@tuturuuu/utils 0.28.0 → 0.29.1

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [0.29.1](https://github.com/tutur3u/platform/compare/utils-v0.29.0...utils-v0.29.1) (2026-09-23)
+
+
+### Bug Fixes
+
+* **auth:** reuse completed session-bound challenges ([b63d510](https://github.com/tutur3u/platform/commit/b63d51046b427350d959137cf37058223e544788))
+* **mobile:** repair Live persistence and reuse session verification ([#5436](https://github.com/tutur3u/platform/issues/5436)) ([cb452e1](https://github.com/tutur3u/platform/commit/cb452e1908eab3db2dce9dfd1d57d721284a2e49))
+
+## [0.29.0](https://github.com/tutur3u/platform/compare/utils-v0.28.0...utils-v0.29.0) (2026-09-20)
+
+
+### Features
+
+* **infrastructure:** coordinate authenticator and meeting leases on Cloudflare ([2582bf2](https://github.com/tutur3u/platform/commit/2582bf2f72670e1f2696de80820eddd118c27d29))
+* **infrastructure:** use Cloudflare for authenticator and meeting coordination ([#5411](https://github.com/tutur3u/platform/issues/5411)) ([a154602](https://github.com/tutur3u/platform/commit/a15460282959831fe617494126d9955b772957aa))
+* **lettin:** add Cloudflare worldbuilding satellite ([0c8cc22](https://github.com/tutur3u/platform/commit/0c8cc22168477440e326bdec08427daf9721d9bf)) ([#5351](https://github.com/tutur3u/platform/issues/5351)) ([2631103](https://github.com/tutur3u/platform/commit/263110318bb9bab6d26a1bdd539fc52a40b25bec))
+* **meet:** publish invite previews and extend paid call limits ([7cf3d6b](https://github.com/tutur3u/platform/commit/7cf3d6b97b0f353e83e894dcc8c83e0d2b6d7a3b))
+* **meet:** turn notes into reviewed calendar and task follow-ups ([#5359](https://github.com/tutur3u/platform/issues/5359)) ([3914a41](https://github.com/tutur3u/platform/commit/3914a41828e6e837add7f55a3f05a5b42e31f98e))
+* **meet:** unlock hosting for verified paid accounts ([00a0168](https://github.com/tutur3u/platform/commit/00a016891845b43ba0297730937fa68d6e465de8))
+* **meet:** unlock paid hosting, longer calls and public previews ([#5364](https://github.com/tutur3u/platform/issues/5364)) ([a6687ff](https://github.com/tutur3u/platform/commit/a6687ffccda096f2ab9da850bf0ddfe8e04c3cf2))
+* **pricing:** add full app comparison and evolving pitch deck ([c967e8d](https://github.com/tutur3u/platform/commit/c967e8d2db75fc65159c7dcb31ed1b27673ae924))
+* **pricing:** compare every app and add an evolving pitch deck ([#5335](https://github.com/tutur3u/platform/issues/5335)) ([962ed75](https://github.com/tutur3u/platform/commit/962ed75e086eb85a06a878720a5d30b747e7ba82))
+
+
+### Bug Fixes
+
+* **billing:** fail closed on unknown usage and subscription capacity ([ccfcba4](https://github.com/tutur3u/platform/commit/ccfcba46f236981b1d4e59e1c389bee8472b2ca8)) ([#5333](https://github.com/tutur3u/platform/issues/5333)) ([a308a89](https://github.com/tutur3u/platform/commit/a308a8996f17a81c76c8fb0d498a14d8dbf289c3))
+* **deps:** align React types and published consumer ranges ([3612cd8](https://github.com/tutur3u/platform/commit/3612cd81723fb5a6982152688227ed21bc4095fd))
+* **deps:** preserve React peer compatibility and clarify audit ([777b9ed](https://github.com/tutur3u/platform/commit/777b9ed7f42095bb9361e6bed94d989310c222de))
+* **meet:** fail closed and release rejected follow-up receipts ([c13a295](https://github.com/tutur3u/platform/commit/c13a295c1fabcf8605fb05b2d6a5042db3213426))
+* **payment:** protect webhook ingress and restore order cron ([e059fc7](https://github.com/tutur3u/platform/commit/e059fc74f4eff9e938823b1bd02b42093adc632e))
+* **payment:** restore catalog webhook delivery and guard publication ([#5342](https://github.com/tutur3u/platform/issues/5342)) ([b5f61ec](https://github.com/tutur3u/platform/commit/b5f61ec25617b09245c117e47081544edafa454a))
+* **pricing:** reconcile live catalog displays and tier comparisons ([3aa65c2](https://github.com/tutur3u/platform/commit/3aa65c2221d0d099ff5bd50de0c90bb4237d1bbd))
+* **tasks:** align filtered counts and local task visibility ([913388b](https://github.com/tutur3u/platform/commit/913388b78767f927685df695398da030ad73bf82))
+* **tasks:** show unprioritized tasks first across paginated views ([1a5dffc](https://github.com/tutur3u/platform/commit/1a5dffccf45fc1a9c20353d19d843d3c66c22379))
+* **tasks:** surface unprioritized tasks before paginating ([#5315](https://github.com/tutur3u/platform/issues/5315)) ([496627b](https://github.com/tutur3u/platform/commit/496627b85688b0030199310ad21bd21cf2a92f72))
+* **utils:** declare server-only runtime dependency ([172674d](https://github.com/tutur3u/platform/commit/172674d9168092acf1270fb09050a59d9efcbed6))
+
 ## [0.28.0](https://github.com/tutur3u/platform/compare/utils-v0.27.1...utils-v0.28.0) (2026-09-07)
 
