@tuturuuu/utils 0.31.0 → 0.33.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## [0.33.0](https://github.com/tutur3u/platform/compare/utils-v0.32.0...utils-v0.33.0) (2026-09-29)
+
+
+### Features
+
+* **auth:** enforce required account MFA lifecycle ([#5448](https://github.com/tutur3u/platform/issues/5448)) ([d7a5ed4](https://github.com/tutur3u/platform/commit/d7a5ed453963e619bd1dc3bd8c8a18c5e027317c))
+* **cron:** gate immediate recovery on Cloudflare ([546f389](https://github.com/tutur3u/platform/commit/546f3899143c09d52dfa198698b1c4310b860db2)) ([#5615](https://github.com/tutur3u/platform/issues/5615)) ([8eac476](https://github.com/tutur3u/platform/commit/8eac47606da1e1295cb3e6c80c96e5b4d3750068))
+* **devboxes:** route agent control through Cloudflare ([98d4580](https://github.com/tutur3u/platform/commit/98d4580b39308fdd835e1762ebad102fe6ca3f02)) ([#5614](https://github.com/tutur3u/platform/issues/5614)) ([cbd18fa](https://github.com/tutur3u/platform/commit/cbd18fa70ee2d88c8b7e607ab56631c581b723c9))
+* **parley:** add private multiplayer training and shared AI Hub billing ([#5505](https://github.com/tutur3u/platform/issues/5505)) ([038e05c](https://github.com/tutur3u/platform/commit/038e05c69a0e4a080f62d6441ae4dd2b15721dba))
+* **parley:** share Meet runtime and integrate private training with AI Hub billing ([66d40e2](https://github.com/tutur3u/platform/commit/66d40e23a8110bd43be652e1181205cf50e506ab))
+
+
+### Bug Fixes
+
+* **devboxes:** load Durable Object base and register internal app ([50a4ed0](https://github.com/tutur3u/platform/commit/50a4ed0dd5f639c44f513e6d7e2ca663452b76bb))
+
+## [0.32.0](https://github.com/tutur3u/platform/compare/utils-v0.31.0...utils-v0.32.0) (2026-09-29)
+
+
+### Features
+
+* **cron:** gate immediate recovery on Cloudflare ([546f389](https://github.com/tutur3u/platform/commit/546f3899143c09d52dfa198698b1c4310b860db2)) ([#5615](https://github.com/tutur3u/platform/issues/5615)) ([8eac476](https://github.com/tutur3u/platform/commit/8eac47606da1e1295cb3e6c80c96e5b4d3750068))
+* **devboxes:** route agent control through Cloudflare ([98d4580](https://github.com/tutur3u/platform/commit/98d4580b39308fdd835e1762ebad102fe6ca3f02)) ([#5614](https://github.com/tutur3u/platform/issues/5614)) ([cbd18fa](https://github.com/tutur3u/platform/commit/cbd18fa70ee2d88c8b7e607ab56631c581b723c9))
+
+
+### Bug Fixes
+
+* **devboxes:** load Durable Object base and register internal app ([50a4ed0](https://github.com/tutur3u/platform/commit/50a4ed0dd5f639c44f513e6d7e2ca663452b76bb))
+
 ## [0.31.0](https://github.com/tutur3u/platform/compare/utils-v0.30.0...utils-v0.31.0) (2026-09-25)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,7 +24,7 @@
     "@tiptap/react": "3.31.3",
     "@tuturuuu/google": "0.1.1",
     "@tuturuuu/icons": "0.1.1",
-    "@tuturuuu/internal-api": "0.42.0",
+    "@tuturuuu/internal-api": "0.47.0",
     "@tuturuuu/supabase": "0.5.2",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.4",

package/src/commercial-comparison.ts

@@ -9,6 +9,20 @@ import { features2 } from './commercial-comparison-2';
 
 const gateOrder = ['FREE', 'PLUS', 'PRO', 'ENTERPRISE'];
 const advanced: ComparisonFeature[] = [
+  {
+    id: 'cronControl',
+    app: 'cron-control',
+    category: 'internal',
+    detail: 'standard',
+    values: ['internal', 'internal', 'internal', 'internal'],
+  },
+  {
+    id: 'devboxControl',
+    app: 'devbox-control',
+    category: 'internal',
+    detail: 'standard',
+    values: ['internal', 'internal', 'internal', 'internal'],
+  },
   {
     id: 'parley_0',
     app: 'parley',

package/src/devbox-control.ts

@@ -0,0 +1,23 @@
+/** Best-effort wake signal. The runner also polls, so enqueue never depends on it. */
+export async function notifyDevboxRun(runId: string) {
+  const origin = process.env.TUTURUUU_DEVBOX_CONTROL_URL?.trim();
+  const token = process.env.TUTURUUU_DEVBOX_CONTROL_TOKEN?.trim();
+  if (!origin || !token) return;
+  try {
+    const url = new URL('/v1/notify', origin);
+    if (url.protocol !== 'https:') throw new Error('Invalid control URL');
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ runId }),
+      signal: AbortSignal.timeout(2000),
+    });
+    if (!response.ok)
+      console.warn('Devbox wake signal rejected', response.status);
+  } catch {
+    console.warn('Devbox wake signal unavailable');
+  }
+}

package/src/email/__tests__/client.test.ts

@@ -5,6 +5,7 @@ import {
   isEmail,
   isExactTuturuuuDotComEmail,
   isIncompleteEmail,
+  isTuturuuuReviewEmail,
   isValidTuturuuuEmail,
   suggestEmails,
 } from '../client';
@@ -90,6 +91,16 @@ describe('isExactTuturuuuDotComEmail', () => {
   });
 });
 
+describe('isTuturuuuReviewEmail', () => {
+  it('accepts only the routed non-staff review domain', () => {
+    expect(isTuturuuuReviewEmail('APP-REVIEW@TUTUR3U.COM')).toBe(true);
+    expect(isTuturuuuReviewEmail('review@tuturuuu.com')).toBe(false);
+    expect(isTuturuuuReviewEmail('review@xwf.tuturuuu.com')).toBe(false);
+    expect(isTuturuuuReviewEmail('review@sub.tutur3u.com')).toBe(false);
+    expect(isTuturuuuReviewEmail('review@tutur3u.com.evil.test')).toBe(false);
+  });
+});
+
 describe('isEmail', () => {
   it('validates complex email formats', () => {
     expect(isEmail('user.name+alias@example.co.uk')).toBe(true);

package/src/email/client.ts

@@ -31,6 +31,12 @@ export const isExactTuturuuuDotComEmail = (email?: string | null): boolean => {
   return /^[^\s@]+@tuturuuu\.com$/i.test(email.trim());
 };
 
+/** Routed QA domain. It is deliberately outside all staff-email allowlists. */
+export const isTuturuuuReviewEmail = (email?: string | null): boolean => {
+  if (!email) return false;
+  return /^[^\s@]+@tutur3u\.com$/i.test(email.trim());
+};
+
 export const isEmail = (text: string): boolean => {
   const emailRegex =
     /^(?:[^<>()[\]\\.,;:\s@"]+(?:\.[^<>()[\]\\.,;:\s@"]+)*|".+")@(?:\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}]|(?:[a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,})$/;

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.55.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.62.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.55.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.62.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */