@tuturuuu/utils 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.12.0](https://github.com/tutur3u/platform/compare/utils-v0.11.0...utils-v0.12.0) (2026-07-02)
+
+
+### Features
+
+* **infrastructure:** add abuse protection controls ([0e09692](https://github.com/tutur3u/platform/commit/0e09692a553cb10fbbb521e921951c2a6863281d))
+
+
+### Bug Fixes
+
+* **ci:** keep cache components enabled in production ([75e6e2b](https://github.com/tutur3u/platform/commit/75e6e2bbbf6fa432bc496ee95b75ade5f8847f9f))
+* **cli:** preserve markdown tables in task descriptions ([9faf8ba](https://github.com/tutur3u/platform/commit/9faf8ba44b92565a9dfc2949c496654fc1fea9b3))
+* **infrastructure:** default docker web to native builds ([7d89f00](https://github.com/tutur3u/platform/commit/7d89f004f75ab12eddc3cb92df5a1e6a7255fe0d))
+* **security:** limit auth recovery code attempts ([72d454c](https://github.com/tutur3u/platform/commit/72d454c507b0d4b7e69c7b38ad2099dbb83193b2))
+
+## [0.11.0](https://github.com/tutur3u/platform/compare/utils-v0.10.0...utils-v0.11.0) (2026-06-29)
+
+
+### Features
+
+* **infrastructure:** add rate-limit appeals ([f1e50e9](https://github.com/tutur3u/platform/commit/f1e50e9fd805dca6c80da8daab60ed24199f24ab))
+
 ## [0.10.0](https://github.com/tutur3u/platform/compare/utils-v0.9.0...utils-v0.10.0) (2026-06-26)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -19,12 +19,12 @@
     "@dnd-kit/core": "^6.3.1",
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
-    "@tanstack/react-query": "^5.101.1",
+    "@tanstack/react-query": "^5.101.2",
     "@tiptap/core": "3.27.1",
     "@tiptap/react": "3.27.1",
     "@tuturuuu/google": "0.0.2",
     "@tuturuuu/icons": "0.0.6",
-    "@tuturuuu/internal-api": "0.11.0",
+    "@tuturuuu/internal-api": "0.13.0",
     "@tuturuuu/supabase": "0.4.0",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
@@ -34,7 +34,7 @@
     "diff": "^9.0.0",
     "effect": "^3.21.4",
     "moment": "^2.30.1",
-    "next": "^16.2.9",
+    "next": "^16.3.0-preview.5",
     "prosemirror-model": "^1.25.9",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
@@ -45,14 +45,14 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.12.0",
+    "@tuturuuu/types": "0.13.1",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.0.1",
     "@types/react": "^19.2.17",
     "@vitejs/plugin-react": "^6.0.3",
     "typescript": "7.0.1-rc",
-    "vite": "^8.1.0",
+    "vite": "^8.1.2",
     "vitest": "^4.1.9"
   },
   "exports": {

package/src/__tests__/api-proxy-guard.test.ts

@@ -8,6 +8,7 @@ const mocks = vi.hoisted(() => ({
   redis: vi.fn(),
   extractIp: vi.fn(),
   isBlocked: vi.fn(),
+  readAbuseProtectionControls: vi.fn(),
   validateEmoji: vi.fn(),
   getTrustEntries: vi.fn(),
   hasAppealRelief: vi.fn(),
@@ -50,6 +51,7 @@ vi.mock('@upstash/redis', () => ({
 vi.mock('../abuse-protection/edge', () => ({
   extractIPFromRequest: (headers: Headers) => mocks.extractIp(headers),
   isIPBlockedEdge: (ip: string) => mocks.isBlocked(ip),
+  readEdgeAbuseProtectionControls: () => mocks.readAbuseProtectionControls(),
 }));
 
 vi.mock('../abuse-protection/edge-trust', () => ({
@@ -105,12 +107,19 @@ describe('guardApiProxyRequest', () => {
     mocks.redis.mockReset();
     mocks.extractIp.mockReset();
     mocks.isBlocked.mockReset();
+    mocks.readAbuseProtectionControls.mockReset();
     mocks.validateEmoji.mockReset();
     mocks.getTrustEntries.mockReset();
     mocks.hasAppealRelief.mockReset();
     // Default: no cached trust (untrusted). Tests opt in by overriding.
     mocks.getTrustEntries.mockResolvedValue(new Map<string, { m: number }>());
     mocks.hasAppealRelief.mockResolvedValue(false);
+    mocks.readAbuseProtectionControls.mockResolvedValue({
+      ipBlockingEnabled: true,
+      rateLimitsEnabled: true,
+      updatedAt: null,
+      updatedBy: null,
+    });
   });
 
   afterEach(() => {
@@ -177,6 +186,98 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.limit).not.toHaveBeenCalled();
   });
 
