webfuscator 1.2.1 → 1.3.1

package/src/transforms/inline-functions.ts

@@ -6,10 +6,10 @@ import type { File } from '@babel/types'
 import { analyzeInlineability } from '../analysis/inlineability'
 import type { InlineCandidate } from '../analysis/inlineability'
 import { isPure } from '../analysis/purity'
-import { enclosingScopeHasDirectEval, isInsideWith, walkOwnFunctionScope } from '../utils/ast'
+import { walkOwnFunctionScope } from '../utils/ast'
 import { reorderableToStatement } from '../utils/evaluation-order'
 import { generateLoopLabel } from '../utils/loop-lowering'
-import { hasAnnexBFunctionAlias, isInStrictContext } from '../utils/paths'
+import { isInStrictContext } from '../utils/paths'
 
 /**
  * Replaces eligible calls with function bodies, working from inner calls out.
@@ -135,14 +135,6 @@ function isSafeAtCallSite(
   callPath: NodePath<t.CallExpression>,
   candidates: Map<string, InlineCandidate>,
 ): boolean {
-  // `with`, direct eval, and Annex B aliases can redirect free names outside
-  // Babel's scope table.
-  if (isInsideWith(callPath) || enclosingScopeHasDirectEval(callPath)) {
-    return false
-  }
-  if (annexBHoistShadowsFreeVar(callPath, freeVars)) {
-    return false
-  }
   // Spliced code inherits call-site strictness, so it must match the callee.
   if (isInStrictContext(candidate.fnPath) !== isInStrictContext(callPath)) {
     return false
@@ -193,32 +185,6 @@ function isSafeAtCallSite(
   return true
 }
 
-// ECMA-262 B.3.2.1 creates a sloppy block-function alias that Babel misses in
-// the enclosing scope.
-function annexBHoistShadowsFreeVar(
-  callPath: NodePath<t.CallExpression>,
-  freeVars: Set<string>,
-): boolean {
-  if (freeVars.size === 0 || isInStrictContext(callPath)) {
-    return false
-  }
-  const owner = callPath.getFunctionParent() ?? callPath.scope.getProgramParent().path
-  let found = false
-  owner.traverse({
-    Function(path) {
-      path.skip()
-    },
-    FunctionDeclaration(path) {
-      const id = path.node.id
-      if (id && freeVars.has(id.name) && hasAnnexBFunctionAlias(path)) {
-        found = true
-        path.stop()
-      }
-    },
-  })
-  return found
-}
-
 // Only loops in the same function repeat the spliced body.
 function callIsInsideLoop(callPath: NodePath): boolean {
   for (let current: NodePath | null = callPath.parentPath; current; current = current.parentPath) {
@@ -581,7 +547,9 @@ function inlineCallSite(
     const replacement: t.Statement[] = []
     if (directTarget.kind === 'declarator') {
       replacement.push(
-        t.variableDeclaration('var', [t.variableDeclarator(t.identifier(directTarget.name))]),
+        t.variableDeclaration(directTarget.declarationKind, [
+          t.variableDeclarator(t.identifier(directTarget.name)),
+        ]),
       )
     }
     if (needsLabel) {
@@ -621,7 +589,9 @@ function inlineCallSite(
   return true
 }
 
-type DirectTarget = { kind: 'declarator'; name: string } | { kind: 'assign'; name: string }
+type DirectTarget =
+  | { kind: 'declarator'; name: string; declarationKind: 'let' | 'var' }
+  | { kind: 'assign'; name: string }
 
 function identifyDirectAssignmentTarget(
   callPath: NodePath<t.CallExpression>,
@@ -642,9 +612,8 @@ function identifyDirectAssignmentTarget(
     if (!declPath || !declPath.isVariableDeclaration() || declPath.node.declarations.length !== 1) {
       return null
     }
-    // Only `var` can become an uninitialized direct target without changing TDZ
-    // or block scope.
-    if (declPath.node.kind !== 'var') {
+    const declarationKind = declPath.node.kind
+    if (declarationKind !== 'var' && declarationKind !== 'let') {
       return null
     }
     const owner = declPath.parentPath
@@ -667,7 +636,7 @@ function identifyDirectAssignmentTarget(
     if (argsContainIdentName(args, name)) {
       return null
     }
-    return { kind: 'declarator', name }
+    return { kind: 'declarator', name, declarationKind }
   }
 
   if (
@@ -714,10 +683,10 @@ function argEligibleForElision(argPath: NodePath, scope: Scope): boolean {
     return false
   }
   const binding = scope.getBinding(argPath.node.name)
-  if (!binding || binding.constantViolations.length > 0) {
+  if (!binding || (binding.kind !== 'const' && binding.constantViolations.length > 0)) {
     return false
   }
-  return isPure(argPath.node, scope, argPath)
+  return isPure(argPath.node, scope)
 }
 
