GeezerVison

Summary

Several saved-credential validators and their tools were hard-coded to one US or production host. This PR adds an additive region/instance/host field to those credentials. The field defaults to today's host, and the validator and every tool of each provider use it.

• Shared: a token credential's domain field can declare options (shown as a dropdown) and a defaultValue. Omitted on create → default. Stored blob without it → default at resolve time. Reconnect with it left blank → the stored value is kept; a reconnect that names a region moves the credential to it. defaultValue is honored on domain only.
• A credential on the default region keeps the bare service display name it had before (Sentry, not Sentry (us)). A vendor region host that fails to resolve is reported as the provider being unavailable, not as a typed host that was not found.
• One defineCredentialRegions definition per vendor (tools/shared/credential-regions.ts) holds the region ids, hosts, dropdown labels, default, API base and hidden tool param. The validator, every tool, the descriptor, and the internal SendGrid/Square operation schemas all read from it.
• The v2 credential provider catalog now reports a defaulted field's defaultValue (additive optional field; OpenAPI document and CLI client regenerated).
• LaunchDarkly: Commercial (default) / EU (app.eu.launchdarkly.com) / Federal (app.launchdarkly.us)
• LangSmith: GCP US (default) / GCP EU / GCP APAC / AWS US / Azure US
• New Relic: adds JP (api.jp.newrelic.com). The region field is now a select. FedRAMP needs no change: NerdGraph has no FedRAMP-specific host, and an unlisted service's standard endpoint is already the compliant one (https://docs.newrelic.com/docs/security/security-privacy/compliance/fedramp-compliant-endpoints/), so FedRAMP accounts use US.
• Square: Production (default) / Sandbox (connect.squareupsandbox.com)
• SendGrid: Global (default) / EU regional subuser (api.eu.sendgrid.com). Notes that Marketing Campaigns is unavailable to EU subusers.
• Hex: workspace host, default app.hex.tech. Only a single label under hex.tech is accepted (EU, HIPAA, single-tenant). Hex's known non-workspace sites (www, docs, learn, status, help, community, blog) are refused, because some of them are served by third parties.
• Sentry: US (default, sentry.io) / EU (de.sentry.io), per https://docs.sentry.io/api/
• Hosts come only from per-provider allowlists (or, for Hex, a strict *.hex.tech pattern). An unknown value is refused before the token is sent. The tool params that carry the region are hidden and filled only by the credential.

Backward compatibility: no new provider ids and no change to stored secret shapes. Existing credentials and legacy inline-key blocks keep today's hosts, and default-region creates keep today's display names and error codes. During a rolling deploy, an old worker sends a regional credential's token to the vendor's default host. That host belongs to the same vendor, so the call fails or gets proxied but nothing leaks.

Deploy note: during the rollout, an old pod that handles a reconnect or create of a non-default-region credential stores no region. Once the deploy finishes, that credential resolves to the default host. Avoid region changes and reconnects of regional credentials until every pod runs this release.

Not included: self-hosted Sentry (design memo)

Self-hosted Sentry is left out deliberately. It cannot ship cleanly in this PR:

• Provider id. It needs a new provider id (for example sentry-self-hosted-service-account), not a third option on the us/de select. An old worker ignores a stored host and calls sentry.io, so a self-hosted token kept under sentry-service-account would be sent to sentry.io during a rolling deploy. A new id makes old workers fail closed.
• Picker (the blocker). OAuthServiceConfig.serviceAccountProviderId is documented as the one non-OAuth credential family a service accepts. additionalProviderIds covers OAuth servers only (Salesforce sandbox). Showing both Sentry ids in the Sentry block's picker means extending that shared contract across the picker, credential listing and executor resolution. The alternative is a separate service or block, which is a product decision. Either way it is its own PR.
• Field shape. A free-text domain (host plus optional subpath, since self-hosted Sentry can sit under a path prefix) on the new id only, normalized like the Sentry KB connector's normalizeHost and GitLab's normalizeGitLabHost. The cloud id keeps its us/de select unchanged.
• Egress. The validator would call https://<host>/api/0/ through tokenCheckValidator({ egress: 'configuredEndpoint' }), as GitLab's does. The tools would take the host as a hidden, credential-filled param and go out through the executor's existing requestTarget path, which GitLab's self-managed tools already use. requestTarget has the same reachability as configuredEndpoint today: public hosts only on hosted, and the operator allowlist off hosted. So no executor change is needed.
• Redirects. Keep the tools' current cross-origin redirect refusal (no allowSameOrigin), and send no token on any redirect. Sentry's API docs (https://docs.sentry.io/api/) document only sentry.io, us.sentry.io and de.sentry.io, so self-hosted behavior needs a live proof against a real install before it ships.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

• saved-credential-regions.test.ts: for every tool of each family, a saved regional credential goes to its host, a run without a credential stays on the default host, and an unknown region is refused.
• service-account-secret.test.ts: each credential check hits the right URL and stores the region. Unlisted hosts (including Hex's third-party-served labels) are refused without a fetch. Default-region credentials keep the bare display name. Vendor region DNS failures are provider_unavailable, while a typed Hex host gives site_not_found.
• Credential-service and orchestration tests cover legacy blobs (including Sentry) resolving to the default. They also cover a reconnect that leaves the region blank keeping the stored region, and a reconnect that names a region overriding it. That last case goes red if the stored region is always kept.
• provider-catalog-contract.test.ts: a defaulted field reports defaultValue and the response still matches the strict v2 schema.
• Internal Square operation and SendGrid client tests prove the regional host end to end.
• Reviewers: please focus on the defaulted-field handling in service-account-secret.ts, credential-service.ts, orchestration/index.ts, and validators/http.ts.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)