Embed Merisar directly in your code.

Returns 1 if the process is being debugged, else 0.

if (svp_debugger_present()) { /* ... */ }

• Checks four documented signals: IsDebuggerPresent, CheckRemoteDebuggerPresent, PEB.BeingDebugged (direct read, survives API hooks), NtGlobalFlag heap-debug bits.
• Self-directed only. Not debugger-blinding / anti-attach — just a signal you can respond to.
• Treat as advisory: a stealth plugin can hide from all four. Weight it; prefer folding results via svp_poison() over hard gates.

Returns 1 if a hypervisor is present (CPUID), else 0.

int suspect_env = svp_in_vm();

• Reads CPUID.1 ECX[31] (hypervisor-present) and the vendor leaf 0x40000000.
• Advisory. Will false-positive on legitimate users running in VMs or on cloud workstations — never hard-gate on this alone.

Keyed MAC over a buffer.

uint64_t tag = svp_mac(blob, len, K0, K1);

• SipHash-2-4. Fast on short messages, keyed (not plain checksum).
• Derive K0/K1 at runtime where you can — a key embedded as a literal in the binary is recoverable like any other embedded constant.

Returns 1 iff svp_mac(data,len,k0,k1) == expected. Constant-time tag compare.

if (!svp_verify(blob, len, K0, K1, SEALED_TAG)) corrupt_state();

• Use this to detect tampering of data you sealed at build time.
• The tag comparison is constant-time (no timing side channel on the 8 bytes).

MAC a region of the process's own code — detect inline hooks / breakpoints / patches.

uint64_t h = svp_code_mac(&hot_fn, hot_len, K0, K1);
if (h != SEALED_FN_TAG) corrupt_state();

• Same primitive as svp_mac. Measure the byte range of the function you sealed at build time.
• For a reliable fn-size, bake it in via linker symbols or compute at build time with a tool — do not guess at runtime.

Branchless select: returns mask when tripped is nonzero, else 0.

// Fold a check into a value — no visible "if (bad)" branch to NOP out.
key ^= svp_poison(SECRET_MASK, svp_debugger_present());

• The whole point: tampered code silently produces wrong results — no compare / branch for an attacker to find and skip.
• Compose with svp_debugger_present / svp_in_vm / svp_verify to turn any boolean signal into a poisoned value.

Constant-time byte compare. 1 if equal, 0 otherwise.

if (svp_ct_equal(user_mac, expected_mac, 32)) grant_access();

• No early-out: runtime does not depend on where the first differing byte is.
• Use whenever you compare secrets (MACs, tokens, HMAC digests). Never use memcmp for that.

Zero memory such that the compiler cannot elide the write.

svp_secure_zero(derived_key, sizeof derived_key);

• Call on sensitive buffers after use — stack-local keys, decrypted material, scrub lists.
• Does not help against swapping / core dumps / cold-boot — those need OS-level mitigations too.

Register a build and get a short-lived GCS signed PUT URL. The server never touches your binary; you upload directly to object storage.

curl -X POST https://merisar.com/api/v1/builds \
  -H "Authorization: Bearer svp_live_XXXXXXXXXXXX" \
  -H "Content-Type: application/json" \
  -d '{
    "inputFilename": "app.exe",
    "inputSize": 1457920,
    "profile": { "base": "medium" }
  }'

# → 201
# {
#   "buildId": "f1e2d3c4-...",
#   "status": "pending_upload",
#   "uploadUrl": "https://storage.googleapis.com/...",
#   "uploadMethod": "PUT",
#   "uploadContentType": "application/octet-stream",
#   "uploadMaxBytes": 1457920,
#   "uploadExpiresAt": "2026-10-09T18:40:00.000Z",
#   "commitUrl": ".../api/v1/builds/f1e2.../commit",
#   "statusUrl": ".../api/v1/builds/f1e2..."
# }

• Size cap: 128 MiB. Larger inputs are rejected with 400.
• Profile keys: base = light | medium | virtualized, optional seed = <hex>. See Layer 1 for which transforms each base runs.
• The signed URL is single-use and bound to Content-Type: application/octet-stream + the exact Content-Length you declared.

Push the bytes directly to GCS. Nothing proxies through our Next.js server, so this scales independent of your binary size.

curl -X PUT "<uploadUrl>" \
  -H "Content-Type: application/octet-stream" \
  --data-binary @app.exe
# → 200

Tell Merisar the upload is complete. We verify the object landed, match the declared size, flip the row to queued, and enqueue the protector. Idempotent.

curl -X POST https://merisar.com/api/v1/builds/f1e2.../commit \
  -H "Authorization: Bearer svp_live_XXXXXXXXXXXX"

# → 200
# { "ok": true, "buildId": "f1e2...", "status": "queued" }

Status + metadata. Poll at 1–2 Hz while the build is in flight; stop once status is terminal.

curl https://merisar.com/api/v1/builds/f1e2... \
  -H "Authorization: Bearer svp_live_XXXXXXXXXXXX"

# → 200
# {
#   "id": "f1e2...",
#   "status": "succeeded",      // pending | queued | running | succeeded | failed
#   "inputFilename": "app.exe",
#   "inputSize": 1457920,
#   "outputSize": 1521664,
#   "durationMs": 8420,
#   "fingerprintHex": "a2c9...",
#   "reportText": "...",        // protector stdout, up to 32 KB
#   "errorText": null,
#   "createdAt": "...",
#   "startedAt": "...",
#   "completedAt": "...",
#   "downloadUrl": ".../api/builds/f1e2.../download"
# }

• Terminal statuses: succeeded, failed, cancelled.
• fingerprintHex is the R12 watermark — hand it to /api/forensics/identify on a recovered binary to trace a leak back to the issuing build.

List up to 50 recent builds for this key's team, newest first.

curl https://merisar.com/api/v1/builds \
  -H "Authorization: Bearer svp_live_XXXXXXXXXXXX"

# → 200
# { "builds": [ { "id": "...", "status": "succeeded", ... }, ... ] }

302 redirect to a short-lived GCS signed GET URL. The download comes directly from GCS; no proxying.

curl -L https://merisar.com/api/builds/f1e2.../download \
  -H "Authorization: Bearer svp_live_XXXXXXXXXXXX" \
  -o protected.exe

• Only works once status === "succeeded"; otherwise returns 409.
• Session cookies also work here — this is the same URL the dashboard "Download" button uses.
• The signed URL expires in 5 minutes; refetch to download again.