feat(credentials): saved credentials for 17 more blocks, GitLab tokens, and keyless hardening (#9840)

* fix(credentials): accept scoped keys on save, isolate the retiring signing key, surface Databricks token errors

* improvement(credentials): report Databricks token failures in the shared service-account codes

* feat(credentials): saved credentials and credential-only versions for 17 more token blocks

Ashby, Calendly, Checkr, Fathom, Grain (v3), Granola, Lemlist, PagerDuty,
Resend, Rootly, Semrush, Sentry, Stripe, Telegram, Typeform, Vercel and
WhatsApp get a token credential with a vendor check on save and a
credential-only successor. Legacy blocks only gain hideFromToolbar and a
sunset; Telegram's params builder is extracted so the legacy block keeps
its bot-token check.

* fix(credentials): close batch-2 audit findings

Restricted keys that name their missing permission (Ashby, Resend,
ElevenLabs) are accepted through a provesKey check; Typeform rejects every
403; WhatsApp keeps the phone number ID in its own path segment; Semrush is
held back because its free balance check accepts unknown keys.

* improvement(credentials): put the credential picker under the operation picker and share the provider-failure split

Credential-only blocks now show their saved-credential picker right under
the operation picker. Validators reuse the tools' header builders, one
providerFailureCode decides caller vs provider errors (a Databricks token
reply without a token is the provider misbehaving), and new providers sit in
alphabetical order.

* fix(credentials): harden keyless sign-in for AWS and Databricks

Saving a keyless Databricks connection now refuses a federation policy that
trusts every Sim subject, as AWS roles already were. Keyless stays off when
the issuer isn't https on the default port, and an unpinned issuer is logged.
Docs cover a zero-downtime key rotation, the issuer requirements, finding the
service principal ID, and troubleshooting.

* feat(credentials): saved GitLab token credential and credential-only gitlab_v2

A GitLab credential holds a personal, project, or group access token and the
instance host (gitlab.com or self-managed). Saving verifies the token's
self-lookup at that exact host over the SSRF-guarded fetch with no redirects
and requires an active token with an API scope; runs only reach the verified
host. Successors may now state the picker's required rule when the replaced
fields differ (GitLab's host was optional).

* fix(credentials): close final-audit findings on keyless wording, issuer logs, and WhatsApp IDs

The Databricks refusal names the real cause (a subject_claim other than sub),
the issuer failure log points at the key or issuer, the AWS troubleshooting
leads with the message users see, rotation steps cover background workers,
and a WhatsApp phone number ID can no longer leave its path segment.

* fix(credentials): keep GitLab personal tokens available after GitLab moves to gitlab_v2

Personal-token visibility resolved the GitLab integration by the legacy block
type, so hiding that block and renaming its catalog entry hid every existing
personal token and refused new ones. It now resolves the current GitLab
version, and the integration page lists personal tokens beside saved GitLab
credentials.

* chore(credentials): cleanup pass on the batch-2 changes

* chore(credentials): shrink the unused-exports baseline

* fix(credentials): type the GitLab check's secure-fetch response

* fix(credentials): address review round 1

GitLab's integration page offers personal tokens and saved access tokens
side by side, a malformed GitLab token lookup reports the provider as
unavailable, and the keyless issuer refuses a query string or fragment.

* fix(credentials): close the PR-wide audit findings

Docs describe credential-only Telegram and Typeform actions and the issuer's
query/fragment refusal, PagerDuty and Grain copy name every token type that
works, Granola accepts a key whose note scope an admin turned off, a GitLab
reply that isn't a token lookup reports the provider, and Semrush's catalog
entry matches staging exactly.

* improvement(credentials): simplify and clean up the review-round changes

* fix(credentials): address review round 2

Ashby's restricted-key check reads the missing permission from object-shaped
error entries too, and a GitLab host that doesn't resolve is reported as not
found instead of the provider being unavailable.

