@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/oauthapp/controller.js

@@ -0,0 +1,232 @@
+import { create, fromBinary } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+import { OAuthAppCommandController } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/command_pb";
+import { OAuthAppsSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/io_pb";
+import { OAuthAppQueryController } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/query_pb";
+import { internalError } from "../../pipeline/errors.js";
+import { apiResourceKindKey } from "../../pipeline/interceptors/apiresource.js";
+import { newPipeline } from "../../pipeline/pipeline.js";
+import { callerIdentityOf } from "../../pipeline/interceptors/auth.js";
+import { RequestContext } from "../../pipeline/request-context.js";
+import { newAuthorizeStep } from "../../pipeline/steps/authorize.js";
+import { newGuardReservedLabelsStep } from "../../pipeline/steps/guard-reserved-labels.js";
+import { newBuildUpdateStateStep } from "../../pipeline/steps/build-update-state.js";
+import { newBuildNewStateStep } from "../../pipeline/steps/defaults.js";
+import { RESOURCE_ID_KEY, newDeleteResourceStep, newLoadExistingForDeleteStep, } from "../../pipeline/steps/delete.js";
+import { newCheckDuplicateStep } from "../../pipeline/steps/duplicate.js";
+import { compareCreatedAtDesc } from "../../pipeline/steps/helpers.js";
+import { EXISTING_RESOURCE_KEY, newLoadExistingStep, } from "../../pipeline/steps/load-existing.js";
+import { SHOULD_CREATE_KEY, newLoadForApplyStep, withResolvedApplyId, } from "../../pipeline/steps/load-for-apply.js";
+import { newLoadByReferenceStep } from "../../pipeline/steps/load-by-reference.js";
+import { TARGET_RESOURCE_KEY, newLoadTargetStep, } from "../../pipeline/steps/load-target.js";
+import { newCleanupIamPoliciesStep, newCreateAuthorizationTuplesStep, } from "../../pipeline/steps/authorization-tuples.js";
+import { newPersistStep } from "../../pipeline/steps/persist.js";
+import { newDestroySecretBackingStateStep } from "../../pipeline/steps/secret-cleanup.js";
+import { newResolveSlugStep } from "../../pipeline/steps/slug.js";
+import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { newValidateVisibilityStep } from "../../pipeline/steps/validate-visibility.js";
+import { newCheckNoReferencingMcpServersStep, newEncryptClientSecretForCreateStep, newEncryptClientSecretForUpdateStep, redactOAuthApp, } from "./steps.js";
+/** Registers both OAuthApp services on the router (routes stage). */
+export function registerOAuthAppServices(router, deps) {
+    router.service(OAuthAppCommandController, {
+        apply: (app, ctx) => apply(deps, app, ctx),
+        create: (app, ctx) => createOAuthApp(deps, app, ctx),
+        update: (app, ctx) => update(deps, app, ctx),
+        delete: (input, ctx) => deleteOAuthApp(deps, input, ctx),
+    });
+    router.service(OAuthAppQueryController, {
+        get: (id, ctx) => get(deps, id, ctx),
+        getByReference: (ref, ctx) => getByReference(deps, ref, ctx),
+        listByOrg: (req, ctx) => listByOrg(deps, req, ctx),
+    });
+}
+function kindOf(ctx) {
+    return ctx.values.get(apiResourceKindKey);
+}
+/**
+ * Create — chain per Go buildCreatePipeline. ResolveSlug runs before
+ * ValidateProto so clients can omit the slug; EncryptClientSecret runs
+ * BEFORE BuildNewState because BuildNewState clones the current state —
+ * the encrypted value must be in place before the clone. The response is
+ * redacted after the pipeline (the persisted row keeps the ciphertext).
+ */
+async function createOAuthApp(deps, app, ctx) {
+    const reqCtx = new RequestContext(OAuthAppSchema, app, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("oauthapp-create", deps.logger)
+        .addStep(newAuthorizeStep(OAuthAppCommandController.method.create, deps.authorizer))
+        .addStep(newResolveSlugStep())
+        .addStep(newValidateProtoStep())