+  it('allows blocked IP traffic when IP blocking is disabled', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue({
+      expiresAt: new Date(Date.now() + 30_000),
+      reason: 'abuse',
+      blockLevel: 'temporary',
+    });
+    mocks.readAbuseProtectionControls.mockResolvedValue({
+      ipBlockingEnabled: false,
+      rateLimitsEnabled: true,
+      updatedAt: null,
+      updatedBy: null,
+    });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/test', 'POST'),
+      {
+        additionalRoutePolicies: [
+          {
+            key: 'ip-block-toggle-test',
+            matches: () => true,
+            rateLimits: { get: [], mutate: [] },
+          },
+        ],
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response).toBeNull();
+    expect(mocks.isBlocked).not.toHaveBeenCalled();
+    expect(mocks.limit).not.toHaveBeenCalled();
+    expect(mocks.validateEmoji).toHaveBeenCalled();
+  });
+
+  it('skips proxy route buckets when rate limits are disabled', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.readAbuseProtectionControls.mockResolvedValue({
+      ipBlockingEnabled: true,
+      rateLimitsEnabled: false,
+      updatedAt: null,
+      updatedBy: null,
+    });
+    mocks.limit.mockResolvedValue({
+      success: false,
+      limit: 1,
+      remaining: 0,
+      reset: Date.now() + 60_000,
+    });
+    mocks.validateEmoji.mockResolvedValue(null);
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/test', 'POST'),
+      {
+        additionalRoutePolicies: [
+          {
+            key: 'rate-limit-toggle-test',
+            matches: () => true,
+            rateLimits: {
+              get: [],
+              mutate: [
+                {
+                  duration: '1 m',
+                  limit: 1,
+                  window: 'minute',
+                },
+              ],
+            },
+          },
+        ],
+        prefixBase: 'proxy:test:api',
+      }
+    );
+
+    expect(response).toBeNull();
+    expect(mocks.isBlocked).toHaveBeenCalledWith('1.2.3.4');
+    expect(mocks.getTrustEntries).not.toHaveBeenCalled();
+    expect(mocks.limit).not.toHaveBeenCalled();
+    expect(mocks.validateEmoji).toHaveBeenCalled();
+  });
+
   it('allows a blocked IP to submit the rate-limit appeal endpoint only', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -1729,7 +1830,37 @@ describe('guardApiProxyRequest', () => {
     expect(response?.headers.get('X-RateLimit-Policy')).toBe('password-login');
   });
 
-  it('keeps password login, OTP send, and OTP verify on distinct limiter prefixes', async () => {
+  it('uses a separate recovery-code bucket for auth recovery consume', async () => {
+    vi.stubEnv('NODE_ENV', 'production');
+    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+    mocks.redis.mockReturnValue({});
+    mocks.extractIp.mockReturnValue('1.2.3.4');
+    mocks.isBlocked.mockResolvedValue(null);
+    mocks.limit.mockResolvedValueOnce({
+      success: false,
+      limit: 10,
+      remaining: 0,
+      reset: Date.now() + 15_000,
+    });
+
+    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+      await import('../api-proxy-guard.js');
+    clearApiProxyGuardLimiterCache();
+
+    const response = await guardApiProxyRequest(
+      makeRequest('/api/v1/auth/recovery/consume', 'POST'),
+      { prefixBase: 'proxy:test:api' }
+    );
+
+    expect(response?.status).toBe(429);
+    expect(response?.headers.get('X-RateLimit-Limit')).toBe('10');
+    expect(response?.headers.get('X-RateLimit-Policy')).toBe(
+      'auth-recovery-code'
+    );
+  });
+
+  it('keeps password login, OTP send, OTP verify, and recovery code on distinct limiter prefixes', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
@@ -1756,6 +1887,9 @@ describe('guardApiProxyRequest', () => {
     await guardApiProxyRequest(makeRequest('/api/v1/auth/otp/verify'), {
       prefixBase: 'proxy:test:api',
     });
+    await guardApiProxyRequest(makeRequest('/api/v1/auth/recovery/consume'), {
+      prefixBase: 'proxy:test:api',
+    });
 
     expect(mocks.ratelimitPrefixes).toContain(
       'proxy:test:api:password-login:anonymous:mutate:minute'
@@ -1766,6 +1900,9 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.ratelimitPrefixes).toContain(
       'proxy:test:api:otp-verify:anonymous:mutate:minute'
     );
+    expect(mocks.ratelimitPrefixes).toContain(
+      'proxy:test:api:auth-recovery-code:anonymous:mutate:minute'
+    );
     expect(mocks.ratelimitPrefixes).not.toContain(
       'proxy:test:api:auth:anonymous:mutate:minute'
     );

package/src/__tests__/task-description-codec.test.ts

@@ -1,3 +1,4 @@
+import type { JSONContent } from '@tiptap/core';
 import { describe, expect, it } from 'vitest';
 import {
   createTaskDescriptionPayload,
@@ -13,6 +14,28 @@ import {
   taskDescriptionYjsStateToBase64,
 } from '../task-description-codec';
 
