feat(netsuite): add Oracle NetSuite integration

[BillLeoutsakosvl346]

Summary

• Add an Oracle NetSuite block with 27 explicit SuiteTalk REST operations for records, metadata, SuiteQL, SuiteAnalytics datasets, homogeneous async batches, and async job inspection.
• Store the SuiteTalk URL, Client ID, Certificate ID, and private key once in a reusable netsuite-service-account credential; tools receive only a short-lived access token and normalized SuiteTalk origin.
• Add bounded record-type and known-job async-task selectors, manual fallbacks, generated metadata/docs, setup guidance, templates, skills, catalog entries, and compatibility migrations.
• Exclude RESTlets, arbitrary API requests, triggers, and an unverified dataset picker.

Architecture record

This branch is rebased on staging commit 618cee5cb9a372e0a0447d204a3fa3052648e953.

• Primary UX reference: Snowflake. Every NetSuite block uses the same stored-credential selector/Advanced manual-ID pattern, and selector requests follow the direct block → selector provider → typed route → credential resolution → provider-tool flow.
• Credential lifecycle references: Salesforce, Box, Zoho Desk, and Zoom. NetSuite uses the existing client-credential service-account family because Oracle requires a signed certificate assertion and short-lived token minting; copying Snowflake's stored PAT backend would be incorrect.
• Selector/testing references: Snowflake and Zoho Desk for selectors, and Windchill for a compact route-boundary suite where provider normalization and hostile link handling are material.
• Credential reuse: the first, second, tenth, or any other NetSuite block can select the same stored credential. Workflow state stores only the credential ID; private signing material is not duplicated in block or Agent-tool parameters.
• Selectors: Record Type (bounded to 1,000) and Async Task for a known job (bounded to 100). Dataset IDs and other account-specific identifiers remain manual; users can obtain dataset IDs with List SuiteAnalytics Datasets.
• Provider-specific behavior retained: RSA/EC JWT signing, bounded token exchange, normalized REST responses, exact async-job link validation, one-page pagination, 1–100 record batches, strict Location handling, and no automatic mutation replay after a 401.
• Compatibility: migrations remove legacy inline certificate material, migrate historical task/selector fields, collapse the retired dataset picker, and scrub nested Agent-tool state. Credential deletion clears recognized aliases in mutable, deployed, frozen, and checkpoint state.
• Shared changes: descriptor-selected certificateId, duplicate service-account name conflict behavior, active-mode selector dependency resolution, recognized credential-deletion aliases, and compatibility migration coverage. No database schema, generic executor, docs generator/parser, generic selector component, or lib/netsuite application layer was added.

Validation

• Focused completion suite: 11 files, 247/247 tests passed.
• Full repository test run: 16/16 tasks passed; Sim reported 1,833 passing files and 24,156 passing tests (2 files and 30 tests skipped).
• Monorepo type-check: 23/23 tasks passed.
• Monorepo check-only lint: 23/23 tasks passed.
• Tool metadata: 4,613 tools in sync; integration catalog: 239 integrations in sync.
• API validation: 1,106/1,106 routes Zod-backed with boundary baseline enforced.
• Tool request/registry, client, monorepo boundary, route-verb, and migration-safety checks passed.
• NetSuite canvas coverage: 27/27 operations; global canvas coverage: 4,826/4,826 operations.
• Tool metadata and docs were regenerated through established scripts; a second docs generation produced identical hashes. Unrelated generator formatting drift was discarded.
• git diff --check and commit checks passed.
• A read-only GPT-5.6 Sol Ultra reviewer ran the complete integration-validation checklist, read all of integration_feedback.md, compared current Snowflake/Salesforce/Box/Zoho Desk/Zoom/Windchill patterns, re-derived current Oracle contracts, and gave the follow-up diff a merge-ready verdict with no remaining blocking defect.

Live limitations

No NetSuite credential was available, so real OAuth certificate mapping, account/role permissions, production and sandbox discovery, NetSuite 2026.1 feature availability, mutations, async polling, and exact account-specific payload variants remain live-unverified. No destructive live calls were attempted.

