jsguardian 1.2.0

package/krak-compiler.js

@@ -0,0 +1,1480 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KrakCompiler = exports.KrakBailError = void 0;
+// ── Types ─────────────────────────────────────────────────────────────────────
+class KrakBailError extends Error {
+}
+exports.KrakBailError = KrakBailError;
+// ── Helpers ───────────────────────────────────────────────────────────────────
+// 32-bit LCG: full 32-bit state, keystream byte = key >>> 24
+function computeKeyAtAddress(initialKey, address, lcgMul, lcgInc) {
+    let key = initialKey >>> 0;
+    for (let i = 0; i < address; i++)
+        key = ((Math.imul(key, lcgMul) + lcgInc) | 0) >>> 0;
+    return key;
+}
+// ── Compiler ──────────────────────────────────────────────────────────────────
+class KrakCompiler {
+    constructor(config) {
+        this.bytecodeArr = [];
+        this.labels = {};
+        this.variables = {};
+        this.nextVarSlot = 4;
+        this.pendingJumps = [];
+        this.functions = {};
+        this.loopStack = [];
+        // Inline-callback return context: ReturnStatement inside map/filter/forEach
+        // callback must jump to a per-callback exit label rather than emitting RET
+        // (which would exit the whole VM function).
+        this.inlineCallbackStack = [];
+        // Hardening: randomise temp reg pool
+        this.hardeningEnabled = false;
+        this.hardeningSalt = 0;
+        this.tempRegMap = {};
+        this.tempRegUsed = {};
+        this.config = config;
+        this.opcodes = config.opcodes;
+        this.layouts = config.argLayouts;
+    }
+    // ── Var / reg management ──────────────────────────────────────────────────
+    allocVar(name) {
+        if (this.variables[name] === undefined)
+            this.variables[name] = this.nextVarSlot++;
+        return this.variables[name];
+    }
+    getVarReg(name) {
+        const slot = this.variables[name];
+        if (slot === undefined)
+            throw new KrakBailError("Undefined variable: " + name);
+        return slot % 256;
+    }
+    getTempReg(index) {
+        if (!this.hardeningEnabled)
+            return 200 + index;
+        if (this.tempRegMap[index] !== undefined)
+            return this.tempRegMap[index];
+        const poolStart = 200, poolSize = 54;
+        const start = ((index * 7) + this.hardeningSalt) % poolSize;
+        for (let probe = 0; probe < poolSize; probe++) {
+            const reg = poolStart + ((start + probe) % poolSize);
+            if (!this.tempRegUsed[reg]) {
+                this.tempRegUsed[reg] = true;
+                this.tempRegMap[index] = reg;
+                return reg;
+            }
+        }
+        const fb = poolStart + (index % poolSize);
+        this.tempRegMap[index] = fb;
+        return fb;
+    }
+    // ── Bytecode emission ─────────────────────────────────────────────────────
+    emit(bytes) {
+        for (const b of bytes)
+            this.bytecodeArr.push(b & 0xFF);
+    }
+    currentAddress() { return this.bytecodeArr.length; }
+    setLabel(name) { this.labels[name] = this.currentAddress(); }
+    // Encode args according to the per-build shuffled layout.
+    encodeArgs(layoutName, argValues) {
+        if (layoutName === "FUNC") {
+            if (argValues["k"] === undefined)
+                argValues["k"] = 0;
+            if (argValues["n"] === undefined)
+                argValues["n"] = 0;
+        }
+        const layout = this.layouts[layoutName] ?? [];
+        const result = [];
+        for (const argDef of layout) {
+            const value = argValues[argDef.name];
+            if (value === undefined)
+                throw new KrakBailError(`Missing arg: ${argDef.name} for ${layoutName}`);
+            if (argDef.type === "BYTE") {
+                result.push(value & 0xFF);
+            }
+            else if (argDef.type === "INT") {
+                result.push(value & 0xFF);
+                result.push((value >> 8) & 0xFF);
+                result.push((value >> 16) & 0xFF);
+                result.push((value >> 24) & 0xFF);
+            }
+        }
+        return result;
+    }
+    // ── Emit helpers ──────────────────────────────────────────────────────────
+    emitMovInt(reg, value) {
+        if (reg === 1 && value === 0)
+            return;
+        this.emit([this.opcodes["MOV"]]);
+        this.emit(this.encodeArgs("MOV", { r: reg, v: value }));
+    }
+    emitMovBool(reg, val) {
+        this.emit([this.opcodes["BOOL"]]);
+        this.emit(this.encodeArgs("BOOL", { d: reg, v: val ? 1 : 0 }));
+    }
+    emitMovReg(dest, src) {
+        if (dest === src)
+            return;
+        this.emit([this.opcodes["MOVR"]]);
+        this.emit(this.encodeArgs("MOVR", { d: dest, s: src }));
+    }
+    emitBinaryOp(opName, dest, src) {
+        this.emit([this.opcodes[opName]]);
+        this.emit(this.encodeArgs(opName, { d: dest, s: src }));
+    }
+    emitPush(reg) {
+        this.emit([this.opcodes["PUSH"]]);
+        this.emit(this.encodeArgs("PUSH", { r: reg }));
+    }
+    emitPop(reg) {
+        this.emit([this.opcodes["POP"]]);
+        this.emit(this.encodeArgs("POP", { r: reg }));
+    }
+    emitNewStr(destReg, str) {
+        this.emit([this.opcodes["STR"]]);
+        this.emit(this.encodeArgs("STR", { d: destReg }));
+        const len = str.length;
+        this.emit([len & 0xFF, (len >> 8) & 0xFF, (len >> 16) & 0xFF, (len >> 24) & 0xFF]);
+        for (let i = 0; i < str.length; i++)
+            this.emit([str.charCodeAt(i) & 0xFF]);
+    }
+    emitGetGlobal(destReg, nameReg) {
+        this.emit([this.opcodes["GGLO"]]);
+        this.emit(this.encodeArgs("GGLO", { d: destReg, n: nameReg }));
+    }
+    emitGetProp(destReg, objReg, propReg) {
+        this.emit([this.opcodes["GPRP"]]);
+        this.emit(this.encodeArgs("GPRP", { d: destReg, o: objReg, p: propReg }));
+    }
+    emitSetProp(objReg, propReg, valueReg) {
+        this.emit([this.opcodes["SPRP"]]);
+        this.emit(this.encodeArgs("SPRP", { o: objReg, p: propReg, v: valueReg }));
+    }
+    emitCallMethod(destReg, objReg, methodReg, argCount) {
+        this.emit([this.opcodes["METH"]]);
+        this.emit(this.encodeArgs("METH", { d: destReg, o: objReg, m: methodReg, c: argCount }));
+    }
+    emitFromNum(destReg, srcReg) {
+        this.emit([this.opcodes["FNUM"]]);
+        this.emit(this.encodeArgs("FNUM", { d: destReg, s: srcReg }));
+    }
+    emitToNum(destReg, srcReg) {
+        this.emit([this.opcodes["TNUM"]]);
+        this.emit(this.encodeArgs("TNUM", { d: destReg, s: srcReg }));
+    }
+    emitCallAddr(targetLabel) {
+        this.emit([this.opcodes["CADR"]]);
+        this.pendingJumps.push({ type: "CADR", address: this.currentAddress(), label: targetLabel });
+        this.emit(this.encodeArgs("CADR", { k: 0, t: 0 }));
+    }
+    emitNew(destReg, constructorReg, argCount) {
+        this.emit([this.opcodes["NEW"]]);
+        this.emit(this.encodeArgs("NEW", { d: destReg, c: constructorReg, n: argCount }));
+    }
+    emitInstanceOf(destReg, objReg, constrReg) {
+        this.emit([this.opcodes["IOF"]]);
+        this.emit(this.encodeArgs("IOF", { d: destReg, o: objReg, c: constrReg }));
+    }
+    emitTypeof(destReg, srcReg) {
+        this.emit([this.opcodes["TYP"]]);
+        this.emit(this.encodeArgs("TYP", { d: destReg, s: srcReg }));
+    }
+    emitRet() { this.emit([this.opcodes["RET"]]); }
+    emitJz(reg, targetLabel) {
+        this.emit([this.opcodes["JZ"]]);
+        this.pendingJumps.push({ type: "JZ", address: this.currentAddress(), label: targetLabel, reg });
+        this.emit(this.encodeArgs("JZ", { r: reg, k: 0, t: 0 }));
+    }
+    emitJnz(reg, targetLabel) {
+        this.emit([this.opcodes["JNZ"]]);
+        this.pendingJumps.push({ type: "JNZ", address: this.currentAddress(), label: targetLabel, reg });
+        this.emit(this.encodeArgs("JNZ", { r: reg, k: 0, t: 0 }));
+    }
+    emitJmp(targetLabel) {
+        this.emit([this.opcodes["JMP"]]);
+        this.pendingJumps.push({ type: "JMP", address: this.currentAddress(), label: targetLabel });
+        this.emit(this.encodeArgs("JMP", { k: 0, t: 0 }));
+    }
+    emitJgt(targetLabel) {
+        this.emit([this.opcodes["JGT"]]);
+        this.pendingJumps.push({ type: "JGT", address: this.currentAddress(), label: targetLabel });
+        this.emit(this.encodeArgs("JGT", { k: 0, t: 0 }));
+    }
+    emitJlt(targetLabel) {
+        this.emit([this.opcodes["JLT"]]);
+        this.pendingJumps.push({ type: "JLT", address: this.currentAddress(), label: targetLabel });
+        this.emit(this.encodeArgs("JLT", { k: 0, t: 0 }));
+    }
+    // emitCallReg: check if fn is internal (number type) or external (function).
