js-confuser-vm 0.0.6 → 0.0.8

package/dist/compiler.js

@@ -1,8 +1,9 @@
+import * as t from "@babel/types";
+import * as b from "./types.js";
 import { parse } from "@babel/parser";
 import traverseImport from "@babel/traverse";
 import { generate } from "@babel/generator";
 import { stripTypeScriptTypes } from "module";
-import * as t from "@babel/types";
 import { ok } from "assert";
 import { obfuscateRuntime } from "./build-runtime.js";
 import { DEFAULT_OPTIONS } from "./options.js";
@@ -10,14 +11,14 @@ import { resolveLabels } from "./transforms/bytecode/resolveLabels.js";
 import { resolveConstants } from "./transforms/bytecode/resolveContants.js";
 import { selfModifying } from "./transforms/bytecode/selfModifying.js";
 import { macroOpcodes } from "./transforms/bytecode/macroOpcodes.js";
-import * as b from "./types.js";
+import { microOpcodes } from "./transforms/bytecode/microOpcodes.js";
 import { specializedOpcodes } from "./transforms/bytecode/specializedOpcodes.js";
 import { aliasedOpcodes } from "./transforms/bytecode/aliasedOpcodes.js";
 import { getRandomInt } from "./utils/random-utils.js";
 import { U16_MAX } from "./utils/op-utils.js";
 import { concealConstants } from "./transforms/bytecode/concealConstants.js";
 const traverse = traverseImport.default || traverseImport;
-const readVMRuntimeFile = () => "import { OP_ORIGINAL as OP } from \"./compiler.ts\";\nconst BYTECODE = [];\nconst MAIN_START_PC = 0;\nconst MAIN_REG_COUNT = 0;\nconst CONSTANTS = [];\nconst ENCODE_BYTECODE = false;\nconst TIMING_CHECKS = false;\n// The text above is not included in the compiled output - for type intellisense only\n// @START\n\nfunction decodeBytecode(s) {\n  if (!ENCODE_BYTECODE) return s;\n\n  var b =\n    typeof Buffer !== \"undefined\"\n      ? Buffer.from(s, \"base64\")\n      : Uint8Array.from(atob(s), function (c) {\n          return c.charCodeAt(0);\n        });\n  // Each slot is a u16 stored as 2 little-endian bytes.\n  var r = new Uint16Array(b.length / 2);\n  for (var i = 0; i < r.length; i++) r[i] = b[i * 2] | (b[i * 2 + 1] << 8);\n  return r;\n}\n\n// Closure symbol\n// Used to tag shell functions so the VM can fast-path back to the\n// inner Closure instead of going through a sub-VM on internal calls.\nvar CLOSURE_SYM = Symbol(); // Nameless for obfuscation\n\n// Upvalue\n// While the outer frame is alive: reads/writes go to frame.regs[slot].\n// After the outer frame returns (closed): reads/writes hit this._value.\nfunction Upvalue(frame, slot) {\n  this._frame = frame;\n  this._slot = slot;\n  this._closed = false;\n  this._value = undefined;\n}\nUpvalue.prototype._read = function () {\n  return this._closed ? this._value : this._frame.regs[this._slot];\n};\nUpvalue.prototype._write = function (v) {\n  if (this._closed) this._value = v;\n  else this._frame.regs[this._slot] = v;\n};\nUpvalue.prototype._close = function () {\n  this._value = this._frame.regs[this._slot];\n  this._closed = true;\n};\n\n// Closure & Frame\nfunction Closure(fn) {\n  this.fn = fn;\n  this.upvalues = [];\n  this.prototype = {}; // <- default prototype object for `new`\n}\n\nfunction Frame(closure, returnPc, parent, thisVal, retDstReg) {\n  this.closure = closure;\n  this.regs = new Array(closure.fn.regCount).fill(undefined);\n  this._pc = closure.fn.startPc; // <- initialize from fn descriptor\n  this._returnPc = returnPc; // pc to resume in parent frame after RETURN\n  this._parent = parent;\n  this.thisVal = thisVal !== undefined ? thisVal : undefined;\n  this._retDstReg = retDstReg !== undefined ? retDstReg : 0; // register in parent to write return value\n  this._newObj = null; // <- set by NEW so RETURN can see it\n  this._handlerStack = []; // <- exception handlers pushed by TRY_SETUP\n}\n\n// VM\nfunction VM(bytecode, mainStartPc, mainRegCount, constants, globals) {\n  this.bytecode = bytecode;\n  this.constants = constants;\n  this.globals = globals;\n  this._frameStack = [];\n  this._openUpvalues = []; // all currently open Upvalue objects across all frames\n\n  var mainFn = {\n    paramCount: 0,\n    regCount: mainRegCount,\n    startPc: mainStartPc, // <- where main begins\n  };\n  this._currentFrame = new Frame(new Closure(mainFn), null, null, undefined, 0);\n}\n\n// Consume the next slot from the flat bytecode stream and advance the PC.\n// Called by opcode handlers to read each of their operands in order.\nVM.prototype._operand = function () {\n  return this.bytecode[this._currentFrame._pc++];\n};\n\nVM.prototype.captureUpvalue = function (frame, slot) {\n  // Reuse existing open upvalue for this frame+slot if one exists.\n  // This is what makes two closures share the same mutable cell.\n  for (var i = 0; i < this._openUpvalues.length; i++) {\n    var uv = this._openUpvalues[i];\n    if (uv._frame === frame && uv._slot === slot) return uv;\n  }\n  var uv = new Upvalue(frame, slot);\n  this._openUpvalues.push(uv);\n  return uv;\n};\n\n// Reads and decodes a constant from the pool.\n// idx  \u2014 pool index (first operand of the constant pair emitted by resolveConstants).\n// key  \u2014 conceal key (second operand). 0 means no concealment.\n//\n// For integers:  stored value is (original ^ key); XOR again to recover.\n// For strings:   stored value is a base64 string containing u16 LE byte pairs.\n//                Mirrors decodeBytecode: base64 \u2192 bytes \u2192 u16 LE \u2192 XOR with\n//                (key + i) & 0xFFFF to recover the original char codes.\n// idxIn, keyIn are passed in from specializedOpcodes when the operands are determined at compile time.\nVM.prototype._constant = function (idxIn, keyIn) {\n  var idx = idxIn ?? this._operand();\n  var key = keyIn ?? this._operand();\n\n  var v = this.constants[idx];\n  if (!key) return v;\n  if (typeof v === \"number\") return v ^ key;\n  // String: base64-decode to u16 LE byte pairs, then XOR each code with (key+i).\n  var b =\n    typeof Buffer !== \"undefined\"\n      ? Buffer.from(v, \"base64\")\n      : Uint8Array.from(atob(v), function (c) {\n          return c.charCodeAt(0);\n        });\n  var out = \"\";\n  for (var i = 0; i < b.length / 2; i++) {\n    var code = b[i * 2] | (b[i * 2 + 1] << 8); // u16 LE\n    out += String.fromCharCode(code ^ ((key + i) & 0xffff));\n  }\n  return out;\n};\n\nVM.prototype._closeUpvaluesFor = function (frame) {\n  // Called on RETURN - close every upvalue that was pointing into this frame.\n  // After this, closures that captured from the frame read from upvalue.value.\n  this._openUpvalues = this._openUpvalues.filter(function (uv) {\n    if (uv._frame === frame) {\n      uv._close();\n      return false;\n    }\n    return true;\n  });\n};\n\nVM.prototype.run = function () {\n  var now = () => {\n    return performance.now();\n  };\n\n  var lastTime = now();\n\n  while (true) {\n    var frame = this._currentFrame;\n    var bc = this.bytecode;\n    if (frame._pc >= bc.length) break;\n\n    var pc = frame._pc++;\n    var op = this.bytecode[pc];\n    var opcode = this.bytecode[pc];\n    // console.log(\n    //   \"pc=\" + pc,\n    //   \"opcode=\" + opcode,\n    //   Object.keys(OP).find((key) => OP[key] === opcode),\n    // );\n\n    // Debugging protection: Detects debugger by checking for >1s pauses which can only happen from debugger; or extremely slow sync tasks\n    if (TIMING_CHECKS) {\n      var currentTime = now();\n      var isTamper = currentTime - lastTime > 1000;\n      lastTime = currentTime;\n      if (isTamper) {\n        // Poison the bytecode\n        for (var i = 0; i < this.bytecode.length; i++) this.bytecode[i] = 0;\n        // Break the current state\n        frame.regs.fill(undefined);\n        op = OP.JUMP;\n        frame._pc = this.bytecode.length; // jump past end to halt\n      }\n    }\n\n    try {\n      /* @SWITCH */\n      switch (op) {\n        case OP.LOAD_CONST: {\n          var dst = this._operand();\n          frame.regs[dst] = this._constant();\n          break;\n        }\n\n        case OP.LOAD_INT: {\n          var dst = this._operand();\n          frame.regs[dst] = this._operand();\n          break;\n        }\n\n        case OP.LOAD_GLOBAL: {\n          var dst = this._operand();\n          var globalName = this._constant();\n\n          if (!(globalName in this.globals)) {\n            throw new ReferenceError(`${globalName} is not defined`);\n          }\n\n          frame.regs[dst] = this.globals[globalName];\n          break;\n        }\n\n        case OP.LOAD_UPVALUE: {\n          var dst = this._operand();\n          frame.regs[dst] = frame.closure.upvalues[this._operand()]._read();\n          break;\n        }\n\n        case OP.LOAD_THIS: {\n          var dst = this._operand();\n          frame.regs[dst] = frame.thisVal;\n          break;\n        }\n\n        case OP.MOVE: {\n          var dst = this._operand();\n          frame.regs[dst] = frame.regs[this._operand()];\n          break;\n        }\n\n        case OP.STORE_GLOBAL: {\n          // nameIdx and key are consumed inline so the concealConstants runtime\n          // transform can rewrite this._constant() consistently.\n          this.globals[this._constant()] = frame.regs[this._operand()];\n          break;\n        }\n\n        case OP.STORE_UPVALUE: {\n          var uvIdx = this._operand();\n          frame.closure.upvalues[uvIdx]._write(frame.regs[this._operand()]);\n          break;\n        }\n\n        case OP.GET_PROP: {\n          // dst = regs[obj][regs[key]]\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          frame.regs[dst] = obj[key];\n          break;\n        }\n\n        case OP.SET_PROP: {\n          // regs[obj][regs[key]] = regs[val]\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          var val = frame.regs[this._operand()];\n          // Reflect.set performs [[Set]] without throwing on failure,\n          // correctly simulating sloppy-mode assignment from a strict-mode host.