webfuscator 1.0.0 → 1.1.0

package/dist/utils/ast.js.map

@@ -1 +1 @@
-{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../src/utils/ast.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AAEjC,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAA;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GACV,MAAM,CAAC,SAAS,EAAE;QAClB,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAW,CAAA;QACtC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,QAAgC;IACjF,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,UAAU,sBAAsB,CAAC,MAA4B;IACjE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,wBAAwB;AACxB,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,CACL,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC;QACjD,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CACtD,CAAA;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,IAAI,CAAA;AAC3E,CAAC;AAED,iFAAiF;AACjF,kBAAkB;AAClB,MAAM,UAAU,2BAA2B,CAAC,IAAc;IACxD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,OAAO,GAAoB,IAAI,CAAA;IACnC,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,UAAU,CAAA;IAC9B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAAmB,CAAA;AACxD,MAAM,WAAW,GAAG,IAAI,OAAO,EAAmB,CAAA;AAElD,SAAS,eAAe,CACtB,WAAmB,EACnB,KAA+B,EAC/B,OAAkC;IAElC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,KAAK,GAAG,IAAI,CAAA;QACZ,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAA;IAC5B,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IAC7B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,mEAAmE;IACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QAC7B,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAA;YACZ,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAA;QAC5B,CAAC;QACD,OAAO,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAA;AAC/F,CAAC"}
+{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../src/utils/ast.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AAEjC,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAA;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GACV,MAAM,CAAC,SAAS,EAAE;QAClB,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAA;IAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAW,CAAA;QACtC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,QAAgC;IACjF,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,4EAA4E;AAC5E,iDAAiD;AACjD,MAAM,UAAU,sBAAsB,CAAC,MAA4B;IACjE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,wBAAwB;AACxB,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,CACL,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC;QACjD,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,CAAC,CACtD,CAAA;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,IAAI,CAAA;AAC3E,CAAC;AAED,iFAAiF;AACjF,kBAAkB;AAClB,MAAM,UAAU,2BAA2B,CAAC,IAAc;IACxD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC/F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,OAAO,GAAoB,IAAI,CAAA;IACnC,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,UAAU,CAAA;IAC9B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAAmB,CAAA;AACxD,MAAM,WAAW,GAAG,IAAI,OAAO,EAAmB,CAAA;AAElD,SAAS,eAAe,CACtB,WAAmB,EACnB,KAA+B,EAC/B,OAAkC;IAElC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAA;IACf,CAAC;IACD,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QACD,KAAK,GAAG,IAAI,CAAA;QACZ,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAA;IAC5B,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IAC7B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,KAAK,GAAG,KAAK,CAAA;IACjB,mEAAmE;IACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QAC7B,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAA;YACZ,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAA;QAC5B,CAAC;QACD,OAAO,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,8EAA8E;IAC9E,0BAA0B;IAC1B,OAAO,CACL,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAC5B,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webfuscator",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "JavaScript obfuscator built on Babel",
   "keywords": [
     "babel",

package/src/index.ts

@@ -1,2 +1,7 @@
 export { obfuscate } from 'src/obfuscator'
-export type { ManglePropertiesOptions, ObfuscatorOptions, PropertyNameGenerator } from 'src/options'
+export type {
+  ManglePropertiesOptions,
+  ObfuscatorOptions,
+  PackOptions,
+  PropertyNameGenerator,
+} from 'src/options'

package/src/obfuscator.ts

@@ -7,7 +7,6 @@ import type { ObfuscatorOptions, TransformContext, TransformName } from 'src/opt
 import { dotToBracket } from 'src/preparation/dot-to-bracket'
 import { expandDestructuring } from 'src/preparation/expand-destructuring'
 import { expandTemplateLiterals } from 'src/preparation/expand-template-literals'
-import { rewriteClassFields } from 'src/preparation/rewrite-class-fields'
 import { splitSequenceExpressions } from 'src/preparation/split-sequence-expressions'
 import { splitVariableDeclarations } from 'src/preparation/split-variable-declarations'
 import { stringifyObjectKeys } from 'src/preparation/stringify-object-keys'
@@ -34,6 +33,7 @@ import { nullishCoalescingToTernary } from 'src/transforms/nullish-coalescing-to
 import { numbersToStrings } from 'src/transforms/numbers-to-strings'
 import { objectMethodToProperty } from 'src/transforms/object-method-to-property'
 import { optionalChainingToTernary } from 'src/transforms/optional-chaining-to-ternary'
+import { pack } from 'src/transforms/pack'
 import { packDeclarationsIntoParameters } from 'src/transforms/pack-declarations-into-parameters'
 import { removeAnonymousFunctionNames } from 'src/transforms/remove-anonymous-function-names'
 import { removeUnreachableCode } from 'src/transforms/remove-unreachable-code'
@@ -61,13 +61,12 @@ type TransformFn = (ast: File, ctx: TransformContext) => boolean
 type Phase = readonly [name: string, fn: TransformFn]
 type ConfigurablePhase = readonly [name: TransformName, fn: TransformFn]
 
-// Mangling must see quoted access and class fields before preparation erases
-// those shapes. It is opt-in because outside code may use the same properties.
+// Mangling must see quoted access before preparation erases that distinction.
+// It is opt-in because outside code may use the same properties.
 const BEFORE_PREPARATION: readonly ConfigurablePhase[] = [['mangleProperties', mangleProperties]]
 
 // Shape-normalizing passes. Always run; never exposed in `options.transforms`.
 const PREPARATION: readonly Phase[] = [
-  ['rewriteClassFields', asBoolean(rewriteClassFields)],
   ['expandDestructuring', asBoolean(expandDestructuring)],
   ['wrapSingleStatements', asBoolean(wrapSingleStatements)],
   ['splitSequenceExpressions', asBoolean(splitSequenceExpressions)],
@@ -137,6 +136,11 @@ const POST_PROCESS: readonly ConfigurablePhase[] = [
 // Renaming runs last because later transforms depend on recognizable bindings.
 const RENAME: readonly ConfigurablePhase[] = [['renameIdentifiers', renameIdentifiers]]
 
+// Packing serializes the finished program to a string and rebuilds it through
+// the Function constructor. It must see final names and shapes, so it runs after
+// every other rewrite, including renaming.
+const PACK: readonly ConfigurablePhase[] = [['pack', pack]]
+
 /** Parses, transforms, and prints JavaScript without mutating external state. */
 export function obfuscate(code: string, options: ObfuscatorOptions = {}): string {
   const log = options.verbose ? makeLogger() : null
@@ -187,6 +191,13 @@ export function obfuscate(code: string, options: ObfuscatorOptions = {}): string
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
   }
 
+  for (const [name, fn] of PACK) {
+    if (!isEnabled(name, options)) {
+      continue
+    }
+    run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
+  }
+
   return run(
     log,
     'generate',
@@ -213,6 +224,9 @@ function ctxFor(
   if (name === 'mangleProperties' && entry && typeof entry === 'object') {
     return { ...context, mangleProperties: entry }
   }
+  if (name === 'pack' && entry && typeof entry === 'object') {
+    return { ...context, pack: entry }
+  }
   return context
 }
 

package/src/options.ts

@@ -37,6 +37,7 @@ export type TransformName =
   | 'numbersToStrings'
   | 'mangleProperties'
   | 'renameIdentifiers'
+  | 'pack'
 
 // An override enables the transform and replaces its string-generator mode.
 type TransformEntry = boolean | { stringGeneratorMode?: StringGeneratorModeOption }
@@ -76,13 +77,25 @@ export interface ManglePropertiesOptions {
   undeclared?: boolean
 }
 
+/** Options for the `Function`-constructor packing transform. */
+export interface PackOptions {
+  /**
+   * Skip the strict-mode directive so the packed body runs sloppy even when the
+   * source is strict. This deliberately changes behavior. Default `false`.
+   */
+  escapeStrict?: boolean
+  /** Override the default string-generator mode for the names pack creates. */
+  stringGeneratorMode?: StringGeneratorModeOption
+}
+
 type SimpleTransform = Exclude<
   TransformName,
-  'mangleProperties' | 'renameIdentifiers' | 'specialsToStrings'
+  'mangleProperties' | 'pack' | 'renameIdentifiers' | 'specialsToStrings'
 >
 
