unpeek 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Efe Arabacı & unpeek contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,246 @@
-# Temporary Holding Version
+# unpeek
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Zero-config, call-graph-aware polymorphic JavaScript protection and runtime anti-tamper toolkit with <2% CPU overhead.**
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-emerald.svg)](LICENSE)
+[![CPU Overhead](https://img.shields.io/badge/CPU_Overhead-%3C2%25-10b981.svg)](packages/unpeek/benchmarks/overhead.bench.ts)
+[![Gzip Delta](https://img.shields.io/badge/Gzip_Delta-%3C15%25-06b6d4.svg)](packages/unpeek/benchmarks/overhead.bench.ts)
+[![Interactive Playground](https://img.shields.io/badge/Playground-Live_Demo-6366f1.svg)](https://woffluon.github.io/unpeek)
+
+English | [Türkçe](./README.tr.md) · [Live Interactive Playground](https://woffluon.github.io/unpeek) · [Agent Architecture Guide](./AGENTS.md) · [AI Skill](./skills/unpeek/SKILL.md)
+
+---
+
+<baglam>
+
+## Why unpeek?
+
+Shipping a modern web application in Next.js, Vite, or Webpack exposes client-side business logic, internal API endpoints, feature flags, and proprietary algorithms to anyone who opens Chrome DevTools or runs an automated AST deobfuscator (`webcrack`, `synchrony`).
+
+Existing tools force an uncomfortable trade-off:
+- **Standard minifiers (`esbuild`, `SWC`, `Terser`)** compress whitespace and shorten variable names, leaving string literals, endpoint URLs, and control flow readable after a single click on the DevTools Pretty-Print (`{}`) button.
+- **Legacy AST obfuscators (`javascript-obfuscator`)** apply indiscriminate control-flow flattening, `eval` traps, and eager string-array rotation to every function in the bundle. This inflates bundle sizes by 40–300%, breaks V8 TurboFan JIT inlining inside 60fps UI rendering loops, and triggers false-positive browser freezes.
+
+`unpeek` resolves this trade-off by combining static call-graph analysis with polymorphic compile-time encryption:
+
+| Capability | Standard Minifiers (`Terser` / `SWC`) | Legacy AST Obfuscators | `unpeek` |
+| :--- | :--- | :--- | :--- |
+| **Runtime CPU Overhead** | ~0% | 15% – 85% (throttles UI loops) | **< 2.0%** (Call-Graph Hot-Path Exemption) |
+| **Gzip Bundle Growth** | 0% (Baseline) | +45% – +300% | **< 15%** (O(1) Lazy String Vault) |
+| **String & Endpoint Encryption** | Plaintext in bundle | Eager array rotation (high CPU) | **Polymorphic XOR + O(1) Memoized Vault** |
+| **DevTools Pretty-Print (`{}`) Defense** | None | `debugger` infinite loops (easily bypassed) | **`Function.prototype.toString()` FNV-1a Integrity** |
+| **Source Map Isolation** | Manual CI scripts | Manual configuration | **Automatic `.unpeek-maps/` Vault + Comment Strip** |
+| **Static Deobfuscator Resistance** | None | Fixed templates (fingerprinted by `webcrack`) | **Per-Build Polymorphic AST Seed** |
+| **SSR / Next.js Compatibility** | Native | Frequently breaks server hydration | **Client-Only Auto-Detection + SSR Guard** |
+
+### Core Architecture
+
+1. **Call-Graph Hot-Path Exemption (`<2%` CPU Budget)**
+   Before modifying a single AST node, [`detectHotPaths`](packages/unpeek/src/ast/index.ts) traverses the file's call graph. Functions containing loops (`for`, `while`, `do-while`, `for-of`), array higher-order callbacks (`.map`, `.filter`, `.reduce`, `.forEach`), `requestAnimationFrame` tickers, and React/UI render components (`useState`, `useEffect`, `createElement`) are flagged as hot paths. `unpeek` mangles identifiers and encrypts string constants across the entire bundle, while injecting opaque control-flow predicates exclusively into cold functions (such as license checks, request signers, and auth validators). V8 JIT optimization inside hot loops remains untouched.
+2. **O(1) Lazy String Vault (`<15%` Gzip Budget)**