+        .addStep(newValidateVisibilityStep())
+        .addStep(newCheckDuplicateStep(deps.store))
+        .addStep(newEncryptClientSecretForCreateStep(deps.secretService, deps.logger))
+        .addStep(newBuildNewStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newPersistStep(deps.store))
+        .addStep(newCreateAuthorizationTuplesStep(deps.authorizationLifecycle, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const result = reqCtx.newState;
+    redactOAuthApp(result);
+    return result;
+}
+/**
+ * Update — chain per Go buildUpdatePipeline. EncryptClientSecret runs
+ * AFTER BuildUpdateState (which replaces newState with a fresh clone of
+ * the input): it then either encrypts a new plaintext secret or restores
+ * the stored ciphertext when the redaction marker is echoed back.
+ */
+async function update(deps, app, ctx) {
+    const reqCtx = new RequestContext(OAuthAppSchema, app, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("oauthapp-update", deps.logger)
+        .addStep(newAuthorizeStep(OAuthAppCommandController.method.update, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadExistingStep(deps.store))
+        .addStep(newBuildUpdateStateStep())
+        .addStep(newGuardReservedLabelsStep(deps.authorizer))
+        .addStep(newEncryptClientSecretForUpdateStep(deps.secretService, deps.logger))
+        .addStep(newPersistStep(deps.store))
+        .build()
+        .execute(reqCtx);
+    const result = reqCtx.newState;
+    redactOAuthApp(result);
+    return result;
+}
+/**
+ * Apply — kubectl-style idempotent create-or-update: a minimal pipeline
+ * decides existence, then delegates to Create or Update with the ORIGINAL
+ * request message (Go delegates `app`, not the pipeline's mutated clone);
+ * the update arm carries the resolved id via withResolvedApplyId.
+ */
+async function apply(deps, app, ctx) {
+    const reqCtx = new RequestContext(OAuthAppSchema, app, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("oauthapp-apply", deps.logger)
+        .addStep(newAuthorizeStep(OAuthAppCommandController.method.apply, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newResolveSlugStep())
+        .addStep(newLoadForApplyStep(deps.store))
+        .build()
+        .execute(reqCtx);
+    const shouldCreate = reqCtx.get(SHOULD_CREATE_KEY);
+    if (typeof shouldCreate !== "boolean") {
+        throw internalError(new Error("apply pipeline did not set shouldCreate flag"), "apply operation failed to determine create vs update");
+    }
+    return shouldCreate
+        ? createOAuthApp(deps, app, ctx)
+        : update(deps, withResolvedApplyId(OAuthAppSchema, app, reqCtx), ctx);
+}
+/**
+ * Delete — chain per Go buildDeletePipeline: the referential guard runs
+ * between load and delete. The RESOURCE_ID_KEY is set manually because
+ * ApiResourceDeleteInput carries resourceId, not the value field
+ * ExtractResourceId expects (the environment-domain pattern). Returns the
+ * deleted resource for the audit trail — unredacted, exactly as Go does
+ * (see redactOAuthApp's header for the disclosure).
+ */
+async function deleteOAuthApp(deps, input, ctx) {
+    const reqCtx = new RequestContext(OAuthAppCommandController.method.delete.input, input, callerIdentityOf(ctx), kindOf(ctx));
+    reqCtx.set(RESOURCE_ID_KEY, input.resourceId);
+    await newPipeline("oauthapp-delete", deps.logger)
+        .addStep(newAuthorizeStep(OAuthAppCommandController.method.delete, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadExistingForDeleteStep(deps.store, OAuthAppSchema))
+        .addStep(newCheckNoReferencingMcpServersStep(deps.store, deps.logger))
+        .addStep(newDeleteResourceStep(deps.store))
+        .addStep(newCleanupIamPoliciesStep(deps.authorizationLifecycle, deps.logger))
+        .addStep(newDestroySecretBackingStateStep(deps.secretService, deps.logger, (app) => app.spec === undefined ? [] : [app.spec.clientSecret]))
+        .build()