 

package/biome.json

@@ -1,5 +1,5 @@
 {
   "root": false,
-  "$schema": "https://biomejs.dev/schemas/2.5.12/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.13/schema.json",
   "extends": "//"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.28.0",
+  "version": "0.29.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -20,38 +20,39 @@
     "@noble/ciphers": "^2.4.0",
     "@noble/hashes": "^2.4.0",
     "@tanstack/react-query": "^5.102.8",
-    "@tiptap/core": "3.31.2",
-    "@tiptap/react": "3.31.2",
-    "@tuturuuu/google": "0.1.0",
-    "@tuturuuu/icons": "0.1.0",
-    "@tuturuuu/internal-api": "0.34.0",
-    "@tuturuuu/supabase": "0.5.1",
+    "@tiptap/core": "3.31.3",
+    "@tiptap/react": "3.31.3",
+    "@tuturuuu/google": "0.1.1",
+    "@tuturuuu/icons": "0.1.1",
+    "@tuturuuu/internal-api": "0.40.0",
+    "@tuturuuu/supabase": "0.5.2",
     "@upstash/ratelimit": "^2.0.8",
-    "@upstash/redis": "^1.38.3",
-    "cn": "^0.2.5",
+    "@upstash/redis": "^1.38.4",
+    "cn": "^0.3.0",
     "date-fns": "^4.4.0",
     "dayjs": "^1.11.23",
     "diff": "^9.0.0",
-    "effect": "^3.22.1",
+    "effect": "^3.22.2",
     "moment": "^2.30.1",
-    "next": "^16.3.4",
+    "next": "^16.3.5",
     "prosemirror-model": "^1.25.11",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
+    "server-only": "^0.0.1",
     "uuid": "^14.0.2",
     "y-prosemirror": "^1.3.7",
     "yjs": "^13.6.32",
-    "zod": "^4.5.4"
+    "zod": "^4.6.2"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.29.0",
+    "@tuturuuu/types": "0.31.0",
     "@tuturuuu/typescript-config": "0.1.2",
     "@types/diff": "^8.0.0",
-    "@types/node": "^26.4.1",
-    "@types/react": "^19.2.18",
+    "@types/node": "^26.5.1",
+    "@types/react": "~19.2.18",
     "@vitejs/plugin-react": "^6.1.1",
     "typescript": "7.0.2",
-    "vite": "^8.2.2",
+    "vite": "^8.3.0",
     "vitest": "^5.0.0"
   },
   "exports": {

package/src/__tests__/api-proxy-guard.test.ts

@@ -2231,45 +2231,38 @@ describe('guardApiProxyRequest', () => {
     expect(blockedResponse?.headers.get('X-RateLimit-Policy')).toBe('cron');
   });
 