+   Plaintext string literals (`minStringLength >= 4`) are encrypted at build time with a polymorphic XOR stream cipher keyed by a per-build 32-bit seed. Instead of decrypting every string on page startup, the injected vault helper decodes each string lazily on its first access and caches the plaintext result in its array slot. Subsequent reads resolve in O(1) time via direct array indexing.
+3. **Self-Defending `Function.prototype.toString()` Integrity & Passive Deterrent**
+   When an analyst formats a protected chunk using DevTools Pretty-Print (`{}`) or edits a branch instruction in the Sources panel, the formatted source alters `Function.prototype.toString()`. [`verifyCodeIntegrity`](packages/unpeek/src/runtime/index.ts) validates a seeded 32-bit FNV-1a checksum against the function's source representation with zero false positives on untouched minified code, triggering gradual state degradation (`deterrentMode: 'gradual'`) rather than an obvious crash point that attackers can patch out.
+4. **Automatic Source Map Vault (`.unpeek-maps/`)**
+   Leaving `.js.map` files in a public build directory reconstructs your original TypeScript project tree inside DevTools. [`protectDirectory`](packages/unpeek/src/cli/index.ts) automatically extracts `.map` files from your public build directory into a private `.unpeek-maps/` folder and strips `//# sourceMappingURL=` comments from every client bundle so you can upload maps to Sentry or Datadog without serving them to end users.
+
+</baglam>
+
+---
+
+<talimat>
+
+## Quick Start
+
+### 1. One-Command Project Setup (`npx unpeek init`)
+
+Run the initializer from your project root (Next.js, Vite, Webpack, or vanilla):
+
+```bash
+npx unpeek init
+```
+
+This command performs three non-destructive setup actions:
+1. Detects your framework (`nextjs`, `vite`, `webpack`, or `vanilla`) from `package.json` and build config files.
+2. Adds `"postbuild": "unpeek protect"` to your `package.json` scripts so every production build is automatically protected.
+3. Appends `.unpeek-maps/` to `.gitignore` so extracted source maps stay out of version control.
+
+### 2. CLI Usage (`unpeek protect`)
+
+You can also install `unpeek` as a development dependency and run it directly in CI/CD or local builds:
+
+```bash
+npm install -D unpeek
+npx unpeek protect
+```
+
+#### CLI Options
+
+| Flag | Description | Default |
+| :--- | :--- | :--- |
+| `--dir <path>` | Explicit client output directory override (e.g., `dist/assets`, `.next/static/chunks`) | Auto-detected |
+| `--seed <number>` | Deterministic 32-bit polymorphic build seed | Random per build |
+| `--mode <gradual\|passive>` | Runtime anti-tamper deterrent mode | `gradual` |
+| `--min-str <number>` | Minimum character length for O(1) lazy string vault encryption | `4` |
+| `--no-shield` | Skip injecting the runtime integrity and DevTools telemetry preamble | Shield enabled |
+| `--delete-maps` | Permanently delete `.map` files instead of moving them to `.unpeek-maps/` | Moves to `.unpeek-maps/` |
+
+### 3. Universal Bundler Plugin (`unpeek/unplugin`)
+
+If you prefer in-memory chunk transformations during the bundler lifecycle rather than a post-build CLI pass, use [`unpeek/unplugin`](packages/unpeek/src/bundler/unplugin.ts):
+
+#### Vite (`vite.config.ts`)
+
+```ts
+import { defineConfig } from 'vite';
+import unpeek from 'unpeek/unplugin';
+
+export default defineConfig({
+  build: {
+    sourcemap: true, // Extracted into .unpeek-maps/ automatically
+  },
+  plugins: [
+    unpeek.vite({
+      deterrentMode: 'gradual',
+      keepPrivateMaps: true,
+    }),
+  ],
+});
+```
+
+#### Next.js (`next.config.mjs`)
+
+Scope the plugin to client bundles (`!isServer`) so Node.js server chunks keep their native stack traces:
+
+```js
+import unpeek from 'unpeek/unplugin';
+
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  webpack(config, { dev, isServer }) {
+    if (!dev && !isServer) {
+      config.plugins.push(
