@tuturuuu/utils 0.33.3 → 0.35.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## [0.35.0](https://github.com/tutur3u/platform/compare/utils-v0.34.0...utils-v0.35.0) (2026-10-09)
+
+
+### Features
+
+* **docs:** expand platform guides and enforce app SEO and runtime pause ([e79cb7e](https://github.com/tutur3u/platform/commit/e79cb7e96c7db4d1baedb09b7420ca41b75e367f))
+* **docs:** expand platform guides, enforce SEO, and pause inactive runtimes ([#6085](https://github.com/tutur3u/platform/issues/6085)) ([df7a159](https://github.com/tutur3u/platform/commit/df7a159e9c657fee4f6e0b593c776d6887b2ae11))
+* **tutoring:** define teacher hours domain contract ([b6fa164](https://github.com/tutur3u/platform/commit/b6fa1647d0c6afd9788778de7648d34b037dde61)) ([#6001](https://github.com/tutur3u/platform/issues/6001)) ([c23e08a](https://github.com/tutur3u/platform/commit/c23e08a403fbf59b3b74cc1650f3abc1505ad1aa))
+
+
+### Bug Fixes
+
+* **calendar:** stabilize civil dates and today rendering ([c1abdf0](https://github.com/tutur3u/platform/commit/c1abdf0df75c0a02cc00c37b7a0a5e55c862bf89)) ([#5950](https://github.com/tutur3u/platform/issues/5950)) ([5a00326](https://github.com/tutur3u/platform/commit/5a00326171bec65ec7210de161dd5272bfda22b2))
+* **finance:** reconcile attendance summary with current main ([fb00e6e](https://github.com/tutur3u/platform/commit/fb00e6ef4373adc1b6b9107f9bba883c101c3438))
+* **utils:** keep teacher-hours tests within package boundary ([bf55e46](https://github.com/tutur3u/platform/commit/bf55e46d5a842d70ea87c03b9b0e40c65c14f60d)) ([#6006](https://github.com/tutur3u/platform/issues/6006)) ([1039959](https://github.com/tutur3u/platform/commit/1039959d7258ed9fc612c0871ae575a71f3e4fe8))
+
+
+### Performance Improvements
+
+* **calendar:** reject oversized recurrence scans before expansion ([ac3441b](https://github.com/tutur3u/platform/commit/ac3441b4881b9ef0f8f380fdcf22c46e8794e145)) ([#5908](https://github.com/tutur3u/platform/issues/5908)) ([f662fef](https://github.com/tutur3u/platform/commit/f662fef3995435caa84153b06e7bb8e4c74aaf45))
+
+## [0.34.0](https://github.com/tutur3u/platform/compare/utils-v0.33.3...utils-v0.34.0) (2026-10-04)
+
+
+### Features
+
+* **calendar:** support full Google color choices and scoped edits ([#5661](https://github.com/tutur3u/platform/issues/5661)) ([8cafac5](https://github.com/tutur3u/platform/commit/8cafac53438b504eafa8bcc8213d18448e4a17bc))
+* **identity:** enforce creator identity and media policies ([1078119](https://github.com/tutur3u/platform/commit/1078119eb4871568f76e4bc31005ba9f1b1ddd76)) ([e71e94f](https://github.com/tutur3u/platform/commit/e71e94fd1a643c5ee76979ba9444976ad4798906))
+* **identity:** protect creator usernames and profile media ([#5740](https://github.com/tutur3u/platform/issues/5740)) ([f8e18a4](https://github.com/tutur3u/platform/commit/f8e18a4c39d5bb65acfc5a680ccb9b2557ae4bed))
+* **mobile:** support offline data, cached images, and safe inventory checkout ([a45d634](https://github.com/tutur3u/platform/commit/a45d63498cc1e686d1d070f5861cf938c4e9a9ef)) ([#5734](https://github.com/tutur3u/platform/issues/5734)) ([2f0f397](https://github.com/tutur3u/platform/commit/2f0f39763daea56f1029fcc3e99e0be53c60e106))
+
+
+### Bug Fixes
+
+* **calendar:** fence metadata reads and retain recurrence during imports ([3895d28](https://github.com/tutur3u/platform/commit/3895d28fb4acd0164f6f021ad15df4c39a83938e))
+* **identity:** align live support validation and profile parity ([7d5e1b0](https://github.com/tutur3u/platform/commit/7d5e1b056d34d316177c21b178f201edf7680651))
+* **identity:** close profile policy and upload bypasses ([6f5aae5](https://github.com/tutur3u/platform/commit/6f5aae52c2ba3e633b4f24dd3f683d4b564a952f))
+* **identity:** enforce verified upload budgets and canonical profile validation ([8138fb5](https://github.com/tutur3u/platform/commit/8138fb59276191508416031f69195de291b2b06a))
+* **identity:** integrate main and order unapplied creator migrations ([5512e24](https://github.com/tutur3u/platform/commit/5512e2414abaa0c78b68cbdd3186a1d4bab861e7))
+* **identity:** preserve budgeted avatar tickets and atomic handle claims ([b18092f](https://github.com/tutur3u/platform/commit/b18092fb7bf8632f6ba5f99ab8a61308d09544b9))
+* **mobile:** harden offline inventory and scoped cache replay ([d9c0b13](https://github.com/tutur3u/platform/commit/d9c0b13b386287fb874be62a8b8ec794deeb6407))
+* **release:** gate critical app promotion on staged API probes ([f39cea3](https://github.com/tutur3u/platform/commit/f39cea3621b504a9320b6d79675aa42b905b0476)) ([#5761](https://github.com/tutur3u/platform/issues/5761)) ([391397f](https://github.com/tutur3u/platform/commit/391397f90f651d041d8f0e9ae566f8c3eab60dd7))
+* **release:** preserve manual test notes and share filtering policy ([ff312ca](https://github.com/tutur3u/platform/commit/ff312ca8b16e36bdc7f65484cded768de3073c17))
+* **releases:** omit merge bookkeeping from release summaries ([c66e0b1](https://github.com/tutur3u/platform/commit/c66e0b139c89706db32ec70c3e87fcc9c4018b6c)) ([#5741](https://github.com/tutur3u/platform/issues/5741)) ([552cd5a](https://github.com/tutur3u/platform/commit/552cd5ae85d19d9147f1367475f5f6b3bf522a63))
+* **sdk:** bound mixed judge jobs and validate playground exports ([c5efff9](https://github.com/tutur3u/platform/commit/c5efff9427dc36cae6c4212871a335f9cd4bde03))
+* **security:** isolate bulk limits from ordinary web operations ([b3a9add](https://github.com/tutur3u/platform/commit/b3a9addf90271c7e28319a2138bbd52aaa294bc1))
+* **security:** isolate offline bulk protection from daily web operations ([#5752](https://github.com/tutur3u/platform/issues/5752)) ([fd32aca](https://github.com/tutur3u/platform/commit/fd32aca3319c67d82149975e8c3a7615dfbca275))
+* **security:** stage offline download protection activation ([018f6ab](https://github.com/tutur3u/platform/commit/018f6ab2ada3fef843d66789dee6ec45fba905d3))
+
+
+### Performance Improvements
+
+* **devboxes:** parallelize bounded execution and retain warm playgrounds ([#5746](https://github.com/tutur3u/platform/issues/5746)) ([efd8ac4](https://github.com/tutur3u/platform/commit/efd8ac44b5c9f8cbf2ab5d64fbe89e1f7afe4f96))
+* **devboxes:** parallelize bounded runner execution and retain warm playgrounds ([c31cbf3](https://github.com/tutur3u/platform/commit/c31cbf3a2a7cb5214d75183896791366affdc7e6))
+
 ## [0.33.3](https://github.com/tutur3u/platform/compare/utils-v0.33.2...utils-v0.33.3) (2026-10-02)
 
