js-confuser-vm 0.1.0 → 0.1.2

package/dist/compiler.js

@@ -5,40 +5,43 @@ import traverseImport from "@babel/traverse";
 import { generate } from "@babel/generator";
 import { stripTypeScriptTypes } from "module";
 import { ok } from "assert";
-import { obfuscateRuntime } from "./build-runtime.js";
+import { buildRuntime } from "./build-runtime.js";
 import { DEFAULT_OPTIONS } from "./options.js";
 import { resolveLabels } from "./transforms/bytecode/resolveLabels.js";
 import { resolveRegisters } from "./transforms/bytecode/resolveRegisters.js";
-import { resolveConstants } from "./transforms/bytecode/resolveContants.js";
+import { resolveConstants } from "./transforms/bytecode/resolveConstants.js";
 import { selfModifying } from "./transforms/bytecode/selfModifying.js";
 import { macroOpcodes } from "./transforms/bytecode/macroOpcodes.js";
-import { microOpcodes } from "./transforms/bytecode/microOpcodes.js";
 import { specializedOpcodes } from "./transforms/bytecode/specializedOpcodes.js";
 import { aliasedOpcodes } from "./transforms/bytecode/aliasedOpcodes.js";
 import { getRandomInt } from "./utils/random-utils.js";
-import { U16_MAX } from "./utils/op-utils.js";
+import { U16_MAX, U32_MAX } from "./utils/op-utils.js";
 import { concealConstants } from "./transforms/bytecode/concealConstants.js";
 import { dispatcher } from "./transforms/bytecode/dispatcher.js";
+import { controlFlowFlattening } from "./transforms/bytecode/controlFlowFlattening.js";
+import { stringConcealing } from "./transforms/bytecode/stringConcealing.js";
+import { now } from "./utils/profile-utils.js";
+import { walkHoistScope } from "./utils/ast-utils.js";
 const traverse = traverseImport.default || traverseImport;
-const readVMRuntimeFile = () => "import { OP_ORIGINAL as OP } from \"./compiler.ts\";\nconst BYTECODE = [];\nconst MAIN_START_PC = 0;\nconst MAIN_REG_COUNT = 0;\nconst CONSTANTS = [];\nconst ENCODE_BYTECODE = false;\nconst TIMING_CHECKS = false;\n// The text above is not included in the compiled output - for type intellisense only\n// @START\n\nfunction decodeBytecode(s) {\n  if (!ENCODE_BYTECODE) return s;\n\n  var b =\n    typeof Buffer !== \"undefined\"\n      ? Buffer.from(s, \"base64\")\n      : Uint8Array.from(atob(s), function (c) {\n          return c.charCodeAt(0);\n        });\n  // Each slot is a u16 stored as 2 little-endian bytes.\n  var r = new Uint16Array(b.length / 2);\n  for (var i = 0; i < r.length; i++) r[i] = b[i * 2] | (b[i * 2 + 1] << 8);\n  return r;\n}\n\n// Closure symbol\n// Used to tag shell functions so the VM can fast-path back to the\n// inner Closure instead of going through a sub-VM on internal calls.\nvar CLOSURE_SYM = Symbol(); // Nameless for obfuscation\n\n// Upvalue \u2014 Lua/CPython style.\n// While the outer frame is alive: reads/writes go to vm._regs[_absSlot].\n// After the outer frame returns (closed): reads/writes hit this._value.\n// _absSlot is the absolute index in VM._regs (frame._base + local slot).\nfunction Upvalue(regs, absSlot) {\n  this._regs = regs; // shared reference to VM._regs flat array\n  this._absSlot = absSlot; // absolute index; stable as long as frame is alive\n  this._closed = false;\n  this._value = undefined;\n}\nUpvalue.prototype._read = function () {\n  return this._closed ? this._value : this._regs[this._absSlot];\n};\nUpvalue.prototype._write = function (v) {\n  if (this._closed) this._value = v;\n  else this._regs[this._absSlot] = v;\n};\nUpvalue.prototype._close = function () {\n  this._value = this._regs[this._absSlot];\n  this._closed = true;\n};\n\n// Closure & Frame\nfunction Closure(fn) {\n  this.fn = fn;\n  this.upvalues = [];\n  this.prototype = {}; // <- default prototype object for `new`\n}\n\n// Frame \u2014 analogous to Lua CallInfo / CPython PyFrameObject.\n// Does NOT own a register array; registers live in VM._regs[_base .. _base+regCount).\nfunction Frame(closure, returnPc, parent, thisVal, retDstReg, base) {\n  this.closure = closure;\n  this._base = base; // absolute offset into VM._regs for this frame's r0\n  this._pc = closure.fn.startPc;\n  this._returnPc = returnPc;\n  this._parent = parent;\n  this.thisVal = thisVal !== undefined ? thisVal : undefined;\n  this._retDstReg = retDstReg !== undefined ? retDstReg : 0;\n  this._newObj = null;\n  this._handlerStack = [];\n}\n\n// VM\nfunction VM(bytecode, mainStartPc, mainRegCount, constants, globals) {\n  this.bytecode = bytecode;\n  this.constants = constants;\n  this.globals = globals;\n  this._frameStack = [];\n  this._openUpvalues = [];\n\n  // \u2500\u2500 Flat register file (Lua-style) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // All frames share a single array.  Each Frame records its _base offset.\n  // _regsTop is the next free slot (= base of the hypothetical next frame).\n  // On CALL:   newBase = _regsTop; _regsTop += fn.regCount\n  // On RETURN: _regsTop = frame._base   (pop the frame's register window)\n  this._regs = new Array(mainRegCount).fill(undefined);\n  this._regsTop = mainRegCount; // main frame occupies [0, mainRegCount)\n\n  var mainFn = {\n    paramCount: 0,\n    regCount: mainRegCount,\n    startPc: mainStartPc,\n  };\n  this._currentFrame = new Frame(\n    new Closure(mainFn),\n    null,\n    null,\n    undefined,\n    0,\n    0,\n  );\n  this._internals = {};\n}\n\n// Consume the next slot from the flat bytecode stream and advance the PC.\n// Called by opcode handlers to read each of their operands in order.\nVM.prototype._operand = function () {\n  return this.bytecode[this._currentFrame._pc++];\n};\n\nVM.prototype.captureUpvalue = function (frame, slot) {\n  // Dedup by absolute slot \u2014 two closures capturing the same local share one Upvalue.\n  var absSlot = frame._base + slot;\n  for (var i = 0; i < this._openUpvalues.length; i++) {\n    var uv = this._openUpvalues[i];\n    if (!uv._closed && uv._absSlot === absSlot) return uv;\n  }\n  var uv = new Upvalue(this._regs, absSlot);\n  this._openUpvalues.push(uv);\n  return uv;\n};\n\n// Reads and decodes a constant from the pool.\n// idx  \u2014 pool index (first operand of the constant pair emitted by resolveConstants).\n// key  \u2014 conceal key (second operand). 0 means no concealment.\n//\n// For integers:  stored value is (original ^ key); XOR again to recover.\n// For strings:   stored value is a base64 string containing u16 LE byte pairs.\n//                Mirrors decodeBytecode: base64 \u2192 bytes \u2192 u16 LE \u2192 XOR with\n//                (key + i) & 0xFFFF to recover the original char codes.\n// idxIn, keyIn are passed in from specializedOpcodes when the operands are determined at compile time.\nVM.prototype._constant = function (idxIn, keyIn) {\n  var idx = idxIn ?? this._operand();\n  var key = keyIn ?? this._operand();\n\n  var v = this.constants[idx];\n  if (!key) return v;\n  if (typeof v === \"number\") return v ^ key;\n  // String: base64-decode to u16 LE byte pairs, then XOR each code with (key+i).\n  var b =\n    typeof Buffer !== \"undefined\"\n      ? Buffer.from(v, \"base64\")\n      : Uint8Array.from(atob(v), function (c) {\n          return c.charCodeAt(0);\n        });\n  var out = \"\";\n  for (var i = 0; i < b.length / 2; i++) {\n    var code = b[i * 2] | (b[i * 2 + 1] << 8); // u16 LE\n    out += String.fromCharCode(code ^ ((key + i) & 0xffff));\n  }\n  return out;\n};\n\nVM.prototype._closeUpvaluesFor = function (frame) {\n  // Called on RETURN \u2014 close every upvalue whose absolute slot falls within\n  // this frame's register window [_base, _base + regCount).\n  var lo = frame._base;\n  var hi = frame._base + frame.closure.fn.regCount;\n  this._openUpvalues = this._openUpvalues.filter(function (uv) {\n    if (!uv._closed && uv._absSlot >= lo && uv._absSlot < hi) {\n      uv._close();\n      return false;\n    }\n    return true;\n  });\n};\n\nVM.prototype._ensureRegisterWindow = function (base, regCount) {\n  var end = base + regCount;\n  while (this._regs.length < end) this._regs.push(undefined);\n  for (var i = base; i < end; i++) this._regs[i] = undefined;\n};\n\nVM.prototype.run = function () {\n  var now = () => {\n    return performance.now();\n  };\n\n  var lastTime = now();\n\n  while (true) {\n    var frame = this._currentFrame;\n    var bc = this.bytecode;\n    if (frame._pc >= bc.length) break;\n\n    var pc = frame._pc++;\n    var op = this.bytecode[pc];\n    var opcode = this.bytecode[pc];\n    // console.log(\n    //   \"pc=\" + pc,\n    //   \"opcode=\" + opcode,\n    //   Object.keys(OP).find((key) => OP[key] === opcode),\n    // );\n\n    // Debugging protection: Detects debugger by checking for >1s pauses which can only happen from debugger; or extremely slow sync tasks\n    if (TIMING_CHECKS) {\n      var currentTime = now();\n      var isTamper = currentTime - lastTime > 1000;\n      lastTime = currentTime;\n      if (isTamper) {\n        // Poison the bytecode\n        for (var i = 0; i < this.bytecode.length; i++) this.bytecode[i] = 0;\n        // Break the current state\n        for (var i2 = frame._base; i2 < this._regsTop; i2++)\n          this._regs[i2] = undefined;\n        op = OP.JUMP;\n        frame._pc = this.bytecode.length; // jump past end to halt\n      }\n    }\n\n    try {\n      var regs = this._regs;\n      var base = frame._base;\n      /* @SWITCH */\n      switch (op) {\n        case OP.LOAD_CONST: {\n          var dst = this._operand();\n          regs[base + dst] = this._constant();\n          break;\n        }\n\n        case OP.LOAD_INT: {\n          var dst = this._operand();\n          regs[base + dst] = this._operand();\n          break;\n        }\n\n        case OP.LOAD_GLOBAL: {\n          var dst = this._operand();\n          var globalName = this._constant();\n\n          if (!(globalName in this.globals)) {\n            throw new ReferenceError(`${globalName} is not defined`);\n          }\n\n          regs[base + dst] = this.globals[globalName];\n          break;\n        }\n\n        case OP.LOAD_UPVALUE: {\n          var dst = this._operand();\n          regs[base + dst] = frame.closure.upvalues[this._operand()]._read();\n          break;\n        }\n\n        case OP.LOAD_THIS: {\n          var dst = this._operand();\n          regs[base + dst] = frame.thisVal;\n          break;\n        }\n\n        case OP.MOVE: {\n          var dst = this._operand();\n          regs[base + dst] = regs[base + this._operand()];\n          break;\n        }\n\n        case OP.STORE_GLOBAL: {\n          // nameIdx and key are consumed inline so the concealConstants runtime\n          // transform can rewrite this._constant() consistently.\n          this.globals[this._constant()] = regs[base + this._operand()];\n          break;\n        }\n\n        case OP.STORE_UPVALUE: {\n          var uvIdx = this._operand();\n          frame.closure.upvalues[uvIdx]._write(regs[base + this._operand()]);\n          break;\n        }\n\n        case OP.GET_PROP: {\n          // dst = regs[obj][regs[key]]\n          var dst = this._operand();\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          regs[base + dst] = obj[key];\n          break;\n        }\n\n        case OP.SET_PROP: {\n          // regs[obj][regs[key]] = regs[val]\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          var val = regs[base + this._operand()];\n          // Reflect.set performs [[Set]] without throwing on failure,\n          // correctly simulating sloppy-mode assignment from a strict-mode host.\n          Reflect.set(obj, key, val);\n          break;\n        }\n\n        case OP.DELETE_PROP: {\n          var dst = this._operand();\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          regs[base + dst] = delete obj[key];\n          break;\n        }\n\n        // \u2500\u2500 Arithmetic  (dst, src1, src2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.ADD: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a + regs[base + this._operand()];\n          break;\n        }\n        case OP.SUB: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a - regs[base + this._operand()];\n          break;\n        }\n        case OP.MUL: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a * regs[base + this._operand()];\n          break;\n        }\n        case OP.DIV: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a / regs[base + this._operand()];\n          break;\n        }\n        case OP.MOD: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a % regs[base + this._operand()];\n          break;\n        }\n        case OP.BAND: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a & regs[base + this._operand()];\n          break;\n        }\n        case OP.BOR: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a | regs[base + this._operand()];\n          break;\n        }\n        case OP.BXOR: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a ^ regs[base + this._operand()];\n          break;\n        }\n        case OP.SHL: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a << regs[base + this._operand()];\n          break;\n        }\n        case OP.SHR: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a >> regs[base + this._operand()];\n          break;\n        }\n        case OP.USHR: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a >>> regs[base + this._operand()];\n          break;\n        }\n\n        // \u2500\u2500 Comparison  (dst, src1, src2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.LT: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a < regs[base + this._operand()];\n          break;\n        }\n        case OP.GT: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a > regs[base + this._operand()];\n          break;\n        }\n        case OP.LTE: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a <= regs[base + this._operand()];\n          break;\n        }\n        case OP.GTE: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a >= regs[base + this._operand()];\n          break;\n        }\n        case OP.EQ: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a === regs[base + this._operand()];\n          break;\n        }\n        case OP.NEQ: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a !== regs[base + this._operand()];\n          break;\n        }\n        case OP.LOOSE_EQ: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a == regs[base + this._operand()];\n          break;\n        }\n        case OP.LOOSE_NEQ: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a != regs[base + this._operand()];\n          break;\n        }\n        case OP.IN: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a in regs[base + this._operand()];\n          break;\n        }\n        case OP.INSTANCEOF: {\n          var dst = this._operand();\n          var obj = regs[base + this._operand()];\n          var ctor = regs[base + this._operand()];\n          if (typeof ctor === \"function\") {\n            regs[base + dst] = obj instanceof ctor;\n          } else {\n            // VM Closure - walk prototype chain for identity with ctor.prototype.\n            var proto = ctor.prototype;\n            var target = Object.getPrototypeOf(obj);\n            var result = false;\n            while (target !== null) {\n              if (target === proto) {\n                result = true;\n                break;\n              }\n              target = Object.getPrototypeOf(target);\n            }\n            regs[base + dst] = result;\n          }\n          break;\n        }\n\n        // \u2500\u2500 Unary  (dst, src) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.UNARY_NEG: {\n          var dst = this._operand();\n          regs[base + dst] = -regs[base + this._operand()];\n          break;\n        }\n        case OP.UNARY_POS: {\n          var dst = this._operand();\n          regs[base + dst] = +regs[base + this._operand()];\n          break;\n        }\n        case OP.UNARY_NOT: {\n          var dst = this._operand();\n          regs[base + dst] = !regs[base + this._operand()];\n          break;\n        }\n        case OP.UNARY_BITNOT: {\n          var dst = this._operand();\n          regs[base + dst] = ~regs[base + this._operand()];\n          break;\n        }\n        case OP.TYPEOF: {\n          var dst = this._operand();\n          regs[base + dst] = typeof regs[base + this._operand()];\n          break;\n        }\n        case OP.VOID: {\n          var dst = this._operand();\n          this._operand(); // consume src \u2014 evaluated for side-effects by compiler\n          regs[base + dst] = undefined;\n          break;\n        }\n        case OP.TYPEOF_SAFE: {\n          // dst, nameConstIdx \u2014 safe typeof for potentially-undeclared globals.\n          var dst = this._operand();\n          var name = this._constant();\n          var val = Object.prototype.hasOwnProperty.call(this.globals, name)\n            ? this.globals[name]\n            : undefined;\n          regs[base + dst] = typeof val;\n          break;\n        }\n\n        // \u2500\u2500 Control flow \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.JUMP:\n          frame._pc = this._operand();\n          break;\n\n        case OP.JUMP_IF_FALSE: {\n          var src = this._operand();\n          var target = this._operand();\n          if (!regs[base + src]) frame._pc = target;\n          break;\n        }\n\n        case OP.JUMP_IF_TRUE: {\n          // || short-circuit: if truthy, jump over RHS.\n          var src = this._operand();\n          var target = this._operand();\n          if (regs[base + src]) frame._pc = target;\n          break;\n        }\n\n        // \u2500\u2500 Calls \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.CALL: {\n          // dst, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var callee = regs[base + this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = regs[base + this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var closure = callee[CLOSURE_SYM];\n            var newBase = this._regsTop;\n            this._ensureRegisterWindow(newBase, closure.fn.regCount);\n            this._regsTop = newBase + closure.fn.regCount;\n            var f = new Frame(\n              closure,\n              frame._pc,\n              frame,\n              this.globals,\n              dst,\n              newBase,\n            );\n            for (var i = 0; i < args.length && i < closure.fn.regCount; i++) {\n              this._regs[newBase + i] = args[i];\n            }\n            if (closure.fn.paramCount < closure.fn.regCount) {\n              this._regs[newBase + closure.fn.paramCount] = args;\n            }\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            regs[base + dst] = callee.apply(null, args);\n          }\n          break;\n        }\n\n        case OP.CALL_METHOD: {\n          // dst, receiverReg, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var receiver = regs[base + this._operand()];\n          var callee = regs[base + this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = regs[base + this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var closure = callee[CLOSURE_SYM];\n            var newBase = this._regsTop;\n            this._ensureRegisterWindow(newBase, closure.fn.regCount);\n            this._regsTop = newBase + closure.fn.regCount;\n            var f = new Frame(\n              closure,\n              frame._pc,\n              frame,\n              receiver,\n              dst,\n              newBase,\n            );\n            for (var i = 0; i < args.length && i < closure.fn.regCount; i++) {\n              this._regs[newBase + i] = args[i];\n            }\n            if (closure.fn.paramCount < closure.fn.regCount) {\n              this._regs[newBase + closure.fn.paramCount] = args;\n            }\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            regs[base + dst] = callee.apply(receiver, args);\n          }\n          break;\n        }\n\n        case OP.NEW: {\n          // dst, calleeReg, argc, [argReg...]\n          var dst = this._operand();\n          var callee = regs[base + this._operand()];\n          var argc = this._operand();\n          var args = new Array(argc);\n          for (var i = 0; i < argc; i++) args[i] = regs[base + this._operand()];\n\n          if (callee && callee[CLOSURE_SYM]) {\n            var closure = callee[CLOSURE_SYM];\n            var newObj = Object.create(closure.prototype || null);\n            var newBase = this._regsTop;\n            this._ensureRegisterWindow(newBase, closure.fn.regCount);\n            this._regsTop = newBase + closure.fn.regCount;\n            var f = new Frame(closure, frame._pc, frame, newObj, dst, newBase);\n            for (var i = 0; i < args.length && i < closure.fn.regCount; i++) {\n              this._regs[newBase + i] = args[i];\n            }\n            if (closure.fn.paramCount < closure.fn.regCount) {\n              this._regs[newBase + closure.fn.paramCount] = args;\n            }\n            f._newObj = newObj;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            // Reflect.construct is required - Object.create+apply does NOT set\n            // internal slots ([[NumberData]], [[StringData]], etc.) for built-ins.\n            regs[base + dst] = Reflect.construct(callee, args);\n          }\n          break;\n        }\n\n        case OP.RETURN: {\n          var retVal = regs[base + this._operand()];\n          this._closeUpvaluesFor(frame); // must happen before frame is abandoned\n          this._regsTop = frame._base;\n\n          if (this._frameStack.length === 0) return retVal; // main script returning\n\n          // new-call rule: primitive return -> discard, use the constructed object instead\n          if (frame._newObj !== null) {\n            if (typeof retVal !