@stigmer/server 3.30.0 → 3.32.0

package/src/sandbox/kubernetes.ts

@@ -6,7 +6,8 @@
  * @kubernetes/client-node, the official client — this driver is the one
  * the cloud composition will eventually run in production, C4).
  *
- * Each sandbox = a per-sandbox Secret (STIGMER_TOKEN) + a single-replica
+ * Each sandbox = a per-sandbox Secret (STIGMER_TOKEN, plus the Temporal
+ * connection settings when the server's Temporal is authenticated) + a single-replica
  * Deployment (strategy Recreate) + a PVC-backed /workspace for the
  * persistent scopes (session, workflow — the Java persistent-scope
  * split; connect rides emptyDir). One shared namespace, never
@@ -255,6 +256,7 @@ export function buildSandboxSecret(
   scope: SandboxScope,
   id: string,
   stigmerToken: string,
+  temporalConnectionEnv: Readonly<Record<string, string>> = {},
 ): V1Secret {
   return {
     metadata: {
@@ -264,7 +266,10 @@ export function buildSandboxSecret(
     type: "Opaque",
     // A token-less sandbox still gets its (empty) Secret — the object
     // must exist for uniform cleanup (the Java posture).
-    stringData: stigmerToken !== "" ? { STIGMER_TOKEN: stigmerToken } : {},
+    stringData: {
+      ...temporalConnectionEnv,
+      ...(stigmerToken !== "" ? { STIGMER_TOKEN: stigmerToken } : {}),
+    },
   };
 }
 
@@ -308,6 +313,7 @@ export function buildSandboxDeployment(
     { name: "STIGMER_TASK_QUEUE", value: env.taskQueue },
     { name: "STIGMER_BACKEND_ENDPOINT", value: config.backendEndpoint },
     { name: "TEMPORAL_SERVICE_ADDRESS", value: config.temporalAddress },
+    { name: "TEMPORAL_NAMESPACE", value: config.temporalNamespace },
     { name: "WORKSPACE_ROOT_DIR", value: WORKSPACE_MOUNT_PATH },
   ];
   if (env.stigmerToken !== "") {
@@ -318,6 +324,15 @@ export function buildSandboxDeployment(
       },
     });
   }
+  // The Temporal connection settings sit in the same per-sandbox Secret as
+  // the token (buildSandboxSecret): they carry credentials, so the
+  // Deployment names them and never holds their values.
+  for (const name of Object.keys(config.temporalConnectionEnv)) {
+    containerEnv.push({
+      name,
+      valueFrom: { secretKeyRef: { name: `${baseName}-env`, key: name } },
+    });
+  }
 
   return {
     metadata: { name: baseName, labels },
@@ -417,7 +432,7 @@ export function newKubernetesSandboxProvisionerOverGateway(
       // references it), claim (reused when it survived a repair), then
       // the Deployment. No readiness wait (module header).
       await gateway.applySecret(
-        buildSandboxSecret(scope, id, env.stigmerToken),
+        buildSandboxSecret(scope, id, env.stigmerToken, config.temporalConnectionEnv),
       );
       if (PERSISTENT_SCOPES.has(scope)) {
         await gateway.applyPvc(buildWorkspacePvc(scope, id));

package/src/sandbox/local-process.ts

@@ -33,6 +33,8 @@ import { mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import path from "node:path";
 
+import { TEMPORAL_CONNECTION_ENV_NAMES } from "@stigmer/temporal-codecs";
+
 import type { Logger } from "../boot/logger.js";
 import type {
   SandboxEnvironment,
@@ -86,10 +88,18 @@ export const newLocalProcessSandboxProvisioner: SandboxProvisionerFactory = ({
     );
     mkdirSync(workspaceRoot, { recursive: true });
 
+    // The server's own Temporal connection settings are replaced by their
+    // rendered form, never inherited beside it: an inherited _PATH item
+    // next to its rendered _DATA twin is a boot refusal in the runner.
+    const inherited = Object.fromEntries(
+      Object.entries(process.env).filter(([name]) => !TEMPORAL_CONNECTION_ENV_NAMES.includes(name)),
+    );
     const childEnv: NodeJS.ProcessEnv = {
-      ...process.env,
+      ...inherited,
+      ...config.temporalConnectionEnv,
       MODE: "local",
       STIGMER_TASK_QUEUE: env.taskQueue,
+      TEMPORAL_NAMESPACE: config.temporalNamespace,
       WORKSPACE_ROOT_DIR: workspaceRoot,
     };
     if (config.backendEndpoint !== "") {

