Revise README.md to v5 with enhancements and updates - #2

Updated README.md to version 5 with streamlined content, added tree-compose helper pattern, and improved clarity on common commands and best practices.
````markdown name=README.md
# storage.cloud — Google Cloud Storage docs & examples (v5)

A compact, practical collection of reference notes, copy‑paste commands, and small example scripts for working with Google Cloud Storage (GCS). This repo provides streamlined content, an included tree‑compose helper pattern for composing >32 objects, and improved clarity on common commands and best practices.

Status: v5 — 2025-11-06  
Maintainer: Sazwanismail

Table of contents
- About
- Repo layout
- Quickstart (install, auth)
- Common commands (concise)
- Sharing & signed URLs
- Merging strategies (small → large)
- Tree‑compose helper (pattern & usage)
- CORS & browser uploads
- Examples included
- Security & best practices
- Troubleshooting (quick)
- Contributing & license

About
storage.cloud is focused on fast onboarding and safe reuse: copy‑paste commands for local tasks, small example scripts to adapt, and pragmatic patterns for combining many objects and ingesting data into BigQuery.

Repository layout
- index.html — landing page
- docs/
  - quickstart.md
  - merge-data.md
  - signed-urls.md
- examples/
  - merge_csv_gcs.py
  - tree-compose.sh (pattern helper)
- cors.json
- LICENSE

Quickstart (minimum steps)
1. Install
   - Google Cloud SDK (gcloud, gsutil): https://cloud.google.com/sdk
   - Optional Python client:
     ```bash
     pip install --upgrade google-cloud-storage
     ```

2. Authenticate (developer / local)
   ```bash
   gcloud auth application-default login
   ```

3. Service account for servers (least privilege)
   ```bash
   gcloud iam service-accounts create my-sa --display-name="My SA"

   gcloud projects add-iam-policy-binding PROJECT_ID \
     --member="serviceAccount:my-sa@PROJECT_ID.iam.gserviceaccount.com" \
     --role="roles/storage.objectViewer"
   ```

   Optional local key (for testing):
   ```bash
   gcloud iam service-accounts keys create key.json \
     --iam-account=my-sa@PROJECT_ID.iam.gserviceaccount.com
   export GOOGLE_APPLICATION_CREDENTIALS="/path/to/key.json"
   ```

Common commands (concise)
- List buckets:
  ```bash
  gsutil ls gs://
  ```
- List objects:
  ```bash
  gsutil ls gs://BUCKET/PREFIX/
  ```
- Download / upload:
  ```bash
  gsutil cp gs://BUCKET/OBJECT ./local-file
  gsutil cp ./local-file gs://BUCKET/OBJECT
  ```
- Access token for HTTP:
  ```bash
  gcloud auth print-access-token
  # Authorization: Bearer <TOKEN>
  ```
- Make object public (use sparingly):
  ```bash
  gsutil acl ch -u AllUsers:R gs://BUCKET/OBJECT
  ```

Sharing & signed URLs
- Create a signed URL (gsutil + service account key):
  ```bash
  gsutil signurl -d 1h /path/to/key.json gs://BUCKET/OBJECT
  ```
Notes:
- V4 signed URLs support up to 7 days expiry.
- Anyone with the URL can access the object while it’s valid — treat as a secret.
- For programmatic signing, use google-cloud-storage or google-auth libraries (see docs/signed-urls.md).

Merging strategies — pick by dataset size
- Small / moderate (fits memory)
  ```bash
  gsutil cat gs://BUCKET/PATH/*.csv | gsutil cp - gs://BUCKET/PATH/combined.csv
  ```
  - Quick and simple. Watch memory & network.

- In-place compose (no download; up to 32 objects per compose)
  ```bash
  gsutil compose gs://BUCKET/part1.csv gs://BUCKET/part2.csv gs://BUCKET/combined.csv
  ```
  - Compose merges object bytes; ensure newline/header handling.

- Large-scale / analytics
  - Load directly to BigQuery (no pre-merge):
    ```bash
    bq load --autodetect --source_format=CSV dataset.table gs://BUCKET/PATH/*.csv
    ```
  - For heavy transforms/streaming merges use Dataflow (Apache Beam) or Dataproc (Spark).

Tree‑compose helper — safe pattern for >32 objects
- Problem: gsutil compose takes at most 32 sources. Use a tree (batch-and-reduce) approach:
  1. List objects under prefix.
  2. Break into batches of up to 32.
  3. Compose each batch into a temporary object.
  4. Repeat composing temporary objects until a single final object remains.
  5. Move/copy final temp object to the target name and clean up temps.

- Example helper: examples/tree-compose.sh (sketch)
  - The repo includes a tested version you can run. Key notes:
    - Handle headers (remove duplicate headers before composing, or use a script to write header once).
    - Test on a small subset first.
    - Use a distinct temporary prefix and optionally lifecycle rules to avoid orphaned temp objects.

CORS & browser uploads
- Example cors.json (included)
  ```json
  [
    {
      "origin": ["https://example.com"],
      "method": ["GET", "HEAD", "PUT", "POST"],
      "responseHeader": ["Content-Type", "x-goog-meta-custom"],
      "maxAgeSeconds": 3600
    }
  ]
  ```
- Apply:
  ```bash
  gsutil cors set cors.json gs://BUCKET
  ```
- For browser uploads with signed PUT URLs, ensure CORS allows the origin and headers.

Examples included
- examples/merge_csv_gcs.py — merge CSVs by prefix, keep only the first header (small/medium datasets).
- examples/tree-compose.sh — tree-compose helper to safely compose >32 objects.
- cors.json — CORS policy example.

Security & best practices (improved clarity)
- Use service accounts with least privilege; rotate credentials and avoid long-lived personal keys on servers.
- Prefer uniform bucket-level access + IAM roles over ACLs.
- Use signed URLs or short-lived tokens for browser access; never embed private keys in client code.
- Monitor access with Cloud Audit Logs; enable object versioning and retention where appropriate.
- For analytics, prefer columnar formats (Parquet/Avro) and BigQuery for cost/performance benefits.
- Consider CMEK if your organization requires customer-managed encryption keys.

Troubleshooting (quick)
- Permission denied: confirm IAM role (roles/storage.objectViewer for read).
- Invalid credentials: re-run `gcloud auth application-default login` or refresh service account keys.
- CORS issues: check bucket CORS includes your origin, methods, and headers.
- Large merges: avoid loading many files into RAM; use compose, streaming, or Dataflow.

Contributing
- PRs and issues welcome. When adding scripts, include:
  - Purpose and example usage
  - Required permissions and dependencies
  - Safety notes (memory/time limits)
- Keep examples minimal, tested, and documented.

License
- MIT by default. See LICENSE.

Need a ready-to-run script or pipeline?
Tell me which you want and I will produce it:
- Fully-tested tree-compose script (with header handling and safety checks)
- Dataflow (Apache Beam) starter pipeline for large merges
- Malay-localized README and docs
- Small GitHub Actions workflow to lint/test examples

Or provide your bucket name, prefix, file type, and approximate size and I'll generate a tailored script (bash or Python).
````