Function performTokenRefresh

packages/core/sdk/src/executor.ts:2424–2759

(
      row: ConnectionRow,
      provider: CredentialProvider,
      trigger: RefreshTrigger,
    )

    // Perform the actual refresh-token grant and persist the rotated material.
    const performTokenRefresh = (
      row: ConnectionRow,
      provider: CredentialProvider,
      trigger: RefreshTrigger,
    ): Effect.Effect<string | null, StorageFailure | CredentialResolutionError> =>
      Effect.gen(function* () {
        const owner = row.owner as Owner;
        const reauth = (
          message: string,
          options?: { readonly credentialMissing?: boolean; readonly blockedByAdmin?: boolean },
        ): CredentialResolutionError =>
          new CredentialResolutionError({
            owner,
            integration: IntegrationSlug.make(row.integration),
            name: ConnectionName.make(row.name),
            message,
            reauthRequired: true,
            ...(options?.credentialMissing === true ? { credentialMissing: true } : {}),
            ...(options?.blockedByAdmin === true ? { blockedByAdmin: true } : {}),
          });

        // A recorded invalid_grant is the AS's standing verdict on this grant:
        // re-sending it cannot succeed, so don't. Fail as reauth-required
        // without a token request — the reconnect mint rewrites
        // `provider_state` and thereby re-arms refresh. Without this gate a
        // dead connection re-sent its dead grant on every proactive cycle,
        // indefinitely (owner.com's Datadog connections: 100+ identical
        // rejections over two days, surfacing nothing).
        const reauthState = oauthReauthRequiredFromProviderState(row.provider_state);
        if (reauthState !== null) {
          yield* Effect.annotateCurrentSpan({ "executor.oauth.refresh.skipped_known_dead": true });
          const recordedHealth = Option.getOrNull(decodeLastHealth(row.last_health));
          const recordedDetail =
            reauthState.oauthReauthRequiredDetail ??
            (recordedHealth?.status === "expired" ? recordedHealth.detail : undefined);
          const detail =
            recordedDetail === undefined
              ? "The authorization server rejected this connection's refresh token (invalid_grant). Reconnect to continue."
              : recordedDetail.endsWith("Reconnect to continue.")
                ? recordedDetail
                : `${recordedDetail} Reconnect to continue.`;
          // An admin-policy denial recorded on the dead grant must survive
          // reconstruction: without the flag, callers past the first denial
          // would show ordinary reconnect guidance — the interactive OAuth
          // route the policy contract forbids offering.
          return yield* reauth(detail, {
            blockedByAdmin: recordedDeadGrantReason(reauthState) === "blocked_by_admin",
          });
        }

        // Load the backing app. A `first-party:` slug resolves from host config
        // (deployment-owned identity, in-memory secret); a stored slug loads by
        // the owner STORED on the connection (a Personal connection may be
        // backed by a shared Workspace app) — no derivation — with its secret
        // resolved out of the credential provider by item id.
        const clientSlug = String(row.oauth_client);
        const clientRow: RefreshClient | null = yield* Effect.gen(function* () {
          if (isFirstPartyOAuthClientSlug(clientSlug)) {