fix(credentials): enforce the saved-credential contract on every credential block, reopen key-based reconnects on their mode, and tighten fixtures and skills

- check-block-registry runs the saved-credential contract for every block with a
  saved-credential picker, not only successors; the per-block contract moves to
  saved-credential-contract.ts with tests. The host probe gains a path-shaped id and a
  per-param shape so mixed-validation builders (Jama, Higgsfield) are probed, not guessed.
- Blocks the widened check caught: Coda, Harmonic, and Oracle Database tools declare
  credentialKind 'service-account'; NetSuite pins instanceUrl in authoritativeParams;
  Vanta's assetExternalAccountId is a filter, not a host.
- prepareWorkloadIdentity covers every keyless provider (AWS, Databricks added) and
  reuses audiences.ts for the provider-id mapping; the AWS and Databricks dialogs reopen
  a reconnect on the stored mode.
- Snowflake keyless verification maps an egress refusal to host_not_allowed.
- Neutral token fixtures in new credential tests; subject uniqueness TSDoc; skills
  describe native token blocks, the picker shape, keyless setup, and the successor naming
  exception.

Author: waleedlatif1

.agents/skills/add-block/SKILL.md

@@ -83,7 +83,8 @@ export const {ServiceName}Block: BlockConfig = {
 // Multi-line input
 { id: 'field', title: 'Label', type: 'long-input', placeholder: '...', rows: 6 }
 
-// Password input
+// Password input: only for legacy blocks or a secret with no saved-credential fit
+// (model-provider keys, hosted-key pairs); a service token uses a saved credential
 { id: 'apiKey', title: 'API Key', type: 'short-input', password: true }
 ```
 
@@ -136,6 +137,32 @@ export const {ServiceName}Block: BlockConfig = {
 }
 ```
 
+A service-account-only picker (a saved token or key credential) instead sets
+`credentialKind: 'service-account'` and `mode: 'basic'` (no scopes), and pairs with an advanced
+twin; `isSavedCredentialPicker` matches only this shape:
+```typescript
+{
+  id: 'credential',
+  title: '{Service} Account',
+  type: 'oauth-input',
+  serviceId: '{service}',
+  credentialKind: 'service-account',
+  canonicalParamId: 'oauthCredential',
+  mode: 'basic',
+  placeholder: 'Select {Service} credential',
+  required: true,
+},
+{
+  id: 'manualCredential',
+  title: '{Service} Account',
+  type: 'short-input',
+  canonicalParamId: 'oauthCredential',
+  mode: 'advanced',
+  placeholder: 'Enter credential ID',
+  required: true,
+}
+```
+
 **Scopes:** Always use `getScopesForService(serviceId)` from `@/lib/oauth/utils` for `requiredScopes`. Never hardcode scope arrays — the single source of truth is `OAUTH_PROVIDERS` in `lib/oauth/oauth.ts`.
 
 **Scope descriptions:** When adding a new OAuth provider, also add human-readable descriptions for all scopes in `SCOPE_DESCRIPTIONS` within `lib/oauth/utils.ts`.
@@ -695,7 +722,8 @@ outputs: {
 When creating V2 blocks (alongside legacy V1):
 
 ```typescript
-// V1 Block - mark as legacy
+// V1 Block - mark as legacy. A credential-only successor is the exception: the
+// successor keeps the legacy block's name, so neither block is renamed.
 export const ServiceBlock: BlockConfig = {
   type: 'service',
   name: 'Service (Legacy)',

.agents/skills/add-integration/SKILL.md

@@ -43,6 +43,12 @@ supported paths and choose the simplest supported setup for the intended user:
 | Customer-owned client credentials | Saved `service_account` credential with a client ID and secret | Internal-app eligibility, grant activation, scope syntax, token lifetime and revocation behavior |
 | API token or personal access token | Saved token service account when reusable connections are useful | Token permissions, identity verification, expiry and rotation |
 | Private key, certificate, or service-account JSON | Existing key-based service-account framework | Signing algorithm, audience, subject, tenant binding and key rotation |
+| Cloud workload identity (AWS role, Databricks/Snowflake/Entra/GCP federation) | Keyless saved credential: Sim signs a short-lived OIDC token the customer's cloud trusts. Add the provider to every table in `lib/credentials/workload-identity/audiences.ts` (`WORKLOAD_IDENTITY_PROVIDERS`, its service-account provider ID map, `WORKLOAD_IDENTITY_KEYLESS_CONFIGS`, `WORKLOAD_IDENTITY_AUDIENCES`) and to `MIXED_MODE_PROVIDERS` in `lib/credentials/application/prepare-workload-identity.ts` | Issuer and audience the provider accepts, how the trust pins the subject, token lifetime |
+
+API, CLI, and MCP callers set up keyless in two steps: `POST /api/v2/credentials/workload-identity/subjects`
+(or `sim credentials keyless-subject <providerId> --output json`) returns the subject to trust and a
+`keylessConfig`; they add its `requiredConfigFields` and create the credential with it. The provider
+catalog advertises `keyless` only when the deployment can sign tokens.
