@tuturuuu/utils 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.22.0](https://github.com/tutur3u/platform/compare/utils-v0.21.0...utils-v0.22.0) (2026-08-04)
+
+
+### Features
+
+* **chat:** add connected site sync bridge ([#5078](https://github.com/tutur3u/platform/issues/5078)) ([3de1a07](https://github.com/tutur3u/platform/commit/3de1a07dfa2fec96982aa0d116e003d0aa3fe47c))
+* **onboarding:** connect product guidance across apps ([68cf626](https://github.com/tutur3u/platform/commit/68cf626c9650e5044b6c123f9423a6cebf1bba9a))
+
+
+### Bug Fixes
+
+* **ai:** accept rich embedding payloads ([a65b13f](https://github.com/tutur3u/platform/commit/a65b13fa80034959e5f18ee4515b3081002558e2))
+* **tooling:** support webpack verification builds ([5275e10](https://github.com/tutur3u/platform/commit/5275e10c4007ae92e84be6c057a79f223980700c))
+
+## [0.21.0](https://github.com/tutur3u/platform/compare/utils-v0.20.0...utils-v0.21.0) (2026-07-28)
+
+
+### Features
+
+* **git:** add fast repository satellite ([51982ae](https://github.com/tutur3u/platform/commit/51982ae8618bb7463e30c97f6e731551ec673660))
+
+
+### Bug Fixes
+
+* **workspaces:** preserve creator administration access ([cea32ea](https://github.com/tutur3u/platform/commit/cea32ea22acaae6be6e39552be4af47e6f4dcdc7))
+
 ## [0.20.0](https://github.com/tutur3u/platform/compare/utils-v0.19.0...utils-v0.20.0) (2026-07-27)
 
 

package/biome.json

@@ -1,5 +1,5 @@
 {
   "root": false,
-  "$schema": "https://biomejs.dev/schemas/2.5.5/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.6/schema.json",
   "extends": "//"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -20,21 +20,21 @@
     "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
     "@tanstack/react-query": "^5.101.4",
-    "@tiptap/core": "3.28.0",
-    "@tiptap/react": "3.28.0",
+    "@tiptap/core": "3.29.2",
+    "@tiptap/react": "3.29.2",
     "@tuturuuu/google": "0.1.0",
     "@tuturuuu/icons": "0.1.0",
-    "@tuturuuu/internal-api": "0.24.0",
+    "@tuturuuu/internal-api": "0.27.0",
     "@tuturuuu/supabase": "0.5.0",
     "@upstash/ratelimit": "^2.0.8",
-    "@upstash/redis": "^1.38.0",
+    "@upstash/redis": "^1.38.1",
     "clsx": "^2.1.1",
     "date-fns": "^4.4.0",
     "dayjs": "^1.11.21",
     "diff": "^9.0.0",
-    "effect": "^3.22.0",
+    "effect": "^3.22.1",
     "moment": "^2.30.1",
-    "next": "^16.3.0-preview.9",
+    "next": "^16.3.0",
     "prosemirror-model": "^1.25.11",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
@@ -45,14 +45,14 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.23.0",
+    "@tuturuuu/types": "0.26.0",
     "@tuturuuu/typescript-config": "0.1.1",
     "@types/diff": "^8.0.0",
-    "@types/node": "^26.1.1",
-    "@types/react": "^19.2.17",
-    "@vitejs/plugin-react": "^6.0.4",
+    "@types/node": "^26.1.2",
+    "@types/react": "^19.2.18",
+    "@vitejs/plugin-react": "^6.0.5",
     "typescript": "7.0.2",
-    "vite": "^8.1.5",
+    "vite": "^8.2.0",
     "vitest": "^4.1.10"
   },
   "exports": {

package/src/__tests__/api-proxy-guard.test.ts

@@ -159,6 +159,35 @@ describe('guardApiProxyRequest', () => {
     expect(mocks.validateEmoji).not.toHaveBeenCalled();
   });
 
