feat(credentials): saved PostgreSQL, MySQL, and SQL Server connections (#9929)

* refactor(credentials): share the owner-scoped service-account secret read

Oracle Database's saved-connection lookup now reads its row through one
owner-scoped helper, so the saved database connections that follow bind
to their owner and provider the same way instead of copying the query.

* feat(credentials): saved PostgreSQL, MySQL, and SQL Server connections

Adds three service-account providers (postgresql-, mysql-, and
mssql-service-account) that store a database connection: host, port,
database, login, password, and the SSL mode or SQL Server encrypt and
trust-certificate settings. Saving proves the connection with SELECT 1
through each family's own query operation, so host validation and IP
pinning match a real run, and only then encrypts it; driver errors are
never surfaced. The connection is read back inside the tool operation,
bound to the run's workspace or organization, by
withSavedDatabaseConnection, which replaces every connection field in the
call so a caller or model cannot steer a shared credential.

One client-safe descriptor table drives the provider ids, required
fields, provider catalog, token resolvers, secret builders, and a shared
connect modal.

* feat(database-tools): run PostgreSQL, MySQL, and SQL Server tools on a saved connection

Every PostgreSQL, MySQL, and SQL Server tool now declares an optional
service-account credential policy (required: false), so its inline
connection fields keep working unchanged and a saved connection can stand
in for them. The executor authorizes the selected credential and passes
it through trusted context; the family's operation handler, wrapped by
withSavedDatabaseConnection, reads the stored connection bound to the
run's owner and replaces every connection field before parsing. The
providers resolve inside the operation, like AWS, so they join
OPERATION_RESOLVED_CREDENTIAL_PROVIDERS.

A real-Postgres integration test saves a connection (SELECT 1 through
the guarded path), refuses one the server rejects, runs a query on the
saved connection whatever fields the call carries, and refuses it to
another workspace and once revoked.

* feat(blocks): credential-only PostgreSQL, MySQL, and SQL Server blocks

postgresql_v2, mysql_v2, and mssql_v2 spread their legacy blocks and swap
the connection fields (host, port, database, username, password, and SSL
mode or SQL Server encrypt and trust-certificate settings) for a saved
connection picker through withSavedCredential. Their canvas sentences
drop the database clause the block no longer holds.

The legacy blocks change only by hideFromToolbar and a legacy sunset
pointing at the successor, so existing workflows keep their inline
connection fields and run exactly as before. Generated block successors,
docs, icon maps, and deployment metadata are regenerated.

* docs(integrations): set up saved PostgreSQL, MySQL, and SQL Server connections

Each page's intro now explains adding a saved connection, how Sim proves
it before saving, what every SSL mode or SQL Server TLS setting does in
the runtime's drivers, and that existing workflows keep their inline
connection fields.

* refactor(database-tools): wrap SQL families at registration and derive saved-connection schemas from the operations

- Register the PostgreSQL, MySQL, and SQL Server families through
  registerSavedDatabaseFamily, which applies withSavedDatabaseConnection and
  records each tool id's service. A registry test now fails when a tool that
  names a saved database connection runs outside a wrapped family, the case
  the saved-credential contract skips for operation-resolved providers.
- Build the stored connection schemas from each operation's own connection
  schema (bounds tightened, strict), so the TLS values and defaults have one
  source. Stored blobs decode exactly as before.
- Reuse the SQL Server default connection timeout instead of repeating it,
  and parse a submitted connection once.
- Unit tests prove save-then-run round trips and drive refusals through the
  run wrapper; the workspace and revocation cases stay in the integration
  test, which now runs through the registered operation.

* fix(credentials): describe saved-connection TLS modes as the drivers apply them

- MySQL Required verifies the certificate chain but not the host name (like
  VERIFY_CA), and both Preferred and Required refuse a server without TLS.
- SQL Server Encrypt connection requests TLS; a server that does not support
  encryption gets an unencrypted session rather than an error.
- PostgreSQL Preferred can be downgraded by an on-path attacker, so the hint
  and docs steer to Required when the server supports TLS.
- Picker options are keyed by each operation schema's value type, so a mode
  the operations add or drop fails to compile instead of drifting.

* refactor(credentials): derive stored database connection fields and credential-supplied params from one list

The stored v1 schema now picks exactly the descriptor's login and TLS fields
out of each operation schema instead of extending the whole schema, and the
tools' credentialSuppliedParams come from the same list. An operation field
added later can no longer change the stored blob, get pinned on every run,
or stay visible on the credential-only block.

* fix(credentials): validate the saved-connection port in the form and carry TLS tradeoffs into the provider catalog

The connection modal now refuses a port that is not a whole number from 1 to
65535 and says so beside the field, instead of a generic verify failure. The
v2 provider catalog hint for saved PostgreSQL, MySQL, and SQL Server
connections now includes each transport-security field's tradeoff, so API
callers see what Preferred, Encrypt, and Trust server certificate give up.
The integration fixture decodes the database name from TEST_DATABASE_URL.

