@pigmilcom/a11y 1.1.0 → 1.1.1

package/README.md

@@ -78,11 +78,12 @@ A "request" is one widget initialisation (page load / route change).
 
 1. On widget mount the browser makes a single `GET` request to the PIGMIL API.
 2. The API checks whether the domain is registered and within quota.
-3. The response (`valid`, `blocked`, or error) controls whether the widget renders:
+3. The response controls whether the widget renders:
    - **`valid`** — widget renders normally.
    - **`blocked`** — quota exceeded; widget does not render until the day / month resets or the plan is upgraded.
    - **`error`** / API unreachable — widget does not render (fail-closed on non-local domains).
 4. The result is cached in `sessionStorage` for 30 minutes to avoid redundant calls.
+5. Cached and returned result objects are `Object.freeze()`d — their `status` and `plan` properties cannot be mutated after resolution.
 
 ### Local / development environments
 
@@ -92,9 +93,19 @@ Validation is **automatically skipped** when the page runs on:
 
 The widget always renders in these environments with a free-plan appearance. No API key or sign-up is required during development.
 
+### Security layers
+
+| Layer | What it does |
+|---|---|
+| **Server-side enforcement** (primary) | The PIGMIL API only validates registered domains, increments per-domain counters, and returns `blocked:true` when quotas are exceeded. This is the real gate — no client-side bypass can defeat it. |
+| **Frozen result objects** | `Object.freeze()` on the validation result prevents callers from mutating `{ status, plan }` to escalate their own access level. |
+| **CDN bundle obfuscation** | `dist/a11y.cdn.js` is post-processed by `javascript-obfuscator` with Base64 string-array encoding and self-defending code. The self-defending wrapper causes the bundle to break at runtime if it has been reformatted / prettified before execution, deterring the "prettify → grep → patch → re-minify" bypass workflow. The npm package source remains intentionally readable (open source). |
+| **XOR-encoded endpoint** | The API URL is stored as a numeric XOR array in source and decoded at runtime, making it non-trivial to locate in the minified + obfuscated CDN bundle. |
+| **Daily-rotating request signature** | Each API call includes an FNV-1a hash of `domain + YYYY-MM-DD` — a per-domain-per-day token the server can optionally verify to detect replayed or forged requests. |
+
 ### Current status (mock mode)
 
-The API endpoint is being implemented in the PIGMIL backend. Until it is live, `src/license.js` uses a **mock response** that always returns `{ ok: true, plan: 'free', blocked: false }`. To switch to the real API, remove the `_mock` block and uncomment the `fetch` block in that file.
+The API endpoint is being implemented in the PIGMIL backend. Until it is live, `src/license.js` uses `MOCK_MODE = true`, which always returns `{ ok: true, plan: 'free', blocked: false }`. To switch to the real API, set `MOCK_MODE = false` in that file — the fetch code is already written and ready.
 
 ---