\n          Reflect.set(obj, key, val);\n          break;\n        }\n\n        case OP.DELETE_PROP: {\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          frame.regs[dst] = delete obj[key];\n          break;\n        }\n\n        // \u2500\u2500 Arithmetic  (dst, src1, src2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.ADD: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a + frame.regs[this._operand()];\n          break;\n        }\n        case OP.SUB: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a - frame.regs[this._operand()];\n          break;\n        }\n        case OP.MUL: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a * frame.regs[this._operand()];\n          break;\n        }\n        case OP.DIV: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a / frame.regs[this._operand()];\n          break;\n        }\n        case OP.MOD: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a % frame.regs[this._operand()];\n          break;\n        }\n        case OP.BAND: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a & frame.regs[this._operand()];\n          break;\n        }\n        case OP.BOR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a | frame.regs[this._operand()];\n          break;\n        }\n        case OP.BXOR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a ^ frame.regs[this._operand()];\n          break;\n        }\n        case OP.SHL: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a << frame.regs[this._operand()];\n          break;\n        }\n        case OP.SHR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a >> frame.regs[this._operand()];\n          break;\n        }\n        case OP.USHR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a >>> frame.regs[this._operand()];\n          break;\n        }\n\n        // \u2500\u2500 Comparison  (dst, src1, src2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.LT: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a < frame.regs[this._operand()];\n          break;\n        }\n        case OP.GT: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a > frame.regs[this._operand()];\n          break;\n        }\n        case OP.LTE: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a <= frame.regs[this._operand()];\n          break;\n        }\n        case OP.GTE: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a >= frame.regs[this._operand()];\n          break;\n        }\n        case OP.EQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a === frame.regs[this._operand()];\n          break;\n        }\n        case OP.NEQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a !== frame.regs[this._operand()];\n          break;\n        }\n        case OP.LOOSE_EQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a == frame.regs[this._operand()];\n          break;\n        }\n        case OP.LOOSE_NEQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a != frame.regs[this._operand()];\n          break;\n        }\n        case OP.IN: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a in frame.regs[this._operand()];\n          break;\n        }\n        case OP.INSTANCEOF: {\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var ctor = frame.regs[this._operand()];\n          if (typeof ctor === \"function\") {\n            frame.regs[dst] = obj instanceof ctor;\n          } else {\n            // VM Closure - walk prototype chain for identity with ctor.prototype.\n            var proto = ctor.prototype;\n            var target = Object.getPrototypeOf(obj);\n            var result = false;\n            while (target !== null) {\n              if (target === proto) {\n                result = true;\n                break;\n              }\n              target = Object.getPrototypeOf(target);\n            }\n            frame.regs[dst] = result;\n          }\n          break;\n        }\n\n        // \u2500\u2500 Unary  (dst, src) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.UNARY_NEG: {\n          var dst = this._operand();\n          frame.regs[dst] = -frame.regs[this._operand()];\n          break;\n        }\n        case OP.UNARY_POS: {\n          var dst = this._operand();\n          frame.regs[dst] = +frame.regs[this._operand()];\n          break;\n        }\n        case OP.UNARY_NOT: {\n          var dst = this._operand();\n          frame.regs[dst] = !frame.regs[this._operand()];\n          break;\n        }\n        case OP.UNARY_BITNOT: {\n          var dst = this._operand();\n          frame.regs[dst] = ~frame.regs[this._operand()];\n          break;\n        }\n        case OP.TYPEOF: {\n          var dst = this._operand();\n          frame.regs[dst] = typeof frame.regs[this._operand()];\n          break;\n        }\n        case OP.VOID: {\n          var dst = this._operand();\n          this._operand(); // consume src \u2014 evaluated for side-effects by compiler\n          frame.regs[dst] = undefined;\n          break;\n        }\n        case OP.TYPEOF_SAFE: {\n          // dst, nameConstIdx \u2014 safe typeof for potentially-undeclared globals.\n          var dst = this._operand();\n          var name = this._constant();\n          var val = Object.prototype.hasOwnProperty.call(this.globals, name)\n            ? this.globals[name]\n            : undefined;\n          frame.regs[dst] = typeof val;\n          break;\n        }\n\n        // \u2500\u2500 Control flow \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.JUMP:\n          frame._pc = this._operand();\n          break;\n\n        case OP.JUMP_IF_FALSE: {\n          var src = this._operand();\n          var target = this._operand();\n          if (!frame.regs[src]) frame._pc = target;\n          break;\n        }\n\n        case OP.JUMP_IF_TRUE: {\n          // || short-circuit: if truthy, jump over RHS.\n          var src = this._operand();\n          var target = this._operand();\n          if (frame.regs[src]) frame._pc = target;\n          break;\n        }\n\n        // \u2500\u2500 Calls \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.CALL: {\n          // dst, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var callee = frame.regs[this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var c = callee[CLOSURE_SYM];\n            var f = new Frame(c, frame._pc, frame, this.globals, dst);\n            for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n            f.regs[c.fn.paramCount] = args;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            frame.regs[dst] = callee.apply(null, args);\n          }\n          break;\n        }\n\n        case OP.CALL_METHOD: {\n          // dst, receiverReg, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var receiver = frame.regs[this._operand()];\n          var callee = frame.regs[this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var c = callee[CLOSURE_SYM];\n            var f = new Frame(c, frame._pc, frame, receiver, dst);\n            for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n            f.regs[c.fn.paramCount] = args;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            frame.regs[dst] = callee.apply(receiver, args);\n          }\n          break;\n        }\n\n        case OP.NEW: {\n          // dst, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var callee = frame.regs[this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var c = callee[CLOSURE_SYM];\n            var newObj = Object.create(c.prototype || null);\n            var f = new Frame(c, frame._pc, frame, newObj, dst);\n            f._newObj = newObj;\n            for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n            f.regs[c.fn.paramCount] = args;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            // Reflect.construct is required - Object.create+apply does NOT set\n            // internal slots ([[NumberData]], [[StringData]], etc.) for built-ins.\n            frame.regs[dst] = Reflect.construct(callee, args);\n          }\n          break;\n        }\n\n        case OP.RETURN: {\n          var retVal = frame.regs[this._operand()];\n          this._closeUpvaluesFor(frame); // must happen before frame is abandoned\n\n          if (this._frameStack.length === 0) return retVal; // main script returning\n\n          // new-call rule: primitive return -> discard, use the constructed object instead\n          if (frame._newObj !== null) {\n            if (typeof retVal !== \"object\" || retVal === null)\n              retVal = frame._newObj;\n          }\n\n          var parentFrame = this._frameStack.pop();\n          parentFrame.regs[frame._retDstReg] = retVal;\n          this._currentFrame = parentFrame;\n          break;\n        }\n\n        case OP.THROW:\n          throw frame.regs[this._operand()];\n\n        // \u2500\u2500 Closures \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.MAKE_CLOSURE: {\n          // dst, startPc, paramCount, regCount, uvCount, [isLocal, idx, ...]\n          var dst = this._operand();\n          var startPc = this._operand();\n          var paramCount = this._operand();\n          var regCount = this._operand();\n          var uvCount = this._operand();\n\n          var uvDescs = new Array(uvCount);\n          for (var i = 0; i < uvCount; i++) {\n            var isLocalRaw = this._operand();\n            var uvIndex = this._operand();\n            uvDescs[i] = { isLocal: isLocalRaw, _index: uvIndex };\n          }\n\n          var fn = {\n            paramCount: paramCount,\n            regCount: regCount,\n            startPc: startPc,\n            upvalueDescriptors: uvDescs,\n          };\n\n          var closure = new Closure(fn);\n          for (var i = 0; i < uvDescs.length; i++) {\n            var uvd = uvDescs[i];\n            if (uvd.isLocal) {\n              closure.upvalues.push(this.captureUpvalue(frame, uvd._index));\n            } else {\n              closure.upvalues.push(frame.closure.upvalues[uvd._index]);\n            }\n          }\n\n          // Wrap in a native callable shell so host code (array methods,\n          // test assertions, setTimeout, etc.) can invoke VM closures.\n          // CLOSURE_SYM lets VM-internal CALL/NEW bypass the sub-VM entirely.\n          var self = this;\n          var shell = (function (c) {\n            return function () {\n              var args = Array.prototype.slice.call(arguments);\n              var sub = new VM(\n                self.bytecode,\n                0,\n                c.fn.regCount,\n                self.constants,\n                self.globals,\n              );\n              var f = new Frame(\n                c,\n                null,\n                null,\n                this == null ? self.globals : this,\n                0,\n              );\n              for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n              f.regs[c.fn.paramCount] = args;\n              sub._currentFrame = f;\n              return sub.run();\n            };\n          })(closure);\n          shell[CLOSURE_SYM] = closure;\n          shell.prototype = closure.prototype; // unified prototype for new/instanceof\n          frame.regs[dst] = shell;\n          break;\n        }\n\n        // \u2500\u2500 Collections \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.BUILD_ARRAY: {\n          // dst, count, [elemReg...]\n          var dst = this._operand();\n          var count = this._operand();\n          var elems = new Array(count);\n          for (var i = 0; i < count; i++)\n            elems[i] = frame.regs[this._operand()];\n          frame.regs[dst] = elems;\n          break;\n        }\n\n        case OP.BUILD_OBJECT: {\n          // dst, pairCount, [keyReg, valReg, ...]