package/src/sandbox/provisioner.ts

@@ -136,6 +136,18 @@ export interface SandboxDriverConfig {
   readonly backendEndpoint: string;
   /** Temporal address as reachable from inside a sandbox (TEMPORAL_SERVICE_ADDRESS). */
   readonly temporalAddress: string;
+  /** The Temporal namespace the sandbox's runner polls in (TEMPORAL_NAMESPACE). */
+  readonly temporalNamespace: string;
+  /**
+   * How the sandbox's runner authenticates to that Temporal: the server's
+   * own `STIGMER_TEMPORAL_*` settings rendered by `temporalConnectionEnv`
+   * (`@stigmer/temporal-codecs`), every PEM item in its `_DATA` form so no
+   * file has to exist inside the sandbox. Empty for a plaintext Temporal.
+   * The values include credentials, so each driver passes them through the
+   * channel it uses for the token, never through argv or a plain manifest
+   * value.
+   */
+  readonly temporalConnectionEnv: Readonly<Record<string, string>>;
   /** The runner image for container-based drivers (docker/kubernetes). */
   readonly runnerImage: string;
   /** The runner executable for the local-process driver. */

package/src/temporal/__tests__/manager.test.ts

@@ -11,6 +11,9 @@
  *     lives forever — latent until #21/#22 add factories);
  *   - the Go availability parity: getClient() is undefined only until
  *     the first successful connect;
+ *   - both connections, the client's and the workers' native one, carry
+ *     the configured connection security (TLS and API key) beside the
+ *     address, and a plaintext manager passes neither;
  *   - deps.createWorker builds through THIS package's Worker.create with
  *     the manager's connection, namespace, and codec chain pre-wired
  *     (the finding-16 seam — factories never see the NativeConnection);
@@ -34,14 +37,34 @@ const sdkSpy = vi.hoisted(() => ({
   createCalls: [] as Record<string, unknown>[],
   /** The connection object the mocked NativeConnection.connect returned last. */
   lastConnection: undefined as unknown,
+  /** Options of every NativeConnection.connect and Connection.connect call. */
+  nativeConnectCalls: [] as Record<string, unknown>[],
+  clientConnectCalls: [] as Record<string, unknown>[],
 }));
 
+vi.mock("@temporalio/client", async (importOriginal) => {
+  const original = await importOriginal<typeof import("@temporalio/client")>();
+  return {
+    ...original,
+    Connection: {
+      connect: async (options: Record<string, unknown>) => {
+        sdkSpy.clientConnectCalls.push(options);
+        return { close: async () => {}, healthService: { check: async () => ({ status: 1 }) } };
+      },
+    },
+    Client: class {
+      constructor(readonly options: Record<string, unknown>) {}
+    },
+  };
+});
+
 vi.mock("@temporalio/worker", async (importOriginal) => {
   const original = await importOriginal<typeof import("@temporalio/worker")>();
   return {
     ...original,
     NativeConnection: {
-      connect: async () => {
+      connect: async (options: Record<string, unknown>) => {
+        sdkSpy.nativeConnectCalls.push(options);
         const connection = { close: async () => {} };
         sdkSpy.lastConnection = connection;
         return connection;
@@ -74,6 +97,8 @@ const managers: TemporalManager[] = [];
 afterEach(async () => {
   sdkSpy.createCalls.length = 0;
   sdkSpy.lastConnection = undefined;
+  sdkSpy.nativeConnectCalls.length = 0;
+  sdkSpy.clientConnectCalls.length = 0;
   for (const manager of managers.splice(0)) {
     await manager.close();
   }
@@ -108,11 +133,13 @@ function newManager(
     payloadCodecs?: ConstructorParameters<
       typeof TemporalManager
     >[0]["payloadCodecs"];
+    connection?: ConstructorParameters<typeof TemporalManager>[0]["connection"];
   },
 ): TemporalManager {
   const manager = new TemporalManager({
     hostPort: "127.0.0.1:1",
     namespace: "default",
+    connection: options?.connection ?? {},
     logger: options?.logger ?? silentLogger,
     payloadCodecs: options?.payloadCodecs ?? [],
     workerFactories: factories,
@@ -283,6 +310,37 @@ describe("TemporalManager createWorker capability (the finding-16 seam)", () =>
   });
 });
 