 // Catch parameters stay scoped to their copied handlers. Counting them here
@@ -931,8 +900,8 @@ function isNonReferenceSlot(parent: t.Node, key: string): boolean {
 interface StatementWalkContext {
   insideNestedLoop: boolean
   insideNestedSwitch: boolean
-  // Tail position propagates through final blocks, branches, and labels. Try,
-  // switch, loops, and `with` interrupt it because more code may run afterward.
+  // Tail position propagates through final blocks, branches, labels, and `with`.
+  // Try, switch, and loops interrupt it because more code may run afterward.
   tailPosition: boolean
 }
 
@@ -1052,7 +1021,7 @@ function walkIntoCompound(
   }
 
   if (t.isWithStatement(node)) {
-    node.body = walkSingleChild(node.body, hooks, { ...ctx, tailPosition: false })
+    node.body = walkSingleChild(node.body, hooks, ctx)
   }
 }
 

package/src/transforms/logical-to-ternary.ts

@@ -3,10 +3,10 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import { isPure } from '../analysis/purity'
-import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 import { lowerLogicalWriteStatement } from '../utils/logical-lowering'
+import { buildNonNullishCheck, buildNullishCheck } from '../utils/nullish'
 
 /**
  * Rewrites logical expressions as guarded assignments or ternaries. A
@@ -23,7 +23,7 @@ import { lowerLogicalWriteStatement } from '../utils/logical-lowering'
  * if (!x) x = b;
  * y = c;
  * if (y) y = d;
- * f((_t = get()) != null ? _t : fallback);
+ * f(((_t = get()) !== null ? _t !== void 0 : false) ? _t : fallback);
  */
 export function logicalToTernary(ast: File): boolean {
   return traverseForChanges(ast, visitor)
@@ -45,11 +45,6 @@ function lowerLogical(path: NodePath<t.LogicalExpression>): boolean {
   if (op !== '&&' && op !== '||' && op !== '??') {
     return false
   }
-  // `with` can turn repeated names into getters and shadow a cache temp.
-  if (isInsideWith(path)) {
-    return false
-  }
-
   if (lowerLogicalWriteStatement(path, (target) => buildFallbackTest(op, target))) {
     return true
   }
@@ -60,7 +55,7 @@ function lowerLogical(path: NodePath<t.LogicalExpression>): boolean {
   let valueSrc: t.Expression
 
   // Babel purity misses user coercion in unary and binary expressions.
-  if (isPure(leftPath.node, scope, leftPath)) {
+  if (isPure(leftPath.node, scope)) {
     testSrc = node.left
     valueSrc = t.cloneNode(node.left)
   } else {
@@ -71,7 +66,7 @@ function lowerLogical(path: NodePath<t.LogicalExpression>): boolean {
   }
 
   const test: t.Expression =
-    op === '??' ? t.binaryExpression('!=', testSrc, t.nullLiteral()) : testSrc
+    op === '??' ? buildNonNullishCheck(testSrc, t.cloneNode(valueSrc)) : testSrc
 
   path.replaceWith(
     op === '&&'
@@ -88,5 +83,5 @@ function buildFallbackTest(op: '&&' | '||' | '??', target: t.Identifier): t.Expr
   if (op === '&&') {
     return target
   }
-  return t.binaryExpression('==', target, t.nullLiteral())
+  return buildNullishCheck(target, t.cloneNode(target))
 }

package/src/transforms/mangle-properties.ts

@@ -13,11 +13,8 @@ import { StringGenerator } from '../utils/string-generator'
 
