kaafil-react-uikit 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -6,6 +6,41 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this package uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 While on `0.x` a minor bump may carry a breaking change; the entry will say so.
 
+## [0.10.1] — 2026-09-15
+
+Two long-standing bugs that only bite together, found when the traveller
+surface of that same partner CRM went blank on a **production** build.
+
+### Fixed
+
+- **`isDevelopment()` answered `true` in every production browser build.**
+  It read `(globalThis as {...}).process?.env?.NODE_ENV`, on the reasoning
+  that a bundler "sees this exact property-access shape and inlines it the
+  same way it would a bare reference". It does not — Vite, webpack, Turbopack
+  and esbuild all match the literal member expression `process.env.NODE_ENV`,
+  and route it through `globalThis` or an optional chain and nothing is
+  replaced. A browser has no `process`, so the expression was `undefined`,
+  `undefined !== 'production'` is `true`, and **every dev-only throw in this
+  package shipped to real users**. It now reads a bare `process.env.NODE_ENV`
+  (declared locally, so still no `@types/node`) and fails CLOSED: a value it
+  cannot read means production, because a false positive here does not
+  produce a stray console line — it turns a guard meant to degrade quietly
+  into a crash.
+
+- **The session's open window no longer claims to be a manager.**
+  `SessionShell` populated `SessionContext` with `persona: 'manager'`
+  unconditionally while opening. On a share surface that is simply false: a
+  bare `shareToken` prop settles the persona synchronously, which is the whole
+  premise of the credential-shape model. It now derives `'share'` from the
+  prop and keeps the guess only for `credentialResolver`, which genuinely
+  cannot be known before it resolves.
+
+  Together these took out the entire traveller surface in production:
+  `BrandShell` rejects `headStrategy: 'own-page'` for any non-`share` persona,
+  that guard is written to warn and fall back outside development, and instead
+  it threw — so `/t/<token>`, the page a traveller opens from a WhatsApp
+  message, rendered nothing but an error boundary.
+
 ## [0.10.0] — 2026-09-15
 
 Both changes came out of integrating a real partner CRM against the live