@taskforcehq/taskforce 0.3.168

package/dist/soak/preflight.js

@@ -0,0 +1,113 @@
+function asNonEmpty(value) {
+    return String(value || '').trim();
+}
+function parsePositiveInt(value, fallback) {
+    const parsed = Number.parseInt(String(value || '').trim(), 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return fallback;
+    return parsed;
+}
+function parseBoolean(value, fallback = false) {
+    const normalized = String(value || '').trim().toLowerCase();
+    if (!normalized)
+        return fallback;
+    if (['1', 'true', 'yes', 'on'].includes(normalized))
+        return true;
+    if (['0', 'false', 'no', 'off'].includes(normalized))
+        return false;
+    return fallback;
+}
+function parseProfile(value) {
+    const normalized = String(value || '').trim().toLowerCase();
+    if (normalized === 'stress')
+        return 'stress';
+    if (normalized === 'overnight')
+        return 'overnight';
+    return 'smoke';
+}
+function isHttpUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+function containsProdHint(value) {
+    return /\bprod(uction)?\b/i.test(value);
+}
+export function loadSyncEndurancePreflightConfig(env = process.env) {
+    const sharedWorkspaceId = asNonEmpty(env.SYNC_SOAK_WORKSPACE_ID);
+    const sharedEmail = asNonEmpty(env.SYNC_SOAK_EMAIL);
+    const sharedPassword = asNonEmpty(env.SYNC_SOAK_PASSWORD);
+    const workspaceId = sharedWorkspaceId;
+    const localWorkspaceId = workspaceId;
+    const cloudWorkspaceId = workspaceId;
+    const localEmail = sharedEmail;
+    const localPassword = sharedPassword;
+    const cloudEmail = sharedEmail;
+    const cloudPassword = sharedPassword;
+    return {
+        localBaseUrl: asNonEmpty(env.SYNC_SOAK_LOCAL_BASE_URL),
+        cloudBaseUrl: asNonEmpty(env.SYNC_SOAK_CLOUD_BASE_URL),
+        workspaceId,
+        localWorkspaceId,
+        cloudWorkspaceId,
+        localEmail,
+        localPassword,
+        cloudEmail,
+        cloudPassword,
+        durationMin: parsePositiveInt(env.SYNC_SOAK_DURATION_MIN, 60),
+        seed: asNonEmpty(env.SYNC_SOAK_SEED) || String(Date.now()),
+        profile: parseProfile(env.SYNC_SOAK_PROFILE),
+        artifactDir: asNonEmpty(env.SYNC_SOAK_ARTIFACT_DIR) || '.taskforce/soak-artifacts',
+        enableSyncDebug: parseBoolean(env.SYNC_SOAK_ENABLE_SYNC_DEBUG, false)
+    };
+}
+export function validateSyncEndurancePreflight(config) {
+    const errors = [];
+    const warnings = [];
+    if (!config.localBaseUrl)
+        errors.push('Missing SYNC_SOAK_LOCAL_BASE_URL.');
+    if (!config.cloudBaseUrl)
+        errors.push('Missing SYNC_SOAK_CLOUD_BASE_URL.');
+    if (config.localBaseUrl && !isHttpUrl(config.localBaseUrl)) {
+        errors.push('SYNC_SOAK_LOCAL_BASE_URL must be an absolute http(s) URL.');
+    }
+    if (config.cloudBaseUrl && !isHttpUrl(config.cloudBaseUrl)) {
+        errors.push('SYNC_SOAK_CLOUD_BASE_URL must be an absolute http(s) URL.');
+    }
+    if (!config.workspaceId)
+        errors.push('Missing SYNC_SOAK_WORKSPACE_ID.');
+    if (!config.localEmail)
+        errors.push('Missing SYNC_SOAK_EMAIL.');
+    if (!config.localPassword)
+        errors.push('Missing SYNC_SOAK_PASSWORD.');
+    if (!config.cloudEmail)
+        errors.push('Missing SYNC_SOAK_EMAIL.');
+    if (!config.cloudPassword)
+        errors.push('Missing SYNC_SOAK_PASSWORD.');
+    if (!config.artifactDir)
+        errors.push('Missing SYNC_SOAK_ARTIFACT_DIR.');
+    if (config.durationMin < 5)
+        errors.push('SYNC_SOAK_DURATION_MIN must be >= 5.');
+    if (containsProdHint(config.localBaseUrl) || containsProdHint(config.cloudBaseUrl)) {
+        warnings.push('One or more base URLs look production-like; prefer dedicated test environments.');
+    }
+    return {
+        ok: errors.length === 0,
+        config,
+        errors,
+        warnings
+    };
+}
+export function assertSyncEndurancePreflight(env = process.env) {
+    const config = loadSyncEndurancePreflightConfig(env);
+    const result = validateSyncEndurancePreflight(config);
+    if (!result.ok) {
+        const details = result.errors.map((entry) => `- ${entry}`).join('\n');
+        throw new Error(`Sync soak preflight failed:\n${details}`);
+    }
+    return result.config;
+}