-  it('bypasses trusted webhook traffic only with required signature headers', async () => {
+  it('rate limits webhook requests even with forged signature headers', async () => {
     vi.stubEnv('NODE_ENV', 'production');
     vi.stubEnv('POLAR_WEBHOOK_SECRET', 'polar-secret');
     vi.stubEnv('UPSTASH_REDIS_REST_URL', 'https://redis.test');
     vi.stubEnv('UPSTASH_REDIS_REST_TOKEN', 'token');
     mocks.redis.mockReturnValue({});
-
-    const { guardApiProxyRequest, clearApiProxyGuardLimiterCache } =
-      await import('../api-proxy-guard.js');
-    clearApiProxyGuardLimiterCache();
-
-    const allowedResponse = await guardApiProxyRequest(
-      makeRequest('/api/payment/webhooks', 'POST', {
-        'webhook-id': 'id',
-        'webhook-signature': 'sig',
-        'webhook-timestamp': 'ts',
-      }),
-      { prefixBase: 'proxy:test:api' }
-    );
-
-    expect(allowedResponse).toBeNull();
-
     mocks.extractIp.mockReturnValue('1.2.3.4');
     mocks.isBlocked.mockResolvedValue(null);
-    mocks.limit.mockResolvedValueOnce({
+    mocks.limit.mockResolvedValue({
       success: false,
-      limit: 12,
+      limit: 30,
       remaining: 0,
       reset: Date.now() + 15_000,
     });
-
-    const blockedResponse = await guardApiProxyRequest(
-      makeRequest('/api/payment/webhooks', 'POST', {
+    const { guardApiProxyRequest } = await import('../api-proxy-guard.js');
+    const attempts: Record<string, string>[] = [
+      { 'webhook-id': 'id' },
+      {
         'webhook-id': 'id',
-      }),
-      { prefixBase: 'proxy:test:api' }
-    );
-
-    expect(blockedResponse?.status).toBe(429);
+        'webhook-signature': 'sig',
+        'webhook-timestamp': 'ts',
+      },
+    ];
+    for (const headers of attempts) {
+      const response = await guardApiProxyRequest(
+        makeRequest('/api/payment/webhooks', 'POST', headers),
+        { prefixBase: 'proxy:test:api' }
+      );
+      expect(response?.status).toBe(429);
+      expect(response?.headers.get('X-RateLimit-Policy')).toBe('default');
+    }
+    expect(mocks.limit).toHaveBeenCalledTimes(2);
   });
 
   it('delegates to emoji validation after rate limiting passes', async () => {

package/src/__tests__/app-url.test.ts

@@ -305,6 +305,7 @@ describe('Portless app origin registry', () => {
       'https://infra.tuturuuu.localhost',
       'https://inventory.tuturuuu.localhost',
       'https://learn.tuturuuu.localhost',
+      'https://lettin.tuturuuu.localhost',
       'https://mail.tuturuuu.localhost',
       'https://meet.tuturuuu.localhost',
       'https://mind.tuturuuu.localhost',

package/src/__tests__/workspace-principal-resolution.test.ts

@@ -0,0 +1,34 @@
+import { expect, it, vi } from 'vitest';
+
+vi.mock('@tuturuuu/supabase/next/server', () => ({
+  createAdminClient: vi.fn(),
+  createClient: vi.fn(),
+}));
+
+import {
+  resolveWorkspaceIdForPrincipal,
+  WorkspaceNotFoundError,
+  WorkspaceResolutionError,
+} from '../workspace-helper';
+
+it.each([
+  { error: null, Expected: WorkspaceNotFoundError },
+  { error: { message: 'unavailable' }, Expected: WorkspaceResolutionError },
+])(
+  'distinguishes a missing personal workspace from a database lookup failure (%s)',
+  async ({ error, Expected }) => {
+    const query = {
+      select: vi.fn().mockReturnThis(),
+      eq: vi.fn().mockReturnThis(),
+      maybeSingle: vi.fn().mockResolvedValue({ data: null, error }),
+    };
+    const db = { from: () => query };
+    await expect(
+      resolveWorkspaceIdForPrincipal({
+        authorizationClient: db as never,
+        principal: { id: 'actor', email: null },
+        wsId: 'personal',
+      })
+    ).rejects.toBeInstanceOf(Expected);
+  }
+);

package/src/abuse-protection/__tests__/reputation.test.ts

@@ -1,8 +1,10 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 const mockRpc = vi.fn();
+const mockFrom = vi.fn();
 const mockCreateAdminClient = vi.fn(() => ({
   rpc: mockRpc,
+  from: mockFrom,
 }));
 
 vi.mock('@tuturuuu/supabase/next/server', () => ({
@@ -28,6 +30,111 @@ describe('adaptive abuse reputation', () => {
     mockRpc.mockResolvedValue({ data: [], error: null });
   });
 