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tuturuuu/utils",
   "license": "MIT",
-  "version": "0.33.3",
+  "version": "0.35.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/tutur3u/platform",
@@ -17,6 +17,7 @@
   },
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",
+    "@js-temporal/polyfill": "^0.5.1",
     "@noble/ciphers": "^2.4.0",
     "@noble/hashes": "^2.4.0",
     "@tanstack/react-query": "^5.102.8",
@@ -24,8 +25,9 @@
     "@tiptap/react": "3.31.3",
     "@tuturuuu/google": "0.1.1",
     "@tuturuuu/icons": "0.1.1",
-    "@tuturuuu/internal-api": "0.48.0",
+    "@tuturuuu/internal-api": "0.50.0",
     "@tuturuuu/supabase": "0.5.2",
+    "@tuturuuu/turnstile": "0.1.3",
     "@upstash/ratelimit": "^2.0.8",
     "@upstash/redis": "^1.38.4",
     "cn": "^0.3.0",
@@ -34,7 +36,7 @@
     "diff": "^9.0.0",
     "effect": "^3.22.2",
     "moment": "^2.30.1",
-    "next": "^16.3.5",
+    "next": "^16.4.0",
     "prosemirror-model": "^1.25.11",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
@@ -45,7 +47,7 @@
     "zod": "^4.6.2"
   },
   "devDependencies": {
-    "@tuturuuu/types": "0.33.1",
+    "@tuturuuu/types": "0.34.0",
     "@tuturuuu/typescript-config": "0.1.2",
     "@types/diff": "^8.0.0",
     "@types/node": "^26.5.1",