== \"object\" || retVal === null)\n              retVal = frame._newObj;\n          }\n\n          var parentFrame = this._frameStack.pop();\n          this._regs[parentFrame._base + frame._retDstReg] = retVal;\n          this._currentFrame = parentFrame;\n          break;\n        }\n\n        case OP.THROW:\n          throw regs[base + this._operand()];\n\n        // \u2500\u2500 Closures \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.MAKE_CLOSURE: {\n          // dst, startPc, paramCount, regCount, uvCount, [isLocal, idx, ...]\n          var dst = this._operand();\n          var startPc = this._operand();\n          var paramCount = this._operand();\n          var regCount = this._operand();\n          var uvCount = this._operand();\n\n          var uvDescs = new Array(uvCount);\n          for (var i = 0; i < uvCount; i++) {\n            var isLocalRaw = this._operand();\n            var uvIndex = this._operand();\n            uvDescs[i] = { isLocal: isLocalRaw, _index: uvIndex };\n          }\n\n          var fn = {\n            paramCount: paramCount,\n            regCount: regCount,\n            startPc: startPc,\n            upvalueDescriptors: uvDescs,\n          };\n\n          var closure = new Closure(fn);\n          for (var i = 0; i < uvDescs.length; i++) {\n            var uvd = uvDescs[i];\n            if (uvd.isLocal) {\n              closure.upvalues.push(this.captureUpvalue(frame, uvd._index));\n            } else {\n              closure.upvalues.push(frame.closure.upvalues[uvd._index]);\n            }\n          }\n\n          // Wrap in a native callable shell so host code (array methods,\n          // test assertions, setTimeout, etc.) can invoke VM closures.\n          // CLOSURE_SYM lets VM-internal CALL/NEW bypass the sub-VM entirely.\n          var self = this;\n          var shell = (function (c) {\n            return function () {\n              var args = Array.prototype.slice.call(arguments);\n              var sub = new VM(\n                self.bytecode,\n                0,\n                c.fn.regCount,\n                self.constants,\n                self.globals,\n              );\n              var f = new Frame(\n                c,\n                null,\n                null,\n                this == null ? self.globals : this,\n                0,\n                0,\n              );\n              sub._currentFrame = f;\n              for (var i = 0; i < args.length && i < c.fn.regCount; i++) {\n                sub._regs[i] = args[i];\n              }\n              if (c.fn.paramCount < c.fn.regCount) {\n                sub._regs[c.fn.paramCount] = args;\n              }\n              return sub.run();\n            };\n          })(closure);\n          shell[CLOSURE_SYM] = closure;\n          shell.prototype = closure.prototype; // unified prototype for new/instanceof\n          regs[base + dst] = shell;\n          break;\n        }\n\n        // \u2500\u2500 Collections \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.BUILD_ARRAY: {\n          // dst, count, [elemReg...]\n          var dst = this._operand();\n          var count = this._operand();\n          var elems = new Array(count);\n          for (var i = 0; i < count; i++)\n            elems[i] = regs[base + this._operand()];\n          regs[base + dst] = elems;\n          break;\n        }\n\n        case OP.BUILD_OBJECT: {\n          // dst, pairCount, [keyReg, valReg, ...]\n          var dst = this._operand();\n          var pairCount = this._operand();\n          var o = {};\n          for (var i = 0; i < pairCount; i++) {\n            var key = regs[base + this._operand()];\n            var val = regs[base + this._operand()];\n            o[key] = val;\n          }\n          regs[base + dst] = o;\n          break;\n        }\n\n        // \u2500\u2500 Property definitions (getters / setters) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.DEFINE_GETTER: {\n          // obj, key, fn\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          var getterFn = regs[base + this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var getDesc                     = {\n            get: getterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.set === \"function\") {\n            getDesc.set = existingDesc.set;\n          }\n          Object.defineProperty(obj, key, getDesc);\n          break;\n        }\n\n        case OP.DEFINE_SETTER: {\n          // obj, key, fn\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          var setterFn = regs[base + this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var setDesc                     = {\n            set: setterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.get === \"function\") {\n            setDesc.get = existingDesc.get;\n          }\n          Object.defineProperty(obj, key, setDesc);\n          break;\n        }\n\n        // \u2500\u2500 For-in iteration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.FOR_IN_SETUP: {\n          // dst, src \u2014 build iterator object from enumerable keys of regs[src]\n          var dst = this._operand();\n          var obj = regs[base + this._operand()];\n          var keys = [];\n          if (obj !== null && obj !== undefined) {\n            var seen = Object.create(null);\n            var cur = Object(obj); // box primitives\n            while (cur !== null) {\n              var ownNames = Object.getOwnPropertyNames(cur);\n              for (var i = 0; i < ownNames.length; i++) {\n                var k = ownNames[i];\n                if (!(k in seen)) {\n                  seen[k] = true;\n                  var propDesc = Object.getOwnPropertyDescriptor(cur, k);\n                  if (propDesc && propDesc.enumerable) {\n                    keys.push(k);\n                  }\n                }\n              }\n              cur = Object.getPrototypeOf(cur);\n            }\n          }\n          regs[base + dst] = { _keys: keys, i: 0 };\n          break;\n        }\n\n        case OP.FOR_IN_NEXT: {\n          // dst, iterReg, exitTarget\n          // Advances iterator; writes next key to dst, or jumps to exitTarget when done.\n          var dst = this._operand();\n          var iter = regs[base + this._operand()];\n          var exitTarget = this._operand();\n          if (iter.i >= iter._keys.length) {\n            frame._pc = exitTarget;\n          } else {\n            regs[base + dst] = iter._keys[iter.i++];\n          }\n          break;\n        }\n\n        // \u2500\u2500 Exception handling \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.TRY_SETUP: {\n          // handlerPc, exceptionReg \u2014 push exception handler record onto current frame.\n          frame._handlerStack.push({\n            handlerPc: this._operand(),\n            exceptionReg: this._operand(),\n            frameStackDepth: this._frameStack.length,\n          });\n          break;\n        }\n\n        case OP.TRY_END: {\n          // Normal exit from a try block \u2014 disarm the exception handler.\n          frame._handlerStack.pop();\n          break;\n        }\n\n        // \u2500\u2500 Self-modifying bytecode \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.PATCH: {\n          // destPc, sliceStart, sliceEnd\n          var destPc = this._operand();\n          var sliceStart = this._operand();\n          var sliceEnd = this._operand();\n          for (var pi = sliceStart; pi < sliceEnd; pi++) {\n            this.bytecode[destPc + (pi - sliceStart)] = this.bytecode[pi];\n          }\n          break;\n        }\n\n        case OP.JUMP_REG: {\n          // Indirect jump: target PC is read from a register rather than a\n          // bytecode immediate. Used by the jumpDispatcher pass so that static\n          // analysis cannot determine the jump destination without tracking the\n          // register value (which contains an encoded PC resolved at runtime).\n          frame._pc = regs[base + this._operand()];\n          break;\n        }\n\n        case OP.DEBUGGER: {\n          debugger;\n          break;\n        }\n\n        default:\n          throw new Error(\n            \"Unknown opcode: \" + op + \" at pc \" + (frame._pc - 1),\n          );\n      }\n    } catch (err) {\n      // Exception handler unwinding (CPython-style frame walk, Lua-style upvalue close).\n      // Walk from the current frame upward until we find a frame that has an open\n      // exception handler (TRY_SETUP without a matching TRY_END).\n      // For every frame we abandon along the way, close its captured upvalues.\n      var handledFrame = null;\n      var searchFrame = this._currentFrame;\n      while (true) {\n        if (searchFrame._handlerStack.length > 0) {\n          handledFrame = searchFrame;\n          break;\n        }\n        // No handler in this frame \u2014 abandon it and walk up.\n        this._closeUpvaluesFor(searchFrame);\n        this._regsTop = searchFrame._base;\n        if (this._frameStack.length === 0) break;\n        searchFrame = this._frameStack.pop();\n        this._currentFrame = searchFrame;\n      }\n\n      if (!handledFrame) throw err; // no handler anywhere \u2014 propagate to host\n\n      var h = handledFrame._handlerStack.pop();\n      // Discard any call-frames that were pushed inside the try body.\n      this._frameStack.length = h.frameStackDepth;\n      // Write the caught exception directly into the designated register.\n      this._regs[handledFrame._base + h.exceptionReg] = err;\n      // Jump to the catch block.\n      handledFrame._pc = h.handlerPc;\n      this._regsTop = handledFrame._base + handledFrame.closure.fn.regCount;\n      this._currentFrame = handledFrame;\n    }\n  }\n};\n\n// Boot\nvar globals      = {}; // global object for globals\n\n// Always pull built-ins from globalThis so eval() scoping can't shadow them\n// with a local `window` variable (e.g. the test harness fake window).\nfor (var k of Object.getOwnPropertyNames(globalThis)) {\n  globals[k] = globalThis[k];\n}\n// If a window object is in scope (browser or test harness), capture it\n// explicitly so VM code can read/write window.TEST_OUTPUT etc.\nif (typeof window !== \"undefined\") {\n  globals.window = window;\n  for (var k of Object.getOwnPropertyNames(window)) {\n    globals[k] = window[k];\n  }\n}\n\n// Transfer common primitives\nglobals.undefined = undefined;\nglobals.Infinity = Infinity;\nglobals.NaN = NaN;\n\nvar vm = new VM(\n  decodeBytecode(BYTECODE),\n  MAIN_START_PC,\n  MAIN_REG_COUNT,\n  CONSTANTS,\n  globals,\n);\nvm.run();\n";
+const readVMRuntimeFile = () => "import { OP_ORIGINAL as OP } from \"./compiler.ts\";\nconst BYTECODE = [];\nconst MAIN_START_PC = 0;\nconst MAIN_REG_COUNT = 0;\nconst CONSTANTS = [];\nconst ENCODE_BYTECODE = false;\nconst TIMING_CHECKS = false;\nconst SENTINELS = { CALL_SPREAD: 0 };\n// The text above is not included in the compiled output - for type intellisense only\n// @START\n\nfunction base64ToBytes(s) {\n  return typeof Buffer !== \"undefined\"\n    ? Buffer.from(s, \"base64\")\n    : Uint8Array.from(atob(s), function (c) {\n        return c.charCodeAt(0);\n      });\n}\n\nfunction decodeBytecode(s) {\n  if (!ENCODE_BYTECODE) return s;\n\n  var b = base64ToBytes(s);\n  // Each slot is a u32 stored as 4 little-endian bytes.\n  var r = new Uint32Array(b.length / 4);\n  for (var i = 0; i < r.length; i++)\n    r[i] =\n      (b[i * 4] |\n        (b[i * 4 + 1] << 8) |\n        (b[i * 4 + 2] << 16) |\n        (b[i * 4 + 3] << 24)) >>>\n      0;\n  return r;\n}\n\n// Closure map\n// Maps shell functions -> inner Closure so the VM can fast-path instead of going through a sub-VM on internal calls.\n// A WeakMap is used over a Symbol to prevent leaking information to debuggers\nvar CLOSURE_MAP = new WeakMap();\n\n// Upvalue (Lua style)\n// While the outer frame is alive: reads/writes go to vm._regs[_absSlot].\n// After the outer frame returns (closed): reads/writes hit this._value.\nfunction Upvalue(regs, absSlot) {\n  this._regs = regs; // shared reference to VM._regs flat array\n  this._absSlot = absSlot; // absolute index; stable as long as frame is alive\n  this._closed = false;\n  this._value = undefined;\n}\nUpvalue.prototype._read = function () {\n  return this._closed ? this._value : this._regs[this._absSlot];\n};\nUpvalue.prototype._write = function (v) {\n  if (this._closed) this._value = v;\n  else this._regs[this._absSlot] = v;\n};\nUpvalue.prototype._close = function () {\n  this._value = this._regs[this._absSlot];\n  this._closed = true;\n};\n\n// Closure & Frame\nfunction Closure(fn) {\n  this.fn = fn;\n  this.upvalues = [];\n  this.prototype = {}; // <- default prototype object for `new`\n}\n\n// Frame (Lua CallInfo / CPython PyFrameObject)\n// Does NOT own a register array; registers live in VM._regs[_base .. _base+regCount).\nfunction Frame(closure, returnPc, parent, thisVal, retDstReg, base) {\n  this.closure = closure;\n  this._base = base; // absolute offset into VM._regs for this frame's r0\n  this._pc = closure.fn.startPc;\n  this._returnPc = returnPc;\n  this._parent = parent;\n  this.thisVal = thisVal !== undefined ? thisVal : undefined;\n  this._retDstReg = retDstReg !== undefined ? retDstReg : 0;\n  this._newObj = null;\n  this._handlerStack = [];\n}\n\n// VM\nfunction VM(bytecode, mainStartPc, mainRegCount, constants, globals) {\n  this.bytecode = bytecode;\n  this.constants = constants;\n  this.globals = globals;\n  this._frameStack = [];\n  this._openUpvalues = [];\n\n  // Flat register array (Lua-style)\n  // Each Frame records its _base offset.\n  // _regsTop is the next free slot (= base of the hypothetical next frame).\n  // On CALL:   newBase = _regsTop; _regsTop += fn.regCount\n  // On RETURN: _regsTop = frame._base   (pop the frame's register window)\n  this._regs = new Array(mainRegCount).fill(undefined);\n  this._regsTop = mainRegCount; // main frame occupies [0, mainRegCount)\n\n  var mainFn = {\n    paramCount: 0,\n    regCount: mainRegCount,\n    startPc: mainStartPc,\n  };\n  this._currentFrame = new Frame(\n    new Closure(mainFn),\n    null,\n    null,\n    undefined,\n    0,\n    0,\n  );\n}\n\n// Consume the next slot from the flat bytecode stream and advance the PC.\n// Called by opcode handlers to read each of their operands in order.\nVM.prototype._operand = function () {\n  return this.bytecode[this._currentFrame._pc++];\n};\n\nVM.prototype.captureUpvalue = function (frame, slot) {\n  // Dedup by absolute slot \u2014 two closures capturing the same local share one Upvalue.\n  var absSlot = frame._base + slot;\n  for (var i = 0; i < this._openUpvalues.length; i++) {\n    var uv = this._openUpvalues[i];\n    if (!uv._closed && uv._absSlot === absSlot) return uv;\n  }\n  var uv = new Upvalue(this._regs, absSlot);\n  this._openUpvalues.push(uv);\n  return uv;\n};\n\n// Reads and decodes a constant from the pool.\n// idx: pool index (first operand of the constant pair emitted by resolveConstants).\n// key: conceal key (second operand). 0 means no concealment.\n//\n// For integers:  stored value is (original ^ key); XOR again to recover.\n// For strings:   stored value is a base64 string containing u16 LE byte pairs.\n//                Mirrors decodeBytecode: base64 \u2192 bytes \u2192 u16 LE \u2192 XOR with\n//                (key + i) & 0xFFFF to recover the original char codes.\n// idxIn, keyIn are passed in from specializedOpcodes when the operands are determined at compile time.\nVM.prototype._constant = function (idxIn, keyIn) {\n  var idx = idxIn ?? this._operand();\n  var key = keyIn ?? this._operand();\n\n  var v = this.constants[idx];\n  if (!key) return v;\n  if (typeof v === \"number\") return v ^ key;\n  // String: base64-decode to u16 LE byte pairs, then XOR each code with (key+i).\n  var b = base64ToBytes(v);\n  var out = \"\";\n  for (var i = 0; i < b.length / 2; i++) {\n    var code = b[i * 2] | (b[i * 2 + 1] << 8); // u16 LE\n    out += String.fromCharCode(code ^ ((key + i) & 0xffff));\n  }\n  return out;\n};\n\nVM.prototype._closeUpvaluesFor = function (frame) {\n  // Called on RETURN \u2014 close every upvalue whose absolute slot falls within\n  // this frame's register window [_base, _base + regCount).\n  var lo = frame._base;\n  var hi = frame._base + frame.closure.fn.regCount;\n  this._openUpvalues = this._openUpvalues.filter(function (uv) {\n    if (!uv._closed && uv._absSlot >= lo && uv._absSlot < hi) {\n      uv._close();\n      return false;\n    }\n    return true;\n  });\n};\n\nVM.prototype._ensureRegisterWindow = function (base, regCount) {\n  var end = base + regCount;\n  while (this._regs.length < end) this._regs.push(undefined);\n  for (var i = base; i < end; i++) this._regs[i] = undefined;\n};\n\nVM.prototype.run = function () {\n  var now = () => {\n    return performance.now();\n  };\n\n  var lastTime = now();\n\n  while (true) {\n    var frame = this._currentFrame;\n    var bc = this.bytecode;\n    if (frame._pc >= bc.length) break;\n\n    var pc = frame._pc++;\n    var op = this.bytecode[pc];\n    var opcode = this.bytecode[pc];\n    // console.log(`[run] pc=${pc}, opcode=${opcode}, name=${Object.keys(OP).find((key) => OP[key] === opcode)}`);\n\n    // Debugging protection: Detects debugger by checking for >1s pauses which can only happen from debugger; or extremely slow sync tasks\n    if (TIMING_CHECKS) {\n      var currentTime = now();\n      var isTamper = currentTime - lastTime > 1000;\n      lastTime = currentTime;\n      if (isTamper) {\n        // Poison the bytecode\n        for (var i = 0; i < this.bytecode.length; i++) this.bytecode[i] = 0;\n        // Break the current state\n        for (var i2 = frame._base; i2 < this._regsTop; i2++)\n          this._regs[i2] = undefined;\n        op = OP.JUMP;\n        frame._pc = this.bytecode.length; // jump past end to halt\n      }\n    }\n\n    try {\n      var regs = this._regs;\n      var base = frame._base;\n\n      /* @SWITCH */\n      switch (op) {\n        case OP.LOAD_CONST: {\n          var dst = this._operand();\n          regs[base + dst] = this._constant();\n          break;\n        }\n\n        case OP.LOAD_INT: {\n          var dst = this._operand();\n          regs[base + dst] = this._operand();\n          break;\n        }\n\n        case OP.LOAD_GLOBAL: {\n          var dst = this._operand();\n          var globalName = this._constant();\n\n          if (!(globalName in this.globals)) {\n            throw new ReferenceError(`${globalName} is not defined`);\n          }\n\n          regs[base + dst] = this.globals[globalName];\n          break;\n        }\n\n        case OP.LOAD_UPVALUE: {\n          var dst = this._operand();\n          regs[base + dst] = frame.closure.upvalues[this._operand()]._read();\n          break;\n        }\n\n        case OP.LOAD_THIS: {\n          var dst = this._operand();\n          regs[base + dst] = frame.thisVal;\n          break;\n        }\n\n        case OP.MOVE: {\n          var dst = this._operand();\n          regs[base + dst] = regs[base + this._operand()];\n          break;\n        }\n\n        case OP.STORE_GLOBAL: {\n          // globals[globalName] = regs[src]\n          this.globals[this._constant()] = regs[base + this._operand()];\n          break;\n        }\n\n        case OP.STORE_UPVALUE: {\n          var uvIdx = this._operand();\n          frame.closure.upvalues[uvIdx]._write(regs[base + this._operand()]);\n          break;\n        }\n\n        case OP.GET_PROP: {\n          // dst = regs[obj][regs[key]]\n          var dst = this._operand();\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          regs[base + dst] = obj[key];\n          break;\n        }\n\n        case OP.SET_PROP: {\n          // regs[obj][regs[key]] = regs[val]\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          var val = regs[base + this._operand()];\n          // Reflect.set performs [[Set]] without throwing on failure (non-strict mode behavior)\n          Reflect.set(obj, key, val);\n          break;\n        }\n\n        case OP.DELETE_PROP: {\n          // regs[dst] = delete regs[obj][regs[key]]\n          // The delete operator returns true if successful which is most cases\n          var dst = this._operand();\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          regs[base + dst] = delete obj[key];\n          break;\n        }\n\n        // Arithmetic  (dst, src1, src2)\n        case OP.ADD: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a + regs[base + this._operand()];\n          break;\n        }\n        case OP.SUB: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a - regs[base + this._operand()];\n          break;\n        }\n        case OP.MUL: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a * regs[base + this._operand()];\n          break;\n        }\n        case OP.DIV: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a / regs[base + this._operand()];\n          break;\n        }\n        case OP.MOD: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a % regs[base + this._operand()];\n          break;\n        }\n        case OP.EXP: {\n          // Math.pow instead of `**`\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = Math.pow(a, regs[base + this._operand()]);\n          break;\n        }\n        case OP.BAND: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a & regs[base + this._operand()];\n          break;\n        }\n        case OP.BOR: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a | regs[base + this._operand()];\n          break;\n        }\n        case OP.BXOR: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a ^ regs[base + this._operand()];\n          break;\n        }\n        case OP.SHL: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a << regs[base + this._operand()];\n          break;\n        }\n        case OP.SHR: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a >> regs[base + this._operand()];\n          break;\n        }\n        case OP.USHR: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a >>> regs[base + this._operand()];\n          break;\n        }\n\n        // Comparison  (dst, src1, src2)\n        case OP.LT: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a < regs[base + this._operand()];\n          break;\n        }\n        case OP.GT: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a > regs[base + this._operand()];\n          break;\n        }\n        case OP.LTE: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a <= regs[base + this._operand()];\n          break;\n        }\n        case OP.GTE: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a >= regs[base + this._operand()];\n          break;\n        }\n        case OP.EQ: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a === regs[base + this._operand()];\n          break;\n        }\n        case OP.NEQ: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a !