+    emitCallReg(destReg, funcReg, argCount) {
+        const typeReg = this.getTempReg(46); // reg 246 — safe, below flags reg 255
+        const numTypeReg = this.getTempReg(47); // reg 247
+        this.emitTypeof(typeReg, funcReg);
+        this.emitNewStr(numTypeReg, "number");
+        this.emit([this.opcodes["CMP"]]);
+        this.emit(this.encodeArgs("CMP", { a: typeReg, b: numTypeReg }));
+        const externalLabel = `__creg_ext_${this.currentAddress()}`;
+        const endLabel = `__creg_end_${this.currentAddress()}`;
+        this.emitJnz(255, externalLabel);
+        this.emit([this.opcodes["CREGI"]]);
+        this.emit(this.encodeArgs("CREGI", { f: funcReg, n: argCount }));
+        if (destReg !== 0)
+            this.emitMovReg(destReg, 0);
+        this.emitJmp(endLabel);
+        this.setLabel(externalLabel);
+        this.emit([this.opcodes["CREGE"]]);
+        this.emit(this.encodeArgs("CREGE", { d: destReg, f: funcReg, n: argCount }));
+        this.setLabel(endLabel);
+    }
+    // ── compileMemberBase ─────────────────────────────────────────────────────
+    compileMemberBase(node, objReg, propReg) {
+        if (node.object.type === "Identifier" && this.variables[node.object.name] === undefined) {
+            this.emitNewStr(this.getTempReg(0), node.object.name);
+            this.emitGetGlobal(objReg, this.getTempReg(0));
+        }
+        else {
+            this.compileExpression(node.object, objReg);
+        }
+        if (node.computed) {
+            this.compileExpression(node.property, propReg);
+        }
+        else {
+            const propName = node.property.name ?? node.property.value;
+            this.emitNewStr(propReg, String(propName));
+        }
+    }
+    compileMemberExpression(node, targetReg) {
+        const objReg = this.getTempReg(20);
+        const propReg = this.getTempReg(21);
+        this.compileMemberBase(node, objReg, propReg);
+        this.emitGetProp(targetReg, objReg, propReg);
+    }
+    // ── tryCompileConditionExit ───────────────────────────────────────────────
+    tryCompileConditionExit(node, exitLabel) {
+        if (node.type !== "BinaryExpression")
+            return false;
+        const op = node.operator;
+        if (!["<", "<=", ">", ">=", "==", "===", "!=", "!=="].includes(op))
+            return false;
+        let leftReg;
+        if (node.left.type === "Identifier" && this.variables[node.left.name] !== undefined) {
+            leftReg = this.getVarReg(node.left.name);
+        }
+        else {
+            leftReg = this.getTempReg(48); // reg 248 — was 254 (too close to flags)
+            this.compileExpression(node.left, leftReg);
+        }
+        let rightReg;
+        if (node.right.type === "Identifier" && this.variables[node.right.name] !== undefined) {
+            rightReg = this.getVarReg(node.right.name);
+        }
+        else if (node.right.type === "NumericLiteral" && node.right.value === 0) {
+            rightReg = 1;
+        }
+        else {
+            rightReg = this.getTempReg(49); // reg 249 — was 255 (CMP flags reg, conflicting)
+            this.compileExpression(node.right, rightReg);
+        }
+        this.emit([this.opcodes["CMP"]]);
+        this.emit(this.encodeArgs("CMP", { a: leftReg, b: rightReg }));
+        switch (op) {
+            case "<":
+                this.emitJgt(exitLabel);
+                this.emitJz(255, exitLabel);
+                break;
+            case "<=":
+                this.emitJgt(exitLabel);
+                break;
+            case ">":
+                this.emitJlt(exitLabel);
+                this.emitJz(255, exitLabel);
+                break;
+            case ">=":
+                this.emitJlt(exitLabel);
+                break;
+            case "==":
+            case "===":
+                this.emitJlt(exitLabel);
+                this.emitJgt(exitLabel);
+                break;
+            case "!=":
+            case "!==":
+                this.emitJz(255, exitLabel);
+                break;
+        }
+        return true;
+    }
+    // ── compileCallExpression ─────────────────────────────────────────────────
+    compileCallExpression(node, targetReg) {
+        // Handle array methods with inline callbacks
+        if (node.callee.type === "MemberExpression" && !node.callee.computed && node.callee.property.name) {
+            const methodName = node.callee.property.name;
+            const isCbMethod = ["map", "filter", "forEach", "reduce"].includes(methodName);
+            if (isCbMethod) {
+                if (node.arguments.length < 1)
+                    throw new KrakBailError(`Array.${methodName} requires a callback`);
+                const callbackArg = node.arguments[0];
+                const cbType = callbackArg.type;
+                const isInlineCallback = cbType === "ArrowFunctionExpression" || cbType === "FunctionExpression";
+                // ── reduce ── compile as: acc = init; for (i=0; i<len; i++) acc = cb(acc, arr[i], i, arr)
+                if (methodName === "reduce") {
+                    const uid = this.currentAddress();
+                    const colReg = this.allocVar(`__rd_col_${uid}`) % 256;
+                    const lenReg = this.allocVar(`__rd_len_${uid}`) % 256;
+                    const idxReg = this.allocVar(`__rd_idx_${uid}`) % 256;
+                    const accReg = this.allocVar(`__rd_acc_${uid}`) % 256;
+                    const elemReg = this.allocVar(`__rd_el_${uid}`) % 256;
+                    this.compileExpression(node.callee.object, colReg);
+                    this.emitNewStr(this.getTempReg(4), "length");
+                    this.emitGetProp(lenReg, colReg, this.getTempReg(4));
+                    this.emitToNum(lenReg, lenReg);
+                    // initial accumulator and start index
+                    let startIdx = 0;
+                    if (node.arguments.length >= 2) {
+                        this.compileExpression(node.arguments[1], accReg);
+                        startIdx = 0;
+                    }
+                    else {
+                        // no initial value: acc = arr[0], start loop at 1
+                        this.emitMovInt(this.getTempReg(4), 0);
+                        this.emitFromNum(this.getTempReg(4), this.getTempReg(4));
+                        this.emitGetProp(accReg, colReg, this.getTempReg(4));
+                        startIdx = 1;
+                    }
+                    this.emitMovInt(idxReg, startIdx);
+                    const loopStart = `__rd_loop_${uid}`, loopEnd = `__rd_end_${uid}`, loopBody = `__rd_body_${uid}`;
+                    this.setLabel(loopStart);
+                    this.emit([this.opcodes["CMP"]]);
+                    this.emit(this.encodeArgs("CMP", { a: idxReg, b: lenReg }));
+                    this.emit([this.opcodes["JLT"]]);
+                    this.pendingJumps.push({ type: "JLT", address: this.currentAddress(), label: loopBody });
+                    this.emit(this.encodeArgs("JLT", { k: 0, t: 0 }));
+                    this.emitJmp(loopEnd);
+                    this.setLabel(loopBody);
+                    this.emitFromNum(this.getTempReg(4), idxReg);
+                    this.emitGetProp(elemReg, colReg, this.getTempReg(4));
+                    if (isInlineCallback) {
+                        const callbackArity = callbackArg.params.length;
+                        const savedVars = this.variables;
+                        const savedNext = this.nextVarSlot;
+                        this.variables = Object.assign({}, this.variables);
+                        if (callbackArity >= 1) {
+                            const p0 = this.allocVar(callbackArg.params[0].name) % 256;
+                            this.emitMovReg(p0, accReg);
+                        }
+                        if (callbackArity >= 2) {
+                            const p1 = this.allocVar(callbackArg.params[1].name) % 256;
+                            this.emitMovReg(p1, elemReg);
+                        }
+                        if (callbackArity >= 3) {
+                            const p2 = this.allocVar(callbackArg.params[2].name) % 256;
+                            this.emitMovReg(p2, idxReg);
+                        }
+                        if (callbackArity >= 4) {
+                            const p3 = this.allocVar(callbackArg.params[3].name) % 256;
+                            this.emitMovReg(p3, colReg);
+                        }
+                        if (callbackArg.body.type === "BlockStatement") {
+                            const cbRetLabel = `__rd_ret_${uid}_${this.currentAddress()}`;
+                            this.inlineCallbackStack.push({ cbResReg: accReg, returnLabel: cbRetLabel });
+                            this.compileStatement(callbackArg.body);
+                            this.inlineCallbackStack.pop();
+                            this.setLabel(cbRetLabel);
+                        }
+                        else {
+                            this.compileExpression(callbackArg.body, accReg);
+                        }
+                        this.variables = savedVars;
+                        this.nextVarSlot = savedNext;
+                    }
+                    else if (cbType === "Identifier") {
+                        const callReg = this.getVarReg(callbackArg.name);
+                        this.emitPush(accReg);
+                        this.emitPush(elemReg);
+                        this.emitPush(idxReg);