package/dist/soak/preflight.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/soak/preflight.test.js

@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest';
+import { assertSyncEndurancePreflight, loadSyncEndurancePreflightConfig, validateSyncEndurancePreflight } from './preflight';
+const validEnv = {
+    SYNC_SOAK_LOCAL_BASE_URL: 'http://localhost:5174',
+    SYNC_SOAK_CLOUD_BASE_URL: 'https://cloud.example.com',
+    SYNC_SOAK_WORKSPACE_ID: 'workspace-sync-test',
+    SYNC_SOAK_EMAIL: 'shared-sync-test@example.com',
+    SYNC_SOAK_PASSWORD: 'shared-password',
+    SYNC_SOAK_DURATION_MIN: '90',
+    SYNC_SOAK_PROFILE: 'stress',
+    SYNC_SOAK_SEED: 'seed-123'
+};
+describe('soak/preflight', () => {
+    it('loads typed preflight config from env', () => {
+        const config = loadSyncEndurancePreflightConfig(validEnv);
+        expect(config.localBaseUrl).toBe('http://localhost:5174');
+        expect(config.profile).toBe('stress');
+        expect(config.durationMin).toBe(90);
+        expect(config.seed).toBe('seed-123');
+        expect(config.workspaceId).toBe('workspace-sync-test');
+        expect(config.localWorkspaceId).toBe('workspace-sync-test');
+        expect(config.cloudWorkspaceId).toBe('workspace-sync-test');
+    });
+    it('fails validation when required fields are missing', () => {
+        const config = loadSyncEndurancePreflightConfig({});
+        const result = validateSyncEndurancePreflight(config);
+        expect(result.ok).toBe(false);
+        expect(result.errors.length).toBeGreaterThan(0);
+    });
+    it('throws with a readable error when preflight fails', () => {
+        expect(() => assertSyncEndurancePreflight({})).toThrowError(/preflight failed/i);
+    });
+    it('passes for valid environment', () => {
+        expect(() => assertSyncEndurancePreflight(validEnv)).not.toThrow();
+        const config = loadSyncEndurancePreflightConfig(validEnv);
+        expect(config.localEmail).toBe('shared-sync-test@example.com');
+        expect(config.cloudEmail).toBe('shared-sync-test@example.com');
+    });
+});

package/dist/soak/syncSoakHarness.d.ts

@@ -0,0 +1,6 @@
+import { type SyncEndurancePreflightConfig } from './preflight';
+export interface SyncEnduranceHarness {
+    config: SyncEndurancePreflightConfig;
+    run: () => Promise<void>;
+}
+export declare function createSyncEnduranceHarnessFromEnv(env?: NodeJS.ProcessEnv): SyncEnduranceHarness;

package/dist/soak/syncSoakHarness.js

@@ -0,0 +1,10 @@
+import { assertSyncEndurancePreflight } from './preflight';
+export function createSyncEnduranceHarnessFromEnv(env = process.env) {
+    const config = assertSyncEndurancePreflight(env);
+    return {
+        config,
+        run: async () => {
+            throw new Error('Sync soak harness is not implemented yet.');
+        }
+    };
+}