+  it('can skip form-content validation without skipping payload limits', async () => {
+    mocks.validateEmoji.mockResolvedValue(
+      new Response(JSON.stringify({ error: 'Bad Request' }), { status: 400 })
+    );
+
+    const { guardApiProxyRequest } = await import('../api-proxy-guard.js');
+    const response = await guardApiProxyRequest(
+      makeRequest('/v1/embeddings', 'POST'),
+      {
+        prefixBase: 'proxy:test:ai',
+        skipContentValidation: true,
+      }
+    );
+
+    expect(response).toBeNull();
+    expect(mocks.validateEmoji).not.toHaveBeenCalled();
+
+    const oversized = await guardApiProxyRequest(
+      makeRequest('/v1/embeddings', 'POST', {
+        'content-length': `${1024 * 1024 + 1}`,
+      }),
+      {
+        prefixBase: 'proxy:test:ai',
+        skipContentValidation: true,
+      }
+    );
+    expect(oversized?.status).toBe(413);
+  });
+
   it('returns an IP-block response when the client is blocked', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     mocks.extractIp.mockReturnValue('1.2.3.4');

package/src/__tests__/app-url.test.ts

@@ -298,6 +298,7 @@ describe('Portless app origin registry', () => {
       'https://external.tuturuuu.localhost',
       'https://finance.tuturuuu.localhost',
       'https://forms.tuturuuu.localhost',
+      'https://git.tuturuuu.localhost',
       'https://hive.tuturuuu.localhost',
       'https://realtime.hive.tuturuuu.localhost',
       'https://infra.tuturuuu.localhost',

package/src/__tests__/permissions.test.tsx

@@ -32,6 +32,7 @@ describe('workspace permission catalog', () => {
     expect(permissionIds).not.toContain('view_infrastructure');
     expect(permissionIds).not.toContain('manage_infrastructure_stress_tests');
     expect(permissionIds).not.toContain('manage_internal_accounts');
+    expect(permissionIds).not.toContain('manage_git_repositories');
     expect(permissionIds).not.toContain('manage_workspace_secrets');
   });
 
@@ -42,6 +43,7 @@ describe('workspace permission catalog', () => {
     }).map((permission) => permission.id);
 
     expect(rootPermissionIds).toContain('manage_internal_accounts');
+    expect(rootPermissionIds).toContain('manage_git_repositories');
   });
 
   it('keeps internal account permission translations in shared role editors', () => {
@@ -75,6 +77,7 @@ describe('workspace permission catalog', () => {
     expect(permissionIds).toContain('view_infrastructure');
     expect(permissionIds).toContain('manage_infrastructure_stress_tests');
     expect(permissionIds).toContain('manage_internal_accounts');
+    expect(permissionIds).toContain('manage_git_repositories');
     expect(permissionIds).toContain('manage_external_migrations');
     expect(permissionIds).toContain('manage_workspace_secrets');
     expect(new Set(permissionIds).size).toBe(permissionIds.length);

package/src/__tests__/workspace-helper.test.ts

@@ -560,24 +560,153 @@ describe('getPermissions membership type gate', () => {
     expect(adminAuthGetUser).not.toHaveBeenCalled();
     expect(personalWorkspaceQuery.eq).toHaveBeenCalledWith('personal', true);
     expect(personalWorkspaceQuery.eq).toHaveBeenCalledWith(
-      'workspace_members.user_id',
+      'creator_id',
       'user-1'
     );
     expect(membershipQuery.eq).toHaveBeenCalledWith(
       'ws_id',
       personalWorkspaceId
     );
-    expect(roleMembersQuery.eq).toHaveBeenCalledWith(
-      'workspace_roles.ws_id',
-      personalWorkspaceId
-    );
     expect(workspaceQuery.eq).toHaveBeenCalledWith('id', personalWorkspaceId);
-    expect(defaultPermissionsQuery.eq).toHaveBeenCalledWith(
-      'ws_id',
-      personalWorkspaceId
+    expect(roleMembersQuery.select).not.toHaveBeenCalled();
+    expect(defaultPermissionsQuery.select).not.toHaveBeenCalled();
+  });
+
+  it('grants full member permissions to a creator with a missing membership row', async () => {
+    const workspaceId = '11111111-1111-4111-8111-111111111111';
+    const membershipQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      maybeSingle: vi.fn(),
+    };
+    membershipQuery.select.mockReturnValue(membershipQuery);
+    membershipQuery.eq.mockReturnValue(membershipQuery);
+    membershipQuery.maybeSingle.mockResolvedValue({
+      data: null,
+      error: null,
+    });
+
+    const workspaceQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      single: vi.fn(),
+    };
+    workspaceQuery.select.mockReturnValue(workspaceQuery);
+    workspaceQuery.eq.mockReturnValue(workspaceQuery);
+    workspaceQuery.single.mockResolvedValue({
+      data: { creator_id: 'user-1' },
+      error: null,
+    });
+
+    mockCreateAdminClient.mockResolvedValue({
+      from: vi.fn((table: string) => {
+        if (table === 'workspace_members') return membershipQuery;
+        if (table === 'workspaces') return workspaceQuery;
+        throw new Error(`Unexpected admin table lookup: ${table}`);
+      }),
+    });
+
+    const permissions = await getPermissions({
+      user: { id: 'user-1', email: 'creator@example.com' },
+      wsId: workspaceId,
+    });
+
+    expect(permissions?.membershipType).toBe('MEMBER');
+    expect(permissions?.containsPermission('manage_workspace_settings')).toBe(
+      true
+    );
+    expect(permissions?.containsPermission('manage_workspace_members')).toBe(
+      true
+    );
+  });
+
+  it('normalizes a creator GUEST membership to effective MEMBER permissions', async () => {
+    const workspaceId = '11111111-1111-4111-8111-111111111111';
+    const membershipQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      maybeSingle: vi.fn(),
+    };
+    membershipQuery.select.mockReturnValue(membershipQuery);
+    membershipQuery.eq.mockReturnValue(membershipQuery);
+    membershipQuery.maybeSingle.mockResolvedValue({
+      data: { type: 'GUEST' },
+      error: null,
+    });
+
+    const workspaceQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      single: vi.fn(),
+    };
+    workspaceQuery.select.mockReturnValue(workspaceQuery);
+    workspaceQuery.eq.mockReturnValue(workspaceQuery);
+    workspaceQuery.single.mockResolvedValue({
+      data: { creator_id: 'user-1' },
+      error: null,
+    });
+
+    mockCreateAdminClient.mockResolvedValue({
+      from: vi.fn((table: string) => {
+        if (table === 'workspace_members') return membershipQuery;
+        if (table === 'workspaces') return workspaceQuery;
+        throw new Error(`Unexpected admin table lookup: ${table}`);
+      }),
+    });
+
+    const permissions = await getPermissions({
+      user: { id: 'user-1', email: 'creator@example.com' },
+      wsId: workspaceId,
+    });
+
+    expect(permissions?.membershipType).toBe('MEMBER');
+    expect(permissions?.containsPermission('manage_workspace_roles')).toBe(
+      true
     );
   });
 