+                        this.emitPush(colReg);
+                        this.emitCallReg(accReg, callReg, 4);
+                    }
+                    else {
+                        throw new KrakBailError("unsupported reduce callback type: " + cbType);
+                    }
+                    this.emit([this.opcodes["INC"]]);
+                    this.emit(this.encodeArgs("INC", { r: idxReg }));
+                    this.emitJmp(loopStart);
+                    this.setLabel(loopEnd);
+                    if (targetReg !== accReg)
+                        this.emitMovReg(targetReg, accReg);
+                    return;
+                }
+                // ── map / filter / forEach ────────────────────────────────────────────
+                const uid = this.currentAddress();
+                const colReg = this.allocVar(`__cb_col_${uid}`) % 256;
+                const lenReg = this.allocVar(`__cb_len_${uid}`) % 256;
+                const idxReg = this.allocVar(`__cb_idx_${uid}`) % 256;
+                const resReg = this.allocVar(`__cb_res_${uid}`) % 256;
+                const elemReg = this.allocVar(`__cb_el_${uid}`) % 256;
+                const cbResReg = this.allocVar(`__cb_val_${uid}`) % 256;
+                this.compileExpression(node.callee.object, colReg);
+                this.emitNewStr(this.getTempReg(4), "length");
+                this.emitGetProp(lenReg, colReg, this.getTempReg(4));
+                this.emitToNum(lenReg, lenReg);
+                if (methodName === "map" || methodName === "filter") {
+                    const arrayConstReg = this.getTempReg(36);
+                    this.emitNewStr(this.getTempReg(37), "Array");
+                    this.emitGetGlobal(arrayConstReg, this.getTempReg(37));
+                    this.emitNew(resReg, arrayConstReg, 0);
+                }
+                this.emitMovInt(idxReg, 0);
+                const loopStart = `__cb_loop_${uid}`, loopEnd = `__cb_end_${uid}`, loopBody = `__cb_body_${uid}`;
+                this.setLabel(loopStart);
+                this.emit([this.opcodes["CMP"]]);
+                this.emit(this.encodeArgs("CMP", { a: idxReg, b: lenReg }));
+                this.emit([this.opcodes["JLT"]]);
+                this.pendingJumps.push({ type: "JLT", address: this.currentAddress(), label: loopBody });
+                this.emit(this.encodeArgs("JLT", { k: 0, t: 0 }));
+                this.emitJmp(loopEnd);
+                this.setLabel(loopBody);
+                this.emitFromNum(this.getTempReg(4), idxReg);
+                this.emitGetProp(elemReg, colReg, this.getTempReg(4));
+                if (isInlineCallback) {
+                    const callbackArity = callbackArg.params.length;
+                    const savedVars = this.variables;
+                    const savedNext = this.nextVarSlot;
+                    this.variables = Object.assign({}, this.variables);
+                    if (callbackArity >= 1) {
+                        const p0 = this.allocVar(callbackArg.params[0].name) % 256;
+                        this.emitMovReg(p0, elemReg);
+                    }
+                    if (callbackArity >= 2) {
+                        const p1 = this.allocVar(callbackArg.params[1].name) % 256;
+                        this.emitMovReg(p1, idxReg);
+                    }
+                    if (callbackArity >= 3) {
+                        const p2 = this.allocVar(callbackArg.params[2].name) % 256;
+                        this.emitMovReg(p2, colReg);
+                    }
+                    if (callbackArg.body.type === "BlockStatement") {
+                        // Each `return` in the block must NOT emit RET (that exits the whole
+                        // VM function). Instead we push a context so ReturnStatement jumps
+                        // to cbRetLabel, writing the value into cbResReg.
+                        const cbRetLabel = `__cb_ret_${uid}_${this.currentAddress()}`;
+                        this.inlineCallbackStack.push({ cbResReg, returnLabel: cbRetLabel });
+                        this.compileStatement(callbackArg.body);
+                        this.inlineCallbackStack.pop();
+                        this.emitMovInt(cbResReg, 0); // fallthrough: callback body had no return
+                        this.setLabel(cbRetLabel); // all `return expr` paths jump here
+                    }
+                    else
+                        this.compileExpression(callbackArg.body, cbResReg);
+                    this.variables = savedVars;
+                    this.nextVarSlot = savedNext;
+                }
+                else if (cbType === "Identifier") {
+                    const callReg = this.getVarReg(callbackArg.name);
+                    this.emitPush(elemReg);
+                    this.emitPush(idxReg);
+                    this.emitPush(colReg);
+                    this.emitCallReg(cbResReg, callReg, 3);
+                }
+                else {
+                    throw new KrakBailError("unsupported callback type: " + cbType);
+                }
+                if (methodName === "map") {
+                    this.emitPush(cbResReg);
+                    this.emitNewStr(this.getTempReg(38), "push");
+                    this.emitCallMethod(this.getTempReg(39), resReg, this.getTempReg(38), 1);
+                }
+                else if (methodName === "filter") {
+                    const skipPush = `__cb_skip_${uid}_${this.currentAddress()}`;
+                    this.emitJz(cbResReg, skipPush);
+                    this.emitPush(elemReg);
+                    this.emitNewStr(this.getTempReg(38), "push");
+                    this.emitCallMethod(this.getTempReg(39), resReg, this.getTempReg(38), 1);
+                    this.setLabel(skipPush);
+                }
+                this.emit([this.opcodes["INC"]]);
+                this.emit(this.encodeArgs("INC", { r: idxReg }));
+                this.emitJmp(loopStart);
+                this.setLabel(loopEnd);
+                if (methodName === "map" || methodName === "filter") {
+                    if (targetReg !== resReg)
+                        this.emitMovReg(targetReg, resReg);
+                }
+                else {
+                    this.emitMovInt(targetReg, 0);
+                }
+                return;
+            }
+        }
+        // Named function call (direct)
+        if (node.callee.type === "Identifier" && this.functions[node.callee.name]) {
+            for (let i = 0; i < node.arguments.length; i++) {
+                const argReg = this.getTempReg(40 + i);
+                this.compileExpression(node.arguments[i], argReg);
+                this.emitPush(argReg);
+            }
+            const thisPlaceholder = this.getTempReg(0);
+            this.emitMovInt(thisPlaceholder, 0);
+            this.emitPush(thisPlaceholder);
+            this.emitCallAddr(`__func_${node.callee.name}`);
+            if (targetReg !== 0)
+                this.emitMovReg(targetReg, 0);
+            return;
+        }
+        // Identifier call
+        if (node.callee.type === "Identifier") {
+            for (let i = 0; i < node.arguments.length; i++) {
+                const argReg = this.getTempReg(40 + i);
+                this.compileExpression(node.arguments[i], argReg);
+                this.emitPush(argReg);
+            }
+            let funcReg;
+            if (this.variables[node.callee.name] !== undefined) {
+                funcReg = this.getVarReg(node.callee.name);
+            }
+            else {
+                funcReg = this.getTempReg(8);
+                this.emitNewStr(this.getTempReg(7), node.callee.name);
+                this.emitGetGlobal(funcReg, this.getTempReg(7));
+            }
+            this.emitCallReg(targetReg, funcReg, node.arguments.length);
+            return;
+        }
+        // General call
+        const argCount = node.arguments.length;
+        for (let i = 0; i < argCount; i++) {
+            const argReg = this.getTempReg(40 + i);
+            this.compileExpression(node.arguments[i], argReg);
+            this.emitPush(argReg);
+        }
+        if (node.callee.type === "MemberExpression") {
+            const objReg = this.getTempReg(30);
+            const methodReg = this.getTempReg(31);
+            this.compileMemberBase(node.callee, objReg, methodReg);
+            this.emitCallMethod(targetReg, objReg, methodReg, argCount);
+        }
+        else {
+            const funcReg = this.getTempReg(8);
+            this.compileExpression(node.callee, funcReg);
+            this.emitCallReg(targetReg, funcReg, argCount);
+        }
+    }
+    // ── compileExpression (Babel nodes) ──────────────────────────────────────
+    compileExpression(node, targetReg) {
+        switch (node.type) {
+            case "NumericLiteral": {
+                const v = node.value;
+                if (Number.isInteger(v) && v >= -2147483648 && v <= 2147483647) {
+                    this.emitMovInt(targetReg, v | 0);
+                }
+                else {
+                    this.emitNewStr(targetReg, String(v));
+                    this.emitToNum(targetReg, targetReg);
+                }
+                break;
+            }
+            case "StringLiteral":
+                this.emitNewStr(targetReg, node.value);
+                break;
+            case "BooleanLiteral":
+                this.emitMovBool(targetReg, node.value);
+                break;
+            case "NullLiteral":
+                this.emitMovInt(targetReg, 0);
+                break;
+            case "Identifier":
+                if (node.name === "undefined") {
+                    this.emitMovInt(targetReg, 0);
+                    break;
+                }
+                if (this.variables[node.name] !== undefined) {
+                    const srcReg = this.getVarReg(node.name);
+                    if (srcReg !== targetReg)
+                        this.emitMovReg(targetReg, srcReg);
+                }
+                else {
+                    this.emitNewStr(this.getTempReg(2), node.name);
+                    this.emitGetGlobal(targetReg, this.getTempReg(2));
+                }
+                break;
+            case "LogicalExpression": {
+                const endL = `__log_end_${this.currentAddress()}`;
+                this.compileExpression(node.left, targetReg);
+                if (node.operator === "||")
+                    this.emitJnz(targetReg, endL);
+                else if (node.operator === "&&")
+                    this.emitJz(targetReg, endL);
+                else if (node.operator === "??")
+                    this.emitJnz(targetReg, endL);
+                else
+                    throw new KrakBailError("unsupported logical: " + node.operator);
+                this.compileExpression(node.right, targetReg);
+                this.setLabel(endL);
+                break;
+            }
+            case "BinaryExpression": {
+                this.compileExpression(node.left, targetReg);
+                let tempReg;
+                if (node.right.type === "Identifier" && this.variables[node.right.name] !== undefined) {
+                    tempReg = this.getVarReg(node.right.name);
+                }
+                else if (node.right.type === "NumericLiteral" && node.right.value === 0) {
+                    tempReg = 1;
+                }
+                else {
+                    tempReg = (targetReg === this.getTempReg(0)) ? this.getTempReg(1) : this.getTempReg(0);
+                    if (node.right.type === "NumericLiteral" || node.right.type === "StringLiteral" || node.right.type === "BooleanLiteral") {
+                        this.compileExpression(node.right, tempReg);
+                    }
+                    else {
+                        this.emitPush(targetReg);
+                        this.compileExpression(node.right, tempReg);
+                        this.emitPop(targetReg);
+                    }
+                }
+                const opMap = {
+                    "+": "ADD", "-": "SUB", "*": "MUL", "/": "DIV", "%": "MOD",
+                    "&": "AND", "|": "OR", "^": "XOR", "<<": "SHL", ">>": "SAR", ">>>": "SHR",
+                };
+                const opName = opMap[node.operator];
+                if (opName) {
+                    this.emitBinaryOp(opName, targetReg, tempReg);
+                }
+                else {
+                    this.emit([this.opcodes["CMP"]]);
+                    this.emit(this.encodeArgs("CMP", { a: targetReg, b: tempReg }));
+                    const skipL = `__cmp_skip_${this.currentAddress()}`;
+                    const skip2L = `__cmp_skip2_${this.currentAddress()}`;
+                    switch (node.operator) {
+                        case "==":
+                        case "===":
+                            this.emitMovBool(targetReg, false);
+                            this.emitJnz(255, skipL);
+                            this.emitMovBool(targetReg, true);
+                            this.setLabel(skipL);
+                            break;
+                        case "!=":
+                        case "!==":
+                            this.emitMovBool(targetReg, false);
+                            this.emitJz(255, skipL);
+                            this.emitMovBool(targetReg, true);
+                            this.setLabel(skipL);
+                            break;
+                        case "<":
+                            this.emitMovBool(targetReg, false);
+                            this.emitJgt(skipL);
+                            this.emitJz(255, skip2L);
+                            this.emitMovBool(targetReg, true);
+                            this.setLabel(skipL);
+                            this.setLabel(skip2L);
+                            break;
+                        case "<=":
+                            this.emitMovBool(targetReg, false);
+                            this.emitJgt(skipL);
+                            this.emitMovBool(targetReg, true);
+                            this.setLabel(skipL);
+                            break;
+                        case ">":
+                            this.emitMovBool(targetReg, false);
+                            this.emitJlt(skipL);
+                            this.emitJz(255, skip2L);
+                            this.emitMovBool(targetReg, true);
+                            this.setLabel(skipL);
+                            this.setLabel(skip2L);
+                            break;
+                        case ">=":
+                            this.emitMovBool(targetReg, false);
+                            this.emitJlt(skipL);
+                            this.emitMovBool(targetReg, true);
+                            this.setLabel(skipL);
+                            break;
+                        case "instanceof":
+                            this.emitInstanceOf(targetReg, targetReg, tempReg);
+                            break;
+                        default:
+                            throw new KrakBailError("unsupported binary: " + node.operator);
+                    }
+                }
+                break;
+            }
+            case "UnaryExpression":
+                if (node.operator === "typeof") {
+                    const srcReg = this.getTempReg(0);
+                    this.compileExpression(node.argument, srcReg);
+                    this.emitTypeof(targetReg, srcReg);
+                }
+                else if (node.operator === "!") {
+                    const testReg = (targetReg === this.getTempReg(0)) ? this.getTempReg(1) : this.getTempReg(0);
+                    this.compileExpression(node.argument, testReg);
+                    const trueL = `__not_true_${this.currentAddress()}`, endL = `__not_end_${this.currentAddress()}`;
+                    this.emitJz(testReg, trueL);
+                    this.emitMovBool(targetReg, false);
+                    this.emitJmp(endL);
+                    this.setLabel(trueL);
+                    this.emitMovBool(targetReg, true);
+                    this.setLabel(endL);
+                }
+                else if (node.operator === "-") {
+                    const valReg = (targetReg === this.getTempReg(0)) ? this.getTempReg(1) : this.getTempReg(0);
+                    this.compileExpression(node.argument, valReg);
+                    this.emitMovInt(targetReg, 0);
+                    this.emitBinaryOp("SUB", targetReg, valReg);
+                }
+                else if (node.operator === "+") {
+                    this.compileExpression(node.argument, targetReg);
+                }
+                else if (node.operator === "void") {
+                    this.compileExpression(node.argument, this.getTempReg(0));
+                    this.emitMovInt(targetReg, 0);
+                }
+                else if (node.operator === "~") {
+                    this.compileExpression(node.argument, targetReg);
+                    this.emit([this.opcodes["NOT"]]);
+                    this.emit(this.encodeArgs("NOT", { r: targetReg }));
+                }
+                else {
+                    throw new KrakBailError("unsupported unary: " + node.operator);
+                }
+                break;
+            case "AssignmentExpression": {
+                if (node.operator === "=") {
+                    this.compileExpression(node.right, targetReg);
+                    if (node.left.type === "Identifier") {
+                        const destReg = this.allocVar(node.left.name) % 256;
+                        if (destReg !== targetReg)
+                            this.emitMovReg(destReg, targetReg);
+                    }
+                    else if (node.left.type === "MemberExpression") {
+                        this.emitPush(targetReg);
+                        const objR = this.getTempReg(10), propR = this.getTempReg(11);
+                        this.compileMemberBase(node.left, objR, propR);
+                        const valR = this.getTempReg(12);
+                        this.emitPop(valR);
+                        this.emitSetProp(objR, propR, valR);
+                        if (targetReg !== valR)
+                            this.emitMovReg(targetReg, valR);
+                    }
+                }
+                else {
+                    const op = node.operator.slice(0, -1);
+                    const opMap = { "+": "ADD", "-": "SUB", "*": "MUL", "/": "DIV", "%": "MOD", "&": "AND", "|": "OR", "^": "XOR", "<<": "SHL", ">>": "SAR", ">>>": "SHR" };
+                    const opName = opMap[op];
+                    if (!opName)
+                        throw new KrakBailError("unsupported compound assignment: " + node.operator);
+                    if (node.left.type === "Identifier") {
+                        const destReg = this.allocVar(node.left.name) % 256;
+                        const tempR = this.getTempReg(0);
+                        this.compileExpression(node.right, tempR);
+                        this.emitBinaryOp(opName, destReg, tempR);
+                        if (targetReg !== destReg)
+                            this.emitMovReg(targetReg, destReg);
+                    }
+                    else if (node.left.type === "MemberExpression") {
+                        const objR = this.getTempReg(20), propR = this.getTempReg(21);
+                        this.compileMemberBase(node.left, objR, propR);
+                        const curR = this.getTempReg(19);
+                        this.emitGetProp(curR, objR, propR);
+                        const rightR = this.getTempReg(0);
+                        this.compileExpression(node.right, rightR);
+                        this.emitBinaryOp(opName, curR, rightR);
+                        this.emitSetProp(objR, propR, curR);
+                        if (targetReg !== 0)
+                            this.emitMovReg(targetReg, curR);
+                    }
+                }
+                break;
+            }
+            case "UpdateExpression": {
+                if (node.argument.type === "Identifier") {
+                    const varReg = this.getVarReg(node.argument.name);
+                    const op = node.operator === "++" ? "INC" : "DEC";
+                    if (node.prefix) {
+                        this.emit([this.opcodes[op]]);
+                        this.emit(this.encodeArgs(op, { r: varReg }));
+                        if (targetReg !== varReg)
+                            this.emitMovReg(targetReg, varReg);
+                    }
+                    else {
+                        if (targetReg !== varReg)
+                            this.emitMovReg(targetReg, varReg);
+                        this.emit([this.opcodes[op]]);
+                        this.emit(this.encodeArgs(op, { r: varReg }));
+                    }
+                }
+                else if (node.argument.type === "MemberExpression") {
+                    const objR = this.getTempReg(20), propR = this.getTempReg(21);
+                    this.compileMemberBase(node.argument, objR, propR);
+                    const valR = this.getTempReg(19);
+                    this.emitGetProp(valR, objR, propR);
+                    if (!node.prefix)
+                        this.emitMovReg(targetReg, valR);
+                    const oneReg = this.getTempReg(0);
+                    this.emitMovInt(oneReg, 1);
+                    if (node.operator === "++")
+                        this.emitBinaryOp("ADD", valR, oneReg);
+                    else
+                        this.emitBinaryOp("SUB", valR, oneReg);
+                    if (node.prefix)
+                        this.emitMovReg(targetReg, valR);
+                    this.emitSetProp(objR, propR, valR);
+                }
+                break;
+            }
+            case "ConditionalExpression": {
+                const elseL = `__cond_else_${this.currentAddress()}`, endL = `__cond_end_${this.currentAddress()}`;
+                const testR = (targetReg === this.getTempReg(0)) ? this.getTempReg(1) : this.getTempReg(0);
+                this.compileExpression(node.test, testR);
+                this.emitJz(testR, elseL);
+                this.compileExpression(node.consequent, targetReg);
+                this.emitJmp(endL);
+                this.setLabel(elseL);
+                this.compileExpression(node.alternate, targetReg);
+                this.setLabel(endL);
+                break;
+            }
+            case "MemberExpression":
+                this.compileMemberExpression(node, targetReg);
+                break;
+            case "CallExpression":
+                this.compileCallExpression(node, targetReg);
+                break;
+            case "NewExpression": {
+                for (let i = 0; i < node.arguments.length; i++) {
+                    const argR = this.getTempReg(1);
+                    this.compileExpression(node.arguments[i], argR);
+                    this.emitPush(argR);
+                }
+                const conR = this.getTempReg(0);
+                this.compileExpression(node.callee, conR);
+                this.emitNew(targetReg, conR, node.arguments.length);
+                break;
+            }
+            case "ArrayExpression": {
+                // Build array in a fresh var-slot register so that sub-expression
+                // compilation (which reuses getTempReg slots for inner calls) cannot
+                // overwrite the array reference.
+                const arrVarSlot = this.nextVarSlot++ % 256; // guaranteed unique var slot
+                const arrNR = this.getTempReg(32); // "Array" string (high temp, safe)
+                const arrCR = this.getTempReg(33); // Array constructor ref
+                const pushNR = this.getTempReg(34); // "push" string — set once before loop
+                const callTR = this.getTempReg(35); // discard return of push()
+                this.emitNewStr(arrNR, "Array");
+                this.emitGetGlobal(arrCR, arrNR);
+                this.emitNew(arrVarSlot, arrCR, 0); // array lives in stable var slot
+                this.emitNewStr(pushNR, "push"); // set once before loop
+                for (let i = 0; i < node.elements.length; i++) {
+                    if (!node.elements[i])
+                        continue;
+                    // Compile element into a fresh temp — must not be arrVarSlot
+                    const elTR = this.getTempReg(36);
+                    this.compileExpression(node.elements[i], elTR);
+                    this.emitPush(elTR);
+                    // Re-emit pushNR in case element sub-expression clobbered it
+                    this.emitNewStr(pushNR, "push");
+                    this.emitCallMethod(callTR, arrVarSlot, pushNR, 1);
+                }
+                if (targetReg !== arrVarSlot)
+                    this.emitMovReg(targetReg, arrVarSlot);
+                break;
+            }
+            case "ObjectExpression": {
+                // Use fresh var-slot for the object so sub-expressions don't clobber it
+                const objVarSlot = this.nextVarSlot++ % 256;
+                const objCR = this.getTempReg(40);
+                this.emitNewStr(this.getTempReg(41), "Object");
+                this.emitGetGlobal(objCR, this.getTempReg(41));
+                this.emitNew(objVarSlot, objCR, 0);
+                for (const prop of node.properties) {
+                    if (prop.type !== "ObjectProperty" && prop.type !== "Property")
+                        throw new KrakBailError("spread");
+                    const keyName = prop.key.name ?? prop.key.value;
+                    // propR must survive the compileExpression call, so use stable high regs
+                    const propR = this.getTempReg(42);
+                    const valR = this.getTempReg(43);
+                    this.emitNewStr(propR, String(keyName));
+                    this.compileExpression(prop.value, valR);
+                    // Re-emit propR key in case sub-expression smashed it
+                    this.emitNewStr(propR, String(keyName));
+                    this.emitSetProp(objVarSlot, propR, valR);
+                }
+                if (targetReg !== objVarSlot)
+                    this.emitMovReg(targetReg, objVarSlot);
+                break;
+            }
+            case "ArrowFunctionExpression":
+            case "FunctionExpression": {
+                const labelName = `anon_${this.currentAddress()}`;
+                const startL = `__func_${labelName}`, endL = `__func_end_${labelName}`;
+                this.emitJmp(endL);
+                this.setLabel(startL);
+                const savedVars = this.variables, savedNext = this.nextVarSlot;
+                this.variables = Object.assign({}, this.variables);
+                this.allocVar("this");
+                for (const p of node.params)
+                    this.allocVar(p.name);
+                const thisR = this.getVarReg("this");
+                this.emitPop(thisR);
+                for (let p = node.params.length - 1; p >= 0; p--) {
+                    const paramR = this.getVarReg(node.params[p].name);
+                    this.emitPop(paramR);
+                }
+                if (node.body.type === "BlockStatement") {
+                    this.compileStatement(node.body);
+                    this.emitMovInt(0, 0);
+                    this.emitRet();
+                }
+                else {
+                    this.compileExpression(node.body, 0);
+                    this.emitRet();
+                }
+                this.variables = savedVars;
+                this.nextVarSlot = savedNext;
+                this.setLabel(endL);
+                this.emit([this.opcodes["FUNC"]]);
+                this.pendingJumps.push({ type: "FUNC", address: this.currentAddress(), label: startL });
+                this.emit(this.encodeArgs("FUNC", { d: targetReg, a: 0, k: 0, n: node.params.length }));
+                break;
+            }
+            case "SequenceExpression":
+                for (const expr of node.expressions)
+                    this.compileExpression(expr, targetReg);
+                break;
+            case "TemplateLiteral":
+                if (node.quasis.length === 1 && node.expressions.length === 0) {
+                    this.emitNewStr(targetReg, node.quasis[0].value.cooked);
+                }
+                else {
