@ik-firewall/core 2.3.7 → 2.4.1

package/dist/index.cjs

@@ -90,10 +90,10 @@ var Registry = class _Registry {
   /**
    * Loads instance configurations with Hook support
    */
-  load() {
+  async load() {
     if (this.hooks?.loadState) {
       try {
-        const hookData = this.hooks.loadState("ik_registry");
+        const hookData = await this.hooks.loadState("ik_registry");
         if (hookData) return JSON.parse(hookData);
       } catch (e) {
         console.warn("[IK_REGISTRY] Registry load via hook failed, falling back...");
@@ -114,10 +114,10 @@ var Registry = class _Registry {
     }
     return {};
   }
-  save(data) {
+  async save(data) {
     const jsonStr = JSON.stringify(data, null, 2);
     if (this.hooks?.persistState) {
-      this.hooks.persistState("ik_registry", jsonStr);
+      await this.hooks.persistState("ik_registry", jsonStr);
     }
     if (fs && this.registryPath) {
       try {
@@ -132,10 +132,10 @@ var Registry = class _Registry {
       }
     }
   }
-  updateInstance(instanceId, config) {
-    const all = this.load();
+  async updateInstance(instanceId, config) {
+    const all = await this.load();
     all[instanceId] = { ...all[instanceId] || {}, ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-    this.save(all);
+    await this.save(all);
   }
   getUsageFilePath() {
     return this.usagePath;
@@ -158,13 +158,25 @@ var Registry = class _Registry {
     } catch (e) {
     }
   }
-  clearUsage() {
+  async clearUsage() {
     if (!fs || !this.usagePath) return;
     try {
       if (fs.existsSync(this.usagePath)) fs.unlinkSync(this.usagePath);
     } catch (e) {
     }
   }
+  async getLastFlushTime() {
+    if (this.hooks?.loadState) {
+      const val = await this.hooks.loadState("ik_last_flush");
+      if (val) return parseInt(val, 10);
+    }
+    return null;
+  }
+  async setLastFlushTime(time) {
+    if (this.hooks?.persistState) {
+      await this.hooks.persistState("ik_last_flush", time.toString());
+    }
+  }
 };
 
