@tuturuuu/utils 0.25.5 → 0.26.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [0.26.0](https://github.com/tutur3u/platform/compare/utils-v0.25.5...utils-v0.26.0) (2026-08-26)
+
+
+### Features
+
+* **forms:** add landing page, per-form SEO, realtime collaboration, and embeds ([#5145](https://github.com/tutur3u/platform/issues/5145)) ([6896515](https://github.com/tutur3u/platform/commit/6896515b099b28bbebc873f98733879bf108ef89))
+* **forms:** add six embed modes and a public embed SDK ([5d0b68b](https://github.com/tutur3u/platform/commit/5d0b68b3ca5ce3d4cd6cd119e2b0ad79b014aedd))
+* **tu-do:** search board tasks by ticket identifier ([e81891c](https://github.com/tutur3u/platform/commit/e81891c7424b530322e3250d917636a988e278fe))
+* **tu-do:** search board tasks by ticket identifier ([#5142](https://github.com/tutur3u/platform/issues/5142)) ([18c0e3e](https://github.com/tutur3u/platform/commit/18c0e3ea6a20522959a0b66ed8dfd5a5699daec4))
+
 ## [0.25.5](https://github.com/tutur3u/platform/compare/utils-v0.25.4...utils-v0.25.5) (2026-08-25)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.25.5",
+  "version": "0.26.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,7 +24,7 @@
     "@tiptap/react": "3.30.2",
     "@tuturuuu/google": "0.1.0",
     "@tuturuuu/icons": "0.1.0",
-    "@tuturuuu/internal-api": "0.32.0",
+    "@tuturuuu/internal-api": "0.33.0",
     "@tuturuuu/supabase": "0.5.1",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.2",
@@ -45,7 +45,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.27.0",
+    "@tuturuuu/types": "0.28.0",
     "@tuturuuu/typescript-config": "0.1.2",
     "@types/diff": "^8.0.0",
     "@types/node": "^26.2.0",

package/src/common/metadata.test.ts

@@ -326,7 +326,7 @@ describe('application metadata coverage', () => {
       )
       .map((entry) => resolve(entry.parentPath, entry.name));
 
-    expect(marketingLayouts).toHaveLength(37);
+    expect(marketingLayouts).toHaveLength(38);
     for (const layoutPath of marketingLayouts) {
       expect(readFileSync(layoutPath, 'utf8')).toMatch(/pathname:\s*['`]/);
     }

package/src/next-config.test.ts

@@ -500,4 +500,35 @@ describe('trimTrailingSlashes', () => {
       'https://example.com/path'
     );
   });
+
+  it('excludes opted-in paths from the anti-framing rule', async () => {
+    const config = createTuturuuuNextConfig({
+      framablePathPatterns: ['embed/[^/]+'],
+    });
+
+    const headers = await config.headers?.();
+    const source = headers?.[0]?.source ?? '';
+
+    expect(source).toContain('embed/[^/]+(?:/|$)');
+    // The platform default must survive an app adding its own patterns.
+    expect(source).toContain('external-projects/assets/[^/]+/webgl(?:/|$)');
+
+    // The `source` is a path-to-regexp pattern, so assert the lookahead does
+    // what it claims: opted-in paths must not match the deny rule, and
+    // everything else still must.
+    const lookahead = new RegExp(`^${source.slice('/:path('.length, -1)}$`);
+    expect(lookahead.test('embed/abc123')).toBe(false);
+    expect(lookahead.test('embed/abc123/preview')).toBe(false);
+    expect(lookahead.test('embedded-elsewhere')).toBe(true);
+    expect(lookahead.test('f/abc123')).toBe(true);
+    expect(lookahead.test('personal/forms')).toBe(true);
+  });
+
+  it('does not leak framablePathPatterns into the Next config object', () => {
+    const config = createTuturuuuNextConfig({
+      framablePathPatterns: ['embed/[^/]+'],
+    });
+
+    expect(config).not.toHaveProperty('framablePathPatterns');
+  });
 });

package/src/next-config.ts

@@ -41,8 +41,31 @@ export const TUTURUUU_NEXT_IMAGE_REMOTE_PATTERNS = [
 
 export const TUTURUUU_NEXT_IMAGE_MINIMUM_CACHE_TTL_SECONDS = 7 * 24 * 60 * 60;
 
