webfuscator 1.3.2 → 1.3.4

package/dist/transforms/yodify-conditions.js.map

@@ -1 +1 @@
-{"version":3,"file":"yodify-conditions.js","sourceRoot":"","sources":["../../src/transforms/yodify-conditions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAS;IACxC,OAAO,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,OAAO,GAAyB;IACpC,gBAAgB,CAAC,IAAI,EAAE,KAAK;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;QACxB,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAM;QACR,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAM;QACR,CAAC;QACD,yEAAyE;QACzE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAM;QACR,CAAC;QACD,6EAA6E;QAC7E,IAAI,eAAe,CAAC,EAAE,CAAC,KAAK,SAAS,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAA;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACjB,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,CAAC,CAAA;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,IAAI,CAAA;IACtB,CAAC;CACF,CAAA;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;AAExF,SAAS,cAAc,CAAC,EAAU;IAChC,OAAO,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,eAAe,GAAmD;IACtE,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;CACX,CAAA;AAED,yEAAyE;AACzE,SAAS,yBAAyB,CAAC,IAAkB;IACnD,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,4EAA4E;AAC5E,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC1B,OAAO,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACrF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAkB;IAC/C,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"yodify-conditions.js","sourceRoot":"","sources":["../../src/transforms/yodify-conditions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAA;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAS;IACxC,OAAO,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,OAAO,GAAyB;IACpC,gBAAgB,CAAC,IAAI,EAAE,KAAK;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAA;QACxB,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAM;QACR,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAM;QACR,CAAC;QACD,yEAAyE;QACzE,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAM;QACR,CAAC;QACD,6EAA6E;QAC7E,IAAI,eAAe,CAAC,EAAE,CAAC,KAAK,SAAS,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,KAAK,CAAA;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACjB,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,CAAC,CAAA;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACzB,CAAC;QACD,KAAK,CAAC,OAAO,GAAG,IAAI,CAAA;IACtB,CAAC;CACF,CAAA;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAA;AAExF,SAAS,cAAc,CAAC,EAAU;IAChC,OAAO,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,eAAe,GAAmD;IACtE,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,IAAI;CACX,CAAA;AAED,yEAAyE;AACzE,SAAS,yBAAyB,CAAC,IAAkB;IACnD,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,4EAA4E;AAC5E,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC1B,OAAO,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACrF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAkB;IAC/C,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webfuscator",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "JavaScript obfuscator built on Babel",
   "keywords": [
     "babel",

package/src/obfuscator.ts

@@ -31,13 +31,13 @@ import { hoistVariables } from './transforms/hoist-variables'
 import { inlineFunctions } from './transforms/inline-functions'
 import { logicalToTernary } from './transforms/logical-to-ternary'
 import { mangleProperties } from './transforms/mangle-properties'
-import { mergeVariableDeclarations } from './transforms/merge-variable-declarations'
 import { nullishCoalescingToTernary } from './transforms/nullish-coalescing-to-ternary'
 import { numbersToStrings } from './transforms/numbers-to-strings'
 import { objectMethodToProperty } from './transforms/object-method-to-property'
 import { optionalChainingToTernary } from './transforms/optional-chaining-to-ternary'
 import { pack } from './transforms/pack'
 import { packDeclarationsIntoParameters } from './transforms/pack-declarations-into-parameters'
+import { packExpressions } from './transforms/pack-expressions'
 import { removeAnonymousFunctionNames } from './transforms/remove-anonymous-function-names'
 import { removeUnreachableCode } from './transforms/remove-unreachable-code'
 import { removeUnusedCode } from './transforms/remove-unused-code'
@@ -125,16 +125,15 @@ const LOWERING: readonly ConfigurablePhase[] = [
   ['ternaryToIf', ternaryToIf],
 ]
 
