@hook-sdk/template 0.23.0 → 0.23.2

package/dist/index.d.cts

@@ -208,18 +208,27 @@ type AppRootProps = AppRootSlots & {
 declare function AppRoot(props: AppRootProps): react_jsx_runtime.JSX.Element;
 
 /**
- * Build-time + runtime gate for dev-only tools (e.g. <DevSkipOnboardingFab>).
+ * Runtime gate for dev-only tools (e.g. <DevSkipOnboardingFab>).
  *
- * Two independent signals must agree:
+ * History:
+ *   v0.23.0 / v0.23.1 also gated on `import.meta.env.VITE_HOOK_DEV_TOOLS`.
+ *   That was intended as a build-time DCE signal so the dev module would
+ *   tree-shake out of prod bundles. Empirically vite's static replacement
+ *   does NOT apply to template code consumed from node_modules when the
+ *   creator app uses `build.lib` mode — every consumer ended up with
+ *   `undefined !== '1'` → DCE killed the FAB from STAGING bundles too.
  *
- *   1. Build-time: `import.meta.env.VITE_HOOK_DEV_TOOLS === '1'`. Vite folds
- *      this constant at build time — when unset, the entire dev tree is
- *      tree-shaken from the prod bundle (sideEffects:false in package.json
- *      makes that effective). Set `VITE_HOOK_DEV_TOOLS=1` only in
- *      `.env.staging` builds.
+ *   Pragmatic fix: drop the env gate and rely on the runtime hostname
+ *   check alone. The FAB code now ships in prod bundles too (~5 KB), but
+ *   it never renders on prod hostnames because `.staging.` / `localhost`
+ *   is the only path that returns `true`. Visual safety = hostname check
+ *   at render. Compliance / privacy = no real user can ever trigger the
+ *   auto-signup branch on a `usehook.net` (prod) origin.
  *
- *   2. Runtime: hostname must be staging-ish. Belt-and-suspenders against
- *      a misconfigured build that somehow ships the FAB to prod.
+ *   If a creator app wants the build-time DCE back, the consumer's
+ *   `vite.config.ts` `define` block must explicitly substitute
+ *   `import.meta.env.VITE_HOOK_DEV_TOOLS` — vite's auto-replacement skips
+ *   `node_modules` in lib mode.
  */
 declare function isDevToolsEnabled(): boolean;
 

package/dist/index.d.ts

@@ -208,18 +208,27 @@ type AppRootProps = AppRootSlots & {
 declare function AppRoot(props: AppRootProps): react_jsx_runtime.JSX.Element;
 
 /**
- * Build-time + runtime gate for dev-only tools (e.g. <DevSkipOnboardingFab>).
+ * Runtime gate for dev-only tools (e.g. <DevSkipOnboardingFab>).
  *
- * Two independent signals must agree:
+ * History:
+ *   v0.23.0 / v0.23.1 also gated on `import.meta.env.VITE_HOOK_DEV_TOOLS`.
+ *   That was intended as a build-time DCE signal so the dev module would
+ *   tree-shake out of prod bundles. Empirically vite's static replacement
+ *   does NOT apply to template code consumed from node_modules when the
+ *   creator app uses `build.lib` mode — every consumer ended up with
+ *   `undefined !== '1'` → DCE killed the FAB from STAGING bundles too.
  *
- *   1. Build-time: `import.meta.env.VITE_HOOK_DEV_TOOLS === '1'`. Vite folds
- *      this constant at build time — when unset, the entire dev tree is
- *      tree-shaken from the prod bundle (sideEffects:false in package.json
- *      makes that effective). Set `VITE_HOOK_DEV_TOOLS=1` only in
- *      `.env.staging` builds.
+ *   Pragmatic fix: drop the env gate and rely on the runtime hostname
+ *   check alone. The FAB code now ships in prod bundles too (~5 KB), but
+ *   it never renders on prod hostnames because `.staging.` / `localhost`
+ *   is the only path that returns `true`. Visual safety = hostname check
+ *   at render. Compliance / privacy = no real user can ever trigger the
+ *   auto-signup branch on a `usehook.net` (prod) origin.
  *
- *   2. Runtime: hostname must be staging-ish. Belt-and-suspenders against
- *      a misconfigured build that somehow ships the FAB to prod.
+ *   If a creator app wants the build-time DCE back, the consumer's
+ *   `vite.config.ts` `define` block must explicitly substitute
+ *   `import.meta.env.VITE_HOOK_DEV_TOOLS` — vite's auto-replacement skips
+ *   `node_modules` in lib mode.
  */
 declare function isDevToolsEnabled(): boolean;
 

package/dist/index.js

@@ -2099,8 +2099,6 @@ function I18nProvider({
 
 // src/dev/env.ts
 function isDevToolsEnabled() {
-  const meta = import.meta;
-  if (meta.env?.VITE_HOOK_DEV_TOOLS !== "1") return false;
   if (typeof window === "undefined") return false;
   const host = window.location.hostname;
   return host.includes(".staging.") || host === "localhost" || host === "127.0.0.1";