feat(credentials): saved credentials and credential-only block versions, with keyless AWS/Databricks OIDC (#9763)

* feat(credentials): saved AWS and Databricks credentials with keyless OIDC

Adds an optional saved credential to every AWS block and the Databricks
block, alongside the existing inline key fields, plus Sim's own
workload-identity (OIDC) issuer so a credential can assume a customer's
AWS role or federate into a Databricks service principal without any
stored secret.

Existing workflows are unchanged: the inline fields stay, show, and
validate exactly as before until someone selects a saved credential.

- Issuer at /oidc/workload (discovery + JWKS), signing key from
  WORKLOAD_IDENTITY_SIGNING_KEY; 404 and keyless option off when unset
- Credential-scoped subjects, HMAC-bound to the preparing user and
  workspace, so a member cannot reuse another credential's subject
- aws-service-account: access keys, keys + AssumeRole (external ID), or
  keyless AssumeRoleWithWebIdentity; resolved server-side per call
- databricks-service-account: PAT, service principal M2M secret, or
  keyless RFC 8693 token federation
- AWS families accept the executor-authorized credential through trusted
  operation context; clients add the session token only for that pair
- S3 get_object signs x-amz-security-token for temporary credentials;
  inline signatures are byte-identical to before
- Tool credential binding honors optional (required: false) policies

* fix(credentials): close review findings on saved AWS/Databricks credentials

- Models can no longer inject a credential selector (or the token, session
  token, or host derived from one) into a hybrid tool call, which would
  have swapped an agent tool's inline keys for another workspace credential
- Databricks connections own the workspace host (authoritative `domain`)
- Drop the advanced credential-ID input: with a single picker, "is a
  credential selected" can no longer disagree with the active canonical mode
- OIDC subject proofs are bound to their provider
- Databricks token and identity fetches refuse redirects
- Correct the AWS module doc on presigned URLs carrying a session token

* chore(credentials): satisfy test-pattern, unused-export, and test-type audits

* fix(credentials): keyless reconnect, availability, and shared credential plumbing

- Reconnecting a keyless AWS role or Databricks principal keeps its trusted
  subject by default instead of issuing a new one that breaks the
  customer's trust policy
- The connect dialogs offer the keyless mode only where the deployment can
  sign tokens; the prepare endpoint reports availability instead of failing
- Register AWS (all 19 block types) and Databricks as stored-credential
  integrations, so org settings, the v2 credentials API, and Copilot can
  create and see them
- Optional STS region for GovCloud and China access keys
- One subject binder and config parser shared by both providers (neutral
  copy), one modal core for submit/errors/trust display
- Generic `authorizedServiceAccountCredential` operation context instead of
  an AWS-specific field; Databricks resolver checks credential type and
  honors cancellation
- Model-blocked params derive from each tool's authoritative params

* test(credentials): type the handler mock in the AWS credential seam test

* feat(credentials): credential-only block versions instead of hybrid inline keys

Existing AWS and Databricks blocks are left exactly as on staging, only
marked legacy and hidden from the toolbar; placed instances keep running
and show an upgrade badge. Each gets a credential-only successor
(s3_v2 ... databricks_v2, textract_v3) built by spreading the legacy block
and swapping its secret fields for a required saved-credential picker.

- withSavedCredential derives the successor's fields, inputs, and params
  builder; S3 and Textract split their builders so legacy key checks stay
- tools declare credentialSuppliedParams so serializer validation and the
  canonical-id check stop asking credential-only blocks for inline keys
- CloudWatch gets saved-credential log group/stream selectors that sign
  inside the credential's STS session
- docs generator resolves multi-level spreads and same-file param builders
- the AWS/Databricks providers are derived from the catalog again, so the
  hand-maintained token-credential mapping is reverted

* docs(credentials): document credential-only blocks by their credential, not inline keys

The generator omits a tool's credential-supplied params on pages for
blocks that sign in with a saved credential, as it already omits
accessToken. Intros now point at the AWS/Databricks credential guides.
Regenerates OpenAPI, CLI API, and CLI docs for the new selector keys.