\n          var dst = this._operand();\n          var pairCount = this._operand();\n          var o = {};\n          for (var i = 0; i < pairCount; i++) {\n            var key = frame.regs[this._operand()];\n            var val = frame.regs[this._operand()];\n            o[key] = val;\n          }\n          frame.regs[dst] = o;\n          break;\n        }\n\n        // \u2500\u2500 Property definitions (getters / setters) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.DEFINE_GETTER: {\n          // obj, key, fn\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          var getterFn = frame.regs[this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var getDesc                     = {\n            get: getterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.set === \"function\") {\n            getDesc.set = existingDesc.set;\n          }\n          Object.defineProperty(obj, key, getDesc);\n          break;\n        }\n\n        case OP.DEFINE_SETTER: {\n          // obj, key, fn\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          var setterFn = frame.regs[this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var setDesc                     = {\n            set: setterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.get === \"function\") {\n            setDesc.get = existingDesc.get;\n          }\n          Object.defineProperty(obj, key, setDesc);\n          break;\n        }\n\n        // \u2500\u2500 For-in iteration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.FOR_IN_SETUP: {\n          // dst, src \u2014 build iterator object from enumerable keys of regs[src]\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var keys = [];\n          if (obj !== null && obj !== undefined) {\n            var seen = Object.create(null);\n            var cur = Object(obj); // box primitives\n            while (cur !== null) {\n              var ownNames = Object.getOwnPropertyNames(cur);\n              for (var i = 0; i < ownNames.length; i++) {\n                var k = ownNames[i];\n                if (!(k in seen)) {\n                  seen[k] = true;\n                  var propDesc = Object.getOwnPropertyDescriptor(cur, k);\n                  if (propDesc && propDesc.enumerable) {\n                    keys.push(k);\n                  }\n                }\n              }\n              cur = Object.getPrototypeOf(cur);\n            }\n          }\n          frame.regs[dst] = { _keys: keys, i: 0 };\n          break;\n        }\n\n        case OP.FOR_IN_NEXT: {\n          // dst, iterReg, exitTarget\n          // Advances iterator; writes next key to dst, or jumps to exitTarget when done.\n          var dst = this._operand();\n          var iter = frame.regs[this._operand()];\n          var exitTarget = this._operand();\n          if (iter.i >= iter._keys.length) {\n            frame._pc = exitTarget;\n          } else {\n            frame.regs[dst] = iter._keys[iter.i++];\n          }\n          break;\n        }\n\n        // \u2500\u2500 Exception handling \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.TRY_SETUP: {\n          // handlerPc, exceptionReg \u2014 push exception handler record onto current frame.\n          frame._handlerStack.push({\n            handlerPc: this._operand(),\n            exceptionReg: this._operand(),\n            frameStackDepth: this._frameStack.length,\n          });\n          break;\n        }\n\n        case OP.TRY_END: {\n          // Normal exit from a try block \u2014 disarm the exception handler.\n          frame._handlerStack.pop();\n          break;\n        }\n\n        // \u2500\u2500 Self-modifying bytecode \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.PATCH: {\n          // destPc, sliceStart, sliceEnd\n          var destPc = this._operand();\n          var sliceStart = this._operand();\n          var sliceEnd = this._operand();\n          for (var pi = sliceStart; pi < sliceEnd; pi++) {\n            this.bytecode[destPc + (pi - sliceStart)] = this.bytecode[pi];\n          }\n          break;\n        }\n\n        case OP.DEBUGGER: {\n          debugger;\n          break;\n        }\n\n        default:\n          throw new Error(\n            \"Unknown opcode: \" + op + \" at pc \" + (frame._pc - 1),\n          );\n      }\n    } catch (err) {\n      // Exception handler unwinding (CPython-style frame walk, Lua-style upvalue close).\n      // Walk from the current frame upward until we find a frame that has an open\n      // exception handler (TRY_SETUP without a matching TRY_END).\n      // For every frame we abandon along the way, close its captured upvalues.\n      var handledFrame = null;\n      var searchFrame = this._currentFrame;\n      while (true) {\n        if (searchFrame._handlerStack.length > 0) {\n          handledFrame = searchFrame;\n          break;\n        }\n        // No handler in this frame \u2014 abandon it and walk up.\n        this._closeUpvaluesFor(searchFrame);\n        if (this._frameStack.length === 0) break;\n        searchFrame = this._frameStack.pop();\n        this._currentFrame = searchFrame;\n      }\n\n      if (!handledFrame) throw err; // no handler anywhere \u2014 propagate to host\n\n      var h = handledFrame._handlerStack.pop();\n      // Discard any call-frames that were pushed inside the try body.\n      this._frameStack.length = h.frameStackDepth;\n      // Write the caught exception directly into the designated register.\n      handledFrame.regs[h.exceptionReg] = err;\n      // Jump to the catch block.\n      handledFrame._pc = h.handlerPc;\n      this._currentFrame = handledFrame;\n    }\n  }\n};\n\n// Boot\nvar globals      = {}; // global object for globals\n\n// Always pull built-ins from globalThis so eval() scoping can't shadow them\n// with a local `window` variable (e.g. the test harness fake window).\nfor (var k of Object.getOwnPropertyNames(globalThis)) {\n  globals[k] = globalThis[k];\n}\n// If a window object is in scope (browser or test harness), capture it\n// explicitly so VM code can read/write window.TEST_OUTPUT etc.\nif (typeof window !== \"undefined\") {\n  globals[\"window\"] = window;\n}\n\n// Transfer common primitives\nglobals.undefined = undefined;\nglobals.Infinity = Infinity;\nglobals.NaN = NaN;\n\nvar vm = new VM(\n  decodeBytecode(BYTECODE),\n  MAIN_START_PC,\n  MAIN_REG_COUNT,\n  CONSTANTS,\n  globals,\n);\nvm.run();\n";
+const readVMRuntimeFile = () => "import { OP_ORIGINAL as OP } from \"./compiler.ts\";\nconst BYTECODE = [];\nconst MAIN_START_PC = 0;\nconst MAIN_REG_COUNT = 0;\nconst CONSTANTS = [];\nconst ENCODE_BYTECODE = false;\nconst TIMING_CHECKS = false;\n// The text above is not included in the compiled output - for type intellisense only\n// @START\n\nfunction decodeBytecode(s) {\n  if (!ENCODE_BYTECODE) return s;\n\n  var b =\n    typeof Buffer !== \"undefined\"\n      ? Buffer.from(s, \"base64\")\n      : Uint8Array.from(atob(s), function (c) {\n          return c.charCodeAt(0);\n        });\n  // Each slot is a u16 stored as 2 little-endian bytes.\n  var r = new Uint16Array(b.length / 2);\n  for (var i = 0; i < r.length; i++) r[i] = b[i * 2] | (b[i * 2 + 1] << 8);\n  return r;\n}\n\n// Closure symbol\n// Used to tag shell functions so the VM can fast-path back to the\n// inner Closure instead of going through a sub-VM on internal calls.\nvar CLOSURE_SYM = Symbol(); // Nameless for obfuscation\n\n// Upvalue\n// While the outer frame is alive: reads/writes go to frame.regs[slot].\n// After the outer frame returns (closed): reads/writes hit this._value.\nfunction Upvalue(frame, slot) {\n  this._frame = frame;\n  this._slot = slot;\n  this._closed = false;\n  this._value = undefined;\n}\nUpvalue.prototype._read = function () {\n  return this._closed ? this._value : this._frame.regs[this._slot];\n};\nUpvalue.prototype._write = function (v) {\n  if (this._closed) this._value = v;\n  else this._frame.regs[this._slot] = v;\n};\nUpvalue.prototype._close = function () {\n  this._value = this._frame.regs[this._slot];\n  this._closed = true;\n};\n\n// Closure & Frame\nfunction Closure(fn) {\n  this.fn = fn;\n  this.upvalues = [];\n  this.prototype = {}; // <- default prototype object for `new`\n}\n\nfunction Frame(closure, returnPc, parent, thisVal, retDstReg) {\n  this.closure = closure;\n  this.regs = new Array(closure.fn.regCount).fill(undefined);\n  this._pc = closure.fn.startPc; // <- initialize from fn descriptor\n  this._returnPc = returnPc; // pc to resume in parent frame after RETURN\n  this._parent = parent;\n  this.thisVal = thisVal !== undefined ? thisVal : undefined;\n  this._retDstReg = retDstReg !== undefined ? retDstReg : 0; // register in parent to write return value\n  this._newObj = null; // <- set by NEW so RETURN can see it\n  this._handlerStack = []; // <- exception handlers pushed by TRY_SETUP\n}\n\n// VM\nfunction VM(bytecode, mainStartPc, mainRegCount, constants, globals) {\n  this.bytecode = bytecode;\n  this.constants = constants;\n  this.globals = globals;\n  this._frameStack = [];\n  this._openUpvalues = []; // all currently open Upvalue objects across all frames\n\n  var mainFn = {\n    paramCount: 0,\n    regCount: mainRegCount,\n    startPc: mainStartPc, // <- where main begins\n  };\n  this._currentFrame = new Frame(new Closure(mainFn), null, null, undefined, 0);\n  this._internals = {};\n}\n\n// Consume the next slot from the flat bytecode stream and advance the PC.\n// Called by opcode handlers to read each of their operands in order.\nVM.prototype._operand = function () {\n  return this.bytecode[this._currentFrame._pc++];\n};\n\nVM.prototype.captureUpvalue = function (frame, slot) {\n  // Reuse existing open upvalue for this frame+slot if one exists.\n  // This is what makes two closures share the same mutable cell.\n  for (var i = 0; i < this._openUpvalues.length; i++) {\n    var uv = this._openUpvalues[i];\n    if (uv._frame === frame && uv._slot === slot) return uv;\n  }\n  var uv = new Upvalue(frame, slot);\n  this._openUpvalues.push(uv);\n  return uv;\n};\n\n// Reads and decodes a constant from the pool.\n// idx  \u2014 pool index (first operand of the constant pair emitted by resolveConstants).\n// key  \u2014 conceal key (second operand). 0 means no concealment.\n//\n// For integers:  stored value is (original ^ key); XOR again to recover.\n// For strings:   stored value is a base64 string containing u16 LE byte pairs.\n//                Mirrors decodeBytecode: base64 \u2192 bytes \u2192 u16 LE \u2192 XOR with\n//                (key + i) & 0xFFFF to recover the original char codes.\n// idxIn, keyIn are passed in from specializedOpcodes when the operands are determined at compile time.\nVM.prototype._constant = function (idxIn, keyIn) {\n  var idx = idxIn ?? this._operand();\n  var key = keyIn ?? this._operand();\n\n  var v = this.constants[idx];\n  if (!key) return v;\n  if (typeof v === \"number\") return v ^ key;\n  // String: base64-decode to u16 LE byte pairs, then XOR each code with (key+i).\n  var b =\n    typeof Buffer !== \"undefined\"\n      ? Buffer.from(v, \"base64\")\n      : Uint8Array.from(atob(v), function (c) {\n          return c.charCodeAt(0);\n        });\n  var out = \"\";\n  for (var i = 0; i < b.length / 2; i++) {\n    var code = b[i * 2] | (b[i * 2 + 1] << 8); // u16 LE\n    out += String.fromCharCode(code ^ ((key + i) & 0xffff));\n  }\n  return out;\n};\n\nVM.prototype._closeUpvaluesFor = function (frame) {\n  // Called on RETURN - close every upvalue that was pointing into this frame.