+function findNode(
+  content: JSONContent | undefined,
+  type: string
+): JSONContent | undefined {
+  if (!content) return undefined;
+  if (content.type === type) return content;
+
+  for (const child of content.content ?? []) {
+    const match = findNode(child, type);
+    if (match) return match;
+  }
+}
+
+function cellTexts(row: JSONContent | undefined) {
+  return (row?.content ?? []).map((cell) =>
+    taskDescriptionPlainText({
+      content: cell.content ?? [],
+      type: 'doc',
+    })
+  );
+}
+
 describe('task description codec', () => {
   it('creates storage payloads from plain text', () => {
     const payload = createTaskDescriptionPayload(
@@ -52,6 +75,90 @@ describe('task description codec', () => {
     expect(plainText).toContain('const shipped = true;');
   });
 
+  it('parses GFM pipe tables into TipTap table nodes', () => {
+    const content = parseTaskDescriptionInput(
+      [
+        '| **Item** | Owner |',
+        '| :--- | ---: |',
+        '| API | [Sam](https://example.com) |',
+        '| CLI | `ttr` |',
+      ].join('\n'),
+      'markdown'
+    );
+    const table = findNode(content, 'table');
+    const rows = table?.content ?? [];
+
+    expect(table).toBeDefined();
+    expect(rows).toHaveLength(3);
+    expect(rows[0]?.content?.map((cell) => cell.type)).toEqual([
+      'tableHeader',
+      'tableHeader',
+    ]);
+    expect(cellTexts(rows[0])).toEqual(['Item', 'Owner']);
+    expect(cellTexts(rows[1])).toEqual(['API', 'Sam']);
+
+    const firstHeaderText = rows[0]?.content?.[0]?.content?.[0]?.content?.[0];
+    expect(firstHeaderText).toMatchObject({
+      marks: [expect.objectContaining({ type: 'bold' })],
+      text: 'Item',
+      type: 'text',
+    });
+  });
+
+  it('keeps escaped pipes inside markdown table cells', () => {
+    const content = parseTaskDescriptionInput(
+      ['Name | Notes', '--- | ---', 'API | Keep A\\|B together'].join('\n'),
+      'markdown'
+    );
+    const table = findNode(content, 'table');
+    const rows = table?.content ?? [];
+
+    expect(cellTexts(rows[1])).toEqual(['API', 'Keep A|B together']);
+  });
+
+  it('pads ragged markdown table rows into rectangular table rows', () => {
+    const content = parseTaskDescriptionInput(
+      [
+        '| A | B | C |',
+        '| --- | --- | --- |',
+        '| 1 | 2 |',
+        '| 3 | 4 | 5 | 6 |',
+      ].join('\n'),
+      'markdown'
+    );
+    const table = findNode(content, 'table');
+    const rows = table?.content ?? [];
+
+    expect(rows.map((row) => row.content?.length)).toEqual([4, 4, 4]);
+    expect(cellTexts(rows[1])).toEqual(['1', '2', '', '']);
+    expect(cellTexts(rows[2])).toEqual(['3', '4', '5', '6']);
+  });
+
+  it('keeps non-table pipe text as paragraph text', () => {
+    const content = parseTaskDescriptionInput(
+      ['This mentions A | B as text.', 'There is no delimiter row.'].join('\n'),
+      'markdown'
+    );
+
+    expect(findNode(content, 'table')).toBeUndefined();
+    expect(taskDescriptionPlainText(content)).toContain('A | B as text');
+  });
+
+  it('round-trips markdown tables through Yjs state', () => {
+    const payload = createTaskDescriptionPayload(
+      ['| Field | Value |', '| --- | --- |', '| Priority | High |'].join('\n'),
+      'markdown'
+    );
+    const decoded = decodeTaskDescriptionYjsState(
+      payload.description_yjs_state ?? []
+    );
+    const table = findNode(decoded, 'table');
+    const rows = table?.content ?? [];
+
+    expect(table).toBeDefined();
+    expect(cellTexts(rows[1])).toEqual(['Priority', 'High']);
+  });
+
   it('round-trips TipTap content through Yjs base64', () => {
     const content = parseTaskDescriptionInput(
       JSON.stringify({

package/src/abuse-protection/__tests__/edge.test.ts

@@ -15,7 +15,11 @@ vi.mock('../../upstash-rest', () => ({
 }));
 
 import {
+  blockIPEdge,
+  clearEdgeAbuseProtectionControlsCache,
+  EDGE_ABUSE_PROTECTION_CONTROLS_REDIS_KEY,
   extractIPFromRequest,
+  isIPBlockedEdge,
   recordMalformedAuthCookieEdge,
   recordSuspiciousApiRequestEdge,
 } from '../edge';
@@ -25,6 +29,7 @@ describe('abuse-protection edge', () => {
     vi.useFakeTimers();
     vi.setSystemTime(new Date());
     vi.clearAllMocks();
+    clearEdgeAbuseProtectionControlsCache();
     mocks.getRedis.mockResolvedValue(mocks.redis);
     mocks.redis.expire.mockResolvedValue(1);
     mocks.redis.get.mockResolvedValue(0);
@@ -61,6 +66,61 @@ describe('abuse-protection edge', () => {
     });
   });
 