+        unpeek.webpack({
+          deterrentMode: 'gradual',
+          keepPrivateMaps: true,
+        })
+      );
+    }
+    return config;
+  },
+};
+
+export default nextConfig;
+```
+
+#### Programmatic API
+
+```ts
+import { transformJavaScript, protectDirectory } from 'unpeek';
+
+// Transform an individual JavaScript string in memory
+const result = transformJavaScript(sourceCode, {
+  seed: 0x7f3a91,
+  minStringLength: 4,
+  injectRuntimeShield: true,
+  deterrentMode: 'gradual',
+});
+
+console.log(result.hotPathReport);
+// { totalFunctions: 12, hotFunctionsSkipped: ['renderLoop'], coldFunctionsProtected: ['signRequest'] }
+
+// Or protect an entire build directory
+const summary = await protectDirectory({
+  cwd: process.cwd(),
+  keepPrivateMaps: true,
+  privateMapsDir: '.unpeek-maps',
+});
+```
+
+---
+
+## `.unpeek-maps/` Source Map Vault & Sentry Workflow
+
+When `keepPrivateMaps` is enabled (the default), `unpeek` relocates all `.js.map` files from your public output directory into `.unpeek-maps/` while preserving their relative filenames, and strips `//# sourceMappingURL=` directives from the public `.js` chunks.
+
+To retain full stack-trace symbolication in production error trackers:
+
+```bash
+# 1. Build your app and run unpeek (automatically triggered if wired via postbuild)
+npm run build
+
+# 2. Upload the private source maps from .unpeek-maps/ to Sentry or Datadog
+npx @sentry/cli sourcemaps upload .unpeek-maps --release="$GIT_COMMIT_SHA"
+
+# 3. Deploy your public build folder (.next/, dist/, or build/)
+```
+
+---
+
+## Official AI Agent Skill Installation
+
+`unpeek` ships with an official, token-optimized AI Agent Skill ([`skills/unpeek/SKILL.md`](skills/unpeek/SKILL.md)) following Agent Skills Discovery Optimization (SDO) standards. Installing this skill teaches your coding agent (Claude Code, Cursor, Antigravity, OpenAI Codex, or Gemini CLI) how to configure `unpeek`, guard SSR chunks, and wire `.unpeek-maps/` into CI/CD pipelines.
+
+### Project-Scoped Installation (Shared with Team via Git)
+
+Copy the skill into your repository's `.agents/skills/unpeek/` directory:
+
+```bash
+mkdir -p .agents/skills/unpeek
+curl -fsSL https://raw.githubusercontent.com/Woffluon/unpeek/main/skills/unpeek/SKILL.md \
+  -o .agents/skills/unpeek/SKILL.md
+```
+
+### Global Machine Installation (Antigravity / Gemini CLI / Claude Code)
+
+```bash
+# Antigravity & Gemini CLI
+mkdir -p ~/.gemini/config/skills/unpeek
+curl -fsSL https://raw.githubusercontent.com/Woffluon/unpeek/main/skills/unpeek/SKILL.md \
+  -o ~/.gemini/config/skills/unpeek/SKILL.md
+
+# Cross-agent standard (~/.agents/skills)
+mkdir -p ~/.agents/skills/unpeek
+curl -fsSL https://raw.githubusercontent.com/Woffluon/unpeek/main/skills/unpeek/SKILL.md \
+  -o ~/.agents/skills/unpeek/SKILL.md
+```
+
+</talimat>
+
+---
+
+<dogrulama>
+
+## Verification, Testing & Benchmarks
+
+This monorepo is managed with `pnpm` and verified against strict semantic equivalence, deobfuscation resistance, and runtime overhead budgets:
+
+```bash
+# Install workspace dependencies
+pnpm install
+
+# Run unit & reverse-engineering resistance test suites (Vitest)
+pnpm test
+
+# Run the V8 VM CPU overhead (<2%) & Gzip delta (<15%) benchmark
+pnpm bench
+
+# Run strict TypeScript typechecking across packages/unpeek and apps/web
+pnpm typecheck
+
+# Build the core package and static interactive web playground
+pnpm build
+```
+
+### Benchmark Output Reference ([`packages/unpeek/benchmarks/overhead.bench.ts`](packages/unpeek/benchmarks/overhead.bench.ts))
+
+- **Build / Transform Time**: `< 3000 ms`
+- **Gzip Size Delta**: `< 15%` on production application bundles
+- **Runtime CPU Overhead**: `< 2.00%` (interleaved multi-round V8 JIT benchmark)
+- **Plaintext Leak Rate**: `0%` for string literals meeting `minStringLength`
+
+</dogrulama>
+
+## License
+
+Released under the [MIT License](./LICENSE).

package/bin/unpeek.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { runCli } from '../dist/cli/index.js';
+
+runCli(process.argv.slice(2)).catch((err) => {
+  console.error('[unpeek] fatal error:', err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});

package/dist/ast/cold-flow-guard.d.ts

@@ -0,0 +1,2 @@
+import * as acorn from 'acorn';
+export declare function applyColdFlowGuard(ast: acorn.Program, coldFunctionNodes: WeakSet<acorn.Node>, seed?: number): number;

package/dist/ast/cold-flow-guard.js

@@ -0,0 +1,39 @@
+import * as acorn from 'acorn';
+import * as walk from 'acorn-walk';
+function createOpaqueGuardStatement(seed, fnIndex) {
+    // Deterministic polymorphic constants where ((A ^ B) & 7) === Expected
+    const a = ((seed >>> 0) + Math.imul(fnIndex + 1, 0x45d9f3b)) & 0xffff;
+    const b = (a ^ 0x1357) & 0xffff;
+    const wrongVal = ((a ^ b) & 7) ^ 5; // Guaranteed never equal to ((a ^ b) & 7)
+    const guardCode = `if (((${a} ^ ${b}) & 7) === ${wrongVal}) return;`;
+    const parsed = acorn.parse(guardCode, {
+        ecmaVersion: 'latest',
+        allowReturnOutsideFunction: true,
+    });
+    return parsed.body[0];
+}
+export function applyColdFlowGuard(ast, coldFunctionNodes, seed = 0x9e3779b9) {
+    let guardedCount = 0;
+    function maybeInjectGuard(node) {
+        if (!coldFunctionNodes.has(node))
+            return;
+        if (!node.body || node.body.type !== 'BlockStatement')
+            return;
+        guardedCount++;
+        const guardStmt = createOpaqueGuardStatement(seed, guardedCount);
+        // Insert after any leading 'use strict' directive inside the function body
+        let insertIdx = 0;
+        while (insertIdx < node.body.body.length &&
+            node.body.body[insertIdx].type === 'ExpressionStatement' &&
+            node.body.body[insertIdx].directive) {
+            insertIdx++;
+        }
+        node.body.body.splice(insertIdx, 0, guardStmt);
+    }
+    walk.simple(ast, {
+        FunctionDeclaration: maybeInjectGuard,
+        FunctionExpression: maybeInjectGuard,
+        ArrowFunctionExpression: maybeInjectGuard,
+    });
+    return guardedCount;
+}