 // src/lib/hmac.ts
@@ -202,6 +214,7 @@ var ConfigManager = class {
   config;
   registry;
   hooks;
+  blockedInstances = /* @__PURE__ */ new Set();
   constructor(initialConfig, hooks) {
     this.config = initialConfig;
     this.hooks = hooks;
@@ -209,7 +222,6 @@ var ConfigManager = class {
     if (hooks) {
       this.registry.setHooks(hooks);
     }
-    this.loadFromRegistry();
   }
   getRegistry() {
     return this.registry;
@@ -225,16 +237,16 @@ var ConfigManager = class {
         if (state) {
           const parsed = JSON.parse(state);
           const registry = this.registry;
-          registry.save(parsed);
-          this.loadFromRegistry();
+          await registry.save(parsed);
+          await this.loadFromRegistry();
         }
       } catch (e) {
         console.warn("[IK_CONFIG] Hydration from hooks failed:", e);
       }
     }
   }
-  loadFromRegistry() {
-    const instanceConfigs = this.registry.load();
+  async loadFromRegistry() {
+    const instanceConfigs = await this.registry.load();
     this.config.instanceConfigs = {
       ...this.config.instanceConfigs || {},
       ...instanceConfigs
@@ -276,7 +288,7 @@ var ConfigManager = class {
             return;
           }
         }
-        this.setInstanceConfig(instanceId, {
+        await this.setInstanceConfig(instanceId, {
           billingStatus: data.billingStatus,
           isVerified: data.isVerified,
           pricing: data.pricing,
@@ -288,7 +300,7 @@ var ConfigManager = class {
       }
     } catch (error) {
       console.error(`[IK_CONFIG] Remote sync failed (${error.message}). Falling open (Fail-Open mode).`);
-      this.setInstanceConfig(instanceId, {
+      await this.setInstanceConfig(instanceId, {
         isVerified: true,
         lastSyncDate: now.toISOString()
       });
@@ -308,11 +320,27 @@ var ConfigManager = class {
     if (instanceId && this.config.instanceConfigs?.[instanceId]) {
       merged = { ...merged, ...this.config.instanceConfigs[instanceId] };
     }
+    if (instanceId && this.blockedInstances.has(instanceId)) {
+      merged.billingStatus = "blocked";
+    }
     if (override) {
       merged = { ...merged, ...override };
     }
     return merged;
   }
+  /**
+   * Updates the live blocked status for an instance (Kill-Switch).
+   * This is used by UsageTracker when it receives a response from the central server.
+   */
+  async setBlockedStatus(instanceId, blocked) {
+    if (blocked) {
+      this.blockedInstances.add(instanceId);
+      await this.setInstanceConfig(instanceId, { billingStatus: "blocked" });
+    } else {
+      this.blockedInstances.delete(instanceId);
+      await this.setInstanceConfig(instanceId, { billingStatus: "active" });
+    }
+  }
   updateConfig(newConfig) {
     this.config = {
       ...this.config,
@@ -351,7 +379,7 @@ var ConfigManager = class {
             return false;
           }
         }
-        this.setInstanceConfig(instanceId, {
+        await this.setInstanceConfig(instanceId, {
           licenseKey: data.licenseKey,
           billingStatus: data.status.toLowerCase(),
           isVerified: true,
@@ -367,10 +395,10 @@ var ConfigManager = class {
       return false;
     }
   }
-  ensureInstanceConfig(instanceId) {
-    const all = this.registry.load();
+  async ensureInstanceConfig(instanceId) {
+    const all = await this.registry.load();
     if (!all[instanceId]) {
-      this.registry.updateInstance(instanceId, {
+      await this.registry.updateInstance(instanceId, {
         balance: this.config.balance || 0.5,
         aggressiveness: this.config.aggressiveness || 0.5,
         isEnabled: true,
@@ -378,15 +406,15 @@ var ConfigManager = class {
         ownerEmail: this.config.ownerEmail
         // Inherit from global if not specific
       });
-      this.loadFromRegistry();
+      await this.loadFromRegistry();
     }
   }
-  getInstanceConfigs() {
+  async getInstanceConfigs() {
     return this.registry.load();
   }
-  setInstanceConfig(instanceId, config) {
-    this.registry.updateInstance(instanceId, config);
-    this.loadFromRegistry();
+  async setInstanceConfig(instanceId, config) {
+    await this.registry.updateInstance(instanceId, config);
+    await this.loadFromRegistry();
   }
 };
 