\n  // After this, closures that captured from the frame read from upvalue.value.\n  this._openUpvalues = this._openUpvalues.filter(function (uv) {\n    if (uv._frame === frame) {\n      uv._close();\n      return false;\n    }\n    return true;\n  });\n};\n\nVM.prototype.run = function () {\n  var now = () => {\n    return performance.now();\n  };\n\n  var lastTime = now();\n\n  while (true) {\n    var frame = this._currentFrame;\n    var bc = this.bytecode;\n    if (frame._pc >= bc.length) break;\n\n    var pc = frame._pc++;\n    var op = this.bytecode[pc];\n    var opcode = this.bytecode[pc];\n    // console.log(\n    //   \"pc=\" + pc,\n    //   \"opcode=\" + opcode,\n    //   Object.keys(OP).find((key) => OP[key] === opcode),\n    // );\n\n    // Debugging protection: Detects debugger by checking for >1s pauses which can only happen from debugger; or extremely slow sync tasks\n    if (TIMING_CHECKS) {\n      var currentTime = now();\n      var isTamper = currentTime - lastTime > 1000;\n      lastTime = currentTime;\n      if (isTamper) {\n        // Poison the bytecode\n        for (var i = 0; i < this.bytecode.length; i++) this.bytecode[i] = 0;\n        // Break the current state\n        frame.regs.fill(undefined);\n        op = OP.JUMP;\n        frame._pc = this.bytecode.length; // jump past end to halt\n      }\n    }\n\n    try {\n      /* @SWITCH */\n      switch (op) {\n        case OP.LOAD_CONST: {\n          var dst = this._operand();\n          frame.regs[dst] = this._constant();\n          break;\n        }\n\n        case OP.LOAD_INT: {\n          var dst = this._operand();\n          frame.regs[dst] = this._operand();\n          break;\n        }\n\n        case OP.LOAD_GLOBAL: {\n          var dst = this._operand();\n          var globalName = this._constant();\n\n          if (!(globalName in this.globals)) {\n            throw new ReferenceError(`${globalName} is not defined`);\n          }\n\n          frame.regs[dst] = this.globals[globalName];\n          break;\n        }\n\n        case OP.LOAD_UPVALUE: {\n          var dst = this._operand();\n          frame.regs[dst] = frame.closure.upvalues[this._operand()]._read();\n          break;\n        }\n\n        case OP.LOAD_THIS: {\n          var dst = this._operand();\n          frame.regs[dst] = frame.thisVal;\n          break;\n        }\n\n        case OP.MOVE: {\n          var dst = this._operand();\n          frame.regs[dst] = frame.regs[this._operand()];\n          break;\n        }\n\n        case OP.STORE_GLOBAL: {\n          // nameIdx and key are consumed inline so the concealConstants runtime\n          // transform can rewrite this._constant() consistently.\n          this.globals[this._constant()] = frame.regs[this._operand()];\n          break;\n        }\n\n        case OP.STORE_UPVALUE: {\n          var uvIdx = this._operand();\n          frame.closure.upvalues[uvIdx]._write(frame.regs[this._operand()]);\n          break;\n        }\n\n        case OP.GET_PROP: {\n          // dst = regs[obj][regs[key]]\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          frame.regs[dst] = obj[key];\n          break;\n        }\n\n        case OP.SET_PROP: {\n          // regs[obj][regs[key]] = regs[val]\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          var val = frame.regs[this._operand()];\n          // Reflect.set performs [[Set]] without throwing on failure,\n          // correctly simulating sloppy-mode assignment from a strict-mode host.\n          Reflect.set(obj, key, val);\n          break;\n        }\n\n        case OP.DELETE_PROP: {\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          frame.regs[dst] = delete obj[key];\n          break;\n        }\n\n        // \u2500\u2500 Arithmetic  (dst, src1, src2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.ADD: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a + frame.regs[this._operand()];\n          break;\n        }\n        case OP.SUB: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a - frame.regs[this._operand()];\n          break;\n        }\n        case OP.MUL: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a * frame.regs[this._operand()];\n          break;\n        }\n        case OP.DIV: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a / frame.regs[this._operand()];\n          break;\n        }\n        case OP.MOD: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a % frame.regs[this._operand()];\n          break;\n        }\n        case OP.BAND: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a & frame.regs[this._operand()];\n          break;\n        }\n        case OP.BOR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a | frame.regs[this._operand()];\n          break;\n        }\n        case OP.BXOR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a ^ frame.regs[this._operand()];\n          break;\n        }\n        case OP.SHL: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a << frame.regs[this._operand()];\n          break;\n        }\n        case OP.SHR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a >> frame.regs[this._operand()];\n          break;\n        }\n        case OP.USHR: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a >>> frame.regs[this._operand()];\n          break;\n        }\n\n        // \u2500\u2500 Comparison  (dst, src1, src2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.LT: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a < frame.regs[this._operand()];\n          break;\n        }\n        case OP.GT: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a > frame.regs[this._operand()];\n          break;\n        }\n        case OP.LTE: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a <= frame.regs[this._operand()];\n          break;\n        }\n        case OP.GTE: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a >= frame.regs[this._operand()];\n          break;\n        }\n        case OP.EQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a === frame.regs[this._operand()];\n          break;\n        }\n        case OP.NEQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a !== frame.regs[this._operand()];\n          break;\n        }\n        case OP.LOOSE_EQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a == frame.regs[this._operand()];\n          break;\n        }\n        case OP.LOOSE_NEQ: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a != frame.regs[this._operand()];\n          break;\n        }\n        case OP.IN: {\n          var dst = this._operand();\n          var a = frame.regs[this._operand()];\n          frame.regs[dst] = a in frame.regs[this._operand()];\n          break;\n        }\n        case OP.INSTANCEOF: {\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var ctor = frame.regs[this._operand()];\n          if (typeof ctor === \"function\") {\n            frame.regs[dst] = obj instanceof ctor;\n          } else {\n            // VM Closure - walk prototype chain for identity with ctor.prototype.\n            var proto = ctor.prototype;\n            var target = Object.getPrototypeOf(obj);\n            var result = false;\n            while (target !== null) {\n              if (target === proto) {\n                result = true;\n                break;\n              }\n              target = Object.getPrototypeOf(target);\n            }\n            frame.regs[dst] = result;\n          }\n          break;\n        }\n\n        // \u2500\u2500 Unary  (dst, src) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.UNARY_NEG: {\n          var dst = this._operand();\n          frame.regs[dst] = -frame.regs[this._operand()];\n          break;\n        }\n        case OP.UNARY_POS: {\n          var dst = this._operand();\n          frame.regs[dst] = +frame.regs[this._operand()];\n          break;\n        }\n        case OP.UNARY_NOT: {\n          var dst = this._operand();\n          frame.regs[dst] = !frame.regs[this._operand()];\n          break;\n        }\n        case OP.UNARY_BITNOT: {\n          var dst = this._operand();\n          frame.regs[dst] = ~frame.regs[this._operand()];\n          break;\n        }\n        case OP.TYPEOF: {\n          var dst = this._operand();\n          frame.regs[dst] = typeof frame.regs[this._operand()];\n          break;\n        }\n        case OP.VOID: {\n          var dst = this._operand();\n          this._operand(); // consume src \u2014 evaluated for side-effects by compiler\n          frame.regs[dst] = undefined;\n          break;\n        }\n        case OP.TYPEOF_SAFE: {\n          // dst, nameConstIdx \u2014 safe typeof for potentially-undeclared globals.\n          var dst = this._operand();\n          var name = this._constant();\n          var val = Object.prototype.hasOwnProperty.call(this.globals, name)\n            ? this.globals[name]\n            : undefined;\n          frame.regs[dst] = typeof val;\n          break;\n        }\n\n        // \u2500\u2500 Control flow \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.JUMP:\n          frame._pc = this._operand();\n          break;\n\n        case OP.JUMP_IF_FALSE: {\n          var src = this._operand();\n          var target = this._operand();\n          if (!frame.regs[src]) frame._pc = target;\n          break;\n        }\n\n        case OP.JUMP_IF_TRUE: {\n          // || short-circuit: if truthy, jump over RHS.\n          var src = this._operand();\n          var target = this._operand();\n          if (frame.regs[src]) frame._pc = target;\n          break;\n        }\n\n        // \u2500\u2500 Calls \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.CALL: {\n          // dst, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var callee = frame.regs[this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var c = callee[CLOSURE_SYM];\n            var f = new Frame(c, frame._pc, frame, this.globals, dst);\n            for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n            f.regs[c.fn.paramCount] = args;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            frame.regs[dst] = callee.apply(null, args);\n          }\n          break;\n        }\n\n        case OP.CALL_METHOD: {\n          // dst, receiverReg, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var receiver = frame.regs[this._operand()];\n          var callee = frame.regs[this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var c = callee[CLOSURE_SYM];\n            var f = new Frame(c, frame._pc, frame, receiver, dst);\n            for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n            f.regs[c.fn.paramCount] = args;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            frame.regs[dst] = callee.apply(receiver, args);\n          }\n          break;\n        }\n\n        case OP.NEW: {\n          // dst, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var callee = frame.regs[this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var c = callee[CLOSURE_SYM];\n            var newObj = Object.create(c.prototype || null);\n            var f = new Frame(c, frame._pc, frame, newObj, dst);\n            f._newObj = newObj;\n            for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n            f.regs[c.fn.paramCount] = args;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            // Reflect.construct is required - Object.create+apply does NOT set\n            // internal slots ([[NumberData]], [[StringData]], etc.) for built-ins.