 
 Do not present customer-owned credentials as a way around a provider's approval requirements
 for a shared public integration. Explain the supported account/app type in the setup docs. Keep
@@ -86,15 +92,23 @@ service id:
    answers), and `errorBodyEchoesToken` when an error body echoes the token.
 3. `apps/sim/lib/oauth/oauth.ts` and `types.ts`: the service entry (`authType: 'service_account'`,
    `serviceAccountProviderId`).
-4. `apps/sim/tools/shared/saved-credentials.ts`: `tokenCredentialOAuth('<service>', { <toolParam>:
-   'accessToken' | 'domain' | 'providerWorkspaceId' })`, listed in `SAVED_CREDENTIAL_OAUTH`, and set
-   as `oauth` on every tool. Map every param that decides the request host; the executor overwrites
-   mapped params after authorizing the credential, and `check-block-registry` probes the tools' real
-   URL builders and fails on a host-steering param left unmapped.
+4. The tools' credential policy. A NEW integration's tools take a hidden `accessToken` and declare
+   `oauth: { required: true, provider: '<service>', credentialKind: 'service-account' }`, pinning
+   any host or account param with `authoritativeParams` (Flow's and Snowflake's tools are the
+   pattern). `tokenCredentialOAuth('<service>', { <toolParam>: 'accessToken' | 'domain' |
+   'providerWorkspaceId' })` in `apps/sim/tools/shared/saved-credentials.ts`, listed in
+   `SAVED_CREDENTIAL_OAUTH`, is for existing tools that already take the token inline (successors).
+   Either way, the executor overwrites mapped and pinned params after authorizing the credential,
+   and `check-block-registry` probes the real URL builders of every block with a saved-credential
+   picker and fails on a host-steering param left unmapped or unpinned.
 5. A credential-only block (including a successor) uses `authMode: AuthMode.OAuth`, so the
    generated catalog maps the service; a token-only block that keeps `AuthMode.ApiKey`, as Coda
    does, registers in `tokenCredentialIntegrationTypes` instead (see below). The credential picker
-   sits directly under the operation dropdown (`add-block` → OAuth/Credentials). An existing block that already takes the secret inline is never edited in
+   sits directly under the operation dropdown (`add-block` → OAuth/Credentials). A new block
+   writes the picker inline, as Higgsfield does: `{ id: 'credential', type: 'oauth-input', serviceId,
+   credentialKind: 'service-account', canonicalParamId: 'oauthCredential', mode: 'basic',
+   required: true }`, plus a `manualCredential` `short-input` with the same `canonicalParamId` in
+   `mode: 'advanced'`. An existing block that already takes the secret inline is never edited in
    place: add a credential-only successor (`add-block` → Credential-only successor).
 
 Then run `generate-docs`, `generate:block-successors`, `generate:deployment-config`, and
@@ -461,7 +475,8 @@ If creating V2 versions (API-aligned outputs):
 
 1. **V2 Tools** - Add `_v2` suffix, version `2.0.0`, flat outputs
 2. **V2 Block** - Add `_v2` type, use `createVersionedToolSelector`
-3. **V1 Block** - Add `(Legacy)` to name, set `hideFromToolbar: true`, and add
+3. **V1 Block** - Add `(Legacy)` to name (a credential-only successor is the exception: it keeps
+   the legacy block's name), set `hideFromToolbar: true`, and add
    `sunset: { status: 'legacy', replacedBy: '{service}_v2' }` — `check-block-registry`
    fails a legacy block with no `replacedBy`, and the amber legacy badge plus its
    click-to-upgrade action read from that field.