+                    this.emitNewStr(targetReg, node.quasis[0].value.cooked);
+                    for (let i = 0; i < node.expressions.length; i++) {
+                        this.emitPush(targetReg);
+                        const exprR = this.getTempReg(0);
+                        this.compileExpression(node.expressions[i], exprR);
+                        this.emitPop(targetReg);
+                        this.emitBinaryOp("ADD", targetReg, exprR);
+                        const nextQ = node.quasis[i + 1]?.value.cooked ?? "";
+                        if (nextQ.length > 0) {
+                            this.emitPush(targetReg);
+                            this.emitNewStr(this.getTempReg(0), nextQ);
+                            this.emitPop(targetReg);
+                            this.emitBinaryOp("ADD", targetReg, this.getTempReg(0));
+                        }
+                    }
+                }
+                break;
+            case "ThisExpression":
+                if (this.variables["this"] !== undefined)
+                    this.emitMovReg(targetReg, this.getVarReg("this"));
+                else
+                    this.emitMovInt(targetReg, 0);
+                break;
+            default:
+                throw new KrakBailError("unsupported expression: " + node.type);
+        }
+    }
+    // ── compileStatement ──────────────────────────────────────────────────────
+    compileStatement(node) {
+        switch (node.type) {
+            case "VariableDeclaration":
+                for (const decl of node.declarations) {
+                    if (decl.id.type === "Identifier") {
+                        const reg = this.allocVar(decl.id.name) % 256;
+                        if (decl.init)
+                            this.compileExpression(decl.init, reg);
+                        else
+                            this.emitMovInt(reg, 0);
+                    }
+                    else if (decl.id.type === "ArrayPattern") {
+                        // const [a, b, c] = expr  → tmp = expr; a = tmp[0]; b = tmp[1]; ...
+                        const tmpR = this.getTempReg(10);
+                        if (decl.init)
+                            this.compileExpression(decl.init, tmpR);
+                        else
+                            this.emitMovInt(tmpR, 0);
+                        for (let _ai = 0; _ai < decl.id.elements.length; _ai++) {
+                            const elem = decl.id.elements[_ai];
+                            if (!elem)
+                                continue; // sparse hole: skip
+                            if (elem.type !== "Identifier")
+                                throw new KrakBailError("nested destructuring");
+                            const idxNumR = this.getTempReg(11);
+                            const idxStrR = this.getTempReg(12);
+                            const elR = this.allocVar(elem.name) % 256;
+                            this.emitMovInt(idxNumR, _ai);
+                            this.emitFromNum(idxStrR, idxNumR); // convert int→JS value for GPRP
+                            this.emitGetProp(elR, tmpR, idxStrR);
+                        }
+                    }
+                    else if (decl.id.type === "ObjectPattern") {
+                        // const { a, b } = expr  →  tmp = expr; a = tmp.a; b = tmp.b;
+                        const tmpR = this.getTempReg(10);
+                        if (decl.init)
+                            this.compileExpression(decl.init, tmpR);
+                        else
+                            this.emitMovInt(tmpR, 0);
+                        for (const prop of decl.id.properties) {
+                            if (prop.type !== "ObjectProperty")
+                                throw new KrakBailError("rest destructuring");
+                            const keyName = prop.key.name ?? prop.key.value;
+                            const valNode = prop.value;
+                            if (valNode.type !== "Identifier")
+                                throw new KrakBailError("nested obj destructuring");
+                            const propR = this.allocVar(valNode.name) % 256;
+                            const kR = this.getTempReg(11);
+                            this.emitNewStr(kR, String(keyName));
+                            this.emitGetProp(propR, tmpR, kR);
+                        }
+                    }
+                    else {
+                        throw new KrakBailError("destructuring: " + decl.id.type);
+                    }
+                }
+                break;
+            case "ExpressionStatement":
+                this.compileExpression(node.expression, this.getTempReg(3));
+                break;
+            case "IfStatement": {
+                const endL = `__if_end_${this.currentAddress()}`;
+                const elseL = `__if_else_${this.currentAddress()}`;
+                if (node.alternate) {
+                    if (!this.tryCompileConditionExit(node.test, elseL)) {
+                        this.compileExpression(node.test, 254);
+                        this.emitJz(254, elseL);
+                    }
+                    this.compileStatement(node.consequent);
+                    this.emitJmp(endL);
+                    this.setLabel(elseL);
+                    this.compileStatement(node.alternate);
+                }
+                else {
+                    if (!this.tryCompileConditionExit(node.test, endL)) {
+                        this.compileExpression(node.test, 254);
+                        this.emitJz(254, endL);
+                    }
+                    this.compileStatement(node.consequent);
+                }
+                this.setLabel(endL);
+                break;
+            }
+            case "WhileStatement": {
+                const loopStart = `__while_start_${this.currentAddress()}`;
+                const loopEnd = `__while_end_${this.currentAddress()}`;
+                this.setLabel(loopStart);
+                if (!this.tryCompileConditionExit(node.test, loopEnd)) {
+                    this.compileExpression(node.test, 254);
+                    this.emitJz(254, loopEnd);
+                }
+                this.loopStack.push({ continueLabel: loopStart, breakLabel: loopEnd });
+                this.compileStatement(node.body);
+                this.loopStack.pop();
+                this.emitJmp(loopStart);
+                this.setLabel(loopEnd);
+                break;
+            }
+            case "DoWhileStatement": {
+                const doStart = `__do_start_${this.currentAddress()}`;
+                const doEnd = `__do_end_${this.currentAddress()}`;
+                const doCond = `__do_cond_${this.currentAddress()}`;
+                this.setLabel(doStart);
+                this.loopStack.push({ continueLabel: doCond, breakLabel: doEnd });
+                this.compileStatement(node.body);
+                this.loopStack.pop();
+                this.setLabel(doCond);
+                this.compileExpression(node.test, 254);
+                this.emitJnz(254, doStart);
+                this.setLabel(doEnd);
+                break;
+            }
+            case "ForStatement": {
+                const forStart = `__for_start_${this.currentAddress()}`;
+                const forEnd = `__for_end_${this.currentAddress()}`;
+                const forUpdate = `__for_update_${this.currentAddress()}`;
+                if (node.init) {
+                    if (node.init.type === "VariableDeclaration")
+                        this.compileStatement(node.init);
+                    else
+                        this.compileExpression(node.init, this.getTempReg(3));
+                }
+                this.setLabel(forStart);
+                if (node.test) {
+                    if (!this.tryCompileConditionExit(node.test, forEnd)) {
+                        this.compileExpression(node.test, 254);
+                        this.emitJz(254, forEnd);
+                    }
+                }
+                this.loopStack.push({ continueLabel: forUpdate, breakLabel: forEnd });
+                this.compileStatement(node.body);
+                this.loopStack.pop();
+                this.setLabel(forUpdate);
+                if (node.update)
+                    this.compileExpression(node.update, this.getTempReg(3));
+                this.emitJmp(forStart);
+                this.setLabel(forEnd);
+                break;
+            }
+            case "BlockStatement":
+                for (const s of node.body)
+                    this.compileStatement(s);
+                break;
+            case "FunctionDeclaration": {
+                if (this.functions[node.id.name])
+                    break;
+                const funcVarReg = this.allocVar(node.id.name) % 256;
+                this.compileExpression({
+                    type: "FunctionExpression",
+                    params: node.params,
+                    body: node.body,
+                }, funcVarReg);
+                break;
+            }
+            case "ReturnStatement": {
+                const cbCtx = this.inlineCallbackStack.length > 0
+                    ? this.inlineCallbackStack[this.inlineCallbackStack.length - 1]
+                    : null;
+                if (cbCtx) {
+                    // Inside an inline callback — write return value into cbResReg and
+                    // jump to the callback exit label (do NOT emit RET here).
