@wireai/activation 0.10.0 → 0.11.0

package/dist/questionnaire/index.mjs

@@ -698,7 +698,14 @@ var resolveRules = (config) => {
   var _a, _b, _c, _d, _e;
   return {
     enabled: (_a = config.enabled) != null ? _a : true,
-    minSessions: (_b = config.minSessions) != null ? _b : 0,
+    // FAIL-CLOSED on the first session (behavior change, 0.11.0). An unconfigured host with no
+    // server decision must NOT prompt on the very first mount: `minSessions` defaults to 2 so the
+    // gate needs at least a second session before the LOCAL rules can fire. This is the client-side
+    // floor only — a server `decision` (from `fetchReviewDecision`) still OVERRIDES everything, and a
+    // host that genuinely wants first-session prompting can set `minSessions: 1` (or `0`) explicitly.
+    // Mirrors the 2026-07-16 incident: a first-session user, no server decision, got the prompt and
+    // left 1 star. See `evaluateGate` (`min_sessions` reason) and the CHANGELOG.
+    minSessions: (_b = config.minSessions) != null ? _b : 2,
     minEvents: (_c = config.minEvents) != null ? _c : 0,
     cooldownDays: (_d = config.cooldownDays) != null ? _d : 0,
     oncePerVersion: (_e = config.oncePerVersion) != null ? _e : true
@@ -856,7 +863,8 @@ var fetchQuestionnaireDecision = async (target, options = {}) => {
     const res = await fetch(url, { headers });
     if (!res || !res.ok) return null;
     const json = await res.json();
-    return json != null ? json : null;
+    if (!json || typeof json.fire !== "boolean") return null;
+    return json;
   } catch {
     return null;
   }