@tangle-network/agent-integrations 0.45.0 → 0.46.0

package/dist/catalog.js

@@ -7,7 +7,7 @@ import {
   parseIntegrationToolName,
   searchIntegrationTools,
   toMcpTools
-} from "./chunk-E6BBOBYT.js";
+} from "./chunk-CPZUNSKB.js";
 import "./chunk-S2BUASSV.js";
 import "./chunk-LA76XB7M.js";
 import "./chunk-H4XYLS7T.js";
@@ -15,7 +15,7 @@ import "./chunk-VLVSP7SP.js";
 import "./chunk-IA5GCKM6.js";
 import "./chunk-7P2LN4VT.js";
 import "./chunk-376UBTNB.js";
-import "./chunk-WTMOFI3U.js";
+import "./chunk-F6MF4YNI.js";
 import "./chunk-2TW2QKGZ.js";
 import "./chunk-UWF33ESC.js";
 import "./chunk-PZ5AY32C.js";

package/dist/{chunk-E6BBOBYT.js → chunk-CPZUNSKB.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-IA5GCKM6.js";
 import {
   adapters_exports
-} from "./chunk-WTMOFI3U.js";
+} from "./chunk-F6MF4YNI.js";
 
 // src/activepieces-catalog.ts
 import { readFileSync } from "fs";
@@ -4334,4 +4334,4 @@ export {
   signCapability,
   verifyCapabilityToken
 };
-//# sourceMappingURL=chunk-E6BBOBYT.js.map
+//# sourceMappingURL=chunk-CPZUNSKB.js.map

package/dist/{chunk-WTMOFI3U.js → chunk-F6MF4YNI.js}

@@ -2350,6 +2350,119 @@ async function createSheet(inv, accessToken, timeoutMs) {
   };
 }
 
+// src/connectors/adapters/aws-sigv4.ts
+import { createHash as createHash3, createHmac } from "crypto";
+var ALGORITHM = "AWS4-HMAC-SHA256";
+function parseAwsCredentialBundle(credentials) {
+  if (credentials.kind !== "api-key") {
+    throw new Error(`AWS SigV4 connectors require api-key credentials, got ${credentials.kind}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(credentials.apiKey);
+  } catch {
+    throw new Error(
+      "AWS credential must be a JSON object with accessKeyId, secretAccessKey, and region \u2014 received a non-JSON string"
+    );
+  }
+  if (!raw || typeof raw !== "object") {
+    throw new Error("AWS credential bundle must be a JSON object with accessKeyId, secretAccessKey, and region");
+  }
+  const o = raw;
+  const accessKeyId = pickString(o, ["accessKeyId", "access_key_id", "awsAccessKeyId", "AccessKeyId"]);
+  const secretAccessKey = pickString(o, [
+    "secretAccessKey",
+    "secret_access_key",
+    "awsSecretAccessKey",
+    "SecretAccessKey",
+    "secretKey"
+  ]);
+  const region = pickString(o, ["region", "awsRegion", "Region"]) ?? "";
+  const sessionToken = pickString(o, ["sessionToken", "session_token", "awsSessionToken", "SessionToken"]);
+  const endpoint = pickString(o, ["endpoint", "Endpoint"]);
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("AWS credential bundle is missing accessKeyId and/or secretAccessKey");
+  }
+  return { accessKeyId, secretAccessKey, region, sessionToken, endpoint };
+}
+function signSigV4(input) {
+  const { method, url, body, service, region, accessKeyId, secretAccessKey, sessionToken, amzDate } = input;
+  const dateStamp = amzDate.slice(0, 8);
+  const payloadHash = hashSha256Hex(body);
+  const headerMap = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(input.headers)) {
+    const name = key.toLowerCase().trim();
+    if (name === "authorization") continue;
+    headerMap.set(name, collapseWhitespace(value));
+  }
+  headerMap.set("host", url.host);
+  headerMap.set("x-amz-date", amzDate);
+  if (sessionToken) headerMap.set("x-amz-security-token", sessionToken);
+  const sortedNames = [...headerMap.keys()].sort();
+  const canonicalHeaders = sortedNames.map((name) => `${name}:${headerMap.get(name)}
+`).join("");
+  const signedHeaders = sortedNames.join(";");
+  const canonicalRequest = [
+    method.toUpperCase(),
+    canonicalUri(url.pathname, service),
+    canonicalizeAwsQuery(url.searchParams),
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash
+  ].join("\n");
+  const credentialScope = `${dateStamp}/${region}/${service}/aws4_request`;
+  const stringToSign = [ALGORITHM, amzDate, credentialScope, hashSha256Hex(canonicalRequest)].join("\n");
+  const signingKey = deriveSigningKey(secretAccessKey, dateStamp, region, service);
+  const signature = createHmac("sha256", signingKey).update(stringToSign, "utf8").digest("hex");
+  const authorization = `${ALGORITHM} Credential=${accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  return { amzDate, signedHeaders, canonicalRequest, stringToSign, signature, authorization };
+}
+function amzDateNow(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+}
+function hashSha256Hex(data) {
+  return createHash3("sha256").update(data, "utf8").digest("hex");
+}
+function deriveSigningKey(secretAccessKey, dateStamp, region, service) {
+  const kDate = createHmac("sha256", `AWS4${secretAccessKey}`).update(dateStamp, "utf8").digest();
+  const kRegion = createHmac("sha256", kDate).update(region, "utf8").digest();
+  const kService = createHmac("sha256", kRegion).update(service, "utf8").digest();
+  return createHmac("sha256", kService).update("aws4_request", "utf8").digest();
+}
+function canonicalUri(pathname, service) {
+  if (!pathname) return "/";
+  if (service === "s3") return pathname;
+  const segments = [];
+  for (const segment of pathname.split("/")) {
+    if (segment.length === 0 || segment === ".") continue;
+    if (segment === "..") segments.pop();
+    else segments.push(segment);
+  }
+  const normalized = `/${segments.join("/")}${segments.length > 0 && pathname.endsWith("/") ? "/" : ""}`;
+  return awsUriEncode(normalized).replace(/%2F/g, "/");
+}
+function canonicalizeAwsQuery(params) {
+  const pairs = [];
+  for (const [key, value] of params) {
+    pairs.push([awsUriEncode(key), awsUriEncode(value)]);
+  }
+  pairs.sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0);
+  return pairs.map(([key, value]) => `${key}=${value}`).join("&");
+}
+function awsUriEncode(value) {
+  return encodeURIComponent(value).replace(/[!'()*]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function collapseWhitespace(value) {
+  return value.trim().replace(/\s+/g, " ");
+}
+function pickString(obj, keys) {
+  for (const key of keys) {
+    const value = obj[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return void 0;
+}
+
 // src/connectors/adapters/declarative-rest.ts
 function declarativeRestConnector(spec) {
   const capabilities = spec.capabilities.map(operationToCapability);
@@ -2449,7 +2562,11 @@ function requiredArgsOf(parameters) {
   return Array.isArray(required) ? required.filter((entry) => typeof entry === "string") : void 0;
 }
 async function executeRestRequest(spec, request, inv, requiredArgs) {
-  const baseUrl = resolveBaseUrl(spec.baseUrl, inv.source.metadata);
+  const placement = spec.credentialPlacement ?? { kind: "bearer" };
+  const aws = placement.kind === "aws-sigv4" ? parseAwsCredentialBundle(inv.source.credentials) : void 0;
+  const awsRegion = aws ? resolveAwsRegion(aws, inv.source.metadata, placement) : void 0;
+  let baseUrl = resolveBaseUrl(spec.baseUrl, inv.source.metadata);
+  if (aws) baseUrl = applyRegionTemplate(baseUrl, awsRegion, aws.endpoint);
   const renderedPath = interpolate(request.path, inv.args).replace(/^\/+/, "");
   const baseWithSlash = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
   const url = new URL(renderedPath, baseWithSlash);
@@ -2457,21 +2574,36 @@ async function executeRestRequest(spec, request, inv, requiredArgs) {
     const rendered = renderQueryValue(value, inv.args);
     if (rendered !== void 0 && rendered !== "") url.searchParams.set(key, String(rendered));
   }