\n            frame.regs[dst] = Reflect.construct(callee, args);\n          }\n          break;\n        }\n\n        case OP.RETURN: {\n          var retVal = frame.regs[this._operand()];\n          this._closeUpvaluesFor(frame); // must happen before frame is abandoned\n\n          if (this._frameStack.length === 0) return retVal; // main script returning\n\n          // new-call rule: primitive return -> discard, use the constructed object instead\n          if (frame._newObj !== null) {\n            if (typeof retVal !== \"object\" || retVal === null)\n              retVal = frame._newObj;\n          }\n\n          var parentFrame = this._frameStack.pop();\n          parentFrame.regs[frame._retDstReg] = retVal;\n          this._currentFrame = parentFrame;\n          break;\n        }\n\n        case OP.THROW:\n          throw frame.regs[this._operand()];\n\n        // \u2500\u2500 Closures \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.MAKE_CLOSURE: {\n          // dst, startPc, paramCount, regCount, uvCount, [isLocal, idx, ...]\n          var dst = this._operand();\n          var startPc = this._operand();\n          var paramCount = this._operand();\n          var regCount = this._operand();\n          var uvCount = this._operand();\n\n          var uvDescs = new Array(uvCount);\n          for (var i = 0; i < uvCount; i++) {\n            var isLocalRaw = this._operand();\n            var uvIndex = this._operand();\n            uvDescs[i] = { isLocal: isLocalRaw, _index: uvIndex };\n          }\n\n          var fn = {\n            paramCount: paramCount,\n            regCount: regCount,\n            startPc: startPc,\n            upvalueDescriptors: uvDescs,\n          };\n\n          var closure = new Closure(fn);\n          for (var i = 0; i < uvDescs.length; i++) {\n            var uvd = uvDescs[i];\n            if (uvd.isLocal) {\n              closure.upvalues.push(this.captureUpvalue(frame, uvd._index));\n            } else {\n              closure.upvalues.push(frame.closure.upvalues[uvd._index]);\n            }\n          }\n\n          // Wrap in a native callable shell so host code (array methods,\n          // test assertions, setTimeout, etc.) can invoke VM closures.\n          // CLOSURE_SYM lets VM-internal CALL/NEW bypass the sub-VM entirely.\n          var self = this;\n          var shell = (function (c) {\n            return function () {\n              var args = Array.prototype.slice.call(arguments);\n              var sub = new VM(\n                self.bytecode,\n                0,\n                c.fn.regCount,\n                self.constants,\n                self.globals,\n              );\n              var f = new Frame(\n                c,\n                null,\n                null,\n                this == null ? self.globals : this,\n                0,\n              );\n              for (var i = 0; i < args.length; i++) f.regs[i] = args[i];\n              f.regs[c.fn.paramCount] = args;\n              sub._currentFrame = f;\n              return sub.run();\n            };\n          })(closure);\n          shell[CLOSURE_SYM] = closure;\n          shell.prototype = closure.prototype; // unified prototype for new/instanceof\n          frame.regs[dst] = shell;\n          break;\n        }\n\n        // \u2500\u2500 Collections \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.BUILD_ARRAY: {\n          // dst, count, [elemReg...]\n          var dst = this._operand();\n          var count = this._operand();\n          var elems = new Array(count);\n          for (var i = 0; i < count; i++)\n            elems[i] = frame.regs[this._operand()];\n          frame.regs[dst] = elems;\n          break;\n        }\n\n        case OP.BUILD_OBJECT: {\n          // dst, pairCount, [keyReg, valReg, ...]\n          var dst = this._operand();\n          var pairCount = this._operand();\n          var o = {};\n          for (var i = 0; i < pairCount; i++) {\n            var key = frame.regs[this._operand()];\n            var val = frame.regs[this._operand()];\n            o[key] = val;\n          }\n          frame.regs[dst] = o;\n          break;\n        }\n\n        // \u2500\u2500 Property definitions (getters / setters) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.DEFINE_GETTER: {\n          // obj, key, fn\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          var getterFn = frame.regs[this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var getDesc                     = {\n            get: getterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.set === \"function\") {\n            getDesc.set = existingDesc.set;\n          }\n          Object.defineProperty(obj, key, getDesc);\n          break;\n        }\n\n        case OP.DEFINE_SETTER: {\n          // obj, key, fn\n          var obj = frame.regs[this._operand()];\n          var key = frame.regs[this._operand()];\n          var setterFn = frame.regs[this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var setDesc                     = {\n            set: setterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.get === \"function\") {\n            setDesc.get = existingDesc.get;\n          }\n          Object.defineProperty(obj, key, setDesc);\n          break;\n        }\n\n        // \u2500\u2500 For-in iteration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.FOR_IN_SETUP: {\n          // dst, src \u2014 build iterator object from enumerable keys of regs[src]\n          var dst = this._operand();\n          var obj = frame.regs[this._operand()];\n          var keys = [];\n          if (obj !== null && obj !== undefined) {\n            var seen = Object.create(null);\n            var cur = Object(obj); // box primitives\n            while (cur !== null) {\n              var ownNames = Object.getOwnPropertyNames(cur);\n              for (var i = 0; i < ownNames.length; i++) {\n                var k = ownNames[i];\n                if (!(k in seen)) {\n                  seen[k] = true;\n                  var propDesc = Object.getOwnPropertyDescriptor(cur, k);\n                  if (propDesc && propDesc.enumerable) {\n                    keys.push(k);\n                  }\n                }\n              }\n              cur = Object.getPrototypeOf(cur);\n            }\n          }\n          frame.regs[dst] = { _keys: keys, i: 0 };\n          break;\n        }\n\n        case OP.FOR_IN_NEXT: {\n          // dst, iterReg, exitTarget\n          // Advances iterator; writes next key to dst, or jumps to exitTarget when done.\n          var dst = this._operand();\n          var iter = frame.regs[this._operand()];\n          var exitTarget = this._operand();\n          if (iter.i >= iter._keys.length) {\n            frame._pc = exitTarget;\n          } else {\n            frame.regs[dst] = iter._keys[iter.i++];\n          }\n          break;\n        }\n\n        // \u2500\u2500 Exception handling \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.TRY_SETUP: {\n          // handlerPc, exceptionReg \u2014 push exception handler record onto current frame.\n          frame._handlerStack.push({\n            handlerPc: this._operand(),\n            exceptionReg: this._operand(),\n            frameStackDepth: this._frameStack.length,\n          });\n          break;\n        }\n\n        case OP.TRY_END: {\n          // Normal exit from a try block \u2014 disarm the exception handler.\n          frame._handlerStack.pop();\n          break;\n        }\n\n        // \u2500\u2500 Self-modifying bytecode \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.PATCH: {\n          // destPc, sliceStart, sliceEnd\n          var destPc = this._operand();\n          var sliceStart = this._operand();\n          var sliceEnd = this._operand();\n          for (var pi = sliceStart; pi < sliceEnd; pi++) {\n            this.bytecode[destPc + (pi - sliceStart)] = this.bytecode[pi];\n          }\n          break;\n        }\n\n        case OP.DEBUGGER: {\n          debugger;\n          break;\n        }\n\n        default:\n          throw new Error(\n            \"Unknown opcode: \" + op + \" at pc \" + (frame._pc - 1),\n          );\n      }\n    } catch (err) {\n      // Exception handler unwinding (CPython-style frame walk, Lua-style upvalue close).\n      // Walk from the current frame upward until we find a frame that has an open\n      // exception handler (TRY_SETUP without a matching TRY_END).\n      // For every frame we abandon along the way, close its captured upvalues.\n      var handledFrame = null;\n      var searchFrame = this._currentFrame;\n      while (true) {\n        if (searchFrame._handlerStack.length > 0) {\n          handledFrame = searchFrame;\n          break;\n        }\n        // No handler in this frame \u2014 abandon it and walk up.\n        this._closeUpvaluesFor(searchFrame);\n        if (this._frameStack.length === 0) break;\n        searchFrame = this._frameStack.pop();\n        this._currentFrame = searchFrame;\n      }\n\n      if (!handledFrame) throw err; // no handler anywhere \u2014 propagate to host\n\n      var h = handledFrame._handlerStack.pop();\n      // Discard any call-frames that were pushed inside the try body.\n      this._frameStack.length = h.frameStackDepth;\n      // Write the caught exception directly into the designated register.\n      handledFrame.regs[h.exceptionReg] = err;\n      // Jump to the catch block.\n      handledFrame._pc = h.handlerPc;\n      this._currentFrame = handledFrame;\n    }\n  }\n};\n\n// Boot\nvar globals      = {}; // global object for globals\n\n// Always pull built-ins from globalThis so eval() scoping can't shadow them\n// with a local `window` variable (e.g. the test harness fake window).\nfor (var k of Object.getOwnPropertyNames(globalThis)) {\n  globals[k] = globalThis[k];\n}\n// If a window object is in scope (browser or test harness), capture it\n// explicitly so VM code can read/write window.TEST_OUTPUT etc.\nif (typeof window !== \"undefined\") {\n  globals.window = window;\n  for (var k of Object.getOwnPropertyNames(window)) {\n    globals[k] = window[k];\n  }\n}\n\n// Transfer common primitives\nglobals.undefined = undefined;\nglobals.Infinity = Infinity;\nglobals.NaN = NaN;\n\nvar vm = new VM(\n  decodeBytecode(BYTECODE),\n  MAIN_START_PC,\n  MAIN_REG_COUNT,\n  CONSTANTS,\n  globals,\n);\nvm.run();\n";
 export const VM_RUNTIME = readVMRuntimeFile().split("@START")[1];
 export const SOURCE_NODE_SYM = Symbol("SOURCE_NODE");
 
