@tuturuuu/utils 0.15.1 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## [0.17.0](https://github.com/tutur3u/platform/compare/utils-v0.16.0...utils-v0.17.0) (2026-07-21)
+
+
+### Features
+
+* **infrastructure:** manage internal accounts ([02fd9f3](https://github.com/tutur3u/platform/commit/02fd9f3d1b4edb23c881e2dbb04bf244b36e6ed0))
+
+
+### Bug Fixes
+
+* **chat:** harden personal Zalo integration ([f1d12c6](https://github.com/tutur3u/platform/commit/f1d12c60fe12ab3b01a1be3f0381573d44a32226))
+* **ci:** keep task helper collection source-only ([7355a05](https://github.com/tutur3u/platform/commit/7355a05385ccd8d1e2d1bcf6ac15ae5297e057ad))
+* **e2e:** run tasks lifecycle in CI ([bed2cd5](https://github.com/tutur3u/platform/commit/bed2cd590572748f65e75fcb15b7e4b714b9034c))
+* **inventory:** harden sales analytics and access ([53968d3](https://github.com/tutur3u/platform/commit/53968d38a0c5425a3c1065ab2f645e30a0145c8f))
+* resolve code quality findings ([63f10b5](https://github.com/tutur3u/platform/commit/63f10b5ec22a4194f48f448ee2b1b088b5da8f08))
+* **security:** remediate code scanning findings ([023db2e](https://github.com/tutur3u/platform/commit/023db2edf4b0557be108a9d772cbc7e2223af947))
+
+
+### Performance Improvements
+
+* **storefront:** share customer navigation shell ([21cb78d](https://github.com/tutur3u/platform/commit/21cb78db484d1e1fdb9f2469fcac4e3a948bd176))
+
+## [0.16.0](https://github.com/tutur3u/platform/compare/utils-v0.15.1...utils-v0.16.0) (2026-07-18)
+
+
+### Features
+
+* **seo:** improve discovery metadata ([a574409](https://github.com/tutur3u/platform/commit/a57440984df45086c4989db07b02d402dd93c828))
+* **seo:** improve discovery metadata ([8e2420d](https://github.com/tutur3u/platform/commit/8e2420d49e7b94c462d92222ea8f239ab92564f6))
+* **seo:** improve page metadata ([0c621cb](https://github.com/tutur3u/platform/commit/0c621cb7fc1253b0a11ea21992503274052c6be0))
+* **seo:** standardize app metadata ([6523d91](https://github.com/tutur3u/platform/commit/6523d91fedf38e19804d10ea3b82890db180bc6f))
+
+
+### Bug Fixes
+
+* **mobile:** preserve bearer auth across satellites ([f890170](https://github.com/tutur3u/platform/commit/f89017044cf3aaaa6a1b15c31c64a81d75cfdab2))
+
 ## [0.15.1](https://github.com/tutur3u/platform/compare/utils-v0.15.0...utils-v0.15.1) (2026-07-13)
 
 

package/biome.json

@@ -1,5 +1,5 @@
 {
   "root": false,
-  "$schema": "https://biomejs.dev/schemas/2.5.3/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.4/schema.json",
   "extends": "//"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -20,21 +20,21 @@
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
     "@tanstack/react-query": "^5.101.2",
-    "@tiptap/core": "3.27.3",
-    "@tiptap/react": "3.27.3",
+    "@tiptap/core": "3.28.0",
+    "@tiptap/react": "3.28.0",
     "@tuturuuu/google": "0.0.3",
     "@tuturuuu/icons": "0.0.6",
-    "@tuturuuu/internal-api": "0.18.0",
-    "@tuturuuu/supabase": "0.4.0",
+    "@tuturuuu/internal-api": "0.20.0",
+    "@tuturuuu/supabase": "0.4.1",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.0",
     "clsx": "^2.1.1",
     "date-fns": "^4.4.0",
     "dayjs": "^1.11.20",
     "diff": "^9.0.0",
-    "effect": "^3.21.4",
+    "effect": "^3.22.0",
     "moment": "^2.30.1",
-    "next": "^16.3.0-preview.5",
+    "next": "^16.3.0-preview.6",
     "prosemirror-model": "^1.25.11",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
@@ -45,14 +45,14 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.17.0",
+    "@tuturuuu/types": "0.19.0",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
     "@types/node": "^26.1.1",
     "@types/react": "^19.2.17",
     "@vitejs/plugin-react": "^6.0.3",
     "typescript": "7.0.2",
-    "vite": "^8.1.4",
+    "vite": "^8.1.5",
     "vitest": "^4.1.10"
   },
   "exports": {
@@ -60,8 +60,10 @@
     "./effect": "./src/effect.ts",
     "./email/validation": "./src/email/validation.ts",
     "./hooks/*": "./src/hooks/*.ts",
+    "./task-helper/personal-external-staging": "./src/task-helper/personal-external-staging.ts",
     "./*": "./src/*.ts",
     "./common/scan": "./src/common/scan.tsx",
+    "./common/metadata": "./src/common/metadata.ts",
     "./common/nextjs": "./src/common/nextjs.tsx",
     "./permissions": "./src/permissions.tsx",
     "./editor": "./src/editor/index.ts",

package/src/__tests__/api-proxy-guard.test.ts

@@ -1663,6 +1663,23 @@ describe('guardApiProxyRequest', () => {
     ).toBe(false);
   });
 