-// `packDeclarationsIntoParameters` must precede declaration motion and merging.
+// `packDeclarationsIntoParameters` must precede declaration motion.
 // `reorderFunctionDeclarations` follows `functionDeclarationToExpression`, so it
-// moves only declarations still needed for hoisting. `hoistVariables` must run
-// before `mergeVariableDeclarations`. `numbersToStrings` follows the fixed point,
-// yodification, and `specialsToStrings` because they need or create numbers.
+// moves only declarations still needed for hoisting. `numbersToStrings` follows
+// the fixed point, yodification, and `specialsToStrings` because they need or
+// create numbers.
 const POST_PROCESS: readonly ConfigurablePhase[] = [
   ['packDeclarationsIntoParameters', packDeclarationsIntoParameters],
   ['reorderFunctionDeclarations', reorderFunctionDeclarations],
   ['hoistVariables', hoistVariables],
-  ['mergeVariableDeclarations', mergeVariableDeclarations],
   ['yodifyConditions', yodifyConditions],
   ['specialsToStrings', specialsToStrings],
   ['numbersToStrings', numbersToStrings],
@@ -144,12 +143,17 @@ const POST_PROCESS: readonly ConfigurablePhase[] = [
 // generated vault bindings use the caller's name generator.
 const PROTECTION: readonly ConfigurablePhase[] = [['concealStrings', concealStrings]]
 
-// Renaming runs last because later transforms depend on recognizable bindings.
+// All binding-producing passes run before renaming so their generated
+// identifiers also receive names from the configured string generator.
 const RENAME: readonly ConfigurablePhase[] = [['renameIdentifiers', renameIdentifiers]]
 
+// Statement packing consumes final declaration and expression shapes and creates
+// no bindings, so it runs after renaming and before whole-program packing.
+const FINAL_SHAPE: readonly ConfigurablePhase[] = [['packExpressions', packExpressions]]
+
 // Packing serializes the finished program to a string and rebuilds it through
 // the Function constructor. It must see final names and shapes, so it runs after
-// every other rewrite, including renaming.
+// every other rewrite.
 const PACK: readonly ConfigurablePhase[] = [['pack', pack]]
 
 // Tests derive their all-transforms setup from this list. The phase tables remain
@@ -162,6 +166,7 @@ export const CONFIGURABLE_TRANSFORM_NAMES: readonly TransformName[] = [
   ...POST_PROCESS,
   ...PROTECTION,
   ...RENAME,
+  ...FINAL_SHAPE,
   ...PACK,
 ].map(([name]) => name)
 
@@ -175,7 +180,7 @@ export function obfuscate(code: string, options: ObfuscatorOptions = {}): string
   const ast = run(log, 'parse', () => parse(code, parserOptions))
 
   for (const [name, fn] of BEFORE_PREPARATION) {
-    if (!isEnabled(name, options)) {
+    if (!shouldRun(name, options)) {
       continue
     }
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
@@ -186,7 +191,7 @@ export function obfuscate(code: string, options: ObfuscatorOptions = {}): string
   }
 
   for (const [name, fn] of PRE_LOOP) {
-    if (!isEnabled(name, options)) {
+    if (!shouldRun(name, options)) {
       continue
     }
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
@@ -195,35 +200,42 @@ export function obfuscate(code: string, options: ObfuscatorOptions = {}): string
   runFixedPoint(ast, options, baseCtx, log)
 
   for (const [name, fn] of LOWERING) {
-    if (!isEnabled(name, options)) {
+    if (!shouldRun(name, options)) {
       continue
     }
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
   }
 
   for (const [name, fn] of POST_PROCESS) {
-    if (!isEnabled(name, options)) {
+    if (!shouldRun(name, options)) {
       continue
     }
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
   }
 
   for (const [name, fn] of PROTECTION) {
-    if (!isEnabled(name, options)) {
+    if (!shouldRun(name, options)) {
       continue
     }
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
   }
 
   for (const [name, fn] of RENAME) {
-    if (!isEnabled(name, options)) {
+    if (!shouldRun(name, options)) {
+      continue
+    }
+    run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
+  }
+
+  for (const [name, fn] of FINAL_SHAPE) {
+    if (!shouldRun(name, options)) {
       continue
     }
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
   }
 
   for (const [name, fn] of PACK) {
-    if (!isEnabled(name, options)) {
+    if (!shouldRun(name, options)) {
       continue
     }
     run(log, name, () => fn(ast, ctxFor(name, options, baseCtx)))
@@ -242,7 +254,7 @@ export function obfuscate(code: string, options: ObfuscatorOptions = {}): string
   )
 }
 
-function isEnabled(name: TransformName, options: ObfuscatorOptions): boolean {
+function shouldRun(name: TransformName, options: ObfuscatorOptions): boolean {
   const entry = options.transforms?.[name]
   return entry !== undefined && entry !== false
 }
@@ -277,14 +289,14 @@ function runFixedPoint(
   ctx: TransformContext,
   log: Logger | null,
 ): void {
-  const enabled = FIXED_POINT.filter(([name]) => isEnabled(name, options))
-  if (enabled.length === 0) {
+  const transforms = FIXED_POINT.filter(([name]) => shouldRun(name, options))
+  if (transforms.length === 0) {
     return
   }
 
   for (let iter = 0; iter < FIXED_POINT_ITERATION_CAP; iter++) {
     let any = false
-    for (const [name, fn] of enabled) {
+    for (const [name, fn] of transforms) {
       if (run(log, name, () => fn(ast, ctx))) {
         any = true
       }

package/src/options.ts

@@ -1,8 +1,8 @@
 import type { StringGeneratorModeOption } from './utils/string-generator'
 
 /**
- * Exported transform entry points. Preparation passes are always enabled and
- * do not appear here.
+ * Exported transform entry points. Preparation passes always run and do not
+ * appear here.
  */
 export type TransformName =
   | 'dropConsole'
@@ -23,7 +23,6 @@ export type TransformName =
   | 'functionDeclarationToExpression'
   | 'reorderFunctionDeclarations'
   | 'hoistVariables'
-  | 'mergeVariableDeclarations'
   | 'switchToIf'
   | 'forToWhile'
   | 'doWhileToWhile'
@@ -41,9 +40,10 @@ export type TransformName =
   | 'concealStrings'
   | 'mangleProperties'
   | 'renameIdentifiers'
+  | 'packExpressions'
   | 'pack'
 
-// An override enables the transform and replaces its string-generator mode.
+// An options object runs the transform and replaces its string-generator mode.
 type TransformEntry = boolean | { stringGeneratorMode?: StringGeneratorModeOption }
 
 /** Maps a zero-based ordinal to a stable property name. */
@@ -105,8 +105,6 @@ export interface ConcealStringsOptions {
   cache?: boolean
   /** Choose how much of the UTF-16 range pads each pool. Default `'regional'`. */
   cover?: 'full' | 'regional' | 'used'
-  /** Reuse one vault entry for equal strings. Default `true`. */
-  deduplicate?: boolean
   /** Use one program vault or a separate vault per function. Default `'program'`. */
   scope?: 'function' | 'program'
 }
@@ -130,21 +128,22 @@ export interface ObfuscatorOptions {
   /** Logs each pipeline step and its elapsed milliseconds to stderr. */
   verbose?: boolean
   /**
-   * Per-transform toggles and string-generator overrides. Omitted transforms
-   * are disabled. Preparation passes always run and are not configurable.
+   * Per-transform entries and string-generator overrides. An omitted key or
+   * `false` means that transform does not run. Preparation passes always run.
    */
   transforms?: TransformsMap
   /**
-   * Default mode for generated identifiers, labels, and string contents. An
-   * array mixes modes uniformly. Individual transforms may override it through
-   * `transforms.<name>.stringGeneratorMode`. Default `'mangled'`.
+   * Mode used by transforms that run for generated identifiers, labels, and
+   * string contents. An array mixes modes uniformly. Individual transforms may
+   * override it through `transforms.<name>.stringGeneratorMode`. Default
+   * `'mangled'`.
    */
   stringGeneratorMode?: StringGeneratorModeOption
-  /** Seed for any nondeterministic transform. Same seed, same output. Default `0`. */
+  /** Seed used by randomized transforms that run. Same seed, same output. Default `0`. */
   seed?: number
 }
 
-// Resolved per-call defaults handed to every transform.
+// Resolved per-call settings handed to each executed pass.
 export interface TransformContext {
   concealStrings?: ConcealStringsOptions
   mangleProperties?: ManglePropertiesOptions

package/src/transforms/arguments-to-parameters.ts

@@ -8,11 +8,8 @@ import type { ChangeState } from '../utils/change-tracking'
 import { isInStrictContext } from '../utils/paths'
 
 /**
- * Replaces numeric `arguments[i]` reads with the corresponding parameter in
- * sloppy functions with simple parameter lists. It leaves a read unchanged when
- * that index is written or its parameter is reassigned. Reassigning, deleting,
- * or passing around `arguments` disables the rewrite. Missing parameters are
- * never added because that would change `fn.length`.
+ * Replaces eligible numeric `arguments[i]` reads with the corresponding
+ * parameter in sloppy functions with simple parameter lists.
  *
  * @example
  * // ◀️ before

package/src/transforms/arrow-to-function.ts

@@ -6,10 +6,9 @@ import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
 /**
- * Converts arrows with Babel's capture-aware `arrowFunctionToExpression`.
- * Arrows that use `super` stay unchanged. An arrow also stays unchanged unless
- * every use is an immediate call or a discarded expression, because a normal
- * function can be constructed with `new` and has a `prototype`.
+ * Converts eligible arrow functions to function expressions while preserving
+ * their lexical captures. Arrows that use `super` or whose values escape stay
+ * unchanged.
  *
  * @example
  * // ◀️ before

package/src/transforms/collapse-single-use-temps.ts

@@ -15,9 +15,8 @@ import { valueToLiteral } from '../utils/literal'
 import { isCalleeOrTagOf } from '../utils/paths'
 
 /**
- * Drops single-use temporaries through substitution, direct branch writes, or
- * constant replacement. It repeats these rewrites so one removal can expose
- * another.
+ * Replaces eligible single-use temporary bindings with their values and removes
+ * the declarations.
  *
  * @example
  * // ◀️ before

package/src/transforms/conceal-strings.ts

@@ -11,25 +11,8 @@ import { mulberry32, shuffleInPlace } from '../utils/random'
 const RECORD_WIDTH = 4
 
 /**
- * Replaces runtime string literals with calls to a generated decoder. Each vault
- * stores masked positions in a shuffled UTF-16 pool. The decoder handles lone
- * surrogates without relying on mutable built-ins. The default `regional` pool
- * covers U+0000-00FF and every 256-unit page used by the program. `full` covers
- * all 65,536 code units.
- *
- * `scope: 'program'` creates one vault. `scope: 'function'` creates a vault per
- * function but repeats the program-wide pool in each one. Parameter defaults and
- * computed keys use the enclosing vault because they run before the function
- * body.
- *
- * Directives, module specifiers, import attributes, and non-computed keys are not
- * runtime expressions, so they stay unchanged.
- *
- * This is obfuscation, not encryption. The output contains the decoder and all
- * data needed to recover each string. `cover: 'used'` also leaves one-unit
- * strings in the pool and may reproduce longer text by chance.
- *
- * The example uses `{ cover: 'used' }` to keep the pool short.
+ * Replaces runtime string literals with calls to a generated decoder backed by
+ * an obfuscated string vault.
  *
  * @example
  * // ◀️ before
@@ -38,21 +21,21 @@ const RECORD_WIDTH = 4
  * }
  *
  * // ▶️ after
- * const _stringPool = " lo,He",
- *   _stringPayload = [0, 4, 7, 2, 2, 6, 2],
+ * var _stringPool = " lo,He";
+ * var _stringPayload = [0, 4, 7, 2, 2, 6, 2],
  *   _stringMetadata = [0, 7, 4, 5],
  *   _stringCache = [null],
  *   _stringDecoder = function (_entry) {
- *     let _cached = _stringCache[_entry];
+ *     var _cached = _stringCache[_entry];
  *     if (_cached !== null) return _cached;
- *     let _result = "",
+ *     var _result = "",
  *       _record = _entry * 4,
  *       _start = _stringMetadata[_record],
  *       _length = _stringMetadata[_record + 1],
  *       _stringKey = _stringMetadata[_record + 2],
  *       _stringStep = _stringMetadata[_record + 3];
- *     for (let _position = 0; _position < _length; _position++) {
- *       let _stringMask = _stringKey + _position * _stringStep & 7;
+ *     for (var _position = 0; _position < _length; _position++) {
+ *       var _stringMask = _stringKey + _position * _stringStep & 7;
  *       _result += _stringPool[_stringPayload[_start + _position] ^ _stringMask];
  *     }
  *     _stringCache[_entry] = _result;
@@ -65,7 +48,7 @@ const RECORD_WIDTH = 4
 export function concealStrings(ast: File, ctx: TransformContext): boolean {
   const options = resolveOptions(ctx.concealStrings)
   const rng = mulberry32(ctx.seed)
-  const state: State = { changed: false, groups: new Map(), options }
+  const state: State = { changed: false, groups: new Map(), options, program: null }
 
   if (options.scope === 'function') {
     normalizeConciseArrows(ast, options)
@@ -76,17 +59,18 @@ export function concealStrings(ast: File, ctx: TransformContext): boolean {
     return false
   }
   const pool = buildSharedPool(state.groups.values(), options.cover, rng)
+  const poolIdentifier = t.identifier(state.program!.scope.generateUid('stringPool'))
   for (const group of state.groups.values()) {
-    concealGroup(group, options, pool, rng)
+    concealGroup(group, options, pool, poolIdentifier, rng)
     state.changed = true
   }
+  insertSharedPool(state.program!, poolIdentifier, pool.value)
   return state.changed
 }
 
 interface ResolvedOptions {
   cache: boolean
   cover: 'full' | 'regional' | 'used'
-  deduplicate: boolean
   scope: 'function' | 'program'
 }
 
@@ -106,6 +90,7 @@ interface VaultGroup {
 interface State extends ChangeState {
   groups: Map<VaultOwner, VaultGroup>
   options: ResolvedOptions
+  program: NodePath<t.Program> | null
 }
 
 interface Entry {
@@ -117,7 +102,6 @@ interface VaultData {
   indexMask: number
   metadata: number[]
   payload: number[]
-  pool: string
 }
 
 interface SharedPool {
@@ -135,6 +119,9 @@ interface VaultIdentifiers {
 }
 
 const collectVisitor: Visitor<State> = {
+  Program(path, state) {
+    state.program = path
+  },
   StringLiteral(path, state) {
     if (!isRuntimeString(path)) {
       return
@@ -155,7 +142,6 @@ const collectVisitor: Visitor<State> = {
 function resolveOptions(options: ConcealStringsOptions | undefined): ResolvedOptions {
   const cache = options?.cache ?? true
   const cover = options?.cover ?? 'regional'
-  const deduplicate = options?.deduplicate ?? true
   const scope = options?.scope ?? 'program'
   if (typeof cache !== 'boolean') {
     throw new TypeError('concealStrings cache must be a boolean')
@@ -163,13 +149,10 @@ function resolveOptions(options: ConcealStringsOptions | undefined): ResolvedOpt
   if (cover !== 'full' && cover !== 'regional' && cover !== 'used') {
     throw new TypeError("concealStrings cover must be 'full', 'regional', or 'used'")
   }
-  if (typeof deduplicate !== 'boolean') {
-    throw new TypeError('concealStrings deduplicate must be a boolean')
-  }
   if (scope !== 'function' && scope !== 'program') {
     throw new TypeError("concealStrings scope must be 'function' or 'program'")
   }
-  return { cache, cover, deduplicate, scope }
+  return { cache, cover, scope }
 }
 
 function normalizeConciseArrows(ast: File, options: ResolvedOptions): void {
@@ -237,12 +220,19 @@ function concealGroup(
   group: VaultGroup,
   options: ResolvedOptions,
   pool: SharedPool,
+  poolIdentifier: t.Identifier,
   rng: () => number,
 ): void {
-  const entries = makeEntries(group.occurrences, options.deduplicate)
+  const entries = makeEntries(group.occurrences)
   shuffleInPlace(entries, rng)
   const data = encodeEntries(entries, pool, rng)
-  const identifiers = insertVault(statementBody(group.owner), entries.length, data, options.cache)
+  const identifiers = insertVault(
+    statementBody(group.owner),
+    entries.length,
+    data,
+    options.cache,
+    poolIdentifier,
+  )
 
   for (let index = 0; index < entries.length; index++) {
     for (const occurrence of entries[index]!.occurrences) {
@@ -254,10 +244,7 @@ function concealGroup(
   }
 }
 