package/src/__tests__/api-proxy-bearer-trust.test.ts

@@ -7,6 +7,9 @@ const mocks = vi.hoisted(() => ({
   blocked: vi.fn(),
   prefixes: [] as string[],
 }));
+vi.mock('../offline-download-guard', () => ({
+  guardOfflineDownloadRequest: async () => null,
+}));
 vi.mock('../required-mfa-runtime', () => ({
   enforceRequiredMfaRequest: async () => null,
 }));

package/src/__tests__/api-proxy-guard.test.ts

@@ -3,6 +3,12 @@ vi.mock('../required-mfa-runtime', () => ({
 }));
 
 import { NextRequest } from 'next/server';
+import { makeRequest } from './api-proxy-test-request';
+
+vi.mock('../offline-download-guard', () => ({
+  guardOfflineDownloadRequest: async () => null,
+}));
+
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
 const mocks = vi.hoisted(() => ({
@@ -74,19 +80,6 @@ vi.mock('../request-emoji-limit', () => ({
   ) => mocks.validateEmoji(req, options),
 }));
 
-function makeRequest(
-  pathname = '/api/test',
-  method = 'POST',
-  headers?: Record<string, string>,
-  body = '{}'
-) {
-  return new NextRequest(`http://localhost${pathname}`, {
-    method,
-    headers,
-    body: method === 'GET' || method === 'HEAD' ? undefined : body,
-  });
-}
-
 function singleReadRoutePolicies() {
   return [
     {

package/src/__tests__/api-proxy-offline-response.test.ts

@@ -0,0 +1,48 @@
+import { NextRequest } from 'next/server';
+import { describe, expect, it, vi } from 'vitest';
+
+const guard = vi.hoisted(() => vi.fn());
+vi.mock('../required-mfa-runtime', () => ({
+  enforceRequiredMfaRequest: async () => null,
+}));
+vi.mock('../offline-download-guard', () => ({
+  guardOfflineDownloadRequest: guard,
+}));
+
+import { guardApiProxyRequest } from '../api-proxy-guard';
+import { isFinanceInvoiceCreateSupportRead } from '../api-proxy-read-policy';
+
+describe('offline guard proxy integration', () => {
+  it('propagates a download challenge without continuing the request', async () => {
+    const challenge = Response.json(
+      { message: 'Verify download' },
+      { status: 403 }
+    );
+    guard.mockResolvedValueOnce(challenge);
+    const request = new NextRequest(
+      'https://example.test/api/v1/workspaces/ws/tasks'
+    );
+    expect(
+      await guardApiProxyRequest(request, { prefixBase: 'test:offline' })
+    ).toBe(challenge);
+    expect(guard).toHaveBeenCalledWith(request);
+  });
+  it.each(['permissions', 'members'])(
+    'excludes static settings/%s from invoice reads',
+    (name) => {
+      const request = new NextRequest(
+        `https://example.test/api/v1/workspaces/ws/settings/${name}`
+      );
+      expect(isFinanceInvoiceCreateSupportRead(request)).toBe(false);
+    }
+  );
+  it.each(['configs', 'custom-config'])(
+    'retains supported settings/%s invoice reads',
+    (name) => {
+      const request = new NextRequest(
+        `https://example.test/api/v1/workspaces/ws/settings/${name}`
+      );
+      expect(isFinanceInvoiceCreateSupportRead(request)).toBe(true);
+    }
+  );
+});

