Shield API

# CLI (CI / scripts / ad-hoc)
npm install --save-dev shieldmycode-cli

# Webpack 5
npm install --save-dev shieldmycode-webpack-plugin

# Vite / Rollup
npm install --save-dev shieldmycode-vite-plugin

# Header on every request
Authorization: Bearer shield_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Or as the SHIELD_API_KEY env var for the CLI / plugins
export SHIELD_API_KEY=shield_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

curl -s -X POST https://shield.shieldmycode.com/api/v1/obfuscate \
  -H "Authorization: Bearer $SHIELD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "source": "const secret = \"alpha\"; function unlock(c) { return c === secret; }",
    "kind":   "js",
    "options": { "level": "hard", "antiLlm": true }
  }' | jq .

{
  "output":     "(function(){\"use strict\";var _0xH=\"...\";...})();",
  "bytesIn":    67,
  "bytesOut":   12450,
  "durationMs": 8,
  "kind":       "js",
  "level":      "hard",
  "quota":      { "used": 1, "limit": 3, "plan": "free" }
}

{
  "source": "string (required) — JS or HTML source to obfuscate. Max 50 MB.",
  "kind":   "\"js\" | \"html\" (required)",
  "options": {
    "level":            "\"soft\" | \"medium\" | \"hard\" (default \"hard\")",
    "encodeStrings":    "boolean (default true)",
    "obfuscateNumbers": "boolean (default true)",
    "mangleLocals":     "boolean (default true)",
    "integrity":        "boolean (default true)",
    "debuggerTrap":     "boolean (default true)",
    "devToolsCheck":    "boolean (default true)",
    "heartbeatMs":      "number (50–5000, default 250)",
    "noscriptFallback": "boolean (default true)",
    "stealth":          "boolean (default false) — HTML only",
    "headlessCheck":    "boolean (default true)",
    "antiLlm":          "boolean (default true) — anti-LLM defenses",
    "deadCode":         "boolean (default false) — inject decoy branches",
    "domainLock":       "string — comma-separated hostnames",
    "expiresAt":        "string — ISO 8601 datetime",
    "geoAllow":         "string — comma-separated ISO 3166-1 country codes",
    "browserBlocklist": "string — comma-separated UA substrings",
    "osBlocklist":      "string — comma-separated OS names",
    "ipBlocklist":      "string — comma-separated IPv4/IPv6",
    "telemetryUrl":     "string — POST tamper events here"
  }
}

{
  "output":     "string — the obfuscated payload",
  "bytesIn":    "number — input size",
  "bytesOut":   "number — output size",
  "durationMs": "number — server-side processing time",
  "kind":       "\"js\" | \"html\"",
  "level":      "the strictness that ran",
  "quota":      { "used": 1, "limit": 1000, "plan": "pro" }
}

# single file -> next to it
SHIELD_API_KEY=shield_xxx npx shield obfuscate app.js

# explicit output
npx shield obfuscate app.js -o dist/app.shield.js

# whole dist/ tree, mirrored under dist-shield/
npx shield obfuscate dist -o dist-shield --recursive

# glob with config file (shield.config.js auto-detected)
npx shield obfuscate "src/**/*.{js,html}" -o dist-shield

// webpack.config.js
const ShieldPlugin = require('shieldmycode-webpack-plugin');

module.exports = {
  // ...your existing config...
  plugins: [
    new ShieldPlugin({
      apiKey: process.env.SHIELD_API_KEY,
      options: {
        level: 'hard',
        antiLlm: true,
        domainLock: 'mycompany.com'
      }
    })
  ]
};

// vite.config.js
import { defineConfig } from 'vite';
import shield from 'shieldmycode-vite-plugin';

export default defineConfig({
  plugins: [
    shield({
      apiKey: process.env.SHIELD_API_KEY,
      options: { level: 'hard', antiLlm: true }
    })
  ]
});

name: Build & protect
on:
  push:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npm ci && npm run build
      - run: npx shieldmycode-cli obfuscate dist -o dist-protected --recursive
        env:
          SHIELD_API_KEY: ${{ secrets.SHIELD_API_KEY }}
      - uses: actions/upload-artifact@v4
        with: { name: protected, path: dist-protected }

#!/usr/bin/env bash
# Obfuscate every .js in ./dist into ./dist-protected
mkdir -p dist-protected
for f in dist/**/*.js; do
  rel="${f#dist/}"
  out="dist-protected/${rel}"
  mkdir -p "$(dirname "$out")"
  source=$(cat "$f")
  curl -sS -X POST https://shield.shieldmycode.com/api/v1/obfuscate \
    -H "Authorization: Bearer $SHIELD_API_KEY" \
    -H "Content-Type: application/json" \
    -d "$(jq -nc --arg s "$source" '{source:$s, kind:"js", options:{level:"hard"}}')" \
    | jq -r '.output' > "$out"
  echo "  $f -> $out"
done

# shield.py — minimal Shield API wrapper
import os, requests, pathlib

API_KEY = os.environ['SHIELD_API_KEY']
BASE    = 'https://shield.shieldmycode.com'

def obfuscate(source: str, kind: str = 'js', **options) -> dict:
    r = requests.post(
        f'{BASE}/api/v1/obfuscate',
        headers={ 'Authorization': f'Bearer {API_KEY}' },
        json={ 'source': source, 'kind': kind, 'options': options },
        timeout=30,
    )
    r.raise_for_status()
    return r.json()

# Usage
src = pathlib.Path('app.js').read_text()
result = obfuscate(src, level='hard', antiLlm=True)
pathlib.Path('app.shield.js').write_text(result['output'])
print(f"{result['quota']['used']}/{result['quota']['limit']} this month")