+  it('binds native subjects to authenticated bearer credentials, never a raw token or an anonymous caller', () => {
+    const subjects = (token: string, userId?: string) =>
+      buildAbuseRiskSubjects({
+        headers: { authorization: `Bearer ${token}` },
+        userId,
+      });
+    expect(subjects('secret', 'caller')).toContainEqual(
+      expect.objectContaining({ subject_type: 'session' })
+    );
+    expect(JSON.stringify(subjects('secret', 'caller'))).not.toContain(
+      'secret'
+    );
+    expect(subjects('secret', 'caller')).not.toEqual(
+      subjects('rotated', 'caller')
+    );
+    expect(subjects('secret')).toEqual([]);
+  });
+
+  it.each([true, false])(
+    'reuses only a recent passed challenge for this authenticated session: %s',
+    async (passed) => {
+      const lookup = {
+        select: vi.fn().mockReturnThis(),
+        eq: vi.fn().mockReturnThis(),
+        gt: vi.fn().mockReturnThis(),
+        gte: vi.fn().mockReturnThis(),
+        order: vi.fn().mockReturnThis(),
+        limit: vi.fn().mockResolvedValue({
+          data: passed ? [{ id: 'proof' }] : [],
+          error: null,
+        }),
+      };
+      mockFrom.mockReturnValue(lookup);
+      const decision = await resolveAbuseRiskDecision({
+        authKind: 'session',
+        headers: {
+          authorization: 'Bearer session-token',
+          'user-agent': 'Dart/3.9 (dart:io)',
+        },
+        isRead: false,
+        method: 'POST',
+        route: '/tasks',
+        userId: 'caller',
+      });
+      expect(decision.tier).toBe(passed ? 'standard' : 'challenge_required');
+      expect(decision.trustMultiplier).toBe(1);
+      expect(lookup.eq).toHaveBeenCalledWith('user_id', 'caller');
+      expect(lookup.eq).toHaveBeenCalledWith(
+        'subject_key',
+        decision.subjects.find((subject) => subject.subject_type === 'session')
+          ?.subject_key
+      );
+      expect(lookup.eq).toHaveBeenCalledWith('status', 'passed');
+      expect(lookup.gt).toHaveBeenCalledWith(
+        'expires_at',
+        '2026-05-17T00:00:00.000Z'
+      );
+      expect(lookup.gte).toHaveBeenCalledWith(
+        'completed_at',
+        '2026-05-16T23:45:00.000Z'
+      );
+    }
+  );
+
+  it.each(['restricted', 'challenge_required'])(
+    'never overrides explicit server policy: %s',
+    async (tier) => {
+      mockRpc.mockResolvedValue({
+        data: [{ tier, trust_multiplier: 1, decision_source: 'override' }],
+        error: null,
+      });
+      const decision = await resolveAbuseRiskDecision({
+        authKind: 'session',
+        headers: {
+          authorization: 'Bearer session-token',
+          'user-agent': 'Dart/3.9 (dart:io)',
+        },
+        isRead: false,
+        method: 'POST',
+        route: '/tasks',
+        userId: 'caller',
+      });
+      expect(decision.tier).toBe(tier);
+      expect(mockFrom).not.toHaveBeenCalled();
+    }
+  );
+
+  it('fails closed when challenge storage is unavailable', async () => {
+    mockFrom.mockImplementation(() => {
+      throw new Error('offline');
+    });
+    const decision = await resolveAbuseRiskDecision({
+      authKind: 'session',
+      headers: {
+        authorization: 'Bearer session-token',
+        'user-agent': 'Dart/3.9 (dart:io)',
+      },
+      isRead: false,
+      method: 'POST',
+      route: '/tasks',
+      userId: 'caller',
+    });
+    expect(decision.tier).toBe('challenge_required');
+  });
+
   it('does not earn trust from old account and browser shape alone', async () => {
     const decision = await resolveAbuseRiskDecision({
       authKind: 'session',