package/dist/ast/hot-path-detector.d.ts

@@ -0,0 +1,10 @@
+import * as acorn from 'acorn';
+import type { HotPathReport } from '../types.js';
+export interface HotPathAnalysis {
+    report: HotPathReport;
+    hotFunctionNodes: WeakSet<acorn.Node>;
+    coldFunctionNodes: WeakSet<acorn.Node>;
+}
+export declare function parseJavaScriptAst(code: string): acorn.Program | null;
+export declare function analyzeAstHotPaths(ast: acorn.Program): HotPathAnalysis;
+export declare function detectHotPaths(code: string): HotPathReport;

package/dist/ast/hot-path-detector.js

@@ -0,0 +1,235 @@
+import * as acorn from 'acorn';
+import * as walk from 'acorn-walk';
+const LOOP_NODE_TYPES = new Set([
+    'ForStatement',
+    'ForInStatement',
+    'ForOfStatement',
+    'WhileStatement',
+    'DoWhileStatement',
+]);
+const ARRAY_HOF_METHODS = new Set([
+    'map',
+    'filter',
+    'reduce',
+    'forEach',
+    'flatMap',
+    'find',
+    'some',
+    'every',
+]);
+const UI_HOOK_OR_RENDER_CALLS = new Set([
+    'useState',
+    'useEffect',
+    'useMemo',
+    'useCallback',
+    'useRef',
+    'useLayoutEffect',
+    'jsx',
+    'jsxs',
+    '_jsx',
+    '_jsxs',
+    'createElement',
+    'requestAnimationFrame',
+]);
+const FUNCTION_NODE_TYPES = new Set([
+    'FunctionDeclaration',
+    'FunctionExpression',
+    'ArrowFunctionExpression',
+]);
+export function parseJavaScriptAst(code) {
+    try {
+        return acorn.parse(code, {
+            ecmaVersion: 'latest',
+            sourceType: 'module',
+            allowReturnOutsideFunction: true,
+        });
+    }
+    catch {
+        try {
+            return acorn.parse(code, {
+                ecmaVersion: 'latest',
+                sourceType: 'script',
+                allowReturnOutsideFunction: true,
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function getFunctionLabel(node, ancestors) {
+    if (node.id && typeof node.id.name === 'string') {
+        return node.id.name;
+    }
+    const parent = ancestors[ancestors.length - 2];
+    if (parent) {
+        if (parent.type === 'VariableDeclarator' && parent.id?.type === 'Identifier') {
+            return parent.id.name;
+        }
+        if (parent.type === 'Property' && parent.key?.type === 'Identifier') {
+            return parent.key.name;
+        }
+        if (parent.type === 'MethodDefinition' && parent.key?.type === 'Identifier') {
+            return parent.key.name;
+        }
+        if (parent.type === 'AssignmentExpression' &&
+            parent.left?.type === 'Identifier') {
+            return parent.left.name;
+        }
+    }
+    return `anonymous_${node.start}`;
+}
+function isPascalCaseComponent(name) {
+    return /^[A-Z][a-zA-Z0-9]*$/.test(name);
+}
+export function analyzeAstHotPaths(ast) {
+    const hotFunctionNodes = new WeakSet();
+    const coldFunctionNodes = new WeakSet();
+    const allFunctions = [];
+    const fnByName = new Map();
+    const callerToCallees = new Map();
+    walk.ancestor(ast, {
+        FunctionDeclaration(node, _state, ancestors) {
+            const name = getFunctionLabel(node, ancestors);
+            allFunctions.push({ node, name });
+            fnByName.set(name, node);
+            if (isPascalCaseComponent(name)) {
+                hotFunctionNodes.add(node);
+            }
+        },
+        FunctionExpression(node, _state, ancestors) {
+            const name = getFunctionLabel(node, ancestors);
+            allFunctions.push({ node, name });
+            fnByName.set(name, node);
+            if (isPascalCaseComponent(name)) {
+                hotFunctionNodes.add(node);
+            }
+        },
+        ArrowFunctionExpression(node, _state, ancestors) {
+            const name = getFunctionLabel(node, ancestors);
+            allFunctions.push({ node, name });
+            fnByName.set(name, node);
+            if (isPascalCaseComponent(name)) {
+                hotFunctionNodes.add(node);
+            }
+        },
+        CallExpression(node, _state, ancestors) {
+            const callee = node.callee;
+            let calleeName = '';
+            let memberProp = '';
+            if (callee?.type === 'Identifier') {
+                calleeName = callee.name;
+                for (let i = ancestors.length - 1; i >= 0; i--) {
+                    if (FUNCTION_NODE_TYPES.has(ancestors[i].type)) {
+                        let set = callerToCallees.get(ancestors[i]);
+                        if (!set) {
+                            set = new Set();
+                            callerToCallees.set(ancestors[i], set);
+                        }
+                        set.add(calleeName);
+                        break;
+                    }
+                }
+            }
+            else if (callee?.type === 'MemberExpression' &&
+                !callee.computed &&
+                callee.property?.type === 'Identifier') {
+                memberProp = callee.property.name;
+            }
+            // Check if arguments are hot callbacks (.map, .filter, .reduce, .forEach, .flatMap, requestAnimationFrame)
+            if (ARRAY_HOF_METHODS.has(memberProp) ||
+                calleeName === 'requestAnimationFrame' ||
+                memberProp === 'requestAnimationFrame') {
+                for (const arg of node.arguments || []) {
+                    if (FUNCTION_NODE_TYPES.has(arg.type)) {
+                        hotFunctionNodes.add(arg);
+                    }
+                }
+            }
+            // Check if enclosing function calls React hooks / createElement / jsx
+            if (UI_HOOK_OR_RENDER_CALLS.has(calleeName) ||
+                UI_HOOK_OR_RENDER_CALLS.has(memberProp)) {
+                for (let i = ancestors.length - 1; i >= 0; i--) {
+                    if (FUNCTION_NODE_TYPES.has(ancestors[i].type)) {
+                        hotFunctionNodes.add(ancestors[i]);
+                        break;
+                    }
+                }
+            }
+        },
+    });
+    // Mark functions containing any loop statement as hot
+    walk.ancestor(ast, {
+        ForStatement(_node, _state, ancestors) {
+            markEnclosingFunctionHot(ancestors, hotFunctionNodes);
+        },
+        ForInStatement(_node, _state, ancestors) {
+            markEnclosingFunctionHot(ancestors, hotFunctionNodes);
+        },
+        ForOfStatement(_node, _state, ancestors) {
+            markEnclosingFunctionHot(ancestors, hotFunctionNodes);
+        },
+        WhileStatement(_node, _state, ancestors) {
+            markEnclosingFunctionHot(ancestors, hotFunctionNodes);
+        },
+        DoWhileStatement(_node, _state, ancestors) {
+            markEnclosingFunctionHot(ancestors, hotFunctionNodes);
+        },
+    });
+    // Propagate hotness bottom-up along the static call graph (caller -> hot callee)
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const [callerNode, calleeNames] of callerToCallees.entries()) {
+            if (hotFunctionNodes.has(callerNode))
+                continue;
+            for (const cName of calleeNames) {
+                const targetNode = fnByName.get(cName);
+                if (targetNode && hotFunctionNodes.has(targetNode)) {
+                    hotFunctionNodes.add(callerNode);
+                    changed = true;
+                    break;
+                }
+            }
+        }
+    }
+    const hotFunctionsSkipped = [];
+    const coldFunctionsProtected = [];
+    for (const fn of allFunctions) {
+        if (hotFunctionNodes.has(fn.node)) {
+            hotFunctionsSkipped.push(fn.name);
+        }
+        else {
+            coldFunctionNodes.add(fn.node);
+            coldFunctionsProtected.push(fn.name);
+        }
+    }
+    return {
+        report: {
+            totalFunctions: allFunctions.length,
+            hotFunctionsSkipped,
+            coldFunctionsProtected,
+        },
+        hotFunctionNodes,
+        coldFunctionNodes,
+    };
+}
+function markEnclosingFunctionHot(ancestors, hotSet) {
+    for (let i = ancestors.length - 1; i >= 0; i--) {
+        if (FUNCTION_NODE_TYPES.has(ancestors[i].type)) {
+            hotSet.add(ancestors[i]);
+            break;
+        }
+    }
+}
+export function detectHotPaths(code) {
+    const ast = parseJavaScriptAst(code);
+    if (!ast) {
+        return {
+            totalFunctions: 0,
+            hotFunctionsSkipped: [],
+            coldFunctionsProtected: [],
+        };
+    }
+    return analyzeAstHotPaths(ast).report;
+}