.agents/skills/validate-integration/SKILL.md

@@ -226,6 +226,13 @@ For **each tool** in `tools.access`:
       `tokenCredentialOAuth` policy, every
       param that decides the request host is mapped, and the stored domain is in the form the tools
       build URLs from (`check-block-registry.ts origin/staging` passes)
+- [ ] A non-successor token block's tools declare `oauth: { required: true, provider,
+      credentialKind: 'service-account' }` and pin every host or account param in
+      `authoritativeParams` (`check-block-registry` enforces this for every block with a
+      saved-credential picker)
+- [ ] A keyless provider appears in every table in `lib/credentials/workload-identity/audiences.ts`
+      and in `MIXED_MODE_PROVIDERS` (`prepare-workload-identity.ts`), and the provider catalog
+      shows `keyless` only when the deployment can sign tokens
 - [ ] The `tokenCheckValidator` request uses the tools' host and auth, its normalizers refuse
       anything that could steer the host or path, and a fake key is rejected without a valid
       scoped key being refused

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal.tsx

@@ -114,9 +114,17 @@ function AwsAccountForm({
   const [displayName, setDisplayName] = useState(initialDisplayName ?? '')
   const [description, setDescription] = useState(initialDescription ?? '')
 
-  // Keyless is the default wherever this deployment supports it.
-  const authType: AwsAuthType =
-    selectedAuthType ?? (keyless.available ? 'oidc_role' : 'access_keys')
+  // A reconnect opens on keyless only for a keyless credential, so a key-based connection is
+  // never switched to keyless by default; a new connection defaults to keyless wherever this
+  // deployment supports it.
+  const defaultAuthType: AwsAuthType = credentialId
+    ? keyless.reconnectsKeyless
+      ? 'oidc_role'
+      : 'access_keys'
+    : keyless.available
+      ? 'oidc_role'
+      : 'access_keys'
+  const authType: AwsAuthType = selectedAuthType ?? defaultAuthType
   const needsKeys = authType === 'access_keys' || authType === 'assume_role'
   const needsRole = authType === 'oidc_role' || authType === 'assume_role'
   const disabled =

apps/sim/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/databricks-account-modal.tsx

@@ -93,9 +93,17 @@ function DatabricksAccountForm({
   const [displayName, setDisplayName] = useState(initialDisplayName ?? '')
   const [description, setDescription] = useState(initialDescription ?? '')
 
-  // Keyless is the default wherever this deployment supports it.
-  const authType: DatabricksAuthType =
-    selectedAuthType ?? (keyless.available ? 'oidc_federation' : 'service_principal')
+  // A reconnect opens on keyless only for a keyless credential, so a key-based connection is
+  // never switched to keyless by default; a new connection defaults to keyless wherever this
+  // deployment supports it.
+  const defaultAuthType: DatabricksAuthType = credentialId
+    ? keyless.reconnectsKeyless
+      ? 'oidc_federation'
+      : 'service_principal'
+    : keyless.available
+      ? 'oidc_federation'
+      : 'service_principal'
+  const authType: DatabricksAuthType = selectedAuthType ?? defaultAuthType
   const usesServicePrincipal = authType === 'service_principal' || authType === 'oidc_federation'
   const disabled =
     isPending ||

apps/sim/lib/credentials/application/prepare-workload-identity.test.ts

@@ -59,7 +59,9 @@ function reconnecting(
   encryptionMockFns.mockDecryptSecret.mockResolvedValue({ decrypted: JSON.stringify(secret) })
 }
 
-function prepare(provider: 'snowflake' | 'google' | 'microsoft' = 'snowflake') {
+function prepare(
+  provider: 'aws' | 'databricks' | 'snowflake' | 'google' | 'microsoft' = 'snowflake'
+) {
   return prepareWorkloadIdentity.execute({
     principal,
     input: { workspaceId: 'workspace-1', provider, credentialId: 'cred-1' },
@@ -198,3 +200,80 @@ describe('preparing a Microsoft app credential reconnect', () => {
     expect(await prepare('microsoft')).not.toHaveProperty('reconnectsKeyless')
   })
 })
+
+describe('preparing an AWS or Databricks reconnect', () => {
+  const subject = 'sim:workspace:workspace-1:credential:abcdef0123456789'
+  const roleArn = 'arn:aws:iam::123456789012:role/sim-role'
+  const accessKeys = { accessKeyId: 'TESTACCESSKEYID0000', secretAccessKey: 'test-secret' }
+  const databricksHost = 'dbc-00000000-0000.cloud.databricks.com'
+  const clientId = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee'
+
+  beforeEach(() => {
+    workspaceContextMockFns.mockLoadActiveWorkspaceApplicationContext.mockResolvedValue({
+      workspaceId: 'workspace-1',
+      workspaceOrganizationId: null,
