jz 0.3.1 → 0.4.0

package/src/emit.js

@@ -536,7 +536,7 @@ export function emitDecl(...inits) {
         ctx.func.locals.set(innerName, 'f64')
         result.push(
           ['local.set', `$${innerName}`, ['local.get', `$${name}`]],
-          ['local.set', `$${bt}`, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', Math.max(1, schema.length)], ['i32.const', 8]]],
+          ['local.set', `$${bt}`, ['call', '$__alloc_hdr', ['i32.const', 0], ['i32.const', Math.max(1, schema.length)]]],
           ['f64.store', ['local.get', `$${bt}`], ['local.get', `$${name}`]],
           ...schema.slice(1).map((_, j) =>
             ['f64.store', ['i32.add', ['local.get', `$${bt}`], ['i32.const', (j + 1) * 8]], ['f64.const', 0]]),
@@ -1879,6 +1879,7 @@ export const emitter = {
           const callIR = typed(['call', `$${fname}`, ...emittedArgs], func.sig.results[0])
           if (func.sig.ptrKind != null) callIR.ptrKind = func.sig.ptrKind
           if (func.sig.ptrAux != null) callIR.ptrAux = func.sig.ptrAux
+          if (func.sig.unsignedResult) callIR.unsigned = true
           return callIR
         }
       }
@@ -2282,6 +2283,7 @@ export const emitter = {
           arrayIR], func.sig.results[0])
         if (func.sig.ptrKind != null) callIR.ptrKind = func.sig.ptrKind
         if (func.sig.ptrAux != null) callIR.ptrAux = func.sig.ptrAux
+        if (func.sig.unsignedResult) callIR.unsigned = true
         return callIR
       }
 
@@ -2302,6 +2304,9 @@ export const emitter = {
       const callIR = typed(['call', `$${callee}`, ...args], func?.sig.results[0] || 'f64')
       if (func?.sig.ptrKind != null) callIR.ptrKind = func.sig.ptrKind
       if (func?.sig.ptrAux != null) callIR.ptrAux = func.sig.ptrAux
+      // Unsigned-uint32 result (every tail was `>>>`): consumer's asF64 must use
+      // `f64.convert_i32_u` instead of `_s`, preserving the [0, 2^32) range.
+      if (func?.sig.unsignedResult) callIR.unsigned = true
       return callIR
     }
 

