fix(credentials): Splunk password sign-in, Snowflake key pair in the CLI, Apollo OAuth people search, and one short SailPoint throttle wait - #9943

Summary

Fixes for the four issues a release audit of main..staging confirmed. Each was checked against the code and the vendor's docs before it was fixed. Existing credentials, blocks and CLI calls behave as before.

• Splunk: username and password sign-in on the saved credential. The legacy splunk block is sunset, and splunk_v2 only took a token, but token sign-in is off by default on Splunk Enterprise.
  • The credential now takes an optional username.
  • With a username, the secret is checked as a password over HTTP Basic against authentication/current-context, and the credential resolves with authStyle: 'basic'. The executor sets authStyle; a caller can't.
  • Without a username, it resolves exactly as a token does today.
  • Follows ServiceNow's saved-login pattern.
• CLI: Snowflake key pair without keyless. sim credentials create snowflake-service-account refused a key-pair serviceAccountJson on deployments that can't sign keyless tokens, and refused a raw key-pair object everywhere.
  • A supplied serviceAccountJson now stands in for the required fields whenever the catalog offers it as an optional field, which matches what the server accepts.
  • A configuration object with an authType is wrapped for those providers.
  • Keyless and required-field providers are unchanged.
• Apollo: People Search over OAuth calls /mixed_people/api_search.
  • The only people-search scope Apollo documents (mixed_people_api_search) covers that path, not the legacy /mixed_people/search.
  • API-key calls stay on the legacy path, so their outputs, including emails and phones, are unchanged.
  • Pagination now reads the api_search shape.
• SailPoint: a saved credential waits out one short token throttle (Retry-After ≤ 5s) before failing.
  • Longer throttles still return at once with their Retry-After.
  • The legacy inline path keeps its retries.
  • Corrected the TSDoc, which said the resolver waits.

Type of Change

• Bug fix

Testing

• New tests: each failed before its fix and passes after, with a revert check for each guard. They are in Splunk validator/resolution/executor, CLI credentials, Apollo people_search, and SailPoint minter.
• Targeted suites: 83 files and 1,845 tests pass (credentials, oauth credential-service, tools/index, Splunk, Apollo, SailPoint, saved-credential contract, provider catalog). The CLI credentials tests (20) pass, and so does tsc for packages/sim-cli.
• Lint and audits: bun run lint and generate:tool-metadata ran. These pass: check:tool-metadata, check:test-patterns, check:comment-hygiene, check:explicit-any, check:boundaries, check:client-boundary, check:utils, check:file-names, check:api-validation:strict, check:cli-docs, check:docs, check:tool-registry-boundary --check and check-block-registry.ts origin/staging.
• Review: each fix had two independent reviewers (correctness against vendor docs, and backward compatibility).
• Known limits:
  • During a blue/green rollout, a Splunk username/password credential saved on a new worker and run on an old one gets a 401 from the user's own Splunk until the rollout finishes.
  • Apollo api_search filters are sent as a JSON body, the same way as the legacy call. This needs one live OAuth check.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)