+  describe('edge abuse protection controls', () => {
+    it('does not enforce cached IP blocks when IP blocking is disabled', async () => {
+      mocks.redis.get.mockImplementation((key: string) => {
+        if (key === EDGE_ABUSE_PROTECTION_CONTROLS_REDIS_KEY) {
+          return Promise.resolve(
+            JSON.stringify({
+              ipBlockingEnabled: false,
+              rateLimitsEnabled: true,
+            })
+          );
+        }
+
+        return Promise.resolve(
+          JSON.stringify({
+            id: 'block-1',
+            level: 2,
+            reason: 'api_abuse',
+            blockedAt: new Date().toISOString(),
+            expiresAt: new Date(Date.now() + 60_000).toISOString(),
+          })
+        );
+      });
+
+      const blockInfo = await isIPBlockedEdge('203.0.113.40');
+
+      expect(blockInfo).toBeNull();
+      expect(mocks.redis.get).toHaveBeenCalledWith(
+        EDGE_ABUSE_PROTECTION_CONTROLS_REDIS_KEY
+      );
+      expect(mocks.redis.get).not.toHaveBeenCalledWith(
+        'ip:blocked:203.0.113.40'
+      );
+    });
+
+    it('does not create edge IP blocks when IP blocking is disabled', async () => {
+      mocks.redis.get.mockImplementation((key: string) => {
+        if (key === EDGE_ABUSE_PROTECTION_CONTROLS_REDIS_KEY) {
+          return Promise.resolve(
+            JSON.stringify({
+              ipBlockingEnabled: false,
+              rateLimitsEnabled: true,
+            })
+          );
+        }
+
+        return Promise.resolve(0);
+      });
+
+      const blockInfo = await blockIPEdge('203.0.113.50', 'api_abuse');
+
+      expect(blockInfo).toBeNull();
+      expect(mocks.redis.set).not.toHaveBeenCalled();
+    });
+  });
+
   describe('recordMalformedAuthCookieEdge', () => {
     it('tracks malformed-cookie hits without blocking on the first offense', async () => {
       mocks.redis.incr.mockResolvedValueOnce(1);

package/src/abuse-protection/edge.ts

@@ -21,6 +21,38 @@ import type { BlockInfo } from './types';
 let edgeRedisClient: UpstashRestRedisClient | null = null;
 let edgeRedisInitialized = false;
 
+export const EDGE_ABUSE_PROTECTION_CONTROLS_REDIS_KEY =
+  'infrastructure:edge-abuse-protection-controls';
+
+const EDGE_ABUSE_PROTECTION_CONTROLS_CACHE_TTL_MS = 5_000;
+
+export interface EdgeAbuseProtectionControls {
+  ipBlockingEnabled: boolean;
+  rateLimitsEnabled: boolean;
+  updatedAt: string | null;
+  updatedBy: string | null;
+}
+
+export interface EdgeAbuseProtectionControlsPatch {
+  ipBlockingEnabled?: boolean;
+  rateLimitsEnabled?: boolean;
+  updatedAt?: string;
+  updatedBy?: string | null;
+}
+
+export const DEFAULT_EDGE_ABUSE_PROTECTION_CONTROLS: EdgeAbuseProtectionControls =
+  {
+    ipBlockingEnabled: true,
+    rateLimitsEnabled: true,
+    updatedAt: null,
+    updatedBy: null,
+  };
+
+let edgeAbuseProtectionControlsCache: {
+  expiresAt: number;
+  value: EdgeAbuseProtectionControls;
+} | null = null;
+
 function parsePositiveIntEnv(name: string, fallback: number): number {
   const rawValue = process.env[name];
   if (!rawValue) {
@@ -44,6 +76,111 @@ async function getEdgeRedisClient() {
   }
 }
 
