diff --git a/.github/workflows/minify.yml b/.github/workflows/minify.yml
index e316084..580d29c 100644
--- a/.github/workflows/minify.yml
+++ b/.github/workflows/minify.yml
@@ -1,4 +1,4 @@
-name: Update minified CloakJS
+name: Tests and minified build
 
 on:
   push:
@@ -6,6 +6,13 @@ on:
       - '**'
     paths:
       - cloakjs.js
+      - test/cloakjs.test.js
+      - .github/workflows/minify.yml
+  pull_request:
+    paths:
+      - cloakjs.js
+      - test/cloakjs.test.js
+  workflow_dispatch:
 
 permissions:
   contents: write
@@ -18,20 +25,87 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: '22'
-      - name: Minify and verify
+
+      - name: Run the test suite
+        run: node --test
+
+      - name: Minify
         run: |
-          node --test
           npm exec --yes --package=terser@5.44.0 -- terser cloakjs.js --compress --mangle --comments '/^!/' --output cloakjs.min.js
           node --check cloakjs.min.js
-          node -e 'const c = require("./cloakjs.min.js"); const source = require("./cloakjs.js"); if (c.VERSION !== source.VERSION || typeof c.obfuscate !== "function") process.exit(1); const vm = require("node:vm"); const logs = []; vm.runInNewContext(c.obfuscate("console.log(\"ok\")", "high"), { console: { log: x => logs.push(x) }, atob, TextDecoder }); if (logs[0] !== "ok") process.exit(1)'
-      - name: Commit minified file if changed
+
+      - name: Verify the minified build
+        run: |
+          cat > "$RUNNER_TEMP/verify-cloakjs.js" <<'VERIFY'
+          const assert = require("node:assert/strict");
+          const vm = require("node:vm");
+          const path = require("node:path");
+          const source = require(path.join(process.cwd(), "cloakjs.js"));
+          const minified = require(path.join(process.cwd(), "cloakjs.min.js"));
+
+          // metadata and API surface
+          assert.equal(minified.VERSION, source.VERSION);
+          assert.equal(minified.NAME, source.NAME);
+          assert.deepEqual(Object.keys(minified.presets), Object.keys(source.presets));
+          assert.equal(minified.techniques.length, source.techniques.length);
+          for (const key of ["obfuscate", "obfuscateWithStats", "measure", "resolveOptions"]) {
+            assert.equal(typeof minified[key], "function", `${key} is missing`);
+          }
+          assert.deepEqual(Object.keys(minified.resolveOptions("extreme")).sort(), Object.keys(source.defaultOptions).sort());
+
+          function evaluate(code, sandbox) {
+            const logs = [];
+            const scope = Object.assign({ console: { log: (value) => logs.push(String(value)) } }, sandbox);
+            vm.runInNewContext(code, scope, { timeout: 5000 });
+            return logs;
+          }
+
+          const program = [
+            'function label(value) { var suffix = "!"; return value + suffix; }',
+            'var list = [1, 2, 3].map(function (v) { return v * 2; });',
+            'console.log(label("ok"), "emoji \u{1F680}", list.join("-"), 21 * 2);'
+          ].join("\n");
+          const expected = evaluate(program, { TextDecoder, atob, Uint8Array });
+
+          for (const preset of ["off", "low", "medium", "high", "extreme"]) {
+            for (let attempt = 0; attempt < 4; attempt++) {
+              const result = minified.obfuscateWithStats(program, { seed: `${preset}-${attempt}` });
+              assert.equal(result.stats.seed, `${preset}-${attempt}`);
+              assert.deepEqual(result.warnings, [], `${preset}: ${result.warnings.join("; ")}`);
+              // with the fast decoder path available
+              assert.deepEqual(evaluate(result.code, { TextDecoder, atob, Uint8Array }), expected, preset);
+              // and with no globals at all: the decoder must be self-contained
+              assert.deepEqual(evaluate(result.code, {}), expected, `${preset} (bare sandbox)`);
+            }
+          }
+
+          // the readable and the minified build must generate identical output
+          const options = {
+            seed: "determinism", stringEncryption: true, stringSplitting: true,
+            stringArrayDecoys: 4, controlFlowFlattening: true, identifierEscaping: true
+          };
+          assert.equal(minified.obfuscate(program, options), source.obfuscate(program, options));
+
+          // self-defending output runs, and rejects a patched generated function
+          const guarded = minified.obfuscate(program, { seed: 7 });
+          assert.deepEqual(evaluate(guarded, {}), expected, "guarded build produces the right output");
+          const patched = guarded.replace("String.fromCharCode", "String.fromCharCode2");
+          assert.notEqual(patched, guarded, "the decoder did not contain String.fromCharCode, the tamper check is meaningless");
+          assert.throws(() => evaluate(patched, {}), /Unexpected token/);
+
+          console.log("minified build verified:", minified.VERSION);
+          VERIFY
+          node "$RUNNER_TEMP/verify-cloakjs.js"
+
+      - name: Commit the minified file if it changed
+        if: github.event_name == 'push' && github.ref_type == 'branch'
         run: |
           git add -- cloakjs.min.js
           if git diff --cached --quiet; then
-            echo 'Minified file is already up to date.'
+            echo 'cloakjs.min.js is already up to date.'
             exit 0
           fi
           git config user.name 'github-actions[bot]'
           git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          git commit -m 'chore: update minified CloakJS'
-          git push origin "HEAD:${GITHUB_REF}"
+          git commit -m 'chore: rebuild cloakjs.min.js'
+          git push origin "HEAD:${{ github.ref_name }}"
diff --git a/README.md b/README.md
index ebe4f53..fbb334a 100644
--- a/README.md
+++ b/README.md
@@ -1,101 +1,213 @@
-# CloakJS 1.2.0
+# CloakJS 1.3.0
 
 [![MIT License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![GitHub stars](https://img.shields.io/github/stars/Infinitode/CloakJS.svg)](https://github.com/Infinitode/CloakJS/stargazers)
 [![GitHub issues](https://img.shields.io/github/issues/Infinitode/CloakJS.svg)](https://github.com/Infinitode/CloakJS/issues)
 [![jsDelivr monthly downloads](https://data.jsdelivr.com/v1/package/gh/Infinitode/CloakJS/badge?style=rounded)](https://www.jsdelivr.com/package/gh/Infinitode/CloakJS)
 
-CloakJS is a single-file, dependency-free JavaScript obfuscator for the browser and Node.js. It can rename some identifiers, encode strings and numbers, and optionally add a dispatcher and decoy statements. It returns JavaScript source code; it does **not** run the code for you.
+CloakJS is a single-file, dependency-free JavaScript obfuscator for the browser and Node.js. It renames bindings, hides strings behind a generated decoder, rewrites numeric literals, flattens control flow inside function bodies, injects opaque predicates and unreachable decoy code, escapes identifiers, and can add runtime guards. It returns JavaScript source **as a string** — it never executes the code for you.
+
+```html
+<script src="https://cdn.jsdelivr.net/gh/Infinitode/CloakJS@main/cloakjs.min.js"></script>
+<script>
+  const code = CloakJS.obfuscate('console.log("Hello from CloakJS!")', "extreme");
+  console.log(CloakJS.obfuscateWithStats("var n = 21; console.log(n * 2);", "high").stats);
+</script>
+```
 
 > [!IMPORTANT]
-> Obfuscation makes source less readable, **not secure**. Never put secrets, credentials or security-critical checks in client-side JavaScript. CloakJS uses a small lexer rather than a full JavaScript parser; test transformed output in the environment where it will run. It is intended for classic scripts, not ES modules, JSX or TypeScript.
+> **CloakJS is not distributed through npm.** There *is* a package named `cloakjs` on the npm registry, but it is an unrelated AOP/Proxy wrapper library ("a small AOP/Proxy/Wrapper library with a fluent interface", currently 1.0.1, maintained by somebody else) — it is not this project and it does not contain this obfuscator. Do not install that package expecting CloakJS. Grab [`cloakjs.js`](cloakjs.js) or [`cloakjs.min.js`](cloakjs.min.js) from this repository (or from jsDelivr) instead; the library has no dependencies and no package manifest, so there is nothing to resolve and nothing to build.
+
+> [!WARNING]
+> Obfuscation makes source **harder to read, not secure**. It cannot protect secrets, credentials, licence keys or security-critical checks that ship to the client, and it does not resist an analyst who can instrument the running page. Everything CloakJS does is reversible by hand or by tooling. Treat it as a speed bump and a deterrent — never as a security boundary.
+
+## What changed in 1.3.0
+
+- **`extreme` is a real mode now.** In 1.2.0 its options were identical to `high`; it now turns on identifier escaping, codepoint-safe string splitting, decoy string-array entries, maximum flattening and decoy amounts, and a recurring `debugger` trap.
+- **Control-flow flattening reaches inside function bodies** (nested bodies are flattened before the bodies that contain them), with a shuffled `case` layout and decoy cases that can never be selected.
+- **A self-contained decoder.** Generated code no longer depends on `atob`, `Uint8Array` or `TextDecoder`: it ships its own Base64, alphabet-substitution, RC4 and UTF-8 handling and only uses `TextDecoder` as a fast path when the host has one.
+- **Template literals are first class.** Identifiers inside `` `${…}` `` are analysed and renamed, and static templates are encrypted like ordinary strings (tagged templates are left alone).
+- **Much broader, scope-aware mangling.** Parameters (including defaults and rest), `catch` bindings, class names, named function expressions and template substitutions are renamed — but a spelling is only renamed when *every* occurrence lies inside a scope that declares it, so globals owned by other scripts keep working.
+- **New options:** `stringSplitting` (+ `MinLength`, `MaxParts`), `stringArrayShuffle`, `stringArrayDecoys`, `stringEncoding`, `stringAlphabet`, `identifierEscaping`, `preserveFunctionNames`, `controlFlowThreshold`, `deadCodeAmount`, `debugProtection` (+ `Interval`), `wrapInIife`, `disableConsoleOutput`, `compactOutput`, `seed`.
+- **Validated options with types.** A typo like `stringEncrypton` now throws a `TypeError` instead of being silently ignored, and wrong value types are rejected before anything runs.
+- **Reproducible output** via `seed`, richer `stats` (including the `techniques` that were actually applied) and clearer `warnings`.
 
 ## Getting started
 
-Download [`cloakjs.js`](cloakjs.js) (readable) or [`cloakjs.min.js`](cloakjs.min.js) (minified), or load either from [jsDelivr](https://www.jsdelivr.com/package/gh/Infinitode/CloakJS) after the files are available on the repository's `main` branch:
+Download [`cloakjs.js`](cloakjs.js) (readable) or [`cloakjs.min.js`](cloakjs.min.js) (minified), or load either from [jsDelivr](https://www.jsdelivr.com/package/gh/Infinitode/CloakJS):
 
 ```html
-<!-- Production: minified version -->
+<!-- Minified build -->
 <script src="https://cdn.jsdelivr.net/gh/Infinitode/CloakJS@main/cloakjs.min.js"></script>
-<!-- For development, use https://cdn.jsdelivr.net/gh/Infinitode/CloakJS@main/cloakjs.js instead. -->
-<script>
-  const code = CloakJS.obfuscate('console.log("Hello from CloakJS!")', 'medium');
-  console.log(code); // JavaScript source as a string
-</script>
+<!-- Development: use .../cloakjs.js instead -->
 ```
 
-For reproducible deployments, replace `@main` with a published tag or commit hash (once available). The minified file is generated from `cloakjs.js` with Terser; there is no npm release to install. The badge above displays jsDelivr's live download information rather than a hard-coded count and may not show data until the files have been published on `main`.
+For reproducible deployments, replace `@main` with a tag or commit hash from this repository. The minified file is generated from `cloakjs.js` with Terser; there is no npm release. The badge above shows jsDelivr's live download information rather than a hard-coded count.
 
-In Node.js (modern Node with `atob`, `TextEncoder` and `TextDecoder`):
+In Node.js (any modern Node, no extra packages):
 
 ```js
-const CloakJS = require('./cloakjs.js');
-const result = CloakJS.obfuscateWithStats('console.log("hello")', 'high');
-console.log(result.code);
-console.log(result.stats, result.warnings);
+const CloakJS = require("./cloakjs.js");
+
+const result = CloakJS.obfuscateWithStats('const who = "world"; console.log(`hi ${who}`);', "extreme");
+console.log(result.code);      // obfuscated source, as a string
+console.log(result.stats);     // what the pipeline actually applied
+console.log(result.warnings);  // anything it refused to do — check these
+
+// reproducible output while you are building a pipeline
+const first = CloakJS.obfuscate("var a = 1; console.log(a);", { seed: "build-42" });
 ```
 
-The file is UMD: it also works as an AMD module, or as the global `CloakJS` in a normal `<script>` tag. The **generated** script needs `atob`, `Uint8Array` and `TextDecoder` when string encryption is enabled. If those APIs are unavailable, disable `stringEncryption` or provide polyfills.
+The file is UMD: it works as the global `CloakJS` in a `<script>` tag, as an AMD module, and as a CommonJS module. The **obfuscated** script it produces is self-contained — the generated decoder implements its own Base64, alphabet substitution, RC4 and UTF-8 handling, so it runs in a bare sandbox with no globals, polyfills or helper files (it will use `TextDecoder`/`Uint8Array` when the host provides them).
 
 ## API
 
 | Method / property | Description |
 | --- | --- |
 | `CloakJS.obfuscate(source, options?)` | Return the obfuscated JavaScript **string**. |
-| `CloakJS.obfuscateWithStats(source, options?)` | Return `{ code, stats, warnings }`. Check warnings before using the result. |
-| `CloakJS.measure(source, options?)` | Return `{ originalBytes, obfuscatedBytes, ratio }` (generates a fresh randomized output). |
-| `CloakJS.resolveOptions(options?)` | Return a copy of the chosen preset or defaults merged with your options. |
-| `CloakJS.presets`, `CloakJS.defaultOptions` | Available presets and default settings. |
+| `CloakJS.obfuscateWithStats(source, options?)` | Return `{ code, stats, warnings }`. Check `warnings` before shipping. |
+| `CloakJS.measure(source, options?)` | Return `{ originalBytes, obfuscatedBytes, ratio }` for a fresh randomized output. |
+| `CloakJS.resolveOptions(options?)` | Return a validated copy of a preset or of the defaults merged with your options. |
+| `CloakJS.presets`, `CloakJS.defaultOptions` | Available presets and default settings (every preset defines every key). |
+| `CloakJS.techniques` | Metadata for every transform: `key`, `name`, `summary`, `changesBehavior`. |
 | `CloakJS.NAME`, `CloakJS.VERSION`, `CloakJS.BANNER` | Metadata. |
 
-`source` must be a string. `options` can be a preset name (`'off'`, `'low'`, `'medium'`, `'high'`, `'extreme'`), an options object, or omitted (defaults to the high settings). Unknown preset names throw an error. Output is randomized and may differ from call to call; `measure` will not necessarily describe a previous `obfuscate` result.
-
-The `stats` object contains `identifiersRenamed`, `stringsEncrypted`, `numbersEncoded`, `deadCodeBlocks`, `originalBytes`, `obfuscatedBytes`, and `ratio` (output bytes divided by input bytes). A ratio **greater than 1** means the output grew. The byte counts use UTF-8. `warnings` reports a skipped control-flow pass or a generated-script parse error; it does not guarantee behavioral equivalence.
+`source` must be a string. `options` may be a preset name (`'off'`, `'low'`, `'medium'`, `'high'`, `'extreme'`), an options object, or omitted (defaults to the `high` settings). Unknown preset names, unknown option names and wrong option types throw, so a typo like `stringEncrypton` fails loudly instead of silently doing nothing.
 
-### Presets
+Output is randomized and differs between calls; pass a `seed` when you need reproducible builds. `measure` generates its own random sample, so it does not necessarily describe a previous `obfuscate` result.
 
-| Preset | Identifier mangling | String encryption | Number encoding | Control flow | Dead code | Self-defending prelude |
-| --- | :---: | :---: | :---: | :---: | :---: | :---: |
-| `off` | No | No | No | No | No | No |
-| `low` | Yes | No | No | No | No | No |
-| `medium` | Yes | Yes | Yes | No | No | No |
-| `high` | Yes | Yes | Yes | Yes | Yes | Yes |
-| `extreme` | Yes | Yes | Yes | Yes | Yes | Yes |
+### `stats`
 
-`high` and `extreme` currently have the **same settings**. Every preset enables `compactOutput`. The default options are the high settings. A custom object overrides only the keys you supply:
+| Field | Meaning |
+| --- | --- |
+| `identifiersRenamed` | Distinct spellings that were renamed. |
+| `identifiersEscaped` | Identifier occurrences rewritten with `\uXXXX` escapes. |
+| `stringsEncrypted` | String literals (and static template literals) moved into the encoded array. |
+| `stringsSplit` | Strings that were split into concatenated chunks. |
+| `stringArrayEntries` | Entries in the emitted string array, including decoys. |
+| `numbersEncoded` | Numeric literals that were rewritten as expressions. |
+| `controlFlowBlocks` | `switch` dispatchers that were generated. |
+| `deadCodeBlocks` | Unreachable decoy blocks that were inserted. |
+| `opaquePredicates` | Opaque conditions that were generated. |
+| `originalBytes`, `obfuscatedBytes`, `ratio` | UTF-8 byte counts; `ratio` is output ÷ input, so anything above 1 means the output grew. |
+| `techniques` | The technique keys that were actually applied to this input. |
+| `seed` | The seed that was used, or `null`. |
+
+`warnings` reports things CloakJS deliberately skipped: `eval()`/`with()` (dynamic scope makes renaming unsafe), `new Function("…")` built from a string, module syntax, or an output that failed the internal parse check. It never guarantees behavioural equivalence — test the generated code yourself.
+
+## Presets
+
+| Preset | Identifier mangling | Identifier escaping | String array | String splitting / decoys | Number encoding | Control flow flattening | Dead code + opaque predicates | Self-defending | Debug protection | Console silencing | IIFE wrapper |
+| --- | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
+| `off` | – | – | – | – | – | – | – | – | – | – | – |
+| `low` | yes | – | – | – | – | – | – | – | – | – | – |
+| `medium` | yes | – | Base64, ordered | – | yes | – | – | – | – | – | – |
+| `high` | yes | – | RC4 + shuffled alphabet | – | yes | yes | yes | yes | – | – | – |
+| `extreme` | yes | yes | RC4 + shuffled alphabet | yes | yes | yes (maximum) | yes (maximum) | yes | yes | – | – |
+
+`extreme` is a genuine mode, not a relabelled `high`: compared to `high` it turns on identifier escaping, string splitting (down to 6-character chunks, up to 5 parts), six decoy entries per string array, the maximum decoy amount, and an anti-debugging timer. `disableConsoleOutput` and `wrapInIife` change observable behaviour, so they are options that no preset enables.
+
+Every preset enables `compactOutput`. A partial options object overrides only the keys you supply:
 
 ```js
 const result = CloakJS.obfuscateWithStats(
-  'var message = "hi"; console.log(message);',
-  { stringEncryption: false, controlFlowFlattening: false }
+  'var message = "hi"; for (var i = 0; i < 2; i++) { console.log(message, i); }',
+  { identifierMangling: false, controlFlowFlattening: false, stringArrayDecoys: 12 }
 );
 if (result.warnings.length) console.warn(result.warnings);
-console.log(result.code);
+console.log(result.code, result.stats.techniques);
 ```
 
-### Options and limitations
+## Options
+
+| Option | Type | Default (`high`) | What it does |
+| --- | --- | --- | --- |
+| `identifierMangling` | boolean | `true` | Renames declared bindings whose occurrences provably stay inside a scope that declares them. |
+| `identifierEscaping` | boolean | `false` (`true` in `extreme`) | Rewrites identifiers with `\uXXXX` escapes, e.g. `_0x1a2b` becomes `_\u0030\u0078\u0031a2b`; the escapes parse to the same name. |
+| `preserveFunctionNames` | boolean | `false` | Keeps function and class names, so `Function#name` and `constructor.name` stay readable. |
+| `stringEncryption` | boolean | `true` | Moves strings into an encoded array read through a generated decoder. |
+| `stringEncoding` | `"base64"` \| `"rc4"` | `"rc4"` | Cipher applied to each payload. |
+| `stringAlphabet` | `"standard"` \| `"shuffled"` | `"shuffled"` | Base64 alphabet substitution for the array, with optional reversal of each entry. |
+| `stringArrayShuffle` | boolean | `true` | Shuffles array entries and adds an index map, so positions leak nothing. |
+| `stringArrayDecoys` | count | `0` (`6` in `extreme`) | Adds unused, well-formed entries to the string array. |
+| `stringSplitting` | boolean | `false` (`true` in `extreme`) | Splits strings into codepoint-safe chunks that are decoded separately and concatenated. |
+| `stringSplitMinLength` | count | `8` (`6` in `extreme`) | Shortest string that may be split. |
+| `stringSplitMaxParts` | count | `4` (`5` in `extreme`) | Upper bound on chunks per string. |
+| `numberEncoding` | boolean | `true` | Rewrites numeric literals as hex, binary, octal, bitwise, arithmetic or scaled expressions. |
+| `controlFlowFlattening` | boolean | `true` | Moves statement runs into a shuffled `switch` dispatcher, inside function bodies as well as at the top level. |
+| `controlFlowThreshold` | ratio | `1` | Probability of flattening each eligible statement run (`0` disables it, `1` flattens all of them). |
+| `deadCodeInjection` | boolean | `true` | Inserts unreachable decoy blocks, including dispatcher cases that can never be selected. |
+| `deadCodeAmount` | count | `3` (`6` in `extreme`) | Rough number of decoy statements per inserted block. |
+| `opaquePredicates` | boolean | `true` | Generates conditions whose value is computed at obfuscation time and used as guards. |
+| `selfDefending` | boolean | `true` | Adds a prelude that hashes generated functions and throws if they were patched. |
+| `debugProtection` | boolean | `false` (`true` in `extreme`) | Installs a recurring `debugger` trap through a guarded `setInterval`. |
+| `debugProtectionInterval` | count (ms) | `4000` (`2500` in `extreme`) | Timer period for the trap. |
+| `disableConsoleOutput` | boolean | `false` | Replaces `console.log` and friends with no-ops before the payload runs. |
+| `wrapInIife` | boolean | `false` | Wraps the program in `(function(){ … })();` so top-level declarations stay private. |
+| `compactOutput` | boolean | `true` | Collapses blank lines and indentation. Token-aware, so string and template bodies are never touched. Not a minifier. |
+| `seed` | string \| number \| null | `null` | Seeds the generator for reproducible output. |
+
+## Techniques
+
+- **Identifier mangling** collects bindings from `var`/`let`/`const`, function declarations, named function expressions, parameter lists (including defaults and rest parameters), `catch (…)` clauses and class names. A spelling is renamed only when *every* occurrence lies inside a scope that declares it, which keeps references to globals defined in other scripts working. Property names, object keys and shorthand properties, method and field names, labels, destructuring patterns, module bindings and anything reachable dynamically (`eval`, `with`, string keys such as `obj["name"]`) are left alone. Template substitutions *are* analysed, so `` `${count}` `` is renamed with the rest of the code.
+- **Identifier escaping** writes identifiers with unicode escapes. Escapes normalise to the same name, so behaviour is unchanged, but the source stops matching grep patterns.
+- **String encryption** evaluates each eligible literal, encodes its UTF-8 bytes (RC4 with a random per-run key, then Base64), optionally substitutes a shuffled Base64 alphabet and reverses the entry, and stores it in an array that the generated decoder reads through a shuffled index map. Call sites look like `_0x1f3(0x2,41)`, sometimes with decoy arguments. Static template literals are treated like ordinary strings; tagged templates are skipped. Directive prologues, object keys, `case` labels, method names and `import`/`export` specifiers are skipped too.
+- **String splitting** breaks long strings into codepoint-safe chunks (never inside an emoji or surrogate pair). With encryption on, each chunk becomes its own array entry and the call site becomes a concatenation, so no array entry holds a complete string.
+- **Number encoding** rewrites literals as hex, binary, octal, XOR/OR masks, shifts, `~`, sums, products with remainder, or exact power-of-two scaling. Single-digit literals, BigInts and `Infinity`/`NaN` are left as they are, and floats are only scaled by powers of two so their values stay bit-exact.
+- **Control flow flattening** splits each region (a function body or the top level) into statements and moves runs of statements that cannot change hoisting, scoping or jump targets into `switch` clauses with random labels. Case clauses are emitted in a shuffled layout while a sequence array preserves execution order, and decoy cases are never selected. Declarations (`var`/`let`/`const`/`function`/`class`), `do…while` bodies, `else`/`catch`/`finally` continuations and the final top-level statement stay outside the dispatcher, and nested function bodies are flattened before their enclosing bodies.
+- **Opaque predicates** are expressions whose value is evaluated at obfuscation time and verified with `Function`, so a guard that should be true always is. They wrap statements, dispatchers and dead branches.
+- **Dead code injection** adds unreachable blocks that reference real runtime pieces (loops, local helper functions, decoy decoder lookups, array operations) so they cannot be dismissed by pattern alone. Injection points are only chosen after a `;` whose neighbours are not `else`/`while`/`catch`/`finally`, and never in a position that would change the script's completion value.
+- **Self-defending prelude** hashes the source text of generated functions through `Function.prototype.toString()` and throws `Error("Unexpected token")` when the text no longer matches — including when a patched `toString` returns `[native code]`. The hash ignores whitespace, so re-indenting the output still runs, but renaming or patching a generated function does not. It covers the generated decoder and its own probe function; it does **not** detect an attacker who disables the check itself.
+- **Debug protection** installs `setInterval(function(){ … debugger … }, interval)`, guarded by `typeof setInterval`, and calls `.unref()` when the handle supports it so Node.js processes can still exit.
+- **Console silencing** and **IIFE wrapping** are opt-in behaviour changes, described in the tables above.
+
+## Behaviour changes and limitations
+
+Read this section before shipping obfuscated output.
+
+| Situation | What happens |
+| --- | --- |
+| Code reads `someFunction.name` or `this.constructor.name` | Mangling renames functions and classes, so those strings change. Set `preserveFunctionNames: true` to keep them. |
+| Bindings that are part of a public API | Mangling renames top-level declarations too. Disable `identifierMangling` (or use `low` and check) when other scripts refer to them by name. |
+| Property access through strings, e.g. `obj["count"]` | Every spelling that appears as a property name, object key or string key is left untouched, so such code keeps working. |
+| `eval()`, `with()`, `new Function("… " + someLocal)` | Mangling and escaping are skipped automatically and a warning is added; the other transforms still run. |
+| `import` / `export` | Module syntax is detected and mangling is skipped with a warning, because `new Function` (the internal parse check) only accepts scripts. Strings in `from` clauses are untouched. |
+| Output is minified after obfuscation | `selfDefending` throws, because a minifier renames or rewrites the generated functions. Pure re-indentation (whitespace only) is tolerated. Disable `selfDefending` if the output goes through Terser/esbuild/webpack again, or obfuscate *after* minifying. |
+| Script completion value | The last top-level statement is never moved, wrapped or followed by decoy code, so the value a script evaluates to is preserved — except with `wrapInIife`, which makes it `undefined`. |
+| `debugProtection` in Node.js | A repeating timer is installed. It is unref'ed when possible so the process can still exit, but code that observes timers will see it. |
+| `disableConsoleOutput` | All common `console` methods become no-ops for the whole page/process, not just for your code. |
+| `wrapInIife` | Top-level `var`/`function` declarations and top-level `this` stop leaking to the global object, and the completion value becomes `undefined`. |
+| Strict mode | A leading `"use strict";` directive is kept in front of all generated code, and moved inside the IIFE when `wrapInIife` is used. |
+| Heavily minified input | CloakJS is a lexer, not a parser. It preserves anything it does not explicitly rewrite and skips statements it cannot prove safe, but always test the generated code. |
+| Size | Dead code, decoys, flattening and the decoder all add bytes. On a multi-kilobyte file expect roughly 1.0× (`low`), 1.2× (`medium`), 2–4× (`high`) and 4–8× (`extreme`). Small snippets grow much more, because the generated decoder is a fixed cost that does not shrink with the input. |
+
+CloakJS uses a conservative lexer rather than a full JavaScript parser: it understands strings, template literals (including nested substitutions), regular expressions, comments, ASI-sensitive statement splitting, destructuring, classes including private fields, generators and async functions well enough to avoid touching what it cannot reason about. It does not support JSX, TypeScript, decorators or stage-3 syntax, which may end up only partially obfuscated. Every generated output is checked with `new Function`, and a syntax error is reported through `warnings` instead of being hidden. If you need production-grade semantic guarantees, use a parser-based tool and review its output too.
+
+### What this does *not* do
+
+- It does not encrypt anything with a key the client does not have. The RC4 key, the alphabet and the decoder all ship with the output.
+- It does not stop runtime inspection: patching the decoder, dumping the string array or attaching a debugger all still work.
+- It does not protect secrets. If a value must stay secret, it must not be sent to the client.
+
+## Testing and contributing
 
-- `identifierMangling`: renames selected declared identifiers when the lexer does not find a property/shorthand use. It can change externally visible names; do not use it on code whose bindings are part of a public API.
-- `stringEncryption`: stores eligible string literals as RC4-encoded UTF-8 bytes in a Base64 array and injects a runtime decoder. This is **obfuscation, not cryptographic protection**. Templates are left untouched, and some strings (such as object keys and directives) are skipped.
-- `numberEncoding`: rewrites some numeric literals as arithmetic or hexadecimal expressions. Small literals, BigInts and non-finite values are not rewritten.
-- `controlFlowFlattening`: uses a switch dispatcher only for a limited set of top-level expression statements. It skips statements that might change scope or behavior and reports this in `warnings`.
-- `deadCodeInjection`: adds unreachable decoy statements; this increases output size.
-- `selfDefending`: inserts an isolated prelude. It does **not** prevent debugging or tampering and does not freeze or alter host objects.
-- `compactOutput`: removes empty lines and trims whitespace; this is not a minifier.
+Run the dependency-free Node test suite (no fixtures, no network):
 
-The transform is intentionally conservative in some places, but no textual/lexer-based transform can understand all JavaScript grammar, scopes, dynamic access, template expressions, regex/division ambiguity or automatic semicolon insertion. It may reject valid module syntax in the parse check (`new Function` only accepts scripts), or produce code that parses but behaves differently. Always run your own tests against the **generated** code, especially for complex syntax, strict mode, imports, public globals and code that uses `eval`/`with`. If you need production-grade semantic preservation, use a parser-based tool instead.
+```sh
+node --test
+```
 
-## Testing and contributing
+The suite compares the behaviour of the original and the obfuscated program for every preset and for a matrix of option combinations, so a change that alters program semantics fails the run.
 
-Run the dependency-free Node test suite with `node --test`. To regenerate the minified file locally (build tool only; the library itself has no dependencies):
+To regenerate the minified file locally, fetch Terser as a temporary build tool (the library itself has no dependencies and needs no manifest):
 
 ```sh
 npm exec --yes --package=terser@5.44.0 -- terser cloakjs.js --compress --mangle --comments '/^!/' --output cloakjs.min.js
 ```
 
-On pushes that change `cloakjs.js`, [the Ubuntu GitHub Actions workflow](.github/workflows/minify.yml) runs the tests, regenerates `cloakjs.min.js`, verifies it, and commits/pushes the file back to **the same branch** only if it changed. The workflow needs Actions to have permission to write repository contents; branch protection rules may prevent an automated push. Its generated-file-only commit does not retrigger the workflow because the trigger is limited to `cloakjs.js`.
+On pushes that change `cloakjs.js` or the test suite, [the Ubuntu GitHub Actions workflow](.github/workflows/minify.yml) runs the tests, regenerates `cloakjs.min.js`, verifies that the minified build reproduces the readable build's output for the same seed (in both a full sandbox and a bare one), and commits the file back to **the same branch** only if it changed. The workflow needs Actions to have permission to write repository contents; branch protection rules may prevent an automated push.
 
-Contributions and bug reports are welcome via [GitHub issues](https://github.com/Infinitode/CloakJS/issues) and pull requests; include a small input/output reproduction and runtime details when reporting a transform bug.
+Contributions and bug reports are welcome via [GitHub issues](https://github.com/Infinitode/CloakJS/issues) and pull requests. When reporting a transform bug, include the input snippet, the preset/options, the warning list and the observed output — that is usually enough to reproduce it.
 