@@ -224,6 +225,10 @@ class FnContext {
 }
 // ── Compiler ──────────────────────────────────────────────────────────────────
 export class Compiler {
+  /** Internal variable slot registry.
+   *  globally: shared name→index pool (written on first sight; reused by non-random mode or by 50% chance in random mode).
+   *  opcodes:  per-opcode source-of-truth — all assignment lookups are read/written here. */
+
   emit(bc, instr, node) {
     bc.push(instr);
     instr[SOURCE_NODE_SYM] = node;
@@ -241,8 +246,13 @@ export class Compiler {
     this._labelCount = 0;
     this.serializer = new Serializer(this);
     this.MACRO_OPS = {};
+    this.MICRO_OPS = {};
     this.SPECIALIZED_OPS = {};
     this.ALIASED_OPS = {};
+    this._internals = {
+      globally: new Map(),
+      opcodes: new Map()
+    };
     this.OP = {
       ...OP_ORIGINAL
     };
@@ -380,13 +390,6 @@ export class Compiler {
     return this.compileAST(ast);
   }
   compileAST(ast) {
-    traverse(ast, {
-      FunctionDeclaration: path => {
-        if (path.parent.type !== "Program") return;
-        this._compileFunctionDecl(path.node);
-        path.skip();
-      }
-    });
     this._compileMain(ast.program.body);
     return this.bytecode;
   }
@@ -1017,10 +1020,10 @@ export class Compiler {
       case "TryStatement":
         {
           if (node.finalizer) {
-            throw new Error("try..finally is not supported. Use a helper function instead");
+            throw new Error("try..finally is not supported");
           }
           if (!node.handler) {
-            throw new Error("try without catch is not supported (requires finally).");
+            throw new Error("try without catch is not supported");
           }
           const catchLabel = this._makeLabel("catch");
           const afterCatchLabel = this._makeLabel("after_catch");
@@ -1207,6 +1210,25 @@ export class Compiler {
           ctx.regTop = baseTop + 1;
           return reg_result;
         }
+      case "TemplateLiteral":
+        {
+          const n = node;
+          // Fold: quasi[0] + expr[0] + quasi[1] + ... + quasi[last]
+          let acc = ctx.allocReg();
+          this.emit(bc, [this.OP.LOAD_CONST, acc, b.constantOperand(n.quasis[0].value.cooked ?? "")], node);
+          for (let i = 0; i < n.expressions.length; i++) {
+            const exprReg = this._compileExpr(n.expressions[i], scope, bc);
+            const t1 = ctx.allocReg();
+            this.emit(bc, [this.OP.ADD, t1, acc, exprReg], node);
+            acc = t1;
+            const quasiReg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_CONST, quasiReg, b.constantOperand(n.quasis[i + 1].value.cooked ?? "")], node);
+            const t2 = ctx.allocReg();
+            this.emit(bc, [this.OP.ADD, t2, acc, quasiReg], node);
+            acc = t2;
+          }
+          return acc;
+        }
       case "BinaryExpression":
         {
           const n = node;
@@ -1243,12 +1265,40 @@ export class Compiler {
       case "UpdateExpression":
         {
           const n = node;
-          ok(n.argument.type === "Identifier", "UpdateExpression requires identifier");
-          const name = n.argument.name;
-          const res = this._resolve(name, this._currentCtx);
           const bumpOp = n.operator === "++" ? this.OP.ADD : this.OP.SUB;
 