@@ -1505,11 +1533,14 @@ var UsageTracker = class {
   }
   async checkFlushConditions(instanceId) {
     const now = Date.now();
+    if (this.lastFlushTime === 0) {
+      const persisted = await this.config.getRegistry().getLastFlushTime();
+      if (persisted) this.lastFlushTime = persisted;
+      else this.lastFlushTime = now;
+    }
     const timeSinceFlush = now - this.lastFlushTime;
     if (this.aggregationMap.size >= this.BATCH_SIZE_THRESHOLD || timeSinceFlush >= this.TIME_THRESHOLD_MS) {
-      this.performAsyncFlush(instanceId).catch((err) => {
-        console.error("[IK_TRACKER] Background flush failed:", err);
-      });
+      await this.performAsyncFlush(instanceId);
     }
   }
   async performAsyncFlush(instanceId) {
@@ -1518,7 +1549,8 @@ var UsageTracker = class {
     const reports = Array.from(this.aggregationMap.values());
     this.aggregationMap.clear();
     this.lastFlushTime = Date.now();
-    const licenseKey = this.config.getConfig().instanceConfigs?.[instanceId]?.licenseKey || this.config.get("licenseKey");
+    const instanceConfigs = await this.config.getInstanceConfigs();
+    const licenseKey = instanceConfigs[instanceId]?.licenseKey || this.config.get("licenseKey");
     const payload = {
       licenseKey: licenseKey || "TRIAL-KEY",
       instanceId,
@@ -1551,7 +1583,8 @@ var UsageTracker = class {
       try {
         const crypto = typeof window === "undefined" ? (await import("crypto")).default : null;
         if (crypto && crypto.createHmac) {
-          payload.signature = crypto.createHmac("sha256", hmacSecret).update(JSON.stringify(payload)).digest("hex");
+          const { signature: _sig, ...signablePayload } = payload;
+          payload.signature = crypto.createHmac("sha256", hmacSecret).update(JSON.stringify(signablePayload)).digest("hex");
         }
       } catch (e) {
       }
@@ -1567,6 +1600,17 @@ var UsageTracker = class {
     if (!response.ok) {
       throw new Error(`HTTP Error: ${response.status} ${response.statusText}`);
     }
+    try {
+      const data = await response.json();
+      if (data && (data.status === "blocked" || data.billingStatus === "blocked")) {
+        this.config.setBlockedStatus(payload.instanceId, true);
+        console.warn(`[IK_TRACKER] \u{1F6E1}\uFE0F Kill-Switch triggered for ${payload.instanceId}: Subscription inactive/blocked.`);
+      } else if (data && (data.status === "active" || data.billingStatus === "active" || data.status === "trial")) {
+        this.config.setBlockedStatus(payload.instanceId, false);
+      }
+    } catch (e) {
+    }
+    await this.config.getRegistry().setLastFlushTime(this.lastFlushTime);
     this.hooks?.onFlushSuccess?.(payload);
   }
   async handleFailure(payload) {
@@ -1780,11 +1824,11 @@ var IKFirewallCore = class _IKFirewallCore {
   getSessionDNA() {
     return this.sessionDNA;
   }
-  getInstanceConfigs() {
+  async getInstanceConfigs() {
     return this.configManager.getInstanceConfigs();
   }
-  setInstanceConfig(instanceId, config) {
-    this.configManager.setInstanceConfig(instanceId, config);
+  async setInstanceConfig(instanceId, config) {
+    await this.configManager.setInstanceConfig(instanceId, config);
   }
   /**
    * Discovers available providers by checking environment variables and local health.
@@ -1868,17 +1912,12 @@ var IKFirewallCore = class _IKFirewallCore {
       this.hydrated = true;
     }
     if (instanceId) {
-      this.configManager.ensureInstanceConfig(instanceId);
-      this.configManager.syncRemoteConfig(instanceId).catch((err) => {
-        console.warn("[IK_CORE] Heartbeat sync failed:", err);
-      });
+      await this.configManager.ensureInstanceConfig(instanceId);
     }
     const mergedConfig = this.configManager.getMergedConfig(instanceId);
-    if (instanceId && mergedConfig?.isVerified === false) {
-      if (mergedConfig?.billingStatus === "blocked") {
-        this.hooks?.onStatus?.("\u26A0\uFE0F [IK_FIREWALL] Subscription inactive. Optimization bypassed (Fail-Safe mode).");
-        return this.getEmptyMetrics();
-      }
+    if (instanceId && mergedConfig?.billingStatus === "blocked") {
+      this.hooks?.onStatus?.("\u26A0\uFE0F [IK_FIREWALL] Subscription inactive. Optimization bypassed (Fail-Safe mode).");
+      return this.getEmptyMetrics();
     }
     let auditProvider = this.localProvider;
     let overrideProvider = null;
@@ -2008,7 +2047,7 @@ var IKFirewallCore = class _IKFirewallCore {
   }
   async analyzeAIAssisted(input, provider, personaName = "professional", instanceId, configOverride) {
     if (instanceId) {
-      this.configManager.ensureInstanceConfig(instanceId);
+      await this.configManager.ensureInstanceConfig(instanceId);
     }
     const activeConfig = this.configManager.getMergedConfig(instanceId, configOverride);
     const locale = activeConfig?.locale || "en";

package/dist/index.d.cts

@@ -340,8 +340,8 @@ declare class IKFirewallCore {
     getConfig(): IKConfig;
     getPlugins(): IKPluginInfo[];
     getSessionDNA(): number;
-    getInstanceConfigs(): Record<string, Partial<IKConfig>>;
-    setInstanceConfig(instanceId: string, config: Partial<IKConfig>): void;
+    getInstanceConfigs(): Promise<Record<string, Partial<IKConfig>>>;
+    setInstanceConfig(instanceId: string, config: Partial<IKConfig>): Promise<void>;
     /**
      * Discovers available providers by checking environment variables and local health.
      */