+  it('detects bearer credentials that route handlers can authenticate', async () => {
+    const { hasAuthenticatedBearerToken } = await import(
+      '../api-proxy-guard.js'
+    );
+
+    expect(
+      hasAuthenticatedBearerToken(
+        new Headers({ authorization: 'Bearer header.payload.signature' })
+      )
+    ).toBe(true);
+    expect(
+      hasAuthenticatedBearerToken(
+        new Headers({ authorization: 'Bearer malformed-token' })
+      )
+    ).toBe(false);
+  });
+
   it('enforces anonymous IP blocks for cookie-looking browser requests', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
@@ -1735,35 +1752,35 @@ describe('guardApiProxyRequest', () => {
     );
   });
 
-  it.each([
-    '/api/v1/auth/otp/send',
-    '/api/v1/auth/mobile/send-otp',
-  ])('uses a classroom-friendly OTP send bucket for %s', async (path) => {
-    vi.stubEnv('NODE_ENV', 'production');
-    vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
-    vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
-    mocks.redis.mockReturnValue({});
-    mocks.extractIp.mockReturnValue('1.2.3.4');
-    mocks.isBlocked.mockResolvedValue(null);
-    mocks.limit.mockResolvedValueOnce({
-      success: false,
-      limit: 30,
-      remaining: 0,
-      reset: Date.now() + 15_000,
-    });
+  it.each(['/api/v1/auth/otp/send', '/api/v1/auth/mobile/send-otp'])(
+    'uses a classroom-friendly OTP send bucket for %s',
+    async (path) => {
+      vi.stubEnv('NODE_ENV', 'production');
+      vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
+      vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
+      mocks.redis.mockReturnValue({});
+      mocks.extractIp.mockReturnValue('1.2.3.4');
+      mocks.isBlocked.mockResolvedValue(null);
+      mocks.limit.mockResolvedValueOnce({
+        success: false,
+        limit: 30,
+        remaining: 0,
+        reset: Date.now() + 15_000,
+      });
 
-    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
-      await import('../api-proxy-guard.js');
-    clearApiProxyGuardLimiterCache();
+      const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
+        await import('../api-proxy-guard.js');
+      clearApiProxyGuardLimiterCache();
 
-    const response = await guardApiProxyRequest(makeRequest(path, 'POST'), {
-      prefixBase: 'proxy:test:api',
-    });
+      const response = await guardApiProxyRequest(makeRequest(path, 'POST'), {
+        prefixBase: 'proxy:test:api',
+      });
 
-    expect(response?.status).toBe(429);
-    expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
-    expect(response?.headers.get('X-RateLimit-Policy')).toBe('otp-send');
-  });
+      expect(response?.status).toBe(429);
+      expect(response?.headers.get('X-RateLimit-Limit')).toBe('30');
+      expect(response?.headers.get('X-RateLimit-Policy')).toBe('otp-send');
+    }
+  );
 
   it('uses a classroom-friendly bucket for cross-app return handoffs', async () => {
     vi.stubEnv('NODE_ENV', 'production');

package/src/__tests__/permissions.test.tsx

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { describe, expect, it } from 'vitest';
+import { ROOT_WORKSPACE_ID } from '../constants';
 import { permissions } from '../permissions';
 
 describe('workspace permission catalog', () => {
@@ -30,9 +31,39 @@ describe('workspace permission catalog', () => {
     expect(permissionIds).toContain('admin');
     expect(permissionIds).not.toContain('view_infrastructure');
     expect(permissionIds).not.toContain('manage_infrastructure_stress_tests');
+    expect(permissionIds).not.toContain('manage_internal_accounts');
     expect(permissionIds).not.toContain('manage_workspace_secrets');
   });
 
+  it('exposes internal account management only in the root workspace', () => {
+    const rootPermissionIds = permissions({
+      wsId: ROOT_WORKSPACE_ID,
+      user: null,
+    }).map((permission) => permission.id);
+
+    expect(rootPermissionIds).toContain('manage_internal_accounts');
+  });
+
+  it('keeps internal account permission translations in shared role editors', () => {
+    for (const app of ['cms', 'infrastructure', 'inventory', 'web']) {
+      for (const locale of ['en', 'vi']) {
+        const messages = JSON.parse(
+          readFileSync(
+            resolve(repoRoot, `apps/${app}/messages/${locale}.json`),
+            'utf8'
+          )
+        ) as { 'ws-roles': Record<string, string> };
+
+        expect(
+          messages['ws-roles'].manage_internal_accounts?.length
+        ).toBeGreaterThan(0);
+        expect(
+          messages['ws-roles'].manage_internal_accounts_description?.length
+        ).toBeGreaterThan(0);
+      }
+    }
+  });
+
   it('exposes the full shared catalog for typed defaults', () => {
     const permissionIds = permissions({
       catalog: 'full',
@@ -43,6 +74,7 @@ describe('workspace permission catalog', () => {
     expect(permissionIds).toContain('admin');
     expect(permissionIds).toContain('view_infrastructure');
     expect(permissionIds).toContain('manage_infrastructure_stress_tests');
+    expect(permissionIds).toContain('manage_internal_accounts');
     expect(permissionIds).toContain('manage_external_migrations');
     expect(permissionIds).toContain('manage_workspace_secrets');
     expect(new Set(permissionIds).size).toBe(permissionIds.length);

package/src/__tests__/workspace-helper.test.ts

@@ -578,7 +578,7 @@ describe('getPermissions membership type gate', () => {
     );
   });
 
-  it('returns null when caller membership is GUEST without enabled guest defaults', async () => {
+  it('returns a read-only permission context for a guest without defaults', async () => {
     const membershipQuery = {
       select: vi.fn(),
       eq: vi.fn(),
@@ -656,7 +656,14 @@ describe('getPermissions membership type gate', () => {
       wsId: '11111111-1111-4111-8111-111111111111',
     });
 