+        .execute(reqCtx);
+    const deleted = reqCtx.get(EXISTING_RESOURCE_KEY);
+    if (deleted === undefined) {
+        throw internalError(new Error("deleted OAuthApp not found in context"), "deleted OAuthApp not found in context");
+    }
+    return deleted;
+}
+/** Get — LoadTarget by id, then redact (Go buildGetPipeline). */
+async function get(deps, id, ctx) {
+    const reqCtx = new RequestContext(OAuthAppQueryController.method.get.input, id, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("oauthapp-get", deps.logger)
+        .addStep(newAuthorizeStep(OAuthAppQueryController.method.get, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadTargetStep(deps.store, OAuthAppSchema))
+        .build()
+        .execute(reqCtx);
+    const app = reqCtx.get(TARGET_RESOURCE_KEY);
+    redactOAuthApp(app);
+    return app;
+}
+/** GetByReference — LoadByReference (org/slug), then redact. */
+async function getByReference(deps, ref, ctx) {
+    const reqCtx = new RequestContext(OAuthAppQueryController.method.getByReference.input, ref, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("oauthapp-get-by-reference", deps.logger)
+        .addStep(newAuthorizeStep(OAuthAppQueryController.method.getByReference, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newLoadByReferenceStep(deps.store, OAuthAppSchema))
+        .build()
+        .execute(reqCtx);
+    const app = reqCtx.get(TARGET_RESOURCE_KEY);
+    redactOAuthApp(app);
+    return app;
+}
+const LIST_RESULT_KEY = "listResult";
+/**
+ * ListByOrg — all OAuthApps whose metadata.org matches, each redacted,
+ * sorted created_at descending (Go listByOrgStep). No pagination:
+ * typically 1–5 per org. No authorization filtering in OSS.
+ */
+async function listByOrg(deps, req, ctx) {
+    const reqCtx = new RequestContext(OAuthAppQueryController.method.listByOrg.input, req, callerIdentityOf(ctx), kindOf(ctx));
+    await newPipeline("oauthapp-list-by-org", deps.logger)
+        .addStep(newAuthorizeStep(OAuthAppQueryController.method.listByOrg, deps.authorizer))
+        .addStep(newValidateProtoStep())
+        .addStep(newListByOrgStep(deps.store, deps.logger))
+        .build()
+        .execute(reqCtx);
+    const list = reqCtx.get(LIST_RESULT_KEY);
+    if (list === undefined) {
+        throw internalError(new Error("list result missing from pipeline context"), "OAuthApp list not found in context");
+    }
+    return list;
+}
+/** The domain-local list step: load all, filter by org, redact, sort. */
+function newListByOrgStep(store, logger) {
+    return {
+        name: "ListByOrg",
+        async execute(ctx) {
+            const org = ctx.input.org;
+            let resources;
+            try {
+                resources = await store.listResources(ApiResourceKind.oauth_app);
+            }
+            catch (error) {
+                throw internalError(error, "failed to list OAuthApps");
+            }
+            const apps = [];
+            for (const data of resources) {
+                let app;
+                try {
+                    app = fromBinary(OAuthAppSchema, data);
+                }
+                catch (error) {
+                    logger.warn("failed to unmarshal OAuthApp, skipping", {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                    continue;
+                }
+                if ((app.metadata?.org ?? "") !== org) {
+                    continue;
+                }
+                redactOAuthApp(app);
+                apps.push(app);
+            }
+            apps.sort((a, b) => compareCreatedAtDesc(a.status?.audit?.specAudit?.createdAt, b.status?.audit?.specAudit?.createdAt));
+            logger.info("listed OAuthApps by organization", {
+                org,
+                matchCount: apps.length,
+            });
+            ctx.set(LIST_RESULT_KEY, create(OAuthAppsSchema, { entries: apps }));
+        },
+    };
+}
+//# sourceMappingURL=controller.js.map