+  it('denies an unrelated user when the membership row is missing', async () => {
+    const workspaceId = '11111111-1111-4111-8111-111111111111';
+    const membershipQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      maybeSingle: vi.fn(),
+    };
+    membershipQuery.select.mockReturnValue(membershipQuery);
+    membershipQuery.eq.mockReturnValue(membershipQuery);
+    membershipQuery.maybeSingle.mockResolvedValue({
+      data: null,
+      error: null,
+    });
+
+    const workspaceQuery = {
+      select: vi.fn(),
+      eq: vi.fn(),
+      single: vi.fn(),
+    };
+    workspaceQuery.select.mockReturnValue(workspaceQuery);
+    workspaceQuery.eq.mockReturnValue(workspaceQuery);
+    workspaceQuery.single.mockResolvedValue({
+      data: { creator_id: 'owner-1' },
+      error: null,
+    });
+
+    mockCreateAdminClient.mockResolvedValue({
+      from: vi.fn((table: string) => {
+        if (table === 'workspace_members') return membershipQuery;
+        if (table === 'workspaces') return workspaceQuery;
+        throw new Error(`Unexpected admin table lookup: ${table}`);
+      }),
+    });
+
+    const permissions = await getPermissions({
+      user: { id: 'user-1', email: 'unrelated@example.com' },
+      wsId: workspaceId,
+    });
+
+    expect(permissions).toBeNull();
+  });
+
   it('returns a read-only permission context for a guest without defaults', async () => {
     const membershipQuery = {
       select: vi.fn(),

package/src/api-proxy-guard.ts

@@ -88,6 +88,7 @@ export type GuardOptions = {
   additionalRoutePolicies?: ProxyRoutePolicy[];
   prefixBase: string;
   routePolicies?: ProxyRoutePolicy[];
+  skipContentValidation?: boolean;
   trustedBypassRules?: TrustedProxyBypassRule[];
 };
 
@@ -1385,6 +1386,10 @@ export async function guardApiProxyRequest(
       ? ['snapshot']
       : undefined;
 