+                    if (node.argument)
+                        this.compileExpression(node.argument, cbCtx.cbResReg);
+                    else
+                        this.emitMovInt(cbCtx.cbResReg, 0);
+                    this.emitJmp(cbCtx.returnLabel);
+                }
+                else {
+                    if (node.argument)
+                        this.compileExpression(node.argument, 0);
+                    else
+                        this.emitMovInt(0, 0);
+                    this.emitRet();
+                }
+                break;
+            }
+            case "BreakStatement":
+                if (!this.loopStack.length)
+                    throw new KrakBailError("break outside loop");
+                this.emitJmp(this.loopStack[this.loopStack.length - 1].breakLabel);
+                break;
+            case "ContinueStatement":
+                if (!this.loopStack.length)
+                    throw new KrakBailError("continue outside loop");
+                {
+                    const cl = this.loopStack[this.loopStack.length - 1].continueLabel;
+                    if (!cl)
+                        throw new KrakBailError("continue in switch");
+                    this.emitJmp(cl);
+                }
+                break;
+            case "EmptyStatement":
+                break;
+            case "ThrowStatement": {
+                const errR = this.getTempReg(0);
+                this.compileExpression(node.argument, errR);
+                this.emitPush(errR);
+                this.emitNewStr(this.getTempReg(1), "__krak_throw");
+                this.emitGetGlobal(this.getTempReg(2), this.getTempReg(1));
+                this.emitCallReg(this.getTempReg(3), this.getTempReg(2), 1);
+                break;
+            }
+            case "TryStatement":
+                this.compileStatement(node.block);
+                break;
+            case "SwitchStatement": {
+                const discR = this.getTempReg(14);
+                this.compileExpression(node.discriminant, discR);
+                const switchEndL = `__switch_end_${this.currentAddress()}`;
+                const caseLabels = [];
+                let defaultLabel = null;
+                for (let i = 0; i < node.cases.length; i++) {
+                    const c = node.cases[i];
+                    const cLabel = `__switch_case_${this.currentAddress()}_${i}`;
+                    caseLabels.push(cLabel);
+                    if (c.test === null) {
+                        defaultLabel = cLabel;
+                    }
+                    else {
+                        const testR = this.getTempReg(15);
+                        this.compileExpression(c.test, testR);
+                        this.emit([this.opcodes["CMP"]]);
+                        this.emit(this.encodeArgs("CMP", { a: discR, b: testR }));
+                        this.emitJz(255, cLabel);
+                    }
+                }
+                if (defaultLabel)
+                    this.emitJmp(defaultLabel);
+                else
+                    this.emitJmp(switchEndL);
+                this.loopStack.push({ breakLabel: switchEndL, continueLabel: null });
+                for (let i = 0; i < node.cases.length; i++) {
+                    this.setLabel(caseLabels[i]);
+                    for (const stmt of node.cases[i].consequent)
+                        this.compileStatement(stmt);
+                }
+                this.loopStack.pop();
+                this.setLabel(switchEndL);
+                break;
+            }
+            case "ForOfStatement": {
+                // for (const x of iterable) { body }
+                // Lowered to: idx=0; len=arr.length; while(idx<len){ x=arr[idx]; body; idx++ }
+                // Covers arrays and array-likes only. True iterators bail.
+                if (node.left.type !== "VariableDeclaration")
+                    throw new KrakBailError("for-of non-var");
+                const foDecl = node.left.declarations[0];
+                if (!foDecl || foDecl.id.type !== "Identifier")
+                    throw new KrakBailError("for-of destructuring");
+                const foVarReg = this.allocVar(foDecl.id.name) % 256;
+                const foArrR = this.getTempReg(6);
+                const foIdxR = this.allocVar(`__fo_idx_${this.currentAddress()}`) % 256;
+                const foLenR = this.getTempReg(7);
+                const foLenKey = this.getTempReg(8);
+                const foIdxStrR = this.getTempReg(13); // idx converted to JS value for GPRP
+                this.compileExpression(node.right, foArrR);
+                this.emitMovInt(foIdxR, 0);
+                this.emitNewStr(foLenKey, "length");
+                this.emitGetProp(foLenR, foArrR, foLenKey);
+                this.emitToNum(foLenR, foLenR); // ensure numeric
+                const foStart = `__fo_start_${this.currentAddress()}`;
+                const foEnd = `__fo_end_${this.currentAddress()}`;
+                this.setLabel(foStart);
+                // CMP reg[255]: 0=equal, 1=a>b, -1=a<b; jump if idx >= len (equal OR greater)
+                this.emit([this.opcodes["CMP"]]);
+                this.emit(this.encodeArgs("CMP", { a: foIdxR, b: foLenR }));
+                this.emitJgt(foEnd); // idx > len  (reg[255] = 1)
+                this.emitJz(255, foEnd); // idx == len (reg[255] = 0)
+                // x = arr[idx]  (GPRP needs JS-value key, so convert int via FNUM)
+                this.emitFromNum(foIdxStrR, foIdxR);
+                this.emitGetProp(foVarReg, foArrR, foIdxStrR);
+                this.loopStack.push({ continueLabel: foStart, breakLabel: foEnd });
+                this.compileStatement(node.body);
+                this.loopStack.pop();
+                this.emit([this.opcodes["INC"]]);
+                this.emit(this.encodeArgs("INC", { r: foIdxR }));
+                this.emitJmp(foStart);
+                this.setLabel(foEnd);
+                break;
+            }
+            case "ForInStatement": {
+                // for (const k in obj) { body } — lowered to Object.keys(obj) array loop
+                if (node.left.type !== "VariableDeclaration")
+                    throw new KrakBailError("for-in non-var");
+                const fiDecl = node.left.declarations[0];
+                if (!fiDecl || fiDecl.id.type !== "Identifier")
+                    throw new KrakBailError("for-in destructuring");
+                const fiVarReg = this.allocVar(fiDecl.id.name) % 256;
+                const fiKeysR = this.getTempReg(6);
+                const fiObjNR = this.getTempReg(9); // name reg for "Object" global
+                const fiObjR = this.getTempReg(5); // the right-hand object
+                const fiIdxR = this.allocVar(`__fi_idx_${this.currentAddress()}`) % 256;
+                const fiLenR = this.getTempReg(7);
+                const fiLenKeyR = this.getTempReg(8);
+                const fiIdxStrR = this.getTempReg(13);
+                // fiKeysR = Object.keys(right)
+                this.emitNewStr(fiObjNR, "Object");
+                this.emitGetGlobal(fiObjR, fiObjNR); // fiObjR = globalThis.Object
+                this.compileExpression(node.right, fiObjNR);
+                this.emitPush(fiObjNR);
+                this.emitNewStr(fiLenKeyR, "keys");
+                this.emitCallMethod(fiKeysR, fiObjR, fiLenKeyR, 1);
+                this.emitMovInt(fiIdxR, 0);
+                this.emitNewStr(fiLenKeyR, "length");
+                this.emitGetProp(fiLenR, fiKeysR, fiLenKeyR);
+                this.emitToNum(fiLenR, fiLenR);
+                const fiStart = `__fi_start_${this.currentAddress()}`;
+                const fiEnd = `__fi_end_${this.currentAddress()}`;
+                this.setLabel(fiStart);
+                this.emit([this.opcodes["CMP"]]);
+                this.emit(this.encodeArgs("CMP", { a: fiIdxR, b: fiLenR }));
+                this.emitJgt(fiEnd);
+                this.emitJz(255, fiEnd);
+                this.emitFromNum(fiIdxStrR, fiIdxR);
+                this.emitGetProp(fiVarReg, fiKeysR, fiIdxStrR);
+                this.loopStack.push({ continueLabel: fiStart, breakLabel: fiEnd });