* fix(blocks): never replace trigger fields that share a secret's id

A webhook trigger can register with a field named like the block's
secret (PagerDuty, Fathom, EmailBison, GitLab). withSavedCredential now
leaves trigger-mode fields, and their dependencies, exactly as they are.

* feat(credentials): generic saved-token plumbing for credential-only blocks

Wave 0 of moving inline-secret blocks onto saved credentials.

- tokenCredentialOAuth(provider, credentialParams) declares which tool
  params a saved token fills; credentialSuppliedParams is derived from it
- the executor fills those params after authorization, overriding any
  caller value, and fails closed when the credential lacks a field
- hosted keys are never injected when a saved credential supplies the key
- v2 tool execute no longer demands credential-supplied params when a
  credentialId is passed (fixes AWS/Databricks direct calls)
- withSavedCredential accepts an optional/conditional requirement
- check-block-registry verifies every credential-only successor's tools
  authorize the picker's provider and actually fill what they declare
- redact secretAccessKey/awsSecretAccessKey keys in logs
- serializer contract test covers every operation of each successor

* feat(credentials): Tavily saved credential and credential-only tavily_v2

Reference migration for wave 1. A generic tokenCheckValidator verifies a
token with one documented authenticated request (no redirects); Tavily
uses GET /usage. Legacy tavily is unchanged apart from its legacy marker.

* fix(credentials): close wave-0 audit findings

- agent tool-input no longer synthesizes inline secret fields a block's
  saved-credential picker supplies; one shared rule
  (credentialSuppliedParamsFor) now drives tool-input, serializer
  validation, and the canonical-id check
- the picker inherits the replaced secret's condition and requirement, so
  sts_v2's unsigned calls (web identity, SAML) need no credential
- withSavedCredential replaces both halves of a canonical secret pair and
  refuses options that would silently do nothing
- Databricks fills its inline apiKey/host through credentialParams, so its
  tools are byte-identical to staging apart from the policy line
- AWS operation families record their tool ids; a test and an executor
  guard ensure every AWS-credential tool resolves the credential
- the registry contract check fails on unpinned host params, optional
  credentials over required params, malformed pickers, and kind mismatch
- hosted-key admission (v2) and pre-resolution validation honor a selected
  saved credential; credential errors name fields in plain words

* feat(credentials): wave 1 — saved token credentials for 48 single-token blocks

Each block keeps its legacy definition (only hideFromToolbar + sunset) and
gains a credential-only <type>_v2. Every service gets a token-paste
provider with a one-request validator against a documented, read-only,
credit-free endpoint, and its tools fill the inline key from the saved
credential via tokenCredentialOAuth.

Blocks: affinity, agentmail, agentphone, ahrefs, apify, apollo, brex,
brightdata, browser_use, buffer, circleback, clerk, cloudflare,
crunchbase, daytona, elevenlabs, enrich, gamma, hex, huggingface,
incidentio, instantly, langsmith, launchdarkly, linq, loops, luma,
mailchimp, otter, persona, pinecone, profound, quartr, rb2b, rippling,
rocketlane, semrush, sendgrid, similarweb, sixtyfour, smartlead,
sportmonks, square, tailscale, trigger_dev, uptimerobot, youcom, youtube.

The registry contract check now probes each request tool's real URL
builder to find params that steer the host, and requires the saved
credential to fill them.