+  if (options.skipContentValidation) {
+    return null;
+  }
+
   return (
     (await validateRequestEmojiLimit(req, {
       allowDescriptionYjsState,

package/src/internal-domains.ts

@@ -116,6 +116,10 @@ export const PRODUCTION_INTERNAL_APP_DOMAINS = [
     name: 'forms',
     url: 'https://forms.tuturuuu.com',
   },
+  {
+    name: 'git',
+    url: 'https://git.tuturuuu.com',
+  },
   {
     name: 'hive',
     url: 'https://hive.tuturuuu.com',
@@ -231,6 +235,10 @@ export const PORTLESS_INTERNAL_APP_DOMAINS = [
     name: 'forms',
     url: getTuturuuuPortlessAppOrigin('forms'),
   },
+  {
+    name: 'git',
+    url: getTuturuuuPortlessAppOrigin('git'),
+  },
   {
     name: 'hive',
     url: getTuturuuuPortlessAppOrigin('hive'),
@@ -342,6 +350,10 @@ export const LOCALHOST_INTERNAL_APP_DOMAINS = [
     name: 'forms',
     url: 'http://localhost:7828',
   },
+  {
+    name: 'git',
+    url: 'http://localhost:7830',
+  },
   {
     name: 'hive',
     url: 'http://localhost:7814',

package/src/launchable-apps.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import {
   getLaunchableApp,
+  getLaunchableAppByHostname,
   getLaunchableAppByTitle,
   getLaunchableAppOrigin,
   LAUNCHABLE_APP_CATEGORIES,
@@ -32,9 +33,20 @@ describe('launchable apps', () => {
     });
     expect(getLaunchableAppByTitle('Tuturuuu')?.slug).toBe('platform');
     expect(getLaunchableAppByTitle('questionnaires')?.slug).toBe('forms');
+    expect(getLaunchableAppByTitle('repositories')?.slug).toBe('git');
     expect(getLaunchableAppByTitle('apps gateway')?.slug).toBe('apps');
   });
 
+  it('resolves production and Portless hostnames', () => {
+    expect(getLaunchableAppByHostname('calendar.tuturuuu.com')?.slug).toBe(
+      'calendar'
+    );
+    expect(getLaunchableAppByHostname('finance.tuturuuu.localhost')?.slug).toBe(
+      'finance'
+    );
+    expect(getLaunchableAppByHostname('localhost:7808')?.slug).toBe('finance');
+  });
+
   it('keeps retired apps out of the catalog and pins category overrides', () => {
     expect(LAUNCHABLE_APPS.map((app) => app.slug)).not.toContain('external');
     expect(LAUNCHABLE_APPS.map((app) => app.slug)).not.toContain('playground');
@@ -45,6 +57,11 @@ describe('launchable apps', () => {
     expect(getLaunchableApp('external')).toBeNull();
     expect(getLaunchableApp('playground')).toBeNull();
     expect(getLaunchableApp('platform')?.category).toBe('productivity');
+    expect(getLaunchableApp('git')).toMatchObject({
+      defaultPath: '/tutur3u/platform',
+      localhostOrigin: 'http://localhost:7830',
+      productionUrl: 'https://git.tuturuuu.com',
+    });
     expect(getLaunchableApp('apps')?.category).toBe('miscellaneous');
     expect(getLaunchableApp('cms')?.category).toBe('operations');
     expect(getLaunchableApp('rewise')?.category).toBe('ai');

package/src/launchable-apps.ts

@@ -113,6 +113,18 @@ export const LAUNCHABLE_APPS = [
     title: 'Drive',
     workspacePathResolver: workspaceRootPath,
   },
+  {
+    aliases: ['Source', 'Repositories', 'GitHub', 'Code'],
+    appRoot: 'apps/git',
+    category: 'productivity',
+    defaultPath: '/tutur3u/platform',
+    localhostOrigin: 'http://localhost:7830',
+    packageName: '@tuturuuu/git',
+    portlessApp: 'git',
+    productionUrl: 'https://git.tuturuuu.com',
+    slug: 'git',
+    title: 'Git',
+  },
   {
     aliases: ['App Launcher', 'Gateway', 'Apps Gateway'],
     appRoot: 'apps/apps',
@@ -404,6 +416,29 @@ export function getLaunchableAppByTitle(value?: string | null) {
   );
 }
 
+export function getLaunchableAppByHostname(hostname: string) {
+  const normalized = hostname.trim().toLowerCase();
+  if (!normalized) return null;
+  const normalizedHostname = normalized.split(':')[0];
+
+  return (
+    LAUNCHABLE_APPS.find((app) => {
+      if (normalizedHostname === new URL(app.productionUrl).hostname)
+        return true;
+      if (
+        normalizedHostname === `${app.portlessApp}.tuturuuu.localhost` ||
+        normalizedHostname === `${app.slug}.tuturuuu.localhost`
+      ) {
+        return true;
+      }
+
+      return 'localhostOrigin' in app && app.localhostOrigin
+        ? normalized === new URL(app.localhostOrigin).host
+        : false;
+    }) ?? null
+  );
+}
+
 function getAutoEnvironment(currentOrigin?: string): LaunchableAppEnvironment {
   if (currentOrigin?.includes('tuturuuu.localhost')) return 'portless';
   if (currentOrigin?.includes('localhost')) return 'localhost';

