jsguardian 1.2.0

package/krak-vm-core.js

@@ -0,0 +1,892 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HANDLER_MAP = exports.OPCODE_NAMES = void 0;
+exports.generateVmNameMap = generateVmNameMap;
+exports.applyVmNameMap = applyVmNameMap;
+exports.generateVm = generateVm;
+// ── OPCODE NAMES ─────────────────────────────────────────────────────────────
+exports.OPCODE_NAMES = [
+    "MOV", "MOVR", "ADD", "SUB", "MUL", "DIV", "MOD",
+    "NOR", "XOR", "AND", "OR", "NOT", "SHL", "SHR",
+    "LOAD", "STORE", "CMP", "INC", "DEC", "JMP", "JZ",
+    "JNZ", "JLT", "JGT", "PUSH", "POP", "CALLI", "CALLE", "RET",
+    "OUT", "HALT", "STR", "GGLO", "GPRP", "SPRP", "METH",
+    "TNUM", "FNUM", "CADR", "NEW", "IOF", "CREGI", "CREGE", "TYP",
+    "BOOL", "FUNC", "SAR", "EVAL",
+];
+exports.HANDLER_MAP = {
+    mov: "MOV", movr: "MOVR", add: "ADD", sub: "SUB", mul: "MUL", div: "DIV", mod: "MOD",
+    nor: "NOR", xor: "XOR", and: "AND", or: "OR", not: "NOT", shl: "SHL", shr: "SHR",
+    load: "LOAD", store: "STORE", cmp: "CMP", inc: "INC", dec: "DEC",
+    jmp: "JMP", jz: "JZ", jnz: "JNZ", jlt: "JLT", jgt: "JGT",
+    push: "PUSH", pop: "POP", calli: "CALLI", calle: "CALLE", ret: "RET",
+    out: "OUT", halt: "HALT", str: "STR", getGlobal: "GGLO",
+    getProp: "GPRP", setProp: "SPRP", callMethod: "METH",
+    toNum: "TNUM", fromNum: "FNUM", callAddr: "CADR", newObject: "NEW",
+    instanceOf: "IOF", callRegInternal: "CREGI", callRegExternal: "CREGE",
+    typeOf: "TYP", toBool: "BOOL", newFunc: "FUNC", shiftRightArith: "SAR", _eval: "EVAL",
+};
+// ── HANDLER SOURCES (template) ────────────────────────────────────────────────
+// Each handler is a string with @FETCH_START/@FETCH_END markers.
+// The generator shuffles arg-fetch lines within each block.
+const HANDLER_SRCS = {
+    mov: `function mov() {
+    //@FETCH_START
+    var r = readByte();
+    var v = readInt32();
+    //@FETCH_END
+    ctx.reg[r] = v;
+  }`,
+    movr: `function movr() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[s];
+  }`,
+    add: `function add() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] + ctx.reg[s];
+  }`,
+    sub: `function sub() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] - ctx.reg[s];
+  }`,
+    mul: `function mul() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] * ctx.reg[s];
+  }`,
+    div: `function div() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] / ctx.reg[s];
+  }`,
+    mod: `function mod() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] % ctx.reg[s];
+  }`,
+    nor: `function nor() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ~(ctx.reg[d] | ctx.reg[s]);
+  }`,
+    xor: `function xor() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] ^ ctx.reg[s];
+  }`,
+    and: `function and() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] & ctx.reg[s];
+  }`,
+    or: `function or() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] | ctx.reg[s];
+  }`,
+    not: `function not() {
+    //@FETCH_START
+    var r = readByte();
+    //@FETCH_END
+    ctx.reg[r] = ~ctx.reg[r];
+  }`,
+    shl: `function shl() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] << ctx.reg[s];
+  }`,
+    shr: `function shr() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] >>> ctx.reg[s];
+  }`,
+    shiftRightArith: `function shiftRightArith() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[d] >> ctx.reg[s];
+  }`,
+    load: `function load() {
+    //@FETCH_START
+    var d = readByte();
+    var a = readByte();
+    //@FETCH_END
+    if (ctx.reg[a] < 0 || ctx.reg[a] >= 65536) crash(ctx);
+    ctx.reg[d] = ctx.heap[ctx.reg[a] & 0xFFFF];
+  }`,
+    store: `function store() {
+    //@FETCH_START
+    var a = readByte();
+    var s = readByte();
+    //@FETCH_END
+    if (ctx.reg[a] < 0 || ctx.reg[a] >= 65536) crash(ctx);
+    ctx.heap[ctx.reg[a] & 0xFFFF] = ctx.reg[s];
+  }`,
+    cmp: `function cmp() {
+    //@FETCH_START
+    var a = readByte();