package/src/fuse.js

@@ -0,0 +1,159 @@
+/**
+ * AST-level fusion passes.
+ *
+ * Unlike src/optimize.js (which is a pure WAT IR→IR rewrite, post-emission),
+ * these rewrites need the *raw, pre-resolution* AST shape — bindings still named,
+ * arrow bodies still inline — so they run inside prepare(), before scope
+ * resolution and emit. They mutate the AST in place and always fire (cheap; the
+ * shape guards are strict enough that misfires are impossible).
+ *
+ * @module fuse
+ */
+
+/** Sparse-read .map fusion: rewrite `const b = a.map(arrow); for(...; j<b.length; ...) USE(b[j])`
+ *  into a fused for-loop that inlines `arrow(a[j])` at the read site, eliminating the materialized
+ *  intermediate array. Only fires on shapes where every use of `b` is a numeric `b[idx]` read or a
+ *  `b.length` read, the arrow is pure with a single named param, and `b` is not referenced after the
+ *  consumer for-loop. Preserves observable behavior because the arrow's pure-expression body has no
+ *  order-dependent effects. */
+export function fuseSparseMapReads(root) {
+  walkSparse(root)
+}
+function walkSparse(node) {
+  if (!Array.isArray(node)) return
+  for (let i = 1; i < node.length; i++) walkSparse(node[i])
+  if (node[0] === ';') tryFuseInBlock(node)
+}
+function tryFuseInBlock(seq) {
+  for (let i = 1; i < seq.length - 1; i++) {
+    const fused = tryFusePair(seq[i], seq[i + 1], seq, i)
+    if (fused) {
+      seq.splice(i, 2, ...fused)
+      i--  // re-examine same position (chained fusions)
+    }
+  }
+}
+function tryFusePair(decl, forNode, seq, declIdx) {
+  if (!Array.isArray(decl) || (decl[0] !== 'const' && decl[0] !== 'let')) return null
+  if (decl.length !== 2) return null  // single binding only
+  const bind = decl[1]
+  if (!Array.isArray(bind) || bind[0] !== '=' || typeof bind[1] !== 'string') return null
+  const NAME = bind[1], rhs = bind[2]
+  if (!Array.isArray(rhs) || rhs[0] !== '()') return null
+  const callee = rhs[1]
+  if (!Array.isArray(callee) || callee[0] !== '.' || callee[2] !== 'map') return null
+  const RECV = callee[1]
+  if (typeof RECV !== 'string' || RECV === NAME) return null
+  const arrow = rhs[2]
+  if (!Array.isArray(arrow) || arrow[0] !== '=>') return null
+  // Single-name param only: `x => …` or `(x) => …`
+  const ap = arrow[1]
+  const PARAM = typeof ap === 'string' ? ap :
+    (Array.isArray(ap) && ap[0] === '()' && typeof ap[1] === 'string' ? ap[1] : null)
+  if (!PARAM || PARAM === NAME || PARAM === RECV) return null
+  // Body: single-expression arrow only (block bodies skipped — could extend later).
+  const aBody = arrow[2]
+  if (Array.isArray(aBody) && aBody[0] === '{}') return null
+  if (!isPureSparseArrowBody(aBody, PARAM)) return null
+  // For-loop: ['for', [';', initStmt, cond, inc], body]
+  if (!Array.isArray(forNode) || forNode[0] !== 'for' || forNode.length !== 3) return null
+  const head = forNode[1]
+  if (!Array.isArray(head) || head[0] !== ';' || head.length !== 4) return null
+  const cond = head[2], forBody = forNode[2]
+  // Verify `NAME` is used only as `NAME[idx]` or `NAME.length` inside cond+forBody.
+  if (!hasOnlySparseUses(cond, NAME)) return null
+  if (!hasOnlySparseUses(forBody, NAME)) return null
+  if (!hasAnyIndexedRead(forBody, NAME) && !hasAnyIndexedRead(cond, NAME)) return null
+  // `NAME` must not be read after the for-loop in the same block.
+  for (let k = declIdx + 2; k < seq.length; k++) {
+    if (refsName(seq[k], NAME)) return null
+  }
+  // RECV must not be reassigned inside the for-loop (would invalidate substitution).
+  if (assignsName(forNode, RECV) || assignsName(forNode, NAME)) return null
+  // PARAM must not collide with any binding inside forBody (otherwise substitution shadows wrongly).
+  if (bindsName(forNode, PARAM)) return null