 type TransformsMap = Partial<Record<SimpleTransform, boolean>> & {
   mangleProperties?: boolean | ManglePropertiesOptions
+  pack?: boolean | PackOptions
   renameIdentifiers?: TransformEntry
   specialsToStrings?: TransformEntry
 }
@@ -110,6 +123,7 @@ export interface ObfuscatorOptions {
 // Resolved per-call defaults handed to every transform.
 export interface TransformContext {
   mangleProperties?: ManglePropertiesOptions
+  pack?: PackOptions
   seed: number
   stringGeneratorMode: StringGeneratorModeOption
 }

package/src/transforms/mangle-properties.ts

@@ -17,7 +17,7 @@ import { StringGenerator } from 'src/utils/string-generator'
  * that this pipeline must leave unchanged.
  *
  * This pass runs before shape preparation, while Babel still distinguishes
- * `obj.name` from `obj["name"]` and class fields still carry their source keys.
+ * `obj.name` from `obj["name"]`.
  *
  * @example
  * // ◀️ before

package/src/transforms/optional-chaining-to-ternary.ts

@@ -175,7 +175,10 @@ function transformChain(path: OptionalPath): boolean {
     let check: t.Expression
 
     if (path.scope.isStatic(chain)) {
-      check = chain
+      // The receiver stays in the member expression, so the check needs its own
+      // node. One node under two parents is visited twice, and a later in-place
+      // rewrite such as renameIdentifiers then applies itself twice to it.
+      check = t.cloneNode(chain)
     } else {
       const tmp = path.scope.generateUidIdentifierBasedOnNode(chain)
       path.scope.push({ id: t.cloneNode(tmp) })
@@ -212,7 +215,7 @@ function transformChain(path: OptionalPath): boolean {
       alternate = t.unaryExpression('delete', alternate)
     }
 
-    const newTernary = t.conditionalExpression(condition, shortCircuit, alternate)
+    const newTernary = t.conditionalExpression(condition, t.cloneNode(shortCircuit), alternate)
     const replaced: NodePath<t.ConditionalExpression> = replacementPath.replaceWith(newTernary)[0]
     replacementPath = replaced.get('alternate')
   }