 ## License
 
diff --git a/cloakjs.js b/cloakjs.js
index 9922cd4..5b33b64 100644
--- a/cloakjs.js
+++ b/cloakjs.js
@@ -1,9 +1,15 @@
 /*!
- * CloakJS v1.2.0 — JavaScript Obfuscator
+ * CloakJS v1.3.0 — JavaScript Obfuscator
  * https://github.com/Infinitode/CloakJS
  *
  * A single-file, dependency-free JavaScript obfuscator for browsers and Node.
- * Load with a <script> tag to register global CloakJS, or require() in Node.
+ * Load with a <script> tag to register the global CloakJS, or require() it in Node.
+ *
+ * NOTE: CloakJS is NOT published on npm. There is a package named "cloakjs" on
+ * the npm registry, but it is an unrelated AOP/Proxy library maintained by
+ * someone else and installing that name does not give you this tool. Copy this
+ * file straight from the repository or from jsDelivr — see README.md.
+ *
  * MIT License — see LICENSE.
  */
 (function (global, factory) {
@@ -17,155 +23,506 @@
 })(typeof self !== "undefined" ? self : this, function () {
   "use strict";
 
-  var VERSION = "1.2.0";
+  /* =========================================================================
+   * 0. Metadata
+   * ====================================================================== */
   var NAME = "CloakJS";
+  var VERSION = "1.3.0";
   var BANNER = NAME + " v" + VERSION + " — JavaScript obfuscator · MIT License";
   var HEX = "0123456789abcdef";
+  var B64_STANDARD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
-  var RESERVED = [
-    "__RESULT__", "__done",
-    "break", "case", "catch", "class", "const", "continue", "debugger",
-    "default", "delete", "do", "else", "enum", "export", "extends", "false",
-    "finally", "for", "function", "if", "import", "in", "instanceof", "new",
-    "null", "return", "super", "switch", "this", "throw", "true", "try",
-    "typeof", "var", "void", "while", "with", "yield", "let", "static",
-    "await", "async", "of", "as", "from",
-    "window", "document", "console", "globalThis", "Math", "Object", "Array",
-    "String", "Number", "Boolean", "JSON", "Date", "RegExp", "Error",
-    "Promise", "Map", "Set", "WeakMap", "WeakSet", "Symbol", "Reflect",
-    "Proxy", "Function", "arguments", "undefined", "Infinity", "NaN",
-    "parseInt", "parseFloat", "isNaN", "isFinite", "encodeURIComponent",
-    "decodeURIComponent", "encodeURI", "decodeURI", "eval", "setTimeout",
-    "setInterval", "clearTimeout", "clearInterval", "require", "module",
-    "exports", "__dirname", "__filename", "process"
-  ];
-  var RESERVED_SET = Object.create(null);
-  for (var _ri = 0; _ri < RESERVED.length; _ri++) RESERVED_SET[RESERVED[_ri]] = true;
+  /* =========================================================================
+   * 1. Randomness (optionally seeded for reproducible output)
+   * ====================================================================== */
+  var random = Math.random;
+
+  function seedRandom(seed) {
+    if (seed === null || seed === undefined) {
+      random = Math.random;
+      return;
+    }
+    var text = String(seed), hash = 2166136261 >>> 0, i;
+    for (i = 0; i < text.length; i++) {
+      hash ^= text.charCodeAt(i);
+      hash = Math.imul(hash, 16777619) >>> 0;
+    }
+    var state = hash === 0 ? 0x9e3779b9 : hash;
+    random = function () {
+      state ^= state << 13; state >>>= 0;
+      state ^= state >>> 17;
+      state ^= state << 5; state >>>= 0;
+      return state / 4294967296;
+    };
+  }
+
+  function randInt(max) { return Math.floor(random() * max); }
+  function chance(probability) { return random() < probability; }
+  function pick(list) { return list[randInt(list.length)]; }
+  function shuffle(list) {
+    for (var i = list.length - 1; i > 0; i--) {
+      var j = randInt(i + 1), tmp = list[i];
+      list[i] = list[j];
+      list[j] = tmp;
+    }
+    return list;
+  }
 
+  /* =========================================================================
+   * 2. Identifier vocabulary
+   * ====================================================================== */
+  var KEYWORDS = [
+    "arguments", "as", "async", "await", "break", "case", "catch", "class",
+    "const", "continue", "debugger", "default", "delete", "do", "else", "enum",
+    "eval", "export", "extends", "false", "finally", "for", "from", "function",
+    "get", "if", "implements", "import", "in", "instanceof", "interface", "let",
+    "new", "null", "of", "package", "private", "protected", "public", "return",
+    "set", "static", "super", "switch", "this", "throw", "true", "try", "typeof",
+    "undefined", "var", "void", "while", "with", "yield"
+  ];
+  var GLOBALS = [
+    "window", "document", "console", "globalThis", "self", "global", "module",
+    "exports", "require", "process", "__dirname", "__filename", "Math", "Object",
+    "Array", "String", "Number", "Boolean", "JSON", "Date", "RegExp", "Error",
+    "TypeError", "RangeError", "SyntaxError", "EvalError", "Promise", "Map",
+    "Set", "WeakMap", "WeakSet", "Symbol", "Reflect", "Proxy", "Function",
+    "Infinity", "NaN", "isNaN", "isFinite", "parseInt", "parseFloat",
+    "encodeURIComponent", "decodeURIComponent", "encodeURI", "decodeURI",
+    "setTimeout", "setInterval", "clearTimeout", "clearInterval",
+    "requestAnimationFrame", "atob", "btoa", "TextEncoder", "TextDecoder",
+    "Uint8Array", "Uint16Array", "Uint32Array", "Int8Array", "Int16Array",
+    "Int32Array", "Float32Array", "Float64Array", "BigInt", "ArrayBuffer",
+    "SharedArrayBuffer", "DataView", "Intl", "navigator", "location", "history",
+    "fetch", "XMLHttpRequest", "URL", "Blob", "File", "FileReader", "FormData",
+    "Headers", "Request", "Response", "localStorage", "sessionStorage",
+    "structuredClone", "queueMicrotask", "performance"
+  ];
+  // Helper spellings emitted by previous CloakJS releases stay reserved so that
+  // output never clashes with code that was obfuscated by an older version.
   var INTERNAL = [
     "_0xa", "_0xdc", "_0xord", "_0xst", "_0xbt", "_0xba", "_0xbi", "_0xb1",
     "_0xbn", "_0xbs", "_0xh", "_0xs", "_0xo", "_0xr", "_0xj", "_0xii",
     "_0xl", "_0xk", "_0xt", "_0xv", "_0xpi", "_0xd", "_0xsd", "_0xf",
     "_0xi", "_0xd1", "_0xd2", "_0xd4", "_0xd5", "_0xd6", "_0x9a", "_0xb", "_0xe"
   ];
+  var RESERVED_SET = Object.create(null);
   var INTERNAL_SET = Object.create(null);
-  for (var _ii = 0; _ii < INTERNAL.length; _ii++) INTERNAL_SET[INTERNAL[_ii]] = true;
-
-  var defaultOptions = {
-    identifierMangling: true,
-    stringEncryption: true,
-    numberEncoding: true,
-    controlFlowFlattening: true,
-    deadCodeInjection: true,
-    selfDefending: true,
-    compactOutput: true
-  };
-  var presets = {
-    off: { identifierMangling: false, stringEncryption: false, numberEncoding: false, controlFlowFlattening: false, deadCodeInjection: false, selfDefending: false, compactOutput: true },
-    low: { identifierMangling: true, stringEncryption: false, numberEncoding: false, controlFlowFlattening: false, deadCodeInjection: false, selfDefending: false, compactOutput: true },
-    medium: { identifierMangling: true, stringEncryption: true, numberEncoding: true, controlFlowFlattening: false, deadCodeInjection: false, selfDefending: false, compactOutput: true },
-    high: { identifierMangling: true, stringEncryption: true, numberEncoding: true, controlFlowFlattening: true, deadCodeInjection: true, selfDefending: true, compactOutput: true },
-    extreme: { identifierMangling: true, stringEncryption: true, numberEncoding: true, controlFlowFlattening: true, deadCodeInjection: true, selfDefending: true, compactOutput: true }
-  };
+  (function () {
+    var all = KEYWORDS.concat(GLOBALS).concat(INTERNAL), i;
+    for (i = 0; i < all.length; i++) RESERVED_SET[all[i]] = true;
+    for (i = 0; i < INTERNAL.length; i++) INTERNAL_SET[INTERNAL[i]] = true;
+  })();
+  var KEYWORD_SET = Object.create(null);
+  for (var _ki = 0; _ki < KEYWORDS.length; _ki++) KEYWORD_SET[KEYWORDS[_ki]] = true;
 
-  function randInt(max) { return Math.floor(Math.random() * max); }
   function randomHexName(len) {
-    var s = "_0x";
-    for (var i = 0; i < len; i++) s += HEX[randInt(16)];
-    return s;
+    var out = randInt(2) === 0 ? "_0x" : "_$_";
+    for (var i = 0; i < len; i++) out += HEX[randInt(16)];
+    return out;
   }
   function randomUnicodeName(len) {
-    var s = "_";
-    for (var i = 0; i < len; i++) s += String.fromCharCode(0x4e00 + randInt(0x9fff - 0x4e00));
-    return s;
+    var out = "_";
+    for (var i = 0; i < len; i++) out += String.fromCharCode(0x4e00 + randInt(0x9fa5 - 0x4e00));
+    return out;
   }
-  function pickName(pool, existing, len) {
+  function randomMixedName(len) {
+    var out = "_";
+    for (var i = 0; i < len; i++) {
+      out += randInt(2) === 0 ? HEX[randInt(16)] : String.fromCharCode(0x4e00 + randInt(0x9fa5 - 0x4e00));
+    }
+    return out;
+  }
+
+  // Guarantees that generated names are unique, are not reserved words/globals
+  // and never collide with anything that already appears in the input.
+  function NamePool() { this.used = Object.create(null); }
+  NamePool.prototype.add = function (name) {
+    if (typeof name === "string" && name) this.used[name] = true;
+    return name;
+  };
+  NamePool.prototype.name = function (len) {
     len = len || 8;
-    var name, tries = 0;
+    var name, tries = 0, style;
     do {
-      name = randInt(2) === 0 ? randomHexName(len) : randomUnicodeName(len);
+      style = randInt(3);
+      name = style === 0 ? randomHexName(len)
+        : style === 1 ? randomUnicodeName(Math.max(2, len - 4))
+          : randomMixedName(len);
       if (++tries > 64) { len++; tries = 0; }
-    } while (pool[name] || RESERVED_SET[name] || existing[name] || INTERNAL_SET[name]);
-    pool[name] = true;
+    } while (this.used[name] || RESERVED_SET[name]);
+    this.used[name] = true;
     return name;
+  };
+
+  /* =========================================================================
+   * 3. Options, presets and validation
+   * ====================================================================== */
+  var optionSchema = {
+    identifierMangling: "boolean",
+    identifierEscaping: "boolean",
+    preserveFunctionNames: "boolean",
+    stringEncryption: "boolean",
+    stringEncoding: ["base64", "rc4"],
+    stringAlphabet: ["standard", "shuffled"],
+    stringArrayShuffle: "boolean",
+    stringArrayDecoys: "count",
+    stringSplitting: "boolean",
+    stringSplitMinLength: "count",
+    stringSplitMaxParts: "count",
+    numberEncoding: "boolean",
+    controlFlowFlattening: "boolean",
+    controlFlowThreshold: "ratio",
+    deadCodeInjection: "boolean",
+    deadCodeAmount: "count",
+    opaquePredicates: "boolean",
+    selfDefending: "boolean",
+    debugProtection: "boolean",
+    debugProtectionInterval: "count",
+    disableConsoleOutput: "boolean",
+    wrapInIife: "boolean",
+    compactOutput: "boolean",
+    seed: "seed"
+  };
+
+  function baseOptions() {
+    return {
+      identifierMangling: true,
+      identifierEscaping: false,
+      preserveFunctionNames: false,
+      stringEncryption: true,
+      stringEncoding: "rc4",
+      stringAlphabet: "shuffled",
+      stringArrayShuffle: true,
+      stringArrayDecoys: 0,
+      stringSplitting: false,
+      stringSplitMinLength: 8,
+      stringSplitMaxParts: 4,
+      numberEncoding: true,
+      controlFlowFlattening: true,
+      controlFlowThreshold: 1,
+      deadCodeInjection: true,
+      deadCodeAmount: 3,
+      opaquePredicates: true,
+      selfDefending: true,
+      debugProtection: false,
+      debugProtectionInterval: 4000,
+      disableConsoleOutput: false,
+      wrapInIife: false,
+      compactOutput: true,
+      seed: null
+    };
   }
-  function byteLength(s) {
-    if (typeof TextEncoder !== "undefined") return new TextEncoder().encode(s).length;
-    // UTF-8 length without relying on Node's Buffer.
-    return unescape(encodeURIComponent(s)).length;
+  function makePreset(overrides) {
+    var options = baseOptions();
+    for (var key in overrides) {
+      if (Object.prototype.hasOwnProperty.call(overrides, key)) options[key] = overrides[key];
+    }
+    return options;
   }
-  function toBase64(s) {
-    var hex = "";
-    for (var i = 0; i < s.length; i++) hex += ("0" + s.charCodeAt(i).toString(16)).slice(-2);
-    return base64Encode(hex);
+
+  var presets = {
+    // The source is returned untouched (only surrounding whitespace is trimmed).
+    off: makePreset({
+      identifierMangling: false, stringEncryption: false, numberEncoding: false,
+      controlFlowFlattening: false, deadCodeInjection: false, opaquePredicates: false,
+      selfDefending: false
+    }),
+    // Renames provably local bindings only. Cheap and very safe.
+    low: makePreset({
+      stringEncryption: false, numberEncoding: false, controlFlowFlattening: false,
+      deadCodeInjection: false, opaquePredicates: false, selfDefending: false
+    }),
+    // Adds encoded numbers and a Base64 string array with a runtime decoder.
+    medium: makePreset({
+      stringEncoding: "base64", stringAlphabet: "standard", stringArrayShuffle: false,
+      controlFlowFlattening: false, deadCodeInjection: false, opaquePredicates: false,
+      selfDefending: false
+    }),
+    // Everything that does not change observable behaviour, at default strength.
+    high: makePreset({}),
+    // Maximum strength: escaped identifiers, split strings, decoy array entries,
+    // RC4 + shuffled alphabet, maximum flattening/decoys and a debugger trap.
+    extreme: makePreset({
+      identifierEscaping: true,
+      stringSplitting: true,
+      stringSplitMinLength: 6,
+      stringSplitMaxParts: 5,
+      stringArrayDecoys: 6,
+      controlFlowThreshold: 1,
+      deadCodeAmount: 6,
+      debugProtection: true,
+      debugProtectionInterval: 2500
+    })
+  };
+
+  var defaultOptions = makePreset({});
+
+  function describeOption(key) {
+    var type = optionSchema[key];
+    if (type === "boolean") return "must be true or false";
+    if (type === "count") return "must be a non-negative integer";
+    if (type === "ratio") return "must be a number between 0 and 1";
+    if (type === "seed") return "must be a string, a number or null";
+    if (Array.isArray(type)) return "must be one of: " + type.join(", ");
+    return "is not a known option";
   }
-  // Works in browsers and in older Node versions without btoa.
-  function base64Encode(s) {
-    if (typeof btoa === "function") return btoa(s);
-    if (typeof Buffer !== "undefined") return Buffer.from(s, "latin1").toString("base64");
-    throw new Error("CloakJS: Base64 encoding is unavailable");
+  function checkOption(key, value) {
+    var type = optionSchema[key];
+    if (type === undefined) throw new TypeError(NAME + ": unknown option \"" + key + "\"");
+    if (type === "boolean") {
+      if (typeof value !== "boolean") throw new TypeError(NAME + ": option \"" + key + "\" " + describeOption(key));
+      return;
+    }
+    if (type === "count") {
+      if (typeof value !== "number" || !isFinite(value) || value < 0 || Math.floor(value) !== value) {
+        throw new TypeError(NAME + ": option \"" + key + "\" " + describeOption(key));
+      }
+      return;
+    }
+    if (type === "ratio") {
+      if (typeof value !== "number" || !isFinite(value) || value < 0 || value > 1) {
+        throw new TypeError(NAME + ": option \"" + key + "\" " + describeOption(key));
+      }
+      return;
+    }
+    if (type === "seed") {
+      if (value !== null && typeof value !== "string" && typeof value !== "number") {
+        throw new TypeError(NAME + ": option \"" + key + "\" " + describeOption(key));
+      }
+      return;
+    }
+    if (Array.isArray(type) && type.indexOf(value) === -1) {
+      throw new TypeError(NAME + ": option \"" + key + "\" " + describeOption(key));
+    }
+  }
+
+  // Every preset defines every key, so resolveOptions("low") deep-equals
+  // CloakJS.presets.low while still being an independent copy.
+  function resolveOptions(options) {
+    if (options === undefined || options === null) return Object.assign({}, defaultOptions);
+    if (typeof options === "string") {
+      if (!Object.prototype.hasOwnProperty.call(presets, options)) {
+        throw new Error(NAME + ": unknown preset \"" + options + "\". Valid presets: " + Object.keys(presets).join(", "));
+      }
+      return Object.assign({}, presets[options]);
+    }
+    if (typeof options !== "object" || Array.isArray(options)) {
+      throw new TypeError(NAME + ": options must be a preset name or an options object");
+    }
+    var resolved = Object.assign({}, defaultOptions);
+    for (var key in options) {
+      if (!Object.prototype.hasOwnProperty.call(options, key)) continue;
+      checkOption(key, options[key]);
+      resolved[key] = options[key];
+    }
+    return resolved;
+  }
+
+  /* =========================================================================
+   * 4. Encoder-side byte helpers
+   * ====================================================================== */
+  function byteLength(text) {
+    if (typeof TextEncoder !== "undefined") return new TextEncoder().encode(text).length;
+    return unescape(encodeURIComponent(text)).length; // eslint-disable-line no-restricted-globals
+  }
+  function utf8Bytes(value) {
+    if (typeof TextEncoder !== "undefined") {
+      return Array.prototype.slice.call(new TextEncoder().encode(value));
+    }
+    var binary = unescape(encodeURIComponent(value)), bytes = []; // eslint-disable-line no-restricted-globals
+    for (var i = 0; i < binary.length; i++) bytes.push(binary.charCodeAt(i));
+    return bytes;
   }
-  function rc4(key, data) {
-    var s = new Uint8Array(256), i, j, k;
+  function base64FromBytes(bytes) {
+    var binary = "", i;
+    for (i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+    if (typeof btoa === "function") return btoa(binary);
+    if (typeof Buffer !== "undefined") return Buffer.from(binary, "latin1").toString("base64");
+    var out = "";
+    for (i = 0; i < bytes.length; i += 3) {
+      var b1 = bytes[i], b2 = bytes[i + 1], b3 = bytes[i + 2];
+      out += B64_STANDARD.charAt(b1 >> 2);
+      out += B64_STANDARD.charAt(((b1 & 3) << 4) | ((b2 === undefined ? 0 : b2) >> 4));
+      out += b2 === undefined ? "=" : B64_STANDARD.charAt(((b2 & 15) << 2) | ((b3 === undefined ? 0 : b3) >> 6));
+      out += b3 === undefined ? "=" : B64_STANDARD.charAt(b3 & 63);
+    }
+    return out;
+  }
+  function rc4Bytes(key, bytes) {
+    var s = new Array(256), i, j = 0, swap;
     for (i = 0; i < 256; i++) s[i] = i;
-    j = 0;
     for (i = 0; i < 256; i++) {
       j = (j + s[i] + key.charCodeAt(i % key.length)) & 0xff;
-      k = s[i]; s[i] = s[j]; s[j] = k;
+      swap = s[i]; s[i] = s[j]; s[j] = swap;
     }
+    var out = new Array(bytes.length);
     i = 0; j = 0;
+    for (var n = 0; n < bytes.length; n++) {
+      i = (i + 1) & 0xff;
+      j = (j + s[i]) & 0xff;
+      swap = s[i]; s[i] = s[j]; s[j] = swap;
+      out[n] = bytes[n] ^ s[(s[i] + s[j]) & 0xff];
+    }
+    return out;
+  }
+  function applyAlphabet(text, alphabet) {
+    var out = "";
+    for (var i = 0; i < text.length; i++) {
+      var index = B64_STANDARD.indexOf(text.charAt(i));
+      out += index === -1 ? text.charAt(i) : alphabet.charAt(index);
+    }
+    return out;
+  }
+  function randomKey(length) {
+    var out = "";
+    for (var i = 0; i < length; i++) out += String.fromCharCode(33 + randInt(94));
+    return out;
+  }
+  function codePoints(value) {
     var out = [];
-    for (var n = 0; n < data.length; n++) {
-      i = (i + 1) & 0xff; j = (j + s[i]) & 0xff;
-      k = s[i]; s[i] = s[j]; s[j] = k;
-      out.push(data.charCodeAt(n) ^ s[(s[i] + s[j]) & 0xff]);
+    for (var i = 0; i < value.length; i++) {
+      var code = value.charCodeAt(i);
+      if (code >= 0xd800 && code <= 0xdbff && i + 1 < value.length) {
+        out.push(value.substr(i, 2));
+        i++;
+      } else {
+        out.push(value.charAt(i));
+      }
     }
-    var result = "";
-    for (var start = 0; start < out.length; start += 8192) {
-      result += String.fromCharCode.apply(null, out.slice(start, start + 8192));
+    return out;
+  }
+  function quoteString(value) {
+    return JSON.stringify(value)
+      .replace(/\u2028/g, "\\u2028")
+      .replace(/\u2029/g, "\\u2029");
+  }
+  function literalValue(raw) {
+    try {
+      return Function('"use strict";return (' + raw + ");")();
+    } catch (error) {
+      return undefined;
     }
-    return result;
   }
 
-  // A small lexer: preserve strings, templates, regexes and comments as opaque
-  // spans. This is deliberately not a full JavaScript parser.
+  /* =========================================================================
+   * 5. Lexer
+   *
+   * One pass, no dependencies. Strings, template literals, regexes and
+   * comments stay opaque. Template literals are emitted as head/middle/tail
+   * chunks so the expressions inside ${} are tokenised like ordinary code,
+   * which is what lets identifier mangling work inside template substitutions.
+   * This is deliberately not a full parser; every pass re-validates its output
+   * with new Function() and reports problems through warnings.
+   * ====================================================================== */
+  var PUNCTUATORS = [
+    ">>>=", "...", "&&=", "||=", "??=", "**=", "<<=", ">>=", "===", "!==", ">>>",
+    "=>", "?.", "++", "--", "**", "==", "!=", "<=", ">=", "&&", "||", "??",
+    "+=", "-=", "*=", "/=", "%=", "&=", "|=", "^=", "<<", ">>"
+  ];
+  var REGEX_AFTER_WORD = /^(?:return|throw|case|delete|void|typeof|instanceof|in|of|yield|await|else|do|new)$/;
+  var REGEX_AFTER_PUNCT = Object.create(null);
+  (function () {
+    var single = "([{,;:!&|?+-*~^%<>=";
+    for (var i = 0; i < single.length; i++) REGEX_AFTER_PUNCT[single.charAt(i)] = true;
+    var multi = ["=>", "===", "!==", "==", "!=", "<=", ">=", "&&", "||", "??",
+      "+=", "-=", "*=", "/=", "%=", "&=", "|=", "^=", "**", "**=", "&&=", "||=",
+      "??=", "<<=", ">>=", ">>>=", "..."];
+    for (i = 0; i < multi.length; i++) REGEX_AFTER_PUNCT[multi[i]] = true;
+  })();
+  var OBJECT_LITERAL_PREFIX = Object.create(null);
+  (function () {
+    var puncts = ["(", "[", ",", ":", "=", "?", "!", "&&", "||", "??", "+", "-",
+      "*", "/", "%", "**", "<", ">", "<=", ">=", "===", "!==", "==", "!=", "&",
+      "|", "^", "~", "...", "+=", "-=", "*=", "/=", "%=", "**=", "&=", "|=",
+      "^=", "&&=", "||=", "??="];
+    var words = ["return", "typeof", "in", "of", "instanceof", "case", "delete",
+      "void", "yield", "await", "new", "throw", "default"];
+    var i;
+    for (i = 0; i < puncts.length; i++) OBJECT_LITERAL_PREFIX[puncts[i]] = true;
+    for (i = 0; i < words.length; i++) OBJECT_LITERAL_PREFIX[words[i]] = true;
+  })();
+
   function tokenize(code) {
-    var out = [], i = 0, last = null;
-    function emit(type, start, end) {
+    var out = [], i = 0, last = null, frames = [];
+
+    function emit(type, start, end, extra) {
       var token = { type: type, raw: code.slice(start, end), start: start, end: end };
+      if (extra) for (var key in extra) token[key] = extra[key];
       out.push(token);
       if (type !== "space" && type !== "comment") last = token;
+      return token;
     }
     function regexAllowed() {
       if (!last) return true;
-      if (last.type === "word") return /^(return|throw|case|delete|void|typeof|instanceof|in|of|yield|await|else|do)$/.test(last.raw);
-      return last.type === "punct" && /^(=|\(|\[|\{|,|;|:|!|&|\||\?|\+|-|\*|~|\^|%|<|>)$/.test(last.raw);
+      if (last.type === "template") return last.tpl === "head" || last.tpl === "middle";
+      if (last.type === "word") return REGEX_AFTER_WORD.test(last.raw);
+      return last.type === "punct" && REGEX_AFTER_PUNCT[last.raw] === true;
+    }
+    // Scans one template chunk. `start` points at a backtick (start of a
+    // template) or at the "}" that closes a ${...} substitution.
+    function scanTemplate(start, resume) {
+      var j = start + 1;
+      while (j < code.length) {
+        var ch = code[j];
+        if (ch === "\\") { j += 2; continue; }
+        if (ch === "`") {
+          j++;
+          emit("template", start, j, { tpl: resume ? "tail" : "whole" });
+          return { end: j, open: false };
+        }
+        if (ch === "$" && code[j + 1] === "{") {
+          j += 2;
+          emit("template", start, j, { tpl: resume ? "middle" : "head" });
+          return { end: j, open: true };
+        }
+        j++;
+      }
+      emit("template", start, j, { tpl: resume ? "tail" : "whole" });
+      return { end: j, open: false };
     }
+
     while (i < code.length) {
-      var start = i, c = code[i];
-      if (/\s/.test(c)) {
+      var start = i, ch = code[i];
+      if (/\s/.test(ch)) {
         while (i < code.length && /\s/.test(code[i])) i++;
         emit("space", start, i);
-      } else if (c === "/" && code[i + 1] === "/") {
-        i = code.indexOf("\n", i + 2);
-        if (i < 0) i = code.length;
+        continue;
+      }
+      if (ch === "/" && code[i + 1] === "/") {
+        var lineEnd = code.indexOf("\n", i + 2);
+        i = lineEnd < 0 ? code.length : lineEnd;
         emit("comment", start, i);
-      } else if (c === "/" && code[i + 1] === "*") {
-        var end = code.indexOf("*/", i + 2);
-        i = end < 0 ? code.length : end + 2;
+        continue;
+      }
+      if (ch === "/" && code[i + 1] === "*") {
+        var blockEnd = code.indexOf("*/", i + 2);
+        i = blockEnd < 0 ? code.length : blockEnd + 2;
         emit("comment", start, i);
-      } else if (c === "'" || c === '"' || c === "`") {
+        continue;
+      }
+      if (ch === "'" || ch === '"') {
         i++;
         while (i < code.length) {
           if (code[i] === "\\") { i += 2; continue; }
-          if (code[i++] === c) break;
+          if (code[i] === ch) { i++; break; }
+          if (code[i] === "\n") break;
+          i++;
         }
-        emit(c === "`" ? "template" : "string", start, i);
-      } else if (c === "/" && regexAllowed()) {
+        emit("string", start, i);
+        continue;
+      }
+      if (ch === "`") {
+        var chunk = scanTemplate(i, false);
+        i = chunk.end;
+        if (chunk.open) frames.push(0);
+        continue;
+      }
+      if (ch === "/" && regexAllowed()) {
         i++;
         var inClass = false;
         while (i < code.length) {
           if (code[i] === "\\") { i += 2; continue; }
+          if (code[i] === "\n") break;
           if (code[i] === "[") inClass = true;
           else if (code[i] === "]") inClass = false;
           else if (code[i] === "/" && !inClass) { i++; break; }
@@ -173,294 +530,1395 @@
         }
         while (i < code.length && /[a-z]/i.test(code[i])) i++;
         emit("regex", start, i);
-      } else if (/[A-Za-z_$]/.test(c)) {
+        continue;
+      }
+      if (/[A-Za-z_$]/.test(ch) || ch.charCodeAt(0) > 127) {
         i++;
-        while (i < code.length && /[A-Za-z0-9_$]/.test(code[i])) i++;
+        while (i < code.length && (/[A-Za-z0-9_$]/.test(code[i]) || code.charCodeAt(i) > 127)) i++;
         emit("word", start, i);
-      } else if (/[0-9]/.test(c) || (c === "." && /[0-9]/.test(code[i + 1] || ""))) {
-        var match = /^(?:0[xX][\da-fA-F_]+|0[bB][01_]+|0[oO][0-7_]+|(?:\d[\d_]*(?:\.[\d_]*)?|\.[\d_]+)(?:[eE][+-]?[\d_]+)?)(n?)/.exec(code.slice(i));
-        i += match ? match[0].length : 1;
+        continue;
+      }
+      if (/[0-9]/.test(ch) || (ch === "." && /[0-9]/.test(code[i + 1] || ""))) {
+        var number = /^(?:0[xX][\da-fA-F_]+|0[bB][01_]+|0[oO][0-7_]+|(?:\d[\d_]*(?:\.[\d_]*)?|\.[\d_]+)(?:[eE][+-]?[\d_]+)?)(n?)/.exec(code.slice(i));
+        i += number ? number[0].length : 1;
         emit("number", start, i);
-      } else {
-        i++;
+        continue;
+      }
+      var punct = null;
+      for (var pi = 0; pi < PUNCTUATORS.length; pi++) {
+        var candidate = PUNCTUATORS[pi];
+        if (code.substr(i, candidate.length) === candidate) {
+          if (candidate === "?." && /[0-9]/.test(code[i + 2] || "")) continue;
+          punct = candidate;
+          break;
+        }
+      }
+      if (punct) {
+        i += punct.length;
+        if (frames.length) {
+          if (punct === "{") frames[frames.length - 1]++;
+          else if (punct === "}") frames[frames.length - 1]--;
+        }
         emit("punct", start, i);
+        continue;
       }
+      i++;
+      if (ch === "}") {
+        if (frames.length && frames[frames.length - 1] === 0) {
+          var tail = scanTemplate(start, true);
+          i = tail.end;
+          if (!tail.open) frames.pop(); else frames[frames.length - 1] = 0;
+          continue;
+        }
+        if (frames.length) frames[frames.length - 1]--;
+      } else if (ch === "{" && frames.length) {
+        frames[frames.length - 1]++;
+      }
+      emit("punct", start, i);
     }
     return out;
   }
+
   function joinTokens(tokens) {
-    return tokens.map(function (t) { return t.raw; }).join("");
+    var out = "";
+    for (var i = 0; i < tokens.length; i++) out += tokens[i].raw;
+    return out;
   }
-  function significant(tokens, index, direction) {
+  function isSignificant(token) { return token.type !== "space" && token.type !== "comment"; }
+  function significantIndex(tokens, index, direction) {
     for (var i = index + direction; i >= 0 && i < tokens.length; i += direction) {
-      if (tokens[i].type !== "space" && tokens[i].type !== "comment") return tokens[i];
+      if (isSignificant(tokens[i])) return i;
     }
-    return null;
+    return -1;
+  }
+  function significant(tokens, index, direction) {
+    var found = significantIndex(tokens, index, direction);
+    return found === -1 ? null : tokens[found];
   }
 