* fix(credentials): close wave-1 audit findings

- Pinecone and Semrush leave wave 1: Pinecone's per-call indexHost would
  let a shared key reach any host, and Semrush has no credit-free check
  that rejects a wrong key. Both are back to staging exactly.
- tokenCheckValidator: forbiddenMeansScoped accepts a valid key that lacks
  the check endpoint's scope (Apollo, Brex, Bright Data, Apify, Rippling,
  Persona); acceptsBody proves keys whose rejection arrives in a 200 body
  (Buffer GraphQL)
- the host-steering probe lives in scripts/saved-credential-contract.ts:
  typed placeholders for required params only, id/host shapes, bare and
  scheme probes, and a broad destination-name fallback where the URL
  cannot be built; covered by a fixture test
- S3 refuses a bucket or region that would move the signed request's host
- spread-inheriting docs keep their base block's outputs (restores the
  Smartlead, Trigger.dev, and Instantly output tables)
- incident.io's credential is optional for alert events, which use their
  own alert source token
- withSavedCredential refuses replaced secrets that show or require
  differently; copy, intro, and hint fixes from the audit

* fix(credentials): close wave-1 re-audit findings

- host probe also defeats unparsed suffix checks and finds hosts behind
  optional switches, probing every placeholder shape; broader destination
  names where a URL cannot be built; the contract check fails when a
  successor's tool is missing from the executable registry
- the optional-credential rule evaluates a conditional picker per
  operation; incident.io hides its picker on alert events instead
- withSavedCredential takes an explicit picker condition and refuses one
  that depends on a replaced secret at any nesting depth
- a scoped 403 counts only when it is the vendor's JSON response, never a
  firewall or CDN page
- S3 names a bad bucket or region in its error
- pinecone/semrush catalog dates restored to staging

* feat(credentials): wave 1b — Mem0, Zep, and Discord saved credentials

Their legacy params builders throw without an inline secret, so each is
extracted into a module function with a requireKey flag: the legacy block
keeps identical validation and messages, the credential-only v2 skips only
the key check. discord_v2 hides its picker for webhook posts, which never
use the bot token. BlockToolParams is now a shared type for extracted
builders (S3, Textract, Discord).

* feat(credentials): wave 1b — v3 credential-only versions and Flint

Blocks that already had a v2 get a credential-only v3 that spreads it:
cursor, dub, extend, fireflies, intercom, pulse, quiver, reducto. The v2
becomes legacy and every older version's replacedBy points at v3. Extend,
Pulse, and Reducto's v2 builders trimmed the key inline, so each is
extracted into a builder that takes the key as an argument; the legacy v2
passes the trimmed key exactly as before.

Flint gets flint_v2 with a dedicated validator: its API has no read
endpoint, so an unknown task id answering 404 proves the key.

tokenCheckValidator gains rejectsKey for vendors that answer a bad key
with a server error (Fireflies returns 500 auth_failed), so the user is
told the key is wrong rather than the vendor down.

* fix(credentials): close wave-1b audit findings and CI boundary failures

- token checks for the 59 new providers live in one module
  (validators/token-checks.ts) and their tool policies in
  tools/shared/saved-credentials.ts, so the tool-registry boundary stays
  within its baselines instead of adding ~60 modules to every graph
- the host-steering probe builds URLs through the shared transport
  (new prepareToolRequestUrl) and also flags a host validated against a
  vendor allowlist when two accepted values reach different tenants
- the AWS routing test reads typed metadata through getToolMetadata
- Flint accepts only its documented JSON 'Task not found' 404; Intercom no
  longer treats a 403 (suspended workspace, plan without API) as valid;
  Fireflies keeps its error text in logs when a 5xx isn't auth_failed
- Cursor help text, placeholder wording, Pulse intro, sorted secret fields

* fix(credentials): address pre-ship verification findings

- Refuse a keyless AWS role whose trust policy doesn't pin the credential's
  subject, so no other workspace can assume it
- Treat a malformed workload-identity signing key as not configured
- Brex: reject an unknown token's scope-style 403; the token-check factory
  now runs rejectsKey before accepting a scoped 403
- Flint: probe with a docs-shaped task id and a size-capped body read
- Drop the versioned BlockMeta entries that doubled templates; alias bare
  block types in the app icon map so template icon clusters resolve
- Widen the host-probe fallback names and rotate digits in alternates
- Copy: picker placeholder casing, Databricks v2 description, Pulse and
  Tailscale skills, AWS/Persona/Rippling intros, AWS credential docs
- Tests: AWS executor signing, AWS/Databricks credential setup, legacy
  params builders, serializer coverage for blocks without operations