+      allowPersonalApiKeys: true,
+      billedAccountUserId: 'user-1',
+    })
+    workspaceAuthzMockFns.mockResolveEffectiveWorkspacePermission.mockResolvedValue('write')
+  })
+
+  it.each([
+    {
+      provider: 'aws' as const,
+      providerId: 'aws-service-account',
+      config: { authType: 'oidc_role', roleArn, subject },
+      type: 'aws_credential_v1',
+    },
+    {
+      provider: 'databricks' as const,
+      providerId: 'databricks-service-account',
+      config: { authType: 'oidc_federation', host: databricksHost, clientId, subject },
+      type: 'databricks_credential_v1',
+    },
+  ])(
+    'opens a keyless $provider credential on keyless',
+    async ({ provider, providerId, ...secret }) => {
+      reconnecting(secret, { providerId })
+      await expect(prepare(provider)).resolves.toMatchObject({ reconnectsKeyless: true })
+    }
+  )
+
+  it.each([
+    {
+      provider: 'aws' as const,
+      providerId: 'aws-service-account',
+      config: { authType: 'access_keys', ...accessKeys },
+      type: 'aws_credential_v1',
+    },
+    {
+      provider: 'aws' as const,
+      providerId: 'aws-service-account',
+      config: { authType: 'assume_role', ...accessKeys, roleArn },
+      type: 'aws_credential_v1',
+    },
+    {
+      provider: 'databricks' as const,
+      providerId: 'databricks-service-account',
+      config: { authType: 'personal_access_token', host: databricksHost, token: 'test-token' },
+      type: 'databricks_credential_v1',
+    },
+    {
+      provider: 'databricks' as const,
+      providerId: 'databricks-service-account',
+      config: {
+        authType: 'service_principal',
+        host: databricksHost,
+        clientId,
+        clientSecret: 'test-secret',
+      },
+      type: 'databricks_credential_v1',
+    },
+  ])(
+    'opens a $config.authType $provider credential on its keyed mode',
+    async ({ provider, providerId, ...secret }) => {
+      reconnecting(secret, { providerId })
+      expect(await prepare(provider)).not.toHaveProperty('reconnectsKeyless')
+    }
+  )
+})

apps/sim/lib/credentials/application/prepare-workload-identity.ts

@@ -4,23 +4,22 @@ import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { decryptSecret } from '@/lib/core/security/encryption'
 import { getCredentialActorContext } from '@/lib/credentials/access'
 import { credentialOperations } from '@/lib/credentials/application/operations'
+import { isKeylessAwsSecret } from '@/lib/credentials/aws-service-account.server'
+import { isKeylessDatabricksSecret } from '@/lib/credentials/databricks-service-account.server'
 import { isGoogleWorkloadIdentitySecret } from '@/lib/credentials/google-workload-identity'
 import { isKeylessMicrosoftAppSecret } from '@/lib/credentials/microsoft-app-service-account.server'
 import { isKeylessSnowflakeSecret } from '@/lib/credentials/snowflake-service-account.server'
-import { SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID } from '@/lib/credentials/token-service-accounts/descriptors'
 import {
   fixedWorkloadIdentityAudience,
+  isWorkloadIdentityServiceAccountProviderId,
   type WorkloadIdentityProvider,
+  workloadIdentityProviderFor,
 } from '@/lib/credentials/workload-identity/audiences'
 import {
   getWorkloadIdentityIssuer,
   isWorkloadIdentityConfigured,
 } from '@/lib/credentials/workload-identity/issuer'
 import { issueWorkloadIdentitySubject } from '@/lib/credentials/workload-identity/subject'
-import {
-  GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID,
-  MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID,
-} from '@/lib/oauth/types'
 import { loadActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/context'
 
 export interface PrepareWorkloadIdentityInput {
@@ -44,29 +43,20 @@ export type PrepareWorkloadIdentityResult =
       reconnectsKeyless?: true
     }
 
-/** Providers whose credentials can be keyless or key-based under one provider ID. */
-const MIXED_MODE_PROVIDERS: Partial<
-  Record<
-    WorkloadIdentityProvider,
-    { providerId: string; isKeyless: (decrypted: string) => boolean }
-  >
-> = {
-  snowflake: {
-    providerId: SNOWFLAKE_SERVICE_ACCOUNT_PROVIDER_ID,
-    isKeyless: isKeylessSnowflakeSecret,
-  },
-  microsoft: {
-    providerId: MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID,
-    isKeyless: isKeylessMicrosoftAppSecret,
-  },
-  google: {
-    providerId: GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID,
-    isKeyless: isGoogleWorkloadIdentitySecret,
-  },
+/**
+ * Every keyless provider also has key-based modes under the same provider ID, so a
+ * reconnect reads the stored secret to open the dialog on the mode it holds.