+  const requestHeaders = request.headers ?? {};
+  const hostOverride = aws ? Object.entries(requestHeaders).find(([key]) => key.toLowerCase() === "host")?.[1] : void 0;
+  const renderableHeaders = hostOverride ? Object.fromEntries(Object.entries(requestHeaders).filter(([key]) => key.toLowerCase() !== "host")) : requestHeaders;
   const headers = {
     accept: "application/json",
     ...spec.defaultHeaders,
-    ...renderHeaders(request.headers ?? {}, inv.args)
+    ...renderHeaders(renderableHeaders, inv.args)
   };
-  applyCredentials(headers, url, spec.credentialPlacement ?? { kind: "bearer" }, inv.source.credentials);
+  if (hostOverride) url.host = hostOverride.replace(/\{region\}/g, awsRegion);
   if (inv.expectedEtag) headers["if-match"] = inv.expectedEtag;
   const sendsBody = request.method !== "GET" && (request.method !== "DELETE" || request.body !== void 0);
-  if (sendsBody) {
-    headers["content-type"] = headers["content-type"] ?? "application/json";
+  if (sendsBody && getHeaderCI(headers, "content-type") === void 0) {
+    headers["content-type"] = "application/json";
+  }
+  const bodyString = sendsBody ? JSON.stringify(resolveBody(request.body, inv.args, requiredArgs)) : void 0;
+  if (placement.kind === "aws-sigv4") {
+    signAwsRequest(headers, url, {
+      method: request.method,
+      body: bodyString ?? "",
+      service: placement.service,
+      region: awsRegion,
+      bundle: aws
+    });
+  } else {
+    applyCredentials(headers, url, placement, inv.source.credentials);
   }
   const res = await fetch(url, {
     method: request.method,
     headers,
-    body: sendsBody ? JSON.stringify(resolveBody(request.body, inv.args, requiredArgs)) : void 0,
+    body: bodyString,
     signal: AbortSignal.timeout(2e4)
   });
   if (res.status === 401 || res.status === 403) {
@@ -2530,6 +2662,42 @@ function credentialToken(credentials) {
   if (credentials.kind === "api-key") return credentials.apiKey;
   throw new Error(`declarative REST connectors require oauth2 or api-key credentials, got ${credentials.kind}`);
 }
+function resolveAwsRegion(bundle, metadata, placement) {
+  if (bundle.region) return bundle.region;
+  if (typeof metadata.region === "string" && metadata.region.trim()) return metadata.region;
+  return placement.defaultRegion ?? "us-east-1";
+}
+function applyRegionTemplate(baseUrl, region, endpoint) {
+  if (endpoint) return endpoint;
+  return baseUrl.replace(/\{region\}/g, region);
+}
+function getHeaderCI(headers, name) {
+  const lower = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === lower) return value;
+  }
+  return void 0;
+}
+function signAwsRequest(headers, url, opts) {
+  const canonicalSearch = canonicalizeAwsQuery(url.searchParams);
+  url.search = canonicalSearch ? `?${canonicalSearch}` : "";
+  headers["x-amz-content-sha256"] = hashSha256Hex(opts.body);
+  if (opts.bundle.sessionToken) headers["x-amz-security-token"] = opts.bundle.sessionToken;
+  const signed = signSigV4({
+    method: opts.method,
+    url,
+    headers,
+    body: opts.body,
+    service: opts.service,
+    region: opts.region,
+    accessKeyId: opts.bundle.accessKeyId,
+    secretAccessKey: opts.bundle.secretAccessKey,
+    sessionToken: opts.bundle.sessionToken,
+    amzDate: amzDateNow()
+  });
+  headers["x-amz-date"] = signed.amzDate;
+  headers.authorization = signed.authorization;
+}
 function resolveBody(body, args, requiredArgs) {
   if (!body || body === "args") return args;
   if (typeof body === "string") return renderValue(body, args, requiredArgs);
@@ -4728,7 +4896,7 @@ async function uploadFile2(inv, accessToken, timeoutMs) {
 }
 
 // src/connectors/adapters/docuseal.ts
-import { createHmac, timingSafeEqual } from "crypto";
