@taskforcehq/taskforce 0.3.169 → 0.3.300

package/dist/shared/taxonomyState.js

@@ -0,0 +1,73 @@
+import { getDefaultTypeDefinition } from './taxonomyDefaults.js';
+function sanitizeStringArray(input) {
+    if (!Array.isArray(input))
+        return undefined;
+    const values = input
+        .filter((entry) => typeof entry === 'string' && entry.trim().length > 0)
+        .map((entry) => entry.trim());
+    return values.length > 0 ? values : undefined;
+}
+export function hasWorkspaceTaxonomyStatePayload(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return false;
+    const source = input;
+    return Array.isArray(source.categories)
+        || Array.isArray(source.types)
+        || Array.isArray(source.priorities)
+        || Array.isArray(source.taxonomies)
+        || (!!source.displayLabels && typeof source.displayLabels === 'object' && !Array.isArray(source.displayLabels));
+}
+export function normalizeWorkspaceTaxonomyStatePayload(input) {
+    const source = input || {};
+    const categories = Array.isArray(source.categories)
+        ? source.categories.map((category) => (typeof category === 'string'
+            ? { value: category.toLowerCase().replace(/\s+/g, '-'), label: category }
+            : category))
+        : [];
+    return {
+        categories,
+        types: Array.isArray(source.types)
+            ? source.types.map((type) => {
+                const fallback = getDefaultTypeDefinition(type.value);
+                return {
+                    ...fallback,
+                    ...type,
+                    aliases: Array.isArray(type.aliases)
+                        ? type.aliases.filter((alias) => typeof alias === 'string' && alias.trim().length > 0)
+                            .map((alias) => alias.trim())
+                        : undefined,
+                    status: type.status === 'retired' ? 'retired' : 'active',
+                };
+            })
+            : [],
+        priorities: Array.isArray(source.priorities) ? source.priorities : [],
+        taxonomies: Array.isArray(source.taxonomies)
+            ? source.taxonomies.map((taxonomy) => ({
+                ...taxonomy,
+                aliases: sanitizeStringArray(taxonomy.aliases),
+                options: Array.isArray(taxonomy.options)
+                    ? taxonomy.options.map((option) => ({
+                        ...option,
+                        aliases: sanitizeStringArray(option.aliases),
+                        status: option.status === 'retired' ? 'retired' : 'active'
+                    }))
+                    : [],
+                status: taxonomy.status === 'retired' ? 'retired' : 'active',
+                formEnabled: taxonomy.formEnabled !== false,
+                filterEnabled: taxonomy.filterEnabled !== false,
+                sortEnabled: taxonomy.sortEnabled === true
+            }))
+            : [],
+        displayLabels: {
+            category: typeof source.displayLabels?.category === 'string' && source.displayLabels.category.trim().length > 0
+                ? source.displayLabels.category.trim()
+                : undefined,
+            type: typeof source.displayLabels?.type === 'string' && source.displayLabels.type.trim().length > 0
+                ? source.displayLabels.type.trim()
+                : undefined,
+            priority: typeof source.displayLabels?.priority === 'string' && source.displayLabels.priority.trim().length > 0
+                ? source.displayLabels.priority.trim()
+                : undefined,
+        }
+    };
+}

package/dist/shared/taxonomyState.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/shared/taxonomyState.test.js