* refactor(credentials): one saved-credential table and shared helpers

- withSavedCredential reads the replaced fields from SAVED_CREDENTIAL_OAUTH,
  so blocks and tools share one table instead of two hand-kept copies
- Reuse isTriggerModeSubBlock, getDependsOnFields, and a shared
  isSavedCredentialPicker; build the replacedBy map once in the registry check
- newWorkloadIdentitySubject owns the subject format; the AWS trust-pin probe
  runs alongside verification
- The issuer parses a bad signing key once instead of per request
- Token checks share the accepted result and the capped JSON reader

* chore(credentials): cleanup pass

- Keyless setup query gets its own key root, so broad credential
  invalidations can't refetch an open setup and mint a new subject
- Named staleTime constant for the setup query
- Correct stale comments (relying parties, Databricks param names)
- Tighten tests: assert the refusal reason, make the BYOK guard reachable,
  drop a duplicate and a test that could not fail

* fix(credentials): address review round 1

- A scoped 403 whose body can't be read is provider_unavailable, never accepted
- Provider error snippets read through the bounded reader
- Props interfaces for KeylessTrustFields and useWorkloadIdentitySetup; TSDoc on issuer responses

* fix(credentials): never cache the issuer's not-configured 404

Author: waleedlatif1

apps/docs/components/ui/icon-mapping.ts

@@ -332,23 +332,31 @@ type IconComponent = ComponentType<SVGProps<SVGSVGElement>>
 export const blockTypeToIconMap: Record<string, IconComponent> = {
   a2a: A2AIcon,
   affinity: AffinityIcon,
+  affinity_v2: AffinityIcon,
   agent: AgentIcon,
   agentmail: AgentMailIcon,
+  agentmail_v2: AgentMailIcon,
   agentphone: AgentPhoneIcon,
+  agentphone_v2: AgentPhoneIcon,
   agiloft: AgiloftIcon,
   ahrefs: AhrefsIcon,
+  ahrefs_v2: AhrefsIcon,
   airtable: AirtableIcon,
   algolia: AlgoliaIcon,
   amplitude: AmplitudeIcon,
   api: ApiIcon,
   api_trigger: ApiIcon,
   apify: ApifyIcon,
+  apify_v2: ApifyIcon,
   apollo: ApolloIcon,
+  apollo_v2: ApolloIcon,
   appconfig: AppConfigIcon,
+  appconfig_v2: AppConfigIcon,
   arxiv: ArxivIcon,
   asana: AsanaIcon,
   ashby: AshbyIcon,
   athena: AthenaIcon,
+  athena_v2: AthenaIcon,
   attio: AttioIcon,
   azure_data_explorer: AzureDataExplorerIcon,
   azure_devops: AzureIcon,
@@ -357,25 +365,36 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   box_v2: BoxCompanyIcon,
   brandfetch: BrandfetchIcon,
   brex: BrexIcon,
+  brex_v2: BrexIcon,
   brightdata: BrightDataIcon,
+  brightdata_v2: BrightDataIcon,
   browser_use: BrowserUseIcon,
+  browser_use_v2: BrowserUseIcon,
   buffer: BufferIcon,
+  buffer_v2: BufferIcon,
   calcom: CalComIcon,
   calendly: CalendlyIcon,
   cbinsights: CbInsightsIcon,
   chat_trigger: Task,
   checkr: CheckrIcon,
   circleback: CirclebackIcon,