+import { createHmac as createHmac2, timingSafeEqual } from "crypto";
 var DEFAULT_BASE = "https://api.docuseal.com";
 function readDocuSealCredentials(creds) {
   if (creds.kind === "api-key" && typeof creds.apiKey === "string" && creds.apiKey.length > 0) {
@@ -4853,7 +5021,7 @@ function docuseal(opts = {}) {
       if (!creds?.webhookSecret) return { valid: false, reason: "missing_webhook_secret" };
       const sig = firstHeader(headers, "x-docuseal-signature");
       if (!sig) return { valid: false, reason: "missing_signature_header" };
-      const expected = createHmac("sha256", creds.webhookSecret).update(rawBody).digest("hex");
+      const expected = createHmac2("sha256", creds.webhookSecret).update(rawBody).digest("hex");
       const a = Buffer.from(sig.toLowerCase(), "utf-8");
       const b = Buffer.from(expected, "utf-8");
       if (a.length !== b.length) return { valid: false, reason: "invalid_signature" };
@@ -7045,7 +7213,7 @@ function readApiKey(creds) {
 }
 
 // src/connectors/adapters/webhook.ts
-import { createHmac as createHmac2 } from "crypto";
+import { createHmac as createHmac3 } from "crypto";
 var webhookConnector = {
   manifest: {
     kind: "webhook",
@@ -7159,7 +7327,7 @@ function signHeaders(creds, body, idempotencyKey) {
     "x-phony-idempotency-key": idempotencyKey
   };
   if (creds.kind === "hmac" && typeof creds.secret === "string" && creds.secret.length > 0) {
-    const sig = createHmac2("sha256", creds.secret).update(`${ts}.${body}`).digest("hex");
+    const sig = createHmac3("sha256", creds.secret).update(`${ts}.${body}`).digest("hex");
     headers["x-phony-signature"] = `sha256=${sig}`;
   }
   return headers;
@@ -37263,7 +37431,7 @@ var smooveConnector = declarativeRestConnector({
 });
 
 // src/connectors/adapters/hellosign.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var SCOPES7 = [
   "basic_account_info",
   "request_signature",
@@ -37486,7 +37654,7 @@ function hellosign(opts) {
       if (!event || typeof event.event_time !== "string" || typeof event.event_type !== "string" || typeof event.event_hash !== "string") {
         return { valid: false, reason: "missing_event_fields" };
       }
-      const expected = createHmac3("sha256", source.credentials.accessToken).update(`${event.event_time}${event.event_type}`).digest("hex");
+      const expected = createHmac4("sha256", source.credentials.accessToken).update(`${event.event_time}${event.event_type}`).digest("hex");
       const a = Buffer.from(event.event_hash.toLowerCase(), "utf-8");
       const b = Buffer.from(expected.toLowerCase(), "utf-8");
       if (a.length !== b.length) return { valid: false, reason: "invalid_signature" };
@@ -44857,16 +45025,17 @@ var amazonBedrockConnector = declarativeRestConnector({
   kind: "amazon-bedrock",
   displayName: "Amazon Bedrock",
   description: "Invoke AWS Bedrock foundation models for text generation, image analysis, image generation, and embeddings; list available foundation models.",
-  auth: { kind: "api-key", hint: "AWS access key id / secret access key pair (the connection should also carry metadata.region; requests are signed with AWS Signature V4 at the gateway)." },
+  auth: { kind: "api-key", hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the bedrock-runtime.<region>.amazonaws.com endpoint.' },
   category: "other",
   // Bedrock model invocations are non-idempotent generative calls; the manifest
   // surfaces are advisory (best-effort), not authoritative state.
   defaultConsistencyModel: "advisory",
   // bedrock-runtime is the workhorse endpoint for invoke/converse. Control-plane
   // listing operations override the host on a per-capability basis below.