+function normalizeEdgeAbuseProtectionControls(
+  value: unknown
+): EdgeAbuseProtectionControls {
+  let parsed = value;
+  if (typeof value === 'string') {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      parsed = null;
+    }
+  }
+
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return DEFAULT_EDGE_ABUSE_PROTECTION_CONTROLS;
+  }
+
+  const record = parsed as Record<string, unknown>;
+  return {
+    ipBlockingEnabled:
+      typeof record.ipBlockingEnabled === 'boolean'
+        ? record.ipBlockingEnabled
+        : DEFAULT_EDGE_ABUSE_PROTECTION_CONTROLS.ipBlockingEnabled,
+    rateLimitsEnabled:
+      typeof record.rateLimitsEnabled === 'boolean'
+        ? record.rateLimitsEnabled
+        : DEFAULT_EDGE_ABUSE_PROTECTION_CONTROLS.rateLimitsEnabled,
+    updatedAt:
+      typeof record.updatedAt === 'string' && record.updatedAt.trim()
+        ? record.updatedAt
+        : null,
+    updatedBy:
+      typeof record.updatedBy === 'string' && record.updatedBy.trim()
+        ? record.updatedBy
+        : null,
+  };
+}
+
+export function clearEdgeAbuseProtectionControlsCache() {
+  edgeAbuseProtectionControlsCache = null;
+}
+
+export async function readEdgeAbuseProtectionControls(options?: {
+  allowCache?: boolean;
+}): Promise<EdgeAbuseProtectionControls> {
+  const allowCache = options?.allowCache ?? true;
+  const now = Date.now();
+
+  if (
+    allowCache &&
+    edgeAbuseProtectionControlsCache &&
+    edgeAbuseProtectionControlsCache.expiresAt > now
+  ) {
+    return edgeAbuseProtectionControlsCache.value;
+  }
+
+  try {
+    const redis = await getEdgeRedisClient();
+    if (!redis) {
+      return DEFAULT_EDGE_ABUSE_PROTECTION_CONTROLS;
+    }
+
+    const stored = await redis.get<unknown>(
+      EDGE_ABUSE_PROTECTION_CONTROLS_REDIS_KEY
+    );
+    const controls = normalizeEdgeAbuseProtectionControls(stored);
+    edgeAbuseProtectionControlsCache = {
+      expiresAt: now + EDGE_ABUSE_PROTECTION_CONTROLS_CACHE_TTL_MS,
+      value: controls,
+    };
+
+    return controls;
+  } catch {
+    // Fail-open: keep the platform reachable when the controls store is down.
+    return DEFAULT_EDGE_ABUSE_PROTECTION_CONTROLS;
+  }
+}
+
+export async function writeEdgeAbuseProtectionControls(
+  patch: EdgeAbuseProtectionControlsPatch
+): Promise<EdgeAbuseProtectionControls> {
+  const redis = await getEdgeRedisClient();
+  if (!redis) {
+    throw new Error('Edge abuse protection controls store is unavailable');
+  }
+
+  const current = await readEdgeAbuseProtectionControls({ allowCache: false });
+  const next: EdgeAbuseProtectionControls = {
+    ipBlockingEnabled: patch.ipBlockingEnabled ?? current.ipBlockingEnabled,
+    rateLimitsEnabled: patch.rateLimitsEnabled ?? current.rateLimitsEnabled,
+    updatedAt: patch.updatedAt ?? new Date().toISOString(),
+    updatedBy: patch.updatedBy ?? null,
+  };
+
+  await redis.set(
+    EDGE_ABUSE_PROTECTION_CONTROLS_REDIS_KEY,
+    JSON.stringify(next)
+  );
+  edgeAbuseProtectionControlsCache = {
+    expiresAt: Date.now() + EDGE_ABUSE_PROTECTION_CONTROLS_CACHE_TTL_MS,
+    value: next,
+  };
+
+  return next;
+}
+
 /**
  * Check if an IP is blocked using Redis cache only (no DB fallback).
  * Designed for Edge Runtime where speed > completeness.
@@ -53,6 +190,9 @@ export async function isIPBlockedEdge(
   ipAddress: string
 ): Promise<BlockInfo | null> {
   try {
+    const controls = await readEdgeAbuseProtectionControls();
+    if (!controls.ipBlockingEnabled) return null;
+
     const redis = await getEdgeRedisClient();
     if (!redis) return null;
 
@@ -80,6 +220,9 @@ export async function blockIPEdge(
   reason: BlockInfo['reason']
 ): Promise<BlockInfo | null> {
   try {
+    const controls = await readEdgeAbuseProtectionControls();
+    if (!controls.ipBlockingEnabled) return null;
+
     const redis = await getEdgeRedisClient();
     if (!redis) return null;
 

package/src/api-proxy-guard.ts

@@ -1,7 +1,11 @@
 import { Ratelimit } from '@upstash/ratelimit';
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
-import { extractIPFromRequest, isIPBlockedEdge } from './abuse-protection/edge';
+import {
+  extractIPFromRequest,
+  isIPBlockedEdge,
+  readEdgeAbuseProtectionControls,
+} from './abuse-protection/edge';
 import {
   type CachedTrustEntry,
   getCachedTrustEntries,
@@ -257,6 +261,20 @@ const OTP_VERIFY_RATE_LIMITS: RateLimitProfile = {
   ],
 };
 