+  // Apply substitution: NAME.length → RECV.length; NAME[idx] → arrowBody[PARAM ← RECV[idx]].
+  const newCond = substSparse(cond, NAME, RECV, PARAM, aBody)
+  const newBody = substSparse(forBody, NAME, RECV, PARAM, aBody)
+  const newHead = [';', head[1], newCond, head[3]]
+  return [['for', newHead, newBody]]
+}
+function isPureSparseArrowBody(n, PARAM) {
+  if (typeof n === 'string') return true
+  if (!Array.isArray(n)) return true
+  const op = n[0]
+  // Calls / new / assignments / increments are unsafe for repeated-substitution semantics.
+  if (op === '()' || op === '?.()' || op === 'new' || op === '++' || op === '--') return false
+  if (op === '=>') return false  // nested closure is opaque
+  if (typeof op === 'string' && op !== '=>' && op !== '===' && op !== '!==' && op !== '==' && op !== '!=' && op !== '<=' && op !== '>=' && op.endsWith('=') && op !== '=') return false
+  if (op === '=') return false
+  for (let i = 1; i < n.length; i++) if (!isPureSparseArrowBody(n[i], PARAM)) return false
+  return true
+}
+function hasOnlySparseUses(n, NAME) {
+  if (typeof n === 'string') return n !== NAME
+  if (!Array.isArray(n)) return true
+  const op = n[0]
+  if (op === '[]' && n.length === 3 && n[1] === NAME) return hasOnlySparseUses(n[2], NAME)  // NAME[idx] — idx must not reference NAME
+  if (op === '.' && n[1] === NAME) {
+    if (n[2] === 'length') return true
+    return false  // any other property access on NAME is opaque
+  }
+  for (let i = 1; i < n.length; i++) if (!hasOnlySparseUses(n[i], NAME)) return false
+  return true
+}
+function hasAnyIndexedRead(n, NAME) {
+  if (!Array.isArray(n)) return false
+  if (n[0] === '[]' && n.length === 3 && n[1] === NAME) return true
+  for (let i = 1; i < n.length; i++) if (hasAnyIndexedRead(n[i], NAME)) return true
+  return false
+}
+function refsName(n, NAME) {
+  if (typeof n === 'string') return n === NAME
+  if (!Array.isArray(n)) return false
+  for (let i = 1; i < n.length; i++) if (refsName(n[i], NAME)) return true
+  return false
+}
+function assignsName(n, NAME) {
+  if (!Array.isArray(n)) return false
+  const op = n[0]
+  if ((op === '=' || op === '++' || op === '--' ||
+       (typeof op === 'string' && op.endsWith('=') && op !== '==' && op !== '===' && op !== '!=' && op !== '!==' && op !== '<=' && op !== '>='))
+      && n[1] === NAME) return true
+  for (let i = 1; i < n.length; i++) if (assignsName(n[i], NAME)) return true
+  return false
+}
+function bindsName(n, NAME) {
+  if (!Array.isArray(n)) return false
+  const op = n[0]
+  if ((op === 'let' || op === 'const')) {
+    for (let i = 1; i < n.length; i++) {
+      const bind = n[i]
+      if (Array.isArray(bind) && bind[0] === '=' && bind[1] === NAME) return true
+    }
+  }
+  if (op === '=>') {
+    const p = n[1]
+    if (p === NAME) return true
+    if (Array.isArray(p)) {
+      if (p[0] === '()' && p[1] === NAME) return true
+      // skip deeper destructuring forms — conservative
+    }
+  }
+  for (let i = 1; i < n.length; i++) if (bindsName(n[i], NAME)) return true
+  return false
+}
+function substSparse(n, NAME, RECV, PARAM, arrowBody) {
+  if (typeof n !== 'object' || n === null || !Array.isArray(n)) return n
+  if (n[0] === '.' && n[1] === NAME && n[2] === 'length') return ['.', RECV, 'length']
+  if (n[0] === '[]' && n.length === 3 && n[1] === NAME) {
+    const idx = substSparse(n[2], NAME, RECV, PARAM, arrowBody)
+    return cloneAndBind(arrowBody, PARAM, ['[]', RECV, idx])
+  }
+  return n.map((c, i) => i === 0 ? c : substSparse(c, NAME, RECV, PARAM, arrowBody))
+}
+function cloneAndBind(node, PARAM, replacement) {
+  if (node === PARAM) return replacement
+  if (!Array.isArray(node)) return node
+  return node.map((c, i) => i === 0 ? c : cloneAndBind(c, PARAM, replacement))
+}