+ */
+const MIXED_MODE_PROVIDERS: Record<WorkloadIdentityProvider, (decrypted: string) => boolean> = {
+  aws: isKeylessAwsSecret,
+  databricks: isKeylessDatabricksSecret,
+  snowflake: isKeylessSnowflakeSecret,
+  microsoft: isKeylessMicrosoftAppSecret,
+  google: isGoogleWorkloadIdentitySecret,
 }
 
 /**
- * Whether a Snowflake, Microsoft app, or Google credential in this workspace, which this person
+ * Whether a credential of this provider in this workspace, which this person
  * administers, is keyless. Only that one bit leaves the stored secret, and only
  * for someone allowed to reconnect the credential.
  */
@@ -76,22 +66,21 @@ async function isKeylessCredential(
   workspaceId: string,
   userId: string
 ): Promise<boolean> {
-  const mixedMode = MIXED_MODE_PROVIDERS[provider]
   const access = await getCredentialActorContext(credentialId, userId, { workspaceId })
   const row = access.credential
   if (
     !access.isAdmin ||
     !row ||
     row.workspaceId !== workspaceId ||
     row.type !== 'service_account' ||
-    !mixedMode ||
-    row.providerId !== mixedMode.providerId ||
+    !isWorkloadIdentityServiceAccountProviderId(row.providerId) ||
+    workloadIdentityProviderFor(row.providerId) !== provider ||
     !row.encryptedServiceAccountKey
   ) {
     return false
   }
   const { decrypted } = await decryptSecret(row.encryptedServiceAccountKey)
-  return mixedMode.isKeyless(decrypted)
+  return MIXED_MODE_PROVIDERS[provider](decrypted)
 }
 
 /**
@@ -118,10 +107,9 @@ export const prepareWorkloadIdentity = defineAuthorizedWorkspaceUseCase({
       { workspaceId: input.workspaceId },
       userId
     )
-    const reconnectsKeyless =
-      MIXED_MODE_PROVIDERS[input.provider] && input.credentialId
-        ? await isKeylessCredential(input.provider, input.credentialId, input.workspaceId, userId)
-        : false
+    const reconnectsKeyless = input.credentialId
+      ? await isKeylessCredential(input.provider, input.credentialId, input.workspaceId, userId)
+      : false
     const audience = fixedWorkloadIdentityAudience(input.provider)
     return {
       available: true,

apps/sim/lib/credentials/aws-service-account.server.ts

@@ -215,6 +215,15 @@ export async function resolveAwsSessionCredentials(
   return toSessionCredentials(response.Credentials)
 }
 
+/** Whether a decrypted AWS secret is an OIDC role rather than access keys. */
+export function isKeylessAwsSecret(decrypted: string): boolean {
+  try {
+    return readStoredSubject(JSON.parse(decrypted)) !== undefined
+  } catch {
+    return false
+  }
+}
+
 function readStoredSubject(storedSecret: Record<string, unknown> | null | undefined) {
   const parsed = storedSecretSchema.safeParse(storedSecret)
   return parsed.success && parsed.data.config.authType === 'oidc_role'

apps/sim/lib/credentials/client-credential-accounts/minters/docusign.test.ts

@@ -33,7 +33,7 @@ const FIELDS = {
   orgId: '',
 }
 
-const ACCESS_TOKEN = 'eyJ0eXAiOiJNVCJ9.access-token-value'
+const ACCESS_TOKEN = 'test-docusign-access-token'
 
 function userinfo(accounts: Array<Record<string, unknown>>) {
   return jsonResponse({