+const AUTH_RECOVERY_CODE_RATE_LIMITS: RateLimitProfile = {
+  get: NO_READ_RATE_LIMITS,
+  mutate: [
+    createConfig(
+      'minute',
+      '1 m',
+      10,
+      'API_PROXY_AUTH_RECOVERY_CODE_LIMIT_MINUTE'
+    ),
+    createConfig('hour', '1 h', 50, 'API_PROXY_AUTH_RECOVERY_CODE_LIMIT_HOUR'),
+    createConfig('day', '1 d', 120, 'API_PROXY_AUTH_RECOVERY_CODE_LIMIT_DAY'),
+  ],
+};
+
 const RATE_LIMIT_APPEAL_RATE_LIMITS: RateLimitProfile = {
   get: NO_READ_RATE_LIMITS,
   mutate: [
@@ -494,6 +512,12 @@ const DEFAULT_ROUTE_POLICIES: ProxyRoutePolicy[] = [
       /^\/api\/v1\/auth\/mobile\/verify-otp(?:\/|$)/.test(req.nextUrl.pathname),
     rateLimits: OTP_VERIFY_RATE_LIMITS,
   },
+  {
+    key: 'auth-recovery-code',
+    matches: (req) =>
+      /^\/api\/v1\/auth\/recovery\/consume(?:\/|$)/.test(req.nextUrl.pathname),
+    rateLimits: AUTH_RECOVERY_CODE_RATE_LIMITS,
+  },
   {
     key: 'cross-app-return',
     matches: (req) =>
@@ -1294,8 +1318,9 @@ export async function guardApiProxyRequest(
     const ip = extractIPFromRequest(req.headers);
     const identity = await resolveProxyIdentity(req, ip);
     const routePolicy = getRoutePolicy(req, routePolicies);
+    const abuseProtectionControls = await readEdgeAbuseProtectionControls();
 
-    if (ip !== 'unknown') {
+    if (abuseProtectionControls.ipBlockingEnabled && ip !== 'unknown') {
       const blockInfo = await isIPBlockedEdge(ip);
       if (blockInfo) {
         const hasTemporaryRelief =
@@ -1338,7 +1363,7 @@ export async function guardApiProxyRequest(
     // escape the shared IP bucket.
     let trustEntry: CachedTrustEntry | null = null;
     let sessionScoped = false;
-    if (edgeTrustEnabled()) {
+    if (abuseProtectionControls.rateLimitsEnabled && edgeTrustEnabled()) {
       const lookupKeys = [
         identity.sessionKey,
         ...(isRead
@@ -1373,7 +1398,7 @@ export async function guardApiProxyRequest(
         ? identity.sessionKey
         : identity.ipKey;
 
-    if (limiterId) {
+    if (abuseProtectionControls.rateLimitsEnabled && limiterId) {
       const effectiveCallerClass: CallerClass = sessionScoped
         ? 'authenticated'
         : callerClass;

package/src/next-config.test.ts

@@ -15,10 +15,14 @@ describe('createTuturuuuNextConfig', () => {
 
     expect(config.allowedDevOrigins).toContain('tuturuuu.localhost');
     expect(config.cacheComponents).toBe(true);
+    expect(config.partialPrefetching).toBe(true);
+    expect(config.experimental?.turbopackFileSystemCacheForBuild).toBe(true);
+    expect(config.experimental?.turbopackRustReactCompiler).toBe(true);
     expect(config.images?.remotePatterns).toEqual(
       TUTURUUU_NEXT_IMAGE_REMOTE_PATTERNS
     );
     expect(config.poweredByHeader).toBe(false);
+    expect(config.reactCompiler).toBe(true);
     expect(config.reactStrictMode).toBe(true);
     expect(config.typescript?.ignoreBuildErrors).toBe(true);
   });
@@ -95,10 +99,13 @@ describe('createTuturuuuNextConfig', () => {
   it('preserves app-specific config overrides', () => {
     const config = createTuturuuuNextConfig({
       cacheComponents: false,
-      reactCompiler: true,
+      partialPrefetching: false,
+      reactCompiler: false,
       transpilePackages: ['@tuturuuu/ui'],
       experimental: {
         cpus: 2,
+        turbopackFileSystemCacheForBuild: false,
+        turbopackRustReactCompiler: false,
       },
       typescript: {
         ignoreBuildErrors: false,
@@ -106,11 +113,43 @@ describe('createTuturuuuNextConfig', () => {
     });
 
     expect(config.cacheComponents).toBe(false);
+    expect(config.partialPrefetching).toBe(false);
     expect(config.reactCompiler).toBe(true);
     expect(config.transpilePackages).toEqual(['@tuturuuu/ui']);
     expect(config.experimental?.cpus).toBe(2);
+    expect(config.experimental?.turbopackFileSystemCacheForBuild).toBe(false);
+    expect(config.experimental?.turbopackRustReactCompiler).toBe(false);
     expect(config.typescript?.ignoreBuildErrors).toBe(false);
   });
+
+  it('keeps cache components enabled for all apps by default', () => {
+    const originalCacheComponents = process.env.TUTURUUU_NEXT_CACHE_COMPONENTS;
+
+    try {
+      process.env.TUTURUUU_NEXT_CACHE_COMPONENTS = '0';
+
+      const config = createTuturuuuNextConfig();
+
+      expect(config.cacheComponents).toBe(true);
+      expect(config.partialPrefetching).toBe(true);
+    } finally {
+      if (originalCacheComponents === undefined) {
+        delete process.env.TUTURUUU_NEXT_CACHE_COMPONENTS;
+      } else {
+        process.env.TUTURUUU_NEXT_CACHE_COMPONENTS = originalCacheComponents;
+      }
+    }
+  });
+
+  it('allows apps to explicitly override partial prefetching', () => {
+    const config = createTuturuuuNextConfig({
+      cacheComponents: true,
+      partialPrefetching: false,
+    });
+
+    expect(config.cacheComponents).toBe(true);
+    expect(config.partialPrefetching).toBe(false);
+  });
 });
 
 describe('isTuturuuuNextCacheComponentsEnabled', () => {
@@ -118,12 +157,12 @@ describe('isTuturuuuNextCacheComponentsEnabled', () => {
     expect(isTuturuuuNextCacheComponentsEnabled({})).toBe(true);
   });
 