package/src/ir.js

@@ -391,7 +391,8 @@ export function truthyIR(e) {
     }
     // Fresh pointer constructors never produce nullish. Treat as always truthy.
     if (e[0] === 'call' && typeof e[1] === 'string' &&
-        (e[1].startsWith('$__mkptr') || e[1] === '$__alloc' || e[1].startsWith('$__alloc_hdr'))) {
+        (e[1].startsWith('$__mkptr') || e[1] === '$__alloc' ||
+         e[1] === '$__alloc_hdr' || e[1].startsWith('$__alloc_hdr_'))) {
       return typed(['i32.const', 1], 'i32')
     }
     // Pointer-typed local reads: value is never a plain number — truthy iff not nullish.
@@ -647,11 +648,17 @@ export function arrayLoop(arrExpr, bodyFn, lenLocal, ptrLocal) {
  *    ptr   — f64 IR expression: __mkptr(type, aux, local).
  *  Caller emits init, fills via local, then uses ptr (or local for further work). */
 export function allocPtr({ type, aux = 0, len, cap, stride = 8, tag = 'ap' }) {
-  inc('__alloc_hdr')
+  // stride=8 (f64 slots — Array/HASH/OBJECT) hits the specialized __alloc_hdr which
+  // hardcodes the multiply. Everything else (Set:16, Map probe:24, raw bytes:1) goes
+  // through the generic __alloc_hdr_n(len, cap, stride).
   const local = tempI32(tag)
   const irOf = v => typeof v === 'number' ? ['i32.const', v] : v
-  const init = ['local.set', `$${local}`,
-    ['call', '$__alloc_hdr', irOf(len), irOf(cap == null ? len : cap), ['i32.const', stride]]]
+  const args = [irOf(len), irOf(cap == null ? len : cap)]
+  let helper
+  if (stride === 8) helper = '__alloc_hdr'
+  else { helper = '__alloc_hdr_n'; args.push(['i32.const', stride]) }
+  inc(helper)
+  const init = ['local.set', `$${local}`, ['call', '$' + helper, ...args]]
   const ptr = mkPtrIR(type, aux, ['local.get', `$${local}`])
   return { local, init, ptr }
 }

package/src/jzify.js

@@ -31,7 +31,7 @@ export default function jzify(ast) {
   const names = new Set()
   ast = hoistVars(ast, names)
   if (names.size) ast = prependDecls(ast, names)
-  return foldStaticExportHelpers(transformScope(ast))
+  return foldStaticExportHelpers(canonicalizeObjectIdioms(transformScope(ast)))
 }
 
 /**
@@ -80,7 +80,10 @@ function hoistVars(node, names) {
   if (op === 'for') {
     const head = node[1]
     let h2
-    if (Array.isArray(head) && head[0] === 'var' && Array.isArray(head[1]) &&
+    const normalizedHead = normalizeForDeclHead(head, names)
+    if (normalizedHead) {
+      h2 = normalizedHead
+    } else if (Array.isArray(head) && head[0] === 'var' && Array.isArray(head[1]) &&
         (head[1][0] === 'in' || head[1][0] === 'of') && typeof head[1][1] === 'string') {
       names.add(head[1][1])
       h2 = [head[1][0], head[1][1], hoistVars(head[1][2], names)]
@@ -137,6 +140,27 @@ function prependDecls(body, names) {
   return body == null ? decl : [';', decl, body]
 }
 