@@ -0,0 +1,71 @@
+import { describe, expect, it } from 'vitest';
+import { hasWorkspaceTaxonomyStatePayload, normalizeWorkspaceTaxonomyStatePayload } from './taxonomyState';
+describe('taxonomyState helpers', () => {
+    it('normalizes legacy string categories into category records', () => {
+        const normalized = normalizeWorkspaceTaxonomyStatePayload({
+            categories: ['General', { value: 'research', label: 'Research' }],
+            types: [{ value: 'task', label: 'Task' }],
+            priorities: [{ value: 2, label: 'Medium' }],
+            taxonomies: []
+        });
+        expect(normalized.categories).toEqual([
+            { value: 'general', label: 'General' },
+            { value: 'research', label: 'Research' }
+        ]);
+        expect(normalized.types).toEqual([{
+                value: 'task',
+                label: 'Task',
+                icon: 'CheckSquare',
+                color: 'blue-500',
+                aliases: undefined,
+                status: 'active'
+            }]);
+        expect(normalized.priorities).toEqual([{ value: 2, label: 'Medium' }]);
+        expect(normalized.taxonomies).toEqual([]);
+        expect(normalized.displayLabels).toEqual({});
+    });
+    it('fills missing arrays with empty collections', () => {
+        const normalized = normalizeWorkspaceTaxonomyStatePayload(undefined);
+        expect(normalized).toEqual({
+            categories: [],
+            types: [],
+            priorities: [],
+            taxonomies: [],
+            displayLabels: {}
+        });
+    });
+    it('sanitizes custom taxonomy aliases for taxonomies and options', () => {
+        const normalized = normalizeWorkspaceTaxonomyStatePayload({
+            taxonomies: [{
+                    id: 'review-status',
+                    label: 'Review Status',
+                    aliases: [' review route ', '', 'workflow'],
+                    widgetType: 'select',
+                    isSystem: false,
+                    multiSelect: false,
+                    options: [
+                        { value: 'legal-review', label: 'Legal Review', aliases: [' legal ', '', 'lawyer'], status: 'retired' }
+                    ]
+                }]
+        });
+        expect(normalized.taxonomies).toEqual([
+            expect.objectContaining({
+                id: 'review-status',
+                aliases: ['review route', 'workflow'],
+                options: [
+                    expect.objectContaining({
+                        value: 'legal-review',
+                        aliases: ['legal', 'lawyer'],
+                        status: 'retired'
+                    })
+                ]
+            })
+        ]);
+    });
+    it('detects unified taxonomy payloads', () => {
+        expect(hasWorkspaceTaxonomyStatePayload({ categories: [] })).toBe(true);
+        expect(hasWorkspaceTaxonomyStatePayload({ priorities: [] })).toBe(true);
+        expect(hasWorkspaceTaxonomyStatePayload({ foo: 'bar' })).toBe(false);
+        expect(hasWorkspaceTaxonomyStatePayload(null)).toBe(false);
+    });
+});

package/dist/shared/workflowDefaults.d.ts

@@ -0,0 +1,9 @@
+export interface DefaultWorkflowDefinition {
+    value: string;
+    label: string;
+    color?: string;
+    icon?: string;
+}
+export declare const DEFAULT_WORKFLOW_VALUE = "default";
+export declare const BUILTIN_WORKFLOW_DEFINITIONS: readonly DefaultWorkflowDefinition[];
+export declare function cloneDefaultWorkflowDefinitions(): DefaultWorkflowDefinition[];

package/dist/shared/workflowDefaults.js

@@ -0,0 +1,11 @@
+export const DEFAULT_WORKFLOW_VALUE = 'default';
+export const BUILTIN_WORKFLOW_DEFINITIONS = [
+    { value: DEFAULT_WORKFLOW_VALUE, label: 'Default', color: 'slate-500', icon: 'Circle' },
+    { value: 'evaluate', label: 'Evaluate', color: 'amber-500', icon: 'Search' },
+    { value: 'collaborate', label: 'Collaborate', color: 'blue-500', icon: 'Users' },
+    { value: 'plan', label: 'Plan', color: 'teal-500', icon: 'FileText' },
+    { value: 'review', label: 'Review', color: 'violet-500', icon: 'Microscope' },
+];
+export function cloneDefaultWorkflowDefinitions() {
+    return BUILTIN_WORKFLOW_DEFINITIONS.map((workflow) => ({ ...workflow }));
+}

package/dist/storage/documentIntegrity.d.ts

@@ -1,5 +1,6 @@
 import type { ResolvedObjectStorageConfig } from './objectStorage.js';
 import type { TaskAssetStore } from './taskAssetStore.js';
+import type { WorkspaceAssetStore } from './workspaceAssetStore.js';
 export type IntegrityIssueCode = 'missing_expected_local' | 'missing_expected_r2' | 'hash_mismatch_local' | 'hash_mismatch_r2' | 'missing_local_mirror' | 'missing_r2_mirror' | 'r2_check_failed';
 export interface DocumentIntegrityIssue {
     path: string;
@@ -25,4 +26,5 @@ export declare function scanDocumentIntegrity(params: {
     requireMirror?: boolean;
     limit?: number;
     assetStore?: TaskAssetStore;
+    workspaceAssetStore?: WorkspaceAssetStore;
 }): Promise<DocumentIntegrityScanResult>;