package/dist/domain/oauthapp/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../src/domain/oauthapp/controller.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAEnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAKnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAM9F,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAExF,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,mCAAmC,EACnC,cAAc,GACf,MAAM,YAAY,CAAC;AAYpB,qEAAqE;AACrE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,IAA4B;IAE5B,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE;QACxC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC1C,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QACpD,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;KACzD,CAAC,CAAC;IACH,MAAM,CAAC,OAAO,CAAC,uBAAuB,EAAE;QACtC,GAAG,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC;QACpC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAC5D,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;KACnD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA4B,EAC5B,GAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,MAAM,EACvC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,yBAAyB,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,mCAAmC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CACrE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,OAAO,CACN,gCAAgC,CAC9B,IAAI,CAAC,sBAAsB,EAC3B,IAAI,CAAC,MAAM,CACZ,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,MAAM,CACnB,IAA4B,EAC5B,GAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,iBAAiB,EAAE,IAAI,CAAC,MAAM,CAAC;SACrE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,MAAM,EACvC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,OAAO,CAAC,uBAAuB,EAAE,CAAC;SAClC,OAAO,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;SACpD,OAAO,CACN,mCAAmC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CACrE;SACA,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACnC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,KAAK,CAClB,IAA4B,EAC5B,GAAa,EACb,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,cAAc,EACd,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CAAwB,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;SACpE,OAAO,CACN,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAC1E;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;SAC7B,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SACxC,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,8CAA8C,CAAC,EACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY;QACjB,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAAC,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAC3B,IAA4B,EAC5B,KAA6B,EAC7B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,yBAAyB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAC7C,KAAK,EACL,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,WAAW,CACf,iBAAiB,EACjB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,yBAAyB,CAAC,MAAM,CAAC,MAAM,EACvC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;SACjE,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SACrE,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC1C,OAAO,CACN,yBAAyB,CAAC,IAAI,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CACpE;SACA,OAAO,CACN,gCAAgC,CAG9B,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CACzC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CACtD,CACF;SACA,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,uCAAuC,CAAC,EAClD,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,OAAO,OAAmB,CAAC;AAC7B,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,GAAG,CAChB,IAA4B,EAC5B,EAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EACxC,EAAE,EACF,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,cAAc,EACd,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CACtE;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;SACtD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAa,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,cAAc,CAC3B,IAA4B,EAC5B,GAAyB,EACzB,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EACnD,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,2BAA2B,EAC3B,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,uBAAuB,CAAC,MAAM,CAAC,cAAc,EAC7C,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;SAC3D,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAa,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;GAIG;AACH,KAAK,UAAU,SAAS,CACtB,IAA4B,EAC5B,GAA4B,EAC5B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAC9C,GAAG,EACH,gBAAgB,CAAC,GAAG,CAAC,EACrB,MAAM,CAAC,GAAG,CAAC,CACZ,CAAC;IACF,MAAM,WAAW,CACf,sBAAsB,EACtB,IAAI,CAAC,MAAM,CACZ;SACE,OAAO,CACN,gBAAgB,CACd,uBAAuB,CAAC,MAAM,CAAC,SAAS,EACxC,IAAI,CAAC,UAAU,CAChB,CACF;SACA,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC/B,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;SAClD,KAAK,EAAE;SACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,2CAA2C,CAAC,EACtD,oCAAoC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,IAAiB,CAAC;AAC3B,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CACvB,KAAY,EACZ,MAAc;IAEd,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,OAAO,CACX,GAEC;YAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YAE1B,IAAI,SAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;YACzD,CAAC;YAED,MAAM,IAAI,GAAe,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,IAAI,GAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;wBACpD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,cAAc,CAAC,GAAG,CAAC,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,oBAAoB,CAClB,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EACrC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CACtC,CACF,CAAC;YAEF,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,GAAG;gBACH,UAAU,EAAE,IAAI,CAAC,MAAM;aACxB,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/domain/oauthapp/refresolution/refresolution.d.ts