-  baseUrl: { metadataKey: "runtimeEndpoint", fallback: "https://bedrock-runtime.us-east-1.amazonaws.com" },
+  credentialPlacement: { kind: "aws-sigv4", service: "bedrock" },
+  baseUrl: { metadataKey: "runtimeEndpoint", fallback: "https://bedrock-runtime.{region}.amazonaws.com" },
   defaultHeaders: { "content-type": "application/json", accept: "application/json" },
-  test: { method: "GET", path: "/foundation-models", headers: { host: "bedrock.us-east-1.amazonaws.com" } },
+  test: { method: "GET", path: "/foundation-models", headers: { host: "bedrock.{region}.amazonaws.com" } },
   capabilities: [
     {
       name: "models.list",
@@ -44888,9 +45057,10 @@ var amazonBedrockConnector = declarativeRestConnector({
           byOutputModality: "{byOutputModality}",
           byInferenceType: "{byInferenceType}"
         },
-        // Control-plane host override; declarative-rest forwards the header to
-        // the gateway, which rewrites the upstream Host for SigV4.
-        headers: { host: "bedrock.us-east-1.amazonaws.com" }
+        // Control-plane host override: the runtime folds this `host` header into
+        // the request URL (region substituted) so SigV4 signs the bedrock.<region>
+        // control-plane host, not the bedrock-runtime base host.
+        headers: { host: "bedrock.{region}.amazonaws.com" }
       }
     },
     {
@@ -44907,7 +45077,7 @@ var amazonBedrockConnector = declarativeRestConnector({
       request: {
         method: "GET",
         path: "/foundation-models/{modelIdentifier}",
-        headers: { host: "bedrock.us-east-1.amazonaws.com" }
+        headers: { host: "bedrock.{region}.amazonaws.com" }
       }
     },
     {
@@ -45020,13 +45190,14 @@ var amazonSecretsManagerConnector = declarativeRestConnector({
   description: "Create, read, update, find, and delete secrets in AWS Secrets Manager, or generate a random password.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key id + secret access key + region (api-key field carries the SigV4 credential bundle)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the secretsmanager.<region>.amazonaws.com endpoint.'
   },
   category: "other",
   defaultConsistencyModel: "authoritative",
+  credentialPlacement: { kind: "aws-sigv4", service: "secretsmanager" },
   baseUrl: {
     metadataKey: "endpoint",
-    fallback: "https://secretsmanager.us-east-1.amazonaws.com"
+    fallback: "https://secretsmanager.{region}.amazonaws.com"
   },
   defaultHeaders: {
     "Content-Type": "application/x-amz-json-1.1"
@@ -45924,11 +46095,15 @@ var amazonSesConnector = declarativeRestConnector({
   description: "Send transactional and templated email and manage SES email templates via the Amazon SES v2 REST API.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key ID + secret access key with ses:SendEmail / ses:SendTemplatedEmail / template-management permissions. The region selects the SES endpoint (e.g. us-east-1)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"} (the key needs ses:SendEmail / ses:SendTemplatedEmail / template-management permissions). Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the email.<region>.amazonaws.com (SES v2) endpoint.'
   },
   category: "comms",
   defaultConsistencyModel: "authoritative",
-  baseUrl: { metadataKey: "endpoint" },
+  // SES v2 REST API: the SigV4 signing name is `ses`, but the regional host is
+  // the `email.` subdomain. metadata.endpoint still overrides when a tenant
+  // pins a host.
+  credentialPlacement: { kind: "aws-sigv4", service: "ses" },
+  baseUrl: { metadataKey: "endpoint", fallback: "https://email.{region}.amazonaws.com" },
   test: { method: "GET", path: "/v2/email/identities" },
   capabilities: [
     {
@@ -46191,13 +46366,14 @@ var amazonSnsConnector = declarativeRestConnector({
   description: "Publish messages to Amazon Simple Notification Service topics, manage topics, and manage subscriptions.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key id + secret access key + region (api-key field carries the SigV4 credential bundle)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the sns.<region>.amazonaws.com endpoint.'