-    expect(permissions).toBeNull();
+    expect(permissions).toMatchObject({
+      membershipType: 'GUEST',
+      permissions: [],
+      wsId: '11111111-1111-4111-8111-111111111111',
+    });
+    expect(permissions?.containsPermission('manage_workspace_settings')).toBe(
+      false
+    );
     expect(defaultPermissionsQuery.eq).toHaveBeenCalledWith(
       'member_type',
       'GUEST'

package/src/api-proxy-guard.ts

@@ -763,7 +763,7 @@ function looksLikeWorkspaceApiKey(token: string): boolean {
   return /^ttr_[A-Za-z0-9_-]+$/.test(token);
 }
 
-function hasAuthenticatedBearerToken(headers: Headers): boolean {
+export function hasAuthenticatedBearerToken(headers: Headers): boolean {
   const authHeader = headers.get('authorization');
   if (!authHeader) {
     return false;

package/src/common/metadata.test.ts

@@ -0,0 +1,334 @@
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import {
+  createCommonMetadata,
+  createPageMetadata,
+  NO_INDEX_ROBOTS,
+} from './metadata';
+
+const repoRoot = resolve(__dirname, '../../../..');
+
+const config = {
+  description: {
+    en: 'English product description.',
+    vi: 'Mo ta san pham bang tieng Viet.',
+  },
+  indexable: true,
+  keywords: ['team collaboration', 'workflow automation'],
+  name: 'Tuturuuu Test',
+  url: 'https://test.tuturuuu.com',
+};
+
+describe('createCommonMetadata', () => {
+  it('builds localized, indexable product metadata', () => {
+    const metadata = createCommonMetadata({ config, locale: 'vi' });
+
+    expect(metadata.description).toBe('Mo ta san pham bang tieng Viet.');
+    expect(metadata.metadataBase?.toString()).toBe(
+      'https://test.tuturuuu.com/'
+    );
+    expect(metadata.keywords).toEqual([
+      'Tuturuuu Test',
+      'Tuturuuu',
+      'team collaboration',
+      'workflow automation',
+    ]);
+    expect(metadata.robots).toMatchObject({
+      follow: true,
+      index: true,
+    });
+    expect(metadata.openGraph).toMatchObject({
+      alternateLocale: ['en_US'],
+      description: 'Mo ta san pham bang tieng Viet.',
+      locale: 'vi_VN',
+      siteName: 'Tuturuuu Test',
+      title: 'Tuturuuu Test',
+    });
+    expect(metadata.twitter).toMatchObject({
+      card: 'summary_large_image',
+      creator: '@tuturuuu',
+      site: '@tuturuuu',
+    });
+  });
+
+  it('uses valid shared brand assets without advertising a missing manifest', () => {
+    const metadata = createCommonMetadata({ config, locale: 'en' });
+
+    expect(metadata.icons).toEqual({
+      apple: 'https://tuturuuu.com/apple-touch-icon.png',
+      icon: 'https://tuturuuu.com/favicon.ico',
+      shortcut: 'https://tuturuuu.com/favicon-16x16.png',
+    });
+    expect(metadata.manifest).toBeUndefined();
+    expect(metadata.openGraph).toMatchObject({
+      images: [
+        {
+          alt: 'Tuturuuu Test preview',
+          height: 630,
+          url: 'https://tuturuuu.com/media/logos/og-image.jpg',
+          width: 1200,
+        },
+      ],
+      locale: 'en_US',
+    });
+  });
+
+  it('prevents private application surfaces from being indexed', () => {
+    const metadata = createCommonMetadata({
+      config: {
+        ...config,
+        indexable: false,
+      },
+      locale: 'en',
+    });
+
+    expect(metadata.robots).toEqual({
+      follow: false,
+      googleBot: {
+        follow: false,
+        index: false,
+      },
+      index: false,
+    });
+  });
+
+  it('includes a manifest only when the application declares one', () => {
+    const metadata = createCommonMetadata({
+      config: {
+        ...config,
+        manifest: '/manifest.webmanifest',
+      },
+      locale: 'en',
+    });
+
+    expect(metadata.manifest).toBe('/manifest.webmanifest');
+  });
+});
+
+describe('createPageMetadata', () => {
+  it('builds canonical, hreflang, and social metadata for a localized page', () => {
+    const metadata = createPageMetadata({
+      baseUrl: 'https://test.tuturuuu.com',
+      description: 'Plan and automate team workflows.',
+      image: '/media/workflows-og.png',
+      locale: 'vi',
+      pathname: '/products/workflows',
+      title: 'Workflow Automation',
+    });
+
+    expect(metadata.alternates).toEqual({
+      canonical: 'https://test.tuturuuu.com/vi/products/workflows',
+      languages: {
+        'en-US': 'https://test.tuturuuu.com/products/workflows',
+        'vi-VN': 'https://test.tuturuuu.com/vi/products/workflows',
+        'x-default': 'https://test.tuturuuu.com/products/workflows',
+      },
+    });
+    expect(metadata.openGraph).toMatchObject({
+      alternateLocale: ['en_US'],
+      description: 'Plan and automate team workflows.',
+      locale: 'vi_VN',
+      siteName: 'Tuturuuu',
+      title: 'Workflow Automation',
+      url: 'https://test.tuturuuu.com/vi/products/workflows',
+      images: [
+        {
+          alt: 'Workflow Automation',
+          height: 630,
+          url: 'https://test.tuturuuu.com/media/workflows-og.png',
+          width: 1200,
+        },
+      ],
+    });
+    expect(metadata.twitter).toMatchObject({
+      card: 'summary_large_image',
+      creator: '@tuturuuu',
+      site: '@tuturuuu',
+      title: 'Workflow Automation',
+    });
+  });
+
+  it('does not override inherited robots unless page indexing is explicit', () => {
+    const baseConfig = {
+      baseUrl: 'https://test.tuturuuu.com',
+      description: 'Private workspace page.',
+      locale: 'en',
+      pathname: '/workspace',
+      title: 'Workspace',
+    };
+
+    expect(createPageMetadata(baseConfig).robots).toBeUndefined();
+    expect(
+      createPageMetadata({ ...baseConfig, indexable: false }).robots
+    ).toEqual(NO_INDEX_ROBOTS);
+  });
+
+  it('uses the unprefixed English URL configured by the public router', () => {