-  it('honors explicit environment overrides', () => {
+  it('ignores deprecated environment opt-outs', () => {
     expect(
       isTuturuuuNextCacheComponentsEnabled({
         TUTURUUU_NEXT_CACHE_COMPONENTS: '0',
       })
-    ).toBe(false);
+    ).toBe(true);
     expect(
       isTuturuuuNextCacheComponentsEnabled({
         TUTURUUU_NEXT_CACHE_COMPONENTS: '1',
@@ -133,10 +172,10 @@ describe('isTuturuuuNextCacheComponentsEnabled', () => {
 });
 
 describe('isTuturuuuNextReactCompilerEnabled', () => {
-  it('disables React Compiler by default for next dev', () => {
+  it('keeps React Compiler enabled for next dev', () => {
     expect(
       isTuturuuuNextReactCompilerEnabled({ NODE_ENV: 'development' })
-    ).toBe(false);
+    ).toBe(true);
   });
 
   it('keeps React Compiler enabled by default outside next dev', () => {
@@ -145,13 +184,13 @@ describe('isTuturuuuNextReactCompilerEnabled', () => {
     );
   });
 
-  it('honors explicit environment overrides', () => {
+  it('ignores explicit environment opt-outs', () => {
     expect(
       isTuturuuuNextReactCompilerEnabled({
         NODE_ENV: 'production',
         TUTURUUU_NEXT_REACT_COMPILER: '0',
       })
-    ).toBe(false);
+    ).toBe(true);
     expect(
       isTuturuuuNextReactCompilerEnabled({
         NODE_ENV: 'development',

package/src/next-config.ts

@@ -33,9 +33,6 @@ export const TUTURUUU_NEXT_IMAGE_REMOTE_PATTERNS = [
   },
 ] satisfies NextImageRemotePattern[];
 
-const TRUTHY_ENV_VALUES = new Set(['1', 'true', 'yes', 'on']);
-const FALSY_ENV_VALUES = new Set(['0', 'false', 'no', 'off']);
-
 function mergeStringArrays(
   first: readonly string[] | undefined,
   second: readonly string[] | undefined
@@ -60,42 +57,16 @@ function mergeRemotePatterns(
   return Array.from(merged.values());
 }
 
-function readBooleanEnvOverride(value: string | undefined) {
-  const normalizedValue = value?.trim().toLowerCase();
-
-  if (!normalizedValue) {
-    return undefined;
-  }
-
-  if (TRUTHY_ENV_VALUES.has(normalizedValue)) {
-    return true;
-  }
-
-  if (FALSY_ENV_VALUES.has(normalizedValue)) {
-    return false;
-  }
-
-  return undefined;
-}
-
 export function isTuturuuuNextReactCompilerEnabled(
-  env: Environment = process.env
+  _env: Environment = process.env
 ) {
-  const override = readBooleanEnvOverride(env.TUTURUUU_NEXT_REACT_COMPILER);
-
-  if (override !== undefined) {
-    return override;
-  }
-
-  return env.NODE_ENV !== 'development';
+  return true;
 }
 
 export function isTuturuuuNextCacheComponentsEnabled(
-  env: Environment = process.env
+  _env: Environment = process.env
 ) {
-  const override = readBooleanEnvOverride(env.TUTURUUU_NEXT_CACHE_COMPONENTS);
-
-  return override ?? true;
+  return true;
 }
 
 export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
@@ -103,12 +74,13 @@ export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
   const imageConfig = config.images ?? {};
 
   return {
-    reactCompiler: isTuturuuuNextReactCompilerEnabled(),
     reactStrictMode: true,
     poweredByHeader: false,
     ...config,
+    reactCompiler: isTuturuuuNextReactCompilerEnabled(),
     cacheComponents:
       config.cacheComponents ?? isTuturuuuNextCacheComponentsEnabled(),
+    partialPrefetching: config.partialPrefetching ?? true,
     allowedDevOrigins: mergeStringArrays(
       getTuturuuuPortlessAllowedDevOrigins(),
       config.allowedDevOrigins
@@ -126,6 +98,10 @@ export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
     },
     experimental: {
       ...experimentalConfig,
+      turbopackFileSystemCacheForBuild:
+        experimentalConfig.turbopackFileSystemCacheForBuild ?? true,
+      turbopackRustReactCompiler:
+        experimentalConfig.turbopackRustReactCompiler ?? true,
       optimizePackageImports: mergeStringArrays(
         TUTURUUU_NEXT_OPTIMIZE_PACKAGE_IMPORTS,
         experimentalConfig.optimizePackageImports