   },
   category: "comms",
   defaultConsistencyModel: "authoritative",
+  credentialPlacement: { kind: "aws-sigv4", service: "sns" },
   baseUrl: {
     metadataKey: "endpoint",
-    fallback: "https://sns.us-east-1.amazonaws.com"
+    fallback: "https://sns.{region}.amazonaws.com"
   },
   defaultHeaders: {
     "Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
@@ -46466,16 +46642,17 @@ var amazonSqsConnector = declarativeRestConnector({
   description: "Send, receive, and delete messages on AWS SQS queues, and discover queue URLs and attributes.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key id + secret access key + region (api-key field carries the SigV4 credential bundle; metadata.endpoint may override the regional host)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" (STS temp creds) and "endpoint" (override host). Requests are signed with AWS Signature V4; the region selects the sqs.<region>.amazonaws.com endpoint.'
   },
   category: "other",
   // SQS is an at-least-once durable queue: sends, deletes, and queue-attribute
   // reads are authoritative against the service. Receive returns a transient
   // visibility-locked view, but the queue state itself is authoritative.
   defaultConsistencyModel: "authoritative",
+  credentialPlacement: { kind: "aws-sigv4", service: "sqs" },
   baseUrl: {
     metadataKey: "endpoint",
-    fallback: "https://sqs.us-east-1.amazonaws.com"
+    fallback: "https://sqs.{region}.amazonaws.com"
   },
   defaultHeaders: {
     "Content-Type": "application/x-amz-json-1.0"
@@ -46798,13 +46975,14 @@ var amazonTextractConnector = declarativeRestConnector({
   description: "Extract text, forms, tables, signatures, and structured data (expense, identity) from documents using AWS Textract.",
   auth: {
     kind: "api-key",
-    hint: "AWS access key id + secret access key + region (api-key field carries the SigV4 credential bundle; the gateway signs each request)."
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint". Requests are signed with AWS Signature V4; the region selects the textract.<region>.amazonaws.com endpoint.'
   },
   category: "other",
   defaultConsistencyModel: "authoritative",
+  credentialPlacement: { kind: "aws-sigv4", service: "textract" },
   baseUrl: {
     metadataKey: "endpoint",
-    fallback: "https://textract.us-east-1.amazonaws.com"
+    fallback: "https://textract.{region}.amazonaws.com"
   },
   defaultHeaders: {
     "Content-Type": "application/x-amz-json-1.1"
@@ -52257,15 +52435,14 @@ var backblazeConnector = declarativeRestConnector({
   description: "Read and upload objects on a Backblaze B2 bucket via the S3-compatible REST API at s3.{region}.backblazeb2.com.",
   auth: {
     kind: "api-key",
-    hint: "Backblaze B2 application key pair (accessKeyId + secretAccessKey) scoped to the target bucket. Region selects the s3.{region}.backblazeb2.com endpoint."
+    hint: 'Backblaze B2 application key pair as JSON: {"accessKeyId":"\u2026","secretAccessKey":"\u2026","region":"us-west-001"} scoped to the target bucket. Optional "endpoint" overrides the host. Requests are signed with AWS Signature V4 (S3-compatible); the region selects the s3.<region>.backblazeb2.com endpoint.'
   },
   category: "storage",
   defaultConsistencyModel: "authoritative",
-  // Endpoint is region-derived in the activepieces piece; the runtime
-  // resolves {region} from the credential bundle when constructing the
-  // request URL. The declarative-REST adapter takes a string baseUrl, so
-  // we keep the template here and rely on the runtime's URL resolver to
-  // substitute the region placeholder from the credential metadata.
+  // Backblaze B2 speaks the S3 API, so it signs with AWS SigV4 under the `s3`
+  // service. The runtime substitutes {region} from the credential bundle into
+  // the host template below (or honors an explicit bundle `endpoint`).
+  credentialPlacement: { kind: "aws-sigv4", service: "s3" },
   baseUrl: "https://s3.{region}.backblazeb2.com",
   test: { method: "GET", path: "/{bucket}?list-type=2&max-keys=1" },
   capabilities: [
@@ -125313,4 +125490,4 @@ export {
   demandbaseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-WTMOFI3U.js.map
+//# sourceMappingURL=chunk-F6MF4YNI.js.map