🔥 MODDERENGINE 4.2

ModderEngine is a high-security browser-based runtime and bundler. It compiles your entire frontend (HTML, CSS, JS, and API configurations) into a single, AES-256-GCM encrypted binary file (app.mdc).

The decryption key is never stored on the disk or sent via HTTP. It is delivered securely via a RAM-only WebSocket handshake, ensuring your source code remains invisible to inspectors, scrapers, and standard network sniffing tools.

---

🚀 Key Features

• 🛡️ AES-256-GCM Encryption: Full-project encryption (Routes, Assets, Logic).
• 🔑 RAM-Only Key Exchange: Master keys exist only in volatile memory; they vanish on reload.
• 🐍 Django & Backend Support: Generates "Skeleton" files that mirror your directory structure, allowing seamless integration with Django, Laravel, or PHP.
• 🔒 Secure API Tunneling: Intercepts fetch() requests, encrypts the payload, and routes them through a secure server proxy. Hides real API endpoints from the Network tab.
• ⚡ Zero-Config & Live Reload: Auto-watches files and reloads the browser on changes.
• 🚫 Smart Asset Handling: Automatically strips <script> and <link> tags to prevent 404 errors, injecting assets directly from memory.

---

🛠 Installation

You can install ModderEngine globally via NPM:

npm install -g modderengine

Or run it locally within your project using npx or by linking it.

---

💻 CLI Usage

ModderEngine is controlled via a single command-line interface.

Basic SPA (Single Page App)

Builds everything in src/ and runs the secure server.

modderengine --build --run

Backend Integration (Django/PHP)

Scans specific folders (like templates), preserves server syntax (like {% url %}), and generates directory mirrors.

modderengine --build --dirs=templates,static --django=true --server-mode=true

CLI Flags Reference

Flag	Description
--build, -b	Compiles the project into dist/ and app.mdc.
--run, -r	Starts the Node.js Key Server (Default Port: 3000).
--dirs=name	Comma-separated list of folders to scan (e.g., --dirs=templates,static). Default is src.
--django=true	Generates "Skeleton" HTML files in dist/ mirroring the input structure. Essential for backend routing.
--server-mode=true	Preserves backend syntax (e.g., {{ var }}) inside the bundle without trying to execute it.
--route-based=false	Disables clean URLs (auto-routing) if you prefer strict file paths.

---

🐍 Using with Django (Integration Guide)

ModderEngine allows you to protect your frontend while keeping your Django backend logic.

1. Directory Setup

Assume your Django project looks like this:

my_project/
├── templates/
│   ├── index.html
│   └── dashboard/
│       └── views.html
└── static/
    └── style.css

2. Build Command

Run this command in your project root:

modderengine --build --django=true --server-mode=true --dirs=templates,static

3. What Happens?

• Input: It reads your source templates.
• Encryption: It packs the content of your templates into app.mdc.
• Output (dist/): It recreates the folder structure in dist/.
  • dist/templates/index.html will contain a Skeleton Loader, not your code.
  • The Skeleton Loader connects to the ModderEngine Key Server to render the content.

4. Running

1. Terminal 1: Run the Key Server.

   modderengine --run

2. Terminal 2: Run Django (pointed to serve files from dist/templates).

   python manage.py runserver

---

🔒 Secure API Interceptor (The Tunnel)

ModderEngine can hide your real API endpoints from the browser's Network Tab.

1. Configure api.json

Create an api.json file inside your source directory (e.g., src/api.json or templates/api.json).

{
  "https://api.supersecret.com/v1/users": {
    "method": "GET",
    "redirected_path": "/secure/get-users"
  },
  "https://api.supersecret.com/v1/login": {
    "method": "POST",
    "redirected_path": "/auth/login-gateway"
  }
}

2. Write Standard JavaScript

In your frontend code, you call the real URL:

// You write this:
fetch('https://api.supersecret.com/v1/users')
  .then(res => res.json())
  .then(data => console.log(data));

3. The Security Magic

1. Intercept: The Engine sees the request matches api.json.
2. Encrypt: It stops the request, encrypts your headers/body/cookies into binary.
3. Redirect: It sends a POST request to http://localhost:3000/secure/get-users.
4. Proxy: The Node server decrypts it, calls the actual external API server-side, and encrypts the response.
5. Result: The browser Network Tab shows only binary garbage sent to /secure/get-users. The real API URL is never exposed.

---

🏗 Architecture

Build Process

1. Scans directories (--dirs).
2. Removes <script> and <link> tags from HTML to prevent 404s.
3. Bundles HTML, CSS, JS, and API Config.
4. Encrypts payload using AES-256-GCM.
5. Saves to dist/public/app.mdc.

Runtime Process

1. Browser loads the Skeleton (or index.html).
2. Connects to Key Server via WebSocket (WSS).
3. Server sends MasterKey XOR SessionKey.
4. Browser reconstructs key in RAM.
5. Browser downloads and decrypts app.mdc.
6. Engine injects CSS into memory and renders the HTML route.
7. Engine overrides window.fetch to handle secure API tunneling.

---

⚠️ Requirements

• Node.js: v14.0.0 or higher.
• Modern Browser: Support for WebCrypto API (Chrome, Firefox, Edge, Safari).

---

📝 License

ModderEngine is open-source software. (c) 2024 ModderBoyy. All rights reserved.