Author: waleedlatif1

apps/docs/components/ui/icon-mapping.ts

@@ -355,6 +355,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   arxiv: ArxivIcon,
   asana: AsanaIcon,
   ashby: AshbyIcon,
+  ashby_v2: AshbyIcon,
   athena: AthenaIcon,
   athena_v2: AthenaIcon,
   attio: AttioIcon,
@@ -374,9 +375,11 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   buffer_v2: BufferIcon,
   calcom: CalComIcon,
   calendly: CalendlyIcon,
+  calendly_v2: CalendlyIcon,
   cbinsights: CbInsightsIcon,
   chat_trigger: Task,
   checkr: CheckrIcon,
+  checkr_v2: CheckrIcon,
   circleback: CirclebackIcon,
   circleback_v2: CirclebackIcon,
   clay: ClayIcon,
@@ -449,6 +452,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   extend_v2: ExtendIcon,
   extend_v3: ExtendIcon,
   fathom: FathomIcon,
+  fathom_v2: FathomIcon,
   file: DocumentIcon,
   file_v2: DocumentIcon,
   file_v3: DocumentIcon,
@@ -472,6 +476,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   github: GithubIcon,
   github_v2: GithubIcon,
   gitlab: GitLabIcon,
+  gitlab_v2: GitLabIcon,
   gmail: GmailIcon,
   gmail_v2: GmailIcon,
   gong: GongIcon,
@@ -503,7 +508,9 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   grafana: GrafanaIcon,
   grain: GrainIcon,
   grain_v2: GrainIcon,
+  grain_v3: GrainIcon,
   granola: GranolaIcon,
+  granola_v2: GranolaIcon,
   greenhouse: GreenhouseIcon,
   greenhouse_v2: GreenhouseIcon,
   greptile: GreptileIcon,
@@ -558,6 +565,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   launchdarkly_v2: LaunchDarklyIcon,
   leadmagic: LeadMagicIcon,
   lemlist: LemlistIcon,
+  lemlist_v2: LemlistIcon,
   linear: LinearIcon,
   linear_v2: LinearIcon,
   linkedin: LinkedInIcon,
@@ -622,6 +630,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   otter_v2: OtterIcon,
   outlook: OutlookIcon,
   pagerduty: PagerDutyIcon,
+  pagerduty_v2: PagerDutyIcon,
   parallel_ai: ParallelIcon,
   peopledatalabs: PeopleDataLabsIcon,
   perplexity: PerplexityIcon,
@@ -663,13 +672,15 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   reducto_v2: ReductoIcon,
   reducto_v3: ReductoIcon,
   resend: ResendIcon,
+  resend_v2: ResendIcon,
   response: ResponseIcon,
   revenuecat: RevenueCatIcon,
   rippling: RipplingIcon,
   rippling_v2: RipplingIcon,
   rocketlane: RocketlaneIcon,
   rocketlane_v2: RocketlaneIcon,
   rootly: RootlyIcon,
+  rootly_v2: RootlyIcon,
   router: ConnectIcon,
   router_v2: ConnectIcon,
   rss: RssIcon,
@@ -688,6 +699,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   sendgrid: SendgridIcon,
   sendgrid_v2: SendgridIcon,
   sentry: SentryIcon,
+  sentry_v2: SentryIcon,
   serper: SerperIcon,
   servicenow: ServiceNowIcon,
   servicenow_v2: ServiceNowIcon,
@@ -725,6 +737,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   start_trigger: StartIcon,
   starter: StartIcon,
   stripe: StripeIcon,
+  stripe_v2: StripeIcon,
   sts: STSIcon,
   sts_v2: STSIcon,
   stt: STTIcon,
@@ -737,6 +750,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   tavily: TavilyIcon,
   tavily_v2: TavilyIcon,
   telegram: TelegramIcon,
+  telegram_v2: TelegramIcon,
   temporal: TemporalIcon,
   textract: TextractIcon,
   textract_v2: TextractIcon,
@@ -755,12 +769,14 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   twilio_sms: TwilioIcon,
   twilio_voice: TwilioIcon,
   typeform: TypeformIcon,
+  typeform_v2: TypeformIcon,
   upstash: UpstashIcon,
   uptimerobot: UptimeRobotIcon,
   uptimerobot_v2: UptimeRobotIcon,
   vanta: VantaIcon,
   variables: VariableIcon,
   vercel: VercelIcon,
+  vercel_v2: VercelIcon,
   video_generator: VideoIcon,
   video_generator_v2: VideoIcon,
   video_generator_v3: VideoIcon,
@@ -771,6 +787,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   webflow: WebflowIcon,
   webhook_request: WebhookIcon,
   whatsapp: WhatsAppIcon,
+  whatsapp_v2: WhatsAppIcon,
   wikipedia: WikipediaIcon,
   windchill: WindchillIcon,
   wiza: WizaIcon,