+describe("TemporalManager connection security", () => {
+  it("spreads TLS and the API key into both the client's and the workers' connections", async () => {
+    const security = {
+      tls: { serverNameOverride: "temporal.internal" },
+      apiKey: "api-key-1",
+    };
+    const manager = newManager([fakeWorkerFactory({ shutdowns: 0 })], {
+      connection: security,
+    });
+
+    await manager.initialConnect();
+    await manager.startWorkers();
+
+    expect(sdkSpy.clientConnectCalls).toHaveLength(1);
+    expect(sdkSpy.clientConnectCalls[0]).toMatchObject({ address: "127.0.0.1:1", ...security });
+    expect(sdkSpy.nativeConnectCalls).toHaveLength(1);
+    expect(sdkSpy.nativeConnectCalls[0]).toEqual({ address: "127.0.0.1:1", ...security });
+  });
+
+  it("passes neither for a plaintext manager", async () => {
+    const manager = newManager([fakeWorkerFactory({ shutdowns: 0 })]);
+
+    await manager.initialConnect();
+    await manager.startWorkers();
+
+    expect(sdkSpy.clientConnectCalls[0]).not.toHaveProperty("tls");
+    expect(sdkSpy.clientConnectCalls[0]).not.toHaveProperty("apiKey");
+    expect(sdkSpy.nativeConnectCalls[0]).toEqual({ address: "127.0.0.1:1" });
+  });
+});
+
 describe("TemporalManager worker-death observability", () => {
   it("logs a run() rejection at ERROR with the dead worker's queue identity", async () => {
     const lines: string[] = [];

package/src/temporal/manager.ts

@@ -32,6 +32,12 @@
  * connection errors exactly as Go's stale-client operations do, and the
  * health monitor swaps in a fresh client when the server returns.
  *
+ * One choke point for connection security: `connection` (TLS, mutual TLS,
+ * an API key; `@stigmer/temporal-codecs`' `loadTemporalConnectionConfig`)
+ * is spread into BOTH connects, the client's and the workers' native one,
+ * so every worker, OSS and extension alike, authenticates the same way
+ * through createWorker. Absent settings keep the plaintext connection.
+ *
  * One choke point for payload decryption: the codecs are installed on the
  * client at dial AND wired into every worker by the deps' createWorker
  * capability (the TS SDK's Worker.create takes its own dataConverter; Go
@@ -40,6 +46,7 @@
  */
 import { Client, Connection } from "@temporalio/client";
 import type { PayloadCodec } from "@temporalio/common";
+import type { TemporalConnectionConfig } from "@stigmer/temporal-codecs";
 import {
   NativeConnection,
   Worker,
@@ -150,6 +157,8 @@ export type WorkerFactory = (deps: WorkerFactoryDeps) => Promise<Worker>;
 export interface TemporalManagerOptions {
   readonly hostPort: string;
   readonly namespace: string;
+  /** TLS and API key for both connections; `{}` for plaintext. */
+  readonly connection: TemporalConnectionConfig;
   readonly logger: Logger;
   readonly payloadCodecs: PayloadCodec[];
   readonly workerFactories: readonly WorkerFactory[];
@@ -163,6 +172,7 @@ interface RunningWorker {
 export class TemporalManager {
   private readonly hostPort: string;
   private readonly namespace: string;
+  private readonly connectionSecurity: TemporalConnectionConfig;
   private readonly logger: Logger;
   private readonly payloadCodecs: PayloadCodec[];
   private readonly workerFactories: readonly WorkerFactory[];
@@ -184,6 +194,7 @@ export class TemporalManager {
   constructor(options: TemporalManagerOptions) {
     this.hostPort = options.hostPort;
     this.namespace = options.namespace;
+    this.connectionSecurity = options.connection;
     this.logger = options.logger;
     this.payloadCodecs = options.payloadCodecs;
     this.workerFactories = options.workerFactories;
@@ -328,6 +339,7 @@ export class TemporalManager {
     const connection = await Connection.connect({
       address: this.hostPort,
       connectTimeout: DIAL_CONNECT_TIMEOUT_MS,
+      ...this.connectionSecurity,
     });
     const client = new Client({
       connection,
@@ -494,6 +506,7 @@ export class TemporalManager {
   private async createAndRunWorkers(): Promise<void> {
     const nativeConnection = await NativeConnection.connect({
       address: this.hostPort,
+      ...this.connectionSecurity,
     });
     this.nativeConnection = nativeConnection;
 

