feat(greenhouse): connect Harvest v3 with a customer-owned API credential

[waleedlatif1]

Summary

• Add a greenhouse-service-account client-credential provider: users save their own Greenhouse Harvest V3 (OAuth) client ID and secret, and Sim mints access tokens with the client credentials grant (grant_type=client_credentials, Basic auth, no requested scopes — scopes live on the credential in Greenhouse)
• The Greenhouse block's credential picker lists saved credentials alongside partner OAuth (credentialKind: 'any'), the same shape as Ramp, so the block is available on deployments without GREENHOUSE_CLIENT_ID/GREENHOUSE_CLIENT_SECRET instead of disappearing from the toolbar
• Partner OAuth keeps working where it is configured
• Greenhouse documents no identity endpoint for this grant, so a successful mint is the connect-time check (same as Vanta)
• Docs: Dev Center setup for the Harvest V3 (OAuth) credential

Type of Change

• New feature

Testing

• credential-display.test.ts, token-resolution.test.ts, availability.server.test.ts (77 passed), with Greenhouse rows added to the existing service-account coverage tables
• bun run lint, block-registry check, check:deployment-config, check:integration-catalog, check:docs, check:docs-manifest, check:utils, check:comment-hygiene, check:unused-exports, check:explicit-any, check:file-names, check:source-conventions
• Regenerated service-account-providers.generated.ts via generate:deployment-config; full type-check and audits run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 19, 2026 4:19am UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues remain from this review.

Summary

Adds customer-owned Greenhouse Harvest v3 credentials alongside partner OAuth.

• Greenhouse blocks can use customer-owned Harvest v3 credentials.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Customer-owned credential] --> B[Greenhouse token minter]
  B -->|Client credentials grant| C[Greenhouse token endpoint]
  C --> D[Access token]
  D --> E[Greenhouse block]
  F[Partner OAuth] --> E

Loading

_{Reviews (2) · Last reviewed commit: "test(greenhouse): cover the client crede..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 9 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}