-  // Only rename declared bindings with no member/property use anywhere in the
-  // input. A plain-text global replacement is not safe for JavaScript.
-  function mangleIdentifiers(code, opts) {
-    if (!opts.identifierMangling) return { code: code, map: {} };
-    var tokens = tokenize(code), bindings = Object.create(null), existing = Object.create(null);
-    var i, t, prev, next;
+  /* =========================================================================
+   * 6. Structural analysis helpers
+   * ====================================================================== */
+  function matchDelimiters(tokens) {
+    var stack = [], pairs = new Array(tokens.length);
+    for (var i = 0; i < tokens.length; i++) {
+      var token = tokens[i];
+      if (token.type !== "punct") continue;
+      if (token.raw === "{" || token.raw === "(" || token.raw === "[") stack.push(i);
+      else if (token.raw === "}" || token.raw === ")" || token.raw === "]") {
+        var open = stack.pop();
+        if (open !== undefined) { pairs[open] = i; pairs[i] = open; }
+      }
+    }
+    return pairs;
+  }
+  // Innermost enclosing "{" for each token index (-1 when there is none).
+  function enclosingBraces(tokens, pairs) {
+    var stack = [], result = new Array(tokens.length);
+    for (var i = 0; i < tokens.length; i++) {
+      var token = tokens[i];
+      if (token.type === "punct" && token.raw === "}") {
+        if (stack.length && pairs[stack[stack.length - 1]] === i) stack.pop();
+      }
+      result[i] = stack.length ? stack[stack.length - 1] : -1;
+      if (token.type === "punct" && token.raw === "{") stack.push(i);
+    }
+    return result;
+  }
+  // Braces that open an object literal, as opposed to a block/body.
+  function objectBraces(tokens, pairs) {
+    var flags = Object.create(null);
+    for (var i = 0; i < tokens.length; i++) {
+      if (tokens[i].type !== "punct" || tokens[i].raw !== "{" || pairs[i] === undefined) continue;
+      var prev = significant(tokens, i, -1);
+      if (!prev) continue;
+      if (prev.type === "punct" && OBJECT_LITERAL_PREFIX[prev.raw]) flags[i] = true;
+      else if (prev.type === "template" && (prev.tpl === "head" || prev.tpl === "middle")) flags[i] = true;
+      else if (prev.type === "word" && OBJECT_LITERAL_PREFIX[prev.raw]) flags[i] = true;
+    }
+    return flags;
+  }
+  // Braces that open a class body.
+  function classBraces(tokens, pairs) {
+    var flags = Object.create(null);
+    for (var i = 0; i < tokens.length; i++) {
+      if (tokens[i].type !== "word" || tokens[i].raw !== "class") continue;
+      var cursor = i, depth = 0;
+      while (true) {
+        cursor = significantIndex(tokens, cursor, 1);
+        if (cursor === -1) break;
+        var raw = tokens[cursor].raw;
+        if (raw === "(" || raw === "[") depth++;
+        else if (raw === ")" || raw === "]") depth--;
+        else if (raw === "{" && depth === 0) { flags[cursor] = true; break; }
+        else if (raw === ";" && depth === 0) break;
+      }
+    }
+    return flags;
+  }
+  var NOT_A_METHOD_CALL = (function () {
+    var words = ["if", "for", "while", "switch", "catch", "with", "function",
+      "return", "typeof", "new", "delete", "void", "instanceof", "in", "of",
+      "do", "else", "case", "yield", "await", "throw"], map = Object.create(null);
+    for (var i = 0; i < words.length; i++) map[words[i]] = true;
+    return map;
+  })();
+  var CONTINUES_EXPRESSION = (function () {
+    var puncts = ["(", ")", "[", "]", "{", "}", ".", "?.", ",", ";", "+", "-", "*", "/", "%", "**", "==",
+      "===", "!=", "!==", "<", ">", "<=", ">=", "&&", "||", "??", "?", ":", "&",
+      "|", "^", "<<", ">>", ">>>", "=", "+=", "-=", "*=", "/=", "%=", "**=",
+      "&&=", "||=", "??=", "&=", "|=", "^=", "=>"], map = Object.create(null);
+    var words = ["in", "instanceof"], i;
+    for (i = 0; i < puncts.length; i++) map[puncts[i]] = true;
+    for (i = 0; i < words.length; i++) map[words[i]] = true;
+    return map;
+  })();
+
+  // Function bodies: declarations, expressions, methods and arrow functions.
+  // Methods are only recognised inside object literals and class bodies, which
+  // keeps "foo() { ... }" (a call followed by a block) from looking like one.
+  function findFunctionRegions(tokens, pairs) {
+    var regions = [], objects = objectBraces(tokens, pairs), classes = classBraces(tokens, pairs);
+    var enclosing = enclosingBraces(tokens, pairs);
+    for (var i = 0; i < tokens.length; i++) {
+      var token = tokens[i];
+      if (!isSignificant(token)) continue;
+      if (token.type === "word" && token.raw === "function") {
+        var cursor = significantIndex(tokens, i, 1);
+        if (cursor !== -1 && tokens[cursor].raw === "*") cursor = significantIndex(tokens, cursor, 1);
+        var nameIndex = -1;
+        if (cursor !== -1 && tokens[cursor].type === "word") {
+          nameIndex = cursor;
+          cursor = significantIndex(tokens, cursor, 1);
+        }
+        if (cursor === -1 || tokens[cursor].raw !== "(" || pairs[cursor] === undefined) continue;
+        var bodyStart = significantIndex(tokens, pairs[cursor], 1);
+        if (bodyStart === -1 || tokens[bodyStart].raw !== "{" || pairs[bodyStart] === undefined) continue;
+        regions.push({
+          kind: "function", nameIndex: nameIndex, keywordIndex: i,
+          paramsOpen: cursor, paramsClose: pairs[cursor],
+          bodyOpen: bodyStart, bodyClose: pairs[bodyStart]
+        });
+        continue;
+      }
+      if (token.type === "punct" && token.raw === "=>") {
+        var arrowBody = significantIndex(tokens, i, 1);
+        if (arrowBody === -1 || tokens[arrowBody].raw !== "{" || pairs[arrowBody] === undefined) continue;
+        var before = significantIndex(tokens, i, -1);
+        var paramsOpen = -1, paramsClose = -1;
+        if (before !== -1 && tokens[before].raw === ")") {
+          paramsClose = before;
+          paramsOpen = pairs[before];
+        } else if (before !== -1 && tokens[before].type === "word") {
+          paramsOpen = before;
+          paramsClose = before;
+        }
+        regions.push({
+          kind: "arrow", nameIndex: -1, paramsOpen: paramsOpen, paramsClose: paramsClose,
+          bodyOpen: arrowBody, bodyClose: pairs[arrowBody]
+        });
+        continue;
+      }
+      if (token.type === "punct" && token.raw === "(" && pairs[i] !== undefined) {
+        var calleeIndex = significantIndex(tokens, i, -1);
+        if (calleeIndex === -1 || tokens[calleeIndex].type !== "word") continue;
+        if (NOT_A_METHOD_CALL[tokens[calleeIndex].raw]) continue;
+        var beforeCallee = significantIndex(tokens, calleeIndex, -1);
+        if (beforeCallee !== -1 && (tokens[beforeCallee].raw === "function" || tokens[beforeCallee].raw === ".")) continue;
+        var bodyOpen = significantIndex(tokens, pairs[i], 1);
+        if (bodyOpen === -1 || tokens[bodyOpen].raw !== "{" || pairs[bodyOpen] === undefined) continue;
+        var brace = enclosing[i];
+        if (brace === -1 || (!objects[brace] && !classes[brace])) continue;
+        regions.push({
+          kind: "method", nameIndex: calleeIndex, paramsOpen: i, paramsClose: pairs[i],
+          bodyOpen: bodyOpen, bodyClose: pairs[bodyOpen]
+        });
+      }
+    }
+    return regions;
+  }
+  function regionDepth(regions, region) {
+    var depth = 1;
+    for (var i = 0; i < regions.length; i++) {
+      var other = regions[i];
+      if (other === region) continue;
+      if (other.bodyOpen < region.bodyOpen && other.bodyClose > region.bodyClose) depth++;
+    }
+    return depth;
+  }
+  function scopeOf(index, scopes) {
+    var best = null;
+    for (var i = 0; i < scopes.length; i++) {
+      var scope = scopes[i];
+      if (index >= scope.start && index <= scope.end) {
+        if (!best || (scope.end - scope.start) < (best.end - best.start)) best = scope;
+      }
+    }
+    return best;
+  }
+  // Destructuring patterns are never rewritten; collect their token indexes.
+  function collectPatternTokens(tokens, regions) {
+    var pattern = Object.create(null);
+    function markRange(from, to) {
+      for (var i = from; i <= to && i < tokens.length; i++) pattern[i] = true;
+    }
+    function markFrom(index) {
+      if (index === -1) return;
+      var open = tokens[index].raw, close = open === "{" ? "}" : "]", depth = 0;
+      for (var i = index; i < tokens.length; i++) {
+        if (tokens[i].raw === open) depth++;
+        else if (tokens[i].raw === close) {
+          depth--;
+          if (depth === 0) { markRange(index, i); return; }
+        }
+      }
+      markRange(index, tokens.length - 1);
+    }
+    function scanDeclarators(fromIndex) {
+      var cursor = fromIndex;
+      while (true) {
+        var next = significantIndex(tokens, cursor, 1);
+        if (next === -1) return;
+        if (tokens[next].raw === "{" || tokens[next].raw === "[") markFrom(next);
+        var depth = 0, j = next, stop = false;
+        for (; j < tokens.length; j++) {
+          var raw = tokens[j].raw;
+          if (tokens[j].type === "punct") {
+            if (raw === "(" || raw === "[" || raw === "{") depth++;
+            else if (raw === ")" || raw === "]" || raw === "}") {
+              if (depth === 0) { stop = true; break; }
+              depth--;
+            } else if (depth === 0 && (raw === ";" || raw === ",")) break;
+          } else if (depth === 0 && tokens[j].type === "word" && (raw === "in" || raw === "of")) { stop = true; break; }
+        }
+        if (j >= tokens.length || stop) return;
+        if (tokens[j].type !== "punct" || (tokens[j].raw !== "," )) return;
+        cursor = j;
+      }
+    }
+    for (var i = 0; i < tokens.length; i++) {
+      var token = tokens[i];
+      if (token.type !== "word") continue;
+      if (token.raw === "var" || token.raw === "let" || token.raw === "const") scanDeclarators(i);
+      else if (token.raw === "catch") {
+        var open = significantIndex(tokens, i, 1);
+        if (open !== -1 && tokens[open].raw === "(" && pairsIndex(tokens, open) !== -1) {
+          var first = significantIndex(tokens, open, 1);
+          if (first !== -1 && (tokens[first].raw === "{" || tokens[first].raw === "[")) markFrom(first);
+        }
+      }
+    }
+    for (i = 0; i < regions.length; i++) {
+      var region = regions[i];
+      if (region.paramsOpen === -1 || region.paramsClose <= region.paramsOpen) continue;
+      var paramDepth = 0;
+      for (var k = region.paramsOpen + 1; k < region.paramsClose; k++) {
+        var paramToken = tokens[k];
+        if (paramToken.type !== "punct") continue;
+        if (paramToken.raw === "(" || paramToken.raw === "[" || paramToken.raw === "{") {
+          if (paramDepth === 0 && paramToken.raw !== "(") markFrom(k);
+          paramDepth++;
+        } else if (paramToken.raw === ")" || paramToken.raw === "]" || paramToken.raw === "}") {
+          paramDepth--;
+        }
+      }
+    }
+    return pattern;
+  }
+  function pairsIndex(tokens, open) {
+    var match = open === "{" ? "}" : open === "(" ? ")" : "]", depth = 0;
+    for (var i = open; i < tokens.length; i++) {
+      if (tokens[i].raw === open) depth++;
+      else if (tokens[i].raw === match) {
+        depth--;
+        if (depth === 0) return i;
+      }
+    }
+    return -1;
+  }
+
+  /* =========================================================================
+   * 7. Identifier mangling
+   *
+   * Declared bindings from var/let/const, function and class names, parameter
+   * lists, catch clauses and named function expressions are renamed. A spelling
+   * is only renamed when every occurrence of it lies inside one of the scopes
+   * that declare it; this keeps references to globals defined by other scripts
+   * working. Property names, object keys, shorthand properties, method names,
+   * labels, destructuring patterns, module bindings and anything reachable
+   * dynamically (eval, with, string keys) are left alone.
+   * ====================================================================== */
+  function mangleIdentifiers(code, ctx) {
+    var opts = ctx.opts, tokens = tokenize(code), map = Object.create(null);
+    if (opts.skipMangling) return { code: code, map: map };
+    var pairs = matchDelimiters(tokens);
+    var regions = findFunctionRegions(tokens, pairs);
+    var patterns = collectPatternTokens(tokens, regions);
+    var objects = objectBraces(tokens, pairs);
+    var classes = classBraces(tokens, pairs);
+    var enclosing = enclosingBraces(tokens, pairs);
+    var existing = Object.create(null), stringValues = Object.create(null);
+    var occurrences = Object.create(null);
+    var i, token;
     for (i = 0; i < tokens.length; i++) {
-      t = tokens[i];
-      if (t.type === "word") existing[t.raw] = true;
+      token = tokens[i];
+      if (token.type === "word") {
+        existing[token.raw] = true;
+        if (!occurrences[token.raw]) occurrences[token.raw] = [];
+        occurrences[token.raw].push(i);
+      } else if (token.type === "string") {
+        var value = literalValue(token.raw);
+        if (typeof value === "string" && value) stringValues[value] = true;
+      }
+    }
+    var scopes = [{ start: 0, end: tokens.length - 1, top: true }];
+    for (i = 0; i < regions.length; i++) {
+      scopes.push({
+        start: regions[i].paramsOpen === -1 ? regions[i].bodyOpen : regions[i].paramsOpen,
+        end: regions[i].bodyClose
+      });
     }
+    var candidates = Object.create(null);
+    function declare(index, scope) {
+      if (index === -1 || !scope) return;
+      var name = tokens[index].raw;
+      if (!name || RESERVED_SET[name] || INTERNAL_SET[name]) return;
+      if (!candidates[name]) candidates[name] = [];
+      candidates[name].push(scope);
+    }
+    function declareHere(index) { declare(index, scopeOf(index, scopes)); }
+    // var / let / const bindings
     for (i = 0; i < tokens.length; i++) {
-      t = tokens[i];
-      if (t.type !== "word" || RESERVED_SET[t.raw] || INTERNAL_SET[t.raw] || t.raw.length === 1) continue;
-      prev = significant(tokens, i, -1);
-      if (prev && /^(var|let|const|function)$/.test(prev.raw)) bindings[t.raw] = true;
-    }
-    // If the spelling appears as a property, object key, shorthand, or is used
-    // by eval, don't rename it. This sacrifices coverage for safer output.
-    if (/\beval\s*\(|\bwith\s*\(/.test(code) || tokens.some(function (t) {
-      return t.type === "template" && t.raw.indexOf("${") !== -1;
-    })) bindings = Object.create(null);
+      token = tokens[i];
+      if (token.type !== "word" || (token.raw !== "var" && token.raw !== "let" && token.raw !== "const")) continue;
+      var cursor = i;
+      while (true) {
+        var nameIndex = significantIndex(tokens, cursor, 1);
+        if (nameIndex === -1) break;
+        var nameToken = tokens[nameIndex];
+        if (nameToken.raw === ")" || nameToken.raw === ";") break;
+        if (nameToken.type === "word" && !KEYWORD_SET[nameToken.raw] && !patterns[nameIndex]) declareHere(nameIndex);
+        var depth = 0, j = nameIndex, stop = false;
+        for (; j < tokens.length; j++) {
+          var raw = tokens[j].raw;
+          if (tokens[j].type === "punct") {
+            if (raw === "(" || raw === "[" || raw === "{") depth++;
+            else if (raw === ")" || raw === "]" || raw === "}") {
+              if (depth === 0) { stop = true; break; }
+              depth--;
+            } else if (depth === 0 && (raw === ";" || raw === ",")) break;
+          } else if (depth === 0 && tokens[j].type === "word" && (raw === "in" || raw === "of")) { stop = true; break; }
+        }
+        if (j >= tokens.length || stop || tokens[j].type !== "punct" || tokens[j].raw !== ",") break;
+        cursor = j;
+      }
+    }
+    // function names and parameter lists
+    for (i = 0; i < regions.length; i++) {
+      var region = regions[i];
+      if (region.kind === "function" && region.nameIndex !== -1 && !opts.preserveFunctionNames) {
+        // A declaration name belongs to the enclosing scope, the name of a named
+        // function expression only to the function itself. The keyword before
+        // the name tells the two apart, not the token before the name.
+        var beforeName = significantIndex(tokens, region.keywordIndex, -1);
+        var declarationContext = beforeName === -1 || tokens[beforeName].raw === ";" ||
+          tokens[beforeName].raw === "{" || tokens[beforeName].raw === "}" ||
+          (tokens[beforeName].type === "word" &&
+            (tokens[beforeName].raw === "export" || tokens[beforeName].raw === "default"));
+        if (declarationContext) declareHere(region.nameIndex);
+        else declare(region.nameIndex, { start: region.nameIndex, end: region.bodyClose });
+      }
+      if (region.paramsOpen === -1 || region.paramsClose <= region.paramsOpen) continue;
+      var paramScope = { start: region.paramsOpen, end: region.bodyClose };
+      var parts = [], current = [], depth2 = 0, k;
+      for (k = region.paramsOpen + 1; k < region.paramsClose; k++) {
+        var param = tokens[k];
+        if (param.type === "punct") {
+          if (param.raw === "(" || param.raw === "[" || param.raw === "{") depth2++;
+          else if (param.raw === ")" || param.raw === "]" || param.raw === "}") depth2--;
+          else if (param.raw === "," && depth2 === 0) { parts.push(current); current = []; continue; }
+        }
+        if (depth2 === 0 && param.type === "word" && (param.raw === "var" || param.raw === "let" || param.raw === "const")) {
+          current = [];
+          continue;
+        }
+        current.push(k);
+      }
+      if (current.length) parts.push(current);
+      for (var p = 0; p < parts.length; p++) {
+        var part = parts[p], stopAt = part.length;
+        for (var q = 0; q < part.length; q++) {
+          if (tokens[part[q]].type === "punct" && tokens[part[q]].raw === "=") { stopAt = q; break; }
+        }
+        for (q = 0; q < stopAt; q++) {
+          var index = part[q];
+          if (patterns[index]) continue;
+          if (tokens[index].type === "word" && !KEYWORD_SET[tokens[index].raw]) {
+            declare(index, paramScope);
+            break;
+          }
+        }
+      }
+    }
+    // class names and catch clauses
     for (i = 0; i < tokens.length; i++) {
-      t = tokens[i];
-      if (!bindings[t.raw]) continue;
-      prev = significant(tokens, i, -1);
-      next = significant(tokens, i, 1);
-      if ((prev && (prev.raw === "." || prev.raw === "?" && significant(tokens, i - 1, -1) && significant(tokens, i - 1, -1).raw === ".")) ||
-          (next && next.raw === ":") ||
-          (prev && (prev.raw === "{" || prev.raw === ",") && next &&
-           (next.raw === "," || next.raw === "}" || next.raw === "("))) {
-        delete bindings[t.raw];
-      }
-    }
-    var pool = Object.create(null), map = Object.create(null);
-    for (i = 0; i < INTERNAL.length; i++) pool[INTERNAL[i]] = true;
-    for (var id in bindings) map[id] = pickName(pool, existing, 8);
+      token = tokens[i];
+      if (token.type !== "word") continue;
+      if (token.raw === "class") {
+        if (opts.preserveFunctionNames) continue;
+        var className = significantIndex(tokens, i, 1);
+        if (className === -1) continue;
+        if (tokens[className].type !== "word" || tokens[className].raw === "extends" ||
+          KEYWORD_SET[tokens[className].raw]) continue;
+        var beforeClass = significantIndex(tokens, i, -1);
+        var classIsDeclaration = beforeClass === -1 || tokens[beforeClass].raw === ";" ||
+          tokens[beforeClass].raw === "{" || tokens[beforeClass].raw === "}" ||
+          (tokens[beforeClass].type === "word" &&
+            (tokens[beforeClass].raw === "export" || tokens[beforeClass].raw === "default"));
+        if (classIsDeclaration) {
+          declareHere(className);
+        } else {
+          var classBody = -1, cursor2 = className;
+          while (true) {
+            cursor2 = significantIndex(tokens, cursor2, 1);
+            if (cursor2 === -1 || tokens[cursor2].raw === ";") break;
+            if (tokens[cursor2].raw === "{") { classBody = cursor2; break; }
+          }
+          if (classBody !== -1 && pairs[classBody] !== undefined) {
+            declare(className, { start: classBody, end: pairs[classBody] });
+          } else {
+            declareHere(className);
+          }
+        }
+      } else if (token.raw === "catch") {
+        var openParen = significantIndex(tokens, i, 1);
+        if (openParen === -1 || tokens[openParen].raw !== "(" || pairs[openParen] === undefined) continue;
+        var catchName = significantIndex(tokens, openParen, 1);
+        if (catchName === -1 || catchName >= pairs[openParen]) continue;
+        if (tokens[catchName].type !== "word" || KEYWORD_SET[tokens[catchName].raw] || patterns[catchName]) continue;
+        declareHere(catchName);
+      }
+    }
+    // Spellings that must never be renamed.
+    var blocked = Object.create(null);
     for (i = 0; i < tokens.length; i++) {
-      t = tokens[i];
-      if (t.type === "word" && map[t.raw]) t.raw = map[t.raw];
+      token = tokens[i];
+      if (token.type !== "word") continue;
+      var name = token.raw;
+      if (blocked[name]) continue;
+      if (RESERVED_SET[name] || INTERNAL_SET[name] || patterns[i]) { blocked[name] = true; continue; }
+      var prev = significant(tokens, i, -1), next = significant(tokens, i, 1);
+      if (prev && (prev.raw === "." || prev.raw === "?." || prev.raw === "#")) { blocked[name] = true; continue; }
+      if (prev && prev.raw === "...") { blocked[name] = true; continue; }
+      if (next && next.raw === ":" && (!prev || (prev.raw !== "case" && prev.raw !== "?"))) {
+        blocked[name] = true; continue;
+      }
+      var brace = enclosing[i];
+      if (brace !== -1 && (objects[brace] || classes[brace])) {
+        var propertyStart = prev && (prev.raw === "{" || prev.raw === ",");
+        if (propertyStart && (!next || next.raw === "," || next.raw === "}" || next.raw === "=" ||
+          next.raw === "(" || next.raw === ":")) {
+          blocked[name] = true; continue;
+        }
+      }
+      if (stringValues[name]) { blocked[name] = true; }
+    }
+    // Containment test, then rewrite.
+    for (var spelling in candidates) {
+      if (blocked[spelling]) continue;
+      var declaredScopes = candidates[spelling];
+      var seen = occurrences[spelling] || [];
+      var inside = seen.length > 0;
+      for (i = 0; i < seen.length && inside; i++) {
+        var contained = false;
+        for (var d = 0; d < declaredScopes.length; d++) {
+          var scope = declaredScopes[d];
+          if (seen[i] >= scope.start && seen[i] <= scope.end) { contained = true; break; }
+        }
+        if (!contained) inside = false;
+      }
+      if (inside) map[spelling] = ctx.pool.name(2 + randInt(4));
+    }
+    for (i = 0; i < tokens.length; i++) {
+      token = tokens[i];
+      if (token.type === "word" && map[token.raw]) token.raw = map[token.raw];
     }
     return { code: joinTokens(tokens), map: map };
   }
 
-  function buildDecoder(key) {
-    return (
-      'var _0xdc=function(_0xpi){var _0xv=_0xa[_0xpi];' +
-      'if(_0xv===undefined)return _0xv;' +
-      'var _0xh=atob(_0xv),_0xs=new Uint8Array(_0xh.length>>1);' +
-      'for(var _0xbi=0;_0xbi<_0xs.length;_0xbi++)_0xs[_0xbi]=parseInt(_0xh.substr(_0xbi<<1,2),16);' +
-      'var _0xk="' + key + '",_0xr=new Uint8Array(256);' +
-      'for(var _0xi=0;_0xi<256;_0xi++)_0xr[_0xi]=_0xi;' +
-      'var _0xj=0;for(var _0xi=0;_0xi<256;_0xi++){' +
-      '_0xj=(_0xj+_0xr[_0xi]+_0xk.charCodeAt(_0xi%_0xk.length))&255;' +
-      'var _0xt=_0xr[_0xi];_0xr[_0xi]=_0xr[_0xj];_0xr[_0xj]=_0xt;}' +
-      'var _0xii=0;_0xj=0;var _0xo=new Uint8Array(_0xs.length);' +
-      'for(var _0xl=0;_0xl<_0xs.length;_0xl++){' +
-      '_0xii=(_0xii+1)&255;_0xj=(_0xj+_0xr[_0xii])&255;' +
-      'var _0xt=_0xr[_0xii];_0xr[_0xii]=_0xr[_0xj];_0xr[_0xj]=_0xt;' +
-      '_0xo[_0xl]=_0xs[_0xl]^_0xr[(_0xr[_0xii]+_0xr[_0xj])&255];}' +
-      'var _0xsd=new TextDecoder().decode(_0xo);return _0xsd;};'
-    );
-  }
-  function utf8Bytes(value) {
-    if (typeof TextEncoder !== "undefined") return new TextEncoder().encode(value);
-    var binary = unescape(encodeURIComponent(value)), bytes = [];
-    for (var i = 0; i < binary.length; i++) bytes.push(binary.charCodeAt(i));
-    return bytes;
+  /* =========================================================================
+   * 8. Identifier escaping
+   * ====================================================================== */
+  function escapeIdentifier(name) {
+    var out = "", changed = 0;
+    for (var i = 0; i < name.length; i++) {
+      var code = name.charCodeAt(i), char = name.charAt(i);
+      if ((/[A-Za-z0-9]/.test(char) || code > 127) && chance(0.75)) {
+        var hex = code.toString(16);
+        while (hex.length < 4) hex = "0" + hex;
+        out += "\\u" + hex;
+        changed++;
+      } else {
+        out += char;
+      }
+    }
+    return changed ? out : name;
   }
-  function encryptStrings(code, opts) {
-    if (!opts.stringEncryption) return { code: code, count: 0 };
-    var tokens = tokenize(code), key = randomHexName(10), encrypted = [];
+  function escapeIdentifiers(code, ctx) {
+    if (ctx.opts.skipMangling) return { code: code, count: 0 };
+    var tokens = tokenize(code), count = 0;
     for (var i = 0; i < tokens.length; i++) {
-      var t = tokens[i];
-      if (t.type !== "string") continue;
-      // Do not turn directive prologues or property keys into expressions.
-      var prev = significant(tokens, i, -1), next = significant(tokens, i, 1);
-      if ((next && next.raw === ":") ||
-          (next && next.raw === "(" && prev &&
-           (prev.raw === "{" || prev.raw === "," || prev.raw === "get" || prev.raw === "set")) ||
-          ((!prev || prev.raw === "{" || prev.raw === ";") &&
-          (t.raw === '"use strict"' || t.raw === "'use strict'" ||
-           t.raw === '"use asm"' || t.raw === "'use asm'")) ||
-          (prev && (prev.raw === "from" || prev.raw === "import" || prev.raw === "export"))) continue;
-      var value;
-      try { value = Function('"use strict";return (' + t.raw + ')')(); } catch (e) { continue; }
-      if (!value) continue;
-      var bytes = utf8Bytes(value), binary = "";
-      for (var j = 0; j < bytes.length; j++) binary += String.fromCharCode(bytes[j]);
-      encrypted.push(toBase64(rc4(key, binary)));
-      t.raw = "_0xdc(" + (encrypted.length - 1) + ")";
-    }
-    if (!encrypted.length) return { code: code, count: 0 };
-    var arrayDecl = "var _0xa=[" + encrypted.map(function (e) { return '"' + e + '"'; }).join(",") + "];";
-    return { code: arrayDecl + buildDecoder(key) + joinTokens(tokens), count: encrypted.length };
-  }
-
-  function encodeNumberExpr(n) {
-    if (Number.isSafeInteger(n)) {
-      var mode = randInt(3);
-      var hex = n < 0 ? "-0x" + (-n).toString(16) : "0x" + n.toString(16);
-      if (mode === 0) return hex;
-      if (Math.abs(n) < 4096) {
-        if (mode === 1) { var a = randInt(64) + 1; return a + "+" + (n - a); }
-        var b = randInt(32) + 2, q = Math.round(n / b);
-        return b + "*" + q + "+" + (n - b * q);
-      }
-      return hex;
-    }
-    return String(n);
-  }
-  function encodeNumbers(code, opts) {
-    if (!opts.numberEncoding) return { code: code, count: 0 };
+      var token = tokens[i];
+      if (token.type !== "word") continue;
+      if (RESERVED_SET[token.raw] || INTERNAL_SET[token.raw] || ctx.generatedNames[token.raw]) continue;
+      var prev = significant(tokens, i, -1);
+      if (prev && prev.raw === "#") continue;
+      var escaped = escapeIdentifier(token.raw);
+      if (escaped !== token.raw) {
+        token.raw = escaped;
+        count++;
+      }
+    }
+    return { code: joinTokens(tokens), count: count };
+  }
+
+  /* =========================================================================
+   * 9. Number encoding
+   * ====================================================================== */
+  function intExpression(n) {
+    var strategy = randInt(9), a, b, k;
+    if (strategy === 0) return n < 0 ? "-0x" + (-n).toString(16) : "0x" + n.toString(16);
+    if (strategy === 1 && n >= 0) return "0b" + n.toString(2);
+    if (strategy === 2 && n >= 0) return "0o" + n.toString(8);
+    if (strategy === 3) { k = randInt(60) + 1; return (n - k) + "+" + k; }
+    if (strategy === 4 && n !== 0) { b = randInt(6) + 2; return b + "*" + ((n - (n % b)) / b) + "+" + (n % b); }
+    if (strategy === 5 && Math.abs(n) < 0x7fffffff) { a = randInt(0xffff); return "(" + a + "^" + (a ^ n) + ")"; }
+    if (strategy === 6 && n >= 0 && n < 0x7fffffff) { a = randInt(0xffff); return "(" + (n & a) + "|" + (n & ~a) + ")"; }
+    if (strategy === 7 && n > -100000 && n < 100000) { k = 1 << (randInt(4) + 1); return n + "*" + k + "/" + k; }
+    if (strategy === 8 && n < 0) return "~" + (~n);
+    k = 1 << (randInt(3) + 1);
+    return n * k + "/" + k;
+  }
+  function encodeNumberExpr(value) {
+    if (typeof value !== "number" || !isFinite(value)) return String(value);
+    if (value === 0) return chance(0.5) ? "0x0" : "0*(" + (randInt(9) + 1) + ")";
+    if (Number.isSafeInteger(value) && Math.abs(value) < 0x1fffffffffffff) return intExpression(value);
+    // scaling by a power of two is exact in IEEE-754
+    var power = 1 << (randInt(3) + 1);
+    return value + "*" + power + "/" + power;
+  }
+  function encodeNumbers(code, ctx) {
+    if (!ctx.opts.numberEncoding) return code;
     var tokens = tokenize(code), count = 0;
     for (var i = 0; i < tokens.length; i++) {
-      var t = tokens[i];
-      if (t.type !== "number" || t.raw.length <= 1 || /n$/.test(t.raw)) continue;
+      var token = tokens[i];
+      if (token.type !== "number" || token.raw.length <= 1 || /n$/.test(token.raw)) continue;
       var prev = significant(tokens, i, -1), next = significant(tokens, i, 1);
-      // Avoid property names, object keys, optional chaining and numeric method calls.
-      if ((next && (next.raw === ":" || next.raw === "." ||
-          next.raw === "(" && prev && (prev.raw === "{" || prev.raw === ","))) ||
-          (prev && prev.raw === ".")) continue;
-      var num = Number(t.raw);
-      if (!isFinite(num)) continue;
-      t.raw = "(" + encodeNumberExpr(num) + ")";
+      if (next && (next.raw === ":" || next.raw === "." ||
+        (next.raw === "(" && prev && (prev.raw === "{" || prev.raw === ",")))) continue;
+      if (prev && (prev.raw === "." || prev.raw === "?." || prev.raw === "#")) continue;
+      var value = Number(token.raw.replace(/_/g, ""));
+      if (!isFinite(value)) continue;
+      token.raw = "(" + encodeNumberExpr(value) + ")";
       count++;
     }
-    return { code: joinTokens(tokens), count: count };
+    ctx.stats.numbersEncoded = (ctx.stats.numbersEncoded || 0) + count;
+    return joinTokens(tokens);
   }
 
