@tuturuuu/utils 0.28.0 → 0.29.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [0.29.0](https://github.com/tutur3u/platform/compare/utils-v0.28.0...utils-v0.29.0) (2026-09-20)
+
+
+### Features
+
+* **infrastructure:** coordinate authenticator and meeting leases on Cloudflare ([2582bf2](https://github.com/tutur3u/platform/commit/2582bf2f72670e1f2696de80820eddd118c27d29))
+* **infrastructure:** use Cloudflare for authenticator and meeting coordination ([#5411](https://github.com/tutur3u/platform/issues/5411)) ([a154602](https://github.com/tutur3u/platform/commit/a15460282959831fe617494126d9955b772957aa))
+* **lettin:** add Cloudflare worldbuilding satellite ([0c8cc22](https://github.com/tutur3u/platform/commit/0c8cc22168477440e326bdec08427daf9721d9bf)) ([#5351](https://github.com/tutur3u/platform/issues/5351)) ([2631103](https://github.com/tutur3u/platform/commit/263110318bb9bab6d26a1bdd539fc52a40b25bec))
+* **meet:** publish invite previews and extend paid call limits ([7cf3d6b](https://github.com/tutur3u/platform/commit/7cf3d6b97b0f353e83e894dcc8c83e0d2b6d7a3b))
+* **meet:** turn notes into reviewed calendar and task follow-ups ([#5359](https://github.com/tutur3u/platform/issues/5359)) ([3914a41](https://github.com/tutur3u/platform/commit/3914a41828e6e837add7f55a3f05a5b42e31f98e))
+* **meet:** unlock hosting for verified paid accounts ([00a0168](https://github.com/tutur3u/platform/commit/00a016891845b43ba0297730937fa68d6e465de8))
+* **meet:** unlock paid hosting, longer calls and public previews ([#5364](https://github.com/tutur3u/platform/issues/5364)) ([a6687ff](https://github.com/tutur3u/platform/commit/a6687ffccda096f2ab9da850bf0ddfe8e04c3cf2))
+* **pricing:** add full app comparison and evolving pitch deck ([c967e8d](https://github.com/tutur3u/platform/commit/c967e8d2db75fc65159c7dcb31ed1b27673ae924))
+* **pricing:** compare every app and add an evolving pitch deck ([#5335](https://github.com/tutur3u/platform/issues/5335)) ([962ed75](https://github.com/tutur3u/platform/commit/962ed75e086eb85a06a878720a5d30b747e7ba82))
+
+
+### Bug Fixes
+
+* **billing:** fail closed on unknown usage and subscription capacity ([ccfcba4](https://github.com/tutur3u/platform/commit/ccfcba46f236981b1d4e59e1c389bee8472b2ca8)) ([#5333](https://github.com/tutur3u/platform/issues/5333)) ([a308a89](https://github.com/tutur3u/platform/commit/a308a8996f17a81c76c8fb0d498a14d8dbf289c3))
+* **deps:** align React types and published consumer ranges ([3612cd8](https://github.com/tutur3u/platform/commit/3612cd81723fb5a6982152688227ed21bc4095fd))
+* **deps:** preserve React peer compatibility and clarify audit ([777b9ed](https://github.com/tutur3u/platform/commit/777b9ed7f42095bb9361e6bed94d989310c222de))
+* **meet:** fail closed and release rejected follow-up receipts ([c13a295](https://github.com/tutur3u/platform/commit/c13a295c1fabcf8605fb05b2d6a5042db3213426))
+* **payment:** protect webhook ingress and restore order cron ([e059fc7](https://github.com/tutur3u/platform/commit/e059fc74f4eff9e938823b1bd02b42093adc632e))
+* **payment:** restore catalog webhook delivery and guard publication ([#5342](https://github.com/tutur3u/platform/issues/5342)) ([b5f61ec](https://github.com/tutur3u/platform/commit/b5f61ec25617b09245c117e47081544edafa454a))
+* **pricing:** reconcile live catalog displays and tier comparisons ([3aa65c2](https://github.com/tutur3u/platform/commit/3aa65c2221d0d099ff5bd50de0c90bb4237d1bbd))
+* **tasks:** align filtered counts and local task visibility ([913388b](https://github.com/tutur3u/platform/commit/913388b78767f927685df695398da030ad73bf82))
+* **tasks:** show unprioritized tasks first across paginated views ([1a5dffc](https://github.com/tutur3u/platform/commit/1a5dffccf45fc1a9c20353d19d843d3c66c22379))
+* **tasks:** surface unprioritized tasks before paginating ([#5315](https://github.com/tutur3u/platform/issues/5315)) ([496627b](https://github.com/tutur3u/platform/commit/496627b85688b0030199310ad21bd21cf2a92f72))
+* **utils:** declare server-only runtime dependency ([172674d](https://github.com/tutur3u/platform/commit/172674d9168092acf1270fb09050a59d9efcbed6))
+
 ## [0.28.0](https://github.com/tutur3u/platform/compare/utils-v0.27.1...utils-v0.28.0) (2026-09-07)
 
