feat(oracle-fusion): add shared integration foundation

[BillLeoutsakosvl346]

Summary

Adds the shared Oracle Fusion foundation used by the upcoming HCM, Financials, and SCM integrations.

• Registers one reusable integration-user credential with strict Oracle-assigned origin validation, encrypted username/password storage, local Basic derivation, a five-minute rotation-sensitive cache, and no save-time provider probe.
• Adds a DNS-pinned, GET-only shared client restricted to the versioned HCM and FSCM REST roots, with bounded retries, redirects disabled, response limits, abort preservation, lossless unsafe integers, and non-reflective errors.
• Adds product-neutral collection, pagination, self-link, and opaque-key helpers.
• Reuses the existing Oracle oval through shared Sim and docs icon aliases without changing SVG data.

Product-specific blocks, schemas, operations, registries, and documentation are intentionally deferred to follow-up PRs.

Fixes: N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

• Focused Oracle Fusion credential, client, protocol, encrypted-secret, registry, and cache tests (150 passing)
• bun run type-check
• bun run deployment-config:generate
• bun run deployment-config:check
• bun run lint
• bun run apps/sim/scripts/check-block-registry.ts origin/staging
• bun run check:audits (45 audits)
• git diff --check

Reviewers should focus on the credential boundary, fixed-origin/path enforcement, retry and abort behavior, and product-neutral protocol invariants.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

Not applicable. This foundation does not add a product UI surface; it only exports the existing Oracle oval under a shared alias.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 3, 2026 2:46am UTC

[greptile-apps]

Greptile Summary

Adds the shared foundation for future Oracle Fusion integrations without introducing product-specific blocks or operations.

• Registers and stores Oracle Fusion integration-user credentials with canonical Oracle-origin validation and local Basic credential derivation.
• Adds a DNS-pinned, GET-only client for the versioned HCM and FSCM REST roots with bounded retries, response limits, abort propagation, and sanitized provider errors.
• Adds reusable collection, pagination, self-link, opaque-key, and Oracle icon helpers.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the eligible follow-up-review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/credentials/client-credential-accounts/descriptors.ts	Registers the Oracle Fusion credential descriptor and enforces a canonical Oracle-assigned HTTPS origin.
apps/sim/lib/credentials/client-credential-accounts/minters/oracle-fusion.ts	Validates integration-user fields and locally derives the short-lived cached Basic credential.
apps/sim/lib/internal/oracle-fusion/client.ts	Implements the constrained DNS-pinned Oracle REST client, retry policy, response handling, and sanitized errors.
apps/sim/lib/internal/oracle-fusion/protocol.ts	Adds product-neutral collection, pagination, self-link, and opaque-key validation helpers.
apps/sim/lib/credentials/service-account-secret.ts	Restricts data-center handling to credential descriptors that declare that field.

Sequence Diagram

sequenceDiagram
  participant User
  participant CredentialService
  participant OracleMinter
  participant FusionClient
  participant DNSValidator
  participant OracleFusion
  User->>CredentialService: Save application URL, username, password
  CredentialService->>OracleMinter: Validate and derive Basic credential
  OracleMinter-->>CredentialService: Canonical origin and cached credential
  FusionClient->>DNSValidator: Validate configured Oracle origin
  DNSValidator-->>FusionClient: Public pinned IP
  FusionClient->>OracleFusion: GET versioned HCM/FSCM resource
  OracleFusion-->>FusionClient: Bounded JSON response

Loading

_{Reviews (4): Last reviewed commit: "fix(oracle-fusion): classify rejected re..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 18 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 18 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 18 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 18 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}