== regs[base + this._operand()];\n          break;\n        }\n        case OP.LOOSE_EQ: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a == regs[base + this._operand()];\n          break;\n        }\n        case OP.LOOSE_NEQ: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a != regs[base + this._operand()];\n          break;\n        }\n        case OP.IN: {\n          var dst = this._operand();\n          var a = regs[base + this._operand()];\n          regs[base + dst] = a in regs[base + this._operand()];\n          break;\n        }\n        case OP.INSTANCEOF: {\n          // regs[dst] = regs[obj] instanceof regs[ctor]\n          // Since VM closures are wrapped in native function shells (MAKE_CLOSURE), the native operator works\n          var dst = this._operand();\n          var obj = regs[base + this._operand()];\n          regs[base + dst] = obj instanceof regs[base + this._operand()];\n          break;\n        }\n\n        // Unary  (dst, src)\n        case OP.UNARY_NEG: {\n          var dst = this._operand();\n          regs[base + dst] = -regs[base + this._operand()];\n          break;\n        }\n        case OP.UNARY_POS: {\n          var dst = this._operand();\n          regs[base + dst] = +regs[base + this._operand()];\n          break;\n        }\n        case OP.UNARY_NOT: {\n          var dst = this._operand();\n          regs[base + dst] = !regs[base + this._operand()];\n          break;\n        }\n        case OP.UNARY_BITNOT: {\n          var dst = this._operand();\n          regs[base + dst] = ~regs[base + this._operand()];\n          break;\n        }\n        case OP.TYPEOF: {\n          var dst = this._operand();\n          regs[base + dst] = typeof regs[base + this._operand()];\n          break;\n        }\n        case OP.VOID: {\n          var dst = this._operand();\n          this._operand(); // consumes argument (intended)\n          regs[base + dst] = undefined;\n          break;\n        }\n        case OP.TYPEOF_SAFE: {\n          // regs[dst] = typeof window[name]\n          // Never throws ReferenceError, instead returns undefined for undeclared variables\n          var dst = this._operand();\n          var name = this._constant();\n          var val = Object.prototype.hasOwnProperty.call(this.globals, name)\n            ? this.globals[name]\n            : undefined;\n          regs[base + dst] = typeof val;\n          break;\n        }\n\n        // Control flow\n        case OP.JUMP:\n          frame._pc = this._operand();\n          break;\n\n        case OP.JUMP_IF_FALSE: {\n          var src = this._operand();\n          var target = this._operand();\n          if (!regs[base + src]) frame._pc = target;\n          break;\n        }\n\n        case OP.JUMP_IF_TRUE: {\n          // || short-circuit: if truthy, jump over RHS.\n          var src = this._operand();\n          var target = this._operand();\n          if (regs[base + src]) frame._pc = target;\n          break;\n        }\n\n        // Calls\n        case OP.CALL: {\n          // dst, calleeReg, argc, [argReg...]  (argc=-1 means next operand is spread-args array reg)\n          var dst = this._operand();\n          var callee = regs[base + this._operand()];\n          var argc = this._operand();\n          var args;\n          if (argc === SENTINELS.CALL_SPREAD) {\n            args = regs[base + this._operand()];\n          } else {\n            args = new Array(argc);\n            for (var i = 0; i < argc; i++)\n              args[i] = regs[base + this._operand()];\n          }\n\n          var closure = callee && CLOSURE_MAP.get(callee);\n          if (closure) {\n            var newBase = this._regsTop;\n            this._ensureRegisterWindow(newBase, closure.fn.regCount);\n            this._regsTop = newBase + closure.fn.regCount;\n            var f = new Frame(\n              closure,\n              frame._pc,\n              frame,\n              this.globals,\n              dst,\n              newBase,\n            );\n            if (closure.fn.hasRest) {\n              var restSlot = closure.fn.paramCount - 1;\n              for (var i = 0; i < restSlot; i++)\n                this._regs[newBase + i] = i < args.length ? args[i] : undefined;\n              this._regs[newBase + restSlot] = args.slice(restSlot);\n            } else {\n              for (var i = 0; i < args.length && i < closure.fn.regCount; i++)\n                this._regs[newBase + i] = args[i];\n            }\n            if (closure.fn.paramCount < closure.fn.regCount) {\n              this._regs[newBase + closure.fn.paramCount] = args;\n            }\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            regs[base + dst] = callee.apply(null, args);\n          }\n          break;\n        }\n\n        case OP.CALL_METHOD: {\n          // dst, receiverReg, calleeReg, argc, [argReg...]  (argc=SENTINELS.CALL_SPREAD means spread-args array reg)\n          var dst = this._operand();\n          var receiver = regs[base + this._operand()];\n          var callee = regs[base + this._operand()];\n          var argc = this._operand();\n          var args;\n          if (argc === SENTINELS.CALL_SPREAD) {\n            args = regs[base + this._operand()];\n          } else {\n            args = new Array(argc);\n            for (var i = 0; i < argc; i++)\n              args[i] = regs[base + this._operand()];\n          }\n\n          var closure = callee && CLOSURE_MAP.get(callee);\n          if (closure) {\n            var newBase = this._regsTop;\n            this._ensureRegisterWindow(newBase, closure.fn.regCount);\n            this._regsTop = newBase + closure.fn.regCount;\n            var f = new Frame(\n              closure,\n              frame._pc,\n              frame,\n              receiver,\n              dst,\n              newBase,\n            );\n            if (closure.fn.hasRest) {\n              var restSlot = closure.fn.paramCount - 1;\n              for (var i = 0; i < restSlot; i++)\n                this._regs[newBase + i] = i < args.length ? args[i] : undefined;\n              this._regs[newBase + restSlot] = args.slice(restSlot);\n            } else {\n              for (var i = 0; i < args.length && i < closure.fn.regCount; i++)\n                this._regs[newBase + i] = args[i];\n            }\n            if (closure.fn.paramCount < closure.fn.regCount) {\n              this._regs[newBase + closure.fn.paramCount] = args;\n            }\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            regs[base + dst] = callee.apply(receiver, args);\n          }\n          break;\n        }\n\n        case OP.NEW: {\n          // dst, calleeReg, argc, [argReg...]  (argc=SENTINELS.CALL_SPREAD means spread-args array reg)\n          var dst = this._operand();\n          var callee = regs[base + this._operand()];\n          var argc = this._operand();\n          var args;\n          if (argc === SENTINELS.CALL_SPREAD) {\n            args = regs[base + this._operand()];\n          } else {\n            args = new Array(argc);\n            for (var i = 0; i < argc; i++)\n              args[i] = regs[base + this._operand()];\n          }\n\n          var closure = callee && CLOSURE_MAP.get(callee);\n          if (closure) {\n            var newObj = Object.create(closure.prototype || null);\n            var newBase = this._regsTop;\n            this._ensureRegisterWindow(newBase, closure.fn.regCount);\n            this._regsTop = newBase + closure.fn.regCount;\n            var f = new Frame(closure, frame._pc, frame, newObj, dst, newBase);\n            if (closure.fn.hasRest) {\n              var restSlot = closure.fn.paramCount - 1;\n              for (var i = 0; i < restSlot; i++)\n                this._regs[newBase + i] = i < args.length ? args[i] : undefined;\n              this._regs[newBase + restSlot] = args.slice(restSlot);\n            } else {\n              for (var i = 0; i < args.length && i < closure.fn.regCount; i++)\n                this._regs[newBase + i] = args[i];\n            }\n            if (closure.fn.paramCount < closure.fn.regCount) {\n              this._regs[newBase + closure.fn.paramCount] = args;\n            }\n            f._newObj = newObj;\n            this._frameStack.push(this._currentFrame);\n            this._currentFrame = f;\n          } else {\n            // Reflect.construct is required - Object.create+apply does NOT set\n            // internal slots ([[NumberData]], [[StringData]], etc.) for built-ins.\n            regs[base + dst] = Reflect.construct(callee, args);\n          }\n          break;\n        }\n\n        case OP.RETURN: {\n          var retVal = regs[base + this._operand()];\n          this._closeUpvaluesFor(frame); // must happen before frame is abandoned\n\n          // Zero out callee's register window to limit exposing runtime values\n          var hi = frame._base + frame.closure.fn.regCount;\n          for (var i = frame._base          ; i < hi; i++)\n            this._regs[i] = undefined;\n          this._regsTop = frame._base;\n\n          if (this._frameStack.length === 0) return retVal; // main script returning\n\n          // NewExpression: When invoking from the 'new' keyword, the newly constructed object is returned instead (if the original function doesn't return an object)\n          if (frame._newObj !== null) {\n            if (typeof retVal !== \"object\" || retVal === null)\n              retVal = frame._newObj;\n          }\n\n          var parentFrame = this._frameStack.pop();\n          this._regs[parentFrame._base + frame._retDstReg] = retVal;\n          this._currentFrame = parentFrame;\n          break;\n        }\n\n        case OP.THROW:\n          throw regs[base + this._operand()];\n\n        // Closures\n        case OP.MAKE_CLOSURE: {\n          // dst, startPc, paramCount, regCount, uvCount, hasRest, [isLocal, idx, ...]\n          var dst = this._operand();\n          var startPc = this._operand();\n          var paramCount = this._operand();\n          var regCount = this._operand();\n          var uvCount = this._operand();\n          var hasRest = this._operand(); // 1 if last param is a rest element\n\n          var uvDescs = new Array(uvCount);\n          for (var i = 0; i < uvCount; i++) {\n            var isLocalRaw = this._operand();\n            var uvIndex = this._operand();\n            uvDescs[i] = { isLocal: isLocalRaw, _index: uvIndex };\n          }\n\n          var fn = {\n            paramCount: paramCount,\n            regCount: regCount,\n            startPc: startPc,\n            upvalueDescriptors: uvDescs,\n            hasRest: hasRest,\n          };\n\n          var closure = new Closure(fn);\n          for (var i = 0; i < uvDescs.length; i++) {\n            var uvd = uvDescs[i];\n            if (uvd.isLocal) {\n              closure.upvalues.push(this.captureUpvalue(frame, uvd._index));\n            } else {\n              closure.upvalues.push(frame.closure.upvalues[uvd._index]);\n            }\n          }\n\n          // Wrap in a native callable shell so host code (array methods,\n          // test assertions, setTimeout, etc.) can invoke VM closures.\n          // CLOSURE_MAP lets VM-internal CALL/NEW bypass the sub-VM entirely.\n          var self = this;\n          var shell = (function (c) {\n            return function () {\n              var args = Array.prototype.slice.call(arguments);\n              var sub = new VM(\n                self.bytecode,\n                0,\n                c.fn.regCount,\n                self.constants,\n                self.globals,\n              );\n              var f = new Frame(\n                c,\n                null,\n                null,\n                this == null ? self.globals : this,\n                0,\n                0,\n              );\n              sub._currentFrame = f;\n              if (c.fn.hasRest) {\n                var restSlot = c.fn.paramCount - 1;\n                for (var i = 0; i < restSlot; i++)\n                  sub._regs[i] = i < args.length ? args[i] : undefined;\n                sub._regs[restSlot] = args.slice(restSlot);\n              } else {\n                for (var i = 0; i < args.length && i < c.fn.regCount; i++)\n                  sub._regs[i] = args[i];\n              }\n              if (c.fn.paramCount < c.fn.regCount) {\n                sub._regs[c.fn.paramCount] = args;\n              }\n              return sub.run();\n            };\n          })(closure);\n          CLOSURE_MAP.set(shell, closure);\n          shell.prototype = closure.prototype; // unified prototype for new/instanceof\n          regs[base + dst] = shell;\n          break;\n        }\n\n        // Collections\n        case OP.BUILD_ARRAY: {\n          // dst, count, [elemReg...]\n          var dst = this._operand();\n          var count = this._operand();\n          var elems = new Array(count);\n          for (var i = 0; i < count; i++)\n            elems[i] = regs[base + this._operand()];\n          regs[base + dst] = elems;\n          break;\n        }\n\n        case OP.BUILD_OBJECT: {\n          // dst, pairCount, [keyReg, valReg, ...]\n          var dst = this._operand();\n          var pairCount = this._operand();\n          var o = {};\n          for (var i = 0; i < pairCount; i++) {\n            var key = regs[base + this._operand()];\n            var val = regs[base + this._operand()];\n            o[key] = val;\n          }\n          regs[base + dst] = o;\n          break;\n        }\n\n        // Object methods (getters / setters)\n        case OP.DEFINE_GETTER: {\n          // obj, key, fn\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          var getterFn = regs[base + this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var getDesc                     = {\n            get: getterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.set === \"function\") {\n            getDesc.set = existingDesc.set;\n          }\n          Object.defineProperty(obj, key, getDesc);\n          break;\n        }\n\n        case OP.DEFINE_SETTER: {\n          // obj, key, fn\n          var obj = regs[base + this._operand()];\n          var key = regs[base + this._operand()];\n          var setterFn = regs[base + this._operand()];\n          var existingDesc = Object.getOwnPropertyDescriptor(obj, key);\n          var setDesc                     = {\n            set: setterFn,\n            configurable: true,\n            enumerable: true,\n          };\n          if (existingDesc && typeof existingDesc.get === \"function\") {\n            setDesc.get = existingDesc.get;\n          }\n          Object.defineProperty(obj, key, setDesc);\n          break;\n        }\n\n        // \u2500\u2500 For-in iteration \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.FOR_IN_SETUP: {\n          // dst, src \u2014 build iterator object from enumerable keys of regs[src]\n          var dst = this._operand();\n          var obj = regs[base + this._operand()];\n          var keys = [];\n          if (obj !== null && obj !== undefined) {\n            var seen = Object.create(null);\n            var cur = Object(obj); // box primitives\n            while (cur !== null) {\n              var ownNames = Object.getOwnPropertyNames(cur);\n              for (var i = 0; i < ownNames.length; i++) {\n                var k = ownNames[i];\n                if (!(k in seen)) {\n                  seen[k] = true;\n                  var propDesc = Object.getOwnPropertyDescriptor(cur, k);\n                  if (propDesc && propDesc.enumerable) {\n                    keys.push(k);\n                  }\n                }\n              }\n              cur = Object.getPrototypeOf(cur);\n            }\n          }\n          regs[base + dst] = { _keys: keys, i: 0 };\n          break;\n        }\n\n        case OP.FOR_IN_NEXT: {\n          // dst, iterReg, exitTarget\n          // Advances iterator; writes next key to dst, or jumps to exitTarget when done.\n          var dst = this._operand();\n          var iter = regs[base + this._operand()];\n          var exitTarget = this._operand();\n          if (iter.i >= iter._keys.length) {\n            frame._pc = exitTarget;\n          } else {\n            regs[base + dst] = iter._keys[iter.i++];\n          }\n          break;\n        }\n\n        // \u2500\u2500 Exception handling \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n        case OP.TRY_SETUP: {\n          // handlerPc, exceptionReg \u2014 push exception handler record onto current frame.\n          frame._handlerStack.push({\n            handlerPc: this._operand(),\n            exceptionReg: this._operand(),\n            frameStackDepth: this._frameStack.length,\n          });\n          break;\n        }\n\n        case OP.TRY_END: {\n          // Normal exit from a try block \u2014 disarm the top handler record\n          // (works for both catch and finally regions; they share the stack).\n          frame._handlerStack.pop();\n          break;\n        }\n\n        case OP.FINALLY_SETUP: {\n          // finallyPc, contReg, payloadReg, throwPad\n          // Arm a finalizer for the current region.  Unlike a catch record this\n          // carries no exceptionReg; instead the continuation register (contReg)\n          // receives the resume PC and payloadReg carries the in-flight value.\n          frame._handlerStack.push({\n            finallyPc: this._operand(),\n            contReg: this._operand(),\n            payloadReg: this._operand(),\n            throwPad: this._operand(),\n            frameStackDepth: this._frameStack.length,\n          });\n          break;\n        }\n\n        // Self-modifying bytecode\n        case OP.PATCH: {\n          // destPc, sliceStart, sliceEnd\n          var destPc = this._operand();\n          var sliceStart = this._operand();\n          var sliceEnd = this._operand();\n          for (var pi = sliceStart; pi < sliceEnd; pi++) {\n            this.bytecode[destPc + (pi - sliceStart)] = this.bytecode[pi];\n          }\n          break;\n        }\n\n        case OP.JUMP_REG: {\n          // Indirect jump: allows VM to jump based on runtime values.\n          frame._pc = regs[base + this._operand()];\n          break;\n        }\n\n        case OP.DEBUGGER: {\n          debugger;\n          break;\n        }\n\n        default:\n          throw new Error(\n            \"Unknown opcode: \" + op + \" at pc \" + (frame._pc - 1),\n          );\n      }\n    } catch (err) {\n      // Exception handler unwinding\n      // Walk from the current frame upward until we find a frame that has an open exception handler (TRY_SETUP without a matching TRY_END).\n      // For every frame we abandon along the way, close its captured upvalues.\n      var handledFrame = null;\n      var searchFrame = this._currentFrame;\n      while (true) {\n        if (searchFrame._handlerStack.length > 0) {\n          handledFrame = searchFrame;\n          break;\n        }\n        // No handler in this frame \u2014 abandon it and walk up.\n        this._closeUpvaluesFor(searchFrame);\n        this._regsTop = searchFrame._base;\n        if (this._frameStack.length === 0) break;\n        searchFrame = this._frameStack.pop();\n        this._currentFrame = searchFrame;\n      }\n\n      if (!handledFrame) throw err; // if there's no handler, propagate back to host\n\n      var h = handledFrame._handlerStack.pop();\n      // Discard any call-frames that were pushed inside the protected region.\n      this._frameStack.length = h.frameStackDepth;\n      var hBase = handledFrame._base;\n      if (h.exceptionReg !== undefined) {\n        // catch region \u2014 deliver the exception to the catch binding and run it.\n        this._regs[hBase + h.exceptionReg] = err;\n        handledFrame._pc = h.handlerPc;\n      } else {\n        // finally region: run the finalizer with the exception pending, then\n        // resume at its throw pad (which re-raises and continues unwinding).\n        this._regs[hBase + h.contReg] = h.throwPad;\n        this._regs[hBase + h.payloadReg] = err;\n        handledFrame._pc = h.finallyPc;\n      }\n      this._regsTop = hBase + handledFrame.closure.fn.regCount;\n      this._currentFrame = handledFrame;\n    }\n  }\n};\n\n/* @BOOT */ // <- This comment can't be removed!\nvar globals      = globalThis;\nif (typeof window !== \"undefined\") {\n  globals.window = window;\n  globals.document = typeof document !== \"undefined\" ? document : undefined;\n}\nif (typeof module !== \"undefined\") {\n  globals.module = module;\n  globals.exports = typeof exports !== \"undefined\" ? exports : undefined;\n}\n\nvar vm = new VM(\n  decodeBytecode(BYTECODE),\n  MAIN_START_PC,\n  MAIN_REG_COUNT,\n  CONSTANTS,\n  globals,\n);\nvm.run();\n";
 export const VM_RUNTIME = readVMRuntimeFile().split("@START")[1];
 export const SOURCE_NODE_SYM = Symbol("SOURCE_NODE");
 