package/dist/storage/createDatabaseAdapter.d.ts

@@ -0,0 +1,2 @@
+import type { DatabaseAdapter, DatabaseAdapterOptions } from './databaseAdapter.js';
+export declare function createDatabaseAdapter(options: DatabaseAdapterOptions): DatabaseAdapter;

package/dist/storage/createDatabaseAdapter.js

@@ -0,0 +1,9 @@
+import { PostgresAdapter } from './postgresAdapter.js';
+import { SqliteAdapter } from './sqliteAdapter.js';
+export function createDatabaseAdapter(options) {
+    const provider = options.provider || 'sqlite';
+    if (provider === 'postgres') {
+        return new PostgresAdapter(options.postgresConnectionString);
+    }
+    return new SqliteAdapter(options.sqliteDbPath);
+}

package/dist/storage/databaseAdapter.d.ts

@@ -0,0 +1,22 @@
+export type DatabaseProvider = 'sqlite' | 'postgres';
+export interface DatabaseStatement {
+    run(...params: any[]): any;
+    get(...params: any[]): any;
+    all(...params: any[]): any[];
+}
+export interface DatabaseAdapter {
+    readonly provider: DatabaseProvider;
+    readonly open: boolean;
+    prepare(sql: string): DatabaseStatement;
+    exec(sql: string): void;
+    transaction<T extends (...args: any[]) => any>(fn: T): T;
+    pragma(name: string, options?: {
+        simple?: boolean;
+    }): unknown;
+    close(): void;
+}
+export interface DatabaseAdapterOptions {
+    provider?: DatabaseProvider;
+    sqliteDbPath: string;
+    postgresConnectionString?: string;
+}

package/dist/storage/databaseAdapter.js

@@ -0,0 +1 @@
+export {};

package/dist/storage/documentIntegrity.d.ts

@@ -0,0 +1,28 @@
+import type { ResolvedObjectStorageConfig } from './objectStorage.js';
+import type { TaskAssetStore } from './taskAssetStore.js';
+export type IntegrityIssueCode = 'missing_expected_local' | 'missing_expected_r2' | 'hash_mismatch_local' | 'hash_mismatch_r2' | 'missing_local_mirror' | 'missing_r2_mirror' | 'r2_check_failed';
+export interface DocumentIntegrityIssue {
+    path: string;
+    code: IntegrityIssueCode;
+    message: string;
+    expectedProvider: 'local' | 'r2';
+}
+export interface DocumentIntegrityScanSummary {
+    totalChecked: number;
+    totalIssues: number;
+    byCode: Record<string, number>;
+    skippedDeleted: number;
+}
+export interface DocumentIntegrityScanResult {
+    summary: DocumentIntegrityScanSummary;
+    issues: DocumentIntegrityIssue[];
+}
+export declare function scanDocumentIntegrity(params: {
+    basePath: string;
+    objectStorage: ResolvedObjectStorageConfig;
+    verifyHash?: boolean;
+    includeDeleted?: boolean;
+    requireMirror?: boolean;
+    limit?: number;
+    assetStore?: TaskAssetStore;
+}): Promise<DocumentIntegrityScanResult>;