+    const metadata = createPageMetadata({
+      baseUrl: 'https://test.tuturuuu.com',
+      description: 'The main product landing page.',
+      locale: 'en',
+      pathname: '/',
+      title: 'Tuturuuu',
+    });
+
+    expect(metadata.alternates).toEqual({
+      canonical: 'https://test.tuturuuu.com/',
+      languages: {
+        'en-US': 'https://test.tuturuuu.com/',
+        'vi-VN': 'https://test.tuturuuu.com/vi',
+        'x-default': 'https://test.tuturuuu.com/',
+      },
+    });
+  });
+
+  it('normalizes long runs of boundary slashes in linear time', () => {
+    const boundary = '/'.repeat(20_000);
+    const metadata = createPageMetadata({
+      baseUrl: 'https://test.tuturuuu.com',
+      description: 'Stable metadata path normalization.',
+      locale: 'en',
+      pathname: `${boundary}products/workflows${boundary}`,
+      title: 'Workflow Automation',
+    });
+
+    expect(metadata.alternates?.canonical).toBe(
+      'https://test.tuturuuu.com/products/workflows'
+    );
+  });
+
+  it('supports apps that never expose locale prefixes', () => {
+    const metadata = createPageMetadata({
+      baseUrl: 'https://tools.tuturuuu.com',
+      description: 'Localized tools on one stable URL.',
+      locale: 'vi',
+      localePrefix: 'never',
+      pathname: '/qr',
+      title: 'QR Code Generator',
+    });
+
+    expect(metadata.alternates).toEqual({
+      canonical: 'https://tools.tuturuuu.com/qr',
+    });
+    expect(metadata.openGraph).toMatchObject({
+      locale: 'vi_VN',
+      url: 'https://tools.tuturuuu.com/qr',
+    });
+  });
+
+  it('supports apps that always expose locale prefixes', () => {
+    const metadata = createPageMetadata({
+      baseUrl: 'https://example.tuturuuu.com',
+      description: 'A prefixed localized page.',
+      locale: 'en',
+      localePrefix: 'always',
+      pathname: '/about',
+      title: 'About',
+    });
+
+    expect(metadata.alternates).toMatchObject({
+      canonical: 'https://example.tuturuuu.com/en/about',
+      languages: {
+        'en-US': 'https://example.tuturuuu.com/en/about',
+        'vi-VN': 'https://example.tuturuuu.com/vi/about',
+      },
+    });
+  });
+});
+
+describe('application metadata coverage', () => {
+  it('keeps every Next.js application on the shared metadata contract', () => {
+    const appsDirectory = resolve(repoRoot, 'apps');
+    const nextApps = readdirSync(appsDirectory, { withFileTypes: true })
+      .filter(
+        (entry) =>
+          entry.isDirectory() &&
+          existsSync(resolve(appsDirectory, entry.name, 'next.config.ts'))
+      )
+      .map((entry) => entry.name)
+      .sort();
+
+    expect(nextApps.length).toBeGreaterThan(0);
+
+    for (const app of nextApps) {
+      const appDirectory = resolve(appsDirectory, app, 'src/app');
+      const localizedLayout = resolve(appDirectory, '[locale]/layout.tsx');
+      const rootLayout = resolve(appDirectory, 'layout.tsx');
+      const layoutPath = existsSync(localizedLayout)
+        ? localizedLayout
+        : rootLayout;
+
+      expect(existsSync(layoutPath), `${app} is missing a root layout`).toBe(
+        true
+      );
+      expect(
+        readFileSync(layoutPath, 'utf8'),
+        `${app} is not using the shared metadata contract`
+      ).toMatch(/(?:create|generate)CommonMetadata/);
+    }
+  });
+
+  it('covers the non-Next public application shells', () => {
+    const tanStackHead = readFileSync(
+      resolve(repoRoot, 'apps/tanstack-web/src/lib/platform/app-shell.ts'),
+      'utf8'
+    );
+    const mobileHead = readFileSync(
+      resolve(repoRoot, 'apps/mobile/web/index.html'),
+      'utf8'
+    );
+    const docsConfig = JSON.parse(
+      readFileSync(resolve(repoRoot, 'apps/docs/docs.json'), 'utf8')
+    ) as { description?: string };
+
+    expect(tanStackHead).toContain('max-image-preview:large');
+    expect(tanStackHead).toContain("name: 'twitter:site'");
+    expect(mobileHead).toContain('name="robots" content="noindex, nofollow"');
+    expect(mobileHead).toContain('property="og:image"');
+    expect(docsConfig.description).toMatch(/Tuturuuu platform/);
+  });
+
+  it('keeps SEO-critical public routes on page-specific metadata', () => {
+    const routeFiles = [
+      'apps/apps/src/app/[locale]/page.tsx',
+      'apps/learn/src/app/[locale]/page.tsx',
+      'apps/teach/src/app/[locale]/page.tsx',
+      'apps/tools/src/app/[locale]/page.tsx',
+      'apps/tools/src/app/[locale]/qr/page.tsx',
+      'apps/tools/src/app/[locale]/random/page.tsx',
+      'apps/storefront/src/app/[locale]/[storeSlug]/(shop)/page.tsx',
+      'apps/storefront/src/app/[locale]/[storeSlug]/(shop)/products/[listingId]/page.tsx',
+      'apps/nova/src/app/[locale]/(marketing)/layout.tsx',
+      'apps/nova/src/app/[locale]/(marketing)/learn/layout.tsx',
+    ];
+
+    for (const routeFile of routeFiles) {
+      const source = readFileSync(resolve(repoRoot, routeFile), 'utf8');
+
+      expect(
+        source,
+        `${routeFile} is missing page-specific SEO metadata`
+      ).toMatch(/create(?:Page|NovaPage)Metadata/);
+    }
+
+    const marketingLayouts = readdirSync(
+      resolve(repoRoot, 'apps/web/src/app/[locale]/(marketing)'),
+      { recursive: true, withFileTypes: true }
+    )
+      .filter(
+        (entry) =>
+          entry.isFile() &&
+          entry.name === 'layout.tsx' &&
+          readFileSync(resolve(entry.parentPath, entry.name), 'utf8').includes(
+            'createMarketingMetadata'
+          )
+      )
+      .map((entry) => resolve(entry.parentPath, entry.name));
+
+    expect(marketingLayouts).toHaveLength(34);
+    for (const layoutPath of marketingLayouts) {
+      expect(readFileSync(layoutPath, 'utf8')).toMatch(/pathname:\s*['`]/);
+    }
+  });
+});