package/dist/domain/oauthapp/refresolution/refresolution.d.ts

@@ -1,12 +0,0 @@
-import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import type { OAuthApp } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-import type { Logger } from "../../../boot/logger.js";
-import type { Store } from "../../../store/interface.js";
-/**
- * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
- * without a slug resolves to nothing — an McpServerAuth with no (or an
- * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup. Store
- * errors propagate to the caller (Go returns them).
- */
-export declare function resolveOAuthAppRef(store: Store, ref: ApiResourceReference, logger: Logger): Promise<OAuthApp | undefined>;
-//# sourceMappingURL=refresolution.d.ts.map

package/dist/domain/oauthapp/refresolution/refresolution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresolution.d.ts","sourceRoot":"","sources":["../../../../src/domain/oauthapp/refresolution/refresolution.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAGjG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAElF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,oBAAoB,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA2C/B"}

package/dist/domain/oauthapp/refresolution/refresolution.js

@@ -1,79 +0,0 @@
-/**
- * OAuthApp ref resolution — ports pkg/domain/oauthapp/refresolution: the
- * ONE answer to "which OAuthApp does this `oauth_app_ref` mean?" (the
- * defaultinstance pattern — one small module holds a cross-domain semantic
- * so its consumers cannot drift apart, stigmer/stigmer#584).
- *
- * Consumers: the OAuthApp delete guard (this domain, #13); the OAuth
- * initiate path, the read-path oauth_status enricher, and the token-refresh
- * path arrive with the mcpserver connect/OAuth sub-project (#19) and MUST
- * route through this function — three hand-rolled divergent answers are
- * exactly what #584 removed.
- *
- * Resolution semantics (OSS has a flat OAuthApp store — no org-override
- * chain like the cloud's OAuthAppResolutionService, so the ref is the whole
- * resolution): matching is by slug, with the ref's org as a preference
- * rather than a gate:
- *
- *  1. An exact (org, slug) match wins — unique by the create pipeline's
- *     duplicate check.
- *  2. Otherwise a slug-only match is honored when it is UNIQUE. This lets
- *     a deployment satisfy a public server's ref pinned to
- *     `org: stigmer` with an OAuthApp applied in the user's own org (#584).
- *  3. Two or more slug matches with no exact hit resolve to nothing, with
- *     a WARN naming the candidate orgs: ambiguity is never silently
- *     collapsed into a credential pick.
- *
- * Returns undefined when nothing resolves; callers own the severity of that
- * outcome (the delete guard treats it as unreferenced; initiate will refuse
- * NOT_FOUND, refresh will error — #19).
- */
-import { fromBinary } from "@bufbuild/protobuf";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-/**
- * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
- * without a slug resolves to nothing — an McpServerAuth with no (or an
- * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup. Store
- * errors propagate to the caller (Go returns them).
- */
-export async function resolveOAuthAppRef(store, ref, logger) {
-    if (ref.slug === "") {
-        return undefined;
-    }
-    const rows = await store.listResources(ApiResourceKind.oauth_app);
-    // Collect-then-decide: a single pass gathers every slug match so the
-    // outcome depends only on the store's contents, never on its iteration
-    // order (Go's earlier first-match-wins scan was nondeterministic when a
-    // slug existed in several orgs).
-    const slugMatches = [];
-    for (const data of rows) {
-        let app;
-        try {
-            app = fromBinary(OAuthAppSchema, data);
-        }
-        catch {
-            continue; // skip malformed rows, as Go does
-        }
-        if ((app.metadata?.slug ?? "") !== ref.slug) {
-            continue;
-        }
-        if (ref.org !== "" && app.metadata?.org === ref.org) {
-            return app; // exact match: unique by the create duplicate check
-        }
-        slugMatches.push(app);
-    }
-    if (slugMatches.length === 0) {
-        return undefined;
-    }
-    if (slugMatches.length === 1) {
-        return slugMatches[0];
-    }
-    logger.warn("oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick — pin the ref's org to resolve", {
-        oauthAppSlug: ref.slug,
-        refOrg: ref.org,
-        candidateOrgs: slugMatches.map((app) => app.metadata?.org ?? ""),
-    });
-    return undefined;
-}
-//# sourceMappingURL=refresolution.js.map

package/dist/domain/oauthapp/refresolution/refresolution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"refresolution.js","sourceRoot":"","sources":["../../../../src/domain/oauthapp/refresolution/refresolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAMnF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAY,EACZ,GAAyB,EACzB,MAAc;IAEd,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAElE,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,iCAAiC;IACjC,MAAM,WAAW,GAAe,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,kCAAkC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YACpD,OAAO,GAAG,CAAC,CAAC,oDAAoD;QAClE,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,IAAI,CACT,kIAAkI,EAClI;QACE,YAAY,EAAE,GAAG,CAAC,IAAI;QACtB,MAAM,EAAE,GAAG,CAAC,GAAG;QACf,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;KACjE,CACF,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/src/domain/oauthapp/refresolution/refresolution.ts