+    var b = readByte();
+    //@FETCH_END
+    var v1 = ctx.reg[a]; var v2 = ctx.reg[b];
+    if (v1 === v2) ctx.reg[255] = 0;
+    else if (v1 < v2) ctx.reg[255] = -1;
+    else ctx.reg[255] = 1;
+  }`,
+    inc: `function inc() {
+    //@FETCH_START
+    var r = readByte();
+    //@FETCH_END
+    ctx.reg[r]++;
+  }`,
+    dec: `function dec() {
+    //@FETCH_START
+    var r = readByte();
+    //@FETCH_END
+    ctx.reg[r]--;
+  }`,
+    jmp: `function jmp() {
+    //@FETCH_START
+    var k = readInt32();
+    var t = readInt32();
+    //@FETCH_END
+    if (t < 0 || t >= ctx.mem.length) crash(ctx);
+    ctx.xk = k>>>0; ctx.ip = t;
+  }`,
+    jz: `function jz() {
+    //@FETCH_START
+    var r = readByte();
+    var k = readInt32();
+    var t = readInt32();
+    //@FETCH_END
+    if (t < 0 || t >= ctx.mem.length) crash(ctx);
+    if (!ctx.reg[r]) { ctx.ip = t; ctx.xk = k>>>0; }
+  }`,
+    jnz: `function jnz() {
+    //@FETCH_START
+    var r = readByte();
+    var k = readInt32();
+    var t = readInt32();
+    //@FETCH_END
+    if (t < 0 || t >= ctx.mem.length) crash(ctx);
+    if (ctx.reg[r]) { ctx.ip = t; ctx.xk = k>>>0; }
+  }`,
+    jlt: `function jlt() {
+    //@FETCH_START
+    var k = readInt32();
+    var t = readInt32();
+    //@FETCH_END
+    if (t < 0 || t >= ctx.mem.length) crash(ctx);
+    if (ctx.reg[255] < 0) { ctx.ip = t; ctx.xk = k>>>0; }
+  }`,
+    jgt: `function jgt() {
+    //@FETCH_START
+    var k = readInt32();
+    var t = readInt32();
+    //@FETCH_END
+    if (t < 0 || t >= ctx.mem.length) crash(ctx);
+    if (ctx.reg[255] > 0) { ctx.ip = t; ctx.xk = k>>>0; }
+  }`,
+    // Note: jz/jnz/jlt/jgt/jmp now use INT for k (32-bit LCG checkpoint).
+    push: `function push() {
+    //@FETCH_START
+    var r = readByte();
+    //@FETCH_END
+    if (ctx.stack.length >= MAX_STACK) crash(ctx);
+    ctx.stack.push(ctx.reg[r]);
+  }`,
+    pop: `function pop() {
+    //@FETCH_START
+    var r = readByte();
+    //@FETCH_END
+    var v = ctx.stack.pop(); ctx.reg[r] = (v !== undefined) ? v : 0;
+  }`,
+    calli: `function calli() {
+    //@FETCH_START
+    var o = readByte();
+    var c = readByte();
+    //@FETCH_END
+    var fn = ctx.reg[o]; var args = new Array(c);
+    for (var i = c - 1; i >= 0; i--) args[i] = ctx.stack.pop();
+    var addr = (fn >> 8) & 0xFFFFFF; var key = fn & 0xFF;
+    for (var i = 0; i < args.length; i++) ctx.stack.push(args[i]);
+    ctx.stack.push(null);
+    if (ctx.frames.length >= MAX_FRAMES) crash(ctx);
+    ctx.frames.push(ctx.ip, ctx.xk); ctx.ip = addr; ctx.xk = key;
+  }`,
+    calle: `function calle() {
+    //@FETCH_START
+    var o = readByte();
+    var c = readByte();
+    //@FETCH_END
+    var fn = ctx.reg[o]; var args = new Array(c);
+    for (var i = c - 1; i >= 0; i--) args[i] = ctx.stack.pop();
+    ctx.reg[0] = (typeof fn === 'function') ? fn.apply(null, args) : undefined;
+  }`,
+    ret: `function ret() {
+    var len = ctx.frames.length;
+    if (len >= 2) { ctx.xk = ctx.frames[len-1]; ctx.ip = ctx.frames[len-2]; ctx.frames.length = len-2; }
+    else { ctx.ip = ctx.mem.length + 1; }
+  }`,
+    out: `function out() {
+    //@FETCH_START
+    var r = readByte();
+    //@FETCH_END
+    console.log(ctx.reg[r]);
+  }`,
+    halt: `function halt() { ctx.ip = ctx.mem.length + 1; }`,
+    str: `function str() {
+    //@FETCH_START
+    var d = readByte();
+    //@FETCH_END
+    ctx.reg[d] = readStr();
+  }`,
+    getGlobal: `function getGlobal() {
+    //@FETCH_START
+    var d = readByte();
+    var n = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.env[ctx.reg[n]];
+  }`,
+    getProp: `function getProp() {
+    //@FETCH_START
+    var d = readByte();
+    var o = readByte();
+    var p = readByte();
+    //@FETCH_END
+    var obj = ctx.reg[o]; var key = ctx.reg[p];
+    ctx.reg[d] = (obj == null) ? undefined : obj[key];
+  }`,
+    setProp: `function setProp() {
+    //@FETCH_START
+    var o = readByte();
