@sequenceholdings/managed-functions 0.4.2 → 0.4.3

package/README.md

@@ -583,7 +583,7 @@ capabilities:
 ```
 
 Declarations grant no monitoring authority. The attached account needs the
-producer namespace's runtime floor and pinned `emit_monitoring` capability.
+producer namespace's runtime floor and pinned `emit-monitoring` capability.
 Continuous Improvement must also register that exact namespace and authorize
 publishing or catalog reads. Registrations default to inactive with both
 operations disabled. Only a human with current Monitoring Admin authority can
@@ -627,7 +627,7 @@ accepted. A legitimate zero-event result still receives a hash-bound receipt.
 Both publishing and lookup require producer authorization.
 
 `getBucketCatalog({ producer })` reads only the complete active taxonomy
-metadata under the separate namespace `read_monitoring_catalog` capability.
+metadata under the separate namespace `read-monitoring-catalog` capability.
 Freeze that catalog with the analysis inputs. More than 2000 buckets or 512 KiB
 returns an explicit size error; the client never treats a partial catalog as complete.
 

package/dist/monitoring-contract.d.ts

@@ -3,8 +3,8 @@ import { functionMonitoringAnnotationSchema } from './monitoring-annotations';
 export type { DeltaEventInput as MonitoringDeltaEvent } from './monitoring-events';
 export declare const FUNCTION_MONITORING_TOKEN_HEADER = "x-sequence-monitoring-service-token";
 export declare const FUNCTION_MONITORING_DELIVERIES_PATH = "/api/managed-functions/monitoring/deliveries";
-export declare const MONITORING_PRODUCER_CAPABILITY = "emit_monitoring";
-export declare const MONITORING_CATALOG_CAPABILITY = "read_monitoring_catalog";
+export declare const MONITORING_PRODUCER_CAPABILITY = "emit-monitoring";
+export declare const MONITORING_CATALOG_CAPABILITY = "read-monitoring-catalog";
 export declare const MAX_MONITORING_DELIVERY_BYTES: number;
 export declare const functionMonitoringScopesSchema: z.ZodObject<{
     producers: z.ZodArray<z.ZodString>;

package/dist/monitoring-contract.js

@@ -9,8 +9,8 @@ const monitoring_events_1 = require("./monitoring-events");
 const monitoring_annotations_1 = require("./monitoring-annotations");
 exports.FUNCTION_MONITORING_TOKEN_HEADER = 'x-sequence-monitoring-service-token';
 exports.FUNCTION_MONITORING_DELIVERIES_PATH = '/api/managed-functions/monitoring/deliveries';
-exports.MONITORING_PRODUCER_CAPABILITY = 'emit_monitoring';
-exports.MONITORING_CATALOG_CAPABILITY = 'read_monitoring_catalog';
+exports.MONITORING_PRODUCER_CAPABILITY = 'emit-monitoring';
+exports.MONITORING_CATALOG_CAPABILITY = 'read-monitoring-catalog';
 exports.MAX_MONITORING_DELIVERY_BYTES = 512 * 1024;
 const producer = zod_1.z.string().min(1).max(41).regex(/^[a-z][a-z0-9_]{0,40}$/);
 exports.functionMonitoringScopesSchema = zod_1.z.strictObject({

package/dist/runtime.cjs

@@ -18871,8 +18871,8 @@ var require_monitoring_contract = __commonJS({
     var monitoring_annotations_12 = require_monitoring_annotations();
     exports2.FUNCTION_MONITORING_TOKEN_HEADER = "x-sequence-monitoring-service-token";
     exports2.FUNCTION_MONITORING_DELIVERIES_PATH = "/api/managed-functions/monitoring/deliveries";
-    exports2.MONITORING_PRODUCER_CAPABILITY = "emit_monitoring";
-    exports2.MONITORING_CATALOG_CAPABILITY = "read_monitoring_catalog";
+    exports2.MONITORING_PRODUCER_CAPABILITY = "emit-monitoring";
+    exports2.MONITORING_CATALOG_CAPABILITY = "read-monitoring-catalog";
     exports2.MAX_MONITORING_DELIVERY_BYTES = 512 * 1024;
     var producer = zod_12.z.string().min(1).max(41).regex(/^[a-z][a-z0-9_]{0,40}$/);
     exports2.functionMonitoringScopesSchema = zod_12.z.strictObject({
@@ -29268,9 +29268,12 @@ var require_transfer = __commonJS({
       }
     };
     exports2.StorageTransferError = StorageTransferError;
+    var BUCKET_HOST = /^[a-z0-9][a-z0-9_-]{1,61}[a-z0-9]\.storage\.googleapis\.com$/;
     function checkedUploadUrl(value) {
       const url = new URL(value);
-      if (url.protocol !== "https:" || url.hostname !== "storage.googleapis.com" || !url.pathname.startsWith("/upload/") || !url.searchParams.has("upload_id") || url.port || url.username || url.password) {
+      const jsonSession = url.hostname === "storage.googleapis.com" && url.pathname.startsWith("/upload/");
+      const bucketHostSession = BUCKET_HOST.test(url.hostname) && url.pathname !== "/";
+      if (url.protocol !== "https:" || !(jsonSession || bucketHostSession) || !url.searchParams.has("upload_id") || url.port || url.username || url.password) {
         throw new StorageTransferError("Invalid storage upload destination");
       }
       return url.href;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sequenceholdings/managed-functions",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Managed Function context and opt-in cache runtime",
   "license": "UNLICENSED",
   "main": "./dist/index.js",
@@ -40,7 +40,7 @@
     "zod": "^4.1.13",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/sdk-trace-base": "^2.5.1",
-    "@sequenceholdings/storage": "0.1.1"
+    "@sequenceholdings/storage": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",