-          // Load current value into a register (locals are already in place)
+          // Shared: compute curReg +/- 1 into newReg, return [postfixResult, newReg]
+          const applyBump = curReg => {
+            const postfixReg = n.prefix ? -1 : (() => {
+              const r = ctx.allocReg();
+              this.emit(bc, [this.OP.MOVE, r, curReg], node);
+              return r;
+            })();
+            const oneReg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_CONST, oneReg, b.constantOperand(1)], node);
+            const newReg = ctx.allocReg();
+            this.emit(bc, [bumpOp, newReg, curReg, oneReg], node);
+            return [postfixReg, newReg];
+          };
+          if (n.argument.type === "MemberExpression") {
+            const mem = n.argument;
+            const objReg = this._compileExpr(mem.object, scope, bc);
+            let keyReg;
+            if (mem.computed) {
+              keyReg = this._compileExpr(mem.property, scope, bc);
+            } else {
+              keyReg = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(mem.property.name)], node);
+            }
+            const curReg = ctx.allocReg();
+            this.emit(bc, [this.OP.GET_PROP, curReg, objReg, keyReg], node);
+            const [postfixReg, newReg] = applyBump(curReg);
+            this.emit(bc, [this.OP.SET_PROP, objReg, keyReg, newReg], node);
+            return n.prefix ? newReg : postfixReg;
+          }
+          ok(n.argument.type === "Identifier", "UpdateExpression requires identifier or member expression");
+          const name = n.argument.name;
+          const res = this._resolve(name, this._currentCtx);
           let curReg;
           if (res.kind === "local") {
             curReg = res.slot;
@@ -1259,23 +1309,7 @@ export class Compiler {
             curReg = ctx.allocReg();
             this.emit(bc, [this.OP.LOAD_GLOBAL, curReg, b.constantOperand(name)], node);
           }
-
-          // For postfix we need to preserve the *old* value as the result
-          let resultReg;
-          if (!n.prefix) {
-            resultReg = ctx.allocReg();
-            this.emit(bc, [this.OP.MOVE, resultReg, curReg], node);
-          } else {
-            resultReg = -1; // placeholder – will become newReg below
-          }
-          const oneReg = ctx.allocReg();
-          this.emit(bc, [this.OP.LOAD_CONST, oneReg, b.constantOperand(1)], node);
-
-          // Compute new value (always into a fresh register)
-          const newReg = ctx.allocReg();
-          this.emit(bc, [bumpOp, newReg, curReg, oneReg], node);
-
-          // Write the new value back (local = MOVE, others = STORE_xxx)
+          const [postfixReg, newReg] = applyBump(curReg);
           if (res.kind === "local") {
             this.emit(bc, [this.OP.MOVE, res.slot, newReg], node);
           } else if (res.kind === "upvalue") {
@@ -1283,12 +1317,7 @@ export class Compiler {
           } else {
             this.emit(bc, [this.OP.STORE_GLOBAL, b.constantOperand(name), newReg], node);
           }
-
-          // Prefix returns the *new* value (we already have it in newReg – no reload needed)
-          if (n.prefix) {
-            resultReg = newReg;
-          }
-          return resultReg;
+          return n.prefix ? newReg : postfixReg;
         }
       case "AssignmentExpression":
         {
@@ -1588,16 +1617,20 @@ class Serializer {
     }
     return out;
   }
-  _serializeInstr(instr, constants) {
+  _serializeInstr(instr) {
     const op = instr[0];
     const operands = instr.slice(1);
+    const constants = this.compiler.constants;
     const resolvedOperands = operands.filter(operand => operand?.placeholder !== true).map(o => o?.resolvedValue ?? o);
     for (const o of resolvedOperands) {
       ok(typeof o === "number", "Unresolved operand: " + JSON.stringify(o));
       ok(o >= 0 && o <= 0xffff, `Operand overflow (max 0xFFFF u16): ${o}`);
     }
     ok(op >= 0 && op <= 0xffff, `Opcode overflow (max 0xFFFF u16): ${op}`);
-    const name = this.OP_NAME[op] || `OP_${op}`;
+    let name = this.OP_NAME[op];
+    if (!name || name.includes("{")) {
+      name = `OP_${op}`;
+    }
     let comment = name;
     function formatLoc(loc) {
       return loc ? `${loc.line}:${loc.column}` : "";
@@ -1636,10 +1669,10 @@ class Serializer {
           comment += `  reg[${dst}] PC=${resolvedOperands[1]} (params=${resolvedOperands[2]} regs=${resolvedOperands[3]} upvalues=${resolvedOperands[4]})`;
           break;
         case this.OP.CALL:
-          comment += `  reg[${dst}] = call(reg[${resolvedOperands[1]}], ${resolvedOperands[2]} args)`;
+          comment += `  reg[${dst}] = reg[${resolvedOperands[1]}](${resolvedOperands[2]} args)`;
           break;
         case this.OP.CALL_METHOD:
-          comment += `  reg[${dst}] = method(recv=reg[${resolvedOperands[1]}], fn=reg[${resolvedOperands[2]}], ${resolvedOperands[3]} args)`;
+          comment += `  reg[${dst}] = reg[${resolvedOperands[2]}](recv=reg[${resolvedOperands[1]}], ${resolvedOperands[3]} args)`;
           break;
         case this.OP.NEW:
           comment += `  reg[${dst}] = new reg[${resolvedOperands[1]}](${resolvedOperands[2]} args)`;
@@ -1653,6 +1686,12 @@ class Serializer {
         case this.OP.BUILD_OBJECT:
           comment += `  reg[${dst}] = {${resolvedOperands[1]} pairs}`;
           break;
+        case this.OP.GET_PROP:
+          comment += `  reg[${dst}] = reg[${resolvedOperands[1]}][reg[${resolvedOperands[2]}]]`;
+          break;
+        case this.OP.SET_PROP:
+          comment += `  reg[${resolvedOperands[0]}][reg[${resolvedOperands[1]}]] = reg[${resolvedOperands[2]}]`;
+          break;
         default:
           comment += resolvedOperands.length === 1 ? `  ${resolvedOperands[0]}` : `  [${resolvedOperands.join(", ")}]`;
       }
@@ -1684,7 +1723,6 @@ class Serializer {
         const resolvedValues = operands.map(o => o?.resolvedValue ?? o);
         const originalName = compiler.OP_NAME[specializedOpInfo.originalOp];
         compiler.OP_NAME[instr[0]] = `${originalName}_${resolvedValues.join("_")}`;
-        specializedOpInfo.resolvedOperands = operands;
       }
       serialized.push(instr);
     }
@@ -1704,14 +1742,8 @@ class Serializer {
     const mainStartPc = compiler.mainStartPc;
     const mainRegCount = compiler.mainRegCount;
     let sections = [];
-    var textForm = [];
     var initBody = [];
     var bytecodeResult = this._serializeBytecode(bytecode, compiler);
-    for (const instr of bytecodeResult.bytecode) {
-      const serialized = this._serializeInstr(instr, constants);
-      textForm.push(serialized.text);
-    }
-    initBody.push(textForm.map(line => `// ${line}`).join("\n"));
     const flat = bytecodeResult.bytecode.flatMap(instr => {
       let filtered = instr.filter(x => x?.placeholder !== true);
       let resolved = filtered.map(x => x?.resolvedValue ?? x);
@@ -1742,6 +1774,9 @@ export async function compileAndSerialize(sourceCode, options) {
   if (options.specializedOpcodes) {
     passes.push(specializedOpcodes);
   }
+  if (options.microOpcodes) {
+    passes.push(microOpcodes);
+  }
   if (options.macroOpcodes) {
     passes.push(macroOpcodes);
   }
@@ -1770,7 +1805,19 @@ export async function compileAndSerialize(sourceCode, options) {
 