 /**
  * Renames statically known public properties through one program-wide mapping.
- * Property selection follows Terser, with extra collision checks for names
- * that this pipeline must leave unchanged.
- *
- * This pass runs before shape preparation, while Babel still distinguishes
- * `obj.name` from `obj["name"]`.
+ * Options select or reserve names, and collision checks keep every unchanged
+ * property distinct from the generated names.
  *
  * @example
  * // ◀️ before
@@ -507,7 +504,7 @@ function rewriteKeyedProperty(path: NodePath<KeyedProperty>, state: PropertyMang
   if (mangled === name) {
     return
   }
-  node.key = t.inheritsComments(t.stringLiteral(mangled), node.key)
+  node.key = t.stringLiteral(mangled)
   node.computed = false
   if (t.isObjectProperty(node)) {
     node.shorthand = false
@@ -532,7 +529,7 @@ function rewriteMember(path: NodePath<Member>, state: PropertyManglerState): voi
   }
   // Babel narrows members by `computed`, so both fields need widening.
   const computed = node as Member & { computed: boolean; property: t.Expression }
-  computed.property = t.inheritsComments(t.stringLiteral(mangled), node.property)
+  computed.property = t.stringLiteral(mangled)
   computed.computed = true
   state.changed = true
 }
@@ -586,7 +583,7 @@ function rewriteTerminalNames(
       node.value = mangled
       return node
     }
-    return t.inheritsComments(t.stringLiteral(mangled), node)
+    return t.stringLiteral(mangled)
   }
   if (t.isSequenceExpression(node)) {
     const last = node.expressions.length - 1
@@ -684,10 +681,10 @@ function isTransparentAnnotationParent(path: NodePath, child: t.Node): boolean {
 
 function hasAnnotation(node: t.Node, annotation: string): boolean {
   return (
-    node.leadingComments?.some(
-      (comment) =>
-        comment.value.includes(`@${annotation}`) || comment.value.includes(`#${annotation}`),
-    ) ?? false
+    node.leadingComments?.some((comment) => {
+      const value = comment.value.trim()
+      return value === `@${annotation}` || value === `#${annotation}`
+    }) ?? false
   )
 }
 

package/src/transforms/merge-variable-declarations.ts

@@ -0,0 +1,91 @@
+import * as t from '@babel/types'
+import type { File } from '@babel/types'
+
+import { rewriteStatementLists } from '../utils/statement-lists'
+
+/**
+ * Merges adjacent variable declarations when their kinds and export wrappers
+ * match. It runs in programs, blocks, switch cases, and static blocks, and
+ * removes unlabeled empty statements between compatible declarations.
+ *
+ * @example
+ * // ◀️ before
+ * let a = 1;
+ * let b = 2;
+ *
+ * // ▶️ after
+ * let a = 1,
+ *   b = 2;
+ */
+export function mergeVariableDeclarations(ast: File): boolean {
+  return rewriteStatementLists(ast, (statements) =>
+    mergeAdjacent(statements.map((path) => path.node)),
+  )
+}
+
+type StatementLike = t.Program['body'][number]
+
+interface MergeableDeclaration {
+  declaration: t.VariableDeclaration
+  exported: boolean
+}
+
+function mergeAdjacent(list: readonly StatementLike[]): StatementLike[] | null {
+  const out: StatementLike[] = []
+  let pendingEmpty: t.EmptyStatement[] = []
+  let merged = false
+
+  for (const statement of list) {
+    if (t.isEmptyStatement(statement) && mergeableDeclaration(out.at(-1)) !== null) {
+      pendingEmpty.push(statement)
+      continue
+    }
+
+    const previous = mergeableDeclaration(out.at(-1))
+    const current = mergeableDeclaration(statement)
+    if (previous && current && canMerge(previous, current)) {
+      out[out.length - 1] = mergePair(previous, current)
+      pendingEmpty = []
+      merged = true
+      continue
+    }
+
+    out.push(...pendingEmpty, statement)
+    pendingEmpty = []
+  }
+
+  out.push(...pendingEmpty)
+  return merged ? out : null
+}
+
+function mergeableDeclaration(statement: StatementLike | undefined): MergeableDeclaration | null {
+  if (statement === undefined) {
+    return null
+  }
+  if (t.isVariableDeclaration(statement)) {
+    return { declaration: statement, exported: false }
+  }
+  if (t.isExportNamedDeclaration(statement) && t.isVariableDeclaration(statement.declaration)) {
+    return { declaration: statement.declaration, exported: true }
+  }
+  return null
+}
+
+function canMerge(previous: MergeableDeclaration, current: MergeableDeclaration): boolean {
+  return (
+    previous.exported === current.exported && previous.declaration.kind === current.declaration.kind
+  )
+}
+
+function mergePair(previous: MergeableDeclaration, current: MergeableDeclaration): StatementLike {
+  const declaration = t.variableDeclaration(previous.declaration.kind, [
+    ...previous.declaration.declarations,
+    ...current.declaration.declarations,
+  ])
+
+  if (!previous.exported) {
+    return declaration
+  }
+
+  return t.exportNamedDeclaration(declaration)
+}