package/dist/storage/documentIntegrity.js

@@ -17,24 +17,38 @@ export async function scanDocumentIntegrity(params) {
     const requireMirror = params.requireMirror === true;
     const maxItems = Number.isFinite(params.limit) ? Math.max(1, Math.floor(Number(params.limit))) : 500;
     const registry = new DocumentRegistry(params.basePath);
-    const entriesRaw = params.assetStore
-        ? params.assetStore.listAll(maxItems)
-        : registry
-            .listAll()
-            .sort((a, b) => a.path.localeCompare(b.path))
-            .slice(0, maxItems);
+    const canonicalEntries = params.workspaceAssetStore
+        ? params.workspaceAssetStore.listAll({ includeDeleted: true, limit: maxItems })
+        : [];
+    const entriesRaw = canonicalEntries.length > 0
+        ? canonicalEntries
+        : params.assetStore
+            ? params.assetStore.listAll(maxItems)
+            : registry
+                .listAll()
+                .sort((a, b) => a.path.localeCompare(b.path))
+                .slice(0, maxItems);
     const issues = [];
     const byCode = {};
     let skippedDeleted = 0;
     const r2Client = params.objectStorage.provider === 'r2'
         ? new ObjectStorageClient(params.objectStorage)
         : null;
+    const getEntryPath = (entry) => {
+        return 'storageKey' in entry ? entry.storageKey : entry.path;
+    };
+    const getEntryProvider = (entry) => {
+        return ('storageProvider' in entry ? entry.storageProvider : entry.provider) === 'r2' ? 'r2' : 'local';
+    };
+    const getEntryHash = (entry) => {
+        return 'contentSha256' in entry ? entry.contentSha256 : entry.sha256;
+    };
     const addIssue = (entry, code, message) => {
         issues.push({
-            path: entry.path,
+            path: getEntryPath(entry),
             code,
             message,
-            expectedProvider: entry.provider
+            expectedProvider: getEntryProvider(entry)
         });
         inc(byCode, code);
     };
@@ -43,24 +57,27 @@ export async function scanDocumentIntegrity(params) {
             skippedDeleted += 1;
             continue;
         }
-        const localPath = path.resolve(params.basePath, entry.path);
+        const entryPath = getEntryPath(entry);
+        const entryProvider = getEntryProvider(entry);
+        const entryHash = getEntryHash(entry);
+        const localPath = path.resolve(params.basePath, entryPath);
         const localInRoot = isPathInsideRoot(localPath, params.basePath);
         const localExists = localInRoot && fs.existsSync(localPath);
         let r2Exists = false;
         let r2CheckFailed = false;
         if (r2Client) {
             try {
-                r2Exists = await r2Client.objectExists(entry.path);
+                r2Exists = await r2Client.objectExists(entryPath);
             }
             catch (error) {
                 r2CheckFailed = true;
                 addIssue(entry, 'r2_check_failed', `Failed to verify R2 object existence: ${String(error?.message || error)}`);
             }
         }
-        if (entry.provider === 'local' && !localExists) {
+        if (entryProvider === 'local' && !localExists) {
             addIssue(entry, 'missing_expected_local', 'Registry expects a local file that does not exist on disk.');
         }
-        if (entry.provider === 'r2' && !r2Exists && !r2CheckFailed) {
+        if (entryProvider === 'r2' && !r2Exists && !r2CheckFailed) {
             addIssue(entry, 'missing_expected_r2', 'Registry expects an R2 object that does not exist.');
         }
         if (requireMirror) {
@@ -71,21 +88,21 @@ export async function scanDocumentIntegrity(params) {
                 addIssue(entry, 'missing_r2_mirror', 'R2 mirror copy is missing.');
             }
         }
-        if (verifyHash && entry.provider === 'local' && localExists) {
+        if (verifyHash && entryProvider === 'local' && localExists) {
             const localBuffer = fs.readFileSync(localPath);
             const localHash = createDocumentHash(localBuffer);
-            if (localHash !== entry.sha256) {
+            if (localHash !== entryHash) {
                 addIssue(entry, 'hash_mismatch_local', 'Registry hash does not match local file bytes.');
             }
         }
-        if (verifyHash && entry.provider === 'r2' && r2Client && r2Exists && !r2CheckFailed) {
-            const object = await r2Client.getObject(entry.path);
+        if (verifyHash && entryProvider === 'r2' && r2Client && r2Exists && !r2CheckFailed) {
+            const object = await r2Client.getObject(entryPath);
             if (!object) {
                 addIssue(entry, 'missing_expected_r2', 'Registry expects an R2 object that does not exist.');
             }
             else {
                 const objectHash = createDocumentHash(object.body);
-                if (objectHash !== entry.sha256) {
+                if (objectHash !== entryHash) {
                     addIssue(entry, 'hash_mismatch_r2', 'Registry hash does not match R2 object bytes.');
                 }
             }