package/src/transforms/pack.ts

@@ -0,0 +1,336 @@
+import generate from '@babel/generator'
+import traverse from '@babel/traverse'
+import type { NodePath, Visitor } from '@babel/traverse'
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import type { TransformContext } from 'src/options'
+import { isInsideWith } from 'src/utils/ast'
+import { isCalleeOrTagOf, isInStrictContext, referencesOrWritesVariable } from 'src/utils/paths'
+import { mulberry32 } from 'src/utils/random'
+import { StringGenerator } from 'src/utils/string-generator'
+
+/**
+ * Serializes the whole program to a string and rebuilds it at runtime through
+ * the `Function` constructor. A detached function body only reaches true globals
+ * and its own parameters. A free name might instead be a CommonJS `require`, a
+ * bundler-injected binding, or a live import, none reachable from the body and
+ * none distinguishable from a global at build time, so free names are routed
+ * through a parameter object whose accessors run in the original top-level scope
+ * and resolve each name there. Import declarations return above the call. `eval`
+ * is left un-routed so a direct eval still reads the body scope. Names inside a
+ * `with` stay un-routed too, since they may resolve against the with object at
+ * runtime. Export statements cannot live inside a Function body, so pack throws
+ * on them. It packs everything else as written. Code that needs `import.meta`,
+ * top-level await, dynamic `import()`, or a top-level `arguments` will not run
+ * once moved into a Function body.
+ *
+ * @example
+ * // ◀️ before
+ * console.log(value);
+ *
+ * // ▶️ after
+ * Function("M", "return M[\"b\"].log(M[\"_\"]);")({
+ *   get "b"() {
+ *     return console;
+ *   },
+ *   get "_"() {
+ *     return value;
+ *   }
+ * });
+ */
+export function pack(ast: File, ctx: TransformContext): boolean {
+  let programPath: NodePath<t.Program> | null = null
+  traverse(ast, {
+    Program(path) {
+      programPath = path
+      path.stop()
+    },
+  })
+  if (!programPath) {
+    return false
+  }
+  return packProgram(programPath, ctx)
+}
+
+function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): boolean {
+  assertNoExports(programPath)
+  const importPaths = collectImportDeclarations(programPath)
+  const importDeclarations = importPaths.map((path) => path.node)
+  // An import named `Function` shadows the constructor at the output top level,
+  // so the wrap reaches the real one through a function instance instead.
+  const shadowedConstructor = importDeclarations.some((declaration) =>
+    bindsFunctionConstructor(declaration),
+  )
+
+  const programNode = programPath.node
+  const wasModule = programNode.sourceType === 'module'
+  // Escaping strict is a deliberate opt-in: drop the directive so the packed
+  // body runs sloppy even when the source was strict.
+  const escapeStrict = ctx.pack?.escapeStrict ?? false
+  const bodyStrict = !escapeStrict && isInStrictContext(programPath)
+
+  // Detaching imports drops their bindings, so their names read as free and are
+  // routed like any other global. The declarations return at the output top
+  // level, where the accessors close over them.
+  for (const path of importPaths) {
+    path.remove()
+  }
+  programPath.scope.crawl()
+
+  const usedNames = collectUsedNames(programNode, importDeclarations)
+  const generator = new StringGenerator(ctx.stringGeneratorMode, mulberry32(ctx.seed))
+  const freshIdentifier = (): string => {
+    let name: string
+    do {
+      name = generator.next()
+    } while (usedNames.has(name))
+    usedNames.add(name)
+    return name
+  }
+  const objectName = freshIdentifier()
+  const setterParam = freshIdentifier()
+
+  const readProperties = new Map<string, string>()
+  const typeofProperties = new Map<string, string>()
+  const settable = new Set<string>()
+  const propertyFor = (registry: Map<string, string>, name: string): string => {
+    let property = registry.get(name)
+    if (property === undefined) {
+      do {
+        // `__proto__` as an object-literal key would set the prototype rather
+        // than name an accessor.
+        property = generator.next()
+      } while (property === '__proto__')
+      registry.set(name, property)
+    }
+    return property
+  }
+  const memberFor = (property: string): t.MemberExpression =>
+    t.memberExpression(t.identifier(objectName), t.stringLiteral(property), true)
+
+  const isRoutable = (path: NodePath<t.Identifier>): boolean => {
+    const { name } = path.node
+    // The wrapper parameter stays as written. `arguments` and `eval` are never
+    // routed: `arguments` binds to its own function's object, and leaving `eval`
+    // bare keeps a direct eval reading the body scope rather than the global one.
+    if (name === objectName || name === 'arguments' || name === 'eval') {
+      return false
+    }
+    // Inside `with`, a free name may resolve to a property of the with object at
+    // runtime, so routing it to the top-level accessor would change behavior.
+    if (isInsideWith(path)) {
+      return false
+    }
+    if (!referencesOrWritesVariable(path)) {
+      return false
+    }
+    return !path.scope.getBinding(name)
+  }
+
+  const routingVisitor: Visitor = {
+    UnaryExpression(path) {
+      if (path.node.operator !== 'typeof') {
+        return
+      }
+      const argument = path.get('argument')
+      // A bare `typeof name` must not throw for an undeclared global, so it maps
+      // to an accessor that applies `typeof` in the original scope.
+      if (!argument.isIdentifier() || !isRoutable(argument)) {
+        return
+      }
+      path.replaceWith(memberFor(propertyFor(typeofProperties, argument.node.name)))
+    },
+    Identifier(path) {
+      // `delete name` must keep hitting the global binding; `delete obj[prop]`
+      // would drop the accessor instead. A real global stays reachable bare.
+      if (isBareDeleteArgument(path) || !isRoutable(path)) {
+        return
+      }
+      const { name } = path.node
+      if (isWriteReference(path)) {
+        settable.add(name)
+      }