package/dist/index.d.ts

@@ -340,8 +340,8 @@ declare class IKFirewallCore {
     getConfig(): IKConfig;
     getPlugins(): IKPluginInfo[];
     getSessionDNA(): number;
-    getInstanceConfigs(): Record<string, Partial<IKConfig>>;
-    setInstanceConfig(instanceId: string, config: Partial<IKConfig>): void;
+    getInstanceConfigs(): Promise<Record<string, Partial<IKConfig>>>;
+    setInstanceConfig(instanceId: string, config: Partial<IKConfig>): Promise<void>;
     /**
      * Discovers available providers by checking environment variables and local health.
      */

package/dist/index.js

@@ -48,10 +48,10 @@ var Registry = class _Registry {
   /**
    * Loads instance configurations with Hook support
    */
-  load() {
+  async load() {
     if (this.hooks?.loadState) {
       try {
-        const hookData = this.hooks.loadState("ik_registry");
+        const hookData = await this.hooks.loadState("ik_registry");
         if (hookData) return JSON.parse(hookData);
       } catch (e) {
         console.warn("[IK_REGISTRY] Registry load via hook failed, falling back...");
@@ -72,10 +72,10 @@ var Registry = class _Registry {
     }
     return {};
   }
-  save(data) {
+  async save(data) {
     const jsonStr = JSON.stringify(data, null, 2);
     if (this.hooks?.persistState) {
-      this.hooks.persistState("ik_registry", jsonStr);
+      await this.hooks.persistState("ik_registry", jsonStr);
     }
     if (fs && this.registryPath) {
       try {
@@ -90,10 +90,10 @@ var Registry = class _Registry {
       }
     }
   }
-  updateInstance(instanceId, config) {
-    const all = this.load();
+  async updateInstance(instanceId, config) {
+    const all = await this.load();
     all[instanceId] = { ...all[instanceId] || {}, ...config, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-    this.save(all);
+    await this.save(all);
   }
   getUsageFilePath() {
     return this.usagePath;
@@ -116,13 +116,25 @@ var Registry = class _Registry {
     } catch (e) {
     }
   }
-  clearUsage() {
+  async clearUsage() {
     if (!fs || !this.usagePath) return;
     try {
       if (fs.existsSync(this.usagePath)) fs.unlinkSync(this.usagePath);
     } catch (e) {
     }
   }
+  async getLastFlushTime() {
+    if (this.hooks?.loadState) {
+      const val = await this.hooks.loadState("ik_last_flush");
+      if (val) return parseInt(val, 10);
+    }
+    return null;
+  }
+  async setLastFlushTime(time) {
+    if (this.hooks?.persistState) {
+      await this.hooks.persistState("ik_last_flush", time.toString());
+    }
+  }
 };
 