package/src/common/metadata.ts

@@ -0,0 +1,275 @@
+import type { Metadata } from 'next';
+import { DEV_MODE } from '../constants';
+
+const TUTURUUU_URL = 'https://tuturuuu.com';
+const DEFAULT_OG_IMAGE = `${TUTURUUU_URL}/media/logos/og-image.jpg`;
+
+export const NO_INDEX_ROBOTS = {
+  index: false,
+  follow: false,
+  googleBot: {
+    index: false,
+    follow: false,
+  },
+} satisfies NonNullable<Metadata['robots']>;
+
+export interface CommonMetadataConfig {
+  name: string;
+  url: string;
+  indexable: boolean;
+  keywords: string[];
+  description: {
+    en: string;
+    vi?: string;
+  };
+  authors?: Metadata['authors'];
+  category?: string;
+  creator?: string;
+  icons?: Metadata['icons'];
+  manifest?: string;
+  ogImage?: string;
+  publisher?: string;
+}
+
+export interface PageMetadataConfig {
+  baseUrl: string;
+  description: string;
+  image?: string;
+  imageAlt?: string;
+  indexable?: boolean;
+  keywords?: string[];
+  locale: string;
+  localePrefix?: 'always' | 'as-needed' | 'never';
+  pathname: string;
+  siteName?: string;
+  socialDescription?: string;
+  socialTitle?: string;
+  title: string;
+}
+
+interface CreateCommonMetadataProps {
+  config: CommonMetadataConfig;
+  locale: string;
+}
+
+interface GenerateCommonMetadataProps {
+  config: CommonMetadataConfig;
+  params: Promise<{
+    locale: string;
+  }>;
+}
+
+interface GeneratePageMetadataProps {
+  config: Omit<PageMetadataConfig, 'locale'>;
+  params: Promise<{
+    locale: string;
+  }>;
+}
+
+function getOpenGraphLocale(locale: string) {
+  return locale === 'vi' ? 'vi_VN' : 'en_US';
+}
+
+function trimSlashes(value: string) {
+  let start = 0;
+  let end = value.length;
+
+  while (start < end && value[start] === '/') start += 1;
+  while (end > start && value[end - 1] === '/') end -= 1;
+
+  return value.slice(start, end);
+}
+
+function getLocalizedUrl(
+  baseUrl: string,
+  locale: string,
+  pathname: string,
+  localePrefix: NonNullable<PageMetadataConfig['localePrefix']>
+) {
+  const normalizedPathname =
+    pathname === '/' ? '' : `/${trimSlashes(pathname)}`;
+  const localizedPrefix =
+    localePrefix === 'never' ||
+    (localePrefix === 'as-needed' && locale === 'en')
+      ? ''
+      : `/${locale}`;
+  const localizedPathname = `${localizedPrefix}${normalizedPathname}` || '/';
+
+  return new URL(localizedPathname, baseUrl).toString();
+}
+
+function getRobotsMetadata(indexable: boolean): Metadata['robots'] {
+  if (!indexable) {
+    return NO_INDEX_ROBOTS;
+  }
+
+  return {
+    index: true,
+    follow: true,
+    googleBot: {
+      index: true,
+      follow: true,
+      'max-image-preview': 'large',
+      'max-snippet': -1,
+      'max-video-preview': -1,
+    },
+  };
+}
+
+export function createCommonMetadata({
+  config,
+  locale,
+}: CreateCommonMetadataProps): Metadata {
+  const description =
+    locale === 'vi' && config.description.vi
+      ? config.description.vi
+      : config.description.en;
+  const ogImage = config.ogImage ?? DEFAULT_OG_IMAGE;
+  const openGraphLocale = getOpenGraphLocale(locale);
+
+  return {
+    applicationName: config.name,
+    title: {
+      default: config.name,
+      template: `${DEV_MODE ? '[DEV] ' : ''}%s | ${config.name}`,
+    },
+    metadataBase: new URL(config.url),
+    description,
+    keywords: [...new Set([config.name, 'Tuturuuu', ...config.keywords])],
+    authors: config.authors ?? [
+      {
+        name: 'Tuturuuu',
+        url: TUTURUUU_URL,
+      },
+    ],
+    creator: config.creator ?? 'Tuturuuu',
+    publisher: config.publisher ?? 'Tuturuuu',
+    category: config.category,
+    referrer: 'origin-when-cross-origin',
+    robots: getRobotsMetadata(config.indexable),
+    appleWebApp: {
+      capable: true,
+      statusBarStyle: 'default',
+      title: config.name,
+    },
+    formatDetection: {
+      address: false,
+      email: false,
+      telephone: false,
+    },
+    openGraph: {
+      type: 'website',
+      locale: openGraphLocale,
+      alternateLocale: [openGraphLocale === 'vi_VN' ? 'en_US' : 'vi_VN'],
+      title: config.name,
+      description,
+      siteName: config.name,
+      images: [
+        {
+          url: ogImage,
+          width: 1200,
+          height: 630,
+          alt: `${config.name} preview`,
+        },
+      ],
+    },
+    twitter: {
+      card: 'summary_large_image',
+      title: config.name,
+      description,
+      images: [ogImage],
+      creator: '@tuturuuu',
+      site: '@tuturuuu',
+    },
+    icons: config.icons ?? {
+      icon: `${TUTURUUU_URL}/favicon.ico`,
+      shortcut: `${TUTURUUU_URL}/favicon-16x16.png`,
+      apple: `${TUTURUUU_URL}/apple-touch-icon.png`,
+    },
+    manifest: config.manifest,
+  };
+}
+
+export function createPageMetadata({
+  baseUrl,
+  description,
+  image = DEFAULT_OG_IMAGE,
+  imageAlt,
+  indexable,
+  keywords,
+  locale,
+  localePrefix = 'as-needed',
+  pathname,
+  siteName = 'Tuturuuu',
+  title,
+  socialDescription = description,
+  socialTitle = title,
+}: PageMetadataConfig): Metadata {
+  const canonical = getLocalizedUrl(baseUrl, locale, pathname, localePrefix);
+  const englishUrl = getLocalizedUrl(baseUrl, 'en', pathname, localePrefix);
+  const vietnameseUrl = getLocalizedUrl(baseUrl, 'vi', pathname, localePrefix);
+  const openGraphLocale = getOpenGraphLocale(locale);
+  const absoluteImage = new URL(image, baseUrl).toString();
+
+  return {
+    title,
+    description,
+    ...(keywords?.length ? { keywords } : {}),
+    ...(typeof indexable === 'boolean'
+      ? { robots: getRobotsMetadata(indexable) }
+      : {}),
+    alternates: {
+      canonical,
+      ...(localePrefix === 'never'
+        ? {}
+        : {
+            languages: {
+              'en-US': englishUrl,
+              'vi-VN': vietnameseUrl,
+              'x-default': englishUrl,
+            },
+          }),
+    },
+    openGraph: {
+      type: 'website',
+      url: canonical,
+      locale: openGraphLocale,
+      alternateLocale: [openGraphLocale === 'vi_VN' ? 'en_US' : 'vi_VN'],
+      siteName,
+      title: socialTitle,
+      description: socialDescription,
+      images: [
+        {
+          url: absoluteImage,
+          width: 1200,
+          height: 630,
+          alt: imageAlt ?? socialTitle,
+        },
+      ],
+    },
+    twitter: {
+      card: 'summary_large_image',
+      title: socialTitle,
+      description: socialDescription,
+      images: [absoluteImage],
+      creator: '@tuturuuu',
+      site: '@tuturuuu',
+    },
+  };
+}
+
+export async function generateCommonMetadata({
+  config,
+  params,
+}: GenerateCommonMetadataProps): Promise<Metadata> {
+  const { locale } = await params;
+  return createCommonMetadata({ config, locale });
+}
+
+export async function generatePageMetadata({
+  config,
+  params,
+}: GeneratePageMetadataProps): Promise<Metadata> {
+  const { locale } = await params;
+  return createPageMetadata({ ...config, locale });
+}