package/dist/storage/documentIntegrity.js

@@ -0,0 +1,103 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { DocumentRegistry, createDocumentHash } from './documentRegistry.js';
+import { ObjectStorageClient } from './objectStorageClient.js';
+function isPathInsideRoot(candidatePath, rootDir) {
+    const resolved = path.resolve(candidatePath);
+    const root = path.resolve(rootDir);
+    const relative = path.relative(root, resolved);
+    return !relative.startsWith('..') && !path.isAbsolute(relative);
+}
+function inc(byCode, code) {
+    byCode[code] = (byCode[code] || 0) + 1;
+}
+export async function scanDocumentIntegrity(params) {
+    const verifyHash = params.verifyHash === true;
+    const includeDeleted = params.includeDeleted === true;
+    const requireMirror = params.requireMirror === true;
+    const maxItems = Number.isFinite(params.limit) ? Math.max(1, Math.floor(Number(params.limit))) : 500;
+    const registry = new DocumentRegistry(params.basePath);
+    const entriesRaw = params.assetStore
+        ? params.assetStore.listAll(maxItems)
+        : registry
+            .listAll()
+            .sort((a, b) => a.path.localeCompare(b.path))
+            .slice(0, maxItems);
+    const issues = [];
+    const byCode = {};
+    let skippedDeleted = 0;
+    const r2Client = params.objectStorage.provider === 'r2'
+        ? new ObjectStorageClient(params.objectStorage)
+        : null;
+    const addIssue = (entry, code, message) => {
+        issues.push({
+            path: entry.path,
+            code,
+            message,
+            expectedProvider: entry.provider
+        });
+        inc(byCode, code);
+    };
+    for (const entry of entriesRaw) {
+        if (entry.deletedAt && !includeDeleted) {
+            skippedDeleted += 1;
+            continue;
+        }
+        const localPath = path.resolve(params.basePath, entry.path);
+        const localInRoot = isPathInsideRoot(localPath, params.basePath);
+        const localExists = localInRoot && fs.existsSync(localPath);
+        let r2Exists = false;
+        let r2CheckFailed = false;
+        if (r2Client) {
+            try {
+                r2Exists = await r2Client.objectExists(entry.path);
+            }
+            catch (error) {
+                r2CheckFailed = true;
+                addIssue(entry, 'r2_check_failed', `Failed to verify R2 object existence: ${String(error?.message || error)}`);
+            }
+        }
+        if (entry.provider === 'local' && !localExists) {
+            addIssue(entry, 'missing_expected_local', 'Registry expects a local file that does not exist on disk.');
+        }
+        if (entry.provider === 'r2' && !r2Exists && !r2CheckFailed) {
+            addIssue(entry, 'missing_expected_r2', 'Registry expects an R2 object that does not exist.');
+        }
+        if (requireMirror) {
+            if (!localExists) {
+                addIssue(entry, 'missing_local_mirror', 'Local mirror copy is missing.');
+            }
+            if (r2Client && !r2Exists && !r2CheckFailed) {
+                addIssue(entry, 'missing_r2_mirror', 'R2 mirror copy is missing.');
+            }
+        }
+        if (verifyHash && entry.provider === 'local' && localExists) {
+            const localBuffer = fs.readFileSync(localPath);
+            const localHash = createDocumentHash(localBuffer);
+            if (localHash !== entry.sha256) {
+                addIssue(entry, 'hash_mismatch_local', 'Registry hash does not match local file bytes.');
+            }
+        }
+        if (verifyHash && entry.provider === 'r2' && r2Client && r2Exists && !r2CheckFailed) {
+            const object = await r2Client.getObject(entry.path);
+            if (!object) {
+                addIssue(entry, 'missing_expected_r2', 'Registry expects an R2 object that does not exist.');
+            }
+            else {
+                const objectHash = createDocumentHash(object.body);
+                if (objectHash !== entry.sha256) {
+                    addIssue(entry, 'hash_mismatch_r2', 'Registry hash does not match R2 object bytes.');
+                }
+            }
+        }
+    }
+    return {
+        summary: {
+            totalChecked: entriesRaw.length - skippedDeleted,
+            totalIssues: issues.length,
+            byCode,
+            skippedDeleted
+        },
+        issues
+    };
+}

package/dist/storage/documentPurge.d.ts

@@ -0,0 +1,14 @@
+import type { ResolvedObjectStorageConfig } from './objectStorage.js';
+import type { TaskAssetStore } from './taskAssetStore.js';
+export interface DocumentPurgeSummary {
+    total: number;
+    purged: number;
+    failed: number;
+}
+export declare function purgeExpiredDocuments(params: {
+    basePath: string;
+    taskDataDir: string;
+    objectStorage: ResolvedObjectStorageConfig;
+    now?: Date;
+    assetStore?: TaskAssetStore;
+}): Promise<DocumentPurgeSummary>;

