENTERPRISE_MANAGED_PROVIDER_STATE_KEY]: input.enterpriseManaged }),
        };
        // Null, not `{}`, when this grant records nothing: an empty object would
        // read back as "state exists and is empty" on a column whose absence is
        // what every reader tests.
        const providerState =
          Object.keys(nextProviderState).length === 0 ? null : nextProviderState;
        yield* transaction(
          Effect.gen(function* () {
            const existing = yield* findConnectionRow(ref);
            const existingLabel = existing?.identity_label?.trim() ? existing.identity_label : null;
            identityLabel =
              input.identityLabel ?? existingLabel ?? input.derivedIdentityLabel ?? null;
            const set: Record<string, unknown> = {
              template: String(input.template),
              provider: input.provider,
              item_ids: { [PRIMARY_INPUT_VARIABLE]: input.itemId },
              identity_label: identityLabel,
              oauth_client: String(input.oauthClient),
              oauth_client_owner: input.oauthClientOwner,
              refresh_item_id: input.refreshItemId,