feat(integrations): add saved Ramp and Vanta credentials

[waleedlatif1]

Summary

• Connect Ramp and Vanta with a saved client ID and secret, reuse those credentials in blocks and tools, and keep setup available without deployment-wide OAuth configuration.

• Coordinate Vanta's single active token across connections and workers with encrypted storage, stable application permissions, precise invalidation, and one authorized retry after rejection. Replace inline Vanta auth fields with the saved credential picker.

• Preserve Vanta permissions and deployment on reconnect, correct reconnect labels and API output metadata, and document authentication choices and credential-backed selectors in the integration skill.

• Use the Ramp brand mark with its lime background and simplify Ramp/Vanta credential forms by removing helper copy.

Type of Change

• Feature
• Bug fix

Testing

• Passed the full root test suite across all workspaces, affected credential and tool suites, lint, all workspace type checks, 58 audits, block registry, docs manifest, and actionlint.
• 12 PostgreSQL token lifecycle integration checks and independent mutation checks for renewal, permission lifetime, authorization, retries, and cancellation; 9 HTTP checks through real credential routes and encrypted persistence; browser create/reconnect verification with isolated provider fixtures.
• Additive migration applied to PostgreSQL; migration safety passed; Drizzle regeneration produced no changes.
• Live provider authentication remains unverified because provider credentials were unavailable. No production credentials were changed.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 8, 2026 2:48pm UTC

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds saved credentials for Ramp and Vanta integrations.

The PR appears safe to merge; no new actionable issues remain.

What we checked:

• Blank reconnect fields keep settings: The form omits blank fields. The server reads the saved values and carries them into the replacement credential.
• Ramp tiles keep readable icons: The tile gives light backgrounds a black foreground. Bare brand icons use the theme’s icon color when no brand foreground is registered.

Summary

Adds saved Ramp and Vanta application credentials for blocks and tools without requiring deployment-wide OAuth settings.

• Vanta shares encrypted tokens across workers, keeps application permissions after expiry, and retries one rejected request through the authorized credential path.
• Reconnect preserves saved permissions and deployment. Credential waits can end on cancellation without stopping shared renewal.
• The latest changes replace the Ramp icon and intentionally remove form helper copy.
• Earlier permission-lifetime, retry, Ramp-picker, and cancellation findings are addressed. The report-artifact concern was correctly disputed by waleedlatif1: the shared integration runner writes JSON reports, and CI uploads them.
• No new actionable issues found. No runtime tests were run during this review.

Diagram

sequenceDiagram
  participant Caller as Workflow or tool
  participant Sim as Authorized credential path
  participant DB as Shared encrypted storage
  participant Vanta
  Caller->>Sim: Resolve saved credential
  Sim->>DB: Lock application and check permissions
  DB-->>Sim: Current token or renewal needed
  opt Renewal needed
    Sim->>Vanta: Exchange saved client credentials
    Vanta-->>Sim: New token
    Sim->>DB: Save encrypted application state
  end
  Sim-->>Caller: Token and trusted API origin
  Caller->>Vanta: Run operation
  opt First request returns 401
    Caller->>DB: Expire only rejected token
    Caller->>Sim: Re-authorize same saved credential
    Sim-->>Caller: Current token and API origin
    Caller->>Vanta: Retry once under original deadline
  end

Loading

_{Reviews (6) · Last reviewed commit: "improvement(integrations): refresh Ramp ..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 85 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 89 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 90 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 90 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 92 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic</sub>