@@ -0,0 +1,12 @@
+import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { OAuthApp } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+import type { Logger } from "../../../boot/logger.js";
+import type { Store } from "../../../store/interface.js";
+/**
+ * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
+ * without a slug resolves to nothing — an McpServerAuth with no (or an
+ * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup. Store
+ * errors propagate to the caller (Go returns them).
+ */
+export declare function resolveOAuthAppRef(store: Store, ref: ApiResourceReference, logger: Logger): Promise<OAuthApp | undefined>;
+//# sourceMappingURL=refresolution.d.ts.map

package/dist/domain/oauthapp/refresolution/refresolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresolution.d.ts","sourceRoot":"","sources":["../../../../src/domain/oauthapp/refresolution/refresolution.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA2C/B"}

package/dist/domain/oauthapp/refresolution/refresolution.js

@@ -0,0 +1,79 @@
+/**
+ * OAuthApp ref resolution — ports pkg/domain/oauthapp/refresolution: the
+ * ONE answer to "which OAuthApp does this `oauth_app_ref` mean?" (the
+ * defaultinstance pattern — one small module holds a cross-domain semantic
+ * so its consumers cannot drift apart, stigmer/stigmer#584).
+ *
+ * Consumers: the OAuthApp delete guard (this domain, #13); the OAuth
+ * initiate path, the read-path oauth_status enricher, and the token-refresh
+ * path arrive with the mcpserver connect/OAuth sub-project (#19) and MUST
+ * route through this function — three hand-rolled divergent answers are
+ * exactly what #584 removed.
+ *
+ * Resolution semantics (OSS has a flat OAuthApp store — no org-override
+ * chain like the cloud's OAuthAppResolutionService, so the ref is the whole
+ * resolution): matching is by slug, with the ref's org as a preference
+ * rather than a gate:
+ *
+ *  1. An exact (org, slug) match wins — unique by the create pipeline's
+ *     duplicate check.
+ *  2. Otherwise a slug-only match is honored when it is UNIQUE. This lets
+ *     a self-hosted deployment satisfy seedpack refs pinned to
+ *     `org: stigmer` with an OAuthApp applied in the user's own org (#584).
+ *  3. Two or more slug matches with no exact hit resolve to nothing, with
+ *     a WARN naming the candidate orgs: ambiguity is never silently
+ *     collapsed into a credential pick.
+ *
+ * Returns undefined when nothing resolves; callers own the severity of that
+ * outcome (the delete guard treats it as unreferenced; initiate will refuse
+ * NOT_FOUND, refresh will error — #19).
+ */
+import { fromBinary } from "@bufbuild/protobuf";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+/**
+ * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
+ * without a slug resolves to nothing — an McpServerAuth with no (or an
+ * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup. Store
+ * errors propagate to the caller (Go returns them).
+ */
+export async function resolveOAuthAppRef(store, ref, logger) {
+    if (ref.slug === "") {
+        return undefined;
+    }
+    const rows = await store.listResources(ApiResourceKind.oauth_app);
+    // Collect-then-decide: a single pass gathers every slug match so the
+    // outcome depends only on the store's contents, never on its iteration
+    // order (Go's earlier first-match-wins scan was nondeterministic when a
+    // slug existed in several orgs).
+    const slugMatches = [];
+    for (const data of rows) {
+        let app;
+        try {
+            app = fromBinary(OAuthAppSchema, data);
+        }
+        catch {
+            continue; // skip malformed rows, as Go does
+        }
+        if ((app.metadata?.slug ?? "") !== ref.slug) {
+            continue;
+        }
+        if (ref.org !== "" && app.metadata?.org === ref.org) {
+            return app; // exact match: unique by the create duplicate check
+        }
+        slugMatches.push(app);
+    }
+    if (slugMatches.length === 0) {
+        return undefined;
+    }
+    if (slugMatches.length === 1) {
+        return slugMatches[0];
+    }
+    logger.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick — pin the ref's org to resolve", {
+        oauthAppSlug: ref.slug,
+        refOrg: ref.org,
+        candidateOrgs: slugMatches.map((app) => app.metadata?.org ?? ""),
+    });
+    return undefined;
+}
+//# sourceMappingURL=refresolution.js.map