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.14.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.16.0'); // x-release-please-version
   });
 
   it('normalizes generated metadata and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.14.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.16.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   builtAt?: string | null;

package/src/task-description-codec.ts

@@ -146,6 +146,134 @@ function isHorizontalRule(line: string) {
   return /^\s{0,3}(?:-{3,}|\*{3,}|_{3,})\s*$/u.test(line);
 }
 
+function splitMarkdownTableRow(line: string): string[] | null {
+  let trimmed = line.trim();
+  if (!trimmed) return null;
+
+  const hasOuterPipe = trimmed.startsWith('|') || trimmed.endsWith('|');
+  if (trimmed.startsWith('|')) trimmed = trimmed.slice(1);
+  if (trimmed.endsWith('|')) trimmed = trimmed.slice(0, -1);
+
+  const cells: string[] = [];
+  let cell = '';
+  let foundSeparator = false;
+
+  for (let index = 0; index < trimmed.length; index += 1) {
+    const character = trimmed[index];
+    const nextCharacter = trimmed[index + 1];
+
+    if (character === '\\' && nextCharacter === '|') {
+      cell += '|';
+      index += 1;
+      continue;
+    }
+
+    if (character === '|') {
+      cells.push(cell.trim());
+      cell = '';
+      foundSeparator = true;
+      continue;
+    }
+
+    cell += character;
+  }
+
+  cells.push(cell.trim());
+
+  if (!(hasOuterPipe || foundSeparator)) return null;
+  return cells;
+}
+
+function isMarkdownTableDelimiterCell(cell: string) {
+  return /^:?-{3,}:?$/u.test(cell.trim());
+}
+
+function getMarkdownTableDelimiterCells(line: string) {
+  const cells = splitMarkdownTableRow(line);
+  if (!cells || cells.length === 0) return null;
+  return cells.every(isMarkdownTableDelimiterCell) ? cells : null;
+}
+
+function isMarkdownTableStart(lines: string[], index: number) {
+  const headerCells = splitMarkdownTableRow(lines[index] ?? '');
+  const delimiterCells = getMarkdownTableDelimiterCells(lines[index + 1] ?? '');
+
+  return Boolean(
+    headerCells &&
+      headerCells.length > 0 &&
+      delimiterCells &&
+      delimiterCells.length === headerCells.length
+  );
+}
+
+function tableCellFromText(
+  text: string,
+  type: 'tableCell' | 'tableHeader'
+): JSONContent {
+  return {
+    attrs: { colspan: 1, rowspan: 1, colwidth: null },
+    content: [paragraphFromText(text, true)],
+    type,
+  };
+}
+
+function padTableRow(cells: string[], columnCount: number) {
+  return Array.from({ length: columnCount }, (_, index) => cells[index] ?? '');
+}
+
+function parseMarkdownTable(
+  lines: string[],
+  startIndex: number
+): { block: JSONContent; endIndex: number } | null {
+  const headerCells = splitMarkdownTableRow(lines[startIndex] ?? '');
+  const delimiterCells = getMarkdownTableDelimiterCells(
+    lines[startIndex + 1] ?? ''
+  );
+
+  if (!headerCells || !delimiterCells) return null;
+  if (delimiterCells.length !== headerCells.length) return null;
+
+  const bodyRows: string[][] = [];
+  let index = startIndex + 2;
+
+  while (index < lines.length) {
+    const line = lines[index] ?? '';
+    if (!line.trim() || isBlockStart(line)) break;
+
+    const rowCells = splitMarkdownTableRow(line);
+    if (!rowCells) break;
+    bodyRows.push(rowCells);
+    index += 1;
+  }
+
+  const columnCount = Math.max(
+    headerCells.length,
+    delimiterCells.length,
+    ...bodyRows.map((row) => row.length)
+  );
+
+  return {
+    block: {
+      content: [
+        {
+          content: padTableRow(headerCells, columnCount).map((cell) =>
+            tableCellFromText(cell, 'tableHeader')
+          ),
+          type: 'tableRow',
+        },
+        ...bodyRows.map((row) => ({
+          content: padTableRow(row, columnCount).map((cell) =>
+            tableCellFromText(cell, 'tableCell')
+          ),
+          type: 'tableRow',
+        })),
+      ],
+      type: 'table',
+    },
+    endIndex: index,
+  };
+}
+
 function getListLine(line: string):
   | {
       checked?: boolean;
@@ -288,12 +416,22 @@ function parseMarkdownBlocks(markdown: string): JSONContent[] {
       continue;
     }
 
+    if (isMarkdownTableStart(lines, index)) {
+      const table = parseMarkdownTable(lines, index);
+      if (table) {
+        blocks.push(table.block);
+        index = table.endIndex;
+        continue;
+      }
+    }
+
     const paragraphLines = [line];
     index += 1;
     while (
       index < lines.length &&
       (lines[index] ?? '').trim() &&
-      !isBlockStart(lines[index] ?? '')
+      !isBlockStart(lines[index] ?? '') &&
+      !isMarkdownTableStart(lines, index)
     ) {
       paragraphLines.push(lines[index] ?? '');
       index += 1;