package/dist/storage/documentPurge.js

@@ -0,0 +1,46 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { DocumentRegistry } from './documentRegistry.js';
+import { ObjectStorageClient } from './objectStorageClient.js';
+export async function purgeExpiredDocuments(params) {
+    const registry = new DocumentRegistry(params.basePath);
+    const candidates = params.assetStore
+        ? params.assetStore.listPurgeCandidates(params.now || new Date())
+        : registry.listPurgeCandidates(params.now || new Date());
+    const summary = {
+        total: candidates.length,
+        purged: 0,
+        failed: 0
+    };
+    const objectStorageClient = params.objectStorage.provider === 'r2'
+        ? new ObjectStorageClient(params.objectStorage)
+        : null;
+    for (const entry of candidates) {
+        try {
+            if (objectStorageClient) {
+                await objectStorageClient.deleteObject(entry.path);
+            }
+            else {
+                const filePath = path.resolve(params.basePath, entry.path);
+                const storageRoot = path.resolve(params.basePath);
+                const relative = path.relative(storageRoot, filePath);
+                const insideStorageRoot = !relative.startsWith('..') && !path.isAbsolute(relative);
+                if (insideStorageRoot && fs.existsSync(filePath)) {
+                    fs.unlinkSync(filePath);
+                }
+            }
+            if (params.assetStore) {
+                const workspaceId = entry?.workspaceId ? String(entry.workspaceId) : undefined;
+                params.assetStore.remove(entry.path, workspaceId);
+            }
+            else {
+                registry.remove(entry.path);
+            }
+            summary.purged += 1;
+        }
+        catch {
+            summary.failed += 1;
+        }
+    }
+    return summary;
+}

package/dist/storage/documentRegistry.d.ts

@@ -0,0 +1,39 @@
+import type { ObjectStorageProvider } from './objectStorage.js';
+import type { VirusScanResult } from '../security/virusScan.js';
+export interface DocumentRegistryEntry {
+    path: string;
+    provider: ObjectStorageProvider;
+    version: number;
+    contentType: string;
+    sizeBytes: number;
+    sha256: string;
+    uploadedAt: string;
+    scan: VirusScanResult & {
+        scannedAt: string;
+    };
+    deletedAt?: string | null;
+    purgeAfter?: string | null;
+}
+export declare function createDocumentHash(buffer: Buffer): string;
+export declare class DocumentRegistry {
+    private readonly registryFilePath;
+    constructor(basePath: string);
+    private readRegistry;
+    private writeRegistry;
+    get(pathValue: string): DocumentRegistryEntry | null;
+    recordUpload(input: {
+        path: string;
+        provider: ObjectStorageProvider;
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+        uploadedAt?: string;
+        scan: VirusScanResult;
+    }): DocumentRegistryEntry;
+    isDeleted(pathValue: string): boolean;
+    markDeleted(pathValue: string, retentionDays: number): DocumentRegistryEntry | null;
+    clearDeleted(pathValue: string): DocumentRegistryEntry | null;
+    remove(pathValue: string): boolean;
+    listPurgeCandidates(now?: Date): DocumentRegistryEntry[];
+    listAll(): DocumentRegistryEntry[];
+}