+      const member = memberFor(propertyFor(readProperties, name))
+      // A member callee would bind `this` to the object; the comma discards the
+      // base and keeps the original receiver.
+      path.replaceWith(
+        isCalleeOrTagOf(path) ? t.sequenceExpression([t.numericLiteral(0), member]) : member,
+      )
+    },
+  }
+  programPath.traverse(routingVisitor)
+
+  // The script completion value is its trailing expression; returning it keeps
+  // `eval` of the packed output producing the same value.
+  const { body } = programNode
+  const lastStatement = body.at(-1)
+  if (lastStatement && t.isExpressionStatement(lastStatement)) {
+    body[body.length - 1] = t.returnStatement(lastStatement.expression)
+  }
+
+  const innerDirectives = bodyStrict ? [t.directive(t.directiveLiteral('use strict'))] : []
+  const innerCode = generate(t.program(body, innerDirectives, 'script'), {
+    minified: true,
+    comments: false,
+  }).code
+
+  const objectExpression = buildAccessorObject({
+    readProperties,
+    typeofProperties,
+    settable,
+    setterParam,
+    strict: bodyStrict,
+  })
+
+  const constructorReference = shadowedConstructor
+    ? t.memberExpression(
+        t.functionExpression(null, [], t.blockStatement([])),
+        t.identifier('constructor'),
+      )
+    : t.identifier('Function')
+  const wrapper = t.callExpression(constructorReference, [
+    t.stringLiteral(objectName),
+    t.stringLiteral(innerCode),
+  ])
+  // A strict script keeps top-level `this` bound to the global object. A plainly
+  // called strict function would instead see `undefined`, so pass the global
+  // `this` of the sloppy output script.
+  const invocation =
+    bodyStrict && !wasModule
+      ? t.callExpression(t.memberExpression(wrapper, t.identifier('call')), [
+          t.thisExpression(),
+          objectExpression,
+        ])
+      : t.callExpression(wrapper, [objectExpression])
+
+  programNode.body = [...importDeclarations, t.expressionStatement(invocation)]
+  programNode.directives = []
+  programNode.sourceType = importDeclarations.length > 0 ? 'module' : 'script'
+  return true
+}
+
+// Export statements are module-only syntax and cannot exist inside a Function
+// body. Pack throws rather than emit output that fails to parse at runtime.
+function assertNoExports(programPath: NodePath<t.Program>): void {
+  const hasExport = programPath.node.body.some(
+    (statement) =>
+      t.isExportNamedDeclaration(statement) ||
+      t.isExportDefaultDeclaration(statement) ||
+      t.isExportAllDeclaration(statement),
+  )
+  if (hasExport) {
+    throw new Error('pack cannot wrap a program that uses export statements')
+  }
+}
+
+function collectImportDeclarations(
+  programPath: NodePath<t.Program>,
+): NodePath<t.ImportDeclaration>[] {
+  return programPath
+    .get('body')
+    .filter((statement): statement is NodePath<t.ImportDeclaration> =>
+      statement.isImportDeclaration(),
+    )
+}
+
+function bindsFunctionConstructor(declaration: t.ImportDeclaration): boolean {
+  return declaration.specifiers.some((specifier) => specifier.local.name === 'Function')
+}
+
+function isBareDeleteArgument(path: NodePath<t.Identifier>): boolean {
+  const parent = path.parentPath
+  return (
+    parent != null &&
+    parent.isUnaryExpression({ operator: 'delete' }) &&
+    parent.node.argument === path.node
+  )
+}
+
+function isWriteReference(path: NodePath<t.Identifier>): boolean {
+  const parent = path.parentPath
+  if (!parent) {
+    return false
+  }
+  const { node } = path
+  if (parent.isAssignmentExpression() && parent.node.left === node) {
+    return true
+  }
+  if (parent.isUpdateExpression() && parent.node.argument === node) {
+    return true
+  }
+  if ((parent.isForInStatement() || parent.isForOfStatement()) && parent.node.left === node) {
+    return true
+  }
+  // Destructuring assignment targets bind through patterns Babel flags here.
+  return path.isBindingIdentifier()
+}
+
+function collectUsedNames(
+  program: t.Program,
+  importDeclarations: t.ImportDeclaration[],
+): Set<string> {
+  // The wrapper parameter and setter parameter must avoid every name the body
+  // uses, so no nested binding can shadow their accesses.
+  const names = new Set<string>(['Function'])
+  for (const declaration of importDeclarations) {
+    for (const specifier of declaration.specifiers) {
+      names.add(specifier.local.name)
+    }
+  }
+  t.traverseFast(program, (node) => {
+    if (t.isIdentifier(node)) {
+      names.add(node.name)
+    }
+  })
+  return names
+}
+
+interface AccessorObjectSpec {
+  readProperties: Map<string, string>
+  setterParam: string
+  settable: Set<string>
+  strict: boolean
+  typeofProperties: Map<string, string>
+}
+
+function buildAccessorObject(spec: AccessorObjectSpec): t.ObjectExpression {
+  const { readProperties, setterParam, settable, strict, typeofProperties } = spec
+  const properties: t.ObjectMethod[] = []
+  for (const [name, property] of readProperties) {
+    properties.push(
+      t.objectMethod(
+        'get',
+        t.stringLiteral(property),
+        [],
+        t.blockStatement([t.returnStatement(t.identifier(name))]),
+      ),
+    )
+    if (settable.has(name)) {
+      const setterBody = t.blockStatement([
+        t.expressionStatement(
+          t.assignmentExpression('=', t.identifier(name), t.identifier(setterParam)),
+        ),
+      ])
+      // A strict script becomes a sloppy output script, so the setter stays
+      // strict to keep an undeclared-global write throwing.
+      if (strict) {
+        setterBody.directives.push(t.directive(t.directiveLiteral('use strict')))
+      }
+      properties.push(
+        t.objectMethod('set', t.stringLiteral(property), [t.identifier(setterParam)], setterBody),
+      )
+    }
+  }
+  for (const [name, property] of typeofProperties) {
+    properties.push(
+      t.objectMethod(
+        'get',
+        t.stringLiteral(property),
+        [],
+        t.blockStatement([t.returnStatement(t.unaryExpression('typeof', t.identifier(name)))]),
+      ),
+    )
+  }
+  return t.objectExpression(properties)
+}

