@shipeasy/devtools-core 1.1.0

submitPublicBug / submitPublicFeature take an optional tags: string[]; each name is matched case-insensitively against the project's existing tags — reused when it matches, created when it doesn't. @shipeasy/sdk is unchanged (9.0.2).

v9.0.2

Fixed: bundling the server entry no longer tries to resolve next/headers

@shipeasy/sdk has never depended on Next — the next/headers read in shipeasy() is a Next-only ambient fallback in a try/catch, for Next apps that never pass opts.cookies. But the catch is a runtime guard, and the specifier was a plain literal, so any non-Next app that BUNDLED the server entry had its build fail while resolving it:

[vite]: Rollup failed to resolve import "next/headers" from "@shipeasy/sdk/dist/server/index.mjs"

The published bundle now carries the specifier in a form Rollup and Vite decline to analyse (so it stays a runtime-only lookup that lands in the catch off Next), while webpack and Turbopack still evaluate it — a Next app keeps binding to its own bundled next/headers, and the ambient cookie read (and the stable anonymous bucketing that depends on it) is unchanged.

Verified end to end on Next 16 (Turbopack and webpack), a Vite/Rollup SSR build, esbuild, and unbundled Node + Express.

No API change. Apps that already pass cookies were never affected.

v9.0.1

Docs: where see() extras go in the chain

causes_the(subject) and .to(outcome) are two halves of one sentence, so the docs no longer teach causes_the(x).extras({...}).to(y) — wedging the debug payload between the subject and the outcome splits the consequence in half and is hard to read. That shape is now a documented hard ban.

The preferred form in TypeScript is trailing extras, .to(outcome).extras({...}): the chain dispatches on the next microtask, so extras chained after the terminal still make the report. Inline .to(outcome, extras) remains equivalent, and addExtras() still buffers context from any layer.

Docs, snippet, skill and the to() JSDoc updated to match. No behaviour change.

v9.0.0

Removes the /sdk/loader.js script loader and points the SSR bootstrap tag at /sdk/runtime.js. See CHANGELOG.md for the full 8.0.0 + 9.0.0 diff since 7.9.0.

v7.9.0 — server identity resolver (no anon→identified flip)

Register a request-scoped server identity resolver (setServerIdentity / shipeasy({ identify })) so SSR bootstrap evaluates for the identified user — no anon→identified flip. The bootstrap tag carries the identity (data-user); the browser SDK adopts it and reconciles a later identify() idempotently. See CHANGELOG for details.

v7.8.2

Fix: DevTools override cookie now survives reloads.

The per-session signing grant that lets the overlay write the server-trusted se_ov cookie lived only in module memory (set once from the auth popup) while the devtools session token is persisted — so after the reload every override triggers, the overlay looked connected yet silently failed to write the cookie, changing only the URL param. The grant is now mirrored into sessionStorage and rehydrated on overlay init, dropped on sign-out and when expired/project-mismatched.

v7.8.1

Fix: honor the gatekeeper stack when evaluating gates locally.

evalGateInternal previously read only the flat rules+rolloutPct columns and ignored a gate's ordered stack. For a modern gatekeeper the flat columns are a lossy approximation (a whitelist condition at 100% followed by a 0% public rollout flattens to rolloutPct:0, wrongly read as never-true). The SDK now evaluates the stack top-to-bottom exactly like @shipeasy/core evalGatekeeper and the edge worker. Stack-less gates keep the legacy flat path.

v7.8.0 — signed DevTools override cookies

Signed DevTools override cookies: overrides for feature flags, kill switches, configs and experiments now reach the server (SSR nav, route guards, __SE_BOOTSTRAP) via a signed se_ov cookie, not just the client via URL params.

• Paired-key HMAC handshake (per-project verify key on /sdk/flags + /sdk/evaluate; per-session signing key issued to the authenticated overlay). Fail-closed on missing key / forged / expired.
• Framework-general: shipeasy({ overrideCookie }) takes the bare value or a Cookie header; flags.verifyOverrides(cookie). No next/* dependency.
• Also: gate the "No server key" setup warning to real deploys.

See CHANGELOG.md for details.

v7.7.0 — see() inline extras + ambient add_extras

.to(outcome, extras) folds extras into the terminal alongside the existing trailing .extras(). Adds addExtras/clearExtras (+ runWithExtras): AsyncLocalStorage on the server so concurrent requests don't bleed, a module buffer in the browser; merged under chain extras (chain wins) at dispatch.

v7.6.0

React Native devtools overlay round: full-page config viewer + experiment detail drill-ins, ops-queue redesign (Bugs/Features/Errors/Alerts with status sections, priority left-borders, AI/PR row tints + PR links), Active-overrides screen + header ⚡ pill, redesigned create-success screens, read-only ValueTree for structured values, forced-variant params delivered live, and the I18n panel removed for now. See CHANGELOG.md for the full list.