Type of change

• Feature

Checklist

• Code follows project style guidelines
• Self-reviewed and independently audited
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 13, 2026 9:29am

[cursor]

PR Summary

High Risk
Introduces certificate-based OAuth minting and broad SuiteTalk read/write paths against customer ERP data; risk is mitigated by origin validation, server-only signing keys, and extensive tests, but misconfiguration or credential bugs could still affect connected NetSuite accounts.

Overview
Introduces a full Oracle NetSuite workflow block and 27 SuiteTalk REST tools for records, SuiteQL, SuiteAnalytics, async batches, metadata, and job polling—following the Snowflake stored-credential + Advanced manual-ID pattern.

Credentials: New netsuite-service-account stores SuiteTalk URL, Client ID, Certificate ID, and PEM private key; Sim mints short-lived bearer tokens via signed JWT (PS256 / ES256–ES512) and threads the normalized SuiteTalk instanceUrl through OAuth resolution and tool execution. Create/update credential APIs accept certificateId; duplicate service-account display names now 409 instead of silently dropping secrets.

UI: Record-type and async-task pickers call a new /api/tools/netsuite/objects route (auth, credential resolution, bounded normalization, strict async task link validation). Selector and tool-input paths gain scoped canonical mode overrides and strict canonical dependency resolution so nested Agent tools gate pickers correctly.

Docs & catalog: Integration pages, icon, registry entries, templates, and skills; credential deletion clears recognized NetSuite credential aliases in nested Agent tool state.

^{Reviewed by Cursor Bugbot for commit 05014f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

The PR adds an Oracle NetSuite integration backed by reusable certificate-based service-account credentials.

• Adds 27 SuiteTalk operations covering records, metadata, SuiteQL, datasets, asynchronous batches, and job inspection.
• Adds credential minting and resolution, account-backed selectors, workflow compatibility migrations, generated metadata, documentation, and catalog registration.
• Updates shared selector, credential-deletion, and service-account infrastructure needed by the integration.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains from the previously reported issues.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/tools/netsuite/utils.ts	Implements bounded SuiteTalk request construction, response normalization, URL validation, and payload limits; the previously reported token-cache path is absent.
apps/sim/lib/credentials/client-credential-accounts/minters/netsuite.ts	Implements NetSuite certificate-based JWT signing and bounded OAuth token exchange.
apps/sim/blocks/blocks/netsuite.ts	Defines the NetSuite block and its 27 explicit operations, credential field, selectors, and operation-specific inputs.
apps/sim/tools/netsuite/netsuite.test.ts	Verifies tool and block registry coverage using repository-supported absolute aliases.
apps/sim/lib/workflows/migrations/subblock-migrations.ts	Adds compatibility cleanup and migration of legacy NetSuite credential, selector, and Agent-tool state.
apps/sim/app/api/tools/netsuite/objects/route.ts	Adds the typed selector boundary for bounded record-type and known-job asynchronous-task discovery.

Sequence Diagram

sequenceDiagram
  participant User
  participant Block as NetSuite Block
  participant Cred as Credential Service
  participant OAuth as NetSuite OAuth
  participant API as SuiteTalk REST API
  User->>Block: Select reusable credential and operation
  Block->>Cred: Resolve credential ID
  Cred->>OAuth: Sign assertion and mint access token
  OAuth-->>Cred: Short-lived bearer token
  Cred-->>Block: Token and normalized SuiteTalk origin
  Block->>API: Execute explicit SuiteTalk operation
  API-->>Block: Normalized response or async job location

Loading

_{Reviews (5): Last reviewed commit: "fix(netsuite): complete integration vali..." | Re-trigger Greptile}

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cdd5240. Configure here.}

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 61407f5. Configure here.}

[BillLeoutsakosvl346]

@cursor review

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cursor review

[BillLeoutsakosvl346]

@greptile

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 05014f2. Configure here.}