+    var p = readByte();
+    var v = readByte();
+    //@FETCH_END
+    var obj = ctx.reg[o]; if (obj != null) obj[ctx.reg[p]] = ctx.reg[v];
+  }`,
+    callMethod: `function callMethod() {
+    //@FETCH_START
+    var d = readByte();
+    var o = readByte();
+    var m = readByte();
+    var c = readByte();
+    //@FETCH_END
+    var obj = ctx.reg[o]; var name = ctx.reg[m];
+    var args = new Array(c); for (var i = c-1; i>=0; i--) args[i] = ctx.stack.pop();
+    var mfn = obj != null ? obj[name] : undefined;
+    ctx.reg[d] = (typeof mfn === 'function') ? mfn.apply(obj, args) : undefined;
+  }`,
+    toNum: `function toNum() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = Number(ctx.reg[s]);
+  }`,
+    fromNum: `function fromNum() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ctx.reg[s];
+  }`,
+    callAddr: `function callAddr() {
+    //@FETCH_START
+    var k = readInt32();
+    var t = readInt32();
+    //@FETCH_END
+    if (ctx.frames.length >= MAX_FRAMES) crash(ctx);
+    if (t < 0 || t >= ctx.mem.length) crash(ctx);
+    ctx.frames.push(ctx.ip, ctx.xk); ctx.ip = t; ctx.xk = k>>>0;
+  }`,
+    newObject: `function newObject() {
+    //@FETCH_START
+    var d = readByte();
+    var c = readByte();
+    var n = readByte();
+    //@FETCH_END
+    var C = ctx.reg[c]; var args = new Array(n);
+    for (var i = n-1; i>=0; i--) args[i] = ctx.stack.pop();
+    ctx.reg[d] = new (Function.prototype.bind.apply(C, [null].concat(args)));
+  }`,
+    instanceOf: `function instanceOf() {
+    //@FETCH_START
+    var d = readByte();
+    var o = readByte();
+    var c = readByte();
+    //@FETCH_END
+    ctx.reg[d] = (ctx.reg[o] instanceof ctx.reg[c]) ? 1 : 0;
+  }`,
+    callRegInternal: `function callRegInternal() {
+    //@FETCH_START
+    var f = readByte();
+    var n = readByte();
+    //@FETCH_END
+    var fn = ctx.reg[f]; var args = new Array(n);
+    for (var i = n-1; i>=0; i--) args[i] = ctx.stack.pop();
+    var addr = (fn >> 8) & 0xFFFFFF; var key = fn & 0xFF;
+    for (var i = 0; i < args.length; i++) ctx.stack.push(args[i]);
+    ctx.stack.push(undefined);
+    if (ctx.frames.length >= MAX_FRAMES) crash(ctx);
+    ctx.frames.push(ctx.ip, ctx.xk); ctx.ip = addr; ctx.xk = key;
+  }`,
+    callRegExternal: `function callRegExternal() {
+    //@FETCH_START
+    var d = readByte();
+    var f = readByte();
+    var n = readByte();
+    //@FETCH_END
+    var fn = ctx.reg[f]; var args = new Array(n);
+    for (var i = n-1; i>=0; i--) args[i] = ctx.stack.pop();
+    ctx.reg[d] = (typeof fn === 'function') ? fn.apply(undefined, args) : undefined;
+  }`,
+    typeOf: `function typeOf() {
+    //@FETCH_START
+    var d = readByte();
+    var s = readByte();
+    //@FETCH_END
+    ctx.reg[d] = typeof ctx.reg[s];
+  }`,
+    toBool: `function toBool() {
+    //@FETCH_START
+    var d = readByte();
+    var v = readByte();
+    //@FETCH_END
+    ctx.reg[d] = v !== 0;
+  }`,
+    newFunc: `function newFunc() {
+    //@FETCH_START
+    var d = readByte();
+    var a = readInt32();
+    var k = readByte();
+    var n = readByte();
+    //@FETCH_END
+    ctx.reg[d] = ((a & 0xFFFFFF) << 8) | (k & 0xFF);
+  }`,
+    _eval: `function _eval() {
+    //@FETCH_START
+    var s = readStr();
+    //@FETCH_END
+    eval(s);
+  }`,
+};
+// ── SAFE-TO-INLINE handlers (last fetch var can be inlined) ──────────────────
+const SAFE_INLINE = new Set([
+    "mov", "movr", "add", "sub", "mul", "div", "mod", "nor", "xor", "and", "or", "shl", "shr", "sar", "inc", "dec", "push", "pop", "str",
+]);
+// ── HELPERS ───────────────────────────────────────────────────────────────────
+function fisherYates(arr, rng) {
+    const out = arr.slice();
+    for (let i = out.length - 1; i > 0; i--) {
+        const j = Math.floor(rng.next() * (i + 1));
+        const tmp = out[i];
+        out[i] = out[j];
+        out[j] = tmp;
+    }
+    return out;
+}
+function uniqueOpcodes(n, rng) {