package/dist/storage/documentRegistry.js

@@ -0,0 +1,115 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { createHash } from 'crypto';
+function normalizeRegistryPath(rawPath) {
+    return String(rawPath || '').trim().replace(/\\/g, '/');
+}
+export function createDocumentHash(buffer) {
+    return createHash('sha256').update(buffer).digest('hex');
+}
+export class DocumentRegistry {
+    registryFilePath;
+    constructor(basePath) {
+        this.registryFilePath = path.join(basePath, 'document-registry.json');
+    }
+    readRegistry() {
+        if (!fs.existsSync(this.registryFilePath))
+            return { documents: {} };
+        try {
+            const parsed = JSON.parse(fs.readFileSync(this.registryFilePath, 'utf8'));
+            if (!parsed || typeof parsed !== 'object' || typeof parsed.documents !== 'object') {
+                return { documents: {} };
+            }
+            return parsed;
+        }
+        catch {
+            return { documents: {} };
+        }
+    }
+    writeRegistry(registry) {
+        fs.mkdirSync(path.dirname(this.registryFilePath), { recursive: true });
+        fs.writeFileSync(this.registryFilePath, `${JSON.stringify(registry, null, 2)}\n`, 'utf8');
+    }
+    get(pathValue) {
+        const key = normalizeRegistryPath(pathValue);
+        const registry = this.readRegistry();
+        return registry.documents[key] || null;
+    }
+    recordUpload(input) {
+        const key = normalizeRegistryPath(input.path);
+        const registry = this.readRegistry();
+        const existing = registry.documents[key];
+        const entry = {
+            path: key,
+            provider: input.provider,
+            version: existing ? existing.version + 1 : 1,
+            contentType: input.contentType,
+            sizeBytes: input.sizeBytes,
+            sha256: input.sha256,
+            uploadedAt: input.uploadedAt || new Date().toISOString(),
+            scan: {
+                ...input.scan,
+                scannedAt: new Date().toISOString()
+            },
+            deletedAt: null,
+            purgeAfter: null
+        };
+        registry.documents[key] = entry;
+        this.writeRegistry(registry);
+        return entry;
+    }
+    isDeleted(pathValue) {
+        const entry = this.get(pathValue);
+        return Boolean(entry?.deletedAt);
+    }
+    markDeleted(pathValue, retentionDays) {
+        const key = normalizeRegistryPath(pathValue);
+        const registry = this.readRegistry();
+        const entry = registry.documents[key];
+        if (!entry)
+            return null;
+        const now = new Date();
+        const safeDays = Number.isFinite(retentionDays) ? Math.max(1, Math.floor(retentionDays)) : 7;
+        const purgeAt = new Date(now.getTime() + safeDays * 24 * 60 * 60 * 1000);
+        entry.deletedAt = now.toISOString();
+        entry.purgeAfter = purgeAt.toISOString();
+        registry.documents[key] = entry;
+        this.writeRegistry(registry);
+        return entry;
+    }
+    clearDeleted(pathValue) {
+        const key = normalizeRegistryPath(pathValue);
+        const registry = this.readRegistry();
+        const entry = registry.documents[key];
+        if (!entry)
+            return null;
+        entry.deletedAt = null;
+        entry.purgeAfter = null;
+        registry.documents[key] = entry;
+        this.writeRegistry(registry);
+        return entry;
+    }
+    remove(pathValue) {
+        const key = normalizeRegistryPath(pathValue);
+        const registry = this.readRegistry();
+        if (!registry.documents[key])
+            return false;
+        delete registry.documents[key];
+        this.writeRegistry(registry);
+        return true;
+    }
+    listPurgeCandidates(now = new Date()) {
+        const registry = this.readRegistry();
+        const nowMs = now.getTime();
+        return Object.values(registry.documents).filter((entry) => {
+            if (!entry.deletedAt || !entry.purgeAfter)
+                return false;
+            const purgeMs = Date.parse(entry.purgeAfter);
+            return Number.isFinite(purgeMs) && purgeMs <= nowMs;
+        });
+    }
+    listAll() {
+        const registry = this.readRegistry();
+        return Object.values(registry.documents);
+    }
+}

package/dist/storage/integritySchedule.d.ts

@@ -0,0 +1,17 @@
+export type IntegrityScheduleFrequency = 'daily' | 'weekly';
+export interface StorageIntegrityScheduleSettings {
+    enabled: boolean;
+    frequency: IntegrityScheduleFrequency;
+    dayOfWeek: number;
+    hourUTC: number;
+    minuteUTC: number;
+    verifyHash: boolean;
+    includeDeleted: boolean;
+    requireMirror: boolean;
+    limit: number;
+    lastRunAt?: string | null;
+}
+export declare const DEFAULT_STORAGE_INTEGRITY_SCHEDULE: StorageIntegrityScheduleSettings;
+export declare function normalizeStorageIntegrityScheduleSettings(raw: any): StorageIntegrityScheduleSettings;
+export declare function resolveStorageIntegrityScheduleSettings(globalSettings: any): StorageIntegrityScheduleSettings;
+export declare function shouldRunStorageIntegritySchedule(settings: StorageIntegrityScheduleSettings, now: Date): boolean;

