open connection

Opens a connection to S3-compatible object storage (Ceph RGW, MinIO, Amazon S3). Point it at an object storage service provider so the secret key stays in the provider store and never appears in this blueprint : the key pins are the older way and leave the secret readable to anyone who can open the flow.

Opens an S3-compatible object storage connection and emits it on `connection`. Makes NO network call : it only validates and normalizes, so a wrong endpoint or a down gateway surfaces at the first block that uses the connection, not here. Credentials come one of two ways and they are not equivalent: `provider` names an object_storage service provider and the connection carries only that NAME (the secret is fetched per call and never lands on a pin or in a simulation trace : use this), while `access_key_id`+`secret_access_key` embed literal keys in the blueprint in plaintext. `endpoint` is required unless the named provider supplies one. `path_style` defaults to TRUE (bucket in the URL path), which is what Ceph RGW and MinIO need; set it false only for Amazon S3-style virtual-host addressing, which requires a wildcard DNS entry per bucket. `bucket` here is a DEFAULT that every downstream block inherits when its own bucket pin is empty. success=false with error NO_CREDENTIAL, MISSING_ENDPOINT, or a PROVIDER_* code when the connection cannot be built; `connection` is then null. DEPLOYMENT: outbound calls go through the cluster SSRF guard, which refuses loopback, private and link-local addresses. An RGW on an internal range must have its address added to the `http_outbound_allowlist` cluster setting (Cluster Settings → HTTP → Outbound Allowlist) first, or every operation fails with a blocked-address error even though the credentials are correct.