Function mintOAuthConnection

packages/core/sdk/src/executor.ts:4394–4737

(
      input: MintOAuthConnectionInput,
    )

    // existing name), this path upserts on purpose: reconnect/refresh re-mints
    // the SAME connection, stamping the OAuth columns.
    const mintOAuthConnection = (
      input: MintOAuthConnectionInput,
    ): Effect.Effect<Connection, StorageFailure> =>
      Effect.gen(function* () {
        const name = connectionIdentifier(String(input.name));
        yield* requireUserSubject(input.owner);
        const integrationRow = yield* findIntegrationRow(input.integration);
        if (!integrationRow) {
          return yield* new StorageError({
            message: `Integration not found: ${input.integration}`,
            cause: undefined,
          });
        }
        const keys = yield* Effect.try({
          try: () => ownedKeys(input.owner),
          catch: (cause) => storageFailureFromUnknown("invalid owner", cause),
        });
        const now = new Date();
        const ref: ConnectionRef = {
          owner: input.owner,
          integration: input.integration,
          name,
        };
        // Label precedence: an explicit (user-chosen) label always wins; a
        // derived label (OIDC claims) only FILLS an empty slot. Like
        // `description` below, a reconnect or token refresh must not erase a
        // label the user curated. Resolved once, used by every write below.
        let identityLabel: string | null = null;
        // The core-owned per-connection state this mint writes WHOLESALE:
        // whatever a previous grant recorded (a stale reauth verdict, an old
        // missing-scope set) describes a credential that no longer exists.
        const nextProviderState = {
          ...(input.missingOAuthScopes === undefined || input.missingOAuthScopes.length === 0
            ? {}
            : { missingOAuthScopes: input.missingOAuthScopes }),
          ...(input.enterpriseManaged === undefined
            ? {}
            : {
                [ENTERPRISE_MANAGED_PROVIDER_STATE_KEY]: input.enterpriseManaged,
              }),
        };
        // Null, not `{}`, when this grant records nothing: an empty object would
        // read back as "state exists and is empty" on a column whose absence is
        // what every reader tests.
        const providerState =
          Object.keys(nextProviderState).length === 0 ? null : nextProviderState;
        const credentialProvider = credentialProviders.get(input.provider);
        const credentialSet = credentialProvider?.set;
        if (!credentialProvider || !credentialSet) {
          return yield* new StorageError({
            message: `Credential provider ${input.provider} is not registered as writable.`,
            cause: undefined,
          });
        }
        const credentialAttemptId = crypto.randomUUID();
        const credentialWrite = makeCredentialWriteAttempt(
          credentialWriteRuntimeId,
          credentialAttemptId,