package/dist/storage/documentPurge.d.ts

@@ -1,5 +1,6 @@
 import type { ResolvedObjectStorageConfig } from './objectStorage.js';
 import type { TaskAssetStore } from './taskAssetStore.js';
+import type { WorkspaceAssetStore } from './workspaceAssetStore.js';
 export interface DocumentPurgeSummary {
     total: number;
     purged: number;
@@ -7,8 +8,8 @@ export interface DocumentPurgeSummary {
 }
 export declare function purgeExpiredDocuments(params: {
     basePath: string;
-    taskDataDir: string;
     objectStorage: ResolvedObjectStorageConfig;
     now?: Date;
     assetStore?: TaskAssetStore;
+    workspaceAssetStore?: WorkspaceAssetStore;
 }): Promise<DocumentPurgeSummary>;

package/dist/storage/documentPurge.js

@@ -4,9 +4,23 @@ import { DocumentRegistry } from './documentRegistry.js';
 import { ObjectStorageClient } from './objectStorageClient.js';
 export async function purgeExpiredDocuments(params) {
     const registry = new DocumentRegistry(params.basePath);
-    const candidates = params.assetStore
-        ? params.assetStore.listPurgeCandidates(params.now || new Date())
-        : registry.listPurgeCandidates(params.now || new Date());
+    const now = params.now || new Date();
+    const canonicalCandidates = params.workspaceAssetStore
+        ? params.workspaceAssetStore.listPurgeCandidates(now)
+        : [];
+    const legacyCandidates = params.assetStore
+        ? params.assetStore.listPurgeCandidates(now)
+        : registry.listPurgeCandidates(now);
+    const mergedCandidates = new Map();
+    for (const entry of canonicalCandidates) {
+        mergedCandidates.set(`canonical:${entry.storageKey}`, entry);
+    }
+    for (const entry of legacyCandidates) {
+        if (!mergedCandidates.has(`canonical:${entry.path}`)) {
+            mergedCandidates.set(`legacy:${entry.path}`, entry);
+        }
+    }
+    const candidates = Array.from(mergedCandidates.values());
     const summary = {
         total: candidates.length,
         purged: 0,
@@ -17,11 +31,19 @@ export async function purgeExpiredDocuments(params) {
         : null;
     for (const entry of candidates) {
         try {
+            const storageKey = 'storageKey' in entry ? entry.storageKey : entry.path;
+            const workspaceId = entry?.workspaceId
+                ? String(entry.workspaceId)
+                : (() => {
+                    const normalized = String(storageKey || '').trim().replace(/\\/g, '/');
+                    const match = normalized.match(/^workspaces\/([^/]+)\//);
+                    return match?.[1] ? match[1] : 'default';
+                })();
             if (objectStorageClient) {
-                await objectStorageClient.deleteObject(entry.path);
+                await objectStorageClient.deleteObject(storageKey);
             }
             else {
-                const filePath = path.resolve(params.basePath, entry.path);
+                const filePath = path.resolve(params.basePath, storageKey);
                 const storageRoot = path.resolve(params.basePath);
                 const relative = path.relative(storageRoot, filePath);
                 const insideStorageRoot = !relative.startsWith('..') && !path.isAbsolute(relative);
@@ -30,11 +52,16 @@ export async function purgeExpiredDocuments(params) {
                 }
             }
             if (params.assetStore) {
-                const workspaceId = entry?.workspaceId ? String(entry.workspaceId) : undefined;
-                params.assetStore.remove(entry.path, workspaceId);
+                params.assetStore.remove(storageKey, workspaceId);
             }
             else {
-                registry.remove(entry.path);
+                registry.remove(storageKey);
+            }
+            if (params.workspaceAssetStore) {
+                const canonical = params.workspaceAssetStore.getByStorageKey(storageKey, workspaceId);
+                if (canonical) {
+                    params.workspaceAssetStore.remove(canonical.assetId, workspaceId);
+                }
             }
             summary.purged += 1;
         }