+    const buf = [];
+    for (let i = 0; i < 256; i++)
+        buf.push(i);
+    return fisherYates(buf, rng).slice(0, n);
+}
+function randOddInt32(rng) {
+    return ((Math.floor(rng.next() * 0x7fffffff) * 2 + 1) >>> 0);
+}
+function mathScramble(val, rng) {
+    if (rng.next() < 0.5) {
+        const add = Math.floor(rng.next() * 500000);
+        return `(${val - add} + ${add})`;
+    }
+    else {
+        const sub = Math.floor(rng.next() * 500000);
+        return `(${val + sub} - ${sub})`;
+    }
+}
+function argName(line) {
+    const m = line.match(/var\s+(\w+)\s*=/);
+    return m ? m[1] : null;
+}
+function argType(line) {
+    if (line.includes("readInt32()"))
+        return "INT";
+    if (line.includes("readByte()"))
+        return "BYTE";
+    if (line.includes("readStr()"))
+        return "STRING";
+    return null;
+}
+// Shuffle the @FETCH_START...@FETCH_END block inside a handler source string.
+// Returns { shuffled source, argLayout }
+function shuffleFetchBlock(handlerName, src, rng) {
+    const lines = src.split("\n");
+    const out = [];
+    let inBlock = false;
+    let block = [];
+    const layout = [];
+    for (const line of lines) {
+        if (line.includes("@FETCH_START")) {
+            inBlock = true;
+            out.push(line);
+            block = [];
+        }
+        else if (line.includes("@FETCH_END")) {
+            inBlock = false;
+            const shuffled = fisherYates(block, rng);
+            for (const sl of shuffled) {
+                const n = argName(sl), ty = argType(sl);
+                if (n && ty)
+                    layout.push({ name: n, type: ty });
+            }
+            for (const sl of shuffled)
+                out.push(sl);
+            out.push(line);
+        }
+        else if (inBlock) {
+            block.push(line);
+        }
+        else {
+            out.push(line);
+        }
+    }
+    return { code: out.join("\n"), layout };
+}
+// Optionally inline the last fetched var into its usage site (80% probability).
+function removeMarkers(handlerName, src, rng) {
+    const lines = src.split("\n");
+    let preFetch = [], fetchLines = [], postFetch = [];
+    let state = 0;
+    for (const line of lines) {
+        const cl = line.replace(/\r$/, "");
+        if (cl.includes("@FETCH_START")) {
+            state = 1;
+        }
+        else if (cl.includes("@FETCH_END")) {
+            state = 2;
+        }
+        else if (state === 0)
+            preFetch.push(cl);
+        else if (state === 1)
+            fetchLines.push(cl);
+        else
+            postFetch.push(cl);
+    }
+    if (SAFE_INLINE.has(handlerName) && fetchLines.length > 0 && rng.next() < 0.8) {
+        const lastFetch = fetchLines[fetchLines.length - 1];
+        const m = lastFetch.match(/var\s+(\w+)\s*=\s*(read\w+\(\));/);
+        if (m) {
+            const [, varName, fetchCall] = m;
+            const regex = new RegExp(`\\b${varName}\\b`, "g");
+            const postStr = postFetch.join("\n");
+            const matches = postStr.match(regex);
+            if (matches && matches.length === 1) {
+                postFetch = postStr.replace(regex, fetchCall).split("\n");
+                fetchLines.pop();
+            }
+        }
+    }
+    return [...preFetch, ...fetchLines, ...postFetch].join("\n");
+}
+// Rename ctx property names throughout a source string.
+function renameCtxProps(src, propMap) {
+    const ctxProps = ["reg", "mem", "heap", "stack", "frames", "env", "ip", "xk"];
+    for (const p of ctxProps) {
+        const repl = propMap[p];
+        src = src.replace(new RegExp(`\\.${p}\\b`, "g"), `.${repl}`);
+        src = src.replace(new RegExp(`'${p}'`, "g"), `'${repl}'`);
+        src = src.replace(new RegExp(`"${p}"`, "g"), `"${repl}"`);
+        src = src.replace(new RegExp(`\\b${p}:`, "g"), `${repl}:`);
+    }
+    return src;
+}
+// Apply AST-level polymorphism (textual substitutions).