+  circleback_v2: CirclebackIcon,
   clay: ClayIcon,
   clerk: ClerkIcon,
+  clerk_v2: ClerkIcon,
   clickhouse: ClickHouseIcon,
   clickup: ClickUpIcon,
   cloudflare: CloudflareIcon,
+  cloudflare_v2: CloudflareIcon,
   cloudformation: CloudFormationIcon,
+  cloudformation_v2: CloudFormationIcon,
   cloudtrail: CloudTrailIcon,
+  cloudtrail_v2: CloudTrailIcon,
   cloudwatch: CloudWatchIcon,
+  cloudwatch_v2: CloudWatchIcon,
   coda: CodaIcon,
   codepipeline: CodePipelineIcon,
+  codepipeline_v2: CodePipelineIcon,
   condition: ConditionalIcon,
   confluence: ConfluenceIcon,
   confluence_v2: ConfluenceIcon,
@@ -385,16 +404,21 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   credential_group: GridOffset,
   crowdstrike: CrowdStrikeIcon,
   crunchbase: CrunchbaseIcon,
+  crunchbase_v2: CrunchbaseIcon,
   cursor: CursorIcon,
   cursor_v2: CursorIcon,
+  cursor_v3: CursorIcon,
   dagster: DagsterIcon,
   databricks: DatabricksIcon,
+  databricks_v2: DatabricksIcon,
   datadog: DatadogIcon,
   datagma: DatagmaIcon,
   daytona: DaytonaIcon,
+  daytona_v2: DaytonaIcon,
   deployments: Rocket,
   devin: DevinIcon,
   discord: DiscordIcon,
+  discord_v2: DiscordIcon,
   docusign: DocuSignIcon,
   downdetector: DowndetectorIcon,
   dropbox: DropboxIcon,
@@ -403,21 +427,27 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   dspy: DsPyIcon,
   dub: DubIcon,
   dub_v2: DubIcon,
+  dub_v3: DubIcon,
   duckduckgo: DuckDuckGoIcon,
   dynamodb: DynamoDBIcon,
+  dynamodb_v2: DynamoDBIcon,
   dynatrace: DynatraceIcon,
   ec2: EC2Icon,
+  ec2_v2: EC2Icon,
   elasticsearch: ElasticsearchIcon,
   elevenlabs: ElevenLabsIcon,
+  elevenlabs_v2: ElevenLabsIcon,
   emailbison: EmailBisonIcon,
   embeddings: EmbeddingsIcon,
   enrich: EnrichSoIcon,
+  enrich_v2: EnrichSoIcon,
   enrichment: EnrichmentIcon,
   enrow: EnrowIcon,
   evaluator: ChartBarIcon,
   exa: ExaAIIcon,
   extend: ExtendIcon,
   extend_v2: ExtendIcon,
+  extend_v3: ExtendIcon,
   fathom: FathomIcon,
   file: DocumentIcon,
   file_v2: DocumentIcon,
@@ -428,11 +458,14 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   firecrawl: FirecrawlIcon,
   fireflies: FirefliesIcon,
   fireflies_v2: FirefliesIcon,
+  fireflies_v3: FirefliesIcon,
   fivetran: FivetranIcon,
   flint: FlintIcon,
+  flint_v2: FlintIcon,
   flow: FlowIcon,
   function: CodeIcon,
   gamma: GammaIcon,
+  gamma_v2: GammaIcon,
   gauge: GaugeIcon,
   generic: WebhookIcon,
   generic_webhook: Webhook,
@@ -478,24 +511,31 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   harmonic: HarmonicIcon,
   helpscout: HelpScoutIcon,
   hex: HexIcon,
+  hex_v2: HexIcon,
   higgsfield: HiggsfieldIcon,
   hubspot: HubspotIcon,
   huggingface: HuggingFaceIcon,
+  huggingface_v2: HuggingFaceIcon,
   human_in_the_loop: HumanInTheLoopIcon,
   human_in_the_loop_v2: HumanInTheLoopIcon,
   hunter: HunterIOIcon,
   iam: IAMIcon,