-// ── Opcodes ──────────────────────────────────────────────────────────────────
+// Opcodes
 // Register-based encoding.  Operand convention (x86 / CPython style):
-//   destination register first, then source registers, then immediates.
+//  destination register first, then source registers, then immediates.
 //
-//   dst      – register index that receives the result
-//   src      – register index holding an input value
-//   imm/Idx  – immediate integer (constant-pool index, upvalue index, argc …)
+//  dst      – register index that receives the result
+//  src      – register index holding an input value
+//  imm/Idx  – immediate integer (constant-pool index, upvalue index, argc …)
 //
 // Every arithmetic/comparison/unary instruction: [op, dst, src1, src2?]
 // Every load:                                    [op, dst, ...]
 // Every store:                                   [op, target, src]
 // Calls:     CALL  [op, dst, callee, argc, arg0, arg1, …]
-//            CALL_METHOD [op, dst, receiver, callee, argc, arg0, …]
+//           CALL_METHOD [op, dst, receiver, callee, argc, arg0, …]
 export const OP_ORIGINAL = {
-  // ── Loads ─────────────────────────────────────────────────────────────────
+  // Loads
   LOAD_CONST: 0,
   // dst, constIdx      regs[dst] = constants[constIdx]
   LOAD_INT: 1,
@@ -52,13 +55,13 @@ export const OP_ORIGINAL = {
   MOVE: 5,
   // dst, src           regs[dst] = regs[src]
 