package/src/__tests__/api-proxy-test-request.ts

@@ -0,0 +1,19 @@
+import { NextRequest } from 'next/server';
+
+export function makeRequest(
+  pathname = '/api/test',
+  method = 'POST',
+  headers?: Record<string, string>,
+  body = '{}'
+) {
+  return new NextRequest(`http://localhost${pathname}`, {
+    method,
+    headers: {
+      ...(method !== 'GET' && method !== 'HEAD'
+        ? { 'content-type': 'application/json' }
+        : {}),
+      ...headers,
+    },
+    body: method === 'GET' || method === 'HEAD' ? undefined : body,
+  });
+}

package/src/__tests__/calendar-provider-readonly.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from 'vitest';
+import {
+  isProviderRecurrenceReadonly,
+  markProviderRecurrenceReadonly,
+  providerReadonlyProjection,
+} from '../calendar-provider-readonly';
+
+describe('readonly provider projection', () => {
+  it.each(['google', 'microsoft'] as const)(
+    'projects %s internal marker without leaking raw provider snapshot',
+    (provider) => {
+      const original = { id: 'instance', summary: 'Private title' };
+      const projected = providerReadonlyProjection(
+        markProviderRecurrenceReadonly(original, provider, 'master')
+      );
+      expect(projected).toEqual({
+        locked: true,
+        scheduling_metadata: {
+          provider_recurrence: {
+            state: 'unsupported',
+            provider,
+            master_id: 'master',
+          },
+        },
+      });
+      expect(isProviderRecurrenceReadonly(projected)).toBe(true);
+      expect(original).toEqual({ id: 'instance', summary: 'Private title' });
+    }
+  );
+  it.each([
+    null,
+    {},
+    {
+      __tuturuuuProviderReadonlyRecurrence: {
+        state: 'unsupported',
+        provider: 'foreign',
+        master_id: 'master',
+      },
+    },
+  ])('ignores malformed markers', (value) =>
+    expect(providerReadonlyProjection(value)).toEqual({})
+  );
+  it('does not classify an ordinary locked event as provider readonly', () =>
+    expect(isProviderRecurrenceReadonly({ locked: true })).toBe(false));
+});

