SYK.INIT
v2.0
PROTOCOL.ACTIVE
ENCRYPTED
SEKYURITI
PREPARING ENVIRONMENT
_

AUTHENTICATED POST-DEPLOYMENT CONTROL

DOCUMENTATIONv0.1.0

REGISTRY

Runtime protection for npm packages. Encrypt your source code with server-side key management. The key never exists in the bundle.

NPM PACKAGE
NODE.JS 18+
TYPESCRIPT
*
AI INTEGRATION

TELL YOUR AI

Copy the prompt below and paste it to Claude, ChatGPT, or Cursor to integrate REGISTRY automatically.

01

LOGIN

Get API key

02

PROTECT

Encrypt dist folder

03

PUBLISH

npm publish

04

REQUIRE

Auto-decrypts

01

LOGIN

Authenticate with the CLI. Browser opens automatically.

PREREQUISITES

1.Node.js 18 or higher
2.A built npm package (dist folder)
3.SEKYURITI account
terminalbash
# Run the protect command
npx sekyuriti-protect ./dist

# If not logged in, browser opens automatically
# Complete login in browser → CLI receives token

AUTOMATIC AUTH FLOW

1

Run the CLI command

npx sekyuriti-protect ./dist

2

Browser opens to login page

sekyuriti.build/auth/cli?token=...

3

Sign in with your account

Google, GitHub, or email

4

CLI receives authentication

Token stored locally, protection continues

ENVIRONMENT VARIABLES

Optional. CLI handles authentication automatically.

SEKYURITI_REGISTRY_API_KEYSkip browser auth (CI/CD)
SEKYURITI_REGISTRY_PACKAGE_IDYour package ID (auto-generated)
02

PROTECT

Encrypt your dist folder. Source is transformed with SYKRYPT v6.

terminalbash
# Basic protection
npx sekyuriti-protect ./dist

# With explicit package ID
npx sekyuriti-protect ./dist --package-id abc123

# With output directory
npx sekyuriti-protect ./dist --out ./protected-dist

WHAT HAPPENS

1

Each .js file is encrypted with SYKRYPT v6

6 transformation layers + AES-256-GCM

2

A manifest is generated with file metadata

Hashes, sizes, entry points

3

A loader.js is created that handles runtime decryption

Calls /verify endpoint, decrypts in memory

4

Key is stored server-side

Never in the bundle

ENCRYPTION LAYERS

S-box substitution
Position permutation
XOR key stream
Bit rotation
Interleaving
Checksum verification
AES-256-GCM final encryption
03

PUBLISH

Update package.json and publish normally. Zero friction.

package.jsonjson
{
  "name": "@your-org/protected-package",
  "version": "1.0.0",
  "main": "dist/index.js",
  "exports": {
    ".": {
      "types": "./dist/index.d.ts",
      "import": "./dist/index.mjs",
      "require": "./dist/index.js"
    },
    "./loader": {
      "types": "./dist/loader.d.ts",
      "import": "./dist/loader.mjs",
      "require": "./dist/loader.js"
    }
  },
  "files": [
    "dist"
  ]
}
terminalbash
# Publish as normal
npm publish

# Or with scope
npm publish --access public

FOR YOUR USERS

They npm install and require() normally. The loader handles everything transparently.

NO API KEY NEEDED

The /verify endpoint is public. End users never need credentials.

04

SECURITY

Multi-layer protection at every stage.

SERVER-SIDE KEY MANAGEMENT

The decryption key never exists in the published package. When require() is called, the loader contacts the /verify endpoint to retrieve the key. This happens in memory only.

Key stored on SEKYURITI servers
Retrieved via HTTPS
Never written to disk
Memory-only decryption

VM SANDBOX EXECUTION

Decrypted code runs in an isolated Node.js VM context. Dangerous globals are blocked.

BLOCKEDREASONSTATUS
eval()Code injectionBLOCKED
Function()Code injectionBLOCKED
Hooked fetchInterceptionREJECTED

FETCH VALIDATION

The loader validates that the global fetch is native and unmodified. Hooked or polyfilled fetch implementations are rejected to prevent request interception.

05

API REFERENCE

CLI commands and verification endpoint.

sekyuriti-protect

CLI

Encrypt a dist folder for npm distribution.

sekyuriti-protect <dist-path> [options]

Options:
  --package-id <id>   Package ID from dashboard
  --out <path>        Output directory (default: overwrites dist)
  --api-key <key>     API key (or use env var)
  --help              Show help

Examples:
  sekyuriti-protect ./dist
  sekyuriti-protect ./dist --package-id abc123 --out ./protected

POST /api/v2/registry/verify

PUBLIC

Verify package and retrieve decryption key. No API key required.

// Request
POST https://sekyuriti.build/api/v2/registry/verify
Content-Type: application/json

{
  "package_id": "abc123",
  "file": "index.js"
}

// Response (success)
{
  "verified": true,
  "key": "base64-encoded-key",
  "algorithm": "aes-256-gcm"
}

// Response (failure)
{
  "verified": false,
  "error": "Package not found"
}

Loader Exports

require('@your-org/package')

Standard require. Loader intercepts, verifies, decrypts, and returns exports.

require('@your-org/package/loader')

Direct loader access. Returns loader utilities if needed.

PROTECT YOUR NPM PACKAGE

Server-side key. Zero SDK. npm compatible.

GET STARTEDVIEW MODULE