-  // ── Stores ────────────────────────────────────────────────────────────────
+  // Stores
   STORE_GLOBAL: 6,
   // nameIdx, src       globals[constants[nameIdx]] = regs[src]
   STORE_UPVALUE: 7,
   // uvIdx,   src       upvalues[uvIdx].write(regs[src])
 
-  // ── Property access ───────────────────────────────────────────────────────
+  // Property access
   GET_PROP: 8,
   // dst, obj, key      regs[dst] = regs[obj][regs[key]]
   SET_PROP: 9,
@@ -66,19 +69,21 @@ export const OP_ORIGINAL = {
   DELETE_PROP: 10,
   // dst, obj, key      regs[dst] = delete regs[obj][regs[key]]
 
-  // ── Arithmetic / bitwise  (dst, src1, src2) ───────────────────────────────
+  // Arithmetic / bitwise  (dst, src1, src2)
   ADD: 11,
   SUB: 12,
   MUL: 13,
   DIV: 14,
   MOD: 15,
+  EXP: 60,
+  // dst, src1, src2   regs[dst] = regs[src1] ** regs[src2]
   BAND: 16,
   BOR: 17,
   BXOR: 18,
   SHL: 19,
   SHR: 20,
   USHR: 21,
-  // ── Comparison  (dst, src1, src2) ─────────────────────────────────────────
+  // Comparison  (dst, src1, src2)
   LT: 22,
   GT: 23,
   LTE: 24,
@@ -89,7 +94,7 @@ export const OP_ORIGINAL = {
   LOOSE_NEQ: 29,
   IN: 30,
   INSTANCEOF: 31,
-  // ── Unary  (dst, src) ─────────────────────────────────────────────────────
+  // Unary  (dst, src)
   UNARY_NEG: 32,
   UNARY_POS: 33,
   UNARY_NOT: 34,
@@ -101,7 +106,7 @@ export const OP_ORIGINAL = {
   TYPEOF_SAFE: 38,
   // dst, nameConstIdx – safe typeof for potentially-undeclared globals
 
-  // ── Control flow ──────────────────────────────────────────────────────────
+  // Control flow
   JUMP: 39,
   // target
   JUMP_IF_FALSE: 40,
@@ -109,7 +114,7 @@ export const OP_ORIGINAL = {
   JUMP_IF_TRUE: 41,
   // src, target    if  regs[src] then pc = target  (|| short-circuit)
 
-  // ── Calls & constructors ──────────────────────────────────────────────────
+  // Calls & constructors
   CALL: 42,
   // dst, callee, argc, [argRegs…]
   CALL_METHOD: 43,
@@ -121,48 +126,59 @@ export const OP_ORIGINAL = {
   THROW: 46,
   // src
 
-  // ── Closures ──────────────────────────────────────────────────────────────
+  // Closures
   // dst, startPc, paramCount, regCount, uvCount, [isLocal, idx, …]
   MAKE_CLOSURE: 47,
-  // ── Collections ───────────────────────────────────────────────────────────
+  // Collections
   BUILD_ARRAY: 48,
   // dst, count,     [elemRegs…]
   BUILD_OBJECT: 49,
   // dst, pairCount, [keyReg, valReg, …]
 
-  // ── Property definitions (getters / setters) ──────────────────────────────
+  // Property definitions (getters / setters)
   DEFINE_GETTER: 50,
   // obj, key, fn
   DEFINE_SETTER: 51,
   // obj, key, fn
 
-  // ── For-in iteration ──────────────────────────────────────────────────────
+  // For-in iteration
   FOR_IN_SETUP: 52,
   // dst, src              dst = { _keys: enumKeys(src), i: 0 }
   FOR_IN_NEXT: 53,
   // dst, iter, exitTarget
 
-  // ── Exception handling ────────────────────────────────────────────────────
+  // Exception handling
   TRY_SETUP: 54,
   // handlerPc, exceptionReg
   TRY_END: 55,
-  // ── Self-modifying bytecode ───────────────────────────────────────────────
+  // Self-modifying bytecode
   PATCH: 56,
   // destPc, sliceStart, sliceEnd
 
-  // ── Debug ─────────────────────────────────────────────────────────────────
+  // Debug
   DEBUGGER: 57,
-  // ── Indirect jump (register-addressed) ───────────────────────────────────
-  // Used by the jumpDispatcher pass. The target PC is read from a register
+  // Indirect jump (register-addressed)
+  // Used by Dispatcher pass. The target PC is read from a register
   // rather than encoded as a bytecode immediate, so static analysis cannot
   // determine the destination without tracking register values at runtime.
-  JUMP_REG: 58 // src — frame._pc = regs[src]
+  JUMP_REG: 58,
+  // src — frame._pc = regs[src]
+
+  // Exception handling (finally)
+  // Arms a finalizer for the current region.  Operands:
+  //  finallyPc, contReg, payloadReg, throwPad
+  // The finalizer runs on every exit path (normal, return, break/continue,
+  // throw).  contReg holds the PC to resume at once the finalizer completes;
+  // the finalizer ends with JUMP_REG contReg.  payloadReg carries the pending
+  // value (return value or in-flight exception).  throwPad is the PC the
+  // runtime resumes at when an exception is pending (re-raises after finally).
+  FINALLY_SETUP: 59
 };
 
-// ── Scope ─────────────────────────────────────────────────────────────────────
+// Scope
 // Maps variable names to virtual RegisterOperands.
 // Locals are allocated at compile time via ctx._newReg(); zero name lookups at runtime.
-// resolveRegisters() assigns concrete slot indices before serialisation.
+// resolveRegisters() assigns concrete slot indices before serialization.
 class Scope {
   constructor(parent = null) {
     this.parent = parent;
@@ -188,15 +204,15 @@ class Scope {
   }
 }
 
-// ── FnContext ─────────────────────────────────────────────────────────────────
+// FnContext
 // Compiler-side state for the function currently being compiled.
 // Distinct from the runtime Frame — this is compile-time only.
 //
 // Virtual-register model (Lua/LLVM style):
-//   Every allocReg() / _newReg() call returns a fresh RegisterOperand with a
-//   unique (fnId, id) pair.  IDs are never reused — resolveRegisters() does
-//   liveness-aware slot assignment and sets desc.regCount at the end of the
-//   pipeline, just like resolveLabels() fills in jump targets.
+//  Every allocReg() / _newReg() call returns a fresh RegisterOperand with a
+//  unique (fnId, id) pair.  IDs are never reused — resolveRegisters() does
+//  liveness-aware slot assignment and sets desc.regCount at the end of the
+//  pipeline, just like resolveLabels() fills in jump targets.
 class FnContext {
   // index: RegisterOperand if isLocal (register in parent frame), number if upvalue chain
 
@@ -218,11 +234,11 @@ class FnContext {
     return b.registerOperand(this._nextId++, this._fnId);
   }
 
-  /**
-   * Allocate a short-lived temporary register (pool "temp::").
-   * resolveRegisters() will reuse its concrete slot once its live range ends.
-   * Do NOT use for named locals or upvalue-captured variables — use _newReg()
-   * via scope.define() for those, so they stay in the stable "local::" pool.
+  /**
+   * Allocate a short-lived temporary register (pool "temp::").
+   * resolveRegisters() will reuse its concrete slot once its live range ends.
+   * Do NOT use for named locals or upvalue-captured variables — use _newReg()
+   * via scope.define() for those, so they stay in the stable "local::" pool.
    */
   allocReg() {
     return b.registerOperand(this._nextId++, this._fnId, {
@@ -230,17 +246,17 @@ class FnContext {
     });
   }
 
-  /**
-   * Emit a freeReg pseudo-instruction to explicitly end a temporary's live range.
-   *
-   * NOTE: This is extraneous for any programmatically generated IR.
-   * resolveRegisters() already computes lastUse as the last instruction index
-   * where the register appears as a real operand — which is always the tightest
-   * correct bound when you stop emitting a register after its last logical use.
-   * freeReg is only needed in the rare case where a register has a late syntactic
-   * appearance that does NOT represent its true logical death (e.g. a dummy read
-   * emitted for side-effects long after the value is logically dead). No current
-   * pass in this codebase uses it; it is kept as an extension point only.
+  /**
+   * Emit a freeReg pseudo-instruction to explicitly end a temporary's live range.
+   *
+   * NOTE: This is extraneous for any programmatically generated IR.
+   * resolveRegisters() already computes lastUse as the last instruction index
+   * where the register appears as a real operand — which is always the tightest
+   * correct bound when you stop emitting a register after its last logical use.
+   * freeReg is only needed in the rare case where a register has a late syntactic
+   * appearance that does NOT represent its true logical death (e.g. a dummy read
+   * emitted for side-effects long after the value is logically dead). No current
+   * pass in this codebase uses it; it is kept as an extension point only.
    */
   freeReg(bc, reg) {
     bc.push([null, b.freeRegOperand(reg)]);
@@ -260,12 +276,13 @@ class FnContext {
     return idx;
   }
 }
-// ── Compiler ──────────────────────────────────────────────────────────────────
+// Compiler
 export class Compiler {
-  /** Internal variable slot registry.
-   *  globally: shared name→index pool (written on first sight; reused by non-random mode or by 50% chance in random mode).
-   *  opcodes:  per-opcode source-of-truth — all assignment lookups are read/written here. */
-
+  log(...messages) {
+    if (this.options.verbose) {
+      console.log(...messages);
+    }
+  }
   _cloneRegisterOperand(operand) {
     if (!operand || typeof operand !== "object") return operand;
     if (operand.type !== "register") return operand;
@@ -294,10 +311,6 @@ export class Compiler {
     this.MICRO_OPS = {};
     this.SPECIALIZED_OPS = {};
     this.ALIASED_OPS = {};
-    this._internals = {
-      globally: new Map(),
-      opcodes: new Map()
-    };
     this.OP = {
       ...OP_ORIGINAL
     };
@@ -312,8 +325,16 @@ export class Compiler {
         this.OP[key] = val;
       }
     }
+
+    // SENTINELS: magic values placed in argc slots to signal special call modes.
+    // Default to U16_MAX (safely above any valid arg count).
+    // When randomizeOpcodes is on, pick a random value in [U16_MAX, U32_MAX] so
+    // each obfuscated output looks different to a static analyser.
+    this.SENTINELS = {
+      CALL_SPREAD: this.options.randomizeOpcodes ? getRandomInt(U16_MAX, U32_MAX) : U16_MAX
+    };
     this.OP_NAME = Object.fromEntries(Object.entries(this.OP).map(([k, v]) => [v, k]));
-    this.JUMP_OPS = new Set([this.OP.JUMP, this.OP.JUMP_IF_FALSE, this.OP.JUMP_IF_TRUE, this.OP.FOR_IN_NEXT, this.OP.TRY_SETUP]);
+    this.JUMP_OPS = new Set([this.OP.JUMP, this.OP.JUMP_IF_FALSE, this.OP.JUMP_IF_TRUE, this.OP.FOR_IN_NEXT, this.OP.TRY_SETUP, this.OP.FINALLY_SETUP]);
   }
   _makeLabel(hint = "") {
     return `${hint || "L"}_${this._labelCount++}`;
@@ -344,12 +365,11 @@ export class Compiler {
     };
   }
 
-  // ── Variable hoisting ──────────────────────────────────────────────────────
   // Pre-scan a statement list and reserve virtual registers for every var
   // declaration, function declaration, for-in iterator, and try-catch binding.
   // Must be called before any emit so that locals are allocated before temps.
   _hoistVars(stmts, scope, ctx) {
-    for (const stmt of stmts) {
+    walkHoistScope(stmts, stmt => {
       switch (stmt.type) {
         case "VariableDeclaration":
           for (const decl of stmt.declarations) {
@@ -359,90 +379,77 @@ export class Compiler {
         case "FunctionDeclaration":
           if (stmt.id) scope.define(stmt.id.name, ctx);
           break;
-        case "BlockStatement":
-          this._hoistVars(stmt.body, scope, ctx);
-          break;
-        case "IfStatement":
-          {
-            const cons = stmt.consequent.type === "BlockStatement" ? stmt.consequent.body : [stmt.consequent];
-            this._hoistVars(cons, scope, ctx);
-            if (stmt.alternate) {
-              const alt = stmt.alternate.type === "BlockStatement" ? stmt.alternate.body : [stmt.alternate];
-              this._hoistVars(alt, scope, ctx);
-            }
-            break;
-          }
-        case "WhileStatement":
-        case "DoWhileStatement":
-          {
-            const body = stmt.body.type === "BlockStatement" ? stmt.body.body : [stmt.body];
-            this._hoistVars(body, scope, ctx);
-            break;
-          }
-        case "ForStatement":
-          {
-            if (stmt.init?.type === "VariableDeclaration") {
-              for (const decl of stmt.init.declarations) {
-                if (decl.id.type === "Identifier") scope.define(decl.id.name, ctx);
-              }
-            }
-            const body = stmt.body.type === "BlockStatement" ? stmt.body.body : [stmt.body];
-            this._hoistVars(body, scope, ctx);
-            break;
-          }
         case "ForInStatement":
-          {
-            // Reserve a hidden virtual register for the iterator object.
-            stmt._iterSlot = ctx._newReg();
-            if (stmt.left.type === "VariableDeclaration") {
-              for (const decl of stmt.left.declarations) {
-                if (decl.id.type === "Identifier") scope.define(decl.id.name, ctx);
-              }
-            }
-            const body = stmt.body.type === "BlockStatement" ? stmt.body.body : [stmt.body];
-            this._hoistVars(body, scope, ctx);
-            break;
-          }
-        case "SwitchStatement":
-          for (const c of stmt.cases) this._hoistVars(c.consequent, scope, ctx);
+          // Reserve a hidden virtual register for the iterator object.
+          stmt._iterSlot = ctx._newReg();
           break;
         case "TryStatement":
-          this._hoistVars(stmt.block.body, scope, ctx);
           if (stmt.handler) {
             if (stmt.handler.param?.type === "Identifier") {
-              // Catch parameter IS the exception register.
               scope.define(stmt.handler.param.name, ctx);
             } else {
-              // No catch binding – reserve a dummy virtual register for the exception value.
+              // No catch binding – reserve a dummy register for the exception value.
               stmt._exceptionSlot = ctx._newReg();
             }
-            this._hoistVars(stmt.handler.body.body, scope, ctx);
           }
-          break;
-        case "LabeledStatement":
-          this._hoistVars([stmt.body], scope, ctx);
+          if (stmt.finalizer) {
+            // Two stable locals survive the finalizer: contReg (resume PC) and
+            // payloadReg (pending return value / in-flight exception).
+            stmt._finallyContReg = ctx._newReg();
+            stmt._finallyPayloadReg = ctx._newReg();
+          }
           break;
       }
-    }
+    });
   }
 
-  // ── Entry point ───────────────────────────────────────────────────────────
+  // Collect all FunctionDeclaration nodes reachable in the current function
+  // scope (does not cross into nested function bodies).
+  _collectHoistedFunctions(stmts) {
+    const result = [];
+    walkHoistScope(stmts, stmt => {
+      if (stmt.type === "FunctionDeclaration") result.push(stmt);
+    });
+    return result;
+  }
+  profileData = {
+    transforms: {}
+  };
+
+  // Entry point
   compile(source) {
+    let startedAt = now();
     const ast = parse(source, {
       sourceType: "script",
       allowReturnOutsideFunction: true
     });
+    this.profileData.parseTime = now() - startedAt;
     return this.compileAST(ast);
   }
   compileAST(ast) {
+    let startedAt = now();
     this._compileMain(ast.program.body);
+    this.profileData.compileTime = now() - startedAt;
     return this.bytecode;
   }
 