package/dist/storage/index.d.ts

@@ -0,0 +1,4 @@
+export type { DatabaseAdapter, DatabaseAdapterOptions, DatabaseStatement, DatabaseProvider } from './databaseAdapter.js';
+export { createDatabaseAdapter } from './createDatabaseAdapter.js';
+export { WorkspaceAssetStore } from './workspaceAssetStore.js';
+export type { WorkspaceAssetEntry, WorkspaceAssetKind, WorkspaceAssetLinkEntry, WorkspaceAssetLinkRole, WorkspaceAssetScanStatus } from './workspaceAssetStore.js';

package/dist/storage/index.js

@@ -0,0 +1,2 @@
+export { createDatabaseAdapter } from './createDatabaseAdapter.js';
+export { WorkspaceAssetStore } from './workspaceAssetStore.js';

package/dist/storage/objectStorage.d.ts

@@ -1,4 +1,4 @@
-export type ObjectStorageProvider = 'local' | 'r2';
+export type ObjectStorageProvider = 'local' | 'r2' | 'external';
 export interface R2ObjectStorageConfig {
     accountId: string;
     bucket: string;

package/dist/storage/objectStorageClient.d.ts

@@ -1,4 +1,4 @@
-import type { ResolvedObjectStorageConfig } from './objectStorage.js';
+import type { ObjectStorageProvider, ResolvedObjectStorageConfig } from './objectStorage.js';
 export interface StoredObject {
     body: Buffer;
     contentType: string;
@@ -6,13 +6,15 @@ export interface StoredObject {
 export declare class ObjectStorageClient {
     private readonly config;
     constructor(config: ResolvedObjectStorageConfig);
-    provider(): 'local' | 'r2';
+    provider(): ObjectStorageProvider;
     keyForRelativePath(relativePath: string): string;
     putObject(relativePath: string, body: Buffer, contentType: string): Promise<void>;
     getObject(relativePath: string): Promise<StoredObject | null>;
     objectExists(relativePath: string): Promise<boolean>;
     deleteObject(relativePath: string): Promise<boolean>;
-    createSignedGetUrl(relativePath: string, expiresInSeconds: number): string;
-    createSignedPutUrl(relativePath: string, expiresInSeconds: number): string;
+    createSignedGetUrl(relativePath: string, expiresInSeconds: number, opts?: {
+        responseContentDisposition?: string | null;
+    }): string;
+    createSignedPutUrl(relativePath: string, expiresInSeconds: number, contentType?: string): string;
 }
 export declare function normalizeTaskDataRelativePath(rawPath: string): string | null;