-  var DECOYS = [
-    "if(false){void 1}",
-    "if(false){void 2}",
-    "if(false){void 3}"
-  ];
-  function makeDeadCodeStatements(realCount) {
-    var want = Math.min(DECOYS.length, Math.max(1, Math.ceil(realCount / 3)));
-    return DECOYS.slice(0, want);
+  /* =========================================================================
+   * 10. String handling: splitting, encryption and the generated decoder
+   * ====================================================================== */
+  function splitString(value, opts) {
+    if (!opts.stringSplitting || value.length < opts.stringSplitMinLength) return [value];
+    var chars = codePoints(value);
+    if (chars.length < 2) return [value];
+    var desired = Math.ceil(chars.length / Math.max(2, Math.floor(opts.stringSplitMinLength * 1.5)));
+    desired = Math.max(2, Math.min(Math.max(2, opts.stringSplitMaxParts), desired));
+    if (chance(0.25)) desired = Math.max(2, desired - 1);
+    var parts = [], size = Math.ceil(chars.length / desired), index = 0;
+    while (index < chars.length) {
+      var take = size + (chance(0.4) ? randInt(3) - 1 : 0);
+      if (take < 1) take = 1;
+      if (index + take >= chars.length) take = chars.length - index;
+      parts.push(chars.slice(index, index + take).join(""));
+      index += take;
+    }
+    return parts.length > 1 ? parts : [value];
   }
-
-  // Split only at top-level semicolons. A newline is not necessarily a
-  // statement boundary (e.g. a multi-line expression or return value).
-  function splitTopLevel(code) {
-    var tokens = tokenize(code), out = [], start = 0, depth = 0;
-    for (var i = 0; i < tokens.length; i++) {
-      var t = tokens[i];
-      if (t.type !== "punct") continue;
-      if (t.raw === "{" || t.raw === "(" || t.raw === "[") depth++;
-      if (t.raw === "}" || t.raw === ")" || t.raw === "]") depth--;
-      if (t.raw === ";" && depth === 0) {
-        var part = code.slice(start, t.end).trim();
-        if (part) out.push(part);
-        start = t.end;
-      }
-    }
-    var tail = code.slice(start).trim();
-    if (tail) out.push(tail);
-    return out;
+  // Builds the decoder body. Everything is ES5 and self-contained: no atob, no
+  // Uint8Array and no TextDecoder are required (they are used when present).
+  function buildDecoderFunction(ctx, payload) {
+    var p = {
+      x: ctx.pool.name(4), s: ctx.pool.name(4), t: ctx.pool.name(4), v: ctx.pool.name(4),
+      n: ctx.pool.name(3), b: ctx.pool.name(3), o: ctx.pool.name(3), r: ctx.pool.name(3),
+      k: ctx.pool.name(3), j: ctx.pool.name(3), c: ctx.pool.name(3), i: ctx.pool.name(3)
+    };
+    var names = ctx.names, out = "";
+    out += "var " + p.s + "=" + names.array + (payload.shuffle ? "[" + names.map + "[" + p.x + "]]" : "[" + p.x + "]") + ";";
+    out += "if(" + p.s + "===undefined)return " + p.s + ";";
+    if (payload.reversed) out += p.s + "=" + p.s + ".split(\"\").reverse().join(\"\");";
+    out += "var " + p.t + "={}," + p.n + "=0," + p.b + "=0," + p.v + "=0," + p.o + "=[]," + p.i + "=0" +
+      (payload.encoding === "rc4" ? "," + p.r + "=[]," + p.k + "=\"\"," + p.j + "=0" : "") + ";";
+    out += "for(" + p.c + "=0;" + p.c + "<64;" + p.c + "++)" + p.t + "[" + names.alphabet + ".charCodeAt(" + p.c + ")]=" + p.c + ";";
+    out += "for(;" + p.v + "<" + p.s + ".length;" + p.v + "++){";
+    out += p.c + "=" + p.t + "[" + p.s + ".charCodeAt(" + p.v + ")];";
+    out += "if(" + p.c + "===undefined)continue;";
+    out += p.b + "=(" + p.b + "<<6)|" + p.c + ";" + p.n + "+=6;";
+    out += "if(" + p.n + ">=8){" + p.n + "-=8;" + p.o + ".push((" + p.b + ">>" + p.n + ")&255);" + p.b + "&=(1<<" + p.n + ")-1;}}";
+    if (payload.encoding === "rc4") {
+      out += "for(" + p.v + "=0;" + p.v + "<" + names.key + ".length;" + p.v + "++)" + p.k + "+=String.fromCharCode(" + names.key + "[" + p.v + "]);";
+      out += "for(" + p.v + "=0;" + p.v + "<256;" + p.v + "++)" + p.r + "[" + p.v + "]=" + p.v + ";";
+      out += p.j + "=0;";
+      out += "for(" + p.v + "=0;" + p.v + "<256;" + p.v + "++){" + p.j + "=(" + p.j + "+" + p.r + "[" + p.v + "]+" +
+        p.k + ".charCodeAt(" + p.v + "%" + p.k + ".length))&255;" + p.c + "=" + p.r + "[" + p.v + "];" +
+        p.r + "[" + p.v + "]=" + p.r + "[" + p.j + "];" + p.r + "[" + p.j + "]=" + p.c + ";}";
+      out += p.v + "=0;" + p.j + "=0;";
+      out += "for(" + p.c + "=0;" + p.c + "<" + p.o + ".length;" + p.c + "++){" + p.v + "=(" + p.v + "+1)&255;" +
+        p.j + "=(" + p.j + "+" + p.r + "[" + p.v + "])&255;var " + p.n + "=" + p.r + "[" + p.v + "];" +
+        p.r + "[" + p.v + "]=" + p.r + "[" + p.j + "];" + p.r + "[" + p.j + "]=" + p.n + ";" +
+        p.o + "[" + p.c + "]=" + p.o + "[" + p.c + "]^" + p.r + "[(" + p.r + "[" + p.v + "]+" + p.r + "[" + p.j + "])&255];}";
+    }
+    out += "if(typeof TextDecoder!==\"undefined\"&&typeof Uint8Array!==\"undefined\"){try{return new TextDecoder().decode(new Uint8Array(" + p.o + "));}catch(" + p.c + "){}}";
+    out += "var " + p.c + "=\"\";" + p.i + "=0;";
+    out += "while(" + p.i + "<" + p.o + ".length){";
+    out += p.v + "=" + p.o + "[" + p.i + "++];";
+    out += "if(" + p.v + "<128){" + p.c + "+=String.fromCharCode(" + p.v + ");continue;}";
+    out += "if(" + p.v + ">191&&" + p.v + "<224){" + p.n + "=" + p.o + "[" + p.i + "++];" +
+      p.c + "+=String.fromCharCode(((" + p.v + "&31)<<6)|(" + p.n + "&63));continue;}";
+    out += "if(" + p.v + ">223&&" + p.v + "<240){" + p.n + "=" + p.o + "[" + p.i + "++];" + p.b + "=" + p.o + "[" + p.i + "++];" +
+      p.c + "+=String.fromCharCode(((" + p.v + "&15)<<12)|((" + p.n + "&63)<<6)|(" + p.b + "&63));continue;}";
+    out += p.n + "=" + p.o + "[" + p.i + "++];" + p.b + "=" + p.o + "[" + p.i + "++];" + p.t + "=" + p.o + "[" + p.i + "++];";
+    out += p.n + "=((((" + p.v + "&7)<<18)|((" + p.n + "&63)<<12)|((" + p.b + "&63)<<6)|(" + p.t + "&63))-65536);";
+    out += p.c + "+=String.fromCharCode(55296+(" + p.n + ">>10),56320+(" + p.n + "&1023));}";
+    out += "return " + p.c + ";";
+    var text = "function(" + p.x + "){" + out + "}";
+    return { text: text, declaration: "var " + names.decoder + "=" + text + ";" };
   }
-  function flattenControlFlow(code, opts) {
-    // A dispatcher changes lexical scope, hoisting, directive prologues and
-    // completion values. Only use it for self-contained expression statements.
-    var stmts = splitTopLevel(code), deadCount = 0;
-    var safe = stmts.length > 1 && stmts.every(function (s) {
-      return /^(?:[A-Za-z_$][\w$]*\.)*[A-Za-z_$][\w$]*\s*\(/.test(s) &&
-        !/\b(?:return|throw|break|continue|await|yield|var|let|const|function|class|import|export)\b/.test(s);
-    });
-    if (!safe || !opts.controlFlowFlattening) {
-      if (opts.deadCodeInjection && stmts.length) {
-        var extras = makeDeadCodeStatements(stmts.length);
-        deadCount = extras.length;
-        return { code: code + "\n;" + extras.join(";"), deadCount: deadCount, flattened: false };
-      }
-      return { code: code, deadCount: 0, flattened: false };
-    }
-    if (opts.deadCodeInjection) {
-      var decoys = makeDeadCodeStatements(stmts.length);
-      deadCount = decoys.length;
-      stmts = stmts.concat(decoys);
-    }
-    // Scramble case layout, not execution order: side effects must stay ordered.
-    var indices = stmts.map(function (_, i) { return i; });
-    for (var i = indices.length - 1; i > 0; i--) {
-      var j = randInt(i + 1), tmp = indices[i]; indices[i] = indices[j]; indices[j] = tmp;
-    }
-    var cases = indices.map(function (k) {
-      return "case " + k + ":{" + stmts[k] + "}break;";
+  function encodeStrings(code, ctx) {
+    var opts = ctx.opts;
+    if (!opts.stringEncryption && !opts.stringSplitting) return { code: code, runtime: "", decoderText: "", count: 0, split: 0, entries: 0 };
+    var tokens = tokenize(code);
+    var key = opts.stringEncryption && opts.stringEncoding === "rc4" ? randomKey(6 + randInt(10)) : null;
+    var alphabet = opts.stringEncryption && opts.stringAlphabet === "shuffled"
+      ? shuffle(B64_STANDARD.split("")).join("")
+      : B64_STANDARD;
+    var reversed = opts.stringEncryption && opts.stringAlphabet === "shuffled" ? chance(0.5) : false;
+    var items = [], logical = [], count = 0, splitCount = 0;
+    for (var i = 0; i < tokens.length; i++) {
+      var token = tokens[i];
+      var isTemplate = token.type === "template" && token.tpl === "whole";
+      if (token.type !== "string" && !isTemplate) continue;
+      var prev = significant(tokens, i, -1), next = significant(tokens, i, 1);
+      if (isTemplate && prev && (prev.raw === ")" || prev.raw === "]" || prev.raw === "}" ||
+        (prev.type === "word" && !REGEX_AFTER_WORD.test(prev.raw)))) continue;
+      if (next && next.raw === ":") continue;
+      if (next && next.raw === "(" && prev && (prev.raw === "{" || prev.raw === "," ||
+        prev.raw === "get" || prev.raw === "set")) continue;
+      if (prev && (prev.raw === "from" || prev.raw === "import" || prev.raw === "export")) continue;
+      if ((!prev || prev.raw === "{" || prev.raw === ";" || prev.raw === ":") &&
+        /^(['"])use (?:strict|asm)\1$/.test(token.raw)) continue;
+      var value = literalValue(token.raw);
+      if (typeof value !== "string" || value.length === 0) continue;
+      var chunks = splitString(value, opts);
+      if (chunks.length > 1) splitCount++;
+      var parts = [];
+      for (var c = 0; c < chunks.length; c++) {
+        var piece = chunks[c];
+        if (opts.stringEncryption) {
+          var bytes = utf8Bytes(piece);
+          if (key) bytes = rc4Bytes(key, bytes);
+          var encoded = base64FromBytes(bytes);
+          if (alphabet !== B64_STANDARD) encoded = applyAlphabet(encoded, alphabet);
+          if (reversed) encoded = encoded.split("").reverse().join("");
+          items.push(encoded);
+          logical.push(items.length - 1);
+          parts.push(null);
+        } else {
+          parts.push(quoteString(piece));
+        }
+      }
+      if (opts.stringEncryption) {
+        var start = logical.length - chunks.length, calls = [];
+        for (c = 0; c < chunks.length; c++) {
+          var call = ctx.names.runtime + "(" + encodeNumberExpr(logical[start + c]);
+          if (chance(0.3)) call += "," + encodeNumberExpr(randInt(64));
+          if (chance(0.15)) call += "," + encodeNumberExpr(randInt(64));
+          calls.push(call + ")");
+        }
+        token.raw = calls.length === 1 ? calls[0] : "(" + calls.join("+") + ")";
+      } else {
+        token.raw = parts.length === 1 ? parts[0] : "(" + parts.join("+") + ")";
+      }
+      count++;
+    }
+    var result = joinTokens(tokens);
+    if (!count) return { code: result, runtime: "", decoderText: "", count: 0, split: 0, entries: 0 };
+    if (!opts.stringEncryption) {
+      return { code: result, runtime: "", decoderText: "", count: 0, split: splitCount, entries: 0 };
+    }
+    // decoy entries: valid Base64 payloads that no call site references
+    var decoys = Math.max(0, Math.floor(opts.stringArrayDecoys)), d, j;
+    for (d = 0; d < decoys; d++) {
+      var junk = "", length = 8 + randInt(40);
+      for (j = 0; j < length; j++) junk += B64_STANDARD.charAt(randInt(64));
+      while (junk.length % 4 !== 0) junk += "=";
+      if (alphabet !== B64_STANDARD) junk = applyAlphabet(junk, alphabet);
+      if (reversed) junk = junk.split("").reverse().join("");
+      items.push(junk);
+    }
+    var order = [], index;
+    for (index = 0; index < items.length; index++) order.push(index);
+    if (opts.stringArrayShuffle) shuffle(order);
+    var entries = new Array(items.length), mapArray = new Array(logical.length);
+    for (index = 0; index < items.length; index++) entries[order[index]] = items[index];
+    for (index = 0; index < logical.length; index++) mapArray[index] = order[logical[index]];
+    var names = ctx.names;
+    var decoder = buildDecoderFunction(ctx, {
+      encoding: key ? "rc4" : "base64", reversed: reversed, shuffle: opts.stringArrayShuffle
     });
+    var runtime = "var " + names.runtime + "=(function(){" +
+      "var " + names.array + "=[\"" + entries.join("\",\"") + "\"];" +
+      (opts.stringArrayShuffle ? "var " + names.map + "=[" + mapArray.join(",") + "];" : "") +
+      (key ? "var " + names.key + "=[" + key.split("").map(function (character) {
+        return encodeNumberExpr(character.charCodeAt(0));
+      }).join(",") + "];" : "") +
+      "var " + names.alphabet + "=\"" + alphabet + "\";" +
+      decoder.declaration +
+      "return " + names.decoder + ";})();";
     return {
-      code: "var _0xord=[" + stmts.map(function (_, k) { return k; }).join(",") + "];" +
-        "for(var _0xst=0;_0xst<_0xord.length;_0xst++){switch(_0xord[_0xst]){" + cases.join("") + "}}",
-      deadCount: deadCount,
-      flattened: true
+      code: result, runtime: runtime, decoderText: decoder.text,
+      count: count, split: splitCount, entries: entries.length
     };
   }
-  function selfDefend(opts) {
-    // A harmless, isolated prelude. Freezing Object.prototype (as in the
-    // original sketch) mutates the host application and is intentionally avoided.
-    if (!opts.selfDefending) return "";
-    return '(function(){"use strict";void 0;})();';
+
+  /* =========================================================================
+   * 11. Opaque predicates, dead code and control-flow flattening
+   * ====================================================================== */
+  function opaquePredicate(wantTrue) {
+    var shapes = [
+      function () {
+        var a = randInt(0xffff), b = randInt(0xffff);
+        return "(" + encodeNumberExpr(a) + "^" + encodeNumberExpr(b) + ")===(" + encodeNumberExpr(a ^ b) + ")";
+      },
+      function () {
+        var length = randInt(4) + 1;
+        return "\"" + randomHexName(length) + "\".length!==" + encodeNumberExpr(randInt(3) + length + 1);
+      },
+      function () {
+        var a = randInt(0xffff), b = randInt(0xffff);
+        return "(" + encodeNumberExpr(a) + "|" + encodeNumberExpr(b) + ")%2===" + encodeNumberExpr((a | b) % 2);
+      },
+      function () {
+        var a = randInt(1000) + 2;
+        return "(function(){return " + encodeNumberExpr(a) + ";})()===" + encodeNumberExpr(a) + "?!!1:!!0";
+      },
+      function () {
+        var a = randInt(0xff) + 1;
+        return "(" + encodeNumberExpr(a) + "&" + encodeNumberExpr((a ^ randInt(0xff)) | 1) + ")!==-1";
+      },
+      function () {
+        var a = randInt(100000);
+        return "Number(\"" + a + "\")===" + encodeNumberExpr(a);
+      }
+    ];
+    var value, text, tries = 0;
+    do {
+      text = pick(shapes)();
+      try { value = Function('"use strict";return (' + text + ");")(); } catch (error) { value = undefined; }
+      tries++;
+    } while (typeof value !== "boolean" && tries < 12);
+    if (typeof value !== "boolean") {
+      return "1===1";
+    }
+    if (wantTrue === undefined) return value ? text : "!" + text;
+    return value === wantTrue ? text : "!(" + text + ")";
+  }
+  function deadStatement(ctx) {
+    var amount = Math.max(1, Math.floor(ctx.opts.deadCodeAmount));
+    var names = [], i;
+    for (i = 0; i < 6; i++) names.push(ctx.pool.name(4 + randInt(3)));
+    var lines = [], used = 0, flavor = randInt(5);
+    if (flavor === 0) {
+      lines.push("var " + names[0] + "=" + encodeNumberExpr(randInt(100000)) + "," + names[1] + "=" + encodeNumberExpr(randInt(100000)) + ";");
+      lines.push("function " + names[2] + "(" + names[3] + "," + names[4] + "){return " + names[3] + "*" + names[4] + "+" + encodeNumberExpr(randInt(1000)) + ";}");
+      lines.push("var " + names[5] + "=" + names[2] + "(" + names[0] + "," + names[1] + ");");
+      lines.push("if(" + names[5] + ">" + encodeNumberExpr(randInt(100000)) + "){" + names[0] + "=" + names[5] + ";}");
+    } else if (flavor === 1) {
+      lines.push("for(var " + names[0] + "=0;" + names[0] + "<" + encodeNumberExpr(randInt(4) + 2) + ";" + names[0] + "++){");
+      lines.push(names[1] + "=" + encodeNumberExpr(randInt(1000)) + "*" + names[0] + ";");
+      lines.push("if(" + names[1] + "===" + encodeNumberExpr(randInt(1000)) + ")break;}");
+      lines.push("var " + names[1] + "=" + encodeNumberExpr(randInt(1000)) + ";");
+    } else if (flavor === 2 && ctx.hasRuntime) {
+      lines.push("var " + names[0] + "=" + ctx.names.runtime + "(" + encodeNumberExpr(randInt(8)) + ");");
+      lines.push("var " + names[1] + "=" + names[0] + ".length+" + encodeNumberExpr(randInt(20)) + ";");
+      lines.push("if(" + names[1] + ">" + encodeNumberExpr(randInt(50)) + "){" + names[1] + "=null;}");
+    } else if (flavor === 3) {
+      lines.push("var " + names[0] + "=[" + encodeNumberExpr(randInt(99)) + "," + encodeNumberExpr(randInt(99)) + "];");
+      lines.push(names[0] + ".push(" + encodeNumberExpr(randInt(99)) + ");");
+      lines.push("var " + names[1] + "=" + names[0] + ".join(\"" + randomHexName(2) + "\");");
+      lines.push("if(" + names[1] + ".length>" + encodeNumberExpr(randInt(50)) + "){" + names[1] + "=null;}");
+    } else {
+      lines.push("var " + names[0] + "=\"" + randomHexName(6) + "\";");
+      lines.push("var " + names[1] + "=" + names[0] + ".split(\"\").reverse().join(\"\");");
+      lines.push("if(" + names[1] + "===\"" + randomHexName(5) + "\"){" + names[1] + "=" + names[0] + ";}");
+      lines.push("var " + names[2] + "=" + names[1] + ".length*" + encodeNumberExpr(randInt(9) + 1) + ";");
+    }
+    while (used < amount - 1 && lines.length < 9) {
+      // fresh names: a "var" must never collide with a block level "function"
+      lines.push("var " + ctx.pool.name(4 + randInt(3)) + "=" + encodeNumberExpr(randInt(100000)) + ";");
+      used++;
+    }
+    return "if(" + opaquePredicate(false) + "){" + lines.join("") + "}";
+  }
+  // Moves a run of statements into a shuffled switch. Two things are
+  // randomised independently: the switch labels and the order the case clauses
+  // appear in the source. The sequence array always lists the labels in their
+  // original execution order, so observable behaviour cannot change.
+  function buildDispatcher(ctx, statements, useGuard) {
+    var count = statements.length, index;
+    var labelPool = [];
+    for (index = 0; index < count * 3 + 3; index++) labelPool.push(index);
+    shuffle(labelPool);
+    var labels = labelPool.slice(0, count);
+    var layout = [];
+    for (index = 0; index < count; index++) layout.push(index);
+    shuffle(layout);
+    var loop = ctx.pool.name(5), sequence = ctx.pool.name(5), cases = [];
+    for (index = 0; index < count; index++) {
+      var position = layout[index];
+      cases.push("case " + labels[position] + ":{" + statements[position] + "}break;");
+    }
+    var decoys = "";
+    if (ctx.opts.deadCodeInjection && chance(0.8)) {
+      ctx.stats.deadCodeBlocks++;
+      for (index = 0; index < Math.max(1, Math.floor(ctx.opts.deadCodeAmount / 2)); index++) {
+        decoys += "case " + (100000 + randInt(900000)) + ":{" + deadStatement(ctx) + "}break;";
+      }
+    }
+    var guardOpen = "", guardClose = "";
+    if (useGuard) {
+      ctx.stats.opaquePredicates++;
+      guardOpen = "if(" + opaquePredicate(true) + "){";
+      guardClose = "}";
+    }
+    var sequenceEntries = [];
+    for (index = 0; index < count; index++) sequenceEntries.push(encodeNumberExpr(labels[index]));
+    ctx.stats.controlFlowBlocks++;
+    return "var " + sequence + "=[" + sequenceEntries.join(",") + "];" + guardOpen +
+      "for(var " + loop + "=0;" + loop + "<" + sequence + ".length;" + loop + "++){" +
+      "switch(" + sequence + "[" + loop + "]){" + cases.join("") + decoys + "}}" + guardClose;
+  }
+  function splitStatements(tokens, from, to, functionBodyEnds) {
+    var statements = [], depth = 0, start = from, i;
+    for (i = from; i < to; i++) {
+      var token = tokens[i];
+      if (token.type === "punct") {
+        if (token.raw === "{" || token.raw === "(" || token.raw === "[") depth++;
+        else if (token.raw === "}" || token.raw === ")" || token.raw === "]") depth--;
+        if (depth === 0 && token.raw === ";") {
+          statements.push({ start: start, end: i + 1 });
+          start = i + 1;
+          continue;
+        }
+      }
+      if (depth === 0 && functionBodyEnds[i]) {
+        var nextIndex = significantIndex(tokens, i, 1);
+        var nextToken = nextIndex === -1 ? null : tokens[nextIndex];
+        if (nextIndex === -1 || nextIndex >= to ||
+          (CONTINUES_EXPRESSION[nextToken.raw] !== true && nextToken.type !== "template")) {
+          statements.push({ start: start, end: i + 1 });
+          start = i + 1;
+        }
+      }
+    }
+    if (start < to) statements.push({ start: start, end: to });
+    var filtered = [];
+    for (i = 0; i < statements.length; i++) {
+      var hasCode = false;
+      for (var j = statements[i].start; j < statements[i].end; j++) {
+        if (isSignificant(tokens[j])) { hasCode = true; break; }
+      }
+      if (hasCode) filtered.push(statements[i]);
+    }
+    return filtered;
+  }
+  // Statements that may never be relocated into a switch case: block scoped
+  // declarations, hoisted declarations, any keyword whose statement is only
+  // meaningful next to a neighbour ("else", "while" of a do/while, ...), or a
+  // jump that would start targeting the generated loop.
+  var STATEMENT_STARTERS = (function () {
+    var words = ["let", "const", "function", "class", "import", "export",
+      "case", "default", "else", "catch", "finally", "break", "continue",
+      "while", "do", "with", "yield", "super"], map = Object.create(null);
+    for (var i = 0; i < words.length; i++) map[words[i]] = true;
+    return map;
+  })();
+  function significantTokensOf(tokens, statement) {
+    var list = [];
+    for (var i = statement.start; i < statement.end; i++) {
+      if (isSignificant(tokens[i])) list.push(tokens[i]);
+    }
+    return list;
+  }
+  // A statement may be moved into a switch case when doing so cannot change
+  // hoisting, scoping or ASI behaviour.
+  function statementEligible(tokens, statement) {
+    var list = significantTokensOf(tokens, statement);
+    if (!list.length) return false;
+    var first = list[0];
+    if (first.type === "word" && STATEMENT_STARTERS[first.raw]) return false;
+    if (first.type === "punct" && (first.raw === "{" || first.raw === ";")) return false;
+    if (list.length <= 2 && (first.type === "string" || first.type === "template") &&
+      (list.length === 1 || list[1].raw === ";")) return false;
+    if (first.type === "word" && list.length > 1 && list[1].raw === ":") return false;
+    var depth = 0;
+    for (var i = 0; i < list.length; i++) {
+      var token = list[i];
+      if (token.type === "punct") {
+        if (token.raw === "{" || token.raw === "(" || token.raw === "[") depth++;
+        else if (token.raw === "}" || token.raw === ")" || token.raw === "]") depth--;
+        continue;
+      }
+      if (token.type !== "word" || depth !== 0) continue;
+      // "var" hoists to the enclosing function either way, so it survives being
+      // wrapped in a block. "let"/"const" are block scoped and must not move.
+      if (token.raw === "let" || token.raw === "const") return false;
+      if (token.raw === "function" || token.raw === "class") {
+        var previous = i > 0 ? list[i - 1] : null;
+        // "async function f() {}", "function f() {}" and friends are real
+        // declarations: moving them into a block would drop the binding.
+        if (!previous || EXPRESSION_PREFIX[previous.raw] !== true) return false;
+      }
+    }
+    return true;
+  }
+  // A "function"/"class" keyword at the top level of a statement is only an
+  // expression (and therefore safe to relocate) when it follows one of these.
+  var EXPRESSION_PREFIX = (function () {
+    var puncts = ["=", "(", "[", ",", ":", "?", "!", "+", "-", "*", "/", "%",
+      "**", "&", "|", "^", "~", "<", ">", "<=", ">=", "===", "!==", "==", "!=",
+      "&&", "||", "??", "...", "=>", "+=", "-=", "*=", "/=", "%=", "**=",
+      "&&=", "||=", "??=", "&=", "|=", "^="];
+    var words = ["return", "typeof", "void", "delete", "new", "in", "of",
+      "instanceof", "case", "throw", "await", "yield", "default"];
+    var map = Object.create(null), i;
+    for (i = 0; i < puncts.length; i++) map[puncts[i]] = true;
+    for (i = 0; i < words.length; i++) map[words[i]] = true;
+    return map;
+  })();
+  var INJECTION_BLOCKERS = (function () {
+    var words = ["else", "while", "catch", "finally"], map = Object.create(null);
+    for (var i = 0; i < words.length; i++) map[words[i]] = true;
+    return map;
+  })();
+  function codeSlice(code, tokens, statement) {
+    return code.slice(tokens[statement.start].start, tokens[statement.end - 1].end);
+  }
+  function applyStructuralTransforms(code, ctx) {
+    var opts = ctx.opts, text = code, pass = 0, maxLevel = -1;
+    while (pass < 5) {
+      var tokens = tokenize(text), pairs = matchDelimiters(tokens);
+      var functions = findFunctionRegions(tokens, pairs);
+      var regions = [{ start: 0, end: tokens.length, depth: 0 }], deepest = 0, i;
+      for (i = 0; i < functions.length; i++) {
+        var depth = regionDepth(functions, functions[i]);
+        regions.push({ start: functions[i].bodyOpen + 1, end: functions[i].bodyClose, depth: depth });
+        if (depth > deepest) deepest = depth;
+      }
+      if (maxLevel === -1) maxLevel = deepest;
+      var level = maxLevel - pass;
+      if (level < 0) break;
+      var functionBodyEnds = Object.create(null);
+      for (i = 0; i < functions.length; i++) functionBodyEnds[functions[i].bodyClose] = true;
+      var edits = [];
+      for (i = 0; i < regions.length; i++) {
+        var region = regions[i];
+        if (region.depth !== level) continue;
+        var statements = splitStatements(tokens, region.start, region.end, functionBodyEnds);
+        if (!statements.length) continue;
+        var eligible = [], s;
+        for (s = 0; s < statements.length; s++) eligible[s] = statementEligible(tokens, statements[s]);
+        var runs = [], runStart = -1;
+        for (s = 0; s <= statements.length; s++) {
+          if (s < statements.length && eligible[s]) {
+            if (runStart === -1) runStart = s;
+            continue;
+          }
+          if (runStart !== -1) { runs.push({ from: runStart, to: s }); runStart = -1; }
+        }
+        var moved = Object.create(null);
+        for (var r = 0; r < runs.length; r++) {
+          var run = runs[r];
+          // The completion value of a script is taken from its last value
+          // producing statement, and a for/switch wrapper reports undefined.
+          // Keeping the final top level statement in place preserves it.
+          if (region.depth === 0 && run.to === statements.length) run.to--;
+          var length = run.to - run.from;
+          var flatten = opts.controlFlowFlattening && length >= 2;
+          if (flatten && opts.controlFlowThreshold < 1 && !chance(opts.controlFlowThreshold)) flatten = false;
+          if (flatten && run.from > 0) {
+            var previousFirst = significantTokensOf(tokens, statements[run.from - 1])[0];
+            if (previousFirst && previousFirst.raw === "do") flatten = false;
+          }
+          if (!flatten) continue;
+          var pieces = [];
+          for (s = run.from; s < run.to; s++) {
+            moved[s] = true;
+            var piece = codeSlice(text, tokens, statements[s]);
+            if (opts.opaquePredicates && chance(0.2)) {
+              ctx.stats.opaquePredicates++;
+              piece = "if(" + opaquePredicate(true) + "){" + piece + "}";
+            }
+            pieces.push(piece);
+          }
+          edits.push({
+            start: tokens[statements[run.from].start].start,
+            end: tokens[statements[run.to - 1].end - 1].end,
+            text: buildDispatcher(ctx, pieces, opts.opaquePredicates && chance(0.35))
+          });
+        }
+        for (s = 0; s < statements.length; s++) {
+          if (moved[s]) continue;
+          var statement = statements[s], list = significantTokensOf(tokens, statement);
+          var lastToken = tokens[statement.end - 1];
+          var nextStatement = s + 1 < statements.length ? statements[s + 1] : null;
+          var neighbourBlocks = false;
+          if (nextStatement) {
+            var nextFirst = significantTokensOf(tokens, nextStatement)[0];
+            neighbourBlocks = !!(nextFirst && INJECTION_BLOCKERS[nextFirst.raw]);
+          }
+          if (list[0] && list[0].raw === "do") neighbourBlocks = true;
+          var endsWithSemicolon = lastToken.type === "punct" && lastToken.raw === ";";
+          var terminates = !!(list[0] && /^(?:return|throw|break|continue)$/.test(list[0].raw));
+          // An injected "if" reports undefined, which would replace the script
+          // completion value, so the final top level statement stays untouched.
+          var keepsCompletion = region.depth === 0 && s === statements.length - 1;
+          if (opts.deadCodeInjection && endsWithSemicolon && !neighbourBlocks && !terminates &&
+            !keepsCompletion && (s === statements.length - 1 || chance(0.25))) {
+            ctx.stats.deadCodeBlocks++;
+            edits.push({ start: lastToken.end, end: lastToken.end, text: deadStatement(ctx) });
+          }
+          if (opts.opaquePredicates && eligible[s] && !neighbourBlocks && !keepsCompletion && chance(0.18)) {
+            ctx.stats.opaquePredicates++;
+            edits.push({
+              start: tokens[statement.start].start,
+              end: lastToken.end,
+              text: "if(" + opaquePredicate(true) + "){" + codeSlice(text, tokens, statement) + "}"
+            });
+          }
+        }
+      }
+      if (!edits.length) { pass++; continue; }
+      edits.sort(function (a, b) { return b.start - a.start || b.end - a.end; });
+      var lastStart = Infinity, applied = 0;
+      for (i = 0; i < edits.length; i++) {
+        if (edits[i].end > lastStart) continue;
+        text = text.slice(0, edits[i].start) + edits[i].text + text.slice(edits[i].end);
+        lastStart = edits[i].start;
+        applied++;
+      }
+      pass++;
+      if (!applied) break;
+    }
+    return text;
   }
 