-  // ── Function compilation ───────────────────────────────────────────────────
+  // Function compilation
   _compileFunctionDecl(node) {
+    const isArrow = node.type === "ArrowFunctionExpression";
     ok(!node.generator, "Generator functions are not supported");
     ok(!node.async, "Async functions are not supported");
+
+    // Arrow functions do NOT bind their own `this` or `arguments`; both are
+    // inherited lexically from the nearest enclosing non-arrow function. We
+    // model this with the ordinary upvalue machinery: a non-arrow function
+    // materializes its receiver into a hidden `this` local (see the prologue
+    // below) and an arrow that references `this`/`arguments` simply resolves the
+    // name up the scope chain, capturing it as an upvalue. The result is that an
+    // arrow's MAKE_CLOSURE is byte-for-byte indistinguishable from any other
+    // nested closure — there is no "arrow" marker anywhere in the bytecode.
+    // `node.body` may be an Expression (concise body: `x => x + 1`) rather than
+    // a BlockStatement.
+    const isBlockBody = node.body.type === "BlockStatement";
     var fnIdx = this.fnDescriptors.length;
     const entryLabel = this._makeLabel(`fn_${fnIdx}`);
     var desc = {};
@@ -454,17 +461,54 @@ export class Compiler {
     this._loopStack = [];
 
     // 1. Define parameters as virtual registers (occupy the first IDs in order).
+    let hasRest = false;
     for (const param of node.params) {
-      let identifier = param.type === "AssignmentPattern" ? param.left : param;
-      ok(identifier.type === "Identifier", "Only simple identifiers allowed as parameters");
-      ctx.scope.define(identifier.name, ctx);
+      if (param.type === "RestElement") {
+        ok(param.argument.type === "Identifier", "Rest element must be a simple identifier");
+        hasRest = true;
+        ctx.scope.define(param.argument.name, ctx);
+      } else {
+        let identifier = param.type === "AssignmentPattern" ? param.left : param;
+        ok(identifier.type === "Identifier", "Only simple identifiers allowed as parameters");
+        ctx.scope.define(identifier.name, ctx);
+      }
     }
 
-    // 2. Reserve the `arguments` virtual register (immediately after params).
-    ctx.scope.define("arguments", ctx);
+    // 2. Reserve the `arguments` virtual register (immediately after params)
+    // and a hidden `this` register (immediately after that). Order matters: the
+    // runtime writes the args array into slot `paramCount`, so `arguments` must
+    // keep that slot and `this` follows it. Arrow functions bind neither — a
+    // reference climbs the scope chain to the enclosing function's register.
+    if (!isArrow) {
+      ctx.scope.define("arguments", ctx);
+      const thisReg = ctx.scope.define("this", ctx);
+      // Prologue: materialize the receiver (frame.thisVal) into the hidden
+      // `this` local so it reads like any other register and can be captured as
+      // an upvalue by nested arrows. This is the only place LOAD_THIS is now
+      // emitted, so `this` usage sites become generic register reads.
+      this.emit(ctx.bc, [this.OP.LOAD_THIS, thisReg], node);
+    }
 
     // 3. Hoist all var declarations so locals are allocated before any temps.
-    this._hoistVars(node.body.body, ctx.scope, ctx);
+    // Concise-body arrows have an expression body with no statements to hoist.
+    if (isBlockBody) {
+      this._hoistVars(node.body.body, ctx.scope, ctx);
+    }
+
+    // 4. Hoist function declarations: compile and emit MAKE_CLOSURE at function
+    // entry so they are available before any code in the body runs.
+    if (isBlockBody) {
+      const hoistedFnDecls = this._collectHoistedFunctions(node.body.body);
+      for (const fnDecl of hoistedFnDecls) {
+        const fnDesc = this._compileFunctionDecl(fnDecl);
+        fnDecl._hoistedDesc = fnDesc;
+        const closureReg = this._emitMakeClosure(fnDesc, fnDecl, ctx.bc);
+        const slot = ctx.scope._locals.get(fnDecl.id.name);
+        if (closureReg !== slot) {
+          this.emit(ctx.bc, [this.OP.MOVE, slot, closureReg], fnDecl);
+        }
+      }
+    }
 
     // 5. Emit default-value guards.
     for (const param of node.params) {
@@ -494,14 +538,20 @@ export class Compiler {
     }
 
     // 6. Compile body.
-    for (const stmt of node.body.body) {
-      this._compileStatement(stmt, ctx.scope, ctx.bc);
-    }
+    if (!isBlockBody) {
+      // Concise-body arrow: `(...) => expr` is equivalent to `{ return expr }`.
+      const reg = this._compileExpr(node.body, ctx.scope, ctx.bc);
+      this.emit(ctx.bc, [this.OP.RETURN, reg], node);
+    } else {
+      for (const stmt of node.body.body) {
+        this._compileStatement(stmt, ctx.scope, ctx.bc);
+      }
 
-    // Implicit return undefined at end of function.
-    const reg_undef = ctx.allocReg();
-    this.emit(ctx.bc, [this.OP.LOAD_CONST, reg_undef, b.constantOperand(undefined)], node);
-    this.emit(ctx.bc, [this.OP.RETURN, reg_undef], node);
+      // Implicit return undefined at end of function.
+      const reg_undef = ctx.allocReg();
+      this.emit(ctx.bc, [this.OP.LOAD_CONST, reg_undef, b.constantOperand(undefined)], node);
+      this.emit(ctx.bc, [this.OP.RETURN, reg_undef], node);
+    }
     this._currentCtx = savedCtx;
     this._loopStack = savedLoopStack;
     node._fnIdx = fnIdx;
@@ -510,6 +560,14 @@ export class Compiler {
     desc.bytecode = ctx.bc;
     desc._fnIdx = fnIdx;
     desc.paramCount = node.params.length;
+    // Leading locals whose slots are fixed by position and written by the
+    // runtime at call time: the params (slots 0..paramCount-1), plus — for
+    // non-arrow functions — `arguments` (slot paramCount) and the hidden `this`
+    // (slot paramCount+1). These MUST get an identity slot mapping even when
+    // unused, otherwise a later local/upvalue capture slides into a param slot
+    // and the runtime's fixed-slot writes corrupt it. See resolveRegisters().
+    desc.reservedRegisters = node.params.length + (isArrow ? 0 : 2);
+    desc.hasRest = hasRest;
     // regCount is NOT set here — resolveRegisters() fills it after liveness analysis.
     desc.upvalues = ctx.upvalues.slice();
     desc.ctx = ctx;
@@ -532,11 +590,98 @@ export class Compiler {
       label: desc.entryLabel
     }, desc.paramCount, b.fnRegCountOperand(desc._fnIdx),
     // resolved by resolveRegisters()
-    desc.upvalues.length, ...uvOperands], node);
+    desc.upvalues.length, desc.hasRest ? 1 : 0,
+    // 1 = last param is a rest element
+    ...uvOperands], node);
     return dst;
   }
 
-  // ── Main (top-level) ───────────────────────────────────────────────────────
+  // Load a label's resolved PC into a register (resolveLabels fills the value).
+  // Used to seed a finalizer's continuation register with a resume target.
+  _emitLoadLabel(bc, reg, label, node) {
+    this.emit(bc, [this.OP.LOAD_INT, reg, {
+      type: "label",
+      label
+    }], node);
+  }
+
+  // Abrupt-completion unwinding
+  // Emits the bytecode that carries an abrupt completion (return / break /
+  // continue) out through every enclosing handler on the loop stack:
+  //  • a "try" (catch-only) region is disarmed with TRY_END and we keep going;
+  //  • a "finally" region is *routed through* — control is sent to the
+  //    finalizer first and the remainder of the unwind resumes from the
+  //    finalizer's continuation pad (see _routeThroughFinally);
+  //  • loop/switch/block frames are skipped until we reach the break/continue
+  //    target, where we emit the final JUMP.
+  // For a return with no enclosing finalizer this degenerates to the original
+  // "TRY_END per crossed try, then RETURN" behavior.
+  //
+  // action:
+  //  { kind: "return", valueReg }
+  //  { kind: "break" | "continue", targetEntry }   (targetEntry is the loop-
+  //    stack record to jump to; identified by object identity so it stays
+  //    valid even when re-walked from a finalizer pad after the stack shrank)
+  _emitUnwind(bc, node, action) {
+    const stack = this._loopStack;
+    for (let i = stack.length - 1; i >= 0; i--) {
+      const entry = stack[i];
+      if (action.kind !== "return" && entry === action.targetEntry) {
+        const label = action.kind === "break" ? entry.breakLabel : entry.continueLabel;
+        this.emit(bc, [this.OP.JUMP, {
+          type: "label",
+          label
+        }], node);
+        return;
+      }
+      if (entry.type === "finally") {
+        this._routeThroughFinally(bc, node, entry, action);
+        return; // the finalizer's pad continues the unwind
+      }
+      if (entry.type === "try") {
+        this.emit(bc, [this.OP.TRY_END], node);
+      }
+      // loop / switch / block frames that aren't the target are just skipped.
+    }
+    if (action.kind === "return") {
+      this.emit(bc, [this.OP.RETURN, action.valueReg], node);
+    }
+  }
+
+  // Divert an abrupt completion into a finalizer.  Schedules a continuation pad
+  // (emitted after the finalizer body) that re-issues the completion from the
+  // enclosing context, then sets the resume target + pending value and jumps to
+  // the finalizer.  TRY_END disarms the finalizer's runtime record so an
+  // exception raised inside it doesn't loop back to itself.
+  _routeThroughFinally(bc, node, entry, action) {
+    const padLabel = this._makeLabel("finally_cont");
+    let contAction;
+    if (action.kind === "return") {
+      // Park the return value in the finalizer's payload register so it
+      // survives the finalizer body; the pad resumes the return from there.
+      if (action.valueReg !== entry.payloadReg) {
+        this.emit(bc, [this.OP.MOVE, entry.payloadReg, action.valueReg], node);
+      }
+      contAction = {
+        kind: "return",
+        valueReg: entry.payloadReg
+      };
+    } else {
+      contAction = action;
+    }
+    entry.pads.push({
+      label: padLabel,
+      emit: () => this._emitUnwind(bc, node, contAction)
+    });
+    this._emitLoadLabel(bc, entry.contReg, padLabel, node);
+    this.emit(bc, [this.OP.TRY_END], node); // disarm this finalizer's record
+    this.emit(bc, [this.OP.JUMP, {
+      type: "label",
+      label: entry.finallyLabel
+    }], node);
+  }
+
+  // Main (top-level)
   _compileMain(body) {
     const mainCtx = new FnContext(this, null);
     const savedCtx = this._currentCtx;
@@ -564,7 +709,7 @@ export class Compiler {
     this._currentCtx = savedCtx;
   }
 
-  // ── Statements ────────────────────────────────────────────────────────────
+  // Statements
   // Wrapper that resets temps after every statement so that short-lived
   // expression temps don't accumulate across statements.
   _compileStatement(node, scope, bc) {
@@ -586,6 +731,8 @@ export class Compiler {
         break;
       case "FunctionDeclaration":
         {
+          // Already hoisted and emitted at function entry — skip.
+          if (node._hoistedDesc) break;
           const desc = this._compileFunctionDecl(node);
           const closureReg = this._emitMakeClosure(desc, node, bc);
           if (scope) {
@@ -613,12 +760,12 @@ export class Compiler {
             reg = ctx.allocReg();
             this.emit(bc, [this.OP.LOAD_CONST, reg, b.constantOperand(undefined)], node);
           }
-          for (let _ri = this._loopStack.length - 1; _ri >= 0; _ri--) {
-            if (this._loopStack[_ri].type === "try") {
-              this.emit(bc, [this.OP.TRY_END], node);
-            }
-          }
-          this.emit(bc, [this.OP.RETURN, reg], node);
+          // Unwind through enclosing try/finally regions: disarm catch handlers
+          // and route through any finalizer before the value is actually returned.
+          this._emitUnwind(bc, node, {
+            kind: "return",
+            valueReg: reg
+          });
           break;
         }
       case "ExpressionStatement":
@@ -838,22 +985,19 @@ export class Compiler {
             if (_bTargetIdx === -1) throw new Error(`Label '${node.label.name}' not found`);
           } else {
             for (let _bi = this._loopStack.length - 1; _bi >= 0; _bi--) {
-              if (this._loopStack[_bi].type !== "try") {
+              const _t = this._loopStack[_bi].type;
+              if (_t !== "try" && _t !== "finally") {
                 _bTargetIdx = _bi;
                 break;
               }
             }
             if (_bTargetIdx === -1) throw new Error("break outside loop");
           }
-          for (let _bi = this._loopStack.length - 1; _bi > _bTargetIdx; _bi--) {
-            if (this._loopStack[_bi].type === "try") {
-              this.emit(bc, [this.OP.TRY_END], node);
-            }
-          }
-          this.emit(bc, [this.OP.JUMP, {
-            type: "label",
-            label: this._loopStack[_bTargetIdx].breakLabel
-          }], node);
+          // Disarm catch handlers and route through finalizers on the way out.
+          this._emitUnwind(bc, node, {
+            kind: "break",
+            targetEntry: this._loopStack[_bTargetIdx]
+          });
           break;
         }
       case "ContinueStatement":
@@ -877,15 +1021,11 @@ export class Compiler {
             }
             if (_cTargetIdx === -1) throw new Error("continue outside loop");
           }
-          for (let _ci = this._loopStack.length - 1; _ci > _cTargetIdx; _ci--) {
-            if (this._loopStack[_ci].type === "try") {
-              this.emit(bc, [this.OP.TRY_END], node);
-            }
-          }
-          this.emit(bc, [this.OP.JUMP, {
-            type: "label",
-            label: this._loopStack[_cTargetIdx].continueLabel
-          }], node);
+          // Disarm catch handlers and route through finalizers on the way out.
+          this._emitUnwind(bc, node, {
+            kind: "continue",
+            targetEntry: this._loopStack[_cTargetIdx]
+          });
           break;
         }
       case "SwitchStatement":
@@ -1048,51 +1188,139 @@ export class Compiler {
         }
       case "TryStatement":
         {
-          if (node.finalizer) {
-            throw new Error("try..finally is not supported");
+          if (!node.handler && !node.finalizer) {
+            throw new Error("try without catch or finally is not supported");
           }
-          if (!node.handler) {
-            throw new Error("try without catch is not supported");
+
+          // Emits the inner try[/catch] region.  When there is a finalizer this is
+          // nested *inside* the finally region (CPython-style desugaring of
+          // try/catch/finally into try { try/catch } finally), so each runtime
+          // handler record is purely a catch or purely a finally — never both.
+          const emitTryCatch = () => {
+            if (!node.handler) {
+              // try { … } finally { … } — no catch, just run the protected body.
+              for (const stmt of node.block.body) {
+                this._compileStatement(stmt, scope, bc);
+              }
+              return;
+            }
+            const catchLabel = this._makeLabel("catch");
+            const afterCatchLabel = this._makeLabel("after_catch");
+
+            // Determine where the caught exception is written.
+            const exceptionReg = node.handler.param?.type === "Identifier" ? scope?._locals.get(node.handler.param.name) ?? ctx.allocReg() // shouldn't normally reach here
+            : node._exceptionSlot;
+            this.emit(bc, [this.OP.TRY_SETUP, {
+              type: "label",
+              label: catchLabel
+            }, exceptionReg], node);
+            this._loopStack.push({
+              type: "try",
+              label: null,
+              breakLabel: "",
+              continueLabel: ""
+            });
+            for (const stmt of node.block.body) {
+              this._compileStatement(stmt, scope, bc);
+            }
+            this._loopStack.pop();
+            this.emit(bc, [this.OP.TRY_END], node);
+            this.emit(bc, [this.OP.JUMP, {
+              type: "label",
+              label: afterCatchLabel
+            }], node);
+
+            // Catch block: exceptionReg already holds the caught value.
+            this.emit(bc, [null, {
+              type: "defineLabel",
+              label: catchLabel
+            }], node);
+
+            // If no param binding, just ignore the exception (it's in the dummy slot).
+            for (const stmt of node.handler.body.body) {
+              this._compileStatement(stmt, scope, bc);
+            }
+            this.emit(bc, [null, {
+              type: "defineLabel",
+              label: afterCatchLabel
+            }], node);
+          };
+          if (!node.finalizer) {
+            emitTryCatch();
+            break;
           }
-          const catchLabel = this._makeLabel("catch");
-          const afterCatchLabel = this._makeLabel("after_catch");
 