package/src/common/nextjs.tsx

@@ -1,91 +1,21 @@
-import type { Metadata, Viewport } from 'next';
+import type { Viewport } from 'next';
 import { Noto_Sans } from 'next/font/google';
-import { DEV_MODE } from '../constants';
+
+export {
+  type CommonMetadataConfig,
+  createCommonMetadata,
+  createPageMetadata,
+  generateCommonMetadata,
+  generatePageMetadata,
+  NO_INDEX_ROBOTS,
+  type PageMetadataConfig,
+} from './metadata';
 
 export const font = Noto_Sans({
   subsets: ['latin', 'vietnamese'],
   display: 'block',
 });
 
-interface MetadataProps {
-  config: {
-    name: string;
-    url: string;
-    ogImage: string;
-    keywords?: string[];
-    description: {
-      en: string;
-      vi?: string;
-    };
-  };
-  params: Promise<{
-    locale: string;
-  }>;
-}
-
-export async function generateCommonMetadata({
-  config,
-  params,
-}: MetadataProps): Promise<Metadata> {
-  const { locale } = await params;
-  const description =
-    locale === 'vi' ? config.description.vi : config.description.en;
-
-  return {
-    applicationName: config.name,
-    title: {
-      default: config.name,
-      template: `${DEV_MODE ? '[DEV] ' : ''} %s | ${config.name}`,
-    },
-    metadataBase: new URL(config.url),
-    description,
-    keywords: config.keywords ?? [
-      'React.js',
-      'Next.js',
-      'Tailwind CSS',
-      'TypeScript',
-      'Biome',
-    ],
-    appleWebApp: {
-      capable: true,
-      statusBarStyle: 'default',
-      title: config.name,
-    },
-    formatDetection: {
-      telephone: false,
-    },
-    openGraph: {
-      type: 'website',
-      locale,
-      url: config.url,
-      title: config.name,
-      description,
-      siteName: config.name,
-      images: [
-        {
-          url: config.ogImage,
-          width: 1200,
-          height: 630,
-          alt: config.name,
-        },
-      ],
-    },
-    twitter: {
-      card: 'summary_large_image',
-      title: config.name,
-      description,
-      images: [config.ogImage],
-      creator: '@tuturuuu',
-    },
-    icons: {
-      icon: '/favicon.ico',
-      shortcut: '/favicon-16x16.png',
-      apple: '/apple-touch-icon.png',
-    },
-    manifest: '/manifest.webmanifest',
-  };
-}
-
 export const viewport: Viewport = {
   width: 'device-width',
   initialScale: 1,