package/src/next-config.test.ts

@@ -4,6 +4,7 @@ import {
   createTuturuuuNextConfig,
   isTuturuuuNextCacheComponentsEnabled,
   isTuturuuuNextReactCompilerEnabled,
+  isTuturuuuTurbopackRustReactCompilerEnabled,
   resolveTuturuuuInfrastructureAppUrl,
   resolveTuturuuuWebAppUrl,
   TUTURUUU_NEXT_IMAGE_REMOTE_PATTERNS,
@@ -267,6 +268,20 @@ describe('isTuturuuuNextCacheComponentsEnabled', () => {
   });
 });
 
+describe('isTuturuuuTurbopackRustReactCompilerEnabled', () => {
+  it('keeps the native compiler enabled for normal builds', () => {
+    expect(isTuturuuuTurbopackRustReactCompilerEnabled({})).toBe(true);
+  });
+
+  it('disables the Turbopack-only compiler for webpack fallback builds', () => {
+    expect(
+      isTuturuuuTurbopackRustReactCompilerEnabled({
+        NEXT_WEBPACK_BUILD: '1',
+      })
+    ).toBe(false);
+  });
+});
+
 describe('isTuturuuuNextReactCompilerEnabled', () => {
   it('keeps React Compiler enabled for next dev', () => {
     expect(

package/src/next-config.ts

@@ -83,6 +83,12 @@ export function isTuturuuuNextCacheComponentsEnabled(
   return true;
 }
 
+export function isTuturuuuTurbopackRustReactCompilerEnabled(
+  env: Environment = process.env
+) {
+  return env.NEXT_WEBPACK_BUILD !== '1';
+}
+
 export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
   const experimentalConfig = config.experimental ?? {};
   const imageConfig = config.images ?? {};
@@ -116,7 +122,8 @@ export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
       turbopackFileSystemCacheForBuild:
         experimentalConfig.turbopackFileSystemCacheForBuild ?? true,
       turbopackRustReactCompiler:
-        experimentalConfig.turbopackRustReactCompiler ?? true,
+        experimentalConfig.turbopackRustReactCompiler ??
+        isTuturuuuTurbopackRustReactCompilerEnabled(),
       optimizePackageImports: mergeStringArrays(
         TUTURUUU_NEXT_OPTIMIZE_PACKAGE_IMPORTS,
         experimentalConfig.optimizePackageImports

package/src/onboarding.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest';
+import { LAUNCHABLE_APPS } from './launchable-apps';
+import {
+  ONBOARDING_MISSIONS,
+  ONBOARDING_PERSONAS,
+  recommendOnboardingApps,
+} from './onboarding';
+
+describe('connected onboarding manifest', () => {
+  it('has one dedicated mission for every launchable app', () => {
+    expect(ONBOARDING_MISSIONS.map(({ appSlug }) => appSlug).sort()).toEqual(
+      LAUNCHABLE_APPS.map(({ slug }) => slug).sort()
+    );
+  });
+
+  it('keeps every mission short and action-oriented', () => {
+    expect(
+      ONBOARDING_MISSIONS.every(({ capabilities }) => capabilities.length === 3)
+    ).toBe(true);
+  });
+
+  it.each(ONBOARDING_PERSONAS)(
+    'returns launchable recommendations for %s',
+    (persona) => {
+      const recommendations = recommendOnboardingApps({
+        goals: [],
+        persona,
+      });
+      const launchable = new Set(LAUNCHABLE_APPS.map(({ slug }) => slug));
+
+      expect(recommendations.length).toBeGreaterThan(0);
+      expect(recommendations.every((slug) => launchable.has(slug))).toBe(true);
+    }
+  );
+});