-          // Determine where the caught exception is written.
-          const exceptionReg = node.handler.param?.type === "Identifier" ? scope?._locals.get(node.handler.param.name) ?? ctx.allocReg() // shouldn't normally reach here
-          : node._exceptionSlot;
-          this.emit(bc, [this.OP.TRY_SETUP, {
+          // try [catch] finally
+          const finallyLabel = this._makeLabel("finally");
+          const afterFinallyLabel = this._makeLabel("after_finally");
+          const throwPadLabel = this._makeLabel("finally_throw");
+          const contReg = node._finallyContReg;
+          const payloadReg = node._finallyPayloadReg;
+
+          // Arm the finalizer for the whole protected region (try + catch).
+          this.emit(bc, [this.OP.FINALLY_SETUP, {
             type: "label",
-            label: catchLabel
-          }, exceptionReg], node);
-          this._loopStack.push({
-            type: "try",
+            label: finallyLabel
+          }, contReg, payloadReg, {
+            type: "label",
+            label: throwPadLabel
+          }], node);
+          const finallyEntry = {
+            type: "finally",
             label: null,
             breakLabel: "",
-            continueLabel: ""
-          });
-          for (const stmt of node.block.body) {
-            this._compileStatement(stmt, scope, bc);
-          }
-          this._loopStack.pop();
+            continueLabel: "",
+            finallyLabel,
+            contReg,
+            payloadReg,
+            pads: []
+          };
+          this._loopStack.push(finallyEntry);
+          emitTryCatch();
+          this._loopStack.pop(); // leaving the protected region
+
+          // Normal completion: disarm the finalizer, set resume = after the whole
+          // statement, then fall into the finalizer body.
           this.emit(bc, [this.OP.TRY_END], node);
+          this._emitLoadLabel(bc, contReg, afterFinallyLabel, node);
           this.emit(bc, [this.OP.JUMP, {
             type: "label",
-            label: afterCatchLabel
+            label: finallyLabel
           }], node);
 
-          // Catch block: exceptionReg already holds the caught value.
+          // Finalizer body (compiled once).  Runs with the enclosing context on
+          // the loop stack, so an abrupt completion inside it routes outward
+          // (overriding any pending completion — correct JS semantics).
           this.emit(bc, [null, {
             type: "defineLabel",
-            label: catchLabel
+            label: finallyLabel
           }], node);
-
-          // If no param binding, just ignore the exception (it's in the dummy slot).
-          for (const stmt of node.handler.body.body) {
+          for (const stmt of node.finalizer.body) {
             this._compileStatement(stmt, scope, bc);
           }
+          // END_FINALLY: resume at whatever the continuation register points to.
+          this.emit(bc, [this.OP.JUMP_REG, contReg], node);
+
+          // Throw pad: re-raise the in-flight exception after the finalizer.
+          this.emit(bc, [null, {
+            type: "defineLabel",
+            label: throwPadLabel
+          }], node);
+          this.emit(bc, [this.OP.THROW, payloadReg], node);
+
+          // Continuation pads for return/break/continue that crossed this
+          // finalizer (collected during body compilation, emitted now that the
+          // enclosing loop-stack context is restored).
+          for (const pad of finallyEntry.pads) {
+            this.emit(bc, [null, {
+              type: "defineLabel",
+              label: pad.label
+            }], node);
+            pad.emit();
+          }
           this.emit(bc, [null, {
             type: "defineLabel",
-            label: afterCatchLabel
+            label: afterFinallyLabel
           }], node);
           break;
         }
@@ -1104,7 +1332,65 @@ export class Compiler {
     }
   }
 
-  // ── Expressions ───────────────────────────────────────────────────────────
+  // Returns true if any element in an argument/element list is a SpreadElement.
+  _hasSpread(args) {
+    return args.some(a => a != null && a.type === "SpreadElement");
+  }
+
+  // Build a flat argument array at runtime when the call contains spread elements.
+  // Returns a register holding an Array with all arguments flattened.
+  // Strategy: build a prefix array from leading non-spread elements, then
+  // repeatedly call Array.prototype.concat — spread elements are concat'd directly
+  // (concat spreads array args one level), non-spread elements are wrapped in a
+  // single-element array before concat so they aren't spread.
+  _buildSpreadArgs(args, scope, bc, node) {
+    const ctx = this._currentCtx;
+    const firstSpreadIdx = args.findIndex(a => a != null && a.type === "SpreadElement");
+
+    // Build initial array from non-spread prefix (may be empty).
+    const prefix = args.slice(0, firstSpreadIdx);
+    const prefixRegs = prefix.map(a => {
+      if (a === null) {
+        const r = ctx.allocReg();
+        this.emit(bc, [this.OP.LOAD_CONST, r, b.constantOperand(undefined)], node);
+        return r;
+      }
+      return this._compileExpr(a, scope, bc);
+    });
+    let accReg = ctx.allocReg();
+    this.emit(bc, [this.OP.BUILD_ARRAY, accReg, prefix.length, ...prefixRegs], node);
+
+    // Process each remaining arg via Array.prototype.concat.
+    for (let i = firstSpreadIdx; i < args.length; i++) {
+      const arg = args[i];
+      const concatKeyReg = ctx.allocReg();
+      this.emit(bc, [this.OP.LOAD_CONST, concatKeyReg, b.constantOperand("concat")], node);
+      const concatFnReg = ctx.allocReg();
+      this.emit(bc, [this.OP.GET_PROP, concatFnReg, accReg, concatKeyReg], node);
+      let argArrReg;
+      if (arg === null) {
+        // Array hole — treat as undefined wrapped in [undefined]
+        const elemReg = ctx.allocReg();
+        this.emit(bc, [this.OP.LOAD_CONST, elemReg, b.constantOperand(undefined)], node);
+        argArrReg = ctx.allocReg();
+        this.emit(bc, [this.OP.BUILD_ARRAY, argArrReg, 1, elemReg], node);
+      } else if (arg.type === "SpreadElement") {
+        // Spread: concat the iterable directly (concat flattens one level).
+        argArrReg = this._compileExpr(arg.argument, scope, bc);
+      } else {
+        // Non-spread: wrap in [elem] so concat doesn't flatten the value.
+        const elemReg = this._compileExpr(arg, scope, bc);
+        argArrReg = ctx.allocReg();
+        this.emit(bc, [this.OP.BUILD_ARRAY, argArrReg, 1, elemReg], node);
+      }
+      const newAccReg = ctx.allocReg();
+      this.emit(bc, [this.OP.CALL_METHOD, newAccReg, accReg, concatFnReg, 1, argArrReg], node);
+      accReg = newAccReg;
+    }
+    return accReg;
+  }
+
+  // Expressions
   // Returns the virtual RegisterOperand that holds the result.
   // For local variables: returns their RegisterOperand directly (no instruction emitted).
   // For all others: allocates a fresh virtual register, emits the instruction(s),
@@ -1124,6 +1410,19 @@ export class Compiler {
 
       return dst;
     }
+
+    // _VM_JUMP_("labelName") — emits JUMP with a label operand.
+    // Used by bytecode transforms (e.g. CFF) via Template to express jumps
+    // to labels that exist in the parent compiler's bytecode stream.
+    if (node.type === "CallExpression" && node.callee.type === "Identifier" && node.callee.name === "_VM_JUMP_") {
+      const label = node.arguments[0].value;
+      bc.push([this.OP.JUMP, {
+        type: "label",
+        label
+      }]);
+      // Return a dummy register — caller (ExpressionStatement) discards it.
+      return ctx.allocReg();
+    }
     switch (node.type) {
       case "NumericLiteral":
       case "StringLiteral":
@@ -1155,16 +1454,37 @@ export class Compiler {
         }
       case "ThisExpression":
         {
+          // `this` is resolved like any ordinary binding. In a non-arrow function
+          // it is a hidden local (materialized by the entry prologue); in an arrow
+          // it climbs to the enclosing function and becomes an upvalue read. Either
+          // way the usage site is a generic register/upvalue access, not a
+          // semantically-revealing LOAD_THIS.
+          const res = this._resolve("this", this._currentCtx);
+          if (res.kind === "local") return res.reg; // register IS the local
+          if (res.kind === "upvalue") {
+            const dst = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_UPVALUE, dst, res.index], node);
+            return dst;
+          }
+          // Fallback (no enclosing `this` binding, e.g. a stray top-level use):
+          // read the frame receiver directly.
           const dst = ctx.allocReg();
           this.emit(bc, [this.OP.LOAD_THIS, dst], node);
           return dst;
         }
       case "NewExpression":
         {
-          const calleeReg = this._compileExpr(node.callee, scope, bc);
-          const argRegs = node.arguments.map(a => this._compileExpr(a, scope, bc));
+          const n = node;
+          ok(n.arguments.length < U16_MAX, `Too many arguments (max ${U16_MAX - 1})`);
+          const calleeReg = this._compileExpr(n.callee, scope, bc);
           const dst = ctx.allocReg();
-          this.emit(bc, [this.OP.NEW, dst, calleeReg, node.arguments.length, ...argRegs], node);
+          if (this._hasSpread(n.arguments)) {
+            const argsArrayReg = this._buildSpreadArgs(n.arguments, scope, bc, node);
+            this.emit(bc, [this.OP.NEW, dst, calleeReg, this.SENTINELS.CALL_SPREAD, argsArrayReg], node);
+          } else {
+            const argRegs = n.arguments.map(a => this._compileExpr(a, scope, bc));
+            this.emit(bc, [this.OP.NEW, dst, calleeReg, n.arguments.length, ...argRegs], node);
+          }
           return dst;
         }
       case "SequenceExpression":
@@ -1216,17 +1536,32 @@ export class Compiler {
           const n = node;
           const endLabel = this._makeLabel("logical_end");
           const isOr = n.operator === "||";
-          if (!isOr && n.operator !== "&&") throw new Error(`Unsupported logical operator: ${n.operator}`);
+          const isNullish = n.operator === "??";
+          if (!isOr && !isNullish && n.operator !== "&&") throw new Error(`Unsupported logical operator: ${n.operator}`);
           const lhsReg = this._compileExpr(n.left, scope, bc);
           const reg_result = ctx.allocReg();
           if (lhsReg !== reg_result) this.emit(bc, [this.OP.MOVE, reg_result, lhsReg], node);
-
-          // For ||: if truthy keep LHS, jump past RHS.
-          // For &&: if falsy keep LHS, jump past RHS.
-          this.emit(bc, [isOr ? this.OP.JUMP_IF_TRUE : this.OP.JUMP_IF_FALSE, reg_result, {
-            type: "label",
-            label: endLabel
-          }], node);
+          if (isNullish) {
+            // a ?? b — keep LHS unless it is null or undefined, otherwise use RHS.
+            // `reg_result == null` (loose) is true for exactly null and undefined,
+            // which is precisely the set of "nullish" values.
+            const nullReg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOAD_CONST, nullReg, b.constantOperand(null)], node);
+            const isNullishReg = ctx.allocReg();
+            this.emit(bc, [this.OP.LOOSE_EQ, isNullishReg, reg_result, nullReg], node);
+            // Not nullish → keep LHS and skip RHS.
+            this.emit(bc, [this.OP.JUMP_IF_FALSE, isNullishReg, {
+              type: "label",
+              label: endLabel
+            }], node);
+          } else {
+            // For ||: if truthy keep LHS, jump past RHS.
+            // For &&: if falsy keep LHS, jump past RHS.
+            this.emit(bc, [isOr ? this.OP.JUMP_IF_TRUE : this.OP.JUMP_IF_FALSE, reg_result, {
+              type: "label",
+              label: endLabel
+            }], node);
+          }
 
