fix(connect): resolve applications by client ID

[m-mohamed]

Summary

• resolve Connect applications by entity ID first, then exact indexed client_id
• match the WorkOS API contract that retrieval accepts an application ID or client ID
• preserve unknown-reference 404 behavior and prove ID-first collision semantics

Verification

• bun test: 976/976
• bun run typecheck
• bun run build
• bun run lint
• bun run fmt:check
• package, Node smoke, and generated-drift checks
• independent review: PASS

[greptile-apps]

Greptile Summary

The PR aligns Connect application lookup with the WorkOS contract by accepting either an application ID or an indexed client ID while preserving entity-ID precedence and unknown-reference behavior.

• Adds a shared ID-first application resolver.
• Uses the resolver for application retrieval and client-secret creation.
• Adds coverage for client-ID lookup, collisions, missing references, and secret creation.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/workos/routes/connect.ts	Introduces a primary-ID-first resolver and consistently applies it to application retrieval and client-secret creation.
src/workos/routes/connect.spec.ts	Adds focused regression coverage for client-ID resolution, ID collision precedence, missing references, and client-secret ownership.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Application reference] --> B{Matches entity ID?}
  B -->|Yes| C[Return ID owner]
  B -->|No| D{Matches indexed client_id?}
  D -->|Yes| E[Return client-ID owner]
  D -->|No| F[Return 404]

Loading

_{Reviews (2): Last reviewed commit: "fix(connect): resolve client_secrets rou..." | Re-trigger Greptile}

[gjtorikian]

thanks!