@hook-sdk/template 0.23.1 → 0.23.2

package/dist/index.d.cts

@@ -208,26 +208,27 @@ type AppRootProps = AppRootSlots & {
 declare function AppRoot(props: AppRootProps): react_jsx_runtime.JSX.Element;
 
 /**
- * Build-time + runtime gate for dev-only tools (e.g. <DevSkipOnboardingFab>).
+ * Runtime gate for dev-only tools (e.g. <DevSkipOnboardingFab>).
  *
- * Two independent signals must agree:
+ * History:
+ *   v0.23.0 / v0.23.1 also gated on `import.meta.env.VITE_HOOK_DEV_TOOLS`.
+ *   That was intended as a build-time DCE signal so the dev module would
+ *   tree-shake out of prod bundles. Empirically vite's static replacement
+ *   does NOT apply to template code consumed from node_modules when the
+ *   creator app uses `build.lib` mode — every consumer ended up with
+ *   `undefined !== '1'` → DCE killed the FAB from STAGING bundles too.
  *
- *   1. Build-time: `import.meta.env.VITE_HOOK_DEV_TOOLS === '1'`. Vite folds
- *      this constant at the consumer app's build time — when unset, the
- *      entire dev tree is tree-shaken from the prod bundle. Set
- *      `VITE_HOOK_DEV_TOOLS=1` only in the staging build env.
+ *   Pragmatic fix: drop the env gate and rely on the runtime hostname
+ *   check alone. The FAB code now ships in prod bundles too (~5 KB), but
+ *   it never renders on prod hostnames because `.staging.` / `localhost`
+ *   is the only path that returns `true`. Visual safety = hostname check
+ *   at render. Compliance / privacy = no real user can ever trigger the
+ *   auto-signup branch on a `usehook.net` (prod) origin.
  *
- *   2. Runtime: hostname must be staging-ish. Belt-and-suspenders against
- *      a misconfigured build that somehow ships the FAB to prod.
- *
- * IMPORTANT: the env access MUST be the literal token
- * `import.meta.env.VITE_HOOK_DEV_TOOLS`. Vite's static replacement is a
- * text substitution that only fires on this exact form. Going through a
- * local alias (`const meta = import.meta; meta.env.X`) defeats the
- * substitution and the consumer bundle ends up with `undefined` regardless
- * of what the build env actually has set. See `../vite-env.d.ts` for the
- * ambient ImportMeta augmentation that keeps TypeScript happy without a
- * cast at the access site.
+ *   If a creator app wants the build-time DCE back, the consumer's
+ *   `vite.config.ts` `define` block must explicitly substitute
+ *   `import.meta.env.VITE_HOOK_DEV_TOOLS` — vite's auto-replacement skips
+ *   `node_modules` in lib mode.
  */
 declare function isDevToolsEnabled(): boolean;
 

package/dist/index.d.ts

@@ -208,26 +208,27 @@ type AppRootProps = AppRootSlots & {
 declare function AppRoot(props: AppRootProps): react_jsx_runtime.JSX.Element;
 
 /**
- * Build-time + runtime gate for dev-only tools (e.g. <DevSkipOnboardingFab>).
+ * Runtime gate for dev-only tools (e.g. <DevSkipOnboardingFab>).
  *
- * Two independent signals must agree:
+ * History:
+ *   v0.23.0 / v0.23.1 also gated on `import.meta.env.VITE_HOOK_DEV_TOOLS`.
+ *   That was intended as a build-time DCE signal so the dev module would
+ *   tree-shake out of prod bundles. Empirically vite's static replacement
+ *   does NOT apply to template code consumed from node_modules when the
+ *   creator app uses `build.lib` mode — every consumer ended up with
+ *   `undefined !== '1'` → DCE killed the FAB from STAGING bundles too.
  *
- *   1. Build-time: `import.meta.env.VITE_HOOK_DEV_TOOLS === '1'`. Vite folds
- *      this constant at the consumer app's build time — when unset, the
- *      entire dev tree is tree-shaken from the prod bundle. Set
- *      `VITE_HOOK_DEV_TOOLS=1` only in the staging build env.
+ *   Pragmatic fix: drop the env gate and rely on the runtime hostname
+ *   check alone. The FAB code now ships in prod bundles too (~5 KB), but
+ *   it never renders on prod hostnames because `.staging.` / `localhost`
+ *   is the only path that returns `true`. Visual safety = hostname check
+ *   at render. Compliance / privacy = no real user can ever trigger the
+ *   auto-signup branch on a `usehook.net` (prod) origin.
  *
- *   2. Runtime: hostname must be staging-ish. Belt-and-suspenders against
- *      a misconfigured build that somehow ships the FAB to prod.
- *
- * IMPORTANT: the env access MUST be the literal token
- * `import.meta.env.VITE_HOOK_DEV_TOOLS`. Vite's static replacement is a
- * text substitution that only fires on this exact form. Going through a
- * local alias (`const meta = import.meta; meta.env.X`) defeats the
- * substitution and the consumer bundle ends up with `undefined` regardless
- * of what the build env actually has set. See `../vite-env.d.ts` for the
- * ambient ImportMeta augmentation that keeps TypeScript happy without a
- * cast at the access site.
+ *   If a creator app wants the build-time DCE back, the consumer's
+ *   `vite.config.ts` `define` block must explicitly substitute
+ *   `import.meta.env.VITE_HOOK_DEV_TOOLS` — vite's auto-replacement skips
+ *   `node_modules` in lib mode.
  */
 declare function isDevToolsEnabled(): boolean;
 

package/dist/index.js

@@ -2099,7 +2099,6 @@ function I18nProvider({
 
 // src/dev/env.ts
 function isDevToolsEnabled() {
-  if (import.meta.env.VITE_HOOK_DEV_TOOLS !== "1") return false;
   if (typeof window === "undefined") return false;
   const host = window.location.hostname;
   return host.includes(".staging.") || host === "localhost" || host === "127.0.0.1";