           // Compile RHS into reg_result.
           const rhsReg = this._compileExpr(n.right, scope, bc);
@@ -1268,6 +1603,7 @@ export class Compiler {
             "*": this.OP.MUL,
             "/": this.OP.DIV,
             "%": this.OP.MOD,
+            "**": this.OP.EXP,
             "&": this.OP.BAND,
             "|": this.OP.BOR,
             "^": this.OP.BXOR,
@@ -1356,6 +1692,7 @@ export class Compiler {
             "*=": this.OP.MUL,
             "/=": this.OP.DIV,
             "%=": this.OP.MOD,
+            "**=": this.OP.EXP,
             "&=": this.OP.BAND,
             "|=": this.OP.BOR,
             "^=": this.OP.BXOR,
@@ -1428,6 +1765,7 @@ export class Compiler {
       case "CallExpression":
         {
           const n = node;
+          ok(n.arguments.length < U16_MAX, `Too many arguments (max ${U16_MAX - 1})`);
           if (n.callee.type === "MemberExpression") {
             // Method call: receiver.method(args)
             const receiverReg = this._compileExpr(n.callee.object, scope, bc);
@@ -1440,16 +1778,26 @@ export class Compiler {
             }
             const calleeReg = ctx.allocReg();
             this.emit(bc, [this.OP.GET_PROP, calleeReg, receiverReg, methodKeyReg], node);
-            const argRegs = n.arguments.map(a => this._compileExpr(a, scope, bc));
             const dst = ctx.allocReg();
-            this.emit(bc, [this.OP.CALL_METHOD, dst, receiverReg, calleeReg, n.arguments.length, ...argRegs], node);
+            if (this._hasSpread(n.arguments)) {
+              const argsArrayReg = this._buildSpreadArgs(n.arguments, scope, bc, node);
+              this.emit(bc, [this.OP.CALL_METHOD, dst, receiverReg, calleeReg, this.SENTINELS.CALL_SPREAD, argsArrayReg], node);
+            } else {
+              const argRegs = n.arguments.map(a => this._compileExpr(a, scope, bc));
+              this.emit(bc, [this.OP.CALL_METHOD, dst, receiverReg, calleeReg, n.arguments.length, ...argRegs], node);
+            }
             return dst;
           } else {
             // Plain call: fn(args)
             const calleeReg = this._compileExpr(n.callee, scope, bc);
-            const argRegs = n.arguments.map(a => this._compileExpr(a, scope, bc));
             const dst = ctx.allocReg();
-            this.emit(bc, [this.OP.CALL, dst, calleeReg, n.arguments.length, ...argRegs], node);
+            if (this._hasSpread(n.arguments)) {
+              const argsArrayReg = this._buildSpreadArgs(n.arguments, scope, bc, node);
+              this.emit(bc, [this.OP.CALL, dst, calleeReg, this.SENTINELS.CALL_SPREAD, argsArrayReg], node);
+            } else {
+              const argRegs = n.arguments.map(a => this._compileExpr(a, scope, bc));
+              this.emit(bc, [this.OP.CALL, dst, calleeReg, n.arguments.length, ...argRegs], node);
+            }
             return dst;
           }
         }
@@ -1524,6 +1872,14 @@ export class Compiler {
           const desc = this._compileFunctionDecl(node);
           return this._emitMakeClosure(desc, node, bc);
         }
+      case "ArrowFunctionExpression":
+        {
+          // Arrows compile through the same path as any other function. They differ
+          // only in that they bind no `this`/`arguments` (handled in
+          // _compileFunctionDecl), so the resulting closure is indistinguishable.
+          const desc = this._compileFunctionDecl(node);
+          return this._emitMakeClosure(desc, node, bc);
+        }
       case "MemberExpression":
         {
           const n = node;
@@ -1542,6 +1898,9 @@ export class Compiler {
       case "ArrayExpression":
         {
           const n = node;
+          if (this._hasSpread(n.elements)) {
+            return this._buildSpreadArgs(n.elements, scope, bc, node);
+          }
           const elemRegs = n.elements.map(el => {
             if (el === null) {
               const r = ctx.allocReg();
@@ -1557,45 +1916,87 @@ export class Compiler {
       case "ObjectExpression":
         {
           const n = node;
-          const regularProps = [];
-          const accessorProps = [];
-          for (const prop of n.properties) {
-            if (prop.type === "SpreadElement") throw new Error("Object spread not supported");
-            if (prop.type === "ObjectMethod") {
-              if (prop.kind === "get" || prop.kind === "set") {
-                if (prop.computed) throw new Error("Computed getter/setter keys are not supported");
-                accessorProps.push(prop);
-              } else {
-                throw new Error("Shorthand method syntax is not supported");
-              }
-            } else {
-              regularProps.push(prop);
+          const hasSpread = n.properties.some(p => p.type === "SpreadElement");
+          const hasComputed = n.properties.some(p => (p.type === "ObjectProperty" || p.type === "ObjectMethod") && p.computed);
+          const hasMethodShorthand = n.properties.some(p => p.type === "ObjectMethod" && p.kind === "method");
+
+          // Fast path: no spread, no computed keys, no method shorthands.
+          // Uses BUILD_OBJECT for data properties then DEFINE_GETTER/SETTER for accessors.
+          if (!hasSpread && !hasComputed && !hasMethodShorthand) {
+            const regularProps = [];
+            const accessorProps = [];
+            for (const prop of n.properties) {
+              if (prop.type === "ObjectMethod") accessorProps.push(prop);else regularProps.push(prop);
+            }
+            const pairRegs = [];
+            for (const prop of regularProps) {
+              const key = prop.key;
+              let keyStr;
+              if (key.type === "Identifier") keyStr = key.name;else if (key.type === "StringLiteral" || key.type === "NumericLiteral") keyStr = String(key.value);else throw new Error(`Unsupported object key type: ${key.type}`);
+              const keyReg = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(keyStr)], node);
+              const valReg = this._compileExpr(prop.value, scope, bc);
+              pairRegs.push(keyReg, valReg);
             }
+            const dst = ctx.allocReg();
+            this.emit(bc, [this.OP.BUILD_OBJECT, dst, regularProps.length, ...pairRegs], node);
+            for (const prop of accessorProps) {
+              const key = prop.key;
+              let keyStr;
+              if (key.type === "Identifier") keyStr = key.name;else if (key.type === "StringLiteral" || key.type === "NumericLiteral") keyStr = String(key.value);else throw new Error(`Unsupported object key type: ${key.type}`);
+              const keyReg = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(keyStr)], node);
+              const fnReg = this._emitMakeClosure(this._compileFunctionDecl(prop), prop, bc);
+              this.emit(bc, [prop.kind === "get" ? this.OP.DEFINE_GETTER : this.OP.DEFINE_SETTER, dst, keyReg, fnReg], node);
+            }
+            return dst;
           }
 
-          // Build flat [key, val, key, val, …] register list.
-          const pairRegs = [];
-          for (const prop of regularProps) {
-            let keyStr;
-            const key = prop.key;
-            if (key.type === "Identifier") keyStr = key.name;else if (key.type === "StringLiteral" || key.type === "NumericLiteral") keyStr = String(key.value);else throw new Error(`Unsupported object key type: ${key.type}`);
-            const keyReg = ctx.allocReg();
-            this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(keyStr)], node);
-            const valReg = this._compileExpr(prop.value, scope, bc);
-            pairRegs.push(keyReg, valReg);
-          }
+          // General path: handles spread elements, computed keys, and method shorthands.
+          // Builds an empty object then sets each property in source order.
           const dst = ctx.allocReg();
-          this.emit(bc, [this.OP.BUILD_OBJECT, dst, regularProps.length, ...pairRegs], node);
-
-          // Define accessors on the object now sitting in `dst`.
-          for (const prop of accessorProps) {
-            const key = prop.key;
-            let keyStr;
-            if (key.type === "Identifier") keyStr = key.name;else if (key.type === "StringLiteral" || key.type === "NumericLiteral") keyStr = String(key.value);else throw new Error(`Unsupported object key type: ${key.type}`);
-            const keyReg = ctx.allocReg();
-            this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(keyStr)], node);
-            const fnReg = this._emitMakeClosure(this._compileFunctionDecl(prop), prop, bc);
-            this.emit(bc, [prop.kind === "get" ? this.OP.DEFINE_GETTER : this.OP.DEFINE_SETTER, dst, keyReg, fnReg], node);
+          this.emit(bc, [this.OP.BUILD_OBJECT, dst, 0], node);
+          for (const prop of n.properties) {
+            if (prop.type === "SpreadElement") {
+              // {…src} — copies own enumerable properties via Object.assign(dst, src).
+              const objGlobalReg = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_GLOBAL, objGlobalReg, b.constantOperand("Object")], node);
+              const assignKeyReg = ctx.allocReg();
+              this.emit(bc, [this.OP.LOAD_CONST, assignKeyReg, b.constantOperand("assign")], node);
+              const assignFnReg = ctx.allocReg();
+              this.emit(bc, [this.OP.GET_PROP, assignFnReg, objGlobalReg, assignKeyReg], node);
+              const spreadValReg = this._compileExpr(prop.argument, scope, bc);
+              const _assignResultReg = ctx.allocReg();
+              this.emit(bc, [this.OP.CALL_METHOD, _assignResultReg, objGlobalReg, assignFnReg, 2, dst, spreadValReg], node);
+            } else {
+              const p = prop;
+
+              // Resolve key: computed → evaluate expression; static → load constant.
+              let keyReg;
+              if (p.computed) {
+                keyReg = this._compileExpr(p.key, scope, bc);
+              } else {
+                const key = p.key;
+                let keyStr;
+                if (key.type === "Identifier") keyStr = key.name;else if (key.type === "StringLiteral" || key.type === "NumericLiteral") keyStr = String(key.value);else throw new Error(`Unsupported object key type: ${key.type}`);
+                keyReg = ctx.allocReg();
+                this.emit(bc, [this.OP.LOAD_CONST, keyReg, b.constantOperand(keyStr)], node);
+              }
+              if (p.type === "ObjectMethod") {
+                const fnReg = this._emitMakeClosure(this._compileFunctionDecl(p), p, bc);
+                if (p.kind === "get") {
+                  this.emit(bc, [this.OP.DEFINE_GETTER, dst, keyReg, fnReg], node);
+                } else if (p.kind === "set") {
+                  this.emit(bc, [this.OP.DEFINE_SETTER, dst, keyReg, fnReg], node);
+                } else {
+                  // method shorthand: {foo() {}} ≡ {foo: function() {}}
+                  this.emit(bc, [this.OP.SET_PROP, dst, keyReg, fnReg], node);
+                }
+              } else {
+                const valReg = this._compileExpr(p.value, scope, bc);
+                this.emit(bc, [this.OP.SET_PROP, dst, keyReg, valReg], node);
+              }
+            }
           }
           return dst;
         }
@@ -1607,7 +2008,7 @@ export class Compiler {
   }
 }
 
-// ── Serializer ────────────────────────────────────────────────────────────────
+// Serializer
 class Serializer {
   constructor(compiler) {
     this.compiler = compiler;
@@ -1774,9 +2175,9 @@ class Serializer {
       // Validate no opcode or operand exceeds u16 limit
       for (const o of resolvedValues) {
         ok(typeof o === "number", "Unresolved operand: " + JSON.stringify(o));
-        ok(o >= 0 && o <= 0xffff, `Operand overflow (max 0xFFFF u16): ${o}`);
+        ok(o >= 0 && o <= 0xffffffff, `Operand overflow (max 0xFFFFFFFF u32): ${o}`);
       }
-      ok(op >= 0 && op <= 0xffff, `Opcode overflow (max 0xFFFF u16): ${op}`);
+      ok(op >= 0 && op <= 0xffffffff, `Opcode overflow (max 0xFFFFFFFF u32): ${op}`);
       serialized.push(instr);
     }
     return {
@@ -1784,10 +2185,12 @@ class Serializer {
     };
   }
   _encodeBytecode(flat) {
-    const buf = new Uint8Array(flat.length * 2);
+    const buf = new Uint8Array(flat.length * 4);
     flat.forEach((w, i) => {
-      buf[i * 2] = w & 0xff;
-      buf[i * 2 + 1] = w >>> 8 & 0xff;
+      buf[i * 4] = w & 0xff;
+      buf[i * 4 + 1] = w >>> 8 & 0xff;
+      buf[i * 4 + 2] = w >>> 16 & 0xff;
+      buf[i * 4 + 3] = w >>> 24 & 0xff;
     });
     return Buffer.from(buf).toString("base64");
   }
@@ -1813,6 +2216,8 @@ class Serializer {
     sections.push(`var TIMING_CHECKS = ${!!this.options.timingChecks};`);
     const object = t.objectExpression(Object.entries(this.OP).map(([name, value]) => t.objectProperty(t.identifier(name), t.numericLiteral(value))));
     sections.push(`var OP = ${generate(object).code};`);
+    const sentinelsObject = t.objectExpression(Object.entries(compiler.SENTINELS).map(([name, value]) => t.objectProperty(t.identifier(name), t.numericLiteral(value))));
+    sections.push(`var SENTINELS = ${generate(sentinelsObject).code};`);
     initBody.push(this._serializeConstants(constants));
     sections = [...initBody, ...sections];
     sections.push(VM_RUNTIME);
@@ -1820,33 +2225,71 @@ class Serializer {
   }
 }
 export async function compileAndSerialize(sourceCode, options) {
+  let obfuscationStartedAt = now();
   const compiler = new Compiler(options);
   let bytecode = compiler.compile(sourceCode);
+  const passes = [];
+  if (options.stringConcealing) {
+    passes.push({
+      pass: stringConcealing,
+      name: "stringConcealing"
+    });
+  }
 
-  // jumpDispatcher must run before resolveRegisters so that the new rDisp/rKey
-  // RegisterOperand objects it injects are visible to the liveness analysis.
-  // It must also run before resolveLabels since it emits encodedLabel IR operands.
+  // CFF and Dispatcher both run before resolveRegisters and resolveLabels
+  if (options.controlFlowFlattening) {
+    passes.push({
+      pass: controlFlowFlattening,
+      name: "controlFlowFlattening"
+    });
+  }
   if (options.dispatcher) {
-    const dispatcherResult = dispatcher(bytecode, compiler);
-    bytecode = dispatcherResult.bytecode;
+    passes.push({
+      pass: dispatcher,
+      name: "dispatcher"
+    });
   }
-  const passes = [];
-  passes.push(concealConstants);
+  passes.push({
+    pass: concealConstants,
+    name: "concealConstants"
+  });
   if (options.specializedOpcodes) {
-    passes.push(specializedOpcodes);
-  }
-  if (options.microOpcodes) {
-    passes.push(microOpcodes);
+    passes.push({
+      pass: specializedOpcodes,
+      name: "specializedOpcodes"
+    });
   }
   if (options.macroOpcodes) {
-    passes.push(macroOpcodes);
+    passes.push({
+      pass: macroOpcodes,
+      name: "macroOpcodes"
+    });
   }
   if (options.aliasedOpcodes) {
-    passes.push(aliasedOpcodes);
+    passes.push({
+      pass: aliasedOpcodes,
+      name: "aliasedOpcodes"
+    });
   }
-  for (const pass of passes) {
+  const timings = {};
+  function runAndTime(pass, name) {
+    const startedAt = now();
+    compiler.log(`Running bytecode pass ${name}...`);
     const passResult = pass(bytecode, compiler);
     bytecode = passResult.bytecode;
+    const endedAt = now();
+    const elapsedMs = endedAt - startedAt;
+    timings[name] = elapsedMs;
+    compiler.profileData.transforms[name] = {
+      transformTime: elapsedMs,
+      bytecodeSize: bytecode.length,
+      flatBytecodeSize: bytecode.flat().length
+    };
+    compiler.log(`Bytecode pass ${name} completed in ${Math.floor(elapsedMs)}ms`);
+    return passResult;
+  }
+  for (const pass of passes) {
+    runAndTime(pass.pass, pass.name);
   }
 
   // Resolve virtual registers to concrete slot indices and set regCount per fn.
@@ -1854,32 +2297,36 @@ export async function compileAndSerialize(sourceCode, options) {
   // of the bytecode while leaving RETURN in place, splitting a function's code
   // into two non-contiguous regions. Linear-scan liveness then sees incorrect
   // firstUse/lastUse for registers that span the gap, causing slot collisions.
-  const regsResult = resolveRegisters(bytecode, compiler);
+  const regsResult = runAndTime(resolveRegisters, "resolveRegisters");
   bytecode = regsResult.bytecode;
 
   // selfModifying runs after register resolution so concrete slot indices are
   // already in place; only label operands remain unresolved at this stage.
   if (options.selfModifying) {
-    const smResult = selfModifying(bytecode, compiler);
+    const smResult = runAndTime(selfModifying, "selfModifying");
     bytecode = smResult.bytecode;
   }
 
   // Resolve label references to flat bytecode indices.
-  const labelsResult = resolveLabels(bytecode, compiler);
+  const labelsResult = runAndTime(resolveLabels, "resolveLabels");
   bytecode = labelsResult.bytecode;
 
   // Set mainStartPc from the first function descriptor (or 0 for top-level start).
   compiler.mainStartPc = compiler.mainFn.startPc;
 
   // Resolve constant references to pool indices (+ conceal key operand).
-  const constResult = resolveConstants(bytecode, compiler);
+  const constResult = runAndTime(resolveConstants, "resolveConstants");
   bytecode = constResult.bytecode;
   compiler.constants = constResult.constants;
 
   // Build and obfuscate the runtime.
   const runtimeSource = compiler.serializer.serialize(bytecode, constResult.constants, compiler);
 
-  // This part was purposefully pulled out Serializer as OP_NAME's get resolved during obfuscateRuntime
+  // for (const key of Object.keys(timings)) {
+  //  console.log(`  ${key}: ${timings[key]}ms`);
+  // }
+
+  // This part was purposefully pulled out Serializer as OP_NAME's get resolved during buildRuntime
   // So for the most useful comments, it's ran absolutely last
   // Tests also rely on correct comments so it's required
   const generateBytecodeComment = () => {
@@ -1890,8 +2337,10 @@ export async function compileAndSerialize(sourceCode, options) {
     }
     return lines.join("\n");
   };
-  const code = await obfuscateRuntime(runtimeSource, bytecode, options, compiler, generateBytecodeComment);
+  const code = await buildRuntime(runtimeSource, bytecode, options, compiler, generateBytecodeComment);
+  compiler.profileData.obfuscationTime = now() - obfuscationStartedAt;
   return {
-    code
+    code,
+    profileData: compiler.profileData
   };
 }