package/dist/storage/objectStorageClient.js

@@ -2,6 +2,8 @@ import { createHash, createHmac } from 'crypto';
 const AWS_ALGORITHM = 'AWS4-HMAC-SHA256';
 const AWS_SERVICE = 's3';
 const AWS_REGION = 'auto';
+const TRANSIENT_GET_OBJECT_STATUS_CODES = new Set([408, 425, 429, 500, 502, 503, 504]);
+const MAX_GET_OBJECT_ATTEMPTS = 3;
 function sha256Hex(value) {
     return createHash('sha256').update(value).digest('hex');
 }
@@ -56,6 +58,25 @@ function createAmzDate(now = new Date()) {
     const iso = now.toISOString();
     return iso.replace(/[:-]|\.\d{3}/g, '');
 }
+function shouldRetryGetObjectStatus(status) {
+    return TRANSIENT_GET_OBJECT_STATUS_CODES.has(status);
+}
+function shouldRetryGetObjectError(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const maybeError = error;
+    if (maybeError.name === 'AbortError' || maybeError.name === 'TimeoutError')
+        return true;
+    const message = String(maybeError.message || '').toLowerCase();
+    return message.includes('fetch failed')
+        || message.includes('network')
+        || message.includes('timed out')
+        || message.includes('timeout')
+        || message.includes('socket')
+        || message.includes('econnreset')
+        || message.includes('ecanceled')
+        || message.includes('und_err');
+}
 function signRequest(params) {
     const amzDate = createAmzDate(params.now);
     const dateStamp = toDateStamp(amzDate);
@@ -131,31 +152,50 @@ export class ObjectStorageClient {
         }
         const key = this.keyForRelativePath(relativePath);
         const url = new URL(`/${this.config.r2.bucket}/${key}`, this.config.r2.endpoint);
-        const payloadHash = sha256Hex('');
-        const signed = signRequest({
-            method: 'GET',
-            url,
-            accessKeyId: this.config.r2.accessKeyId,
-            secretAccessKey: this.config.r2.secretAccessKey,
-            payloadHash
-        });
-        const response = await fetch(url, {
-            method: 'GET',
-            headers: {
-                'authorization': signed.authorization,
-                'x-amz-date': signed.amzDate,
-                'x-amz-content-sha256': payloadHash
+        let lastError = null;
+        for (let attempt = 1; attempt <= MAX_GET_OBJECT_ATTEMPTS; attempt += 1) {
+            const payloadHash = sha256Hex('');
+            const signed = signRequest({
+                method: 'GET',
+                url,
+                accessKeyId: this.config.r2.accessKeyId,
+                secretAccessKey: this.config.r2.secretAccessKey,
+                payloadHash
+            });
+            try {
+                const response = await fetch(url, {
+                    method: 'GET',
+                    headers: {
+                        'authorization': signed.authorization,
+                        'x-amz-date': signed.amzDate,
+                        'x-amz-content-sha256': payloadHash
+                    }
+                });
+                if (response.status === 404)
+                    return null;
+                if (!response.ok) {
+                    const text = await response.text().catch(() => '');
+                    const error = new Error(`Failed to read object (${response.status}): ${text || response.statusText}`);
+                    if (attempt < MAX_GET_OBJECT_ATTEMPTS && shouldRetryGetObjectStatus(response.status)) {
+                        lastError = error;
+                        continue;
+                    }
+                    throw error;
+                }
+                const contentType = String(response.headers.get('content-type') || 'application/octet-stream');
+                const body = Buffer.from(await response.arrayBuffer());
+                return { body, contentType };
+            }
+            catch (error) {
+                const normalizedError = error instanceof Error ? error : new Error(String(error));
+                if (attempt < MAX_GET_OBJECT_ATTEMPTS && shouldRetryGetObjectError(normalizedError)) {
+                    lastError = normalizedError;
+                    continue;
+                }
+                throw normalizedError;
             }
-        });
-        if (response.status === 404)
-            return null;
-        if (!response.ok) {
-            const text = await response.text().catch(() => '');
-            throw new Error(`Failed to read object (${response.status}): ${text || response.statusText}`);
         }
-        const contentType = String(response.headers.get('content-type') || 'application/octet-stream');
-        const body = Buffer.from(await response.arrayBuffer());
-        return { body, contentType };
+        throw lastError || new Error('Failed to read object: unknown transient failure');
     }
     async objectExists(relativePath) {
         if (this.config.provider !== 'r2' || !this.config.r2) {
@@ -217,7 +257,7 @@ export class ObjectStorageClient {
         }
         return true;
     }
-    createSignedGetUrl(relativePath, expiresInSeconds) {
+    createSignedGetUrl(relativePath, expiresInSeconds, opts) {
         if (this.config.provider !== 'r2' || !this.config.r2) {
             throw new Error('R2 object storage is not configured.');
         }
@@ -232,6 +272,9 @@ export class ObjectStorageClient {
         url.searchParams.set('X-Amz-Date', amzDate);
         url.searchParams.set('X-Amz-Expires', String(ttl));
         url.searchParams.set('X-Amz-SignedHeaders', 'host');
+        if (typeof opts?.responseContentDisposition === 'string' && opts.responseContentDisposition.trim().length > 0) {
+            url.searchParams.set('response-content-disposition', opts.responseContentDisposition.trim());
+        }
         const canonicalUri = encodeUriPath(url.pathname);
         const canonicalQuery = buildCanonicalQuery(url.searchParams);
         const canonicalRequest = [
@@ -253,7 +296,7 @@ export class ObjectStorageClient {
         url.searchParams.set('X-Amz-Signature', signature);
         return url.toString();
     }
-    createSignedPutUrl(relativePath, expiresInSeconds) {
+    createSignedPutUrl(relativePath, expiresInSeconds, contentType) {
         if (this.config.provider !== 'r2' || !this.config.r2) {
             throw new Error('R2 object storage is not configured.');
         }
@@ -267,15 +310,20 @@ export class ObjectStorageClient {
         url.searchParams.set('X-Amz-Credential', `${this.config.r2.accessKeyId}/${credentialScope}`);
         url.searchParams.set('X-Amz-Date', amzDate);
         url.searchParams.set('X-Amz-Expires', String(ttl));
-        url.searchParams.set('X-Amz-SignedHeaders', 'host');
+        const normalizedContentType = String(contentType || '').trim();
+        const signedHeaders = normalizedContentType ? 'content-type;host' : 'host';
+        url.searchParams.set('X-Amz-SignedHeaders', signedHeaders);
         const canonicalUri = encodeUriPath(url.pathname);
         const canonicalQuery = buildCanonicalQuery(url.searchParams);
+        const canonicalHeaders = normalizedContentType
+            ? `content-type:${normalizedContentType}\nhost:${url.host}\n`
+            : `host:${url.host}\n`;
         const canonicalRequest = [
             'PUT',
             canonicalUri,
             canonicalQuery,
-            `host:${url.host}\n`,
-            'host',
+            canonicalHeaders,
+            signedHeaders,
             'UNSIGNED-PAYLOAD'
         ].join('\n');
         const stringToSign = [
@@ -294,7 +342,7 @@ export function normalizeTaskDataRelativePath(rawPath) {
     const normalized = normalizeRelativePath(rawPath);
     if (!normalized)
         return null;
-    const allowedRoots = ['task-data/', 'users/', 'workspaces/', 'system/', 'tmp/', 'quarantine/'];
+    const allowedRoots = ['users/', 'workspaces/', 'system/', 'tmp/', 'quarantine/'];
     if (!allowedRoots.some((root) => normalized.startsWith(root)))
         return null;
     return normalized;