-const TUTURUUU_ANTI_FRAMING_SOURCE =
-  '/:path((?!api/v1/workspaces/[^/]+/external-projects/assets/[^/]+/webgl(?:/|$)).*)';
+/**
+ * Paths every app excludes from the anti-framing headers.
+ *
+ * Framing is denied by default across the platform; anything listed here has
+ * been deliberately designed to be embedded in a third-party page.
+ */
+const TUTURUUU_DEFAULT_FRAMABLE_PATTERNS = [
+  'api/v1/workspaces/[^/]+/external-projects/assets/[^/]+/webgl',
+];
+
+/**
+ * Builds the anti-framing `source` as a negative lookahead over every framable
+ * path, so those paths simply never match the deny rule.
+ *
+ * A later permissive header would not reliably win: `X-Frame-Options` has no
+ * "allow from any origin" value, so the deny header has to be absent rather
+ * than overridden.
+ */
+function buildAntiFramingSource(framablePathPatterns: readonly string[]) {
+  const alternatives = framablePathPatterns
+    .map((pattern) => `${pattern}(?:/|$)`)
+    .join('|');
+
+  return `/:path((?!${alternatives}).*)`;
+}
 
 const TUTURUUU_ANTI_FRAMING_HEADERS = [
   {
@@ -111,14 +134,32 @@ export function getTuturuuuNextOptimizePackageImports(
     : mergeStringArrays(TUTURUUU_NEXT_OPTIMIZE_PACKAGE_IMPORTS, appImports);
 }
 
-export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
+export interface TuturuuuNextConfigOptions extends NextConfig {
+  /**
+   * Path patterns (no leading slash, regex fragments) that this app allows to
+   * be framed by third-party sites. Excluded from the platform-wide
+   * `frame-ancestors 'none'` / `X-Frame-Options: DENY` rule.
+   *
+   * Opt in per route, never per app: everything not listed here stays denied.
+   */
+  framablePathPatterns?: readonly string[];
+}
+
+export function createTuturuuuNextConfig(
+  config: TuturuuuNextConfigOptions = {}
+): NextConfig {
   const experimentalConfig = config.experimental ?? {};
   const imageConfig = config.images ?? {};
+  const { framablePathPatterns, ...nextConfig } = config;
+  const antiFramingSource = buildAntiFramingSource([
+    ...TUTURUUU_DEFAULT_FRAMABLE_PATTERNS,
+    ...(framablePathPatterns ?? []),
+  ]);
 
   return {
     reactStrictMode: true,
     poweredByHeader: false,
-    ...config,
+    ...nextConfig,
     reactCompiler: isTuturuuuNextReactCompilerEnabled(),
     cacheComponents:
       config.cacheComponents ?? isTuturuuuNextCacheComponentsEnabled(),
@@ -159,10 +200,10 @@ export function createTuturuuuNextConfig(config: NextConfig = {}): NextConfig {
     async headers() {
       return [
         {
-          source: TUTURUUU_ANTI_FRAMING_SOURCE,
+          source: antiFramingSource,
           headers: TUTURUUU_ANTI_FRAMING_HEADERS,
         },
-        ...((await config.headers?.()) ?? []),
+        ...((await nextConfig.headers?.()) ?? []),
       ];
     },
   };

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.41.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.42.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.41.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.42.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */

package/src/task-helper.ts

@@ -6,7 +6,12 @@ export * from './task-helper/optimistic-task-cache';
 export * from './task-helper/personal-external-staging';
 export * from './task-helper/recycle-bin';
 export * from './task-helper/relationships';
-export { getTicketIdentifier } from './task-helper/shared';
+export {
+  getTaskIdentifierForSearch,
+  getTicketIdentifier,
+  isTicketIdentifierLikeQuery,
+  normalizeTaskSearchValue,
+} from './task-helper/shared';
 export * from './task-helper/sort-keys';
 export * from './task-helper/task-hooks-basic';
 export * from './task-helper/task-hooks-move';