Module dead 

Dead code elimination: remove provably-unused declarations.

function f() { var x = 1; var y = 2; return y; } → function f() { var y = 2; return y; }

Safety contract

A universal deobfuscator must produce code that is still runnable like the original. The original may invoke a binding via mechanisms invisible to static analysis: eval, new Function, with, computed property access on the global object, runtime dispatch tables (__dispatch__[idx]), reflection, etc. We can never prove a binding is unreachable.

Therefore this pass is intentionally conservative:

1. Function declarations are NEVER removed. A 0-reference function may still be called via dispatch table or computed lookup. Removing one whole-program function can drop entire subtrees of nested helpers — this exact bug was observed wiping 7700 lines from kasada decompiled output.
2. Module/program-scope var/let/const are NEVER removed, because:
   • var at module scope can still be observable via host hooks or stale tooling that opts out of strict module semantics;
   • the cost of being wrong (broken script) outweighs the benefit (slightly shorter file).
3. Function-/block-scope variable declarations with 0 read references and a side-effect-free initializer ARE removed — within a function body the surface area is bounded by the parent function and OXC’s symbol table is authoritative there.
4. Empty statements are always removed.

Vendor-specific aggressive DCE belongs in a target/locked module, not here.

Structs

DeadCodeEliminator

Dead code elimination module. See module docs for the safety contract.