@sequenceholdings/storage 0.1.1 → 0.1.2

package/README.md

@@ -1,7 +1,7 @@
 # Atlas storage client
 
 Typed Workspaces V2 metadata and direct-to-GCS sequential resumable transfers.
-Initial release is pending publication and public-contract review.
+Preview. See the public Workspaces V2 developer documentation.
 
 ```ts
 import { createStorageClient } from '@sequenceholdings/storage'

package/dist/transfer.js

@@ -13,11 +13,20 @@ class StorageTransferError extends Error {
     }
 }
 exports.StorageTransferError = StorageTransferError;
+/** One dotless bucket label: Google's certificate covers `*.storage.googleapis.com` only. */
+const BUCKET_HOST = /^[a-z0-9][a-z0-9_-]{1,61}[a-z0-9]\.storage\.googleapis\.com$/;
+/**
+ * A session URI is a bearer credential, so bytes go only to GCS's resumable
+ * endpoints: the JSON API on the shared host, or an XML session on a bucket's
+ * own host (Atlas issues those to agent sandboxes, whose egress allows only
+ * their deployment's bucket host). The resumable protocol is the same on both.
+ */
 function checkedUploadUrl(value) {
     const url = new URL(value);
+    const jsonSession = url.hostname === 'storage.googleapis.com' && url.pathname.startsWith('/upload/');
+    const bucketHostSession = BUCKET_HOST.test(url.hostname) && url.pathname !== '/';
     if (url.protocol !== 'https:' ||
-        url.hostname !== 'storage.googleapis.com' ||
-        !url.pathname.startsWith('/upload/') ||
+        !(jsonSession || bucketHostSession) ||
         !url.searchParams.has('upload_id') ||
         url.port ||
         url.username ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sequenceholdings/storage",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Atlas workspace storage contracts and streaming client",
   "license": "UNLICENSED",
   "type": "commonjs",