package/src/transforms/nullish-coalescing-to-ternary.ts

@@ -2,15 +2,14 @@ import type { NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 import { lowerLogicalWriteStatement } from '../utils/logical-lowering'
+import { buildNonNullishCheck, buildNullishCheck } from '../utils/nullish'
 
 /**
- * Rewrites `a ?? b` as a guarded assignment or `a != null ? a : b`. A
- * side-effectful left side is cached. Loose inequality checks both nullish
- * values in one comparison.
+ * Rewrites `a ?? b` as a guarded assignment or strict null and undefined
+ * checks. A side-effectful left side is cached.
  *
  * @example
  * // ◀️ before
@@ -19,8 +18,8 @@ import { lowerLogicalWriteStatement } from '../utils/logical-lowering'
  *
  * // ▶️ after
  * var x = a;
- * if (x == null) x = b;
- * f((_t = get()) != null ? _t : fallback);
+ * if (x === null ? true : x === void 0) x = b;
+ * f(((_t = get()) !== null ? _t !== void 0 : false) ? _t : fallback);
  */
 export function nullishCoalescingToTernary(ast: File): boolean {
   return traverseForChanges(ast, visitor)
@@ -39,11 +38,6 @@ function lowerNullishCoalescing(path: NodePath<t.LogicalExpression>): boolean {
   if (node.operator !== '??') {
     return false
   }
-  // `with` can turn a repeated name into a getter and shadow a cache temp.
-  if (isInsideWith(path)) {
-    return false
-  }
-
   if (lowerLogicalWriteStatement(path, nullishFallbackTest)) {
     return true
   }
@@ -64,7 +58,7 @@ function lowerNullishCoalescing(path: NodePath<t.LogicalExpression>): boolean {
 
   path.replaceWith(
     t.conditionalExpression(
-      t.binaryExpression('!=', test, t.nullLiteral()),
+      buildNonNullishCheck(test, t.cloneNode(consequent)),
       consequent,
       node.right,
     ),
@@ -73,5 +67,5 @@ function lowerNullishCoalescing(path: NodePath<t.LogicalExpression>): boolean {
 }
 
 function nullishFallbackTest(target: t.Identifier): t.Expression {
-  return t.binaryExpression('==', target, t.nullLiteral())
+  return buildNullishCheck(target, t.cloneNode(target))
 }

package/src/transforms/numbers-to-strings.ts

@@ -1,7 +1,8 @@
-import type { NodePath, Visitor } from '@babel/traverse'
+import type { Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
+import { isNonComputedKey } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
@@ -48,14 +49,3 @@ const visitor: Visitor<ChangeState> = {
     state.changed = true
   },
 }
-
-function isNonComputedKey(path: NodePath<t.NumericLiteral>): boolean {
-  const parentPath = path.parentPath
-  if (!parentPath) {
-    return false
-  }
-  const parent = parentPath.node
-  return (
-    'key' in parent && parent.key === path.node && 'computed' in parent && parent.computed === false
-  )
-}

package/src/transforms/object-method-to-property.ts

@@ -16,7 +16,7 @@ import type { ChangeState } from '../utils/change-tracking'
  *
  * Non-computed `__proto__` methods stay intact because the property form invokes
  * ECMA-262 B.3.1 prototype-setting behavior. Computed keys create own properties
- * and remain safe.
+ * and can be rewritten.
  *
  * @example
  * // ◀️ before

package/src/transforms/optional-chaining-to-ternary.ts

@@ -2,9 +2,9 @@ import type { NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { isInsideWith } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
+import { buildNullishCheck } from '../utils/nullish'
 