package/src/onboarding.ts

@@ -0,0 +1,199 @@
+import { LAUNCHABLE_APPS } from './launchable-apps';
+
+export const ONBOARDING_PERSONAS = [
+  'professional',
+  'student',
+  'founder',
+  'executive',
+  'team_leader',
+  'educator',
+  'creator',
+  'developer',
+  'operations',
+] as const;
+
+export const ONBOARDING_GOALS = [
+  'focus',
+  'collaborate',
+  'operate',
+  'learn',
+  'build',
+] as const;
+
+export type OnboardingPersona = (typeof ONBOARDING_PERSONAS)[number];
+export type OnboardingGoal = (typeof ONBOARDING_GOALS)[number];
+export type OnboardingAppSlug = (typeof LAUNCHABLE_APPS)[number]['slug'];
+export type OnboardingActionSafety =
+  | 'preview'
+  | 'reversible'
+  | 'confirmation_required';
+
+export type OnboardingMission = {
+  appSlug: OnboardingAppSlug;
+  capabilities: readonly [string, string, string];
+  goal: OnboardingGoal;
+  safety: OnboardingActionSafety;
+};
+
+export type OnboardingJourneyPreferences = {
+  goals: OnboardingGoal[];
+  persona: OnboardingPersona | null;
+};
+
+export type OnboardingJourneyProgress = OnboardingJourneyPreferences & {
+  completedMissionIds: string[];
+  dismissedAt: string | null;
+  mode: 'standard' | 'employee_test';
+  replayApp: OnboardingAppSlug | null;
+  revision: number;
+};
+
+export const ONBOARDING_JOURNEY_REVISION = 2;
+
+export const PERSONA_RECOMMENDATIONS = {
+  professional: ['tasks', 'calendar', 'mail', 'drive', 'assistant'],
+  student: ['learn', 'rewise', 'calendar', 'tasks', 'mind'],
+  founder: ['tasks', 'finance', 'contacts', 'forms', 'assistant'],
+  executive: ['platform', 'finance', 'calendar', 'meet', 'assistant'],
+  team_leader: ['tasks', 'chat', 'calendar', 'meet', 'contacts'],
+  educator: ['teach', 'learn', 'forms', 'meet', 'drive'],
+  creator: ['cms', 'drive', 'shortener', 'forms', 'assistant'],
+  developer: ['git', 'ai', 'docs', 'tasks', 'tools'],
+  operations: ['inventory', 'finance', 'contacts', 'forms', 'tasks'],
+} as const satisfies Record<OnboardingPersona, readonly string[]>;
+
+export const GOAL_RECOMMENDATIONS = {
+  focus: ['tasks', 'calendar', 'mail', 'track', 'assistant'],
+  collaborate: ['chat', 'meet', 'drive', 'tasks', 'forms'],
+  operate: ['finance', 'inventory', 'contacts', 'pay', 'storefront'],
+  learn: ['learn', 'teach', 'rewise', 'mind', 'docs'],
+  build: ['ai', 'git', 'cms', 'nova', 'tools'],
+} as const satisfies Record<OnboardingGoal, readonly string[]>;
+
+const MISSIONS = [
+  ['platform', 'focus', 'reversible', ['overview', 'apps', 'next_move']],
+  ['calendar', 'focus', 'reversible', ['schedule', 'timebox', 'review']],
+  [
+    'chat',
+    'collaborate',
+    'confirmation_required',
+    ['spaces', 'message', 'follow_up'],
+  ],
+  ['cms', 'build', 'confirmation_required', ['content', 'preview', 'publish']],
+  [
+    'drive',
+    'collaborate',
+    'confirmation_required',
+    ['organize', 'share', 'find'],
+  ],
+  ['git', 'build', 'preview', ['repositories', 'browse', 'search']],
+  ['apps', 'focus', 'reversible', ['discover', 'filter', 'launch']],
+  ['docs', 'learn', 'preview', ['browse', 'search', 'reference']],
+  [
+    'finance',
+    'operate',
+    'confirmation_required',
+    ['wallets', 'transactions', 'reports'],
+  ],
+  ['hive', 'build', 'preview', ['world', 'simulate', 'observe']],
+  [
+    'inventory',
+    'operate',
+    'confirmation_required',
+    ['catalog', 'stock', 'movement'],
+  ],
+  [
+    'storefront',
+    'operate',
+    'confirmation_required',
+    ['store', 'preview', 'checkout'],
+  ],
+  ['learn', 'learn', 'reversible', ['courses', 'study', 'progress']],
+  ['mail', 'focus', 'confirmation_required', ['inbox', 'compose', 'follow_up']],
+  ['meet', 'collaborate', 'confirmation_required', ['room', 'invite', 'meet']],
+  ['mind', 'learn', 'reversible', ['canvas', 'connect', 'organize']],
+  [
+    'ai',
+    'build',
+    'confirmation_required',
+    ['playground', 'models', 'evaluate'],
+  ],
+  ['nova', 'build', 'confirmation_required', ['challenge', 'prompt', 'submit']],
+  ['tools', 'build', 'reversible', ['choose', 'configure', 'generate']],
+  ['rewise', 'learn', 'reversible', ['material', 'practice', 'review']],
+  ['shortener', 'build', 'reversible', ['link', 'customize', 'measure']],
+  ['tasks', 'focus', 'reversible', ['capture', 'plan', 'complete']],
+  ['teach', 'learn', 'confirmation_required', ['course', 'lesson', 'share']],
+  ['pay', 'operate', 'confirmation_required', ['request', 'review', 'pay']],
+  [
+    'contacts',
+    'operate',
+    'confirmation_required',
+    ['people', 'fields', 'follow_up'],
+  ],
+  [
+    'forms',
+    'collaborate',
+    'confirmation_required',
+    ['build', 'preview', 'share'],
+  ],
+  ['track', 'focus', 'reversible', ['timer', 'session', 'insights']],
+] as const satisfies readonly (readonly [
+  OnboardingAppSlug,
+  OnboardingGoal,
+  OnboardingActionSafety,
+  readonly [string, string, string],
+])[];
+
+export const ONBOARDING_MISSIONS: readonly OnboardingMission[] = MISSIONS.map(
+  ([appSlug, goal, safety, capabilities]) => ({
+    appSlug,
+    capabilities,
+    goal,
+    safety,
+  })
+);
+
+export function getOnboardingMission(appSlug: string) {
+  return ONBOARDING_MISSIONS.find((mission) => mission.appSlug === appSlug);
+}
+
+export function recommendOnboardingApps(
+  preferences: OnboardingJourneyPreferences,
+  limit = 8
+): OnboardingAppSlug[] {
+  const ranked = new Map<string, number>();
+  const add = (slug: string, score: number) =>
+    ranked.set(slug, (ranked.get(slug) ?? 0) + score);
+
+  if (preferences.persona) {
+    PERSONA_RECOMMENDATIONS[preferences.persona].forEach((slug, index) => {
+      add(slug, 20 - index);
+    });
+  }
+
+  preferences.goals.forEach((goal) => {
+    GOAL_RECOMMENDATIONS[goal].forEach((slug, index) => {
+      add(slug, 12 - index);
+    });
+  });
+
+  const launchable = new Set(LAUNCHABLE_APPS.map((app) => app.slug));
+  return [...ranked.entries()]
+    .filter(([slug]) => launchable.has(slug as OnboardingAppSlug))
+    .sort((left, right) => right[1] - left[1])
+    .slice(0, limit)
+    .map(([slug]) => slug as OnboardingAppSlug);
+}
+
+export function createDefaultOnboardingProgress(): OnboardingJourneyProgress {
+  return {
+    completedMissionIds: [],
+    dismissedAt: null,
+    goals: [],
+    mode: 'standard',
+    persona: null,
+    replayApp: null,
+    revision: ONBOARDING_JOURNEY_REVISION,
+  };
+}