package/src/abuse-protection/reputation.ts

@@ -192,6 +192,9 @@ function readHeader(
 function getSessionSubjectKey(
   headers: Headers | Map<string, string> | Record<string, string | null>
 ) {
+  const authorization = readHeader(headers, 'authorization');
+  const bearer = authorization?.match(/^Bearer ([^\s]+)$/i)?.[1];
+  if (bearer) return `session:${hashStableSubject(`bearer:${bearer}`)}`;
   const cookies = parseCookieHeader(readHeader(headers, 'cookie'));
   const authCookie = cookies.find(
     (cookie) =>
@@ -304,7 +307,7 @@ export function buildAbuseRiskSubjects({
     subjects.push({ subject_type: 'user', subject_key: `user:${userId}` });
   }
 
-  if (sessionKey) {
+  if (sessionKey && userId && !apiKeyId) {
     subjects.push({ subject_type: 'session', subject_key: sessionKey });
   }
 
@@ -365,6 +368,34 @@ async function loadServerTrustDecision({
   }
 }
 
+async function hasRecentSessionChallenge(
+  userId: string | null | undefined,
+  subjects: AbuseRiskSubject[]
+) {
+  const session = subjects.find(
+    (subject) => subject.subject_type === 'session'
+  );
+  if (!userId || !session) return false;
+  const supabase = await getSupabaseAdmin();
+  if (!supabase) return false;
+  try {
+    const now = new Date();
+    const { data, error } = await supabase
+      .from('abuse_step_up_challenges')
+      .select('id')
+      .eq('user_id', userId)
+      .eq('subject_key', session.subject_key)
+      .eq('status', 'passed')
+      .gt('expires_at', now.toISOString())
+      .gte('completed_at', new Date(now.getTime() - 15 * 60_000).toISOString())
+      .order('completed_at', { ascending: false })
+      .limit(1);
+    return !error && Boolean(data?.length);
+  } catch {
+    return false;
+  }
+}
+
 export async function resolveAbuseRiskDecision(
   input: ResolveAbuseRiskDecisionInput
 ): Promise<AbuseRiskDecision> {
@@ -432,11 +463,19 @@ export async function resolveAbuseRiskDecision(
     (!likelyBrowser || userAgentClassification.riskLevel === 'block');
 
   if (suspiciousBrowserMutation && tier !== 'restricted') {
-    tier = 'challenge_required';
+    // A completed session-bound challenge satisfies the browser-shape
+    // heuristic only. Server restrictions and explicit challenges still win.
+    const cleared =
+      serverDecision?.tier !== 'challenge_required' &&
+      (input.authKind === 'session' || input.authKind === 'app-session') &&
+      (await hasRecentSessionChallenge(input.userId, subjects));
+    tier = cleared ? 'standard' : 'challenge_required';
     trustMultiplier = 1;
     decisionSource = 'heuristic';
     subjectKey ??= subjects[0]?.subject_key ?? null;
-    reasons.push('suspicious_browser_mutation');
+    reasons.push(
+      cleared ? 'session_challenge_passed' : 'suspicious_browser_mutation'
+    );
   } else if (
     tier === 'trusted' &&
     userAgentClassification.riskLevel === 'block'

package/src/api-proxy-guard.ts

@@ -628,14 +628,6 @@ function hasHeaderToken(
   return secrets.some((secret) => !!secret && headerValue === secret);
 }
 
-function hasPolarWebhookSignatureHeaders(headers: Headers) {
-  return (
-    !!headers.get('webhook-id') &&
-    !!headers.get('webhook-timestamp') &&
-    !!headers.get('webhook-signature')
-  );
-}
-
 const DEFAULT_TRUSTED_BYPASS_RULES: TrustedProxyBypassRule[] = [
   {
     matches: (pathname, headers) =>
@@ -654,13 +646,6 @@ const DEFAULT_TRUSTED_BYPASS_RULES: TrustedProxyBypassRule[] = [
           process.env.VERCEL_CRON_SECRET,
         ])),
   },
-  {
-    matches: (pathname, headers) =>
-      (pathname === '/api/payment/webhooks' ||
-        pathname.startsWith('/api/payment/webhooks/')) &&
-      !!process.env.POLAR_WEBHOOK_SECRET &&
-      hasPolarWebhookSignatureHeaders(headers),
-  },
   {
     matches: (pathname, headers) =>
       (pathname === '/api/v1/webhooks' ||