+function applyASTPolymorphism(src, rng) {
+    if (rng.next() < 0.5)
+        src = src.replace(/\(raw \^ ctx\.xk\)/g, "(ctx.xk ^ raw)");
+    else
+        src = src.replace(/\(raw \^ ctx\.xk\)/g, "(~(~raw ^ ctx.xk))");
+    if (rng.next() < 0.5)
+        src = src.replace(/\(m\[p\] \^ k\)/g, "(k ^ m[p])");
+    else
+        src = src.replace(/\(m\[p\] \^ k\)/g, "(~(~k ^ m[p]))");
+    if (rng.next() < 0.5)
+        src = src.replace(/if \(ctx\.ip >= ctx\.mem\.length\)/g, "if (ctx.mem.length <= ctx.ip)");
+    if (rng.next() < 0.5)
+        src = src.replace(/if \(p \+ 4 > m\.length\)/g, "if (m.length < p + 4)");
+    if (rng.next() < 0.5)
+        src = src.replace(/while \(ctx\.ip < l\)/g, "for (; ctx.ip < l ;)");
+    if (rng.next() < 0.5)
+        src = src.replace(/if \(\!h\)/g, "if (h === undefined)");
+    if (rng.next() < 0.5)
+        src = src.replace(/if \(\+\+c >= max\)/g, "c++; if (c >= max)");
+    return src;
+}
+// Generate randomised error array.
+function generateErrorArray(rng) {
+    const msgs = [
+        "Memory Exhausted " + rng.next().toString(36).slice(2, 6),
+        "Stack Bounds Exceeded " + rng.next().toString(36).slice(2, 6),
+        "Illegal Instruction " + rng.next().toString(36).slice(2, 6),
+        "Access Violation " + rng.next().toString(36).slice(2, 6),
+    ];
+    const arrs = msgs.map(m => "[" + m.split("").map(c => "0x" + c.charCodeAt(0).toString(16)).join(", ") + "]");
+    if (rng.next() < 0.5) {
+        return `var _err = [\n    ${arrs.join(",\n    ")}\n];`;
+    }
+    else {
+        return `var _err = [];\n` + arrs.map(a => `_err.push(${a});`).join("\n");
+    }
+}
+// Generate random ctx property names.
+function generateCtxPropMap(rng) {
+    const ctxProps = ["reg", "mem", "heap", "stack", "frames", "env", "ip", "xk"];
+    const used = new Set();
+    const map = {};
+    for (const p of ctxProps) {
+        let hex;
+        do {
+            hex = "_" + Math.floor(rng.next() * 0xffffff).toString(16);
+        } while (used.has(hex));
+        used.add(hex);
+        map[p] = hex;
+    }
+    return map;
+}
+// Generate ctx initialisation code (random form).
+function generateCtxInit(key, propMap, rng) {
+    let keyStr;
+    const r = rng.next();
+    if (r < 0.33) {
+        const add = Math.floor(rng.next() * 100000);
+        keyStr = `(${key - add} + ${add})`;
+    }
+    else if (r < 0.66) {
+        const sub = Math.floor(rng.next() * 100000);
+        keyStr = `(${key + sub} - ${sub})`;
+    }
+    else {
+        keyStr = String(key);
+    }
+    const pm = propMap;
+    const props = [
+        [pm.reg, "new Array(256).fill(0)"],
+        [pm.mem, "null"],
+        [pm.ip, "0"],
+        [pm.xk, keyStr],
+        [pm.heap, "new Array(65536).fill(0)"],
+        [pm.stack, "[]"],
+        [pm.frames, "[]"],
+        [pm.env, "(typeof globalThis !== 'undefined') ? globalThis : (typeof window !== 'undefined' ? window : global)"],
+    ];
+    const shuffled = fisherYates(props, rng);
+    let initCode;
+    if (rng.next() < 0.5) {
+        const lines = shuffled.map(([k, v]) => `${k}: ${v}`);
+        initCode = `var ctx = {\n    ${lines.join(",\n    ")}\n};`;
+    }
+    else {
+        const lines = shuffled.map(([k, v]) => `ctx.${k} = ${v};`);
+        initCode = `var ctx = {};\n${lines.join("\n")}`;
+    }
+    return { initCode, keyStr };
+}
+function generateConsts(mul, inc, rng) {
+    const stack = 100000 + Math.floor(rng.next() * 50000);
+    const frames = 10000 + Math.floor(rng.next() * 5000);
+    const lines = [
+        `var MAX_STACK = ${mathScramble(stack, rng)};`,
+        `var MAX_FRAMES = ${mathScramble(frames, rng)};`,
+        `var LCG_MUL = ${mathScramble(mul, rng)};`,