package/dist/domain/oauthapp/refresolution/refresolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresolution.js","sourceRoot":"","sources":["../../../../src/domain/oauthapp/refresolution/refresolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAMnF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,GAAyB,EACzB,MAAc;IAEd,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAElE,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,iCAAiC;IACjC,MAAM,WAAW,GAAe,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YACpD,OAAO,GAAG,CAAC,CAAC,oDAAoD;QAClE,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CACT,kIAAkI,EAClI;QACE,YAAY,EAAE,GAAG,CAAC,IAAI;QACtB,MAAM,EAAE,GAAG,CAAC,GAAG;QACf,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;KACjE,CACF,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/domain/oauthapp/refresolution.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthApp } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { Store } from "../../store/interface.js";
+/**
+ * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
+ * without a slug resolves to nothing — an McpServerAuth with no (or an
+ * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup.
+ * Storage failures propagate; callers own their severity.
+ */
+export declare function resolveOAuthAppRef(store: Store, ref: ApiResourceReference | undefined, logger: Logger): Promise<OAuthApp | undefined>;
+//# sourceMappingURL=refresolution.d.ts.map

package/dist/domain/oauthapp/refresolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresolution.d.ts","sourceRoot":"","sources":["../../../src/domain/oauthapp/refresolution.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,oBAAoB,GAAG,SAAS,EACrC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA6C/B"}

package/dist/domain/oauthapp/refresolution.js

@@ -0,0 +1,83 @@
+/**
+ * OAuthApp reference resolution — ports pkg/domain/oauthapp/refresolution:
+ * the OSS semantics of resolving an `oauth_app_ref` (an
+ * ApiResourceReference on McpServerAuth) to a stored OAuthApp. One small
+ * module holds a cross-domain semantic so its consumers cannot drift
+ * apart (stigmer/stigmer#584, which found three divergent hand-rolled
+ * answers): the read-path oauth_status enricher (mcpserver, #9), the
+ * OAuth initiate and token-refresh paths (#19 — refresh MUST use the app
+ * initiate selected or it runs against the wrong vendor credentials), and
+ * the OAuthApp delete guard (#13). This file seeds src/domain/oauthapp/;
+ * the domain's controllers arrive with #13.
+ *
+ * Resolution semantics: OSS has a flat OAuthApp store — no org-override
+ * chain like the cloud's OAuthAppResolutionService, so the ref is the
+ * whole resolution (#558 DD-019). Matching is by slug, with the ref's org
+ * as a preference rather than a gate:
+ *
+ *  1. An exact (org, slug) match wins. Uniqueness is guaranteed by the
+ *     create pipeline's duplicate check.
+ *  2. Otherwise a slug-only match is honored when it is UNIQUE — what
+ *     lets a self-hosted deployment satisfy seedpack refs pinned to
+ *     `org: stigmer` with an OAuthApp applied in the user's own org.
+ *  3. Two or more slug matches with no exact hit resolve to nothing, with
+ *     a WARN naming the candidate orgs: ambiguity is never silently
+ *     collapsed into a credential pick.
+ *
+ * Returns undefined when nothing resolves; callers own the severity of
+ * that outcome (the enricher skips, initiate refuses NOT_FOUND, token
+ * refresh errors, the delete guard treats it as unreferenced).
+ *
+ * Proven by __tests__/refresolution.test.ts (Go's table ported).
+ */
+import { fromBinary } from "@bufbuild/protobuf";
+import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+/**
+ * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
+ * without a slug resolves to nothing — an McpServerAuth with no (or an
+ * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup.
+ * Storage failures propagate; callers own their severity.
+ */
+export async function resolveOAuthAppRef(store, ref, logger) {
+    const slug = ref?.slug ?? "";
+    if (slug === "") {
+        return undefined;
+    }
+    const rows = await store.listResources(ApiResourceKind.oauth_app);
+    // Collect-then-decide: a single pass gathers every slug match so the
+    // outcome depends only on the store's contents, never on its iteration
+    // order (Go's previous first-match-wins scan was nondeterministic when
+    // a slug existed in several orgs).
+    const slugMatches = [];
+    for (const data of rows) {
+        let app;
+        try {
+            app = fromBinary(OAuthAppSchema, data);
+        }
+        catch {
+            continue; // skip malformed rows, as Go does
+        }
+        if ((app.metadata?.slug ?? "") !== slug) {
+            continue;
+        }
+        const refOrg = ref?.org ?? "";
+        if (refOrg !== "" && app.metadata?.org === refOrg) {
+            return app; // exact match: unique by the create duplicate check
+        }
+        slugMatches.push(app);
+    }
+    if (slugMatches.length === 0) {
+        return undefined;
+    }
+    if (slugMatches.length === 1) {
+        return slugMatches[0];
+    }
+    logger.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick — pin the ref's org to resolve", {
+        oauthAppSlug: slug,
+        refOrg: ref?.org ?? "",
+        candidateOrgs: slugMatches.map((app) => app.metadata?.org ?? ""),
+    });
+    return undefined;
+}
+//# sourceMappingURL=refresolution.js.map

