Function refreshConnectionToken

packages/core/sdk/src/executor.ts:2897–2943

(
      row: ConnectionRow,
      provider: CredentialProvider,
      trigger: RefreshTrigger = "proactive",
    )

      );

    const refreshConnectionToken = (
      row: ConnectionRow,
      provider: CredentialProvider,
      trigger: RefreshTrigger = "proactive",
    ): Effect.Effect<string | null, StorageFailure | CredentialResolutionError> =>
      // Share a single refresh per connection so concurrent resolves of the same
      // connection all await one refresh-token grant (the AS rotates the refresh
      // token; parallel grants would race on a consumed token — v1's refresh
      // deferred-map). The gate is cleared once the refresh settles so a later
      // expiry can refresh again.
      Effect.suspend(() => {
        const key = connectionKey(row);
        // Joining an in-flight grant is correct for BOTH triggers: whatever
        // that peer mints is newer than the token this fiber just saw rejected,
        // which is exactly what a reactive retry wants. The gate is cleared on
        // settle, so a 401 arriving after a refresh completed starts a fresh
        // grant rather than replaying a stale result.
        const existing = refreshInFlight.get(key);
        if (existing) return Deferred.await(existing);

        // The grant runs on a DETACHED fiber and every caller — including this
        // one — only awaits its deferred. The entry is shared across execution
        // stacks, so the fiber that registers it is merely the first arrival,
        // not an owner. Running the grant ON that fiber would hand it that
        // caller's interruption: a disconnected MCP client, an execution
        // deadline or a cancelled tool call would fail every peer awaiting the
        // same entry with an interrupt none of them caused and none can act on.
        // Awaiting is per-caller, so a cancelled peer detaches without touching
        // the grant or its siblings, and a grant nobody is left waiting on
        // still settles and still persists the rotated token — which is what
        // keeps the next caller off a consumed one. Token requests are bounded
        // by `AbortSignal.timeout`, so the detached fiber cannot outlive its
        // request.
        const deferred = Deferred.makeUnsafe<
          string | null,
          StorageFailure | CredentialResolutionError
        >();
        // Nothing suspends between the lookup above and this registration, so
        // check-and-set is atomic against peer fibers and cannot double-fire.
        refreshInFlight.set(key, deferred);
        const run = performTokenRefresh(row, provider, trigger).pipe(
          Effect.exit,
          Effect.flatMap((exit) => Deferred.done(deferred, exit)),
          Effect.ensuring(Effect.sync(() => void refreshInFlight.delete(key))),
        );
        return Effect.forkDetach(run).pipe(Effect.andThen(Deferred.await(deferred)));
      });

    // Resolve every named input of a connection (`variable → value`). A
    // single-secret connection yields `{ token: <value> }`; an apiKey method with