package/src/utils/ast.ts

@@ -125,5 +125,11 @@ function ownScopeHasDirectEval(owner: t.Node): boolean {
 }
 
 export function isDirectEvalCall(node: t.Node): boolean {
-  return t.isCallExpression(node) && t.isIdentifier(node.callee) && node.callee.name === 'eval'
+  // `eval?.(...)` is an OptionalCallExpression yet still a direct eval, so both
+  // call node shapes count.
+  return (
+    (t.isCallExpression(node) || t.isOptionalCallExpression(node)) &&
+    t.isIdentifier(node.callee) &&
+    node.callee.name === 'eval'
+  )
 }

package/dist/preparation/rewrite-class-fields.d.ts

@@ -1,43 +0,0 @@
-import type { File } from '@babel/types';
-/**
- * Moves safe instance fields into the constructor and safe static fields into
- * static blocks. The whole class stays intact unless every field can be lowered.
- *
- * `Object.defineProperty` preserves CreateDataProperty semantics. A plain
- * assignment could invoke an inherited setter or fail on an inherited read-only
- * property. Static blocks also preserve the class binding and `this`.
- *
- * Accessor collisions, special keys, inferred names, constructor parameter
- * scope, and relocated `this`, `super`, or `new.target` can all expose a rewrite.
- * Private or computed fields, derived classes, `with`, and a shadowed `Object`
- * are therefore refused.
- *
- * @example
- * // ◀️ before
- * class A {
- *   x = 1;
- *   static z = 2;
- * }
- *
- * // ▶️ after
- * class A {
- *   constructor() {
- *     Object.defineProperty(this, "x", {
- *       value: 1,
- *       writable: true,
- *       enumerable: true,
- *       configurable: true
- *     });
- *   }
- *   static {
- *     Object.defineProperty(this, "z", {
- *       value: 2,
- *       writable: true,
- *       enumerable: true,
- *       configurable: true
- *     });
- *   }
- * }
- */
-export declare function rewriteClassFields(ast: File): void;
-//# sourceMappingURL=rewrite-class-fields.d.ts.map

package/dist/preparation/rewrite-class-fields.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rewrite-class-fields.d.ts","sourceRoot":"","sources":["../../src/preparation/rewrite-class-fields.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAKxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAElD"}