package/dist/storage/objectStorageClient.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/storage/objectStorageClient.test.js

@@ -0,0 +1,57 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { ObjectStorageClient } from './objectStorageClient.js';
+const TEST_CONFIG = {
+    provider: 'r2',
+    r2: {
+        accountId: 'acct-1',
+        bucket: 'taskforce-dev-assets',
+        endpoint: 'https://acct-1.r2.cloudflarestorage.com',
+        accessKeyId: 'access-key-1',
+        secretAccessKey: 'secret-key-1',
+        keyPrefix: '',
+        signedUploadTtlSeconds: 600,
+        signedDownloadTtlSeconds: 300
+    }
+};
+describe('ObjectStorageClient.getObject', () => {
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.restoreAllMocks();
+    });
+    it('retries transient upstream failures before succeeding', async () => {
+        const fetchMock = vi.fn()
+            .mockResolvedValueOnce(new Response('bad gateway', { status: 502, statusText: 'Bad Gateway' }))
+            .mockResolvedValueOnce(new Response('hello world', {
+            status: 200,
+            headers: { 'content-type': 'text/markdown' }
+        }));
+        vi.stubGlobal('fetch', fetchMock);
+        const client = new ObjectStorageClient(TEST_CONFIG);
+        const result = await client.getObject('workspaces/workspace-1/assets/documents/doc-1.md');
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+        expect(result).not.toBeNull();
+        expect(result?.contentType).toBe('text/markdown');
+        expect(result?.body.toString('utf8')).toBe('hello world');
+    });
+    it('returns null immediately for 404 responses without retrying', async () => {
+        const fetchMock = vi.fn().mockResolvedValue(new Response('', { status: 404, statusText: 'Not Found' }));
+        vi.stubGlobal('fetch', fetchMock);
+        const client = new ObjectStorageClient(TEST_CONFIG);
+        const result = await client.getObject('workspaces/workspace-1/assets/documents/missing.md');
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(result).toBeNull();
+    });
+    it('retries thrown transient fetch errors before succeeding', async () => {
+        const fetchMock = vi.fn()
+            .mockRejectedValueOnce(new TypeError('fetch failed'))
+            .mockResolvedValueOnce(new Response('recovered', {
+            status: 200,
+            headers: { 'content-type': 'text/plain' }
+        }));
+        vi.stubGlobal('fetch', fetchMock);
+        const client = new ObjectStorageClient(TEST_CONFIG);
+        const result = await client.getObject('workspaces/workspace-1/assets/documents/doc-2.txt');
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+        expect(result?.body.toString('utf8')).toBe('recovered');
+    });
+});