* docs(credentials): document the database connection provider id helpers

* fix(credentials): keep an encryption failure on a verified database connection a server error

* docs(credentials): document the database connection descriptor and id types

* docs(databases): describe the PostgreSQL, MySQL and SQL Server connection setting types

Author: waleedlatif1

apps/docs/components/ui/icon-mapping.ts

@@ -630,7 +630,9 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   mongodb: MongoDBIcon,
   mothership: Blimp,
   mssql: MicrosoftSqlIcon,
+  mssql_v2: MicrosoftSqlIcon,
   mysql: MySQLIcon,
+  mysql_v2: MySQLIcon,
   neo4j: Neo4jIcon,
   netsuite: NetSuiteIcon,
   neverbounce: NeverBounceIcon,
@@ -668,6 +670,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   planetscale_v2: PlanetScaleIcon,
   polymarket: PolymarketIcon,
   postgresql: PostgresIcon,
+  postgresql_v2: PostgresIcon,
   posthog: PosthogIcon,
   powerbi: PowerBIIcon,
   profound: ProfoundIcon,

apps/docs/content/docs/integrations/mssql.mdx

@@ -2,15 +2,25 @@
 title: Microsoft SQL Server
 description: Connect to Microsoft SQL Server database
 integration:
-  type: "mssql"
+  type: "mssql_v2"
   color: "#FFFFFF"
 ---
 
 import { ReferenceDetails } from "@/components/ui/reference-details"
 
 
 {/* MANUAL-CONTENT-START:intro */}
-Use [Microsoft SQL Server](https://www.microsoft.com/sql-server) to query or modify rows, execute T-SQL, and inspect tables, keys, and indexes. Configure the host, port, database, credentials, and TLS settings for your instance.
+Use [Microsoft SQL Server](https://www.microsoft.com/sql-server) to query or modify rows, execute T-SQL, and inspect tables, keys, and indexes.
+
+### Connection setup
+
+In **Integrations**, add a connection with the host, port, database, username, password, and transport-security settings. Sim proves the connection with `SELECT 1` before saving it encrypted, then reads it on the server for each run; the block, the workflow, and agents never see the password. Reconnect the connection from Integrations when its credentials change. The runtime must be able to reach the database host.
+
+- **Encrypt connection** requests TLS; leave it enabled. A server that does not support encryption gets an unencrypted session rather than an error, so confirm the server has encryption on.
+- **Trust server certificate** skips certificate validation. Enable it only for a server with a self-signed certificate you trust.
+- Named instances are not supported; give the instance a static TCP port and connect to that port.
+
+Workflows built before saved connections keep their inline connection fields and run unchanged.
 {/* MANUAL-CONTENT-END */}
 
 ## Use the block [#usage-instructions]
@@ -29,13 +39,6 @@ Execute a SELECT query on a Microsoft SQL Server database
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | Microsoft SQL Server hostname or IP address |
-| `port` | number | No | Server port \(default: 1433\). A named instance must be reached through its static TCP port |
-| `database` | string | Yes | Database name to connect to |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `encrypt` | string | No | Request TLS encryption for the connection \(enabled, disabled\). Defaults to enabled. Disabling sends the login packet and every row in cleartext. Enabling requests encryption over TDS 7.4, which the server negotiates during prelogin - a server that answers NOT_SUP yields an unencrypted session rather than an error, so this is a request, not a guarantee |
-| `trustServerCertificate` | string | No | Trust a self-signed server certificate \(enabled, disabled\). Defaults to disabled. Enabling skips certificate validation, so the connection is open to a machine-in-the-middle |
 | `connectionTimeout` | number | No | Connection and request timeout in milliseconds \(default: 15000\) |
 | `query` | string | Yes | T-SQL SELECT query to execute, optionally led by a WITH clause. Statements that modify data or schema are rejected — use the Execute Raw SQL operation for those. |
 