+  iam_v2: IAMIcon,
   icypeas: IcypeasIcon,
   identity_center: IdentityCenterIcon,
+  identity_center_v2: IdentityCenterIcon,
   image_generator: ImageIcon,
   image_generator_v2: ImageIcon,
   imap: MailServerIcon,
   incidentio: IncidentioIcon,
+  incidentio_v2: IncidentioIcon,
   infisical: InfisicalIcon,
   input_trigger: FormInput,
   instantly: InstantlyIcon,
+  instantly_v2: InstantlyIcon,
   intercom: IntercomIcon,
   intercom_v2: IntercomIcon,
+  intercom_v3: IntercomIcon,
   intune: IntuneIcon,
   jama: JamaIcon,
   jina: JinaAIIcon,
@@ -510,29 +550,37 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   ketch: KetchIcon,
   knowledge: PackageSearchIcon,
   lambda: LambdaIcon,
+  lambda_v2: LambdaIcon,
   langsmith: LangsmithIcon,
+  langsmith_v2: LangsmithIcon,
   latex: LatexIcon,
   launchdarkly: LaunchDarklyIcon,
+  launchdarkly_v2: LaunchDarklyIcon,
   leadmagic: LeadMagicIcon,
   lemlist: LemlistIcon,
   linear: LinearIcon,
   linear_v2: LinearIcon,
   linkedin: LinkedInIcon,
   linkup: LinkupIcon,
   linq: LinqIcon,
+  linq_v2: LinqIcon,
   logfire: LogfireIcon,
   logrocket: LogRocketIcon,
   logs: Library,
   logs_v2: Library,
   loops: LoopsIcon,
+  loops_v2: LoopsIcon,
   luma: LumaIcon,
+  luma_v2: LumaIcon,
   mailchimp: MailchimpIcon,
+  mailchimp_v2: MailchimpIcon,
   mailgun: MailgunIcon,
   managed_agent: ClaudeIcon,
   manageengine_sdp: ManageEngineIcon,
   manual_trigger: Play,
   mcp: McpIcon,
   mem0: Mem0Icon,
+  mem0_v2: Mem0Icon,
   memory: BrainIcon,
   microsoft_ad: AzureIcon,
   microsoft_dataverse: MicrosoftDataverseIcon,
@@ -571,12 +619,14 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   oracle_fusion_financials: OracleIcon,
   oracledb: OracleIcon,
   otter: OtterIcon,
+  otter_v2: OtterIcon,
   outlook: OutlookIcon,
   pagerduty: PagerDutyIcon,
   parallel_ai: ParallelIcon,
   peopledatalabs: PeopleDataLabsIcon,
   perplexity: PerplexityIcon,
   persona: PersonaIcon,
+  persona_v2: PersonaIcon,
   pi: PiIcon,
   pinecone: PineconeIcon,
   pipedrive: PipedriveIcon,
@@ -588,85 +638,109 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   posthog: PosthogIcon,
   powerbi: PowerBIIcon,
   profound: ProfoundIcon,
+  profound_v2: ProfoundIcon,
   prospeo: ProspeoIcon,
   pulse: PulseIcon,
   pulse_v2: PulseIcon,
+  pulse_v3: PulseIcon,
   qdrant: QdrantIcon,
   quartr: QuartrIcon,
+  quartr_v2: QuartrIcon,
   quickbooks: QuickBooksIcon,
   quiver: QuiverIcon,
   quiver_v2: QuiverIcon,
+  quiver_v3: QuiverIcon,
   rabbitmq: RabbitmqIcon,
   railway: RailwayIcon,
   ramp: RampIcon,
   rb2b: RB2BIcon,
+  rb2b_v2: RB2BIcon,
   rds: RDSIcon,
+  rds_v2: RDSIcon,
   reddit: RedditIcon,
   redis: RedisIcon,
   reducto: ReductoIcon,
   reducto_v2: ReductoIcon,
+  reducto_v3: ReductoIcon,
   resend: ResendIcon,
   response: ResponseIcon,
   revenuecat: RevenueCatIcon,
   rippling: RipplingIcon,
