fix(oauth): reject user-scoped clients on single-workspace hosts

packages/core/sdk/src/oauth-flow.test.ts

@@ -874,7 +874,7 @@ describe("oauth.start / oauth.complete", () => {
         );
         expect(Predicate.isTagged("OAuthStartError")(error)).toBe(true);
         const startError = error as OAuthStartError;
-        expect(startError.message).toContain("must use a Workspace app");
+        expect(startError.message).toContain("must use an org-owned OAuth client");
       }),
     ),
   );

packages/core/sdk/src/oauth-service.ts

@@ -847,6 +847,13 @@ export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
     input: CreateOAuthClientInput,
   ): Effect.Effect<OAuthClientSlug, StorageFailure> =>
     Effect.gen(function* () {
+      if (input.owner === "user" && deps.subject === "local") {
+        return yield* new StorageError({
+          message:
+            'User-owned OAuth clients are not supported on single-workspace hosts. Use owner "org" instead.',
+          cause: undefined,
+        });
+      }
       // The `first-party:` namespace is reserved for config-declared apps — a
       // stored row under it would be shadowed by (or worse, impersonate) the
       // host's own app.
@@ -1423,7 +1430,7 @@ export const makeOAuthService = (deps: OAuthServiceDeps): OAuthService => {
       });
       if (!firstPartyFlow && input.owner === "org" && input.clientOwner === "user") {
         return yield* new OAuthStartError({
-          message: "A Workspace connection must use a Workspace app.",
+          message: "An org connection must use an org-owned OAuth client.",
         });
       }
       // Load the app by its EXPLICIT owner (the caller knows it — no derivation).