package/dist/storage/integritySchedule.js

@@ -0,0 +1,62 @@
+export const DEFAULT_STORAGE_INTEGRITY_SCHEDULE = {
+    enabled: false,
+    frequency: 'daily',
+    dayOfWeek: 0,
+    hourUTC: 3,
+    minuteUTC: 0,
+    verifyHash: false,
+    includeDeleted: false,
+    requireMirror: false,
+    limit: 500,
+    lastRunAt: null
+};
+export function normalizeStorageIntegrityScheduleSettings(raw) {
+    const frequency = raw?.frequency === 'weekly' ? 'weekly' : 'daily';
+    const dayOfWeekRaw = Number(raw?.dayOfWeek);
+    const hourRaw = Number(raw?.hourUTC);
+    const minuteRaw = Number(raw?.minuteUTC);
+    const limitRaw = Number(raw?.limit);
+    const lastRunAtRaw = typeof raw?.lastRunAt === 'string' ? raw.lastRunAt : null;
+    return {
+        enabled: raw?.enabled === true,
+        frequency,
+        dayOfWeek: Number.isFinite(dayOfWeekRaw) ? Math.max(0, Math.min(6, Math.floor(dayOfWeekRaw))) : 0,
+        hourUTC: Number.isFinite(hourRaw) ? Math.max(0, Math.min(23, Math.floor(hourRaw))) : 3,
+        minuteUTC: Number.isFinite(minuteRaw) ? Math.max(0, Math.min(59, Math.floor(minuteRaw))) : 0,
+        verifyHash: raw?.verifyHash === true,
+        includeDeleted: raw?.includeDeleted === true,
+        requireMirror: raw?.requireMirror === true,
+        limit: Number.isFinite(limitRaw) ? Math.max(1, Math.floor(limitRaw)) : 500,
+        lastRunAt: lastRunAtRaw
+    };
+}
+export function resolveStorageIntegrityScheduleSettings(globalSettings) {
+    const raw = globalSettings?.storageIntegritySchedule || {};
+    return normalizeStorageIntegrityScheduleSettings({
+        ...DEFAULT_STORAGE_INTEGRITY_SCHEDULE,
+        ...raw
+    });
+}
+export function shouldRunStorageIntegritySchedule(settings, now) {
+    if (!settings.enabled)
+        return false;
+    if (now.getUTCHours() !== settings.hourUTC || now.getUTCMinutes() !== settings.minuteUTC)
+        return false;
+    if (settings.frequency === 'weekly' && now.getUTCDay() !== settings.dayOfWeek)
+        return false;
+    const lastRunAt = settings.lastRunAt ? Date.parse(settings.lastRunAt) : NaN;
+    if (!Number.isFinite(lastRunAt))
+        return true;
+    const last = new Date(lastRunAt);
+    const sameDay = last.getUTCFullYear() === now.getUTCFullYear()
+        && last.getUTCMonth() === now.getUTCMonth()
+        && last.getUTCDate() === now.getUTCDate();
+    if (sameDay)
+        return false;
+    if (settings.frequency === 'weekly') {
+        const daysSince = Math.floor((Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()) - Date.UTC(last.getUTCFullYear(), last.getUTCMonth(), last.getUTCDate())) / (24 * 60 * 60 * 1000));
+        if (daysSince < 7)
+            return false;
+    }
+    return true;
+}

package/dist/storage/objectStorage.d.ts

@@ -0,0 +1,20 @@
+export type ObjectStorageProvider = 'local' | 'r2';
+export interface R2ObjectStorageConfig {
+    accountId: string;
+    bucket: string;
+    endpoint: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    keyPrefix: string;
+    signedUploadTtlSeconds: number;
+    signedDownloadTtlSeconds: number;
+}
+export interface ResolvedObjectStorageConfig {
+    provider: ObjectStorageProvider;
+    r2?: R2ObjectStorageConfig;
+}
+export interface PublicObjectStorageConfig {
+    provider: ObjectStorageProvider;
+    r2?: Omit<R2ObjectStorageConfig, 'accessKeyId' | 'secretAccessKey' | 'accountId'>;
+}
+export declare function toPublicObjectStorageConfig(config: ResolvedObjectStorageConfig): PublicObjectStorageConfig;