+                this.compileStatement(node.body);
+                this.loopStack.pop();
+                this.emit([this.opcodes["INC"]]);
+                this.emit(this.encodeArgs("INC", { r: fiIdxR }));
+                this.emitJmp(fiStart);
+                this.setLabel(fiEnd);
+                break;
+            }
+            default:
+                throw new KrakBailError("unsupported statement: " + node.type);
+        }
+    }
+    // ── resolveJumps ─────────────────────────────────────────────────────────
+    resolveJumps() {
+        const { lcgMul, lcgInc, initialKey } = this.config;
+        for (const jump of this.pendingJumps) {
+            const targetAddr = this.labels[jump.label];
+            if (targetAddr === undefined)
+                throw new KrakBailError("Unknown label: " + jump.label);
+            const resetKey = computeKeyAtAddress(initialKey, targetAddr, lcgMul, lcgInc);
+            const layout = this.layouts[jump.type] ?? [];
+            let addr = jump.address;
+            for (const argDef of layout) {
+                if (["t", "addr", "a"].includes(argDef.name)) {
+                    this.bytecodeArr[addr] = targetAddr & 0xFF;
+                    this.bytecodeArr[addr + 1] = (targetAddr >> 8) & 0xFF;
+                    this.bytecodeArr[addr + 2] = (targetAddr >> 16) & 0xFF;
+                    this.bytecodeArr[addr + 3] = (targetAddr >> 24) & 0xFF;
+                    addr += 4;
+                }
+                else if (["k", "key"].includes(argDef.name)) {
+                    // k is now a 32-bit LCG checkpoint — patch 4 bytes little-endian
+                    this.bytecodeArr[addr] = resetKey & 0xFF;
+                    this.bytecodeArr[addr + 1] = (resetKey >> 8) & 0xFF;
+                    this.bytecodeArr[addr + 2] = (resetKey >> 16) & 0xFF;
+                    this.bytecodeArr[addr + 3] = (resetKey >> 24) & 0xFF;
+                    addr += 4;
+                }
+                else if (["r", "reg"].includes(argDef.name)) {
+                    addr += 1;
+                }
+                else if (argDef.type === "INT") {
+                    addr += 4;
+                }
+                else {
+                    addr += 1;
+                }
+            }
+        }
+    }
+    // ── encrypt ───────────────────────────────────────────────────────────────
+    encryptBytecode() {
+        const { initialKey, lcgMul, lcgInc } = this.config;
+        const encrypted = [];
+        let key = initialKey >>> 0;
+        for (const b of this.bytecodeArr) {
+            encrypted.push((b ^ (key >>> 24)) & 0xFF);
+            key = ((Math.imul(key, lcgMul) + lcgInc) | 0) >>> 0;
+        }
+        return encrypted;
+    }
+    // ── compile: top-level entry ──────────────────────────────────────────────
+    /**
+     * Compile a Babel Program AST body (array of statements) as the main script.
+     * All function declarations in the body are pre-collected and emitted before main.
+     */
+    compileProgram(stmts) {
+        // Pre-collect top-level vars + functions
+        for (const node of stmts) {
+            if (node.type === "VariableDeclaration") {
+                for (const d of node.declarations) {
+                    if (d.id.type === "Identifier")
+                        this.allocVar(d.id.name);
+                }
+            }
+        }
+        this.collectFunctions(stmts);
+        const globalVars = Object.assign({}, this.variables);
+        const globalNextSlot = this.nextVarSlot;
+        const hasFunctions = Object.keys(this.functions).length > 0;
+        const mainLabel = "__main_start";
+        if (hasFunctions)
+            this.emitJmp(mainLabel);
+        // Emit functions
+        let runningSlot = globalNextSlot;
+        for (const [funcName, funcInfo] of Object.entries(this.functions)) {
+            this.setLabel(`__func_${funcName}`);
+            const savedVars = this.variables, savedNext = this.nextVarSlot;
+            this.variables = Object.assign({}, globalVars);
+            this.nextVarSlot = runningSlot;
+            this.variables["this"] = this.nextVarSlot++;
+            for (const p of funcInfo.params)
+                this.variables[p] = this.nextVarSlot++;
+            const thisR = this.getVarReg("this");
+            this.emitPop(thisR);
+            for (let p = funcInfo.params.length - 1; p >= 0; p--) {
+                this.emitPop(this.getVarReg(funcInfo.params[p]));
+            }
+            this.compileStatement(funcInfo.body);
+            this.emitMovInt(0, 0);
+            this.emitRet();
+            runningSlot = this.nextVarSlot;
+            this.variables = savedVars;
+            this.nextVarSlot = savedNext;
+        }
+        if (hasFunctions)
+            this.setLabel(mainLabel);
+        for (const stmt of stmts)
+            this.compileStatement(stmt);
+        this.emit([this.opcodes["HALT"]]);
+        this.resolveJumps();
+        const encrypted = this.encryptBytecode();
+        const base64 = Buffer.from(encrypted).toString("base64");
+        return { bytecode: encrypted, base64 };
+    }
+    /**
+     * Compile a single Babel FunctionDeclaration node.
+     * Used by transform-vm.ts to virtualise individual functions.
+     */
+    compileFunction(fnNode) {
+        if (!fnNode.id)
+            throw new KrakBailError("anonymous function");
+        // Pre-collect params + body vars
+        for (const p of fnNode.params) {
+            if (p.type !== "Identifier")
+                throw new KrakBailError("param-pattern");
+            this.allocVar(p.name);
+        }
+        this.collectFunctions(fnNode.body.body);
+        const mainLabel = "__main_start";
+        const globalVars = Object.assign({}, this.variables);
+        const hasFunctions = Object.keys(this.functions).length > 0;
+        if (hasFunctions)
+            this.emitJmp(mainLabel);
+        // Sub-functions declared inside this function
+        let runningSlot = this.nextVarSlot;
+        for (const [fname, finfo] of Object.entries(this.functions)) {
+            this.setLabel(`__func_${fname}`);
+            const savedVars = this.variables, savedNext = this.nextVarSlot;
+            this.variables = Object.assign({}, globalVars);
+            this.nextVarSlot = runningSlot;
+            this.variables["this"] = this.nextVarSlot++;
+            for (const p of finfo.params)
+                this.variables[p] = this.nextVarSlot++;
+            const thisR = this.getVarReg("this");
+            this.emitPop(thisR);
+            for (let p = finfo.params.length - 1; p >= 0; p--) {
+                this.emitPop(this.getVarReg(finfo.params[p]));
+            }
+            this.compileStatement(finfo.body);
+            this.emitMovInt(0, 0);
+            this.emitRet();
+            runningSlot = this.nextVarSlot;
+            this.variables = savedVars;
+            this.nextVarSlot = savedNext;
+        }
+        if (hasFunctions)
+            this.setLabel(mainLabel);
+        // Pop params in reverse order (caller pushed them in order)
+        const thisR2 = this.allocVar("this") % 256;
+        this.emitPop(thisR2);
+        for (let p = fnNode.params.length - 1; p >= 0; p--) {
+            this.emitPop(this.getVarReg(fnNode.params[p].name));
+        }
+        this.compileStatement(fnNode.body);
+        this.emitMovInt(0, 0);
+        this.emitRet();
+        this.resolveJumps();
+        const encrypted = this.encryptBytecode();
+        const base64 = Buffer.from(encrypted).toString("base64");
+        return { bytecode: encrypted, base64 };
+    }
+    collectFunctions(stmts) {
+        for (const node of stmts) {
+            if (!node)
+                continue;
+            if (node.type === "FunctionDeclaration") {
+                this.allocVar(node.id.name);
+                this.functions[node.id.name] = {
+                    params: node.params.map((p) => p.name),
+                    body: node.body,
+                };
+                this.collectFunctions(node.body.body);
+            }
+            else if (node.type === "BlockStatement") {
+                this.collectFunctions(node.body);
+            }
+        }
+    }
+}
+exports.KrakCompiler = KrakCompiler;