+function normalizeForDeclHead(head, names) {
+  if (!Array.isArray(head) || (head[0] !== 'var' && head[0] !== 'let' && head[0] !== 'const') || head.length !== 2) return null
+  const kind = head[0]
+  const expr = head[1]
+  if (!Array.isArray(expr)) return null
+  if (expr.length >= 3 && Array.isArray(expr[1]) &&
+      (expr[1][0] === 'in' || expr[1][0] === 'of') && typeof expr[1][1] === 'string') {
+    const iter = expr[1]
+    return [iter[0], normalizeForDecl(kind, iter[1], names), hoistVars([expr[0], iter[2], ...expr.slice(2)], names)]
+  }
+  return null
+}
+
+function normalizeForDecl(kind, name, names) {
+  if (kind === 'var') {
+    names.add(name)
+    return name
+  }
+  return [kind, name]
+}
+
 /** Convert a named function declaration to a hoisted const arrow */
 function hoistFnDecl(name, params, body) {
   const [p2, b2] = lowerArguments(params, body)
@@ -507,12 +531,16 @@ const handlers = {
     const clean = cases.map(c => {
       if (c[0] === 'case' && Array.isArray(c[2]) && c[2][0] === ';') {
         const body = c[2].slice(1).filter(s => typeof s !== 'number')
-        return ['case', c[1], body.length === 1 ? body[0] : [';', ...body]]
+        const stripped = stripTerminalSwitchBreak(body.length === 1 ? body[0] : [';', ...body])
+        return ['case', c[1], stripped]
       }
       if (c[0] === 'default' && Array.isArray(c[1]) && c[1][0] === ';') {
         const body = c[1].slice(1).filter(s => s != null && typeof s !== 'number')
-        return ['default', body.length === 1 ? body[0] : [';', ...body]]
+        const stripped = stripTerminalSwitchBreak(body.length === 1 ? body[0] : [';', ...body])
+        return ['default', stripped]
       }
+      if (c[0] === 'case') return ['case', c[1], stripTerminalSwitchBreak(c[2])]
+      if (c[0] === 'default') return ['default', stripTerminalSwitchBreak(c[1])]
       return c
     })
     return transformSwitch(disc, clean)
@@ -589,7 +617,10 @@ function transform(node) {
   const [op, ...args] = node
   if (op == null) return node
   const h = handlers[op]
-  return (h && h(...args)) ?? (h ? [op, ...args.map(transform)] : [op, ...args.map(transform)])
+  // A handler that returns nullish (including no `return`) means "no rewrite at
+  // this node" — fall through to a generic recurse. `??` (not `||`) so handlers
+  // like `'==='` can legitimately return `0`.
+  return (h && h(...args)) ?? [op, ...args.map(transform)]
 }
 
 // Esbuild emits a small ESM helper:
@@ -713,12 +744,98 @@ function replaceStaticExportReads(node, rewrites) {
   return node.map((part, i) => i === 0 ? part : replaceStaticExportReads(part, rewrites))
 }
 
+function canonicalizeObjectIdioms(node) {
+  if (node == null || typeof node !== 'object' || !Array.isArray(node)) return node
+
+  const out = node.map((part, i) => i === 0 ? part : canonicalizeObjectIdioms(part))
+
+  const hasOwnCall = objectHasOwnPropertyCall(out)
+  if (hasOwnCall) return ['()', ['.', hasOwnCall.obj, 'hasOwnProperty'], hasOwnCall.key]
+
+  if (out[0] === '&&') {
+    const leftCtor = constructorIsObject(out[1])
+    const rightKeys = objectKeysLengthZero(out[2])
+    if (leftCtor && rightKeys && astEqual(leftCtor.obj, rightKeys.obj)) return out[2]
+
+    const leftKeys = objectKeysLengthZero(out[1])
+    const rightCtor = constructorIsObject(out[2])
+    if (leftKeys && rightCtor && astEqual(leftKeys.obj, rightCtor.obj)) return out[1]
+  }
+
+  return out
+}
+
+function objectHasOwnPropertyCall(node) {
+  if (!Array.isArray(node) || node[0] !== '()') return null
+  const callee = node[1]
+  if (!Array.isArray(callee) || callee[0] !== '.' || callee[2] !== 'call') return null
+  if (!Array.isArray(callee[1]) || callee[1][0] !== '.' || callee[1][1] !== 'Object' || callee[1][2] !== 'hasOwnProperty') return null
+  const args = callArgs(node.slice(2))
+  if (args.length < 2) return null
+  return { obj: args[0], key: args[1] }
+}
+
+function constructorIsObject(node) {
+  if (!Array.isArray(node) || (node[0] !== '===' && node[0] !== '==')) return null
+  const left = constructorReceiver(node[1])
+  if (left && node[2] === 'Object') return { obj: left }
+  const right = constructorReceiver(node[2])
+  if (right && node[1] === 'Object') return { obj: right }
+  return null
+}
+
+function constructorReceiver(node) {
+  return Array.isArray(node) && node[0] === '.' && node[2] === 'constructor' ? node[1] : null
+}
+
+function objectKeysLengthZero(node) {
+  if (!Array.isArray(node) || (node[0] !== '===' && node[0] !== '==')) return null
+  const left = objectKeysLengthReceiver(node[1])
+  if (left && isZeroLiteral(node[2])) return { obj: left }
+  const right = objectKeysLengthReceiver(node[2])
+  if (right && isZeroLiteral(node[1])) return { obj: right }
+  return null
+}
+
+function objectKeysLengthReceiver(node) {
+  if (!Array.isArray(node) || node[0] !== '.' || node[2] !== 'length') return null
+  const call = node[1]
+  if (!Array.isArray(call) || call[0] !== '()') return null
+  const callee = call[1]
+  if (!Array.isArray(callee) || callee[0] !== '.' || callee[1] !== 'Object' || callee[2] !== 'keys') return null
+  const args = callArgs(call.slice(2))
+  return args.length === 1 ? args[0] : null
+}
+
+function isZeroLiteral(node) {
+  return Array.isArray(node) && node[0] == null && node[1] === 0
+}
+
+function astEqual(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b)
+}
+
 function cloneAst(node) {
   if (node == null || typeof node !== 'object') return node
   if (!Array.isArray(node)) return node
   return node.map(cloneAst)
 }
 