+  rippling_v2: RipplingIcon,
   rocketlane: RocketlaneIcon,
+  rocketlane_v2: RocketlaneIcon,
   rootly: RootlyIcon,
   router: ConnectIcon,
   router_v2: ConnectIcon,
   rss: RssIcon,
   s3: S3Icon,
+  s3_v2: S3Icon,
   sailpoint: SailPointIcon,
   salesforce: SalesforceIcon,
   sap_concur: SapConcurIcon,
   sap_s4hana: SapS4HanaIcon,
   schedule: Clock,
   search: SearchIcon,
   secrets_manager: SecretsManagerIcon,
+  secrets_manager_v2: SecretsManagerIcon,
   semrush: SemrushIcon,
   sendblue: SendblueIcon,
   sendgrid: SendgridIcon,
+  sendgrid_v2: SendgridIcon,
   sentry: SentryIcon,
   serper: SerperIcon,
   servicenow: ServiceNowIcon,
   servicenow_v2: ServiceNowIcon,
   ses: SESIcon,
+  ses_v2: SESIcon,
   sftp: SftpIcon,
   sftp_v2: SftpIcon,
   sharepoint: MicrosoftSharepointIcon,
   sharepoint_v2: MicrosoftSharepointIcon,
   shopify: ShopifyIcon,
   sim_workspace_event: SimTriggerIcon,
   similarweb: SimilarwebIcon,
+  similarweb_v2: SimilarwebIcon,
   sixtyfour: SixtyfourIcon,
+  sixtyfour_v2: SixtyfourIcon,
   slack: SlackIcon,
   slack_app: SlackIcon,
   slack_v2: SlackIcon,
   smartlead: SmartleadIcon,
+  smartlead_v2: SmartleadIcon,
   smtp: SmtpIcon,
   snowflake: SnowflakeIcon,
   splunk: SplunkIcon,
   sportmonks: SportmonksIcon,
+  sportmonks_v2: SportmonksIcon,
   sqs: SQSIcon,
+  sqs_v2: SQSIcon,
   square: SquareIcon,
+  square_v2: SquareIcon,
   ssh: SshIcon,
   ssh_v2: SshIcon,
   ssm: SSMIcon,
+  ssm_v2: SSMIcon,
   stagehand: StagehandIcon,
   start_trigger: StartIcon,
   starter: StartIcon,
   stripe: StripeIcon,
   sts: STSIcon,
+  sts_v2: STSIcon,
   stt: STTIcon,
   stt_v2: STTIcon,
   supabase: SupabaseIcon,
   table: Table,
   table_v2: Table,
   tailscale: TailscaleIcon,
+  tailscale_v2: TailscaleIcon,
   tavily: TavilyIcon,
+  tavily_v2: TavilyIcon,
   telegram: TelegramIcon,
   temporal: TemporalIcon,
   textract: TextractIcon,
   textract_v2: TextractIcon,
+  textract_v3: TextractIcon,
   thinking: BrainIcon,
   thrive: ThriveIcon,
   tiktok: TikTokIcon,
@@ -675,13 +749,15 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   translate: TranslateIcon,
   trello: TrelloIcon,
   trigger_dev: TriggerDevIcon,
+  trigger_dev_v2: TriggerDevIcon,
   tts: TTSIcon,
   twilio: TwilioIcon,
   twilio_sms: TwilioIcon,
   twilio_voice: TwilioIcon,
   typeform: TypeformIcon,
   upstash: UpstashIcon,
   uptimerobot: UptimeRobotIcon,
+  uptimerobot_v2: UptimeRobotIcon,
   vanta: VantaIcon,
   variables: VariableIcon,
   vercel: VercelIcon,
@@ -704,9 +780,12 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   workflow_input: WorkflowIcon,
   x: xIcon,
   youcom: YouComIcon,
+  youcom_v2: YouComIcon,
   youtube: YouTubeIcon,
+  youtube_v2: YouTubeIcon,
   zendesk: ZendeskIcon,
   zep: ZepIcon,
+  zep_v2: ZepIcon,
   zerobounce: ZeroBounceIcon,
   zoho_desk: ZohoDeskIcon,
   zoom: ZoomIcon,