package/src/launchable-apps.test.ts

@@ -101,6 +101,28 @@ describe('launchable apps', () => {
         currentOrigin: 'https://calendar.tuturuuu.localhost',
       })
     ).toBe('https://tasks.tuturuuu.localhost');
+
+    expect(
+      getLaunchableAppOrigin(app!, {
+        currentOrigin: 'https://tuturuuu.localhost:1355',
+      })
+    ).toBe('https://tasks.tuturuuu.localhost:1355');
+  });
+
+  it('preserves the Portless proxy port in full app URLs', () => {
+    const app = getLaunchableApp('tasks');
+
+    expect(app).not.toBeNull();
+    expect(
+      resolveLaunchableAppUrl({
+        app: app!,
+        currentOrigin: 'https://tuturuuu.localhost:1355',
+        searchParams: { source: 'sidebar-apps' },
+        workspace: teamWorkspace,
+      })
+    ).toBe(
+      'https://tasks.tuturuuu.localhost:1355/team-workspace/tasks?source=sidebar-apps'
+    );
   });
 
   it('uses default paths when no workspace is provided', () => {

package/src/launchable-apps.ts

@@ -395,6 +395,32 @@ function getAutoEnvironment(currentOrigin?: string): LaunchableAppEnvironment {
   return process.env.NODE_ENV === 'production' ? 'production' : 'portless';
 }
 
+function preservePortlessProxyPort(
+  targetOrigin: string,
+  currentOrigin?: string
+): string {
+  if (!currentOrigin) return targetOrigin;
+
+  try {
+    const currentUrl = new URL(currentOrigin);
+    const targetUrl = new URL(targetOrigin);
+    const isCurrentPortlessHost =
+      currentUrl.hostname === 'tuturuuu.localhost' ||
+      currentUrl.hostname.endsWith('.tuturuuu.localhost');
+    const isTargetPortlessHost =
+      targetUrl.hostname === 'tuturuuu.localhost' ||
+      targetUrl.hostname.endsWith('.tuturuuu.localhost');
+
+    if (isCurrentPortlessHost && isTargetPortlessHost && currentUrl.port) {
+      targetUrl.port = currentUrl.port;
+    }
+
+    return targetUrl.origin;
+  } catch {
+    return targetOrigin;
+  }
+}
+
 export function getLaunchableAppOrigin(
   app: LaunchableApp,
   {
@@ -413,7 +439,10 @@ export function getLaunchableAppOrigin(
     return app.localhostOrigin ?? getTuturuuuPortlessAppOrigin(app.portlessApp);
   }
 
-  return getTuturuuuPortlessAppOrigin(app.portlessApp);
+  return preservePortlessProxyPort(
+    getTuturuuuPortlessAppOrigin(app.portlessApp),
+    currentOrigin
+  );
 }
 
 function trimTrailingSlashes(value: string) {

package/src/money.ts

@@ -40,7 +40,7 @@ export function getCurrencyFractionDigits(currency = 'USD'): number {
   const cached = fractionDigitsCache.get(code);
   if (cached !== undefined) return cached;
 
-  let digits = DEFAULT_FRACTION_DIGITS;
+  let digits: number;
   try {
     digits =
       new Intl.NumberFormat(getCurrencyLocale(code), {

package/src/next-config.test.ts

@@ -4,6 +4,7 @@ import {
   createTuturuuuNextConfig,
   isTuturuuuNextCacheComponentsEnabled,
   isTuturuuuNextReactCompilerEnabled,
+  resolveTuturuuuInfrastructureAppUrl,
   resolveTuturuuuWebAppUrl,
   TUTURUUU_NEXT_IMAGE_REMOTE_PATTERNS,
   TUTURUUU_NEXT_OPTIMIZE_PACKAGE_IMPORTS,
@@ -17,6 +18,7 @@ describe('createTuturuuuNextConfig', () => {
     expect(config.allowedDevOrigins).toContain('tuturuuu.localhost');
     expect(config.cacheComponents).toBe(true);
     expect(config.partialPrefetching).toBe(true);
+    expect(config.experimental?.useTypeScriptCli).toBe(true);
     expect(config.experimental?.turbopackFileSystemCacheForBuild).toBe(true);
     expect(config.experimental?.turbopackRustReactCompiler).toBe(true);
     expect(config.images?.remotePatterns).toEqual(
@@ -198,6 +200,7 @@ describe('createTuturuuuNextConfig', () => {
         cpus: 2,
         turbopackFileSystemCacheForBuild: false,
         turbopackRustReactCompiler: false,
+        useTypeScriptCli: false,
       },
       typescript: {
         ignoreBuildErrors: false,
@@ -211,6 +214,7 @@ describe('createTuturuuuNextConfig', () => {
     expect(config.experimental?.cpus).toBe(2);
     expect(config.experimental?.turbopackFileSystemCacheForBuild).toBe(false);
     expect(config.experimental?.turbopackRustReactCompiler).toBe(false);
+    expect(config.experimental?.useTypeScriptCli).toBe(true);
     expect(config.typescript?.ignoreBuildErrors).toBe(false);
   });
 