 

package/biome.json

@@ -1,5 +1,5 @@
 {
   "root": false,
-  "$schema": "https://biomejs.dev/schemas/2.5.12/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.13/schema.json",
   "extends": "//"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -20,38 +20,39 @@
     "@noble/ciphers": "^2.4.0",
     "@noble/hashes": "^2.4.0",
     "@tanstack/react-query": "^5.102.8",
-    "@tiptap/core": "3.31.2",
-    "@tiptap/react": "3.31.2",
-    "@tuturuuu/google": "0.1.0",
-    "@tuturuuu/icons": "0.1.0",
-    "@tuturuuu/internal-api": "0.34.0",
-    "@tuturuuu/supabase": "0.5.1",
+    "@tiptap/core": "3.31.3",
+    "@tiptap/react": "3.31.3",
+    "@tuturuuu/google": "0.1.1",
+    "@tuturuuu/icons": "0.1.1",
+    "@tuturuuu/internal-api": "0.39.0",
+    "@tuturuuu/supabase": "0.5.2",
     "@upstash/ratelimit": "^2.0.8",
-    "@upstash/redis": "^1.38.3",
-    "cn": "^0.2.5",
+    "@upstash/redis": "^1.38.4",
+    "cn": "^0.3.0",
     "date-fns": "^4.4.0",
     "dayjs": "^1.11.23",
     "diff": "^9.0.0",
-    "effect": "^3.22.1",
+    "effect": "^3.22.2",
     "moment": "^2.30.1",
-    "next": "^16.3.4",
+    "next": "^16.3.5",
     "prosemirror-model": "^1.25.11",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
+    "server-only": "^0.0.1",
     "uuid": "^14.0.2",
     "y-prosemirror": "^1.3.7",
     "yjs": "^13.6.32",
-    "zod": "^4.5.4"
+    "zod": "^4.6.2"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.29.0",
+    "@tuturuuu/types": "0.31.0",
     "@tuturuuu/typescript-config": "0.1.2",
     "@types/diff": "^8.0.0",
-    "@types/node": "^26.4.1",
-    "@types/react": "^19.2.18",
+    "@types/node": "^26.5.1",
+    "@types/react": "~19.2.18",
     "@vitejs/plugin-react": "^6.1.1",
     "typescript": "7.0.2",
-    "vite": "^8.2.2",
+    "vite": "^8.3.0",
     "vitest": "^5.0.0"
   },
   "exports": {

package/src/__tests__/api-proxy-guard.test.ts

@@ -2231,45 +2231,38 @@ describe('guardApiProxyRequest', () => {
     expect(blockedResponse?.headers.get('X-RateLimit-Policy')).toBe('cron');
   });
 