@@ -61,13 +64,6 @@ Insert data into a Microsoft SQL Server table
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | Microsoft SQL Server hostname or IP address |
-| `port` | number | No | Server port \(default: 1433\). A named instance must be reached through its static TCP port |
-| `database` | string | Yes | Database name to connect to |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `encrypt` | string | No | Request TLS encryption for the connection \(enabled, disabled\). Defaults to enabled. Disabling sends the login packet and every row in cleartext. Enabling requests encryption over TDS 7.4, which the server negotiates during prelogin - a server that answers NOT_SUP yields an unencrypted session rather than an error, so this is a request, not a guarantee |
-| `trustServerCertificate` | string | No | Trust a self-signed server certificate \(enabled, disabled\). Defaults to disabled. Enabling skips certificate validation, so the connection is open to a machine-in-the-middle |
 | `connectionTimeout` | number | No | Connection and request timeout in milliseconds \(default: 15000\) |
 | `table` | string | Yes | Table name to insert data into |
 | `data` | object | Yes | Data object to insert \(key-value pairs\) |
@@ -94,13 +90,6 @@ Update rows in a Microsoft SQL Server table
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | Microsoft SQL Server hostname or IP address |
-| `port` | number | No | Server port \(default: 1433\). A named instance must be reached through its static TCP port |
-| `database` | string | Yes | Database name to connect to |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `encrypt` | string | No | Request TLS encryption for the connection \(enabled, disabled\). Defaults to enabled. Disabling sends the login packet and every row in cleartext. Enabling requests encryption over TDS 7.4, which the server negotiates during prelogin - a server that answers NOT_SUP yields an unencrypted session rather than an error, so this is a request, not a guarantee |
-| `trustServerCertificate` | string | No | Trust a self-signed server certificate \(enabled, disabled\). Defaults to disabled. Enabling skips certificate validation, so the connection is open to a machine-in-the-middle |
 | `connectionTimeout` | number | No | Connection and request timeout in milliseconds \(default: 15000\) |
 | `table` | string | Yes | Table name to update |
 | `data` | object | Yes | Data object with the columns to set \(key-value pairs\) |
@@ -128,13 +117,6 @@ Delete rows from a Microsoft SQL Server table
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | Microsoft SQL Server hostname or IP address |
-| `port` | number | No | Server port \(default: 1433\). A named instance must be reached through its static TCP port |
-| `database` | string | Yes | Database name to connect to |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `encrypt` | string | No | Request TLS encryption for the connection \(enabled, disabled\). Defaults to enabled. Disabling sends the login packet and every row in cleartext. Enabling requests encryption over TDS 7.4, which the server negotiates during prelogin - a server that answers NOT_SUP yields an unencrypted session rather than an error, so this is a request, not a guarantee |
-| `trustServerCertificate` | string | No | Trust a self-signed server certificate \(enabled, disabled\). Defaults to disabled. Enabling skips certificate validation, so the connection is open to a machine-in-the-middle |
 | `connectionTimeout` | number | No | Connection and request timeout in milliseconds \(default: 15000\) |
 | `table` | string | Yes | Table name to delete rows from |
 | `where` | string | Yes | WHERE condition identifying the rows to delete |
@@ -161,13 +143,6 @@ Execute a raw T-SQL statement on a Microsoft SQL Server database
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | Microsoft SQL Server hostname or IP address |
-| `port` | number | No | Server port \(default: 1433\). A named instance must be reached through its static TCP port |
-| `database` | string | Yes | Database name to connect to |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `encrypt` | string | No | Request TLS encryption for the connection \(enabled, disabled\). Defaults to enabled. Disabling sends the login packet and every row in cleartext. Enabling requests encryption over TDS 7.4, which the server negotiates during prelogin - a server that answers NOT_SUP yields an unencrypted session rather than an error, so this is a request, not a guarantee |
-| `trustServerCertificate` | string | No | Trust a self-signed server certificate \(enabled, disabled\). Defaults to disabled. Enabling skips certificate validation, so the connection is open to a machine-in-the-middle |
 | `connectionTimeout` | number | No | Connection and request timeout in milliseconds \(default: 15000\) |
 | `query` | string | Yes | T-SQL statement to execute |
 
@@ -193,13 +168,6 @@ Introspect a Microsoft SQL Server schema to retrieve table structures, columns,
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | Microsoft SQL Server hostname or IP address |
-| `port` | number | No | Server port \(default: 1433\). A named instance must be reached through its static TCP port |
-| `database` | string | Yes | Database name to connect to |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `encrypt` | string | No | Request TLS encryption for the connection \(enabled, disabled\). Defaults to enabled. Disabling sends the login packet and every row in cleartext. Enabling requests encryption over TDS 7.4, which the server negotiates during prelogin - a server that answers NOT_SUP yields an unencrypted session rather than an error, so this is a request, not a guarantee |
-| `trustServerCertificate` | string | No | Trust a self-signed server certificate \(enabled, disabled\). Defaults to disabled. Enabling skips certificate validation, so the connection is open to a machine-in-the-middle |
 | `connectionTimeout` | number | No | Connection and request timeout in milliseconds \(default: 15000\) |
 | `schema` | string | No | Schema to introspect \(default: dbo\) |
 

apps/docs/content/docs/integrations/mysql.mdx

@@ -2,17 +2,28 @@
 title: MySQL
 description: Connect to MySQL database
 integration:
-  type: "mysql"
+  type: "mysql_v2"
   color: "#FFFFFF"
 ---
 
 import { ReferenceDetails } from "@/components/ui/reference-details"
 
 
 {/* MANUAL-CONTENT-START:intro */}
-Use [MySQL](https://www.mysql.com/) to query rows, insert or modify records, execute raw SQL, and inspect databases, tables, columns, keys, and indexes. Configure the host, port, database, credentials, and SSL mode for the target server.
+Use [MySQL](https://www.mysql.com/) to query rows, insert or modify records, execute raw SQL, and inspect databases, tables, columns, keys, and indexes.
 