+        `var LCG_INC = ${mathScramble(inc, rng)};`,
+    ];
+    return fisherYates(lines, rng).join("\n");
+}
+/** Generate a per-build map of all internal VM identifiers → random hex names. */
+function generateVmNameMap(rng) {
+    const used = new Set();
+    function fresh() {
+        let name;
+        do {
+            // Format: _ + 4-6 hex chars  →  looks like any other obfuscated var
+            const len = 4 + Math.floor(rng.next() * 3);
+            name = "_" + Math.floor(rng.next() * 0xffffff).toString(16).padStart(len, "0");
+        } while (used.has(name));
+        used.add(name);
+        return name;
+    }
+    return {
+        ctx: fresh(), ops: fresh(), t1: fresh(),
+        t2: fresh(), SK: fresh(), runVM: fresh(),
+        _init: fresh(), readByte: fresh(), readInt32: fresh(),
+        readStr: fresh(), crash: fresh(), _s: fresh(),
+        _err: fresh(), _h1: fresh(), _hash: fresh(),
+        _ss: fresh(), _ver: fresh(),
+        MAX_STACK: fresh(), MAX_FRAMES: fresh(), LCG_MUL: fresh(), LCG_INC: fresh(),
+        kv_run: fresh(), kv_args: fresh(), kv_ret: fresh(),
+        kv_g: fresh(), kv_fn: fresh(),
+    };
+}
+/**
+ * Apply the name map to a VM source string.
+ * Replacements are done longest-first to avoid partial matches
+ * (e.g. readInt32 must be replaced before readByte/readStr).
+ */
+function applyVmNameMap(src, nm) {
+    // Build list of [original, replacement] sorted by length descending
+    const pairs = [
+        ["readInt32", nm.readInt32],
+        ["readByte", nm.readByte],
+        ["readStr", nm.readStr],
+        ["MAX_STACK", nm.MAX_STACK],
+        ["MAX_FRAMES", nm.MAX_FRAMES],
+        ["LCG_MUL", nm.LCG_MUL],
+        ["LCG_INC", nm.LCG_INC],
+        ["runVM", nm.runVM],
+        ["_init", nm._init],
+        ["crash", nm.crash],
+        ["_hash", nm._hash],
+        ["_ss", nm._ss],
+        ["_ver", nm._ver],
+        ["_err", nm._err],
+        ["_h1", nm._h1],
+        ["_s", nm._s],
+        // split-table names (longer first to avoid partial matches)
+        ["ops", nm.ops],
+        ["ctx", nm.ctx],
+    ];
+    for (const [orig, repl] of pairs) {
+        src = src.replace(new RegExp(`\\b${orig}\\b`, "g"), repl);
+    }
+    // t1/t2/SK are injected via template substitution, not regex rename
+    return src;
+}
+// ── CORE VM TEMPLATE ─────────────────────────────────────────────────────────
+// All identifiers here use the canonical names from VmNameMap keys.
+// applyVmNameMap() renames them to per-build random identifiers after generation.
+const CORE_TEMPLATE = `
+// @INJECT_ERR_START
+var _err = [[0x4f,0x6f,0x6d]];
+// @INJECT_ERR_END
+
+function _s(b){var r='';for(var i=0;i<b.length;i++)r+=String.fromCharCode(b[i]);return r;}
+
+function crash(ctx){
+  if(ctx){ctx.mem=null;if(ctx.reg)ctx.reg.fill(0);if(ctx.stack)ctx.stack.length=0;if(ctx.heap)ctx.heap.fill(0);}
+  throw new Error(_s(_err[(Math.random()*_err.length)|0]));
+}
+
+var _h1=0;
+function _hash(m){if(!m)return 0;var c=0;for(var i=0;i<m.length;i++)c=((c<<5)-c+m[i])|0;return c;}
+function _ss(m,arr){_h1=_hash(m);}
+function _ver(ctx,arr){if(_hash(ctx.mem)!==_h1)crash(ctx);}
+
+// @INJECT_CTX_START
+var INIT_KEY=0;
+var ctx={reg:new Array(256).fill(0),mem:null,ip:0,xk:INIT_KEY,heap:new Array(65536).fill(0),stack:[],frames:[],env:(typeof globalThis!=='undefined')?globalThis:(typeof window!=='undefined'?window:global)};
+// @INJECT_CTX_END
+
+// @INJECT_CONSTS_START
+var MAX_STACK=100000;var MAX_FRAMES=10000;var LCG_MUL=1664525;var LCG_INC=1013904223;
+// @INJECT_CONSTS_END
+
+function readByte(){
+  if(ctx.ip>=ctx.mem.length)crash(ctx);
+  var raw=ctx.mem[ctx.ip++];
+  var dec=(raw^(ctx.xk>>>24))&0xFF;