@@ -369,6 +373,46 @@ describe('resolveTuturuuuWebAppUrl', () => {
   });
 });
 
+describe('resolveTuturuuuInfrastructureAppUrl', () => {
+  it('trims configured infrastructure origins', () => {
+    expect(
+      resolveTuturuuuInfrastructureAppUrl({
+        env: {
+          INTERNAL_INFRASTRUCTURE_API_ORIGIN: 'https://example.com///',
+          NODE_ENV: 'development',
+        },
+      })
+    ).toBe('https://example.com');
+  });
+
+  it('uses the local Portless infrastructure app in development', () => {
+    expect(
+      resolveTuturuuuInfrastructureAppUrl({
+        env: { NODE_ENV: 'development' },
+      })
+    ).toBe('https://infra.tuturuuu.localhost');
+  });
+
+  it('uses the canonical production infrastructure app when deployed', () => {
+    expect(
+      resolveTuturuuuInfrastructureAppUrl({
+        env: { VERCEL_ENV: 'production' },
+      })
+    ).toBe('https://infrastructure.tuturuuu.com');
+  });
+
+  it('ignores origins registered to another Tuturuuu app', () => {
+    expect(
+      resolveTuturuuuInfrastructureAppUrl({
+        env: {
+          INTERNAL_INFRASTRUCTURE_API_ORIGIN: 'https://chat.tuturuuu.com',
+          VERCEL_ENV: 'production',
+        },
+      })
+    ).toBe('https://infrastructure.tuturuuu.com');
+  });
+});
+
 describe('trimTrailingSlashes', () => {
   it('removes only trailing slash characters', () => {
     expect(trimTrailingSlashes('https://example.com/path///')).toBe(

package/src/next-config.ts

@@ -112,6 +112,7 @@ export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
     },
     experimental: {
       ...experimentalConfig,
+      useTypeScriptCli: true,
       turbopackFileSystemCacheForBuild:
         experimentalConfig.turbopackFileSystemCacheForBuild ?? true,
       turbopackRustReactCompiler:
@@ -192,3 +193,31 @@ export function resolveTuturuuuWebAppUrl({
       (isTuturuuuNextDeployedEnvironment(env) ? productionUrl : localUrl)
   );
 }
+
+export function resolveTuturuuuInfrastructureAppUrl({
+  env = process.env,
+  localFallbackUrl,
+  productionUrl = 'https://infrastructure.tuturuuu.com',
+}: {
+  env?: Environment;
+  localFallbackUrl?: string;
+  productionUrl?: string;
+} = {}) {
+  const localUrl =
+    localFallbackUrl ??
+    getLocalInternalAppUrl('infra', 'http://localhost:7823');
+
+  return trimTrailingSlashes(
+    resolveInternalAppUrl({
+      appName: 'infra',
+      candidates: [
+        env.INTERNAL_INFRASTRUCTURE_API_ORIGIN,
+        env.INFRASTRUCTURE_APP_URL,
+        env.NEXT_PUBLIC_INFRASTRUCTURE_APP_URL,
+      ],
+      fallback: isTuturuuuNextDeployedEnvironment(env)
+        ? productionUrl
+        : localUrl,
+    })
+  );
+}

package/src/permissions.tsx

@@ -121,6 +121,16 @@ export const permissionGroups = ({
                   disableOnProduction: false,
                   disabled: false,
                 },
+                {
+                  id: 'manage_internal_accounts' as PermissionId,
+                  icon: <UserCog />,
+                  title: t('ws-roles.manage_internal_accounts'),
+                  description: t(
+                    'ws-roles.manage_internal_accounts_description'
+                  ),
+                  disableOnProduction: false,
+                  disabled: false,
+                },
                 {
                   id: 'manage_mobile_deployment_vault' as PermissionId,
                   icon: <FileKey2 />,

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.22.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.24.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.22.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.24.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */

package/src/task-helper/board.ts

@@ -153,9 +153,11 @@ export function useWorkspaceLabels(wsId: string | null | undefined) {
 
 export interface BoardConfig {
   id: string;
+  name?: string | null;
   estimation_type: string | null;
   extended_estimation: boolean;
   allow_zero_estimates: boolean;
+  count_unestimated_issues?: boolean;
   ws_id: string;
   ticket_prefix: string | null;
 }
@@ -179,9 +181,11 @@ export function useBoardConfig(
 
       return {
         id: board.id,
+        name: board.name ?? null,
         estimation_type: board.estimation_type ?? null,
         extended_estimation: board.extended_estimation ?? false,
         allow_zero_estimates: board.allow_zero_estimates ?? false,
+        count_unestimated_issues: board.count_unestimated_issues ?? false,
         ws_id: board.ws_id,
         ticket_prefix: board.ticket_prefix ?? null,
       } as BoardConfig;

package/src/workspace-helper.ts

@@ -828,22 +828,14 @@ async function getPermissionsImpl({
 
   const isCreator =
     membershipType === 'MEMBER' && workspaceData.creator_id === userId;
-  const hasPermissions =
-    permissionsData.length > 0 || defaultData.length > 0 || isCreator;
-
   // if (DEV_MODE) {
   //   console.log('--------------------');
   //   console.log('Is creator', isCreator);
   //   console.log('Workspace permissions', permissionsData);
   //   console.log('Default permissions', defaultData);
-  //   console.log('Has permissions', hasPermissions);
   //   console.log('--------------------');
   // }
 
-  if (!isCreator && !hasPermissions) {
-    return null;
-  }
-
   const permissions = isCreator
     ? rolePermissions({
         wsId: resolvedWorkspaceId,