-function makeEntries(occurrences: Occurrence[], deduplicate: boolean): Entry[] {
-  if (!deduplicate) {
-    return occurrences.map((occurrence) => ({ occurrences: [occurrence], value: occurrence.value }))
-  }
+function makeEntries(occurrences: Occurrence[]): Entry[] {
   const byValue = new Map<string, Entry>()
   for (const occurrence of occurrences) {
     let entry = byValue.get(occurrence.value)
@@ -308,7 +295,7 @@ function encodeEntries(entries: Entry[], pool: SharedPool, rng: () => number): V
       payload.push(truePosition ^ maskPosition(position, key, step, pool.indexMask))
     }
   }
-  return { indexMask: pool.indexMask, metadata, payload, pool: pool.value }
+  return { indexMask: pool.indexMask, metadata, payload }
 }
 
 function makePoolUnits(usedUnits: ReadonlySet<string>, cover: ResolvedOptions['cover']): string[] {
@@ -385,6 +372,7 @@ function insertVault(
   entryCount: number,
   data: VaultData,
   cache: boolean,
+  pool: t.Identifier,
 ): VaultIdentifiers {
   const fresh = (purpose: string): t.Identifier => t.identifier(body.scope.generateUid(purpose))
   const identifiers: VaultIdentifiers = {
@@ -392,11 +380,10 @@ function insertVault(
     decoder: fresh('stringDecoder'),
     metadata: fresh('stringMetadata'),
     payload: fresh('stringPayload'),
-    pool: fresh('stringPool'),
+    pool,
   }
   const decoder = t.functionExpression(null, [], t.blockStatement([]))
   const declarations = [
-    t.variableDeclarator(identifiers.pool, t.stringLiteral(data.pool)),
     t.variableDeclarator(identifiers.payload, numericArray(data.payload)),
     t.variableDeclarator(identifiers.metadata, numericArray(data.metadata)),
   ]
@@ -410,7 +397,7 @@ function insertVault(
   }
   declarations.push(t.variableDeclarator(identifiers.decoder, decoder))
 
-  const declaration = t.variableDeclaration('const', declarations)
+  const declaration = t.variableDeclaration('var', declarations)
   const [declarationPath] = body.unshiftContainer('body', declaration)
   const declaratorPaths = declarationPath!.get('declarations') as NodePath<t.VariableDeclarator>[]
   const decoderPath = declaratorPaths
@@ -420,6 +407,19 @@ function insertVault(
   return identifiers
 }
 
+function insertSharedPool(
+  program: NodePath<t.Program>,
+  identifier: t.Identifier,
+  value: string,
+): void {
+  program.unshiftContainer(
+    'body',
+    t.variableDeclaration('var', [
+      t.variableDeclarator(t.cloneNode(identifier), t.stringLiteral(value)),
+    ]),
+  )
+}
+
 function populateDecoder(
   decoderPath: NodePath<t.FunctionExpression>,
   vault: VaultIdentifiers,
@@ -441,13 +441,13 @@ function populateDecoder(
   if (vault.cache) {
     const cached = fresh('cached')
     statements.push(
-      t.variableDeclaration('let', [t.variableDeclarator(cached, indexed(vault.cache, entry))]),
+      t.variableDeclaration('var', [t.variableDeclarator(cached, indexed(vault.cache, entry))]),
       t.ifStatement(t.binaryExpression('!==', cached, t.nullLiteral()), t.returnStatement(cached)),
     )
   }
 
   statements.push(
-    t.variableDeclaration('let', [
+    t.variableDeclaration('var', [
       t.variableDeclarator(result, t.stringLiteral('')),
       t.variableDeclarator(record, t.binaryExpression('*', entry, t.numericLiteral(RECORD_WIDTH))),
       t.variableDeclarator(start, indexed(vault.metadata, record)),
@@ -465,11 +465,11 @@ function populateDecoder(
       ),
     ]),
     t.forStatement(
-      t.variableDeclaration('let', [t.variableDeclarator(position, t.numericLiteral(0))]),
+      t.variableDeclaration('var', [t.variableDeclarator(position, t.numericLiteral(0))]),
       t.binaryExpression('<', position, length),
       t.updateExpression('++', position),
       t.blockStatement([
-        t.variableDeclaration('let', [
+        t.variableDeclaration('var', [
           t.variableDeclarator(mask, maskExpression(position, key, step, indexMask)),
         ]),
         t.expressionStatement(

package/src/transforms/const-let-to-var.ts

@@ -4,10 +4,9 @@ import * as t from '@babel/types'
 import type { File } from '@babel/types'
 