+  ctx.xk=((Math.imul(ctx.xk,LCG_MUL)+LCG_INC)|0)>>>0;
+  return dec;
+}
+
+function readInt32(){
+  var m=ctx.mem,p=ctx.ip,k=ctx.xk;
+  if(p+4>m.length)crash(ctx);
+  var b1=(m[p]^(k>>>24))&0xFF;k=((Math.imul(k,LCG_MUL)+LCG_INC)|0)>>>0;
+  var b2=(m[p+1]^(k>>>24))&0xFF;k=((Math.imul(k,LCG_MUL)+LCG_INC)|0)>>>0;
+  var b3=(m[p+2]^(k>>>24))&0xFF;k=((Math.imul(k,LCG_MUL)+LCG_INC)|0)>>>0;
+  var b4=(m[p+3]^(k>>>24))&0xFF;k=((Math.imul(k,LCG_MUL)+LCG_INC)|0)>>>0;
+  ctx.ip=p+4;ctx.xk=k;
+  return (b1|(b2<<8)|(b3<<16)|(b4<<24));
+}
+
+function readStr(){
+  var len=readInt32();var c=[];
+  for(var i=0;i<len;i++)c.push(String.fromCharCode(readByte()));
+  return c.join('');
+}
+
+// @INJECT_SPLIT_DECL
+var ops=new Array(256);
+for(var i=0;i<256;i++){ops[i]=function(){crash(ctx);};}
+
+function _init(b64){
+  var raw=atob(b64);
+  ctx.mem=new Uint8Array(raw.length);
+  for(var i=0;i<raw.length;i++)ctx.mem[i]=raw.charCodeAt(i);
+  ctx.ip=0;
+  // @INJECT_INIT_XK
+  ctx.reg.fill(0);ctx.heap.fill(0);ctx.stack=[];ctx.frames=[];
+  // @INJECT_SPLIT_MERGE
+  _ss(ctx.mem,ops);
+}
+
+function runVM(b64){
+  _init(b64);
+  var l=ctx.mem.length;
+  while(ctx.ip<l){
+    var op=readByte();var h=ops[op];
+    if(!h)crash(ctx);h();
+  }
+  _ver(ctx,ops);
+}
+`;
+/**
+ * Generate a fresh polymorphic KrakVm runtime + config.
+ * Every call produces a structurally distinct VM with different:
+ *   - opcode byte assignments
+ *   - arg-fetch ordering per handler
+ *   - ctx property names
+ *   - LCG parameters
+ *   - AST expression forms
+ */
+function generateVm(rng) {
+    const initialKey = rng.int32() >>> 0; // full 32-bit initial key
+    const lcgMul = randOddInt32(rng);
+    const lcgInc = randOddInt32(rng);
+    // Per-build identifier name map (hides readByte, runVM, ctx, ops, etc.)
+    const nameMap = generateVmNameMap(rng);
+    // Assign opcode byte values
+    const opcodeVals = uniqueOpcodes(exports.OPCODE_NAMES.length, rng);
+    const opcodes = {};
+    exports.OPCODE_NAMES.forEach((name, i) => { opcodes[name] = opcodeVals[i]; });
+    // Build prop rename map (ctx.reg, ctx.mem, etc.)
+    const propMap = generateCtxPropMap(rng);
+    // Process each handler: shuffle fetches, collect layouts
+    const handlerBlocks = {};
+    for (const [hn, src] of Object.entries(HANDLER_SRCS)) {
+        const { code, layout } = shuffleFetchBlock(hn, src, rng);
+        handlerBlocks[hn] = { code, layout };
+    }
+    // Build argLayouts (keyed by opcode name)
+    const argLayouts = {};
+    for (const [hn, { layout }] of Object.entries(handlerBlocks)) {
+        const opName = exports.HANDLER_MAP[hn];
+        if (opName)
+            argLayouts[opName] = layout;
+    }
+    // Per-build split key: each opcode index is XORed with this before being
+    // stored in t1 or t2 so the slot numbers are not the real opcode values.
+    const splitKey = (rng.int32() >>> 0) & 0xFF;
+    // t1Name/t2Name/SKName will be substituted literally after nameMap apply.
+    const t1Name = nameMap.t1;
+    const t2Name = nameMap.t2;
+    const skName = nameMap.SK;
+    const opsName = nameMap.ops;
+    // Separate dynamic (40%) vs static handler assignments
+    const dynamicOps = {};
+    const staticOpsArr = [];
+    for (const [hn, { code }] of Object.entries(handlerBlocks)) {
+        const opName = exports.HANDLER_MAP[hn];
+        if (!opName)
+            continue;
+        const opcodeVal = opcodes[opName];
+        // Apply per-handler transformations
+        let processed = removeMarkers(hn, code, rng);
+        processed = applyASTPolymorphism(processed, rng);
+        processed = renameCtxProps(processed, propMap);
+        // Each handler goes into t1 or t2 (50/50 per-build random split).