-  function resolveOptions(options) {
-    if (options === undefined || options === null) return Object.assign({}, defaultOptions);
-    if (typeof options === "string") {
-      if (!Object.prototype.hasOwnProperty.call(presets, options)) {
-        throw new Error(NAME + ': unknown preset "' + options + '". Valid presets: ' + Object.keys(presets).join(", "));
+  /* =========================================================================
+   * 12. Runtime guards
+   * ====================================================================== */
+  var HASH_SEED = 5381;
+  // Whitespace is ignored by the hash, so reformatting the output does not trip
+  // the guard while renaming or patching generated functions does.
+  function hashText(text) {
+    var hash = HASH_SEED;
+    for (var i = 0; i < text.length; i++) {
+      var code = text.charCodeAt(i);
+      if (code <= 32) continue;
+      hash = ((hash << 5) + hash + code) >>> 0;
+    }
+    return hash;
+  }
+  // A prelude that verifies its own probe function (and the generated decoder
+  // when one exists) using Function.prototype.toString(). Any reformatting or
+  // patching of the output makes the hashes differ and the script throws.
+  function buildSelfDefending(ctx, probeText) {
+    var probeName = ctx.pool.name(4), hashName = ctx.pool.name(4);
+    var textName = ctx.pool.name(4), hashVar = ctx.pool.name(4), indexVar = ctx.pool.name(3);
+    var codeVar = ctx.pool.name(3);
+    var expected = hashText(probeText);
+    var decoyA = randInt(0xffff), decoyB = randInt(0xffff);
+    var probe = "var " + probeName + "=" + probeText + ";";
+    var text = ";(function(){" + probe +
+      "var " + hashName + "=function(" + textName + "){" +
+      "var " + hashVar + "=" + HASH_SEED + ";for(var " + indexVar + "=0;" + indexVar + "<" +
+      textName + ".length;" + indexVar + "++){var " + codeVar + "=" + textName + ".charCodeAt(" + indexVar + ");" +
+      "if(" + codeVar + ">32)" + hashVar + "=((" + hashVar + "<<5)+" + hashVar + "+" + codeVar + ")>>>0;}" +
+      "return " + hashVar + ";};" +
+      "if(" + hashName + "(" + probeName + ".toString())!==" + encodeNumberExpr(expected) + "||" +
+      "(" + encodeNumberExpr(decoyA) + "^" + encodeNumberExpr(decoyB) + ")!==(" + encodeNumberExpr(decoyA ^ decoyB) + ")){" +
+      "throw new Error(\"Unexpected token\");}" +
+      (ctx.decoderText
+        ? "if(typeof " + ctx.names.runtime + "===\"function\"&&" + hashName + "(" + ctx.names.runtime + ".toString())!==" +
+        encodeNumberExpr(hashText(ctx.decoderText)) + "){" +
+        "throw new Error(\"Unexpected token\");}"
+        : "") +
+      "})();";
+    return { text: text, probeText: probeText };
+  }
+  function buildDebugProtection(ctx) {
+    var tick = ctx.pool.name(4), timer = ctx.pool.name(4), start = ctx.pool.name(4);
+    var interval = Math.max(50, Math.floor(ctx.opts.debugProtectionInterval));
+    return ";(function(){" +
+      "var " + tick + "=function(){var " + start + "=(new Date()).getTime();debugger;" +
+      "return (new Date()).getTime()-" + start + ";};" +
+      "if(typeof setInterval===\"function\"){" +
+      "var " + timer + "=setInterval(" + tick + "," + interval + ");" +
+      "if(" + timer + "&&typeof " + timer + ".unref===\"function\")" + timer + ".unref();" +
+      "}})();";
+  }
+  function buildConsoleSilencer(ctx) {
+    var list = ctx.pool.name(4), index = ctx.pool.name(3);
+    return ";(function(){" +
+      "if(typeof console===\"undefined\")return;" +
+      "var " + list + "=[\"log\",\"info\",\"warn\",\"error\",\"debug\",\"trace\",\"dir\",\"table\",\"group\",\"groupEnd\",\"time\",\"timeEnd\",\"assert\",\"count\"];" +
+      "for(var " + index + "=0;" + index + "<" + list + ".length;" + index + "++){" +
+      "try{console[" + list + "[" + index + "]]=function(){};}catch(e){" + index + "=0;}}" +
+      "})();";
+  }
+
+  /* =========================================================================
+   * 13. Output compaction (token aware: never touches string/template bodies)
+   * ====================================================================== */
+  function compact(code) {
+    var tokens = tokenize(code), from = 0, to = tokens.length, out = "";
+    while (from < to && tokens[from].type === "space") from++;
+    while (to > from && tokens[to - 1].type === "space") to--;
+    for (var i = from; i < to; i++) {
+      var token = tokens[i];
+      if (token.type === "space") {
+        var lineComment = i > from && tokens[i - 1].type === "comment" && tokens[i - 1].raw.slice(0, 2) === "//";
+        out += token.raw.indexOf("\n") === -1 && !lineComment ? " " : "\n";
+      } else {
+        out += token.raw;
       }
-      return Object.assign({}, presets[options]);
     }
-    if (typeof options !== "object" || Array.isArray(options)) throw new TypeError("CloakJS: options must be a preset name or an object");
-    return Object.assign({}, defaultOptions, options);
+    return out;
   }
+
+  /* =========================================================================
+   * 14. The pipeline
+   * ====================================================================== */
   function obfuscateWithStats(source, options) {
-    if (typeof source !== "string") throw new TypeError("CloakJS: source must be a string");
-    var opts = resolveOptions(options), warnings = [];
-    // The injected decoder/dispatcher uses fixed helper names. Never shadow a
-    // user binding of the same spelling with those helpers.
-    if (tokenize(source).some(function (t) { return t.type === "word" && INTERNAL_SET[t.raw]; })) {
-      opts.stringEncryption = false;
-      opts.controlFlowFlattening = false;
-      opts.deadCodeInjection = false;
-      warnings.push("Generated helpers skipped because the source uses a reserved helper name.");
-    }
+    if (typeof source !== "string") throw new TypeError(NAME + ": source must be a string");
+    var opts = resolveOptions(options);
     var stats = {
-      identifiersRenamed: 0, stringsEncrypted: 0, numbersEncoded: 0,
-      deadCodeBlocks: 0, originalBytes: byteLength(source), obfuscatedBytes: 0, ratio: 1
+      identifiersRenamed: 0, identifiersEscaped: 0, stringsEncrypted: 0, stringsSplit: 0,
+      stringArrayEntries: 0, numbersEncoded: 0, controlFlowBlocks: 0, deadCodeBlocks: 0,
+      opaquePredicates: 0, originalBytes: 0, obfuscatedBytes: 0, ratio: 1,
+      techniques: [], seed: opts.seed === null ? null : opts.seed
+    };
+    var warnings = [];
+    stats.originalBytes = byteLength(source);
+    seedRandom(opts.seed);
+
+    var ctx = {
+      opts: opts, warnings: warnings, stats: stats, pool: new NamePool(),
+      generatedNames: Object.create(null), names: {}, hasRuntime: false, decoderText: ""
     };
-    // Keep a top-level strict directive before all generated helpers/preludes.
-    var strict = /^(\s*(['"])use strict\2\s*;?)/.exec(source);
-    var code = strict ? source.slice(strict[0].length) : source;
-    var mangled = mangleIdentifiers(code, opts);
-    code = mangled.code;
-    stats.identifiersRenamed = Object.keys(mangled.map).length;
-    var flat = flattenControlFlow(code, opts);
-    code = flat.code;
-    stats.deadCodeBlocks = flat.deadCount;
-    if (opts.controlFlowFlattening && !flat.flattened && splitTopLevel(source).length > 1) {
-      warnings.push("Control-flow flattening skipped for statements that may change scope or behavior.");
-    }
-    var enc = encryptStrings(code, opts);
-    code = enc.code;
-    stats.stringsEncrypted = enc.count;
-    var nums = encodeNumbers(code, opts);
-    code = nums.code;
-    stats.numbersEncoded = nums.count;
-    code = (strict ? strict[0].trim().replace(/;?$/, ";") + "\n" : "") +
-      selfDefend(opts) + (opts.selfDefending ? "\n" : "") + code;
-    if (opts.compactOutput) code = code.replace(/\n\s*\n/g, "\n").trim();
-    try { new Function(code); } catch (e) {
-      warnings.push("Output failed to parse: " + (e && e.message ? e.message : String(e)));
-    }
-    stats.obfuscatedBytes = byteLength(code);
+
+    var scanTokens = tokenize(source), i, key;
+    for (i = 0; i < scanTokens.length; i++) {
+      if (scanTokens[i].type === "word") ctx.pool.add(scanTokens[i].raw);
+    }
+    ctx.names = {
+      runtime: ctx.pool.name(6), decoder: ctx.pool.name(5), array: ctx.pool.name(4),
+      map: ctx.pool.name(4), key: ctx.pool.name(3), alphabet: ctx.pool.name(4)
+    };
+    for (key in ctx.names) {
+      if (Object.prototype.hasOwnProperty.call(ctx.names, key)) ctx.generatedNames[ctx.names[key]] = true;
+    }
+
+    // Renaming is unsafe when the input can reach bindings dynamically. The
+    // checks work on tokens, so "eval(" inside a string literal does not count.
+    var depth = 0, moduleSyntax = false, dynamicScope = false, dynamicCode = false;
+    for (i = 0; i < scanTokens.length; i++) {
+      var token = scanTokens[i];
+      if (token.type === "punct") {
+        if (token.raw === "{" || token.raw === "(" || token.raw === "[") depth++;
+        else if (token.raw === "}" || token.raw === ")" || token.raw === "]") depth--;
+        continue;
+      }
+      if (token.type !== "word") continue;
+      if (depth === 0 && (token.raw === "import" || token.raw === "export")) moduleSyntax = true;
+      var afterWord = significant(scanTokens, i, 1);
+      if (afterWord && afterWord.raw === "(") {
+        if (token.raw === "eval" || token.raw === "with") dynamicScope = true;
+        else if (token.raw === "Function") dynamicCode = true;
+      }
+    }
+    if (moduleSyntax) {
+      opts.skipMangling = true;
+      warnings.push("Module syntax (import/export) detected: identifier mangling and escaping were skipped.");
+    }
+    if (dynamicScope) {
+      opts.skipMangling = true;
+      warnings.push("eval() or with() detected: identifier mangling and escaping were skipped, because dynamic scope cannot be analysed.");
+    } else if (dynamicCode) {
+      opts.skipMangling = true;
+      warnings.push("Function() is called with generated source: identifier mangling and escaping were skipped, because the generated code may reference local names.");
+    }
+
+    // A leading "use strict" directive is lifted out and re-emitted in front of
+    // every generated statement, so the program keeps its strict semantics.
+    var code = source, strictText = "";
+    var directive = significantIndex(scanTokens, -1, 1);
+    if (directive !== -1 && scanTokens[directive].type === "string" &&
+      literalValue(scanTokens[directive].raw) === "use strict") {
+      var afterDirective = significantIndex(scanTokens, directive, 1);
+      var lineBreakAfter = directive + 1 < scanTokens.length &&
+        scanTokens[directive + 1].type === "space" &&
+        scanTokens[directive + 1].raw.indexOf("\n") !== -1;
+      var isDirective = afterDirective === -1 || scanTokens[afterDirective].raw === ";" || lineBreakAfter;
+      if (isDirective) {
+        var cut = scanTokens[directive].end;
+        if (afterDirective !== -1 && scanTokens[afterDirective].raw === ";") cut = scanTokens[afterDirective].end;
+        strictText = "\"use strict\";";
+        code = source.slice(cut);
+      }
+    }
+
+    if (opts.identifierMangling) {
+      var mangled = mangleIdentifiers(code, ctx);
+      code = mangled.code;
+      stats.identifiersRenamed = Object.keys(mangled.map).length;
+      if (stats.identifiersRenamed) stats.techniques.push("identifierMangling");
+      if (opts.preserveFunctionNames) stats.techniques.push("preserveFunctionNames");
+    }
+    if (opts.numberEncoding) {
+      code = encodeNumbers(code, ctx);
+      if (stats.numbersEncoded) stats.techniques.push("numberEncoding");
+    }
+    ctx.hasRuntime = !!opts.stringEncryption;
+    if (opts.controlFlowFlattening || opts.deadCodeInjection || opts.opaquePredicates) {
+      stats.controlFlowBlocks = 0;
+      stats.deadCodeBlocks = 0;
+      stats.opaquePredicates = 0;
+      code = applyStructuralTransforms(code, ctx);
+      if (stats.controlFlowBlocks) stats.techniques.push("controlFlowFlattening");
+      if (stats.deadCodeBlocks) stats.techniques.push("deadCodeInjection");
+      if (stats.opaquePredicates) stats.techniques.push("opaquePredicates");
+    }
+    var strings = encodeStrings(code, ctx);
+    code = strings.code;
+    stats.stringsEncrypted = strings.count;
+    stats.stringsSplit = strings.split;
+    stats.stringArrayEntries = strings.entries;
+    ctx.decoderText = strings.decoderText;
+    ctx.hasRuntime = strings.runtime !== "";
+    if (stats.stringsEncrypted) {
+      stats.techniques.push("stringEncryption");
+      if (opts.stringEncoding === "rc4" || opts.stringAlphabet === "shuffled") stats.techniques.push("stringCipher");
+      if (stats.stringArrayEntries > stats.stringsEncrypted) stats.techniques.push("stringArrayDecoys");
+    }
+    if (stats.stringsSplit) stats.techniques.push("stringSplitting");
+    if (opts.identifierEscaping) {
+      var escaped = escapeIdentifiers(code, ctx);
+      code = escaped.code;
+      stats.identifiersEscaped = escaped.count;
+      if (stats.identifiersEscaped) stats.techniques.push("identifierEscaping");
+    }
+
+    // Guards that must be in place before the payload runs come first, then the
+    // generated runtime, then the self-defending check (which hashes it), then
+    // the obfuscated program itself. There is nothing to guard when the input
+    // carries no code at all (comments or a lone directive).
+    var hasCode = false;
+    var codeTokens = tokenize(code);
+    for (i = 0; i < codeTokens.length; i++) {
+      if (isSignificant(codeTokens[i])) { hasCode = true; break; }
+    }
+    if (!hasCode) {
+      opts = Object.assign({}, opts, {
+        selfDefending: false, debugProtection: false, disableConsoleOutput: false
+      });
+    }
+    var preludes = "";
+    if (opts.disableConsoleOutput) {
+      preludes += buildConsoleSilencer(ctx) + "\n";
+      stats.techniques.push("disableConsoleOutput");
+    }
+    if (opts.debugProtection) {
+      preludes += buildDebugProtection(ctx) + "\n";
+      stats.techniques.push("debugProtection");
+    }
+    var runtime = ctx.hasRuntime ? strings.runtime + "\n" : "";
+    var guards = "";
+    if (opts.selfDefending) {
+      var probeArgument = ctx.pool.name(3);
+      var probe = "function(" + probeArgument + "){return (" + probeArgument + "^" +
+        encodeNumberExpr(randInt(0xffff)) + ")>>>0;}";
+      guards = buildSelfDefending(ctx, probe).text + "\n";
+      stats.techniques.push("selfDefending");
+    }
+    var body = preludes + runtime + guards + code;
+    var preface = strictText;
+    var output;
+    if (opts.wrapInIife) {
+      output = "(function(){" + (preface ? preface + "\n" : "") + body + "\n})();";
+      stats.techniques.push("wrapInIife");
+    } else {
+      output = (preface ? preface + "\n" : "") + body;
+    }
+    if (opts.compactOutput) output = compact(output);
+    try {
+      new Function(output);
+    } catch (error) {
+      warnings.push("Output failed to parse: " + (error && error.message ? error.message : String(error)));
+    }
+    stats.obfuscatedBytes = byteLength(output);
     stats.ratio = stats.originalBytes > 0 ? stats.obfuscatedBytes / stats.originalBytes : 1;
-    return { code: code, stats: stats, warnings: warnings };
+    return { code: output, stats: stats, warnings: warnings };
   }
+
   function obfuscate(source, options) { return obfuscateWithStats(source, options).code; }
   function measure(source, options) {
-    var res = obfuscateWithStats(source, options);
-    return { originalBytes: res.stats.originalBytes, obfuscatedBytes: res.stats.obfuscatedBytes, ratio: res.stats.ratio };
+    var result = obfuscateWithStats(source, options);
+    return {
+      originalBytes: result.stats.originalBytes,
+      obfuscatedBytes: result.stats.obfuscatedBytes,
+      ratio: result.stats.ratio
+    };
   }
+
+  var techniques = [
+    { key: "identifierMangling", name: "Identifier mangling", summary: "Renames declared bindings that provably stay inside their own scope.", changesBehavior: false },
+    { key: "preserveFunctionNames", name: "Preserve function names", summary: "Keeps function and class names, so Function#name and constructor.name stay readable.", changesBehavior: false },
+    { key: "identifierEscaping", name: "Identifier escaping", summary: "Rewrites identifiers with unicode escapes such as \\u005f0x1.", changesBehavior: false },
+    { key: "stringEncryption", name: "String encryption", summary: "Moves string literals into an encoded array with a generated decoder.", changesBehavior: false },
+    { key: "stringSplitting", name: "String splitting", summary: "Splits long strings into concatenated chunks, optionally as separate array entries.", changesBehavior: false },
+    { key: "stringCipher", name: "Alphabet substitution", summary: "Encodes the string array with a shuffled Base64 alphabet and/or RC4.", changesBehavior: false },
+    { key: "stringArrayDecoys", name: "String array decoys", summary: "Adds unused entries to the string array.", changesBehavior: false },
+    { key: "numberEncoding", name: "Number encoding", summary: "Rewrites numeric literals as arithmetic, hex, binary, octal or bit expressions.", changesBehavior: false },
+    { key: "controlFlowFlattening", name: "Control flow flattening", summary: "Moves statement runs into a shuffled switch dispatcher, inside function bodies as well as at top level.", changesBehavior: false },
+    { key: "deadCodeInjection", name: "Dead code injection", summary: "Inserts unreachable decoy statements, including never-selected dispatcher cases.", changesBehavior: false },
+    { key: "opaquePredicates", name: "Opaque predicates", summary: "Wraps statements in conditions whose value is computed at obfuscation time.", changesBehavior: false },
+    { key: "selfDefending", name: "Self-defending prelude", summary: "Hashes generated functions and throws when they have been patched (whitespace-only edits are tolerated).", changesBehavior: true },
+    { key: "debugProtection", name: "Debug protection", summary: "Installs a recurring debugger trap through a guarded setInterval.", changesBehavior: true },
+    { key: "disableConsoleOutput", name: "Console silencing", summary: "Replaces console methods with no-ops.", changesBehavior: true },
+    { key: "wrapInIife", name: "IIFE wrapper", summary: "Wraps the program so top-level declarations stop leaking globals.", changesBehavior: true }
+  ];
+
   return {
-    NAME: NAME, VERSION: VERSION, BANNER: BANNER, presets: presets,
-    defaultOptions: defaultOptions, resolveOptions: resolveOptions,
-    obfuscate: obfuscate, obfuscateWithStats: obfuscateWithStats, measure: measure
+    NAME: NAME,
+    VERSION: VERSION,
+    BANNER: BANNER,
+    presets: presets,
+    defaultOptions: defaultOptions,
+    techniques: techniques,
+    resolveOptions: resolveOptions,
+    obfuscate: obfuscate,
+    obfuscateWithStats: obfuscateWithStats,
+    measure: measure
   };
 });
diff --git a/cloakjs.min.js b/cloakjs.min.js
index fc8ed99..576602f 100644
--- a/cloakjs.min.js
+++ b/cloakjs.min.js
@@ -1,9 +1,15 @@
 /*!
- * CloakJS v1.2.0 — JavaScript Obfuscator
+ * CloakJS v1.3.0 — JavaScript Obfuscator
  * https://github.com/Infinitode/CloakJS
  *
  * A single-file, dependency-free JavaScript obfuscator for browsers and Node.
- * Load with a <script> tag to register global CloakJS, or require() in Node.
+ * Load with a <script> tag to register the global CloakJS, or require() it in Node.
+ *
+ * NOTE: CloakJS is NOT published on npm. There is a package named "cloakjs" on
+ * the npm registry, but it is an unrelated AOP/Proxy library maintained by
+ * someone else and installing that name does not give you this tool. Copy this
+ * file straight from the repository or from jsDelivr — see README.md.
+ *
  * MIT License — see LICENSE.
  */
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define([],function(){return t()}):e.CloakJS=t()}("undefined"!=typeof self?self:this,function(){"use strict";for(var e="1.2.0",t="CloakJS",n=t+" v"+e+" — JavaScript obfuscator · MIT License",r=["__RESULT__","__done","break","case","catch","class","const","continue","debugger","default","delete","do","else","enum","export","extends","false","finally","for","function","if","import","in","instanceof","new","null","return","super","switch","this","throw","true","try","typeof","var","void","while","with","yield","let","static","await","async","of","as","from","window","document","console","globalThis","Math","Object","Array","String","Number","Boolean","JSON","Date","RegExp","Error","Promise","Map","Set","WeakMap","WeakSet","Symbol","Reflect","Proxy","Function","arguments","undefined","Infinity","NaN","parseInt","parseFloat","isNaN","isFinite","encodeURIComponent","decodeURIComponent","encodeURI","decodeURI","eval","setTimeout","setInterval","clearTimeout","clearInterval","require","module","exports","__dirname","__filename","process"],o=Object.create(null),a=0;a<r.length;a++)o[r[a]]=!0;for(var i=["_0xa","_0xdc","_0xord","_0xst","_0xbt","_0xba","_0xbi","_0xb1","_0xbn","_0xbs","_0xh","_0xs","_0xo","_0xr","_0xj","_0xii","_0xl","_0xk","_0xt","_0xv","_0xpi","_0xd","_0xsd","_0xf","_0xi","_0xd1","_0xd2","_0xd4","_0xd5","_0xd6","_0x9a","_0xb","_0xe"],c=Object.create(null),s=0;s<i.length;s++)c[i[s]]=!0;var u={identifierMangling:!0,stringEncryption:!0,numberEncoding:!0,controlFlowFlattening:!0,deadCodeInjection:!0,selfDefending:!0,compactOutput:!0},f={off:{identifierMangling:!1,stringEncryption:!1,numberEncoding:!1,controlFlowFlattening:!1,deadCodeInjection:!1,selfDefending:!1,compactOutput:!0},low:{identifierMangling:!0,stringEncryption:!1,numberEncoding:!1,controlFlowFlattening:!1,deadCodeInjection:!1,selfDefending:!1,compactOutput:!0},medium:{identifierMangling:!0,stringEncryption:!0,numberEncoding:!0,controlFlowFlattening:!1,deadCodeInjection:!1,selfDefending:!1,compactOutput:!0},high:{identifierMangling:!0,stringEncryption:!0,numberEncoding:!0,controlFlowFlattening:!0,deadCodeInjection:!0,selfDefending:!0,compactOutput:!0},extreme:{identifierMangling:!0,stringEncryption:!0,numberEncoding:!0,controlFlowFlattening:!0,deadCodeInjection:!0,selfDefending:!0,compactOutput:!0}};function l(e){return Math.floor(Math.random()*e)}function d(e){for(var t="_0x",n=0;n<e;n++)t+="0123456789abcdef"[l(16)];return t}function x(e){for(var t="_",n=0;n<e;n++)t+=String.fromCharCode(19968+l(20991));return t}function _(e,t,n){n=n||8;var r,a=0;do{r=0===l(2)?d(n):x(n),++a>64&&(n++,a=0)}while(e[r]||o[r]||t[r]||c[r]);return e[r]=!0,r}function g(e){return"undefined"!=typeof TextEncoder?(new TextEncoder).encode(e).length:unescape(encodeURIComponent(e)).length}function p(e){for(var t="",n=0;n<e.length;n++)t+=("0"+e.charCodeAt(n).toString(16)).slice(-2);return function(e){if("function"==typeof btoa)return btoa(e);if("undefined"!=typeof Buffer)return Buffer.from(e,"latin1").toString("base64");throw new Error("CloakJS: Base64 encoding is unavailable")}(t)}function w(e,t){var n,r,o,a=new Uint8Array(256);for(n=0;n<256;n++)a[n]=n;for(r=0,n=0;n<256;n++)r=r+a[n]+e.charCodeAt(n%e.length)&255,o=a[n],a[n]=a[r],a[r]=o;n=0,r=0;for(var i=[],c=0;c<t.length;c++)r=r+a[n=n+1&255]&255,o=a[n],a[n]=a[r],a[r]=o,i.push(t.charCodeAt(c)^a[a[n]+a[r]&255]);for(var s="",u=0;u<i.length;u+=8192)s+=String.fromCharCode.apply(null,i.slice(u,u+8192));return s}function h(e){var t=[],n=0,r=null;function o(n,o,a){var i={type:n,raw:e.slice(o,a),start:o,end:a};t.push(i),"space"!==n&&"comment"!==n&&(r=i)}function a(){return!r||("word"===r.type?/^(return|throw|case|delete|void|typeof|instanceof|in|of|yield|await|else|do)$/.test(r.raw):"punct"===r.type&&/^(=|\(|\[|\{|,|;|:|!|&|\||\?|\+|-|\*|~|\^|%|<|>)$/.test(r.raw))}for(;n<e.length;){var i=n,c=e[n];if(/\s/.test(c)){for(;n<e.length&&/\s/.test(e[n]);)n++;o("space",i,n)}else if("/"===c&&"/"===e[n+1])(n=e.indexOf("\n",n+2))<0&&(n=e.length),o("comment",i,n);else if("/"===c&&"*"===e[n+1]){var s=e.indexOf("*/",n+2);o("comment",i,n=s<0?e.length:s+2)}else if("'"===c||'"'===c||"`"===c){for(n++;n<e.length;)if("\\"!==e[n]){if(e[n++]===c)break}else n+=2;o("`"===c?"template":"string",i,n)}else if("/"===c&&a()){n++;for(var u=!1;n<e.length;)if("\\"!==e[n]){if("["===e[n])u=!0;else if("]"===e[n])u=!1;else if("/"===e[n]&&!u){n++;break}n++}else n+=2;for(;n<e.length&&/[a-z]/i.test(e[n]);)n++;o("regex",i,n)}else if(/[A-Za-z_$]/.test(c)){for(n++;n<e.length&&/[A-Za-z0-9_$]/.test(e[n]);)n++;o("word",i,n)}else if(/[0-9]/.test(c)||"."===c&&/[0-9]/.test(e[n+1]||"")){var f=/^(?:0[xX][\da-fA-F_]+|0[bB][01_]+|0[oO][0-7_]+|(?:\d[\d_]*(?:\.[\d_]*)?|\.[\d_]+)(?:[eE][+-]?[\d_]+)?)(n?)/.exec(e.slice(n));o("number",i,n+=f?f[0].length:1)}else o("punct",i,++n)}return t}function v(e){return e.map(function(e){return e.raw}).join("")}function m(e,t,n){for(var r=t+n;r>=0&&r<e.length;r+=n)if("space"!==e[r].type&&"comment"!==e[r].type)return e[r];return null}function b(e){return'var _0xdc=function(_0xpi){var _0xv=_0xa[_0xpi];if(_0xv===undefined)return _0xv;var _0xh=atob(_0xv),_0xs=new Uint8Array(_0xh.length>>1);for(var _0xbi=0;_0xbi<_0xs.length;_0xbi++)_0xs[_0xbi]=parseInt(_0xh.substr(_0xbi<<1,2),16);var _0xk="'+e+'",_0xr=new Uint8Array(256);for(var _0xi=0;_0xi<256;_0xi++)_0xr[_0xi]=_0xi;var _0xj=0;for(var _0xi=0;_0xi<256;_0xi++){_0xj=(_0xj+_0xr[_0xi]+_0xk.charCodeAt(_0xi%_0xk.length))&255;var _0xt=_0xr[_0xi];_0xr[_0xi]=_0xr[_0xj];_0xr[_0xj]=_0xt;}var _0xii=0;_0xj=0;var _0xo=new Uint8Array(_0xs.length);for(var _0xl=0;_0xl<_0xs.length;_0xl++){_0xii=(_0xii+1)&255;_0xj=(_0xj+_0xr[_0xii])&255;var _0xt=_0xr[_0xii];_0xr[_0xii]=_0xr[_0xj];_0xr[_0xj]=_0xt;_0xo[_0xl]=_0xs[_0xl]^_0xr[(_0xr[_0xii]+_0xr[_0xj])&255];}var _0xsd=new TextDecoder().decode(_0xo);return _0xsd;};'}function y(e){if("undefined"!=typeof TextEncoder)return(new TextEncoder).encode(e);for(var t=unescape(encodeURIComponent(e)),n=[],r=0;r<t.length;r++)n.push(t.charCodeAt(r));return n}function j(e){if(Number.isSafeInteger(e)){var t=l(3),n=e<0?"-0x"+(-e).toString(16):"0x"+e.toString(16);if(0===t)return n;if(Math.abs(e)<4096){if(1===t){var r=l(64)+1;return r+"+"+(e-r)}var o=l(32)+2,a=Math.round(e/o);return o+"*"+a+"+"+(e-o*a)}return n}return String(e)}var C=["if(false){void 1}","if(false){void 2}","if(false){void 3}"];function E(e){var t=Math.min(C.length,Math.max(1,Math.ceil(e/3)));return C.slice(0,t)}function O(e){for(var t=h(e),n=[],r=0,o=0,a=0;a<t.length;a++){var i=t[a];if("punct"===i.type&&("{"!==i.raw&&"("!==i.raw&&"["!==i.raw||o++,"}"!==i.raw&&")"!==i.raw&&"]"!==i.raw||o--,";"===i.raw&&0===o)){var c=e.slice(r,i.end).trim();c&&n.push(c),r=i.end}}var s=e.slice(r).trim();return s&&n.push(s),n}function F(e){if(null==e)return Object.assign({},u);if("string"==typeof e){if(!Object.prototype.hasOwnProperty.call(f,e))throw new Error(t+': unknown preset "'+e+'". Valid presets: '+Object.keys(f).join(", "));return Object.assign({},f[e])}if("object"!=typeof e||Array.isArray(e))throw new TypeError("CloakJS: options must be a preset name or an object");return Object.assign({},u,e)}function S(e,t){if("string"!=typeof e)throw new TypeError("CloakJS: source must be a string");var n=F(t),r=[];h(e).some(function(e){return"word"===e.type&&c[e.raw]})&&(n.stringEncryption=!1,n.controlFlowFlattening=!1,n.deadCodeInjection=!1,r.push("Generated helpers skipped because the source uses a reserved helper name."));var a={identifiersRenamed:0,stringsEncrypted:0,numbersEncoded:0,deadCodeBlocks:0,originalBytes:g(e),obfuscatedBytes:0,ratio:1},s=/^(\s*(['"])use strict\2\s*;?)/.exec(e),u=s?e.slice(s[0].length):e,f=function(e,t){if(!t.identifierMangling)return{code:e,map:{}};var n,r,a,s,u=h(e),f=Object.create(null),l=Object.create(null);for(n=0;n<u.length;n++)"word"===(r=u[n]).type&&(l[r.raw]=!0);for(n=0;n<u.length;n++)"word"!==(r=u[n]).type||o[r.raw]||c[r.raw]||1===r.raw.length||(a=m(u,n,-1))&&/^(var|let|const|function)$/.test(a.raw)&&(f[r.raw]=!0);for((/\beval\s*\(|\bwith\s*\(/.test(e)||u.some(function(e){return"template"===e.type&&-1!==e.raw.indexOf("${")}))&&(f=Object.create(null)),n=0;n<u.length;n++)f[(r=u[n]).raw]&&(a=m(u,n,-1),s=m(u,n,1),(a&&("."===a.raw||"?"===a.raw&&m(u,n-1,-1)&&"."===m(u,n-1,-1).raw)||s&&":"===s.raw||a&&("{"===a.raw||","===a.raw)&&s&&(","===s.raw||"}"===s.raw||"("===s.raw))&&delete f[r.raw]);var d=Object.create(null),x=Object.create(null);for(n=0;n<i.length;n++)d[i[n]]=!0;for(var g in f)x[g]=_(d,l,8);for(n=0;n<u.length;n++)"word"===(r=u[n]).type&&x[r.raw]&&(r.raw=x[r.raw]);return{code:v(u),map:x}}(u,n);u=f.code,a.identifiersRenamed=Object.keys(f.map).length;var x=function(e,t){var n=O(e),r=0;if(!(n.length>1&&n.every(function(e){return/^(?:[A-Za-z_$][\w$]*\.)*[A-Za-z_$][\w$]*\s*\(/.test(e)&&!/\b(?:return|throw|break|continue|await|yield|var|let|const|function|class|import|export)\b/.test(e)})&&t.controlFlowFlattening)){if(t.deadCodeInjection&&n.length){var o=E(n.length);return r=o.length,{code:e+"\n;"+o.join(";"),deadCount:r,flattened:!1}}return{code:e,deadCount:0,flattened:!1}}if(t.deadCodeInjection){var a=E(n.length);r=a.length,n=n.concat(a)}for(var i=n.map(function(e,t){return t}),c=i.length-1;c>0;c--){var s=l(c+1),u=i[c];i[c]=i[s],i[s]=u}var f=i.map(function(e){return"case "+e+":{"+n[e]+"}break;"});return{code:"var _0xord=["+n.map(function(e,t){return t}).join(",")+"];for(var _0xst=0;_0xst<_0xord.length;_0xst++){switch(_0xord[_0xst]){"+f.join("")+"}}",deadCount:r,flattened:!0}}(u,n);u=x.code,a.deadCodeBlocks=x.deadCount,n.controlFlowFlattening&&!x.flattened&&O(e).length>1&&r.push("Control-flow flattening skipped for statements that may change scope or behavior.");var C=function(e,t){if(!t.stringEncryption)return{code:e,count:0};for(var n=h(e),r=d(10),o=[],a=0;a<n.length;a++){var i=n[a];if("string"===i.type){var c=m(n,a,-1),s=m(n,a,1);if(!(s&&":"===s.raw||s&&"("===s.raw&&c&&("{"===c.raw||","===c.raw||"get"===c.raw||"set"===c.raw))&&(c&&"{"!==c.raw&&";"!==c.raw||'"use strict"'!==i.raw&&"'use strict'"!==i.raw&&'"use asm"'!==i.raw&&"'use asm'"!==i.raw)&&(!c||"from"!==c.raw&&"import"!==c.raw&&"export"!==c.raw)){var u;try{u=Function('"use strict";return ('+i.raw+")")()}catch(e){continue}if(u){for(var f=y(u),l="",x=0;x<f.length;x++)l+=String.fromCharCode(f[x]);o.push(p(w(r,l))),i.raw="_0xdc("+(o.length-1)+")"}}}}return o.length?{code:"var _0xa=["+o.map(function(e){return'"'+e+'"'}).join(",")+"];"+b(r)+v(n),count:o.length}:{code:e,count:0}}(u,n);u=C.code,a.stringsEncrypted=C.count;var S=function(e,t){if(!t.numberEncoding)return{code:e,count:0};for(var n=h(e),r=0,o=0;o<n.length;o++){var a=n[o];if(!("number"!==a.type||a.raw.length<=1||/n$/.test(a.raw))){var i=m(n,o,-1),c=m(n,o,1);if(!(c&&(":"===c.raw||"."===c.raw||"("===c.raw&&i&&("{"===i.raw||","===i.raw))||i&&"."===i.raw)){var s=Number(a.raw);isFinite(s)&&(a.raw="("+j(s)+")",r++)}}}return{code:v(n),count:r}}(u,n);u=S.code,a.numbersEncoded=S.count,u=(s?s[0].trim().replace(/;?$/,";")+"\n":"")+function(e){return e.selfDefending?'(function(){"use strict";void 0;})();':""}(n)+(n.selfDefending?"\n":"")+u,n.compactOutput&&(u=u.replace(/\n\s*\n/g,"\n").trim());try{new Function(u)}catch(e){r.push("Output failed to parse: "+(e&&e.message?e.message:String(e)))}return a.obfuscatedBytes=g(u),a.ratio=a.originalBytes>0?a.obfuscatedBytes/a.originalBytes:1,{code:u,stats:a,warnings:r}}return{NAME:t,VERSION:e,BANNER:n,presets:f,defaultOptions:u,resolveOptions:F,obfuscate:function(e,t){return S(e,t).code},obfuscateWithStats:S,measure:function(e,t){var n=S(e,t);return{originalBytes:n.stats.originalBytes,obfuscatedBytes:n.stats.obfuscatedBytes,ratio:n.stats.ratio}}}});
\ No newline at end of file
+!function(e,r){"object"==typeof exports&&"undefined"!=typeof module?module.exports=r():"function"==typeof define&&define.amd?define([],function(){return r()}):e.CloakJS=r()}("undefined"!=typeof self?self:this,function(){"use strict";var e="CloakJS",r="1.3.0",t=e+" v"+r+" — JavaScript obfuscator · MIT License",n="0123456789abcdef",a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",o=Math.random;function i(e){return Math.floor(o()*e)}function s(e){return o()<e}function l(e){return e[i(e.length)]}function u(e){for(var r=e.length-1;r>0;r--){var t=i(r+1),n=e[r];e[r]=e[t],e[t]=n}return e}var c=["arguments","as","async","await","break","case","catch","class","const","continue","debugger","default","delete","do","else","enum","eval","export","extends","false","finally","for","from","function","get","if","implements","import","in","instanceof","interface","let","new","null","of","package","private","protected","public","return","set","static","super","switch","this","throw","true","try","typeof","undefined","var","void","while","with","yield"],f=["window","document","console","globalThis","self","global","module","exports","require","process","__dirname","__filename","Math","Object","Array","String","Number","Boolean","JSON","Date","RegExp","Error","TypeError","RangeError","SyntaxError","EvalError","Promise","Map","Set","WeakMap","WeakSet","Symbol","Reflect","Proxy","Function","Infinity","NaN","isNaN","isFinite","parseInt","parseFloat","encodeURIComponent","decodeURIComponent","encodeURI","decodeURI","setTimeout","setInterval","clearTimeout","clearInterval","requestAnimationFrame","atob","btoa","TextEncoder","TextDecoder","Uint8Array","Uint16Array","Uint32Array","Int8Array","Int16Array","Int32Array","Float32Array","Float64Array","BigInt","ArrayBuffer","SharedArrayBuffer","DataView","Intl","navigator","location","history","fetch","XMLHttpRequest","URL","Blob","File","FileReader","FormData","Headers","Request","Response","localStorage","sessionStorage","structuredClone","queueMicrotask","performance"],d=["_0xa","_0xdc","_0xord","_0xst","_0xbt","_0xba","_0xbi","_0xb1","_0xbn","_0xbs","_0xh","_0xs","_0xo","_0xr","_0xj","_0xii","_0xl","_0xk","_0xt","_0xv","_0xpi","_0xd","_0xsd","_0xf","_0xi","_0xd1","_0xd2","_0xd4","_0xd5","_0xd6","_0x9a","_0xb","_0xe"],p=Object.create(null),h=Object.create(null);!function(){var e,r=c.concat(f).concat(d);for(e=0;e<r.length;e++)p[r[e]]=!0;for(e=0;e<d.length;e++)h[d[e]]=!0}();for(var g=Object.create(null),w=0;w<c.length;w++)g[c[w]]=!0;function v(e){for(var r=0===i(2)?"_0x":"_$_",t=0;t<e;t++)r+=n[i(16)];return r}function m(e){for(var r="_",t=0;t<e;t++)r+=String.fromCharCode(19968+i(20901));return r}function y(e){for(var r="_",t=0;t<e;t++)r+=0===i(2)?n[i(16)]:String.fromCharCode(19968+i(20901));return r}function b(){this.used=Object.create(null)}b.prototype.add=function(e){return"string"==typeof e&&e&&(this.used[e]=!0),e},b.prototype.name=function(e){e=e||8;var r,t,n=0;do{r=0===(t=i(3))?v(e):1===t?m(Math.max(2,e-4)):y(e),++n>64&&(e++,n=0)}while(this.used[r]||p[r]);return this.used[r]=!0,r};var x={identifierMangling:"boolean",identifierEscaping:"boolean",preserveFunctionNames:"boolean",stringEncryption:"boolean",stringEncoding:["base64","rc4"],stringAlphabet:["standard","shuffled"],stringArrayShuffle:"boolean",stringArrayDecoys:"count",stringSplitting:"boolean",stringSplitMinLength:"count",stringSplitMaxParts:"count",numberEncoding:"boolean",controlFlowFlattening:"boolean",controlFlowThreshold:"ratio",deadCodeInjection:"boolean",deadCodeAmount:"count",opaquePredicates:"boolean",selfDefending:"boolean",debugProtection:"boolean",debugProtectionInterval:"count",disableConsoleOutput:"boolean",wrapInIife:"boolean",compactOutput:"boolean",seed:"seed"};function k(e){var r={identifierMangling:!0,identifierEscaping:!1,preserveFunctionNames:!1,stringEncryption:!0,stringEncoding:"rc4",stringAlphabet:"shuffled",stringArrayShuffle:!0,stringArrayDecoys:0,stringSplitting:!1,stringSplitMinLength:8,stringSplitMaxParts:4,numberEncoding:!0,controlFlowFlattening:!0,controlFlowThreshold:1,deadCodeInjection:!0,deadCodeAmount:3,opaquePredicates:!0,selfDefending:!0,debugProtection:!1,debugProtectionInterval:4e3,disableConsoleOutput:!1,wrapInIife:!1,compactOutput:!0,seed:null};for(var t in e)Object.prototype.hasOwnProperty.call(e,t)&&(r[t]=e[t]);return r}var C={off:k({identifierMangling:!1,stringEncryption:!1,numberEncoding:!1,controlFlowFlattening:!1,deadCodeInjection:!1,opaquePredicates:!1,selfDefending:!1}),low:k({stringEncryption:!1,numberEncoding:!1,controlFlowFlattening:!1,deadCodeInjection:!1,opaquePredicates:!1,selfDefending:!1}),medium:k({stringEncoding:"base64",stringAlphabet:"standard",stringArrayShuffle:!1,controlFlowFlattening:!1,deadCodeInjection:!1,opaquePredicates:!1,selfDefending:!1}),high:k({}),extreme:k({identifierEscaping:!0,stringSplitting:!0,stringSplitMinLength:6,stringSplitMaxParts:5,stringArrayDecoys:6,controlFlowThreshold:1,deadCodeAmount:6,debugProtection:!0,debugProtectionInterval:2500})},A=k({});function O(e){var r=x[e];return"boolean"===r?"must be true or false":"count"===r?"must be a non-negative integer":"ratio"===r?"must be a number between 0 and 1":"seed"===r?"must be a string, a number or null":Array.isArray(r)?"must be one of: "+r.join(", "):"is not a known option"}function E(r,t){var n=x[r];if(void 0===n)throw new TypeError(e+': unknown option "'+r+'"');if("boolean"!==n){if("count"!==n){if("ratio"!==n){if("seed"!==n){if(Array.isArray(n)&&-1===n.indexOf(t))throw new TypeError(e+': option "'+r+'" '+O(r))}else if(null!==t&&"string"!=typeof t&&"number"!=typeof t)throw new TypeError(e+': option "'+r+'" '+O(r))}else if("number"!=typeof t||!isFinite(t)||t<0||t>1)throw new TypeError(e+': option "'+r+'" '+O(r))}else if("number"!=typeof t||!isFinite(t)||t<0||Math.floor(t)!==t)throw new TypeError(e+': option "'+r+'" '+O(r))}else if("boolean"!=typeof t)throw new TypeError(e+': option "'+r+'" '+O(r))}function j(r){if(null==r)return Object.assign({},A);if("string"==typeof r){if(!Object.prototype.hasOwnProperty.call(C,r))throw new Error(e+': unknown preset "'+r+'". Valid presets: '+Object.keys(C).join(", "));return Object.assign({},C[r])}if("object"!=typeof r||Array.isArray(r))throw new TypeError(e+": options must be a preset name or an options object");var t=Object.assign({},A);for(var n in r)Object.prototype.hasOwnProperty.call(r,n)&&(E(n,r[n]),t[n]=r[n]);return t}function S(e){return"undefined"!=typeof TextEncoder?(new TextEncoder).encode(e).length:unescape(encodeURIComponent(e)).length}function I(e){if("undefined"!=typeof TextEncoder)return Array.prototype.slice.call((new TextEncoder).encode(e));for(var r=unescape(encodeURIComponent(e)),t=[],n=0;n<r.length;n++)t.push(r.charCodeAt(n));return t}function F(e){var r,t="";for(r=0;r<e.length;r++)t+=String.fromCharCode(e[r]);if("function"==typeof btoa)return btoa(t);if("undefined"!=typeof Buffer)return Buffer.from(t,"latin1").toString("base64");var n="";for(r=0;r<e.length;r+=3){var o=e[r],i=e[r+1],s=e[r+2];n+=a.charAt(o>>2),n+=a.charAt((3&o)<<4|(void 0===i?0:i)>>4),n+=void 0===i?"=":a.charAt((15&i)<<2|(void 0===s?0:s)>>6),n+=void 0===s?"=":a.charAt(63&s)}return n}function M(e,r){var t,n,a=new Array(256),o=0;for(t=0;t<256;t++)a[t]=t;for(t=0;t<256;t++)o=o+a[t]+e.charCodeAt(t%e.length)&255,n=a[t],a[t]=a[o],a[o]=n;var i=new Array(r.length);t=0,o=0;for(var s=0;s<r.length;s++)o=o+a[t=t+1&255]&255,n=a[t],a[t]=a[o],a[o]=n,i[s]=r[s]^a[a[t]+a[o]&255];return i}function _(e,r){for(var t="",n=0;n<e.length;n++){var o=a.indexOf(e.charAt(n));t+=-1===o?e.charAt(n):r.charAt(o)}return t}function B(e){return JSON.stringify(e).replace(/\u2028/g,"\\u2028").replace(/\u2029/g,"\\u2029")}function q(e){try{return Function('"use strict";return ('+e+");")()}catch(e){return}}var P=[">>>=","...","&&=","||=","??=","**=","<<=",">>=","===","!==",">>>","=>","?.","++","--","**","==","!=","<=",">=","&&","||","??","+=","-=","*=","/=","%=","&=","|=","^=","<<",">>"],T=/^(?:return|throw|case|delete|void|typeof|instanceof|in|of|yield|await|else|do|new)$/,R=Object.create(null);!function(){for(var e="([{,;:!&|?+-*~^%<>=",r=0;r<19;r++)R[e.charAt(r)]=!0;var t=["=>","===","!==","==","!=","<=",">=","&&","||","??","+=","-=","*=","/=","%=","&=","|=","^=","**","**=","&&=","||=","??=","<<=",">>=",">>>=","..."];for(r=0;r<t.length;r++)R[t[r]]=!0}();var D=Object.create(null);function N(e){var r=[],t=0,n=null,a=[];function o(t,a,o,i){var s={type:t,raw:e.slice(a,o),start:a,end:o};if(i)for(var l in i)s[l]=i[l];return r.push(s),"space"!==t&&"comment"!==t&&(n=s),s}function i(){return!n||("template"===n.type?"head"===n.tpl||"middle"===n.tpl:"word"===n.type?T.test(n.raw):"punct"===n.type&&!0===R[n.raw])}function s(r,t){for(var n=r+1;n<e.length;){var a=e[n];if("\\"!==a){if("`"===a)return o("template",r,++n,{tpl:t?"tail":"whole"}),{end:n,open:!1};if("$"===a&&"{"===e[n+1])return o("template",r,n+=2,{tpl:t?"middle":"head"}),{end:n,open:!0};n++}else n+=2}return o("template",r,n,{tpl:t?"tail":"whole"}),{end:n,open:!1}}for(;t<e.length;){var l=t,u=e[t];if(/\s/.test(u)){for(;t<e.length&&/\s/.test(e[t]);)t++;o("space",l,t)}else if("/"!==u||"/"!==e[t+1])if("/"!==u||"*"!==e[t+1])if("'"!==u&&'"'!==u)if("`"!==u)if("/"===u&&i()){t++;for(var c=!1;t<e.length;)if("\\"!==e[t]){if("\n"===e[t])break;if("["===e[t])c=!0;else if("]"===e[t])c=!1;else if("/"===e[t]&&!c){t++;break}t++}else t+=2;for(;t<e.length&&/[a-z]/i.test(e[t]);)t++;o("regex",l,t)}else if(/[A-Za-z_$]/.test(u)||u.charCodeAt(0)>127){for(t++;t<e.length&&(/[A-Za-z0-9_$]/.test(e[t])||e.charCodeAt(t)>127);)t++;o("word",l,t)}else if(/[0-9]/.test(u)||"."===u&&/[0-9]/.test(e[t+1]||"")){var f=/^(?:0[xX][\da-fA-F_]+|0[bB][01_]+|0[oO][0-7_]+|(?:\d[\d_]*(?:\.[\d_]*)?|\.[\d_]+)(?:[eE][+-]?[\d_]+)?)(n?)/.exec(e.slice(t));o("number",l,t+=f?f[0].length:1)}else{for(var d=null,p=0;p<P.length;p++){var h=P[p];if(e.substr(t,h.length)===h){if("?."===h&&/[0-9]/.test(e[t+2]||""))continue;d=h;break}}if(d)t+=d.length,a.length&&("{"===d?a[a.length-1]++:"}"===d&&a[a.length-1]--),o("punct",l,t);else{if(t++,"}"===u){if(a.length&&0===a[a.length-1]){var g=s(l,!0);t=g.end,g.open?a[a.length-1]=0:a.pop();continue}a.length&&a[a.length-1]--}else"{"===u&&a.length&&a[a.length-1]++;o("punct",l,t)}}else{var w=s(t,!1);t=w.end,w.open&&a.push(0)}else{for(t++;t<e.length;)if("\\"!==e[t]){if(e[t]===u){t++;break}if("\n"===e[t])break;t++}else t+=2;o("string",l,t)}else{var v=e.indexOf("*/",t+2);o("comment",l,t=v<0?e.length:v+2)}else{var m=e.indexOf("\n",t+2);o("comment",l,t=m<0?e.length:m)}}return r}function U(e){for(var r="",t=0;t<e.length;t++)r+=e[t].raw;return r}function L(e){return"space"!==e.type&&"comment"!==e.type}function $(e,r,t){for(var n=r+t;n>=0&&n<e.length;n+=t)if(L(e[n]))return n;return-1}function J(e,r,t){var n=$(e,r,t);return-1===n?null:e[n]}function W(e){for(var r=[],t=new Array(e.length),n=0;n<e.length;n++){var a=e[n];if("punct"===a.type)if("{"===a.raw||"("===a.raw||"["===a.raw)r.push(n);else if("}"===a.raw||")"===a.raw||"]"===a.raw){var o=r.pop();void 0!==o&&(t[o]=n,t[n]=o)}}return t}function z(e,r){for(var t=[],n=new Array(e.length),a=0;a<e.length;a++){var o=e[a];"punct"===o.type&&"}"===o.raw&&t.length&&r[t[t.length-1]]===a&&t.pop(),n[a]=t.length?t[t.length-1]:-1,"punct"===o.type&&"{"===o.raw&&t.push(a)}return n}function H(e,r){for(var t=Object.create(null),n=0;n<e.length;n++)if("punct"===e[n].type&&"{"===e[n].raw&&void 0!==r[n]){var a=J(e,n,-1);a&&("punct"===a.type&&D[a.raw]?t[n]=!0:"template"!==a.type||"head"!==a.tpl&&"middle"!==a.tpl?"word"===a.type&&D[a.raw]&&(t[n]=!0):t[n]=!0)}return t}function V(e,r){for(var t=Object.create(null),n=0;n<e.length;n++)if("word"===e[n].type&&"class"===e[n].raw)for(var a=n,o=0;-1!==(a=$(e,a,1));){var i=e[a].raw;if("("===i||"["===i)o++;else if(")"===i||"]"===i)o--;else{if("{"===i&&0===o){t[a]=!0;break}if(";"===i&&0===o)break}}return t}!function(){var e,r=["(","[",",",":","=","?","!","&&","||","??","+","-","*","/","%","**","<",">","<=",">=","===","!==","==","!=","&","|","^","~","...","+=","-=","*=","/=","%=","**=","&=","|=","^=","&&=","||=","??="],t=["return","typeof","in","of","instanceof","case","delete","void","yield","await","new","throw","default"];for(e=0;e<r.length;e++)D[r[e]]=!0;for(e=0;e<t.length;e++)D[t[e]]=!0}();var Z=function(){for(var e=["if","for","while","switch","catch","with","function","return","typeof","new","delete","void","instanceof","in","of","do","else","case","yield","await","throw"],r=Object.create(null),t=0;t<e.length;t++)r[e[t]]=!0;return r}(),X=function(){var e,r=["(",")","[","]","{","}",".","?.",",",";","+","-","*","/","%","**","==","===","!=","!==","<",">","<=",">=","&&","||","??","?",":","&","|","^","<<",">>",">>>","=","+=","-=","*=","/=","%=","**=","&&=","||=","??=","&=","|=","^=","=>"],t=Object.create(null),n=["in","instanceof"];for(e=0;e<r.length;e++)t[r[e]]=!0;for(e=0;e<n.length;e++)t[n[e]]=!0;return t}();function K(e,r){for(var t=[],n=H(e,r),a=V(e),o=z(e,r),i=0;i<e.length;i++){var s=e[i];if(L(s))if("word"!==s.type||"function"!==s.raw)if("punct"!==s.type||"=>"!==s.raw){if("punct"===s.type&&"("===s.raw&&void 0!==r[i]){var l=$(e,i,-1);if(-1===l||"word"!==e[l].type)continue;if(Z[e[l].raw])continue;var u=$(e,l,-1);if(-1!==u&&("function"===e[u].raw||"."===e[u].raw))continue;var c=$(e,r[i],1);if(-1===c||"{"!==e[c].raw||void 0===r[c])continue;var f=o[i];if(-1===f||!n[f]&&!a[f])continue;t.push({kind:"method",nameIndex:l,paramsOpen:i,paramsClose:r[i],bodyOpen:c,bodyClose:r[c]})}}else{var d=$(e,i,1);if(-1===d||"{"!==e[d].raw||void 0===r[d])continue;var p=$(e,i,-1),h=-1,g=-1;-1!==p&&")"===e[p].raw?(g=p,h=r[p]):-1!==p&&"word"===e[p].type&&(h=p,g=p),t.push({kind:"arrow",nameIndex:-1,paramsOpen:h,paramsClose:g,bodyOpen:d,bodyClose:r[d]})}else{var w=$(e,i,1);-1!==w&&"*"===e[w].raw&&(w=$(e,w,1));var v=-1;if(-1!==w&&"word"===e[w].type&&(v=w,w=$(e,w,1)),-1===w||"("!==e[w].raw||void 0===r[w])continue;var m=$(e,r[w],1);if(-1===m||"{"!==e[m].raw||void 0===r[m])continue;t.push({kind:"function",nameIndex:v,keywordIndex:i,paramsOpen:w,paramsClose:r[w],bodyOpen:m,bodyClose:r[m]})}}return t}function G(e,r){for(var t=1,n=0;n<e.length;n++){var a=e[n];a!==r&&(a.bodyOpen<r.bodyOpen&&a.bodyClose>r.bodyClose&&t++)}return t}function Q(e,r){for(var t="{"===r?"}":"("===r?")":"]",n=0,a=r;a<e.length;a++)if(e[a].raw===r)n++;else if(e[a].raw===t&&0===--n)return a;return-1}function Y(e,r){var t=r.opts,n=N(e),a=Object.create(null);if(t.skipMangling)return{code:e,map:a};var o,s,l=W(n),u=K(n,l),c=function(e,r){var t=Object.create(null);function n(r,n){for(var a=r;a<=n&&a<e.length;a++)t[a]=!0}function a(r){if(-1!==r){for(var t=e[r].raw,a="{"===t?"}":"]",o=0,i=r;i<e.length;i++)if(e[i].raw===t)o++;else if(e[i].raw===a&&0===--o)return void n(r,i);n(r,e.length-1)}}function o(r){for(var t=r;;){var n=$(e,t,1);if(-1===n)return;"{"!==e[n].raw&&"["!==e[n].raw||a(n);for(var o=0,i=n,s=!1;i<e.length;i++){var l=e[i].raw;if("punct"===e[i].type){if("("===l||"["===l||"{"===l)o++;else if(")"===l||"]"===l||"}"===l){if(0===o){s=!0;break}o--}else if(0===o&&(";"===l||","===l))break}else if(0===o&&"word"===e[i].type&&("in"===l||"of"===l)){s=!0;break}}if(i>=e.length||s)return;if("punct"!==e[i].type||","!==e[i].raw)return;t=i}}for(var i=0;i<e.length;i++){var s=e[i];if("word"===s.type)if("var"===s.raw||"let"===s.raw||"const"===s.raw)o(i);else if("catch"===s.raw){var l=$(e,i,1);if(-1!==l&&"("===e[l].raw&&-1!==Q(e,l)){var u=$(e,l,1);-1===u||"{"!==e[u].raw&&"["!==e[u].raw||a(u)}}}for(i=0;i<r.length;i++){var c=r[i];if(!(-1===c.paramsOpen||c.paramsClose<=c.paramsOpen))for(var f=0,d=c.paramsOpen+1;d<c.paramsClose;d++){var p=e[d];"punct"===p.type&&("("===p.raw||"["===p.raw||"{"===p.raw?(0===f&&"("!==p.raw&&a(d),f++):")"!==p.raw&&"]"!==p.raw&&"}"!==p.raw||f--)}}return t}(n,u),f=H(n,l),d=V(n),w=z(n,l),v=Object.create(null),m=Object.create(null),y=Object.create(null);for(o=0;o<n.length;o++)if("word"===(s=n[o]).type)v[s.raw]=!0,y[s.raw]||(y[s.raw]=[]),y[s.raw].push(o);else if("string"===s.type){var b=q(s.raw);"string"==typeof b&&b&&(m[b]=!0)}var x=[{start:0,end:n.length-1,top:!0}];for(o=0;o<u.length;o++)x.push({start:-1===u[o].paramsOpen?u[o].bodyOpen:u[o].paramsOpen,end:u[o].bodyClose});var k=Object.create(null);function C(e,r){if(-1!==e&&r){var t=n[e].raw;!t||p[t]||h[t]||(k[t]||(k[t]=[]),k[t].push(r))}}function A(e){C(e,function(e,r){for(var t=null,n=0;n<r.length;n++){var a=r[n];e>=a.start&&e<=a.end&&(!t||a.end-a.start<t.end-t.start)&&(t=a)}return t}(e,x))}for(o=0;o<n.length;o++)if("word"===(s=n[o]).type&&("var"===s.raw||"let"===s.raw||"const"===s.raw))for(var O=o;;){var E=$(n,O,1);if(-1===E)break;var j=n[E];if(")"===j.raw||";"===j.raw)break;"word"!==j.type||g[j.raw]||c[E]||A(E);for(var S=0,I=E,F=!1;I<n.length;I++){var M=n[I].raw;if("punct"===n[I].type){if("("===M||"["===M||"{"===M)S++;else if(")"===M||"]"===M||"}"===M){if(0===S){F=!0;break}S--}else if(0===S&&(";"===M||","===M))break}else if(0===S&&"word"===n[I].type&&("in"===M||"of"===M)){F=!0;break}}if(I>=n.length||F||"punct"!==n[I].type||","!==n[I].raw)break;O=I}for(o=0;o<u.length;o++){var _=u[o];if("function"===_.kind&&-1!==_.nameIndex&&!t.preserveFunctionNames){var B=$(n,_.keywordIndex,-1);-1===B||";"===n[B].raw||"{"===n[B].raw||"}"===n[B].raw||"word"===n[B].type&&("export"===n[B].raw||"default"===n[B].raw)?A(_.nameIndex):C(_.nameIndex,{start:_.nameIndex,end:_.bodyClose})}if(!(-1===_.paramsOpen||_.paramsClose<=_.paramsOpen)){var P,T={start:_.paramsOpen,end:_.bodyClose},R=[],D=[],L=0;for(P=_.paramsOpen+1;P<_.paramsClose;P++){var Z=n[P];if("punct"===Z.type)if("("===Z.raw||"["===Z.raw||"{"===Z.raw)L++;else if(")"===Z.raw||"]"===Z.raw||"}"===Z.raw)L--;else if(","===Z.raw&&0===L){R.push(D),D=[];continue}0!==L||"word"!==Z.type||"var"!==Z.raw&&"let"!==Z.raw&&"const"!==Z.raw?D.push(P):D=[]}D.length&&R.push(D);for(var X=0;X<R.length;X++){for(var G=R[X],Y=G.length,ee=0;ee<G.length;ee++)if("punct"===n[G[ee]].type&&"="===n[G[ee]].raw){Y=ee;break}for(ee=0;ee<Y;ee++){var re=G[ee];if(!c[re]&&("word"===n[re].type&&!g[n[re].raw])){C(re,T);break}}}}}for(o=0;o<n.length;o++)if("word"===(s=n[o]).type)if("class"===s.raw){if(t.preserveFunctionNames)continue;var te=$(n,o,1);if(-1===te)continue;if("word"!==n[te].type||"extends"===n[te].raw||g[n[te].raw])continue;var ne=$(n,o,-1);if(-1===ne||";"===n[ne].raw||"{"===n[ne].raw||"}"===n[ne].raw||"word"===n[ne].type&&("export"===n[ne].raw||"default"===n[ne].raw))A(te);else{for(var ae=-1,oe=te;-1!==(oe=$(n,oe,1))&&";"!==n[oe].raw;)if("{"===n[oe].raw){ae=oe;break}-1!==ae&&void 0!==l[ae]?C(te,{start:ae,end:l[ae]}):A(te)}}else if("catch"===s.raw){var ie=$(n,o,1);if(-1===ie||"("!==n[ie].raw||void 0===l[ie])continue;var se=$(n,ie,1);if(-1===se||se>=l[ie])continue;if("word"!==n[se].type||g[n[se].raw]||c[se])continue;A(se)}var le=Object.create(null);for(o=0;o<n.length;o++)if("word"===(s=n[o]).type){var ue=s.raw;if(!le[ue])if(p[ue]||h[ue]||c[o])le[ue]=!0;else{var ce=J(n,o,-1),fe=J(n,o,1);if(!ce||"."!==ce.raw&&"?."!==ce.raw&&"#"!==ce.raw)if(ce&&"..."===ce.raw)le[ue]=!0;else if(!fe||":"!==fe.raw||ce&&("case"===ce.raw||"?"===ce.raw)){var de=w[o];if(-1!==de&&(f[de]||d[de]))if(ce&&("{"===ce.raw||","===ce.raw)&&(!fe||","===fe.raw||"}"===fe.raw||"="===fe.raw||"("===fe.raw||":"===fe.raw)){le[ue]=!0;continue}m[ue]&&(le[ue]=!0)}else le[ue]=!0;else le[ue]=!0}}for(var pe in k)if(!le[pe]){var he=k[pe],ge=y[pe]||[],we=ge.length>0;for(o=0;o<ge.length&&we;o++){for(var ve=!1,me=0;me<he.length;me++){var ye=he[me];if(ge[o]>=ye.start&&ge[o]<=ye.end){ve=!0;break}}ve||(we=!1)}we&&(a[pe]=r.pool.name(2+i(4)))}for(o=0;o<n.length;o++)"word"===(s=n[o]).type&&a[s.raw]&&(s.raw=a[s.raw]);return{code:U(n),map:a}}function ee(e){for(var r="",t=0,n=0;n<e.length;n++){var a=e.charCodeAt(n),o=e.charAt(n);if((/[A-Za-z0-9]/.test(o)||a>127)&&s(.75)){for(var i=a.toString(16);i.length<4;)i="0"+i;r+="\\u"+i,t++}else r+=o}return t?r:e}function re(e){if("number"!=typeof e||!isFinite(e))return String(e);if(0===e)return s(.5)?"0x0":"0*("+(i(9)+1)+")";if(Number.isSafeInteger(e)&&Math.abs(e)<9007199254740991)return r=e,0===(o=i(9))?r<0?"-0x"+(-r).toString(16):"0x"+r.toString(16):1===o&&r>=0?"0b"+r.toString(2):2===o&&r>=0?"0o"+r.toString(8):3===o?r-(a=i(60)+1)+"+"+a:4===o&&0!==r?(n=i(6)+2)+"*"+(r-r%n)/n+"+"+r%n:5===o&&Math.abs(r)<2147483647?"("+(t=i(65535))+"^"+(t^r)+")":6===o&&r>=0&&r<2147483647?"("+(r&(t=i(65535)))+"|"+(r&~t)+")":7===o&&r>-1e5&&r<1e5?r+"*"+(a=1<<i(4)+1)+"/"+a:8===o&&r<0?"~"+~r:r*(a=1<<i(3)+1)+"/"+a;var r,t,n,a,o,l=1<<i(3)+1;return e+"*"+l+"/"+l}function te(e,r){if(!r.stringSplitting||e.length<r.stringSplitMinLength)return[e];var t=function(e){for(var r=[],t=0;t<e.length;t++){var n=e.charCodeAt(t);n>=55296&&n<=56319&&t+1<e.length?(r.push(e.substr(t,2)),t++):r.push(e.charAt(t))}return r}(e);if(t.length<2)return[e];var n=Math.ceil(t.length/Math.max(2,Math.floor(1.5*r.stringSplitMinLength)));n=Math.max(2,Math.min(Math.max(2,r.stringSplitMaxParts),n)),s(.25)&&(n=Math.max(2,n-1));for(var a=[],o=Math.ceil(t.length/n),l=0;l<t.length;){var u=o+(s(.4)?i(3)-1:0);u<1&&(u=1),l+u>=t.length&&(u=t.length-l),a.push(t.slice(l,l+u).join("")),l+=u}return a.length>1?a:[e]}function ne(e,r){var t=r.opts;if(!t.stringEncryption&&!t.stringSplitting)return{code:e,runtime:"",decoderText:"",count:0,split:0,entries:0};for(var n=N(e),o=t.stringEncryption&&"rc4"===t.stringEncoding?function(e){for(var r="",t=0;t<e;t++)r+=String.fromCharCode(33+i(94));return r}(6+i(10)):null,l=t.stringEncryption&&"shuffled"===t.stringAlphabet?u(a.split("")).join(""):a,c=!(!t.stringEncryption||"shuffled"!==t.stringAlphabet)&&s(.5),f=[],d=[],p=0,h=0,g=0;g<n.length;g++){var w=n[g],v="template"===w.type&&"whole"===w.tpl;if("string"===w.type||v){var m=J(n,g,-1),y=J(n,g,1);if((!v||!m||")"!==m.raw&&"]"!==m.raw&&"}"!==m.raw&&("word"!==m.type||T.test(m.raw)))&&(!y||":"!==y.raw)&&(!y||"("!==y.raw||!m||"{"!==m.raw&&","!==m.raw&&"get"!==m.raw&&"set"!==m.raw)&&(!m||"from"!==m.raw&&"import"!==m.raw&&"export"!==m.raw)&&(m&&"{"!==m.raw&&";"!==m.raw&&":"!==m.raw||!/^(['"])use (?:strict|asm)\1$/.test(w.raw))){var b=q(w.raw);if("string"==typeof b&&0!==b.length){var x=te(b,t);x.length>1&&h++;for(var k=[],C=0;C<x.length;C++){var A=x[C];if(t.stringEncryption){var O=I(A);o&&(O=M(o,O));var E=F(O);l!==a&&(E=_(E,l)),c&&(E=E.split("").reverse().join("")),f.push(E),d.push(f.length-1),k.push(null)}else k.push(B(A))}if(t.stringEncryption){var j=d.length-x.length,S=[];for(C=0;C<x.length;C++){var P=r.names.runtime+"("+re(d[j+C]);s(.3)&&(P+=","+re(i(64))),s(.15)&&(P+=","+re(i(64))),S.push(P+")")}w.raw=1===S.length?S[0]:"("+S.join("+")+")"}else w.raw=1===k.length?k[0]:"("+k.join("+")+")";p++}}}}var R=U(n);if(!p)return{code:R,runtime:"",decoderText:"",count:0,split:0,entries:0};if(!t.stringEncryption)return{code:R,runtime:"",decoderText:"",count:0,split:h,entries:0};var D,L,$=Math.max(0,Math.floor(t.stringArrayDecoys));for(D=0;D<$;D++){var W="",z=8+i(40);for(L=0;L<z;L++)W+=a.charAt(i(64));for(;W.length%4!=0;)W+="=";l!==a&&(W=_(W,l)),c&&(W=W.split("").reverse().join("")),f.push(W)}var H,V=[];for(H=0;H<f.length;H++)V.push(H);t.stringArrayShuffle&&u(V);var Z=new Array(f.length),X=new Array(d.length);for(H=0;H<f.length;H++)Z[V[H]]=f[H];for(H=0;H<d.length;H++)X[H]=V[d[H]];var K=r.names,G=function(e,r){var t=e.pool.name(4),n=e.pool.name(4),a=e.pool.name(4),o=e.pool.name(4),i=e.pool.name(3),s=e.pool.name(3),l=e.pool.name(3),u=e.pool.name(3),c=e.pool.name(3),f=e.pool.name(3),d=e.pool.name(3),p=e.pool.name(3),h=e.names,g="";g+="var "+n+"="+h.array+(r.shuffle?"["+h.map+"["+t+"]]":"["+t+"]")+";",g+="if("+n+"===undefined)return "+n+";",r.reversed&&(g+=n+"="+n+'.split("").reverse().join("");'),g+="var "+a+"={},"+i+"=0,"+s+"=0,"+o+"=0,"+l+"=[],"+p+"=0"+("rc4"===r.encoding?","+u+"=[],"+c+'="",'+f+"=0":"")+";",g+="for("+d+"=0;"+d+"<64;"+d+"++)"+a+"["+h.alphabet+".charCodeAt("+d+")]="+d+";",g+="for(;"+o+"<"+n+".length;"+o+"++){",g+=d+"="+a+"["+n+".charCodeAt("+o+")];",g+="if("+d+"===undefined)continue;",g+=s+"=("+s+"<<6)|"+d+";"+i+"+=6;",g+="if("+i+">=8){"+i+"-=8;"+l+".push(("+s+">>"+i+")&255);"+s+"&=(1<<"+i+")-1;}}","rc4"===r.encoding&&(g+="for("+o+"=0;"+o+"<"+h.key+".length;"+o+"++)"+c+"+=String.fromCharCode("+h.key+"["+o+"]);",g+="for("+o+"=0;"+o+"<256;"+o+"++)"+u+"["+o+"]="+o+";",g+=f+"=0;",g+="for("+o+"=0;"+o+"<256;"+o+"++){"+f+"=("+f+"+"+u+"["+o+"]+"+c+".charCodeAt("+o+"%"+c+".length))&255;"+d+"="+u+"["+o+"];"+u+"["+o+"]="+u+"["+f+"];"+u+"["+f+"]="+d+";}",g+=o+"=0;"+f+"=0;",g+="for("+d+"=0;"+d+"<"+l+".length;"+d+"++){"+o+"=("+o+"+1)&255;"+f+"=("+f+"+"+u+"["+o+"])&255;var "+i+"="+u+"["+o+"];"+u+"["+o+"]="+u+"["+f+"];"+u+"["+f+"]="+i+";"+l+"["+d+"]="+l+"["+d+"]^"+u+"[("+u+"["+o+"]+"+u+"["+f+"])&255];}"),g+='if(typeof TextDecoder!=="undefined"&&typeof Uint8Array!=="undefined"){try{return new TextDecoder().decode(new Uint8Array('+l+"));}catch("+d+"){}}",g+="var "+d+'="";'+p+"=0;",g+="while("+p+"<"+l+".length){",g+=o+"="+l+"["+p+"++];",g+="if("+o+"<128){"+d+"+=String.fromCharCode("+o+");continue;}",g+="if("+o+">191&&"+o+"<224){"+i+"="+l+"["+p+"++];"+d+"+=String.fromCharCode((("+o+"&31)<<6)|("+i+"&63));continue;}",g+="if("+o+">223&&"+o+"<240){"+i+"="+l+"["+p+"++];"+s+"="+l+"["+p+"++];"+d+"+=String.fromCharCode((("+o+"&15)<<12)|(("+i+"&63)<<6)|("+s+"&63));continue;}",g+=i+"="+l+"["+p+"++];"+s+"="+l+"["+p+"++];"+a+"="+l+"["+p+"++];",g+=i+"=(((("+o+"&7)<<18)|(("+i+"&63)<<12)|(("+s+"&63)<<6)|("+a+"&63))-65536);",g+=d+"+=String.fromCharCode(55296+("+i+">>10),56320+("+i+"&1023));}";var w="function("+t+"){"+(g+="return "+d+";")+"}";return{text:w,declaration:"var "+h.decoder+"="+w+";"}}(r,{encoding:o?"rc4":"base64",reversed:c,shuffle:t.stringArrayShuffle});return{code:R,runtime:"var "+K.runtime+"=(function(){var "+K.array+'=["'+Z.join('","')+'"];'+(t.stringArrayShuffle?"var "+K.map+"=["+X.join(",")+"];":"")+(o?"var "+K.key+"=["+o.split("").map(function(e){return re(e.charCodeAt(0))}).join(",")+"];":"")+"var "+K.alphabet+'="'+l+'";'+G.declaration+"return "+K.decoder+";})();",decoderText:G.text,count:p,split:h,entries:Z.length}}function ae(e){var r,t,n=[function(){var e=i(65535),r=i(65535);return"("+re(e)+"^"+re(r)+")===("+re(e^r)+")"},function(){var e=i(4)+1;return'"'+v(e)+'".length!=='+re(i(3)+e+1)},function(){var e=i(65535),r=i(65535);return"("+re(e)+"|"+re(r)+")%2==="+re((e|r)%2)},function(){var e=i(1e3)+2;return"(function(){return "+re(e)+";})()==="+re(e)+"?!!1:!!0"},function(){var e=i(255)+1;return"("+re(e)+"&"+re(e^i(255)|1)+")!==-1"},function(){var e=i(1e5);return'Number("'+e+'")==='+re(e)}],a=0;do{t=l(n)();try{r=Function('"use strict";return ('+t+");")()}catch(e){r=void 0}a++}while("boolean"!=typeof r&&a<12);return"boolean"!=typeof r?"1===1":void 0===e?r?t:"!"+t:r===e?t:"!("+t+")"}function oe(e){var r,t=Math.max(1,Math.floor(e.opts.deadCodeAmount)),n=[];for(r=0;r<6;r++)n.push(e.pool.name(4+i(3)));var a=[],o=0,s=i(5);for(0===s?(a.push("var "+n[0]+"="+re(i(1e5))+","+n[1]+"="+re(i(1e5))+";"),a.push("function "+n[2]+"("+n[3]+","+n[4]+"){return "+n[3]+"*"+n[4]+"+"+re(i(1e3))+";}"),a.push("var "+n[5]+"="+n[2]+"("+n[0]+","+n[1]+");"),a.push("if("+n[5]+">"+re(i(1e5))+"){"+n[0]+"="+n[5]+";}")):1===s?(a.push("for(var "+n[0]+"=0;"+n[0]+"<"+re(i(4)+2)+";"+n[0]+"++){"),a.push(n[1]+"="+re(i(1e3))+"*"+n[0]+";"),a.push("if("+n[1]+"==="+re(i(1e3))+")break;}"),a.push("var "+n[1]+"="+re(i(1e3))+";")):2===s&&e.hasRuntime?(a.push("var "+n[0]+"="+e.names.runtime+"("+re(i(8))+");"),a.push("var "+n[1]+"="+n[0]+".length+"+re(i(20))+";"),a.push("if("+n[1]+">"+re(i(50))+"){"+n[1]+"=null;}")):3===s?(a.push("var "+n[0]+"=["+re(i(99))+","+re(i(99))+"];"),a.push(n[0]+".push("+re(i(99))+");"),a.push("var "+n[1]+"="+n[0]+'.join("'+v(2)+'");'),a.push("if("+n[1]+".length>"+re(i(50))+"){"+n[1]+"=null;}")):(a.push("var "+n[0]+'="'+v(6)+'";'),a.push("var "+n[1]+"="+n[0]+'.split("").reverse().join("");'),a.push("if("+n[1]+'==="'+v(5)+'"){'+n[1]+"="+n[0]+";}"),a.push("var "+n[2]+"="+n[1]+".length*"+re(i(9)+1)+";"));o<t-1&&a.length<9;)a.push("var "+e.pool.name(4+i(3))+"="+re(i(1e5))+";"),o++;return"if("+ae(!1)+"){"+a.join("")+"}"}function ie(e,r,t){var n,a=r.length,o=[];for(n=0;n<3*a+3;n++)o.push(n);u(o);var l=o.slice(0,a),c=[];for(n=0;n<a;n++)c.push(n);u(c);var f=e.pool.name(5),d=e.pool.name(5),p=[];for(n=0;n<a;n++){var h=c[n];p.push("case "+l[h]+":{"+r[h]+"}break;")}var g="";if(e.opts.deadCodeInjection&&s(.8))for(e.stats.deadCodeBlocks++,n=0;n<Math.max(1,Math.floor(e.opts.deadCodeAmount/2));n++)g+="case "+(1e5+i(9e5))+":{"+oe(e)+"}break;";var w="",v="";t&&(e.stats.opaquePredicates++,w="if("+ae(!0)+"){",v="}");var m=[];for(n=0;n<a;n++)m.push(re(l[n]));return e.stats.controlFlowBlocks++,"var "+d+"=["+m.join(",")+"];"+w+"for(var "+f+"=0;"+f+"<"+d+".length;"+f+"++){switch("+d+"["+f+"]){"+p.join("")+g+"}}"+v}function se(e,r,t,n){var a,o=[],i=0,s=r;for(a=r;a<t;a++){var l=e[a];if("punct"!==l.type||("{"===l.raw||"("===l.raw||"["===l.raw?i++:"}"!==l.raw&&")"!==l.raw&&"]"!==l.raw||i--,0!==i||";"!==l.raw)){if(0===i&&n[a]){var u=$(e,a,1),c=-1===u?null:e[u];(-1===u||u>=t||!0!==X[c.raw]&&"template"!==c.type)&&(o.push({start:s,end:a+1}),s=a+1)}}else o.push({start:s,end:a+1}),s=a+1}s<t&&o.push({start:s,end:t});var f=[];for(a=0;a<o.length;a++){for(var d=!1,p=o[a].start;p<o[a].end;p++)if(L(e[p])){d=!0;break}d&&f.push(o[a])}return f}var le=function(){for(var e=["let","const","function","class","import","export","case","default","else","catch","finally","break","continue","while","do","with","yield","super"],r=Object.create(null),t=0;t<e.length;t++)r[e[t]]=!0;return r}();function ue(e,r){for(var t=[],n=r.start;n<r.end;n++)L(e[n])&&t.push(e[n]);return t}function ce(e,r){var t=ue(e,r);if(!t.length)return!1;var n=t[0];if("word"===n.type&&le[n.raw])return!1;if("punct"===n.type&&("{"===n.raw||";"===n.raw))return!1;if(t.length<=2&&("string"===n.type||"template"===n.type)&&(1===t.length||";"===t[1].raw))return!1;if("word"===n.type&&t.length>1&&":"===t[1].raw)return!1;for(var a=0,o=0;o<t.length;o++){var i=t[o];if("punct"!==i.type){if("word"===i.type&&0===a){if("let"===i.raw||"const"===i.raw)return!1;if("function"===i.raw||"class"===i.raw){var s=o>0?t[o-1]:null;if(!s||!0!==fe[s.raw])return!1}}}else"{"===i.raw||"("===i.raw||"["===i.raw?a++:"}"!==i.raw&&")"!==i.raw&&"]"!==i.raw||a--}return!0}var fe=function(){var e,r=["=","(","[",",",":","?","!","+","-","*","/","%","**","&","|","^","~","<",">","<=",">=","===","!==","==","!=","&&","||","??","...","=>","+=","-=","*=","/=","%=","**=","&&=","||=","??=","&=","|=","^="],t=["return","typeof","void","delete","new","in","of","instanceof","case","throw","await","yield","default"],n=Object.create(null);for(e=0;e<r.length;e++)n[r[e]]=!0;for(e=0;e<t.length;e++)n[t[e]]=!0;return n}(),de=function(){for(var e=["else","while","catch","finally"],r=Object.create(null),t=0;t<e.length;t++)r[e[t]]=!0;return r}();function pe(e,r,t){return e.slice(r[t.start].start,r[t.end-1].end)}function he(e){for(var r=5381,t=0;t<e.length;t++){var n=e.charCodeAt(t);n<=32||(r=(r<<5)+r+n>>>0)}return r}function ge(r,t){if("string"!=typeof r)throw new TypeError(e+": source must be a string");var n=j(t),a={identifiersRenamed:0,identifiersEscaped:0,stringsEncrypted:0,stringsSplit:0,stringArrayEntries:0,numbersEncoded:0,controlFlowBlocks:0,deadCodeBlocks:0,opaquePredicates:0,originalBytes:0,obfuscatedBytes:0,ratio:1,techniques:[],seed:null===n.seed?null:n.seed},l=[];a.originalBytes=S(r),function(e){if(null!=e){var r,t=String(e),n=2166136261;for(r=0;r<t.length;r++)n^=t.charCodeAt(r),n=Math.imul(n,16777619)>>>0;var a=0===n?2654435769:n;o=function(){return a^=a<<13,a>>>=0,a^=a>>>17,a^=a<<5,(a>>>=0)/4294967296}}else o=Math.random}(n.seed);var u,c,f={opts:n,warnings:l,stats:a,pool:new b,generatedNames:Object.create(null),names:{},hasRuntime:!1,decoderText:""},d=N(r);for(u=0;u<d.length;u++)"word"===d[u].type&&f.pool.add(d[u].raw);for(c in f.names={runtime:f.pool.name(6),decoder:f.pool.name(5),array:f.pool.name(4),map:f.pool.name(4),key:f.pool.name(3),alphabet:f.pool.name(4)},f.names)Object.prototype.hasOwnProperty.call(f.names,c)&&(f.generatedNames[f.names[c]]=!0);var g=0,w=!1,v=!1,m=!1;for(u=0;u<d.length;u++){var y=d[u];if("punct"!==y.type){if("word"===y.type){0!==g||"import"!==y.raw&&"export"!==y.raw||(w=!0);var x=J(d,u,1);x&&"("===x.raw&&("eval"===y.raw||"with"===y.raw?v=!0:"Function"===y.raw&&(m=!0))}}else"{"===y.raw||"("===y.raw||"["===y.raw?g++:"}"!==y.raw&&")"!==y.raw&&"]"!==y.raw||g--}w&&(n.skipMangling=!0,l.push("Module syntax (import/export) detected: identifier mangling and escaping were skipped.")),v?(n.skipMangling=!0,l.push("eval() or with() detected: identifier mangling and escaping were skipped, because dynamic scope cannot be analysed.")):m&&(n.skipMangling=!0,l.push("Function() is called with generated source: identifier mangling and escaping were skipped, because the generated code may reference local names."));var k=r,C="",A=$(d,-1,1);if(-1!==A&&"string"===d[A].type&&"use strict"===q(d[A].raw)){var O=$(d,A,1),E=A+1<d.length&&"space"===d[A+1].type&&-1!==d[A+1].raw.indexOf("\n");if(-1===O||";"===d[O].raw||E){var I=d[A].end;-1!==O&&";"===d[O].raw&&(I=d[O].end),C='"use strict";',k=r.slice(I)}}if(n.identifierMangling){var F=Y(k,f);k=F.code,a.identifiersRenamed=Object.keys(F.map).length,a.identifiersRenamed&&a.techniques.push("identifierMangling"),n.preserveFunctionNames&&a.techniques.push("preserveFunctionNames")}n.numberEncoding&&(k=function(e,r){if(!r.opts.numberEncoding)return e;for(var t=N(e),n=0,a=0;a<t.length;a++){var o=t[a];if(!("number"!==o.type||o.raw.length<=1||/n$/.test(o.raw))){var i=J(t,a,-1),s=J(t,a,1);if((!s||":"!==s.raw&&"."!==s.raw&&("("!==s.raw||!i||"{"!==i.raw&&","!==i.raw))&&(!i||"."!==i.raw&&"?."!==i.raw&&"#"!==i.raw)){var l=Number(o.raw.replace(/_/g,""));isFinite(l)&&(o.raw="("+re(l)+")",n++)}}}return r.stats.numbersEncoded=(r.stats.numbersEncoded||0)+n,U(t)}(k,f),a.numbersEncoded&&a.techniques.push("numberEncoding")),f.hasRuntime=!!n.stringEncryption,(n.controlFlowFlattening||n.deadCodeInjection||n.opaquePredicates)&&(a.controlFlowBlocks=0,a.deadCodeBlocks=0,a.opaquePredicates=0,k=function(e,r){for(var t=r.opts,n=e,a=0,o=-1;a<5;){var i,l=N(n),u=K(l,W(l)),c=[{start:0,end:l.length,depth:0}],f=0;for(i=0;i<u.length;i++){var d=G(u,u[i]);c.push({start:u[i].bodyOpen+1,end:u[i].bodyClose,depth:d}),d>f&&(f=d)}-1===o&&(o=f);var p=o-a;if(p<0)break;var h=Object.create(null);for(i=0;i<u.length;i++)h[u[i].bodyClose]=!0;var g=[];for(i=0;i<c.length;i++){var w=c[i];if(w.depth===p){var v=se(l,w.start,w.end,h);if(v.length){var m,y=[];for(m=0;m<v.length;m++)y[m]=ce(l,v[m]);var b=[],x=-1;for(m=0;m<=v.length;m++)m<v.length&&y[m]?-1===x&&(x=m):-1!==x&&(b.push({from:x,to:m}),x=-1);for(var k=Object.create(null),C=0;C<b.length;C++){var A=b[C];0===w.depth&&A.to===v.length&&A.to--;var O=A.to-A.from,E=t.controlFlowFlattening&&O>=2;if(E&&t.controlFlowThreshold<1&&!s(t.controlFlowThreshold)&&(E=!1),E&&A.from>0){var j=ue(l,v[A.from-1])[0];j&&"do"===j.raw&&(E=!1)}if(E){var S=[];for(m=A.from;m<A.to;m++){k[m]=!0;var I=pe(n,l,v[m]);t.opaquePredicates&&s(.2)&&(r.stats.opaquePredicates++,I="if("+ae(!0)+"){"+I+"}"),S.push(I)}g.push({start:l[v[A.from].start].start,end:l[v[A.to-1].end-1].end,text:ie(r,S,t.opaquePredicates&&s(.35))})}}for(m=0;m<v.length;m++)if(!k[m]){var F=v[m],M=ue(l,F),_=l[F.end-1],B=m+1<v.length?v[m+1]:null,q=!1;if(B){var P=ue(l,B)[0];q=!(!P||!de[P.raw])}M[0]&&"do"===M[0].raw&&(q=!0);var T="punct"===_.type&&";"===_.raw,R=!(!M[0]||!/^(?:return|throw|break|continue)$/.test(M[0].raw)),D=0===w.depth&&m===v.length-1;!t.deadCodeInjection||!T||q||R||D||m!==v.length-1&&!s(.25)||(r.stats.deadCodeBlocks++,g.push({start:_.end,end:_.end,text:oe(r)})),t.opaquePredicates&&y[m]&&!q&&!D&&s(.18)&&(r.stats.opaquePredicates++,g.push({start:l[F.start].start,end:_.end,text:"if("+ae(!0)+"){"+pe(n,l,F)+"}"}))}}}}if(g.length){g.sort(function(e,r){return r.start-e.start||r.end-e.end});var U=1/0,L=0;for(i=0;i<g.length;i++)g[i].end>U||(n=n.slice(0,g[i].start)+g[i].text+n.slice(g[i].end),U=g[i].start,L++);if(a++,!L)break}else a++}return n}(k,f),a.controlFlowBlocks&&a.techniques.push("controlFlowFlattening"),a.deadCodeBlocks&&a.techniques.push("deadCodeInjection"),a.opaquePredicates&&a.techniques.push("opaquePredicates"));var M=ne(k,f);if(k=M.code,a.stringsEncrypted=M.count,a.stringsSplit=M.split,a.stringArrayEntries=M.entries,f.decoderText=M.decoderText,f.hasRuntime=""!==M.runtime,a.stringsEncrypted&&(a.techniques.push("stringEncryption"),"rc4"!==n.stringEncoding&&"shuffled"!==n.stringAlphabet||a.techniques.push("stringCipher"),a.stringArrayEntries>a.stringsEncrypted&&a.techniques.push("stringArrayDecoys")),a.stringsSplit&&a.techniques.push("stringSplitting"),n.identifierEscaping){var _=function(e,r){if(r.opts.skipMangling)return{code:e,count:0};for(var t=N(e),n=0,a=0;a<t.length;a++){var o=t[a];if("word"===o.type&&!(p[o.raw]||h[o.raw]||r.generatedNames[o.raw])){var i=J(t,a,-1);if(!i||"#"!==i.raw){var s=ee(o.raw);s!==o.raw&&(o.raw=s,n++)}}}return{code:U(t),count:n}}(k,f);k=_.code,a.identifiersEscaped=_.count,a.identifiersEscaped&&a.techniques.push("identifierEscaping")}var B=!1,P=N(k);for(u=0;u<P.length;u++)if(L(P[u])){B=!0;break}B||(n=Object.assign({},n,{selfDefending:!1,debugProtection:!1,disableConsoleOutput:!1}));var T="";n.disableConsoleOutput&&(T+=function(e){var r=e.pool.name(4),t=e.pool.name(3);return';(function(){if(typeof console==="undefined")return;var '+r+'=["log","info","warn","error","debug","trace","dir","table","group","groupEnd","time","timeEnd","assert","count"];for(var '+t+"=0;"+t+"<"+r+".length;"+t+"++){try{console["+r+"["+t+"]]=function(){};}catch(e){"+t+"=0;}}})();"}(f)+"\n",a.techniques.push("disableConsoleOutput")),n.debugProtection&&(T+=function(e){var r=e.pool.name(4),t=e.pool.name(4),n=e.pool.name(4);return";(function(){var "+r+"=function(){var "+n+"=(new Date()).getTime();debugger;return (new Date()).getTime()-"+n+';};if(typeof setInterval==="function"){var '+t+"=setInterval("+r+","+Math.max(50,Math.floor(e.opts.debugProtectionInterval))+");if("+t+"&&typeof "+t+'.unref==="function")'+t+".unref();}})();"}(f)+"\n",a.techniques.push("debugProtection"));var R=f.hasRuntime?M.runtime+"\n":"",D="";if(n.selfDefending){var z=f.pool.name(3);D=function(e,r){var t=e.pool.name(4),n=e.pool.name(4),a=e.pool.name(4),o=e.pool.name(4),s=e.pool.name(3),l=e.pool.name(3),u=he(r),c=i(65535),f=i(65535);return{text:";(function(){var "+t+"="+r+";var "+n+"=function("+a+"){var "+o+"=5381;for(var "+s+"=0;"+s+"<"+a+".length;"+s+"++){var "+l+"="+a+".charCodeAt("+s+");if("+l+">32)"+o+"=(("+o+"<<5)+"+o+"+"+l+")>>>0;}return "+o+";};if("+n+"("+t+".toString())!=="+re(u)+"||("+re(c)+"^"+re(f)+")!==("+re(c^f)+')){throw new Error("Unexpected token");}'+(e.decoderText?"if(typeof "+e.names.runtime+'==="function"&&'+n+"("+e.names.runtime+".toString())!=="+re(he(e.decoderText))+'){throw new Error("Unexpected token");}':"")+"})();",probeText:r}}(f,"function("+z+"){return ("+z+"^"+re(i(65535))+")>>>0;}").text+"\n",a.techniques.push("selfDefending")}var H,V=T+R+D+k,Z=C;n.wrapInIife?(H="(function(){"+(Z?Z+"\n":"")+V+"\n})();",a.techniques.push("wrapInIife")):H=(Z?Z+"\n":"")+V,n.compactOutput&&(H=function(e){for(var r=N(e),t=0,n=r.length,a="";t<n&&"space"===r[t].type;)t++;for(;n>t&&"space"===r[n-1].type;)n--;for(var o=t;o<n;o++){var i=r[o];if("space"===i.type){var s=o>t&&"comment"===r[o-1].type&&"//"===r[o-1].raw.slice(0,2);a+=-1!==i.raw.indexOf("\n")||s?"\n":" "}else a+=i.raw}return a}(H));try{new Function(H)}catch(e){l.push("Output failed to parse: "+(e&&e.message?e.message:String(e)))}return a.obfuscatedBytes=S(H),a.ratio=a.originalBytes>0?a.obfuscatedBytes/a.originalBytes:1,{code:H,stats:a,warnings:l}}return{NAME:e,VERSION:r,BANNER:t,presets:C,defaultOptions:A,techniques:[{key:"identifierMangling",name:"Identifier mangling",summary:"Renames declared bindings that provably stay inside their own scope.",changesBehavior:!1},{key:"preserveFunctionNames",name:"Preserve function names",summary:"Keeps function and class names, so Function#name and constructor.name stay readable.",changesBehavior:!1},{key:"identifierEscaping",name:"Identifier escaping",summary:"Rewrites identifiers with unicode escapes such as \\u005f0x1.",changesBehavior:!1},{key:"stringEncryption",name:"String encryption",summary:"Moves string literals into an encoded array with a generated decoder.",changesBehavior:!1},{key:"stringSplitting",name:"String splitting",summary:"Splits long strings into concatenated chunks, optionally as separate array entries.",changesBehavior:!1},{key:"stringCipher",name:"Alphabet substitution",summary:"Encodes the string array with a shuffled Base64 alphabet and/or RC4.",changesBehavior:!1},{key:"stringArrayDecoys",name:"String array decoys",summary:"Adds unused entries to the string array.",changesBehavior:!1},{key:"numberEncoding",name:"Number encoding",summary:"Rewrites numeric literals as arithmetic, hex, binary, octal or bit expressions.",changesBehavior:!1},{key:"controlFlowFlattening",name:"Control flow flattening",summary:"Moves statement runs into a shuffled switch dispatcher, inside function bodies as well as at top level.",changesBehavior:!1},{key:"deadCodeInjection",name:"Dead code injection",summary:"Inserts unreachable decoy statements, including never-selected dispatcher cases.",changesBehavior:!1},{key:"opaquePredicates",name:"Opaque predicates",summary:"Wraps statements in conditions whose value is computed at obfuscation time.",changesBehavior:!1},{key:"selfDefending",name:"Self-defending prelude",summary:"Hashes generated functions and throws when they have been patched (whitespace-only edits are tolerated).",changesBehavior:!0},{key:"debugProtection",name:"Debug protection",summary:"Installs a recurring debugger trap through a guarded setInterval.",changesBehavior:!0},{key:"disableConsoleOutput",name:"Console silencing",summary:"Replaces console methods with no-ops.",changesBehavior:!0},{key:"wrapInIife",name:"IIFE wrapper",summary:"Wraps the program so top-level declarations stop leaking globals.",changesBehavior:!0}],resolveOptions:j,obfuscate:function(e,r){return ge(e,r).code},obfuscateWithStats:ge,measure:function(e,r){var t=ge(e,r);return{originalBytes:t.stats.originalBytes,obfuscatedBytes:t.stats.obfuscatedBytes,ratio:t.stats.ratio}}}});
\ No newline at end of file
diff --git a/test/cloakjs.test.js b/test/cloakjs.test.js
index 318666e..7a7c475 100644
--- a/test/cloakjs.test.js
+++ b/test/cloakjs.test.js
@@ -1,120 +1,845 @@
 "use strict";
-
+/*
+ * CloakJS test suite — run with `node --test` (no dependencies, no fixtures).
+ *
+ * The suite is deliberately behavioural: for every preset and option
+ * combination the obfuscated program is executed against the original one and
+ * the output of both has to match, because obfuscation is only useful when it
+ * does not change what a program does.
+ */
 const test = require("node:test");
 const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
 const vm = require("node:vm");
+
 const CloakJS = require("../cloakjs.js");
 