   // Build and obfuscate the runtime.
   const runtimeSource = compiler.serializer.serialize(bytecode, constResult.constants, compiler);
-  const code = await obfuscateRuntime(runtimeSource, bytecode, options, compiler);
+
+  // This part was purposefully pulled out Serializer as OP_NAME's get resolved during obfuscateRuntime
+  // So for the most useful comments, it's ran absolutely last
+  // Tests also rely on correct comments so it's required
+  const generateBytecodeComment = () => {
+    var lines = [];
+    for (const instr of bytecode) {
+      const serialized = compiler.serializer._serializeInstr(instr);
+      lines.push("// " + serialized.text);
+    }
+    return lines.join("\n");
+  };
+  const code = await obfuscateRuntime(runtimeSource, bytecode, options, compiler, generateBytecodeComment);
   return {
     code
   };

package/dist/runtime.js

@@ -76,6 +76,7 @@ function VM(bytecode, mainStartPc, mainRegCount, constants, globals) {
     startPc: mainStartPc // <- where main begins
   };
   this._currentFrame = new Frame(new Closure(mainFn), null, null, undefined, 0);
+  this._internals = {};
 }
 
 // Consume the next slot from the flat bytecode stream and advance the PC.
@@ -815,7 +816,10 @@ for (var k of Object.getOwnPropertyNames(globalThis)) {
 // If a window object is in scope (browser or test harness), capture it
 // explicitly so VM code can read/write window.TEST_OUTPUT etc.
 if (typeof window !== "undefined") {
-  globals["window"] = window;
+  globals.window = window;
+  for (var k of Object.getOwnPropertyNames(window)) {
+    globals[k] = window[k];
+  }
 }
 
 // Transfer common primitives

package/dist/transforms/bytecode/aliasedOpcodes.js

@@ -1,5 +1,5 @@
 import { SOURCE_NODE_SYM } from "../../compiler.js";
-import { nextFreeSlot, U16_MAX } from "../../utils/op-utils.js";
+import { nextFreeSlot } from "../../utils/op-utils.js";
 import { shuffle } from "../../utils/random-utils.js";
 
 // Opcodes that must not be aliased.
@@ -31,12 +31,6 @@ export function aliasedOpcodes(bc, compiler) {
     baseOpValueToName.set(val, name);
   }
 
-  // Collect all currently used opcode slots (base + any dynamically assigned)
-  const usedOpcodes = new Set(Object.keys(compiler.OP_NAME).map(k => parseInt(k, 10)).filter(v => !isNaN(v)));
-  if (usedOpcodes.size > U16_MAX) return {
-    bytecode: bc
-  };
-
   // ── Step 1: count frequency and determine arity for each eligible base opcode ─
   // We scan the actual post-transform bytecode so frequency reflects what's
   // really left (specialized/macro ops already consumed their share).
@@ -73,7 +67,7 @@ export function aliasedOpcodes(bc, compiler) {
   const aliasMap = new Map();
   const aliasedOps = {};
   for (const [originalOp, stats] of candidates) {
-    const aliasOp = nextFreeSlot(usedOpcodes);
+    const aliasOp = nextFreeSlot(compiler);
     if (aliasOp === -1) break;
     const arity = stats.arity;
 

package/dist/transforms/bytecode/macroOpcodes.js

@@ -1,5 +1,6 @@
 import { SOURCE_NODE_SYM } from "../../compiler.js";
-import { nextFreeSlot, U16_MAX } from "../../utils/op-utils.js";
+import { nextFreeSlot } from "../../utils/op-utils.js";
+import { ok } from "node:assert";
 
 // Opcodes that must not appear in a non-terminal position inside a macro window.
 // Jump ops: modifying frame._pc mid-execution causes the macro handler to
@@ -20,8 +21,7 @@ import { nextFreeSlot, U16_MAX } from "../../utils/op-utils.js";
 // Algorithm:
 //   1. Count every eligible window of length 2–5 by its op-code signature.
 //   2. Keep sequences that appear >= 2 times; sort by frequency then length.
-//   3. Assign unused opcode values (0–255, not already claimed by compiler.OP)
-//      to the most-frequent candidates and store in compiler.MACRO_OPS.
+//   3. Use nextFreeSlot() to assign a new opcode to each of the best candidates
 //   4. Re-scan bytecode, replacing each matched sequence with a single
 //      multi-operand instruction:
 //        [macroOpCode, operands_of_instr_0..., operands_of_instr_1..., ...]
@@ -33,31 +33,30 @@ export function macroOpcodes(bc, compiler) {
     const opVal = compiler.OP[name];
     originalOpToName.set(opVal, name);
   }
+
+  // Names are used instead of codes as specialized opcodes may generate based off these and it should not be considered eligible still
+  const alwaysExcluded = ["PATCH", "TRY_SETUP", "TRY_END", "DEBUGGER", "MAKE_CLOSURE"];
+  const nonTerminalExcluded = ["RETURN", "CALL", "CALL_METHOD", "NEW", "THROW"];
   function isEligible(op, compiler, isLast = false) {
     if (op === null) return false;
     const {
       OP,
-      JUMP_OPS
+      JUMP_OPS,
+      OP_NAME
     } = compiler;
     // Infrastructure and variable-length ops are never eligible.
-    const alwaysExcluded = new Set([OP.PATCH, OP.TRY_SETUP, OP.TRY_END, OP.DEBUGGER, OP.MAKE_CLOSURE // variable-length operands — cannot generate a static handler
-    ]);
-    if (alwaysExcluded.has(op)) return false;
+    const opName = OP_NAME[op];
+    ok(opName, `Unknown opcode ${op} (not in OP_NAME)`);
+    if (alwaysExcluded.find(name => opName.includes(name))) return false;
+
     // Jump and frame-changing ops are only eligible as the terminal instruction.
     if (!isLast) {
       if (JUMP_OPS.has(op)) return false;
-      const nonTerminalExcluded = new Set([OP.RETURN, OP.CALL, OP.CALL_METHOD, OP.NEW, OP.THROW]);
-      if (nonTerminalExcluded.has(op)) return false;
+      if (nonTerminalExcluded.find(name => opName.includes(name))) return false;
     }
-    return originalOpToName.has(op); // Only original Ops are eligible (specialized disallowed)
+    return OP_NAME[op] !== undefined;
   }
 
-  // Collect every opcode value already in use so we can find free slots.
-  const usedOpcodes = new Set(Object.values(compiler.OP).filter(v => v !== undefined));
-  if (usedOpcodes.size > U16_MAX) return {
-    bytecode: bc
-  };
-
   // ── Step 1: count window frequencies ──────────────────────────────────────
   const freqMap = new Map();
   for (let i = 0; i < bc.length; i++) {
@@ -66,7 +65,8 @@ export function macroOpcodes(bc, compiler) {
       const ops = [];
       let valid = true;
       for (let j = 0; j < len; j++) {
-        const op = bc[i + j][0];
+        const instr = bc[i + j];
+        const op = instr[0];
         const isLast = j === len - 1;
         if (!isEligible(op, compiler, isLast)) {
           valid = false;
@@ -98,7 +98,7 @@ export function macroOpcodes(bc, compiler) {
 
   // ── Step 3: assign free opcode slots to the best candidates ───────────────
   for (let i = 0; i < candidates.length; i++) {
-    const macroOp = nextFreeSlot(usedOpcodes);
+    const macroOp = nextFreeSlot(compiler);
     if (macroOp === -1) break;
     const ops = candidates[i].ops;
     compiler.MACRO_OPS[macroOp] = ops;
@@ -144,7 +144,9 @@ export function macroOpcodes(bc, compiler) {
       // Each instruction contributes instr.slice(1) — zero or more operands.
       const allOperands = [];
       for (let j = 0; j < len; j++) {
-        allOperands.push(...bc[i + j].slice(1));
+        var instr = bc[i + j];
+        var operands = instr.slice(1);
+        allOperands.push(...operands);
       }
       const newInstr = [macroOpCode, ...allOperands];
       newInstr[SOURCE_NODE_SYM] = instructions[0][SOURCE_NODE_SYM];