-  it('bypasses trusted webhook traffic only with required signature headers', async () => {
+  it('rate limits webhook requests even with forged signature headers', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('POLAR_WEBHOOK_SECRET', 'polar-secret');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
     mocks.redis.mockReturnValue({});
-
-    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
-      await import('../api-proxy-guard.js');
-    clearApiProxyGuardLimiterCache();
-
-    const allowedResponse = await guardApiProxyRequest(
-      makeRequest('/api/payment/webhooks', 'POST', {
-        'webhook-id': 'id',
-        'webhook-signature': 'sig',
-        'webhook-timestamp': 'ts',
-      }),
-      { prefixBase: 'proxy:test:api' }
-    );
-
-    expect(allowedResponse).toBeNull();
-
     mocks.extractIp.mockReturnValue('1.2.3.4');
     mocks.isBlocked.mockResolvedValue(null);
-    mocks.limit.mockResolvedValueOnce({
+    mocks.limit.mockResolvedValue({
       success: false,
-      limit: 12,
+      limit: 30,
       remaining: 0,
       reset: Date.now() + 15_000,
     });
-
-    const blockedResponse = await guardApiProxyRequest(
-      makeRequest('/api/payment/webhooks', 'POST', {
+    const { guardApiProxyRequest } = await import('../api-proxy-guard.js');
+    const attempts: Record<string, string>[] = [
+      { 'webhook-id': 'id' },
+      {
         'webhook-id': 'id',
-      }),
-      { prefixBase: 'proxy:test:api' }
-    );
-
-    expect(blockedResponse?.status).toBe(429);
+        'webhook-signature': 'sig',
+        'webhook-timestamp': 'ts',
+      },
+    ];
+    for (const headers of attempts) {
+      const response = await guardApiProxyRequest(
+        makeRequest('/api/payment/webhooks', 'POST', headers),
+        { prefixBase: 'proxy:test:api' }
+      );
+      expect(response?.status).toBe(429);
+      expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
+    }
+    expect(mocks.limit).toHaveBeenCalledTimes(2);
   });
 
   it('delegates to emoji validation after rate limiting passes', async () => {

package/src/__tests__/app-url.test.ts

@@ -305,6 +305,7 @@ describe('Portless app origin registry', () => {
       'https://infra.tuturuuu.localhost',
       'https://inventory.tuturuuu.localhost',
       'https://learn.tuturuuu.localhost',
+      'https://lettin.tuturuuu.localhost',
       'https://mail.tuturuuu.localhost',
       'https://meet.tuturuuu.localhost',
       'https://mind.tuturuuu.localhost',

package/src/__tests__/workspace-principal-resolution.test.ts

@@ -0,0 +1,34 @@
+import { expect, it, vi } from 'vitest';
+
+vi.mock('@tuturuuu/supabase/next/server', () => ({
+  createAdminClient: vi.fn(),
+  createClient: vi.fn(),
+}));
+
+import {
+  resolveWorkspaceIdForPrincipal,
+  WorkspaceNotFoundError,
+  WorkspaceResolutionError,
+} from '../workspace-helper';
+
+it.each([
+  { error: null, Expected: WorkspaceNotFoundError },
+  { error: { message: 'unavailable' }, Expected: WorkspaceResolutionError },
+])(
+  'distinguishes a missing personal workspace from a database lookup failure (%s)',
+  async ({ error, Expected }) => {
+    const query = {
+      select: vi.fn().mockReturnThis(),
+      eq: vi.fn().mockReturnThis(),
+      maybeSingle: vi.fn().mockResolvedValue({ data: null, error }),
+    };
+    const db = { from: () => query };
+    await expect(
+      resolveWorkspaceIdForPrincipal({
+        authorizationClient: db as never,
+        principal: { id: 'actor', email: null },
+        wsId: 'personal',
+      })
+    ).rejects.toBeInstanceOf(Expected);
+  }
+);

package/src/api-proxy-guard.ts

@@ -628,14 +628,6 @@ function hasHeaderToken(
   return secrets.some((secret) => !!secret && headerValue === secret);
 }
 
-function hasPolarWebhookSignatureHeaders(headers: Headers) {
-  return (
-    !!headers.get('webhook-id') &&
-    !!headers.get('webhook-timestamp') &&
-    !!headers.get('webhook-signature')
-  );
-}
-
 const DEFAULT_TRUSTED_BYPASS_RULES: TrustedProxyBypassRule[] = [
   {
     matches: (pathname, headers) =>
@@ -654,13 +646,6 @@ const DEFAULT_TRUSTED_BYPASS_RULES: TrustedProxyBypassRule[] = [
           process.env.VERCEL_CRON_SECRET,
         ])),
   },
-  {
-    matches: (pathname, headers) =>
-      (pathname === '/api/payment/webhooks' ||
-        pathname.startsWith('/api/payment/webhooks/')) &&
-      !!process.env.POLAR_WEBHOOK_SECRET &&
-      hasPolarWebhookSignatureHeaders(headers),
-  },
   {
     matches: (pathname, headers) =>
       (pathname === '/api/v1/webhooks' ||