-function run(source, options) {
+const ALL_PRESETS = ["off", "low", "medium", "high", "extreme"];
+const SANDBOX_GLOBALS = {
+  TextEncoder, TextDecoder, atob, btoa, Uint8Array, Promise, Symbol, Map, Set,
+  WeakMap, WeakSet, JSON, Math, Date, Object, Array, String, Number, Boolean,
+  RegExp, Error, TypeError, RangeError, SyntaxError, isNaN, isFinite, parseInt,
+  parseFloat, BigInt, Intl, structuredClone, queueMicrotask, encodeURIComponent,
+  decodeURIComponent
+};
+
+/* ------------------------------------------------------------------ helpers */
+
+function run(code, options = {}) {
   const logs = [];
-  const sandbox = { console: { log: (...values) => logs.push(values) }, TextDecoder, atob };
-  const result = CloakJS.obfuscateWithStats(source, options);
-  vm.runInNewContext(result.code, sandbox);
-  return { logs, result };
+  const record = (...values) => logs.push(values.map((value) => {
+    if (typeof value === "string") return value;
+    try { return JSON.stringify(value) === undefined ? String(value) : JSON.stringify(value); }
+    catch (error) { return String(value); }
+  }).join(" "));
+  const sandbox = Object.assign({ console: {
+    log: record, info: record, warn: record, error: record, debug: record, trace: record,
+    dir: record, table: record, group: record, groupEnd: record, time: record,
+    timeEnd: record, assert: record, count: record
+  } }, SANDBOX_GLOBALS, options.globals || {});
+  const context = vm.createContext(sandbox);
+  const timerState = { intervals: 0, timeouts: 0, cleared: 0, unref: 0 };
+  if (options.timers) {
+    Object.assign(sandbox, {
+      setInterval: (fn, ms) => { timerState.intervals++; return { unref: () => { timerState.unref++; } }; },
+      setTimeout: (fn) => { timerState.timeouts++; return { unref: () => { timerState.unref++; } }; },
+      clearInterval: () => { timerState.cleared++; },
+      clearTimeout: () => { timerState.cleared++; }
+    });
+  }
+  const value = vm.runInContext(code, context, { timeout: 8000, filename: "cloakjs-output.js" });
+  return { logs, text: logs.join("\n"), value, sandbox, timers: timerState };
+}
+
+function obfuscate(source, options) {
+  return CloakJS.obfuscateWithStats(source, options);
+}
+
+function checkEquivalence(source, options, label) {
+  const expected = run(source);
+  const result = obfuscate(source, options);
+  assert.deepEqual(result.warnings, [], `${label}: unexpected warnings ${JSON.stringify(result.warnings)}`);
+  const actual = run(result.code, { timers: true });
+  assert.equal(actual.text, expected.text, `${label}: behaviour changed`);
+  assert.equal(
+    actual.value === undefined ? "undefined" : JSON.stringify(actual.value),
+    expected.value === undefined ? "undefined" : JSON.stringify(expected.value),
+    `${label}: script completion value changed`
+  );
+  return result;
+}
+
+function withPreset(preset, overrides) {
+  return Object.assign({}, CloakJS.resolveOptions(preset), overrides || {});
+}
+
+function techniqueKeys(stats) {
+  return stats.techniques.slice().sort().join(",");
+}
+
+/* --------------------------------------------------------------- fixtures */
+
+const SINK = `
+"use strict";
+var report = [];
+function say() { report.push(Array.prototype.slice.call(arguments).join("|")); }
+
+// numbers and strings
+var n = 1234567, big = 9007199254740991, neg = -4242, float = 0.15625, tiny = 1e-7;
+say("numbers", n, big, neg, float, tiny, n / 7, -0.5 * 4, Math.floor(3.99), 0.1 + 0.2);
+say("strings", "h\\u00e9llo \\ud83d\\ude0e", 'single', "line\\nnext\\ttab", "\\u0041\\x42", "quote\\"inside");
+
+// templates
+var name = "world", count = 3;
+say("template", \`hello \${name}, you have \${count + 1} messages\`);
+say("deep", \`outer \${ \`inner \${name.toUpperCase()}\` } tail\`);
+
+// functions, closures, recursion, defaults, rest
+function fib(k) { return k < 2 ? k : fib(k - 1) + fib(k - 2); }
+function counter(startValue) {
+  var total = startValue;
+  return function (step) { total += step === undefined ? 1 : step; return total; };
+}
+function withDefaults(a, b, c) { b = b === undefined ? 10 : b; c = c === undefined ? a * b : c; return [a, b, c]; }
+function rest(first) { var others = Array.prototype.slice.call(arguments, 1); return first + ":" + others.join("-"); }
+var bump = counter(5);
+say("fib", fib(10), bump(), bump(5), bump(-2));
+say("defaults", JSON.stringify(withDefaults(2)), JSON.stringify(withDefaults(2, 3)), JSON.stringify(withDefaults(2, 3, 4)));
+say("rest", rest("a", 1, 2, 3));
+
+// arrows
+var triple = (x) => x * 3;
+var shouty = (text) => { var upper = text.toUpperCase(); return upper + "!"; };
+var maker = () => ({ kind: "object" });
+say("arrows", triple(4), shouty("hi"), JSON.stringify(maker()), [1, 2, 3, 4].filter((x) => x % 2 === 0).map((x) => x * x).join(","));
+
+// objects: shorthand, computed keys, methods, getters, spread, generators
+var shortA = 1, shortB = 2;
+var obj = {
+  shortA, shortB,
+  ["key" + shortB]: "computed",
+  plain: 42,
+  method(x) { return this.plain + x; },
+  *gen(n) { for (var i = 0; i < n; i++) yield i * this.plain; },
+  get doubled() { return this.plain * 2; },
+  set doubled(value) { this.plain = value / 2; },
+  nested: { deep: { value: "found" } },
+  ...{ extra: true }
+};
+say("object", obj.shortA, obj.shortB, obj.key2, obj.method(8), obj.doubled, JSON.stringify(obj.nested.deep), String(obj.extra));
+say("generator", [...obj.gen(3)].join(","));
+obj.doubled = 100;
+say("setter", obj.plain, obj.doubled);
+var dynamicKey = "plain";
+say("dynamic", obj[dynamicKey], obj["nested"].deep.value);
+
+// destructuring
+var [first, , third = 9] = [1, 2, 3];
+var { shortA: renamedA, nested: { deep } } = obj;
+function destructured({ a, b = 5 }, [c, d] = [6, 7], ...extra) { return [a, b, c, d, extra.length].join(","); }
+try { throw { code: 7, info: { tag: "boom" } }; }
+catch ({ code, info: { tag } }) { say("catch", code, tag); }
+say("destructure", first, third, renamedA, deep.value, destructured({ a: 1 }, undefined, 1, 2), destructured({ a: 2, b: 3 }, [8, 9]));
+
+// classes
+class Base {
+  constructor(value) { this.value = value; }
+  describe() { return "base:" + this.value; }
+  get label() { return "L" + this.value; }
+  static create(v) { return new Base(v); }
+}
+class Child extends Base {
+  #secret = "hidden";
+  static counter = 0;
+  constructor(value) { super(value * 2); Child.counter++; }
+  describe() { return "child:" + this.value + ":" + this.#secret; }
+  reveal() { return this.#secret; }
+}
+var child = new Child(21);
+say("class", child.describe(), child.reveal(), child.label, Base.create(5).describe(), Child.counter);
+
+// control flow: labels, switch fallthrough, do while, for of/in, try finally
+var out = [];
+outer: for (var i = 0; i < 4; i++) { for (var j = 0; j < 4; j++) { if (j === 2) continue outer; if (i === 3) break outer; out.push(i + ":" + j); } }
+var order = [];
+function classify(value) { switch (value) { case 0: order.push("zero"); case 1: order.push("one"); break; case 2: order.push("two"); break; default: order.push("other"); } }
+classify(0); classify(1); classify(2); classify(5);
+var dw = 0; do { dw++; } while (dw < 3);
+var keys = []; for (var k in { a: 1, b: 2 }) keys.push(k);
+var values = []; for (var v of [10, 20]) values.push(v);
+var trace = [];
+function risky(flag) {
+  try { trace.push("try"); if (flag) throw new Error("boom"); return "ok"; }
+  catch (error) { trace.push("catch:" + error.message); return "handled"; }
+  finally { trace.push("finally"); }
 }
+say("flow", out.join(","), order.join(","), dw, keys.join(","), values.join(","), risky(true), risky(false), trace.join(","));
+
+// closures over loop variables, mutual recursion, iife, this
+var closers = [];
+for (let index = 0; index < 3; index++) closers.push(() => index * 10);
+function isEven(value) { return value === 0 ? true : isOdd(value - 1); }
+function isOdd(value) { return value === 0 ? false : isEven(value - 1); }
+var iifeValue = (function (seed) { var total = seed; total += 5; return total; })(7);
+var contextObj = { value: "ctx", read: function () { return this.value; }, readArrow: function () { return (() => this.value)(); } };
+say("closures", closers.map((fn) => fn()).join(","), isEven(10), isOdd(7), iifeValue, contextObj.read(), contextObj.readArrow());
+
+// optional chaining, nullish, spread, exponent, bitwise
+var maybe = { deep: { list: [1, 2, 3] } };
+say("optional", maybe?.deep?.list?.length, String(maybe?.missing?.value), null ?? "fallback", 0 ?? "kept");
+say("operators", 2 ** 10, 0b1010 & 0b0110, 5 << 3, ~0, -7 % 3, 7 / 2, "abc" + 1 + 2, 1 + 2 + "abc");
+var baseArray = [1, 2, 3];
+say("spread", [...baseArray, 4].join(","), Math.max(...baseArray), JSON.stringify({ ...maybe.deep }));
+
+// hoisting and immediate invocations
+var hoisted = (function () { return typeof innerFn; })();
+function innerFn() { return "hoisted"; }
+say("hoist", hoisted, innerFn());
+
+console.log(report.join("\\n"));
+`;
 