package/src/__tests__/calendar-recurrence-edit.test.ts

@@ -0,0 +1,140 @@
+import type { CalendarRecurrenceRule } from '@tuturuuu/types/primitives/calendar-recurrence';
+import { describe, expect, it } from 'vitest';
+import {
+  calendarAnchorAtSlot,
+  calendarProviderDateTimeLocal,
+  calendarRecurrenceSlotBounds,
+  calendarRecurrenceSlotInstant,
+  inspectCalendarRecurrenceSlot,
+} from '../calendar-recurrence-edit';
+
+const anchor = {
+  startLocal: '2026-03-07T02:30:00',
+  endLocal: '2026-03-07T03:30:00',
+  allDay: false,
+};
+const rule: CalendarRecurrenceRule = {
+  version: 1,
+  frequency: 'daily',
+  interval: 1,
+  timeZone: 'America/New_York',
+  end: { type: 'count', count: 4 },
+};
+describe('recurrence edit identity and future split', () => {
+  it('does not consume nonexistent DST slots when splitting count', () => {
+    const result = inspectCalendarRecurrenceSlot({
+      rule,
+      anchor,
+      originalStartLocal: '2026-03-10T02:30:00',
+    });
+    expect(result.precedingCount).toBe(2);
+    expect(result.remainingRule.end).toEqual({ type: 'count', count: 2 });
+    expect(result.previousRule?.end).toEqual({
+      type: 'until',
+      date: '2026-03-09',
+    });
+  });
+  it.each([
+    '2026-03-08T02:30:00',
+    '2026-03-07T03:30:00',
+    '2026-03-06T02:30:00',
+    '2026-03-12T02:30:00',
+  ])('rejects nonexistent or exhausted slot %s', (originalStartLocal) => {
+    expect(() =>
+      inspectCalendarRecurrenceSlot({ rule, anchor, originalStartLocal })
+    ).toThrow('Not a series occurrence');
+  });
+  it('maps first-slot future edit to whole-series edit', () => {
+    expect(
+      inspectCalendarRecurrenceSlot({
+        rule,
+        anchor,
+        originalStartLocal: anchor.startLocal,
+      }).previousRule
+    ).toBeNull();
+  });
+  it('rejects calendar-day boundaries after inclusive until', () => {
+    expect(() =>
+      inspectCalendarRecurrenceSlot({
+        rule: { ...rule, end: { type: 'until', date: '2026-03-09' } },
+        anchor,
+        originalStartLocal: '2026-03-10T02:30:00',
+      })
+    ).toThrow();
+  });
+  it('preserves multi-day local duration at future boundary', () => {
+    expect(
+      calendarAnchorAtSlot(
+        { ...anchor, endLocal: '2026-03-09T03:30:00' },
+        '2026-03-15T02:30:00'
+      ).endLocal
+    ).toBe('2026-03-17T03:30:00');
+  });
+  it('does not admit intervening dates on weekly interval', () => {
+    expect(() =>
+      inspectCalendarRecurrenceSlot({
+        rule: { ...rule, frequency: 'weekly', interval: 2, weekdays: ['SA'] },
+        anchor,
+        originalStartLocal: '2026-03-14T02:30:00',
+      })
+    ).toThrow();
+  });
+});
+
+describe('provider occurrence timezone identity', () => {
+  it('keeps the immutable slot instant after daylight saving changes', () => {
+    expect(
+      calendarRecurrenceSlotInstant({
+        rule,
+        anchor,
+        originalStartLocal: '2026-03-09T02:30:00',
+      })
+    ).toBe('2026-03-09T06:30:00Z');
+  });
+  it('rejects a nonexistent original slot instead of shifting its identity', () => {
+    expect(() =>
+      calendarRecurrenceSlotInstant({
+        rule,
+        anchor,
+        originalStartLocal: '2026-03-08T02:30:00',
+      })
+    ).toThrow();
+  });
+  it.each([
+    { dateTime: '2026-03-09T06:30:00Z' },
+    { dateTime: '2026-03-09T02:30:00-04:00' },
+    { dateTime: '2026-03-09T06:30:00.0000000', timeZone: 'UTC' },
+  ])('normalizes provider time without machine timezone: %j', (input) => {
+    expect(calendarProviderDateTimeLocal(input, 'America/New_York')).toBe(
+      '2026-03-09T02:30:00'
+    );
+  });
+  it('rejects unsupported timezone names', () => {
+    expect(() =>
+      calendarProviderDateTimeLocal(
+        { dateTime: '2026-03-09T09:00:00', timeZone: 'not-a-zone' },
+        'UTC'
+      )
+    ).toThrow();
+  });
+});
+
+describe('provider original interval coverage', () => {
+  it('keeps wall-clock end boundaries across DST for multi-day slots', () => {
+    expect(
+      calendarRecurrenceSlotBounds({
+        rule,
+        anchor: { ...anchor, endLocal: '2026-03-09T03:30:00' },
+        originalStartLocal: '2026-03-07T02:30:00',
+      })
+    ).toEqual({ start: '2026-03-07T07:30:00Z', end: '2026-03-09T07:30:00Z' });
+  });
+  it('refuses to truncate nonzero provider fractional seconds into another immutable identity', () => {
+    expect(() =>
+      calendarProviderDateTimeLocal(
+        { dateTime: '2026-03-09T06:30:00.0000001Z' },
+        'America/New_York'
+      )
+    ).toThrow('fractional');
+  });
+});