 /**
- * Converts `let` and `const` declarations to `var` and renames bindings that
- * would conflict after hoisting. It leaves loop declarations unchanged when
- * `var` would lose a captured per-iteration binding or reuse the previous
- * iteration's value.
+ * Converts eligible `let` and `const` declarations to `var`, renaming bindings
+ * when needed to avoid hoisting conflicts. Loop bindings stay unchanged when
+ * conversion would alter iteration behavior.
  *
  * @example
  * // ◀️ before

package/src/transforms/do-while-to-while.ts

@@ -7,9 +7,8 @@ import type { ChangeState } from '../utils/change-tracking'
 import { collectLoopLabels, generateLoopLabel, redirectContinues } from '../utils/loop-lowering'
 
 /**
- * Rewrites `do` loops as `while (true)` with an exit test after the body.
- * Continues become breaks from an inner block so they still reach that test.
- * The inner label is omitted when nothing uses it.
+ * Rewrites `do...while` loops as equivalent `while` loops while preserving
+ * `continue` behavior.
  *
  * @example
  * // ◀️ before

package/src/transforms/drop-console.ts

@@ -8,10 +8,7 @@ import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
 /**
- * Removes `console.*(...)` expression statements when `console` is not
- * locally shadowed. Matches dot, bracket, and optional-chain forms.
- * Leaves indirect uses alone (`console.log.call(...)`, assignments,
- * `await console.log(...)`).
+ * Removes eligible `console` call expression statements.
  *
  * @example
  * // ◀️ before

package/src/transforms/expand-binary-assignment.ts

@@ -6,14 +6,8 @@ import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
 /**
- * Rewrites arithmetic and bitwise compound assignments as `LHS = LHS op RHS`.
- * Logical compound assignments are handled by `expandLogicalAssignment`.
- *
- * Member objects and computed keys are cached so the read and write use the same
- * evaluated receiver. The cache assignment stays on the outer write target,
- * which evaluates before its right side.
- *
- * Compound and expanded forms use the same operator semantics, including BigInt.
+ * Expands arithmetic and bitwise compound assignments into simple assignments
+ * while preserving single evaluation of member receivers and computed keys.
  *
  * @example
  * // ◀️ before

package/src/transforms/expand-logical-assignment.ts

@@ -6,8 +6,9 @@ import { traverseForChanges } from '../utils/change-tracking'
 import type { ChangeState } from '../utils/change-tracking'
 
 /**
- * Rewrites `||=`/`&&=`/`??=` as `LHS op (LHS = RHS)`. Member objects and
- * computed keys are cached so the read and write use the same receiver.
+ * Expands logical compound assignments into equivalent short-circuiting
+ * assignments while preserving single evaluation of member receivers and
+ * computed keys.
  *
  * @example
  * // ◀️ before

package/src/transforms/extract-object-properties.ts

@@ -9,9 +9,8 @@ import type { ChangeState } from '../utils/change-tracking'
 import { isCalleeOrTagOf } from '../utils/paths'
 
 /**
- * Replaces a constant object or array wrapper with one binding per entry when
- * every reference is a static-key read. The inliner can then see function
- * values directly.
+ * Replaces eligible object and array wrapper bindings with separate bindings
+ * for their statically accessed entries.
  *
  * @example
  * // ◀️ before

package/src/transforms/fold-builtin-methods.ts

@@ -10,9 +10,8 @@ import type { ChangeState } from '../utils/change-tracking'
 import { valueToLiteral } from '../utils/literal'
 
 /**
- * Replaces built-in calls and reads with smaller syntax or host-computed
- * constants. Host evaluation requires known arguments and receivers. Shadowed
- * names, optional forms, and regexp methods stay unchanged.
+ * Replaces eligible built-in calls and property reads with smaller equivalent
+ * expressions or constants.
  *
  * @example
  * // ◀️ before

package/src/transforms/fold-constants.ts

@@ -10,8 +10,8 @@ import { valueToLiteral } from '../utils/literal'
 import { isCalleeOrTagOf } from '../utils/paths'
 
 /**
- * Folds pure constant expressions to literals via `evaluateConstant`.
- * Logical and conditional nodes can fold directly to a chosen nonliteral branch.
+ * Replaces pure compile-time constant expressions with equivalent literals or
+ * selected branches.
  *
  * @example
  * // ◀️ before