-test("UMD browser global and CommonJS expose the same API", () => {
-  const fs = require("node:fs");
-  const browser = {};
-  vm.runInNewContext(fs.readFileSync(require.resolve("../cloakjs.js"), "utf8"), browser);
-  assert.equal(browser.CloakJS.VERSION, "1.2.0");
+const SMALL = `
+function greet(name) { var message = "hello " + name; return message; }
+console.log(greet("world"), \`tpl \${1 + 1}\`, [1, 2, 3].map(function (v) { return v * 2; }).join("-"));
+`;
+
+/* ------------------------------------------------------------ module shape */
+
+test("UMD wrapper exposes the documented API", () => {
   assert.equal(CloakJS.NAME, "CloakJS");
+  assert.equal(CloakJS.VERSION, "1.3.0");
+  assert.match(CloakJS.BANNER, /CloakJS v1\.3\.0/);
+  for (const key of ["presets", "defaultOptions", "techniques", "resolveOptions", "obfuscate", "obfuscateWithStats", "measure"]) {
+    assert.ok(key in CloakJS, `missing export ${key}`);
+  }
   assert.equal(typeof CloakJS.obfuscate, "function");
+  assert.equal(typeof CloakJS.obfuscateWithStats, "function");
+  assert.equal(typeof CloakJS.measure, "function");
+  assert.ok(Object.isFrozen(CloakJS.presets) === false);
+});
+
+test("the library loads as a browser global with no module system", () => {
+  const source = fs.readFileSync(path.join(__dirname, "..", "cloakjs.js"), "utf8");
+  const sandbox = { self: {} };
+  sandbox.self.self = sandbox.self;
+  const context = vm.createContext(sandbox);
+  vm.runInContext(source, context, { filename: "cloakjs.js" });
+  const global = sandbox.CloakJS || sandbox.self.CloakJS;
+  assert.ok(global, "CloakJS was not registered on the global object");
+  assert.equal(global.VERSION, CloakJS.VERSION);
+  assert.deepEqual(Object.keys(global.presets), Object.keys(CloakJS.presets));
+  const fixture = 'console.log("browser", 1 + 2);';
+  const expected = run(fixture);
+  const logs = [];
+  vm.runInContext(global.obfuscate(fixture, { seed: 3 }), vm.createContext({
+    console: { log: (...values) => logs.push(values.join(" ")) }
+  }), { timeout: 5000 });
+  assert.equal(logs.join("\n"), expected.text);
+});
+
+/* --------------------------------------------------------------- presets */
+
+test("presets are complete, independent copies of the option set", () => {
+  const keys = Object.keys(CloakJS.defaultOptions);
+  assert.deepEqual(Object.keys(CloakJS.presets), ALL_PRESETS);
+  for (const preset of ALL_PRESETS) {
+    assert.deepEqual(Object.keys(CloakJS.presets[preset]).sort(), keys.slice().sort(), `${preset} is incomplete`);
+    const resolved = CloakJS.resolveOptions(preset);
+    assert.deepEqual(resolved, CloakJS.presets[preset]);
+    assert.notEqual(resolved, CloakJS.presets[preset], "resolveOptions must return a copy");
+    resolved.identifierMangling = "mutated";
+    assert.notEqual(CloakJS.presets[preset].identifierMangling, "mutated");
+  }
+  assert.deepEqual(CloakJS.resolveOptions(), CloakJS.defaultOptions);
+  assert.deepEqual(CloakJS.resolveOptions("high"), CloakJS.defaultOptions);
+  assert.deepEqual(CloakJS.resolveOptions({ stringEncryption: false }).stringEncryption, false);
+});
+
+test("presets form a ladder from off to extreme", () => {
+  const source = SINK;
+  const stats = {};
+  for (const preset of ALL_PRESETS) {
+    const result = obfuscate(source, withPreset(preset, { seed: 42 }));
+    assert.deepEqual(result.warnings, [], `${preset} warned`);
+    stats[preset] = { bytes: result.stats.obfuscatedBytes, techniques: result.stats.techniques.length, names: result.stats.identifiersRenamed };
+  }
+  assert.ok(stats.low.names > 0, "low should rename identifiers");
+  assert.ok(stats.medium.techniques > stats.low.techniques, "medium should add techniques");
+  assert.ok(stats.high.techniques > stats.medium.techniques, "high should add techniques");
+  assert.ok(stats.extreme.techniques > stats.high.techniques, "extreme should add techniques");
+  assert.ok(stats.extreme.bytes > stats.high.bytes, "extreme should produce more code than high");
+  assert.equal(CloakJS.presets.off.identifierMangling, false);
+  assert.equal(CloakJS.presets.off.stringEncryption, false);
+  assert.equal(CloakJS.presets.extreme.identifierEscaping, true);
+  assert.equal(CloakJS.presets.high.identifierEscaping, false);
+});
+
+test("extreme is a real mode, not a relabelled high", () => {
+  const source = SINK;
+  const high = obfuscate(source, withPreset("high", { seed: 7 }));
+  const extreme = obfuscate(source, withPreset("extreme", { seed: 7 }));
+  assert.notEqual(extreme.code, high.code);
+  assert.ok(extreme.stats.identifiersEscaped > 0, "extreme escapes identifiers");
+  assert.equal(high.stats.identifiersEscaped, 0, "high does not escape identifiers");
+  assert.ok(extreme.stats.stringsSplit > 0, "extreme splits strings");
+  assert.equal(high.stats.stringsSplit, 0, "high does not split strings");
+  assert.ok(extreme.stats.stringArrayEntries > extreme.stats.stringsEncrypted, "extreme adds decoy array entries");
+  assert.match(extreme.code, /debugger/);
+  assert.doesNotMatch(high.code, /debugger/);
+  assert.match(extreme.code, /\\u00[0-9a-f]{2}/i);
+});
+
+test("an empty or comment only input is returned as is, with no guards", () => {
+  for (const source of ["", "   \n\t ", "// just a comment\n", "/* block */", '"use strict";']) {
+    const result = obfuscate(source, "extreme");
+    assert.equal(result.code.trim(), source.trim() === "" ? "" : result.code.trim());
+    assert.doesNotMatch(result.code, /debugger|setInterval|Unexpected token/, `guards added to ${JSON.stringify(source)}`);
+    assert.equal(result.stats.controlFlowBlocks, 0);
+    assert.deepEqual(result.warnings, []);
+  }
+  assert.equal(obfuscate("").code, "");
+  assert.equal(obfuscate("   \n\t ").code, "");
+  assert.equal(obfuscate("// just a comment\n").code, "// just a comment");
+  const directive = obfuscate('"use strict";', "extreme");
+  assert.equal(directive.code, '"use strict";');
+});
+
+/* --------------------------------------------------------------- options */
+
+test("options are validated with useful errors", () => {
+  assert.throws(() => CloakJS.obfuscate("x", "ultra"), /unknown preset "ultra"/);
+  assert.throws(() => CloakJS.obfuscate("x", { nope: true }), /unknown option "nope"/);
+  assert.throws(() => CloakJS.obfuscate("x", { stringEncryption: "yes" }), /must be true or false/);
+  assert.throws(() => CloakJS.obfuscate("x", { stringEncoding: "xor" }), /must be one of: base64, rc4/);
+  assert.throws(() => CloakJS.obfuscate("x", { stringAlphabet: "rot13" }), /must be one of: standard, shuffled/);
+  assert.throws(() => CloakJS.obfuscate("x", { controlFlowThreshold: 2 }), /between 0 and 1/);
+  assert.throws(() => CloakJS.obfuscate("x", { deadCodeAmount: 1.5 }), /non-negative integer/);
+  assert.throws(() => CloakJS.obfuscate("x", { seed: {} }), /string, a number or null/);
+  assert.throws(() => CloakJS.obfuscate("x", []), /preset name or an options object/);
+  assert.throws(() => CloakJS.obfuscate(5), /source must be a string/);
+  assert.throws(() => CloakJS.obfuscate("x", { wrapInIife: 1 }), /must be true or false/);
+});
+
+test("every option key and technique is documented consistently", () => {
+  const optionKeys = Object.keys(CloakJS.defaultOptions).sort();
+  assert.ok(optionKeys.length >= 20, "option set shrank unexpectedly");
+  const techniqueKeysInMetadata = new Set(CloakJS.techniques.map((technique) => technique.key));
+  for (const technique of CloakJS.techniques) {
+    assert.equal(typeof technique.name, "string");
+    assert.equal(typeof technique.summary, "string");
+    assert.equal(typeof technique.changesBehavior, "boolean");
+  }
+  assert.ok(techniqueKeysInMetadata.has("identifierMangling"));
+  assert.ok(techniqueKeysInMetadata.has("preserveFunctionNames"));
+  assert.ok(techniqueKeysInMetadata.has("stringSplitting"));
+  assert.ok(techniqueKeysInMetadata.has("controlFlowFlattening"));
+  assert.ok(techniqueKeysInMetadata.has("selfDefending"));
+  assert.ok(techniqueKeysInMetadata.has("wrapInIife"));
+  assert.equal(CloakJS.techniques.find((t) => t.key === "wrapInIife").changesBehavior, true);
+  assert.equal(CloakJS.techniques.find((t) => t.key === "identifierMangling").changesBehavior, false);
+});
+
+test("returned stats always carry the documented keys", () => {
+  const result = obfuscate(SMALL, withPreset("extreme", { seed: 11 }));
+  const expectedKeys = [
+    "identifiersRenamed", "identifiersEscaped", "stringsEncrypted", "stringsSplit",
+    "stringArrayEntries", "numbersEncoded", "controlFlowBlocks", "deadCodeBlocks",
+    "opaquePredicates", "originalBytes", "obfuscatedBytes", "ratio", "techniques", "seed"
+  ];
+  assert.deepEqual(Object.keys(result.stats).sort(), expectedKeys.slice().sort());
+  assert.equal(result.stats.originalBytes, Buffer.byteLength(SMALL, "utf8"));
+  assert.equal(result.stats.obfuscatedBytes, Buffer.byteLength(result.code, "utf8"));
+  assert.equal(result.stats.ratio, result.stats.obfuscatedBytes / result.stats.originalBytes);
+  assert.equal(result.stats.seed, 11);
+  assert.equal(typeof result.code, "string");
+  assert.ok(result.stats.techniques.every((key) => typeof key === "string"));
+  assert.equal(new Set(result.stats.techniques).size, result.stats.techniques.length, "techniques must not repeat");
+  const measured = CloakJS.measure(SMALL, "medium");
+  assert.deepEqual(Object.keys(measured).sort(), ["obfuscatedBytes", "originalBytes", "ratio"]);
+  assert.ok(measured.ratio > 0);
+  assert.equal(measured.originalBytes, Buffer.byteLength(SMALL, "utf8"));
+});
+
+/* ------------------------------------------------------------ equivalence */
+
+test("every preset preserves the behaviour of a kitchen sink program", () => {
+  for (const preset of ALL_PRESETS) {
+    for (const seed of [0, 1, 2]) {
+      checkEquivalence(SINK, withPreset(preset, { seed }), `${preset}#${seed}`);
+    }
+  }
+});
+
+test("every preset preserves the behaviour of a small program, unseeded", () => {
+  for (const preset of ALL_PRESETS) {
+    for (let attempt = 0; attempt < 6; attempt++) {
+      checkEquivalence(SMALL, preset, `${preset} random #${attempt}`);
+    }
+  }
+});
+
+test("an option matrix preserves behaviour", () => {
+  const toggles = [
+    "identifierMangling", "identifierEscaping", "stringEncryption", "stringSplitting",
+    "numberEncoding", "controlFlowFlattening", "deadCodeInjection", "opaquePredicates",
+    "selfDefending", "compactOutput", "stringArrayShuffle", "preserveFunctionNames"
+  ];
+  const base = withPreset("high", { stringArrayDecoys: 3, stringSplitMinLength: 5, seed: 21 });
+  toggles.forEach((toggle, index) => {
+    const disabled = Object.assign({}, base);
+    disabled[toggle] = false;
+    checkEquivalence(SINK, disabled, `${toggle}: false`);
+    const enabled = Object.assign({}, base);
+    enabled[toggle] = true;
+    if (index % 3 === 0) checkEquivalence(SINK, enabled, `${toggle}: true`);
+  });
+  checkEquivalence(SINK, Object.assign({}, base, {
+    stringEncoding: "base64", stringAlphabet: "standard", stringArrayShuffle: false,
+    controlFlowThreshold: 0, deadCodeAmount: 1
+  }), "base64 standard alphabet, no shuffle, no flattening");
+  checkEquivalence(SINK, Object.assign({}, base, {
+    debugProtection: true, debugProtectionInterval: 1000, disableConsoleOutput: false
+  }), "debug protection");
+  checkEquivalence(SINK, Object.assign({}, base, {
+    stringEncoding: "rc4", stringAlphabet: "shuffled", stringSplitting: true, stringArrayDecoys: 12,
+    deadCodeAmount: 8, controlFlowThreshold: 1
+  }), "everything on");
+});
+
+/* ---------------------------------------------------------- reproducibility */
+
+test("a seed makes the output reproducible, different seeds do not", () => {
+  const options = { seed: "build-42", stringEncryption: true, identifierEscaping: true, deadCodeInjection: true };
+  const first = CloakJS.obfuscate(SMALL, options);
+  const second = CloakJS.obfuscate(SMALL, options);
+  assert.equal(first, second);
+  assert.notEqual(first, CloakJS.obfuscate(SMALL, Object.assign({}, options, { seed: "build-43" })));
+  assert.notEqual(first, CloakJS.obfuscate(SMALL, Object.assign({}, options, { seed: 42 })));
+  const numeric = CloakJS.obfuscate(SMALL, Object.assign({}, options, { seed: 0 }));
+  assert.equal(numeric, CloakJS.obfuscate(SMALL, Object.assign({}, options, { seed: 0 })));
+  assert.equal(obfuscate(SMALL, { seed: 5 }).stats.seed, 5);
+  assert.equal(obfuscate(SMALL, "high").stats.seed, null);
+});
+
+/* ------------------------------------------------------- dynamic scope etc. */
+
+test("eval, with, Function and modules are detected and reported", () => {
+  const cases = [
+    ['eval("1 + 1");', /eval\(\) or with\(\)/],
+    ['var scope = {}; with (scope) { }', /eval\(\) or with\(\)/],
+    ['var fn = new Function("return 1"); console.log(fn());', /Function\(\) is called with generated source/],
+    ['import value from "mod"; console.log(value);', /Module syntax/]
+  ];
+  for (const [source, pattern] of cases) {
+    const result = obfuscate(source, "high");
+    assert.ok(result.warnings.some((warning) => pattern.test(warning)), `${source} -> ${JSON.stringify(result.warnings)}`);
+    assert.deepEqual(result.stats.techniques.filter((key) => key === "identifierMangling"), [], "mangling must be skipped");
+  }
+  const innocent = 'console.log("eval( and with( inside a string"); var Function2 = 1; console.log(Function2);';
+  assert.deepEqual(obfuscate(innocent, "high").warnings, []);
+  assert.ok(obfuscate(innocent, "high").stats.techniques.includes("identifierMangling"));
+});
+
+test("dynamic string keys stop a spelling from being renamed", () => {
+  const source = [
+    'var state = { alpha: 1, beta: 2 };',
+    'function read(key) { return state[key]; }',
+    'var alpha = 5;',
+    'console.log(read("alpha"), alpha);'
+  ].join("\n");
+  const result = obfuscate(source, withPreset("low", { seed: 2 }));
+  assert.deepEqual(result.warnings, []);
+  assert.match(result.code, /alpha/, "a spelling used as a string key must stay readable");
+  assert.equal(run(result.code).text, run(source).text);
+});
+
+/* ------------------------------------------------------------- mangling */
+
+test("mangling never touches property names, keys, labels or patterns", () => {
+  const source = [
+    "var counter = { total: 0 };",
+    "function bump(amount) { counter.total = counter.total + (amount || 1); return counter.total; }",
+    "var shorthand = 4;",
+    "var literal = { shorthand: shorthand, explicit: shorthand };",
+    "loop: for (var index = 0; index < 2; index++) { if (index === 1) break loop; bump(index); }",
+    "var [one, two] = [1, 2];",
+    "var { total } = counter;",
+    "console.log(counter.total, literal.shorthand, literal.explicit, one, two, total);"
+  ].join("\n");
+  const result = obfuscate(source, withPreset("low", { seed: 3 }));
+  assert.deepEqual(result.warnings, []);
+  assert.match(result.code, /total/, "property names stay");
+  assert.match(result.code, /shorthand/, "object keys stay");
+  assert.match(result.code, /loop:/, "labels stay");
+  assert.equal(run(result.code).text, run(source).text);
+});
+
+test("a spelling that reaches out of its declaring scope is left alone", () => {
+  const source = [
+    "function declares() { var shared = 'local'; return shared; }",
+    "function refersToGlobal() { return typeof shared; }",
+    "function alsoGlobal() { return shared; }",
+    "console.log(declares(), refersToGlobal(), alsoGlobal());"
+  ].join("\n");
+  const globals = { shared: "from another script" };
+  const expected = run(source, { globals }).text;
+  for (let seed = 0; seed < 8; seed++) {
+    const result = obfuscate(source, withPreset("low", { seed }));
+    assert.deepEqual(result.warnings, []);
+    assert.match(result.code, /shared/, "the globals spelling must survive");
+    assert.equal(run(result.code, { globals }).text, expected, `seed ${seed}`);
+  }
+});
+
+test("mangling reaches parameters, catch clauses, classes and template substitutions", () => {
+  const source = [
+    "function uniqueOuter(uniqueParameter, uniqueOther) {",
+    "  var uniqueLocal = uniqueParameter + uniqueOther;",
+    "  try { throw new Error(String(uniqueLocal)); }",
+    "  catch (uniqueCatch) { uniqueLocal = uniqueCatch.message.length; }",
+    "  return `value ${uniqueLocal} of ${uniqueParameter}`;",
+    "}",
+    "class UniqueClass { constructor(uniqueValue) { this.uniqueValue = uniqueValue; } read() { return this.uniqueValue; } }",
+    "var uniqueInstance = new UniqueClass(3);",
+    "console.log(uniqueOuter(1, 2), uniqueInstance.read());"
+  ].join("\n");
+  const options = withPreset("low", {
+    seed: 4, stringEncryption: false, stringSplitting: false, numberEncoding: false,
+    controlFlowFlattening: false, deadCodeInjection: false, opaquePredicates: false, selfDefending: false
+  });
+  const result = obfuscate(source, options);
+  assert.deepEqual(result.warnings, []);
+  for (const spelling of ["uniqueParameter", "uniqueOther", "uniqueLocal", "uniqueCatch", "UniqueClass", "uniqueInstance"]) {
+    assert.doesNotMatch(result.code, new RegExp(`\\b${spelling}\\b`), `${spelling} should have been renamed`);
+  }
+  assert.match(result.code, /\$\{/, "the template substitutions must still be a template");
+  assert.match(result.code, /uniqueValue/, "the property name must survive");
+  assert.ok(result.stats.identifiersRenamed >= 6, `expected several renames, got ${result.stats.identifiersRenamed}`);
+  assert.equal(run(result.code).text, run(source).text);
+});
+
+test("preserveFunctionNames keeps function and class names readable", () => {
+  const source = `
+function visibleFunction(a) { return helperArrow(a) + VisibleClass.staticValue; }
+function helperArrow(a) { return a * 2; }
+class VisibleClass { static staticValue = 3; }
+console.log(visibleFunction(1), VisibleClass.name, visibleFunction.name);
+`;
+  const options = withPreset("low", { seed: 1, preserveFunctionNames: true, controlFlowFlattening: false, deadCodeInjection: false, opaquePredicates: false, selfDefending: false, stringEncryption: false, numberEncoding: false });
+  const result = obfuscate(source, options);
+  assert.deepEqual(result.warnings, []);
+  assert.match(result.code, /visibleFunction/);
+  assert.match(result.code, /VisibleClass/);
+  assert.equal(run(result.code).text, run(source).text);
 });
 