package/src/commercial-comparison-0.ts

@@ -0,0 +1,294 @@
+import type { ComparisonFeature } from './commercial-comparison-types';
+export const features0: ComparisonFeature[] = [
+  {
+    id: 'attachments',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['10', '10', '10', '10'],
+    detail: 'attachment',
+    pending: false,
+  },
+  {
+    id: 'publishers',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['8 / 96', '8 / 96', '8 / 96', '8 / 96'],
+    detail: 'meetSafety',
+    pending: false,
+  },
+  {
+    id: 'duration',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['2 h', '2 h', '2 h', '2 h'],
+    detail: 'meetSafety',
+    pending: false,
+  },
+  {
+    id: 'workspaces',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['10', '10', '10', '10'],
+    detail: 'account',
+    pending: false,
+  },
+  {
+    id: 'board',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['10', '50', '50', 'contract'],
+    detail: 'board',
+    pending: false,
+  },
+  {
+    id: 'responses',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['100', '1,000', '5,000', 'contract'],
+    detail: 'monthlyAllowance',
+    pending: true,
+  },
+  {
+    id: 'automation',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['100', '1,000', '5,000', 'contract'],
+    detail: 'monthlyAllowance',
+    pending: true,
+  },
+  {
+    id: 'aiCredits',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['1,000', '10,000', '30,000', 'contract'],
+    detail: 'aiAllowance',
+    pending: true,
+  },
+  {
+    id: 'storage',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['1 GiB', '20 GiB', '100 GiB', 'contract'],
+    detail: 'storageAllowance',
+    pending: true,
+  },
+  {
+    id: 'guests',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['10', '50', '250', 'contract'],
+    detail: 'guests',
+    pending: true,
+  },
+  {
+    id: 'members',
+    app: 'capacity',
+    category: 'capacity',
+    values: ['5', 'seats', 'seats', 'contract'],
+    detail: 'members',
+    pending: true,
+  },
+  {
+    id: 'platform_0',
+    app: 'platform',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'platform_1',
+    app: 'platform',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'platform_2',
+    app: 'platform',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'platform_3',
+    app: 'platform',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'platform_4',
+    app: 'platform',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'platform_5',
+    app: 'platform',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'tasks_0',
+    app: 'tasks',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'tasks_1',
+    app: 'tasks',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'tasks_2',
+    app: 'tasks',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'tasks_3',
+    app: 'tasks',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'tasks_4',
+    app: 'tasks',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'calendar_0',
+    app: 'calendar',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'calendar_1',
+    app: 'calendar',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'calendar_2',
+    app: 'calendar',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'track_0',
+    app: 'track',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'track_1',
+    app: 'track',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'track_2',
+    app: 'track',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'track_3',
+    app: 'track',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'standard',
+  },
+  {
+    id: 'drive_0',
+    app: 'drive',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'storage',
+  },
+  {
+    id: 'drive_1',
+    app: 'drive',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'storage',
+  },
+  {
+    id: 'drive_2',
+    app: 'drive',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'storage',
+  },
+  {
+    id: 'drive_3',
+    app: 'drive',
+    category: 'work',
+    values: ['included', 'included', 'included', 'included'],
+    detail: 'storage',
+  },
+  {
+    id: 'chat_0',
+    app: 'chat',
+    category: 'work',
+    values: ['excluded', 'included', 'included', 'included'],
+    detail: 'storage',
+  },
+  {
+    id: 'chat_1',
+    app: 'chat',
+    category: 'work',
+    values: ['excluded', 'included', 'included', 'included'],
+    detail: 'storage',
+  },
+  {
+    id: 'chat_2',
+    app: 'chat',
+    category: 'work',
+    values: ['excluded', 'included', 'included', 'included'],
+    detail: 'storage',
+  },
+  {
+    id: 'meet_0',
+    app: 'meet',
+    category: 'work',
+    values: ['preview', 'preview', 'preview', 'preview'],
+    detail: 'standard',
+  },
+  {
+    id: 'meet_1',
+    app: 'meet',
+    category: 'work',
+    values: ['preview', 'preview', 'preview', 'preview'],
+    detail: 'standard',
+  },
+  {
+    id: 'meet_2',
+    app: 'meet',
+    category: 'work',
+    values: ['preview', 'preview', 'preview', 'preview'],
+    detail: 'standard',
+  },
+  {
+    id: 'meet_3',
+    app: 'meet',
+    category: 'work',
+    values: ['preview', 'preview', 'preview', 'preview'],
+    detail: 'standard',
+  },
+];