@@ -1,94 +0,0 @@
-/**
- * OAuthApp ref resolution — ports pkg/domain/oauthapp/refresolution: the
- * ONE answer to "which OAuthApp does this `oauth_app_ref` mean?" (the
- * defaultinstance pattern — one small module holds a cross-domain semantic
- * so its consumers cannot drift apart, stigmer/stigmer#584).
- *
- * Consumers: the OAuthApp delete guard (this domain, #13); the OAuth
- * initiate path, the read-path oauth_status enricher, and the token-refresh
- * path arrive with the mcpserver connect/OAuth sub-project (#19) and MUST
- * route through this function — three hand-rolled divergent answers are
- * exactly what #584 removed.
- *
- * Resolution semantics (OSS has a flat OAuthApp store — no org-override
- * chain like the cloud's OAuthAppResolutionService, so the ref is the whole
- * resolution): matching is by slug, with the ref's org as a preference
- * rather than a gate:
- *
- *  1. An exact (org, slug) match wins — unique by the create pipeline's
- *     duplicate check.
- *  2. Otherwise a slug-only match is honored when it is UNIQUE. This lets
- *     a deployment satisfy a public server's ref pinned to
- *     `org: stigmer` with an OAuthApp applied in the user's own org (#584).
- *  3. Two or more slug matches with no exact hit resolve to nothing, with
- *     a WARN naming the candidate orgs: ambiguity is never silently
- *     collapsed into a credential pick.
- *
- * Returns undefined when nothing resolves; callers own the severity of that
- * outcome (the delete guard treats it as unreferenced; initiate will refuse
- * NOT_FOUND, refresh will error — #19).
- */
-import { fromBinary } from "@bufbuild/protobuf";
-
-import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-import type { OAuthApp } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-
-import type { Logger } from "../../../boot/logger.js";
-import type { Store } from "../../../store/interface.js";
-
-/**
- * Resolves the OAuthApp the ref means (Go refresolution.Resolve). A ref
- * without a slug resolves to nothing — an McpServerAuth with no (or an
- * empty) oauth_app_ref is the DCR/manual-token arm, not a lookup. Store
- * errors propagate to the caller (Go returns them).
- */
-export async function resolveOAuthAppRef(
-  store: Store,
-  ref: ApiResourceReference,
-  logger: Logger,
-): Promise<OAuthApp | undefined> {
-  if (ref.slug === "") {
-    return undefined;
-  }
-
-  const rows = await store.listResources(ApiResourceKind.oauth_app);
-
-  // Collect-then-decide: a single pass gathers every slug match so the
-  // outcome depends only on the store's contents, never on its iteration
-  // order (Go's earlier first-match-wins scan was nondeterministic when a
-  // slug existed in several orgs).
-  const slugMatches: OAuthApp[] = [];
-  for (const data of rows) {
-    let app: OAuthApp;
-    try {
-      app = fromBinary(OAuthAppSchema, data);
-    } catch {
-      continue; // skip malformed rows, as Go does
-    }
-    if ((app.metadata?.slug ?? "") !== ref.slug) {
-      continue;
-    }
-    if (ref.org !== "" && app.metadata?.org === ref.org) {
-      return app; // exact match: unique by the create duplicate check
-    }
-    slugMatches.push(app);
-  }
-
-  if (slugMatches.length === 0) {
-    return undefined;
-  }
-  if (slugMatches.length === 1) {
-    return slugMatches[0];
-  }
-  logger.warn(
-    "oauth_app_ref is ambiguous (slug exists in several orgs, none matching the ref); refusing to pick — pin the ref's org to resolve",
-    {
-      oauthAppSlug: ref.slug,
-      refOrg: ref.org,
-      candidateOrgs: slugMatches.map((app) => app.metadata?.org ?? ""),
-    },
-  );
-  return undefined;
-}