-test("every preset preserves the output of a small script", () => {
-  const source = 'var greeting = "héllo 😎"; console.log(greeting); console.log("second");';
-  for (const preset of Object.keys(CloakJS.presets)) {
-    for (let attempt = 0; attempt < 10; attempt++) {
-      const { logs, result } = run(source, preset);
-      assert.deepEqual(logs, [["héllo 😎"], ["second"]], preset);
-      assert.deepEqual(result.warnings.filter(w => /failed to parse/i.test(w)), []);
-      assert.equal(result.stats.originalBytes, Buffer.byteLength(source));
-      assert.equal(result.stats.obfuscatedBytes, Buffer.byteLength(result.code));
+test("identifier escaping produces valid, equivalent code", () => {
+  const result = obfuscate(SMALL, withPreset("extreme", { seed: 6 }));
+  assert.ok(result.stats.identifiersEscaped > 0);
+  assert.match(result.code, /\\u00/);
+  assert.deepEqual(result.warnings, []);
+  assert.equal(run(result.code).text, run(SMALL).text);
+});
+
+/* -------------------------------------------------------------- strings */
+
+test("string encryption keeps values, including non latin text", () => {
+  const source = `
+var values = ["ascii", "héllo", "emoji 😎 pair", "日本語テキスト", "\\u0000\\u001f", "quote\\"slash\\\\", ""];
+var lengths = values.map(function (value) { return value.length; });
+console.log(values.join("|"), lengths.join(","), [..."😎"].length);
+`;
+  for (const preset of ["medium", "high", "extreme"]) {
+    for (const seed of [0, 1, 2]) {
+      const result = obfuscate(source, withPreset(preset, { seed }));
+      assert.deepEqual(result.warnings, []);
+      assert.equal(run(result.code).text, run(source).text, `${preset}#${seed}`);
+      assert.equal(run(result.code, { globals: { TextDecoder: undefined, Uint8Array: undefined, atob: undefined } }).text,
+        run(source).text, `${preset}#${seed} without decoder globals`);
     }
   }
 });
 
-test("dispatcher preserves observable statement order", () => {
-  const source = 'console.log("first");console.log("second");console.log("third");';
-  for (let i = 0; i < 20; i++) {
-    const { logs, result } = run(source, "high");
-    assert.deepEqual(logs, [["first"], ["second"], ["third"]]);
-    assert.match(result.code, /switch\(_0xord\[_0xst\]\)/);
-    assert.ok(result.stats.deadCodeBlocks > 0);
+test("splitting a string never cuts a surrogate pair", () => {
+  const source = 'var emoji = "😎😎😎😎😎😎"; console.log(emoji, emoji.length, [...emoji].length);';
+  for (let seed = 0; seed < 20; seed++) {
+    const result = obfuscate(source, withPreset("extreme", { seed, stringSplitMinLength: 2, stringSplitMaxParts: 5 }));
+    assert.deepEqual(result.warnings, []);
+    assert.equal(run(result.code).text, run(source).text, `seed ${seed}`);
   }
+  const split = obfuscate(source, withPreset("extreme", { seed: 5, stringSplitMinLength: 2, stringSplitMaxParts: 5 }));
+  assert.ok(split.stats.stringsSplit > 0, "expected the emoji string to be split");
 });
 
-test("escaped strings, object keys, regexes, templates, numbers and comments", () => {
+test("string encryption can be turned off without disabling splitting", () => {
+  const source = 'var long = "abcdefghijklmnopqrstuvwxyz"; console.log(long, long.length);';
+  const result = obfuscate(source, {
+    seed: 9, identifierMangling: false, stringEncryption: false, stringSplitting: true,
+    stringSplitMinLength: 6, numberEncoding: false, controlFlowFlattening: false,
+    deadCodeInjection: false, opaquePredicates: false, selfDefending: false
+  });
+  assert.equal(result.stats.stringsEncrypted, 0);
+  assert.equal(result.stats.stringArrayEntries, 0);
+  assert.ok(result.stats.stringsSplit > 0);
+  assert.match(result.code, /"\+"/, "the literal must be concatenated from chunks");
+  assert.equal(run(result.code).text, run(source).text);
+});
+
+test("string array decoys do not change decoded values", () => {
+  const result = obfuscate(SMALL, withPreset("high", { seed: 8, stringArrayDecoys: 24 }));
+  assert.ok(result.stats.stringArrayEntries > result.stats.stringsEncrypted);
+  assert.deepEqual(result.warnings, []);
+  assert.equal(run(result.code).text, run(SMALL).text);
+});
+
+/* ------------------------------------------------------------- numbers */
+
+test("number encoding preserves every literal value", () => {
+  const source = `
+var values = [0, 1, 42, 1234, 98765, 2147483647, 9007199254740991, -4242, -0.15625, 0.1, 1e-7, 1e21, 0x1f, 0b1010, 0o17, 1_000_000];
+var out = values.map(function (value) { return String(value); });
+out.push(String(0.1 + 0.2), String(1 / 3), String(2 ** 53), String(-0));
+console.log(out.join("|"));
+`;
+  for (const preset of ["medium", "high", "extreme"]) {
+    for (const seed of [0, 1, 2, 3]) {
+      const result = obfuscate(source, withPreset(preset, { seed }));
+      assert.deepEqual(result.warnings, []);
+      assert.ok(result.stats.numbersEncoded >= 11, `${preset}#${seed}: ${result.stats.numbersEncoded} numbers`);
+      assert.equal(run(result.code).text, run(source).text, `${preset}#${seed}`);
+    }
+  }
+});
+
+/* -------------------------------------------------------- control flow */
+
+test("control flow flattening preserves statement order", () => {
   const source = [
-    'var phrase = "line\\nnext";',
-    'var object = { phrase: 12, "named": 99 };',
-    'console.log(phrase, object.phrase, object["named"]);',
-    'console.log(/[0-9]+/.test("123"), `literal ${object.phrase}`);',
-    '// "commented out" 876',
+    "var order = [];",
+    "function record(tag) { order.push(tag); }",
+    "record('a'); record('b'); record('c');",
+    "if (order.length === 3) { record('d'); }",
+    "for (var i = 0; i < 2; i++) { record('e' + i); }",
+    "record('f');",
+    "console.log(order.join(','));"
   ].join("\n");
-  const expected = [["line\nnext", 12, 99], [true, "literal 12"]];
-  for (const preset of Object.keys(CloakJS.presets)) {
-    const { logs } = run(source, preset);
-    assert.deepEqual(logs, expected, preset);
+  const result = obfuscate(source, withPreset("high", { seed: 12 }));
+  assert.ok(result.stats.controlFlowBlocks >= 1, `expected dispatchers, got ${result.stats.controlFlowBlocks}`);
+  assert.match(result.code, /switch\(/);
+  assert.equal(run(result.code).text, run(source).text);
+  const disabled = obfuscate(source, withPreset("high", { seed: 12, controlFlowFlattening: false }));
+  assert.equal(disabled.stats.controlFlowBlocks, 0);
+  assert.doesNotMatch(disabled.code, /switch\([^)]*\)\{case/);
+  assert.equal(run(disabled.code).text, run(source).text);
+  const zeroThreshold = obfuscate(source, withPreset("high", { seed: 12, controlFlowThreshold: 0 }));
+  assert.equal(zeroThreshold.stats.controlFlowBlocks, 0);
+  assert.equal(run(zeroThreshold.code).text, run(source).text);
+});
+
+test("flattening keeps hoisting, closures and returns intact", () => {
+  const source = `
+function worker(input) {
+  var doubled = input * 2;
+  var label = "v" + doubled;
+  if (input < 0) { return "negative:" + label; }
+  var total = 0;
+  for (var index = 0; index < 3; index++) { total += index + doubled; }
+  var classifier = function inner(value) { return value % 2 === 0 ? "even" : "odd"; };
+  return label + ":" + total + ":" + classifier(total);
+}
+function early() { var value = 1; return "early" + value; }
+console.log(worker(4), worker(-1), early());
+`;
+  for (let seed = 0; seed < 12; seed++) {
+    const result = obfuscate(source, withPreset("high", { seed }));
+    assert.deepEqual(result.warnings, [], `seed ${seed}`);
+    assert.equal(run(result.code).text, run(source).text, `seed ${seed}`);
+  }
+});
+
+test("dead code and opaque predicates are unreachable but present", () => {
+  const source = 'var value = 1; value = value + 2; console.log("v" + value);';
+  const missing = obfuscate(source, withPreset("high", { seed: 13, deadCodeInjection: false, opaquePredicates: false }));
+  assert.equal(missing.stats.deadCodeBlocks, 0);
+  assert.equal(missing.stats.opaquePredicates, 0);
+  let seenDead = 0, seenOpaque = 0;
+  for (let seed = 0; seed < 25 && (seenDead < 3 || seenOpaque < 3); seed++) {
+    const result = obfuscate(source, withPreset("high", { seed }));
+    assert.deepEqual(result.warnings, []);
+    seenDead += result.stats.deadCodeBlocks;
+    seenOpaque += result.stats.opaquePredicates;
+    assert.equal(run(result.code).text, run(source).text, `seed ${seed}`);
   }
+  assert.ok(seenDead >= 3, `dead code injection never fired (${seenDead})`);
+  assert.ok(seenOpaque >= 3, `opaque predicates never fired (${seenOpaque})`);
 });
 
-test("strict mode is kept before generated code", () => {
-  const source = '"use strict"; function check() { return this === undefined; } console.log(check());';
-  for (const preset of Object.keys(CloakJS.presets)) {
-    const { logs, result } = run(source, preset);
-    assert.deepEqual(logs, [[true]], preset);
-    assert.match(result.code, /^"use strict";/);
+/* ------------------------------------------------------------ guards */
+
+test("selfDefending output runs and rejects patched generated code", () => {
+  const source = 'var secret = "value"; console.log(secret, 1 + 2, [1, 2].map(function (v) { return v * 2; }).join("-"));';
+  const result = obfuscate(source, withPreset("high", { seed: 7 }));
+  assert.deepEqual(result.warnings, []);
+  assert.match(result.code, /Unexpected token/);
+  assert.equal(run(result.code).text, run(source).text);
+
+  const patched = result.code.replace("String.fromCharCode", "String.fromCharCode2");
+  assert.notEqual(patched, result.code, "fixture must actually contain the patched helper");
+  assert.throws(() => run(patched), /Unexpected token/);
+
+  const renamedCondition = result.code.replace(/>32\)/, ">31)");
+  if (renamedCondition !== result.code) {
+    assert.throws(() => run(renamedCondition), /Unexpected token/);
   }
 });
 
-test("options and return types are documented accurately", () => {
-  assert.equal(typeof CloakJS.obfuscate('console.log("ok")', "medium"), "string");
-  assert.equal(CloakJS.obfuscate("var x=1;", "off"), "var x=1;");
-  assert.deepEqual(CloakJS.resolveOptions("low"), CloakJS.presets.low);
-  assert.equal(CloakJS.resolveOptions({ stringEncryption: false }).stringEncryption, false);
-  assert.throws(() => CloakJS.resolveOptions("__proto__"), /unknown preset/);
-  assert.throws(() => CloakJS.obfuscate(5), TypeError);
-  const result = CloakJS.obfuscateWithStats('console.log("ok")', "medium");
+test("selfDefending tolerates reindentation", () => {
+  const source = 'var value = "x"; console.log(value + "y");';
+  const result = obfuscate(source, withPreset("high", { seed: 9 }));
+  const reindented = result.code.replace(/\n/g, "\n\t\t");
+  assert.notEqual(reindented, result.code);
+  assert.equal(run(reindented).text, run(source).text);
+  assert.equal(run(obfuscate(source, withPreset("high", { seed: 9, selfDefending: false })).code).text, run(source).text);
+});
+
+test("debug protection installs an unref'ed interval only when asked", () => {
+  const source = 'console.log("guarded");';
+  const plain = obfuscate(source, withPreset("high", { seed: 3 }));
+  assert.doesNotMatch(plain.code, /setInterval/);
+  assert.equal(run(plain.code, { timers: true }).timers.intervals, 0);
+
+  const guarded = obfuscate(source, withPreset("high", { seed: 3, debugProtection: true, debugProtectionInterval: 2500 }));
+  assert.match(guarded.code, /debugger/);
+  const withTimers = run(guarded.code, { timers: true });
+  assert.equal(withTimers.timers.intervals, 1);
+  assert.equal(withTimers.timers.unref, 1);
+  assert.equal(withTimers.text, "guarded");
+  const withoutTimers = run(guarded.code);
+  assert.equal(withoutTimers.text, "guarded", "must run where setInterval does not exist");
+});
+
+test("disableConsoleOutput silences the console and is off by default", () => {
+  const source = 'console.log("hidden"); console.warn("also hidden");';
+  for (const preset of ALL_PRESETS) {
+    assert.equal(run(obfuscate(source, preset).code).text, "hidden\nalso hidden", `${preset} must not silence`);
+  }
+  const silenced = obfuscate(source, withPreset("high", { seed: 4, disableConsoleOutput: true }));
+  assert.equal(run(silenced.code).text, "");
+  assert.equal(run(silenced.code).logs.length, 0);
+});
+
+test("wrapInIife keeps declarations private without breaking the program", () => {
+  const source = [
+    'var leaked = "global";',
+    "function helper() { return leaked; }",
+    'console.log(helper(), typeof leaked);'
+  ].join("\n");
+  const result = obfuscate(source, withPreset("high", { seed: 5, wrapInIife: true }));
+  assert.deepEqual(result.warnings, []);
+  assert.equal(result.code.trim().slice(0, 12), "(function(){");
+  const executed = run(result.code);
+  assert.equal(executed.sandbox.leaked, undefined, "top level declarations must not leak");
+  assert.equal(executed.text, "global string");
+  const strict = obfuscate('"use strict"; var inner = 1; console.log(inner);', withPreset("low", { seed: 5, wrapInIife: true, identifierEscaping: true }));
+  assert.match(strict.code, /^\(function\(\)\{\s*"use strict";/);
+  assert.equal(run(strict.code).text, "1");
+});
+
+test("a leading use strict directive is preserved", () => {
+  const strict = '"use strict";\nfunction probe() { return this; }\nconsole.log(probe() === undefined, typeof undeclaredOk);';
+  for (const preset of ALL_PRESETS) {
+    const result = obfuscate(strict, withPreset(preset, { seed: 2 }));
+    assert.match(result.code, /"use strict"/, `${preset} dropped the directive`);
+    assert.equal(run(result.code).text, "true undefined", `${preset}`);
+  }
+  const notADirective = 'console.log("use strict" + "!");';
+  const result = obfuscate(notADirective, withPreset("low", { seed: 2 }));
+  assert.equal(run(result.code).text, "use strict!");
+});
+
+/* ------------------------------------------------------------- hygiene */
+
+test("obfuscating never executes the input and never patches globals", () => {
+  const before = {
+    objectPrototype: Object.getOwnPropertyNames(Object.prototype).sort().join(","),
+    consoleLog: console.log,
+    functionToString: Function.prototype.toString
+  };
+  const source = 'console.log("should not run"); globalThis.definitelyNotSet = 1;';
+  const result = obfuscate(source, "high");
   assert.equal(typeof result.code, "string");
-  assert.equal(typeof result.stats.stringsEncrypted, "number");
-  assert.ok(Array.isArray(result.warnings));
-  const measured = CloakJS.measure('console.log("ok")', "medium");
-  assert.ok(measured.obfuscatedBytes >= measured.originalBytes);
-  assert.equal(measured.ratio, measured.obfuscatedBytes / measured.originalBytes);
+  assert.equal(globalThis.definitelyNotSet, undefined);
+  assert.equal(Object.getOwnPropertyNames(Object.prototype).sort().join(","), before.objectPrototype);
+  assert.equal(console.log, before.consoleLog);
+  assert.equal(Function.prototype.toString, before.functionToString);
 });
 
-test("object methods and numeric keys are not turned into expressions", () => {
-  const source = 'var named = 7; var obj = { named() { return named; }, "other"() { return 8; }, 42() { return 9; } }; console.log(obj.named(), obj.other(), obj[42]());';
-  for (const preset of Object.keys(CloakJS.presets)) {
-    const { logs, result } = run(source, preset);
-    assert.deepEqual(logs, [[7, 8, 9]], preset);
-    assert.ok(!result.warnings.some(w => /failed to parse/.test(w)));
+test("obfuscated output is checked for syntax errors and parsed as a script", () => {
+  for (const preset of ALL_PRESETS) {
+    for (const seed of [1, 2]) {
+      const result = obfuscate(SINK, withPreset(preset, { seed }));
+      assert.doesNotThrow(() => new Function(result.code), `${preset}#${seed}`);
+      assert.ok(!result.warnings.some((warning) => /failed to parse/i.test(warning)), `${preset}#${seed}: ${result.warnings}`);
+    }
   }
 });
 
-test("numeric separators and BigInt literals remain intact", () => {
-  const source = 'console.log(10_000, 123n, 0xFF_FF);';
-  const { logs, result } = run(source, "high");
-  assert.deepEqual(logs, [[10000, 123n, 65535]]);
-  assert.ok(!result.warnings.some(w => /failed to parse/.test(w)));
+test("double obfuscation stays valid for non self defending presets", () => {
+  const once = obfuscate(SINK, withPreset("medium", { seed: 3 }));
+  assert.deepEqual(once.warnings, []);
+  const twice = obfuscate(once.code, withPreset("low", { seed: 4 }));
+  assert.deepEqual(twice.warnings, []);
+  assert.equal(run(twice.code).text, run(SINK).text);
 });
 
-test("reserved helper bindings never collide with injected declarations", () => {
-  const { logs, result } = run('var _0xa = 5; console.log("safe", _0xa);', "high");
-  assert.deepEqual(logs, [["safe", 5]]);
-  assert.match(result.warnings.join(" "), /helper name/);
-  assert.equal(result.stats.stringsEncrypted, 0);
+test("code without declarations still obfuscates and runs", () => {
+  const source = 'console.log("no bindings here", 40 + 2);';
+  for (const preset of ["low", "high", "extreme"]) {
+    const result = obfuscate(source, withPreset(preset, { seed: 6 }));
+    assert.deepEqual(result.warnings, []);
+    assert.equal(run(result.code).text, run(source).text, preset);
+  }
 });
 
-test("strict directive without a semicolon remains a directive", () => {
-  const source = '"use strict"\nfunction check(){return this === undefined;} console.log(check());';
-  const { logs } = run(source, "high");
-  assert.deepEqual(logs, [[true]]);
+test("a moderately large program obfuscates in reasonable time", () => {
+  const parts = [];
+  for (let i = 0; i < 40; i++) {
+    parts.push(`function unit${i}(value) { var scaled = value * ${i + 2}; var label = "unit${i}:" + scaled; if (scaled % 2 === 0) { return label + ":even"; } return label + ":odd"; }`);
+  }
+  parts.push("var total = 0;");
+  for (let i = 0; i < 40; i++) parts.push(`total += unit${i}(2).length + unit${i}(3).length;`);
+  parts.push("console.log(total);");
+  const source = parts.join("\n");
+  const started = Date.now();
+  const result = obfuscate(source, withPreset("extreme", { seed: 9 }));
+  const elapsed = Date.now() - started;
+  assert.deepEqual(result.warnings, []);
+  assert.ok(elapsed < 15000, `took ${elapsed}ms`);
+  assert.equal(run(result.code).text, run(source).text);
+  assert.ok(result.stats.identifiersRenamed >= 40, `renamed ${result.stats.identifiersRenamed}`);
 });
 
-test("a generated script does not freeze the host prototype", () => {
-  run('console.log("safe")', "high");
-  assert.equal(Object.isFrozen(Object.prototype), false);
+test("CloakJS can obfuscate itself and the result still obfuscates", () => {
+  const source = fs.readFileSync(path.join(__dirname, "..", "cloakjs.js"), "utf8");
+  const fixture = "function add(a, b) { return a + b; } console.log(add(2, 3), `sum ${add(20, 22)}`);";
+  const expected = CloakJS.obfuscate(fixture, { seed: 42 });
+  for (const preset of ["low", "medium", "high"]) {
+    const started = Date.now();
+    const result = obfuscate(source, withPreset(preset, { seed: 1 }));
+    assert.ok(Date.now() - started < 20000, `${preset} took too long`);
+    assert.ok(!result.warnings.some((warning) => /failed to parse/i.test(warning)), `${preset}: ${result.warnings}`);
+    // the library calls Function() to evaluate literals, so mangling backs off
+    assert.ok(result.warnings.some((warning) => /Function\(\)|eval\(\)/.test(warning)), `${preset} should warn about dynamic code`);
+    const sandbox = { console: { log: () => { } }, TextEncoder, TextDecoder, Uint8Array, atob, btoa };
+    const context = vm.createContext(sandbox);
+    vm.runInContext(result.code, context, { timeout: 30000, filename: "cloakjs-obfuscated.js" });
+    const Obfuscated = sandbox.CloakJS;
+    assert.ok(Obfuscated, `${preset}: the obfuscated library did not load`);
+    assert.equal(Obfuscated.VERSION, CloakJS.VERSION);
+    assert.deepEqual(Object.keys(Obfuscated.presets), Object.keys(CloakJS.presets));
+    assert.equal(Obfuscated.obfuscate(fixture, { seed: 42 }), expected, `${preset}: obfuscating with the obfuscated library changed the output`);
+    assert.equal(run(Obfuscated.obfuscate(fixture, { seed: 42 })).text, run(fixture).text);
+  }
 });