 Query returns rows and a row count. Insert, update, and delete operations accept the data or WHERE clause documented below. Raw SQL can also change schema; use a database account with the permissions the workflow needs.
+
+### Connection setup
+
+In **Integrations**, add a connection with the host, port, database, username, password, and transport-security settings. Sim proves the connection with `SELECT 1` before saving it encrypted, then reads it on the server for each run; the block, the workflow, and agents never see the password. Reconnect the connection from Integrations when its credentials change. The runtime must be able to reach the database host.
+
+- **Preferred** encrypts without verifying the server certificate.
+- **Required** encrypts and verifies the certificate chain against the runtime's trust store, but does not check the host name, like MySQL's `VERIFY_CA`.
+- Both refuse a server that offers no TLS rather than connect unencrypted, so Sim's **Preferred** behaves like MySQL's `REQUIRED`, not its `PREFERRED`.
+- **Disabled** never encrypts. Use it only on a network whose confidentiality you control.
+
+Workflows built before saved connections keep their inline connection fields and run unchanged.
 {/* MANUAL-CONTENT-END */}
 
 ## Use the block [#usage-instructions]
@@ -31,12 +42,6 @@ Execute SELECT query on MySQL database
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | MySQL server hostname or IP address |
-| `port` | number | Yes | MySQL server port \(default: 3306\) |
-| `database` | string | Yes | Database name to connect to \(e.g., my_database\) |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `ssl` | string | No | SSL connection mode \(disabled, required, preferred\) |
 | `query` | string | Yes | SQL SELECT query to execute \(e.g., SELECT * FROM users WHERE active = 1\) |
 
 #### Output
@@ -59,12 +64,6 @@ Insert new record into MySQL database
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | MySQL server hostname or IP address |
-| `port` | number | Yes | MySQL server port \(default: 3306\) |
-| `database` | string | Yes | Database name to connect to \(e.g., my_database\) |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `ssl` | string | No | SSL connection mode \(disabled, required, preferred\) |
 | `table` | string | Yes | Table name to insert into \(e.g., users, orders\) |
 | `data` | object | Yes | Data to insert as key-value pairs |
 
@@ -88,12 +87,6 @@ Update existing records in MySQL database
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | MySQL server hostname or IP address |
-| `port` | number | Yes | MySQL server port \(default: 3306\) |
-| `database` | string | Yes | Database name to connect to \(e.g., my_database\) |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `ssl` | string | No | SSL connection mode \(disabled, required, preferred\) |
 | `table` | string | Yes | Table name to update \(e.g., users, orders\) |
 | `data` | object | Yes | Data to update as key-value pairs |
 | `where` | string | Yes | WHERE clause condition \(without WHERE keyword\) |
@@ -118,12 +111,6 @@ Delete records from MySQL database
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | MySQL server hostname or IP address |
-| `port` | number | Yes | MySQL server port \(default: 3306\) |
-| `database` | string | Yes | Database name to connect to \(e.g., my_database\) |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `ssl` | string | No | SSL connection mode \(disabled, required, preferred\) |
 | `table` | string | Yes | Table name to delete from \(e.g., users, orders\) |
 | `where` | string | Yes | WHERE clause condition \(without WHERE keyword\) |
 
@@ -147,12 +134,6 @@ Execute raw SQL query on MySQL database
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | MySQL server hostname or IP address |
-| `port` | number | Yes | MySQL server port \(default: 3306\) |
-| `database` | string | Yes | Database name to connect to \(e.g., my_database\) |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `ssl` | string | No | SSL connection mode \(disabled, required, preferred\) |
 | `query` | string | Yes | Raw SQL query to execute \(e.g., CREATE TABLE users \(id INT PRIMARY KEY, name VARCHAR\(255\)\)\) |
 
 #### Output
@@ -175,12 +156,6 @@ Introspect MySQL database schema to retrieve table structures, columns, and rela
 
 | Parameter | Type | Required | Description |
 | --------- | ---- | -------- | ----------- |
-| `host` | string | Yes | MySQL server hostname or IP address |
-| `port` | number | Yes | MySQL server port \(default: 3306\) |
-| `database` | string | Yes | Database name to connect to \(e.g., my_database\) |
-| `username` | string | Yes | Database username |
-| `password` | string | Yes | Database password |
-| `ssl` | string | No | SSL connection mode \(disabled, required, preferred\) |
 
 #### Output