package/src/permissions.tsx

@@ -19,6 +19,7 @@ import {
   FileKey2,
   FileText,
   FlaskConical,
+  GitBranch,
   HandCoins,
   HardDrive,
   House,
@@ -131,6 +132,16 @@ export const permissionGroups = ({
                   disableOnProduction: false,
                   disabled: false,
                 },
+                {
+                  id: 'manage_git_repositories' as PermissionId,
+                  icon: <GitBranch />,
+                  title: t('ws-roles.manage_git_repositories'),
+                  description: t(
+                    'ws-roles.manage_git_repositories_description'
+                  ),
+                  disableOnProduction: false,
+                  disabled: false,
+                },
                 {
                   id: 'manage_mobile_deployment_vault' as PermissionId,
                   icon: <FileKey2 />,

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.29.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.32.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.29.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.32.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */

package/src/portless.ts

@@ -17,6 +17,7 @@ export const TUTURUUU_PORTLESS_APP_ORIGINS = {
   external: `https://external.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   finance: `https://finance.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   forms: `https://forms.${TUTURUUU_PORTLESS_ROOT_HOST}`,
+  git: `https://git.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   hive: `https://hive.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   'hive-realtime': `https://realtime.hive.${TUTURUUU_PORTLESS_ROOT_HOST}`,
   infra: `https://infra.${TUTURUUU_PORTLESS_ROOT_HOST}`,

package/src/workspace-helper.ts

@@ -689,19 +689,32 @@ async function resolveWorkspaceIdForPermissions({
     return normalizeWorkspaceId(wsId, authorizationClient);
   }
 
-  const { data: workspace, error } = await authorizationClient
-    .from('workspaces')
-    .select('id, workspace_members!inner(user_id, type)')
-    .eq('personal', true)
-    .eq('workspace_members.user_id', principal.id)
-    .eq('workspace_members.type', 'MEMBER')
-    .maybeSingle();
+  const { data: creatorWorkspace, error: creatorWorkspaceError } =
+    await authorizationClient
+      .from('workspaces')
+      .select('id')
+      .eq('personal', true)
+      .eq('creator_id', principal.id)
+      .maybeSingle();
+
+  if (!creatorWorkspaceError && creatorWorkspace?.id) {
+    return creatorWorkspace.id;
+  }
 
