@wireai/activation 0.10.0 → 0.11.0

package/dist/reviews/index.mjs

@@ -498,7 +498,14 @@ var resolveRules = (config) => {
   var _a, _b, _c, _d, _e;
   return {
     enabled: (_a = config.enabled) != null ? _a : true,
-    minSessions: (_b = config.minSessions) != null ? _b : 0,
+    // FAIL-CLOSED on the first session (behavior change, 0.11.0). An unconfigured host with no
+    // server decision must NOT prompt on the very first mount: `minSessions` defaults to 2 so the
+    // gate needs at least a second session before the LOCAL rules can fire. This is the client-side
+    // floor only — a server `decision` (from `fetchReviewDecision`) still OVERRIDES everything, and a
+    // host that genuinely wants first-session prompting can set `minSessions: 1` (or `0`) explicitly.
+    // Mirrors the 2026-07-16 incident: a first-session user, no server decision, got the prompt and
+    // left 1 star. See `evaluateGate` (`min_sessions` reason) and the CHANGELOG.
+    minSessions: (_b = config.minSessions) != null ? _b : 2,
     minEvents: (_c = config.minEvents) != null ? _c : 0,
     cooldownDays: (_d = config.cooldownDays) != null ? _d : 0,
     oncePerVersion: (_e = config.oncePerVersion) != null ? _e : true
@@ -722,6 +729,19 @@ var requestStoreReview = async (store) => {
   return opened ? "store_url" : "none";
 };
 
+// src/analytics/reportClientEvent.ts
+var buildEventsRequest = (target, events) => {
+  if (!(target == null ? void 0 : target.serverUrl) || events.length === 0) return null;
+  try {
+    const url = `${target.serverUrl.replace(/\/$/, "")}/v1/events`;
+    const headers = { "Content-Type": "application/json" };
+    if (target.apiKey) headers.Authorization = `Bearer ${target.apiKey}`;
+    return { url, init: { method: "POST", headers, body: JSON.stringify({ events }) } };
+  } catch {
+    return null;
+  }
+};
+
 // src/reviews/transport.ts
 var submitReview = (target, review) => {
   if (!(target == null ? void 0 : target.serverUrl)) return;
@@ -761,9 +781,6 @@ var fetchReviewDecision = async (target, options = {}) => {
 var reportAppEvent = (target, name, options = {}) => {
   if (!(target == null ? void 0 : target.serverUrl) || !name) return;
   try {
-    const url = `${target.serverUrl.replace(/\/$/, "")}/v1/events`;
-    const headers = { "Content-Type": "application/json" };
-    if (target.apiKey) headers.Authorization = `Bearer ${target.apiKey}`;
     const event = {
       event_type: "app_event",
       question_key: name
@@ -773,11 +790,9 @@ var reportAppEvent = (target, name, options = {}) => {
     if (options.meta && Object.keys(options.meta).length > 0) {
       event.meta = JSON.stringify(options.meta);
     }
-    void fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({ events: [event] })
-    }).catch(() => {
+    const req = buildEventsRequest(target, [event]);
+    if (!req) return;
+    void fetch(req.url, req.init).catch(() => {
     });
   } catch {
   }