@tuturuuu/utils 0.32.0 → 0.33.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.33.1](https://github.com/tutur3u/platform/compare/utils-v0.33.0...utils-v0.33.1) (2026-09-29)
+
+
+### Bug Fixes
+
+* **infrastructure:** isolate app review identities from staff access ([#5632](https://github.com/tutur3u/platform/issues/5632)) ([ecad401](https://github.com/tutur3u/platform/commit/ecad4019f602317b59d37500cd8049d1602d11fa))
+
+## [0.33.0](https://github.com/tutur3u/platform/compare/utils-v0.32.0...utils-v0.33.0) (2026-09-29)
+
+
+### Features
+
+* **auth:** enforce required account MFA lifecycle ([#5448](https://github.com/tutur3u/platform/issues/5448)) ([d7a5ed4](https://github.com/tutur3u/platform/commit/d7a5ed453963e619bd1dc3bd8c8a18c5e027317c))
+* **cron:** gate immediate recovery on Cloudflare ([546f389](https://github.com/tutur3u/platform/commit/546f3899143c09d52dfa198698b1c4310b860db2)) ([#5615](https://github.com/tutur3u/platform/issues/5615)) ([8eac476](https://github.com/tutur3u/platform/commit/8eac47606da1e1295cb3e6c80c96e5b4d3750068))
+* **devboxes:** route agent control through Cloudflare ([98d4580](https://github.com/tutur3u/platform/commit/98d4580b39308fdd835e1762ebad102fe6ca3f02)) ([#5614](https://github.com/tutur3u/platform/issues/5614)) ([cbd18fa](https://github.com/tutur3u/platform/commit/cbd18fa70ee2d88c8b7e607ab56631c581b723c9))
+* **parley:** add private multiplayer training and shared AI Hub billing ([#5505](https://github.com/tutur3u/platform/issues/5505)) ([038e05c](https://github.com/tutur3u/platform/commit/038e05c69a0e4a080f62d6441ae4dd2b15721dba))
+* **parley:** share Meet runtime and integrate private training with AI Hub billing ([66d40e2](https://github.com/tutur3u/platform/commit/66d40e23a8110bd43be652e1181205cf50e506ab))
+
+
+### Bug Fixes
+
+* **devboxes:** load Durable Object base and register internal app ([50a4ed0](https://github.com/tutur3u/platform/commit/50a4ed0dd5f639c44f513e6d7e2ca663452b76bb))
+
 ## [0.32.0](https://github.com/tutur3u/platform/compare/utils-v0.31.0...utils-v0.32.0) (2026-09-29)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.32.0",
+  "version": "0.33.1",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -24,7 +24,7 @@
     "@tiptap/react": "3.31.3",
     "@tuturuuu/google": "0.1.1",
     "@tuturuuu/icons": "0.1.1",
-    "@tuturuuu/internal-api": "0.46.0",
+    "@tuturuuu/internal-api": "0.47.0",
     "@tuturuuu/supabase": "0.5.2",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.4",

package/src/email/__tests__/client.test.ts

@@ -5,6 +5,7 @@ import {
   isEmail,
   isExactTuturuuuDotComEmail,
   isIncompleteEmail,
+  isTuturuuuReviewEmail,
   isValidTuturuuuEmail,
   suggestEmails,
 } from '../client';
@@ -90,6 +91,16 @@ describe('isExactTuturuuuDotComEmail', () => {
   });
 });
 
+describe('isTuturuuuReviewEmail', () => {
+  it('accepts only the routed non-staff review domain', () => {
+    expect(isTuturuuuReviewEmail('APP-REVIEW@TUTUR3U.COM')).toBe(true);
+    expect(isTuturuuuReviewEmail('review@tuturuuu.com')).toBe(false);
+    expect(isTuturuuuReviewEmail('review@xwf.tuturuuu.com')).toBe(false);
+    expect(isTuturuuuReviewEmail('review@sub.tutur3u.com')).toBe(false);
+    expect(isTuturuuuReviewEmail('review@tutur3u.com.evil.test')).toBe(false);
+  });
+});
+
 describe('isEmail', () => {
   it('validates complex email formats', () => {
     expect(isEmail('user.name+alias@example.co.uk')).toBe(true);

package/src/email/client.ts

@@ -31,6 +31,12 @@ export const isExactTuturuuuDotComEmail = (email?: string | null): boolean => {
   return /^[^\s@]+@tuturuuu\.com$/i.test(email.trim());
 };
 
+/** Routed QA domain. It is deliberately outside all staff-email allowlists. */
+export const isTuturuuuReviewEmail = (email?: string | null): boolean => {
+  if (!email) return false;
+  return /^[^\s@]+@tutur3u\.com$/i.test(email.trim());
+};
+
 export const isEmail = (text: string): boolean => {
   const emailRegex =
     /^(?:[^<>()[\]\\.,;:\s@"]+(?:\.[^<>()[\]\\.,;:\s@"]+)*|".+")@(?:\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}]|(?:[a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,})$/;

package/src/platform-release.test.ts

@@ -7,7 +7,7 @@ import {
 
 describe('platform release metadata', () => {
   it('uses the centralized shared browser app version', () => {
-    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.61.0'); // x-release-please-version
+    expect(TUTURUUU_PLATFORM_VERSION).toBe('0.63.0'); // x-release-please-version
   });
 
   it('preserves the source timestamp in builtAt and derives a short hash', () => {

package/src/platform-release.ts

@@ -1,6 +1,6 @@
 import { PLATFORM_BUILD_METADATA } from './generated/platform-build-metadata';
 
-export const TUTURUUU_PLATFORM_VERSION = '0.61.0'; // x-release-please-version
+export const TUTURUUU_PLATFORM_VERSION = '0.63.0'; // x-release-please-version
 
 export type PlatformBuildMetadataInput = {
   /** ISO timestamp of the source commit used for the build, not deployment time. */