 // src/lib/hmac.ts
@@ -160,6 +172,7 @@ var ConfigManager = class {
   config;
   registry;
   hooks;
+  blockedInstances = /* @__PURE__ */ new Set();
   constructor(initialConfig, hooks) {
     this.config = initialConfig;
     this.hooks = hooks;
@@ -167,7 +180,6 @@ var ConfigManager = class {
     if (hooks) {
       this.registry.setHooks(hooks);
     }
-    this.loadFromRegistry();
   }
   getRegistry() {
     return this.registry;
@@ -183,16 +195,16 @@ var ConfigManager = class {
         if (state) {
           const parsed = JSON.parse(state);
           const registry = this.registry;
-          registry.save(parsed);
-          this.loadFromRegistry();
+          await registry.save(parsed);
+          await this.loadFromRegistry();
         }
       } catch (e) {
         console.warn("[IK_CONFIG] Hydration from hooks failed:", e);
       }
     }
   }
-  loadFromRegistry() {
-    const instanceConfigs = this.registry.load();
+  async loadFromRegistry() {
+    const instanceConfigs = await this.registry.load();
     this.config.instanceConfigs = {
       ...this.config.instanceConfigs || {},
       ...instanceConfigs
@@ -234,7 +246,7 @@ var ConfigManager = class {
             return;
           }
         }
-        this.setInstanceConfig(instanceId, {
+        await this.setInstanceConfig(instanceId, {
           billingStatus: data.billingStatus,
           isVerified: data.isVerified,
           pricing: data.pricing,
@@ -246,7 +258,7 @@ var ConfigManager = class {
       }
     } catch (error) {
       console.error(`[IK_CONFIG] Remote sync failed (${error.message}). Falling open (Fail-Open mode).`);
-      this.setInstanceConfig(instanceId, {
+      await this.setInstanceConfig(instanceId, {
         isVerified: true,
         lastSyncDate: now.toISOString()
       });
@@ -266,11 +278,27 @@ var ConfigManager = class {
     if (instanceId && this.config.instanceConfigs?.[instanceId]) {
       merged = { ...merged, ...this.config.instanceConfigs[instanceId] };
     }
+    if (instanceId && this.blockedInstances.has(instanceId)) {
+      merged.billingStatus = "blocked";
+    }
     if (override) {
       merged = { ...merged, ...override };
     }
     return merged;
   }
+  /**
+   * Updates the live blocked status for an instance (Kill-Switch).
+   * This is used by UsageTracker when it receives a response from the central server.
+   */
+  async setBlockedStatus(instanceId, blocked) {
+    if (blocked) {
+      this.blockedInstances.add(instanceId);
+      await this.setInstanceConfig(instanceId, { billingStatus: "blocked" });
+    } else {
+      this.blockedInstances.delete(instanceId);
+      await this.setInstanceConfig(instanceId, { billingStatus: "active" });
+    }
+  }
   updateConfig(newConfig) {
     this.config = {
       ...this.config,
@@ -309,7 +337,7 @@ var ConfigManager = class {
             return false;
           }
         }
-        this.setInstanceConfig(instanceId, {
+        await this.setInstanceConfig(instanceId, {
           licenseKey: data.licenseKey,
           billingStatus: data.status.toLowerCase(),
           isVerified: true,
@@ -325,10 +353,10 @@ var ConfigManager = class {
       return false;
     }
   }
-  ensureInstanceConfig(instanceId) {
-    const all = this.registry.load();
+  async ensureInstanceConfig(instanceId) {
+    const all = await this.registry.load();
     if (!all[instanceId]) {
-      this.registry.updateInstance(instanceId, {
+      await this.registry.updateInstance(instanceId, {
         balance: this.config.balance || 0.5,
         aggressiveness: this.config.aggressiveness || 0.5,
         isEnabled: true,
@@ -336,15 +364,15 @@ var ConfigManager = class {
         ownerEmail: this.config.ownerEmail
         // Inherit from global if not specific
       });
-      this.loadFromRegistry();
+      await this.loadFromRegistry();
     }
   }
-  getInstanceConfigs() {
+  async getInstanceConfigs() {
     return this.registry.load();
   }
-  setInstanceConfig(instanceId, config) {
-    this.registry.updateInstance(instanceId, config);
-    this.loadFromRegistry();
+  async setInstanceConfig(instanceId, config) {
+    await this.registry.updateInstance(instanceId, config);
+    await this.loadFromRegistry();
   }
 };
 
@@ -1463,11 +1491,14 @@ var UsageTracker = class {
   }
   async checkFlushConditions(instanceId) {
     const now = Date.now();
+    if (this.lastFlushTime === 0) {
+      const persisted = await this.config.getRegistry().getLastFlushTime();
+      if (persisted) this.lastFlushTime = persisted;
+      else this.lastFlushTime = now;
+    }
     const timeSinceFlush = now - this.lastFlushTime;
     if (this.aggregationMap.size >= this.BATCH_SIZE_THRESHOLD || timeSinceFlush >= this.TIME_THRESHOLD_MS) {
-      this.performAsyncFlush(instanceId).catch((err) => {
-        console.error("[IK_TRACKER] Background flush failed:", err);
-      });
+      await this.performAsyncFlush(instanceId);
     }
   }
   async performAsyncFlush(instanceId) {
@@ -1476,7 +1507,8 @@ var UsageTracker = class {
     const reports = Array.from(this.aggregationMap.values());
     this.aggregationMap.clear();
     this.lastFlushTime = Date.now();
-    const licenseKey = this.config.getConfig().instanceConfigs?.[instanceId]?.licenseKey || this.config.get("licenseKey");
+    const instanceConfigs = await this.config.getInstanceConfigs();
+    const licenseKey = instanceConfigs[instanceId]?.licenseKey || this.config.get("licenseKey");
     const payload = {
       licenseKey: licenseKey || "TRIAL-KEY",
       instanceId,
@@ -1509,7 +1541,8 @@ var UsageTracker = class {
       try {
         const crypto = typeof window === "undefined" ? (await import("crypto")).default : null;
         if (crypto && crypto.createHmac) {
-          payload.signature = crypto.createHmac("sha256", hmacSecret).update(JSON.stringify(payload)).digest("hex");
+          const { signature: _sig, ...signablePayload } = payload;
+          payload.signature = crypto.createHmac("sha256", hmacSecret).update(JSON.stringify(signablePayload)).digest("hex");
         }
       } catch (e) {
       }
@@ -1525,6 +1558,17 @@ var UsageTracker = class {
     if (!response.ok) {
       throw new Error(`HTTP Error: ${response.status} ${response.statusText}`);
     }
+    try {
+      const data = await response.json();
+      if (data && (data.status === "blocked" || data.billingStatus === "blocked")) {
+        this.config.setBlockedStatus(payload.instanceId, true);
+        console.warn(`[IK_TRACKER] \u{1F6E1}\uFE0F Kill-Switch triggered for ${payload.instanceId}: Subscription inactive/blocked.`);
+      } else if (data && (data.status === "active" || data.billingStatus === "active" || data.status === "trial")) {
+        this.config.setBlockedStatus(payload.instanceId, false);
+      }
+    } catch (e) {
+    }
+    await this.config.getRegistry().setLastFlushTime(this.lastFlushTime);
     this.hooks?.onFlushSuccess?.(payload);
   }
   async handleFailure(payload) {
@@ -1738,11 +1782,11 @@ var IKFirewallCore = class _IKFirewallCore {
   getSessionDNA() {
     return this.sessionDNA;
   }
-  getInstanceConfigs() {
+  async getInstanceConfigs() {
     return this.configManager.getInstanceConfigs();
   }
-  setInstanceConfig(instanceId, config) {
-    this.configManager.setInstanceConfig(instanceId, config);
+  async setInstanceConfig(instanceId, config) {
+    await this.configManager.setInstanceConfig(instanceId, config);
   }
   /**
    * Discovers available providers by checking environment variables and local health.
@@ -1826,17 +1870,12 @@ var IKFirewallCore = class _IKFirewallCore {
       this.hydrated = true;
     }
     if (instanceId) {
-      this.configManager.ensureInstanceConfig(instanceId);
-      this.configManager.syncRemoteConfig(instanceId).catch((err) => {
-        console.warn("[IK_CORE] Heartbeat sync failed:", err);
-      });
+      await this.configManager.ensureInstanceConfig(instanceId);
     }
     const mergedConfig = this.configManager.getMergedConfig(instanceId);
-    if (instanceId && mergedConfig?.isVerified === false) {
-      if (mergedConfig?.billingStatus === "blocked") {
-        this.hooks?.onStatus?.("\u26A0\uFE0F [IK_FIREWALL] Subscription inactive. Optimization bypassed (Fail-Safe mode).");
-        return this.getEmptyMetrics();
-      }
+    if (instanceId && mergedConfig?.billingStatus === "blocked") {
+      this.hooks?.onStatus?.("\u26A0\uFE0F [IK_FIREWALL] Subscription inactive. Optimization bypassed (Fail-Safe mode).");
+      return this.getEmptyMetrics();
     }
     let auditProvider = this.localProvider;
     let overrideProvider = null;
@@ -1966,7 +2005,7 @@ var IKFirewallCore = class _IKFirewallCore {
   }
   async analyzeAIAssisted(input, provider, personaName = "professional", instanceId, configOverride) {
     if (instanceId) {
-      this.configManager.ensureInstanceConfig(instanceId);
+      await this.configManager.ensureInstanceConfig(instanceId);
     }
     const activeConfig = this.configManager.getMergedConfig(instanceId, configOverride);
     const locale = activeConfig?.locale || "en";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ik-firewall/core",
-  "version": "2.3.7",
+  "version": "2.4.1",
   "type": "module",
   "description": "The core IK Firewall engine for semantic-driven AI optimization.",
   "main": "./dist/index.js",