 /**
  * Rewrites optional chains as nested ternaries. Side-effectful receivers are
@@ -18,9 +18,10 @@ import type { ChangeState } from '../utils/change-tracking'
  * a?.b?.c;
  *
  * // ▶️ after
- * obj == null ? void 0 : (_m = obj.m).call(obj, arg);
- * obj == null ? true : delete obj.x;
- * a == null ? void 0 : (_b = a.b) == null ? void 0 : _b.c;
+ * (obj === null ? true : obj === void 0) ? void 0 : (_m = obj.m).call(obj, arg);
+ * (obj === null ? true : obj === void 0) ? true : delete obj.x;
+ * (a === null ? true : a === void 0) ? void 0 :
+ *   ((_b = a.b) === null ? true : _b === void 0) ? void 0 : _b.c;
  */
 export function optionalChainingToTernary(ast: File): boolean {
   return traverseForChanges(ast, visitor)
@@ -40,10 +41,6 @@ const visitor: Visitor<ChangeState> = {
 }
 
 function lowerOptionalChain(path: OptionalPath): boolean {
-  // `with` can make a repeated receiver name invoke a getter twice.
-  if (isInsideWith(path)) {
-    return false
-  }
   if (isInsideOptionalChain(path)) {
     return false
   }
@@ -173,16 +170,19 @@ function transformChain(path: OptionalPath): boolean {
     }
 
     let check: t.Expression
+    let repeatedCheck: t.Expression
 
     if (path.scope.isStatic(chain)) {
       // The receiver stays in the member expression, so the check needs its own
       // node. One node under two parents is visited twice, and a later in-place
       // rewrite such as renameIdentifiers then applies itself twice to it.
       check = t.cloneNode(chain)
+      repeatedCheck = t.cloneNode(chain)
     } else {
       const tmp = path.scope.generateUidIdentifierBasedOnNode(chain)
       path.scope.push({ id: t.cloneNode(tmp) })
       check = t.assignmentExpression('=', t.cloneNode(tmp), chain)
+      repeatedCheck = t.cloneNode(tmp)
       if (isCall) {
         ;(node as t.CallExpression).callee = t.cloneNode(tmp)
       } else {
@@ -208,7 +208,7 @@ function transformChain(path: OptionalPath): boolean {
       }
     }
 
-    const condition = t.binaryExpression('==', check, t.nullLiteral())
+    const condition = buildNullishCheck(check, repeatedCheck)
 
     let alternate = replacementPath.node as t.Expression
     if (isDelete && i === optionals.length - 1) {

package/src/transforms/pack-declarations-into-parameters.ts

@@ -2,11 +2,10 @@ import type { Binding, NodePath, Visitor } from '@babel/traverse'
 import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
-import { enclosingScopeHasDirectEval, hasDuplicateParamNames } from '../utils/ast'
+import { hasDuplicateParamNames } from '../utils/ast'
 import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 import { isLiteralShaped } from '../utils/literal'
-import { hasAnnexBFunctionAlias } from '../utils/paths'
 
 /**
  * Moves leading literal-valued `var` declarations into trailing default
@@ -50,10 +49,6 @@ function packLeadingIntoParams(path: NodePath<t.Function>): boolean {
   ) {
     return false
   }
-  // An Annex B alias splits call sites across bindings Babel does not connect.
-  if (hasAnnexBFunctionAlias(path)) {
-    return false
-  }
   const params = path.node.params
   if (params.some((param) => t.isRestElement(param))) {
     return false
@@ -75,10 +70,6 @@ function packLeadingIntoParams(path: NodePath<t.Function>): boolean {
   if (referencesArguments(path)) {
     return false
   }
-  // Direct eval can inspect the newly unmapped `arguments` by name.
-  if (enclosingScopeHasDirectEval(path)) {
-    return false
-  }
   // A caller with extra arguments could fill the new parameter slot.
   if (!allCallSitesRespectArity(path, params.length)) {
     return false
@@ -163,7 +154,11 @@ function methodComputedKey(path: NodePath<t.Function>): NodePath | null {
 // arity and without spread.
 function allCallSitesRespectArity(path: NodePath<t.Function>, arity: number): boolean {
   const external = functionBinding(path)
-  if (!external || !external.constant || !bindingCallsRespectArity(external, arity)) {
+  if (
+    !external ||
+    (external.kind !== 'const' && !external.constant) ||
+    !bindingCallsRespectArity(external, arity)
+  ) {
     return false
   }
   if (path.isFunctionExpression() && path.node.id) {
@@ -193,17 +188,12 @@ function bindingCallsRespectArity(binding: Binding, arity: number): boolean {
   return true
 }
 