package/dist/ast/index.d.ts

@@ -0,0 +1,4 @@
+import type { TransformOptions, TransformResult } from '../types.js';
+export { detectHotPaths } from './hot-path-detector.js';
+export { computeFnv1aHash } from './string-vault.js';
+export declare function transformJavaScript(code: string, options?: TransformOptions): TransformResult;

package/dist/ast/index.js

@@ -0,0 +1,55 @@
+import { generate } from 'astring';
+import { analyzeAstHotPaths, parseJavaScriptAst, } from './hot-path-detector.js';
+import { applyStringVault, computeFnv1aHash } from './string-vault.js';
+import { applyPolymorphicMangler } from './polymorphic-mangler.js';
+import { applyColdFlowGuard } from './cold-flow-guard.js';
+export { detectHotPaths } from './hot-path-detector.js';
+export { computeFnv1aHash } from './string-vault.js';
+export function transformJavaScript(code, options = {}) {
+    const seed = options.seed ?? 0x9e3779b9;
+    const minStringLength = options.minStringLength ?? 4;
+    if (!code || !code.trim()) {
+        return {
+            code,
+            encryptedStringsCount: 0,
+            mangledSymbolsCount: 0,
+            hotPathReport: {
+                totalFunctions: 0,
+                hotFunctionsSkipped: [],
+                coldFunctionsProtected: [],
+            },
+            integrityToken: computeFnv1aHash('', seed),
+        };
+    }
+    const ast = parseJavaScriptAst(code);
+    if (!ast) {
+        return {
+            code,
+            encryptedStringsCount: 0,
+            mangledSymbolsCount: 0,
+            hotPathReport: {
+                totalFunctions: 0,
+                hotFunctionsSkipped: [],
+                coldFunctionsProtected: [],
+            },
+            integrityToken: computeFnv1aHash(code, seed),
+        };
+    }
+    // 1. Detect hot paths (loops, array HOF callbacks, rAF, UI components)
+    const { report: hotPathReport, coldFunctionNodes } = analyzeAstHotPaths(ast);
+    // 2. Inject polymorphic opaque guards only on cold functions (<2% runtime CPU budget)
+    applyColdFlowGuard(ast, coldFunctionNodes, seed);
+    // 3. Mangle local parameters & function-scoped variables safely
+    const mangledSymbolsCount = applyPolymorphicMangler(ast, seed);
+    // 4. Encrypt eligible string literals into an O(1) lazy inline-cached vault
+    const { encryptedStringsCount, integrityToken } = applyStringVault(ast, seed, minStringLength);
+    // 5. Generate compact single-line JavaScript output
+    const outputCode = generate(ast, { indent: '', lineEnd: '' });
+    return {
+        code: outputCode,
+        encryptedStringsCount,
+        mangledSymbolsCount,
+        hotPathReport,
+        integrityToken,
+    };
+}

package/dist/ast/polymorphic-mangler.d.ts

@@ -0,0 +1,2 @@
+import * as acorn from 'acorn';
+export declare function applyPolymorphicMangler(ast: acorn.Program, seed?: number): number;