package/dist/domain/oauthapp/refresolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresolution.js","sourceRoot":"","sources":["../../../src/domain/oauthapp/refresolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAGnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,GAAqC,EACrC,MAAc;IAEd,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAElE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,WAAW,GAAe,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,GAAG,CAAC,CAAC,oDAAoD;QAClE,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CACT,kIAAkI,EAClI;QACE,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE;QACtB,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;KACjE,CACF,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/domain/oauthapp/steps.d.ts

@@ -0,0 +1,47 @@
+import type { DescMessage } from "@bufbuild/protobuf";
+import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+import type { OAuthApp } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { SecretService } from "../../encryption/encryption.js";
+import type { PipelineStep } from "../../pipeline/pipeline.js";
+import type { Store } from "../../store/interface.js";
+/**
+ * Replaces client_secret with the redaction marker (Go RedactOAuthApp).
+ *
+ * A function rather than a pipeline step because redaction applies at
+ * different points per operation: create/update after persist on newState;
+ * get/getByReference after load on the target; listByOrg per entry. Go's
+ * response list deliberately excludes DELETE — the delete RPC returns the
+ * STORED resource with its encrypted secret intact, ported byte-faithfully
+ * and disclosed in the PR (a cross-edition follow-up candidate: with
+ * encryption disabled the stored value is plaintext).
+ */
+export declare function redactOAuthApp(app: OAuthApp): void;
+/**
+ * EncryptClientSecret for the create pipeline (Go
+ * NewEncryptClientSecretForCreateStep): encrypts the plaintext secret;
+ * rejects the redaction marker — there is no existing secret to preserve.
+ */
+export declare function newEncryptClientSecretForCreateStep(secretService: SecretService, logger: Logger): PipelineStep<typeof OAuthAppSchema>;
+/**
+ * EncryptClientSecret for the update pipeline (Go
+ * NewEncryptClientSecretForUpdateStep): the redaction marker restores the
+ * stored encrypted value from ExistingResource; a new plaintext value is
+ * encrypted.
+ */
+export declare function newEncryptClientSecretForUpdateStep(secretService: SecretService, logger: Logger): PipelineStep<typeof OAuthAppSchema>;
+/**
+ * CheckNoReferencingMcpServers (Go newCheckNoReferencingMcpServersStep):
+ * blocks deletion while any McpServer's spec.auth.oauth_app_ref RESOLVES
+ * to the app being deleted — resolution semantics through the shared
+ * refresolution, not literal field match (stigmer/stigmer#584). A ref
+ * pinned to another org can reach this app through the unique-slug
+ * fallback (deleting would sever a live vendor-OAuth connection), while a
+ * literal match whose resolution lands elsewhere must not block.
+ *
+ * Requires LoadExistingForDelete to have run first (the OAuthApp being
+ * deleted is read from ExistingResource). Generic over the delete input
+ * Desc, like the shared delete steps.
+ */
+export declare function newCheckNoReferencingMcpServersStep<Desc extends DescMessage>(store: Store, logger: Logger): PipelineStep<Desc>;
+//# sourceMappingURL=steps.d.ts.map

package/dist/domain/oauthapp/steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steps.d.ts","sourceRoot":"","sources":["../../../src/domain/oauthapp/steps.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKtD,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AACnF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAUtD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CAIlD;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CACjD,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,OAAO,cAAc,CAAC,CAErC;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,OAAO,cAAc,CAAC,CAErC;AA4FD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,SAAS,WAAW,EAC1E,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,GACb,YAAY,CAAC,IAAI,CAAC,CA+DpB"}