+        // The slot index is opcodeVal ^ splitKey — not the raw opcode byte.
+        const tbl = rng.next() < 0.5 ? t1Name : t2Name;
+        const slot = opcodeVal ^ splitKey;
+        const assignment = `${tbl}[${slot}] = ${processed}`;
+        if (opName !== "EVAL" && opName !== "JMP" && rng.next() < 0.4) {
+            dynamicOps[opName] = { opcodeVal, src: `${tbl}[${slot}] = ${processed};` };
+        }
+        else {
+            staticOpsArr.push(assignment);
+        }
+    }
+    // Shuffle static assignments
+    const shuffledStatics = fisherYates(staticOpsArr, rng);
+    // ── Split-table declarations and merge code ──────────────────────────────
+    // t1 and t2 are null-initialised (not crash-filled) so null is a reliable
+    // sentinel — exactly one of t1[slot]/t2[slot] holds the real handler.
+    // ops[] is crash-filled separately.
+    const splitDecl = [
+        `var ${skName} = ${mathScramble(splitKey, rng)};`,
+        `var ${t1Name} = new Array(${mathScramble(256, rng)}).fill(null);`,
+        `var ${t2Name} = new Array(${mathScramble(256, rng)}).fill(null);`,
+    ].join("\n");
+    // Merge: ops is already crash-filled from its own init loop.
+    // For each slot i, exactly one of t1[i] or t2[i] is non-null (the real handler).
+    // Copy whichever is non-null into ops[i ^ SK].
+    const mergeCodeClean = [
+        `for(var _mi=0;_mi<256;_mi++){`,
+        `  if(${t1Name}[_mi]!==null)${opsName}[_mi^${skName}]=${t1Name}[_mi];`,
+        `  else if(${t2Name}[_mi]!==null)${opsName}[_mi^${skName}]=${t2Name}[_mi];`,
+        `}`,
+    ].join("\n");
+    // Build core template with all substitutions
+    const { initCode, keyStr } = generateCtxInit(initialKey, propMap, rng);
+    let core = CORE_TEMPLATE;
+    core = core.replace(/\/\/ @INJECT_ERR_START[\s\S]*?\/\/ @INJECT_ERR_END/, generateErrorArray(rng));
+    core = core.replace(/\/\/ @INJECT_CONSTS_START[\s\S]*?\/\/ @INJECT_CONSTS_END/, generateConsts(lcgMul, lcgInc, rng));
+    core = core.replace(/\/\/ @INJECT_CTX_START[\s\S]*?\/\/ @INJECT_CTX_END/, initCode);
+    core = core.replace(/\/\/ @INJECT_INIT_XK/g, `${nameMap.ctx}.${propMap.xk} = ${keyStr};`);
+    core = core.replace(/\/\/ @INJECT_SPLIT_DECL/g, splitDecl);
+    core = core.replace(/\/\/ @INJECT_SPLIT_MERGE/g, mergeCodeClean);
+    core = applyASTPolymorphism(core, rng);
+    core = renameCtxProps(core, propMap);
+    // Scramble the heap literal size.
+    core = core.replace(/\bnew Array\(65536\)/g, `new Array(${mathScramble(65536, rng)})`);
+    // Note: new Array(256) in split decl is already mathScramble'd above.
+    core = core.replace(/\/\/ @INJECT_INIT_XK/g, `${nameMap.ctx}.${propMap.xk} = ${keyStr};`);
+    // Assemble full runtime; then apply nameMap over everything at once.
+    // This renames: readByte, readInt32, readStr, runVM, _init, ops, ctx,
+    // crash, _s, _err, _h1, _hash, _ss, _ver, MAX_STACK, MAX_FRAMES,
+    // LCG_MUL, LCG_INC — all in one pass, longest-first.
+    // t1/t2/SK are already in the template as literal names — nameMap renames ops/ctx etc.
+    let runtimeSrc = core + "\n" + shuffledStatics.join("\n") + "\n";
+    runtimeSrc = applyVmNameMap(runtimeSrc, nameMap);
+    // Apply nameMap to dynamicOps sources too
+    for (const key of Object.keys(dynamicOps)) {
+        dynamicOps[key].src = applyVmNameMap(dynamicOps[key].src, nameMap);
+    }
+    const config = {
+        initialKey,
+        lcgMul,
+        lcgInc,
+        opcodes: opcodes,
+        argLayouts,
+        dynamicOps,
+    };
+    return { runtimeSrc, config, nameMap };
+}