Function persistRefreshedToken

packages/core/sdk/src/executor.ts:2314–2353

(
      row: ConnectionRow,
      provider: CredentialProvider,
      token: OAuth2TokenResponse,
      storedRefreshToken?: string | undefined,
    )

     *  has not changed; a rotated token never matches, so the write that
     *  actually matters is never skipped. */
    const persistRefreshedToken = (
      row: ConnectionRow,
      provider: CredentialProvider,
      token: OAuth2TokenResponse,
      storedRefreshToken?: string | undefined,
    ): Effect.Effect<void, StorageFailure> =>
      Effect.gen(function* () {
        if (provider.set) {
          // OAuth is always single-input: the access token lives in the `token`
          // item. Fall back to a deterministic id if the map is somehow empty.
          const tokenItemId =
            connectionItemIds(row)[PRIMARY_INPUT_VARIABLE] ??
            `connection:${row.owner}:${row.integration}:${row.name}:${PRIMARY_INPUT_VARIABLE}`;
          if (
            token.refresh_token &&
            row.refresh_item_id &&
            token.refresh_token !== storedRefreshToken
          ) {
            yield* provider.set(ProviderItemId.make(row.refresh_item_id), token.refresh_token);
          }
          yield* provider.set(ProviderItemId.make(tokenItemId), token.access_token);
        }

        const nextExpiresAt =
          typeof token.expires_in === "number" ? Date.now() + token.expires_in * 1000 : null;
        const set: Record<string, unknown> = {
          expires_at: nextExpiresAt,
          updated_at: new Date(),
        };
        if (token.scope !== undefined) set.oauth_scope = token.scope;
        yield* core.updateMany("connection", {
          where: (b: AnyCb) =>
            b.and(
              byOwner(row.owner as Owner)(b),
              b("integration", "=", String(row.integration)),
              b("name", "=", String(row.name)),
            ),
          set,
        });
      });

    /** The rendered message of a typed enterprise-managed failure. */
    const enterpriseManagedMessage = (cause: EnterpriseManagedMintError): string =>