-// Annex B can hoist function names from nested blocks into this function scope.
 function functionDeclarationNames(body: t.BlockStatement): Set<string> {
-  const names = new Set<string>()
-  t.traverseFast(body, (node) => {
-    if (t.isFunctionDeclaration(node) && node.id) {
-      names.add(node.id.name)
-      return t.traverseFast.skip
-    }
-    return node !== body && t.isFunction(node) ? t.traverseFast.skip : undefined
-  })
-  return names
+  return new Set(
+    body.body.flatMap((statement) =>
+      t.isFunctionDeclaration(statement) && statement.id ? [statement.id.name] : [],
+    ),
+  )
 }
 
 function functionBinding(path: NodePath<t.Function>): Binding | null {

package/src/transforms/pack.ts

@@ -5,7 +5,6 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 import type { TransformContext } from '../options'
-import { isInsideWith } from '../utils/ast'
 import { isCalleeOrTagOf, isInStrictContext, referencesOrWritesVariable } from '../utils/paths'
 import { mulberry32 } from '../utils/random'
 import { StringGenerator } from '../utils/string-generator'
@@ -108,19 +107,10 @@ const STANDARD_GLOBALS: readonly string[] = [
 ]
 
 /**
- * Serializes the whole program to a string and rebuilds it at runtime through
- * the `Function` constructor. A detached function body only reaches true globals
- * and its own parameters. A free name might instead be a CommonJS `require`, a
- * bundler-injected binding, or a live import, none reachable from the body and
- * none distinguishable from a global at build time, so free names are routed
- * through a parameter object whose accessors run in the original top-level scope
- * and resolve each name there. Import declarations return above the call. `eval`
- * is left un-routed so a direct eval still reads the body scope. Names inside a
- * `with` stay un-routed too, since they may resolve against the with object at
- * runtime. Export statements cannot live inside a Function body, so pack throws
- * on them. It packs everything else as written. Code that needs `import.meta`,
- * top-level await, dynamic `import()`, or a top-level `arguments` will not run
- * once moved into a Function body.
+ * Serializes the whole program and runs it through the `Function` constructor.
+ * Imports stay outside the generated function. Reads and writes to other free
+ * names go through accessors created in the original top-level scope. Export
+ * statements are rejected because they cannot appear in a `Function` body.
  *
  * @example
  * // ◀️ before
@@ -230,15 +220,9 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
 
   const isRoutable = (path: NodePath<t.Identifier>): boolean => {
     const name = path.node.name
-    // The wrapper parameter stays as written. `arguments` and `eval` are never
-    // routed: `arguments` binds to its own function's object, and leaving `eval`
-    // bare keeps a direct eval reading the body scope rather than the global one.
-    if (name === objectName || name === 'arguments' || name === 'eval') {
-      return false
-    }
-    // Inside `with`, a free name may resolve to a property of the with object at
-    // runtime, so routing it to the top-level accessor would change behavior.
-    if (isInsideWith(path)) {
+    // Keep the wrapper parameter and `arguments` bare. The latter must bind to
+    // the wrapper function's own arguments object.
+    if (name === objectName || name === 'arguments') {
       return false
     }
     if (!referencesOrWritesVariable(path)) {
@@ -298,18 +282,13 @@ function packProgram(programPath: NodePath<t.Program>, ctx: TransformContext): b
   }
   programPath.traverse(routingVisitor)
 
-  // The script completion value is its trailing expression; returning it keeps
-  // `eval` of the packed output producing the same value.
   const body = programNode.body
-  const lastStatement = body.at(-1)
-  if (lastStatement && t.isExpressionStatement(lastStatement)) {
-    body[body.length - 1] = t.returnStatement(lastStatement.expression)
-  }
-
   const innerDirectives = bodyStrict ? [t.directive(t.directiveLiteral('use strict'))] : []
   const innerCode = generate(t.program(body, innerDirectives, 'script'), {
     minified: true,
     comments: false,
+    // `comments: false` still allows @license and @preserve.
+    shouldPrintComment: () => false,
   }).code
 
   const objectExpression = buildAccessorObject({