-  if (error || !workspace?.id) {
+  const { data: memberWorkspace, error: memberWorkspaceError } =
+    await authorizationClient
+      .from('workspaces')
+      .select('id, workspace_members!inner(user_id, type)')
+      .eq('personal', true)
+      .eq('workspace_members.user_id', principal.id)
+      .eq('workspace_members.type', 'MEMBER')
+      .maybeSingle();
+
+  if (memberWorkspaceError || !memberWorkspace?.id) {
     throw new Error('Personal workspace not found');
   }
 
-  return workspace.id;
+  return memberWorkspace.id;
 }
 
 /**
@@ -761,7 +774,7 @@ async function getPermissionsImpl({
   let resolvedWorkspaceId: string;
   try {
     resolvedWorkspaceId = await resolveWorkspaceIdForPermissions({
-      authorizationClient: authorizationClient as TypedSupabaseClient,
+      authorizationClient: sbAdmin,
       principal,
       wsId,
     });
@@ -769,21 +782,39 @@ async function getPermissionsImpl({
     return null;
   }
 
-  const membership = await verifyWorkspaceMembershipType({
-    wsId: resolvedWorkspaceId,
-    userId,
-    supabase: authorizationClient as TypedSupabaseClient,
-    requiredType: 'ANY',
-  });
+  const [membership, workspaceRes] = await Promise.all([
+    verifyWorkspaceMembershipType({
+      wsId: resolvedWorkspaceId,
+      userId,
+      supabase: authorizationClient as TypedSupabaseClient,
+      requiredType: 'ANY',
+    }),
+    sbAdmin
+      .from('workspaces')
+      .select('creator_id')
+      .eq('id', resolvedWorkspaceId)
+      .single(),
+  ]);
 
-  if (!membership.ok) {
+  const { data: workspaceData, error: workspaceError } = workspaceRes;
+
+  if (workspaceError || !workspaceData) {
+    console.info('Workspace not found in getPermissions', resolvedWorkspaceId);
     return null;
   }
 
-  const membershipType = membership.membershipType ?? 'MEMBER';
+  const isCreator = workspaceData.creator_id === userId;
+
+  if (!isCreator && !membership.ok) {
+    return null;
+  }
+
+  const membershipType = isCreator
+    ? 'MEMBER'
+    : (membership.membershipType ?? 'MEMBER');
 
   const permissionsQuery =
-    membershipType === 'MEMBER'
+    membershipType === 'MEMBER' && !isCreator
       ? sbAdmin
           .from('workspace_role_members')
           .select(
@@ -794,40 +825,26 @@ async function getPermissionsImpl({
           .eq('workspace_roles.workspace_role_permissions.enabled', true)
       : Promise.resolve({ data: [], error: null });
 
-  const workspaceQuery = sbAdmin
-    .from('workspaces')
-    .select('creator_id')
-    .eq('id', resolvedWorkspaceId)
-    .single();
+  const defaultQuery = isCreator
+    ? Promise.resolve({ data: [], error: null })
+    : sbAdmin
+        .from('workspace_default_permissions')
+        .select('permission')
+        .eq('ws_id', resolvedWorkspaceId)
+        .eq('member_type', membershipType)
+        .eq('enabled', true);
 
-  const defaultQuery = sbAdmin
-    .from('workspace_default_permissions')
-    .select('permission')
-    .eq('ws_id', resolvedWorkspaceId)
-    .eq('member_type', membershipType)
-    .eq('enabled', true);
-
-  const [permissionsRes, workspaceRes, defaultRes] = await Promise.all([
+  const [permissionsRes, defaultRes] = await Promise.all([
     permissionsQuery,
-    workspaceQuery,
     defaultQuery,
   ]);
 
   const { data: permissionsData, error: permissionsError } = permissionsRes;
-  const { data: workspaceData, error: workspaceError } = workspaceRes;
   const { data: defaultData, error: defaultError } = defaultRes;
 
-  if (!workspaceData) {
-    console.info('Workspace not found in getPermissions', resolvedWorkspaceId);
-    return null;
-  }
-
   if (permissionsError) return null;
-  if (workspaceError) return null;
   if (defaultError) return null;
 
-  const isCreator =
-    membershipType === 'MEMBER' && workspaceData.creator_id === userId;
   // if (DEV_MODE) {
   //   console.log('--------------------');
   //   console.log('Is creator', isCreator);