+function stripTerminalSwitchBreak(body) {
+  if (!Array.isArray(body)) return body
+  if (body[0] === 'break') return null
+  if (body[0] === '{}') {
+    const inner = stripTerminalSwitchBreak(body[1])
+    if (inner == null) return ['{}', [';']]
+    return ['{}', Array.isArray(inner) && inner[0] === ';' ? inner : [';', inner]]
+  }
+  if (body[0] !== ';') return body
+
+  const stmts = body.slice(1)
+  if (Array.isArray(stmts.at(-1)) && stmts.at(-1)[0] === 'break') stmts.pop()
+  return stmts.length === 0 ? null : stmts.length === 1 ? stmts[0] : [';', ...stmts]
+}
+
 /** Transform switch statement to if/else chain. */
 let swIdx = 0
 function transformSwitch(discriminant, cases) {
@@ -742,173 +859,3 @@ function transformSwitch(discriminant, cases) {
   if (chain) stmts.push(chain)
   return [';', ...stmts]
 }
-
-// === AST → jz source codegen ===
-
-const INDENT = '  '
-const prec = { '=': 1, '+=': 1, '-=': 1, '*=': 1, '/=': 1, '%=': 1, '&=': 1, '|=': 1, '^=': 1, '>>=': 1, '<<=': 1, '>>>=': 1, '||=': 1, '&&=': 1,
-  '??': 2, '||': 3, '&&': 4, '|': 5, '^': 6, '&': 7, '===': 8, '!==': 8, '==': 8, '!=': 8,
-  '<': 9, '>': 9, '<=': 9, '>=': 9, '<<': 10, '>>': 10, '>>>': 10,
-  '+': 11, '-': 11, '*': 12, '/': 12, '%': 12, '**': 13 }
-
-/** Wrap statement in { } if not already a block */
-function wrapBlock(node, depth) {
-  if (Array.isArray(node) && node[0] === '{}') return codegen(node, depth)
-  return '{ ' + codegen(node, depth) + '; }'
-}
-
-/** Generate jz source from AST. Enforces semicolons. */
-export function codegen(node, depth = 0) {
-  if (node == null) return ''
-  if (typeof node === 'number') return String(node)
-  if (typeof node === 'bigint') return node + 'n'
-  if (typeof node === 'string') return node
-  if (!Array.isArray(node)) return String(node)
-
-  const [op, ...a] = node
-  const ind = INDENT.repeat(depth), ind1 = INDENT.repeat(depth + 1)
-
-  // Literal: [, value]
-  if (op == null) return typeof a[0] === 'string' ? JSON.stringify(a[0]) : a[0] == null ? 'null' : String(a[0]) + (typeof a[0] === 'bigint' ? 'n' : '')
-
-  // Statements
-  if (op === ';') return a.map(s => codegen(s, depth)).filter(Boolean).join(';\n' + ind) + ';'
-  if (op === '{}') {
-    // Discriminate object literal / destructuring pattern from block.
-    // Object: `:` key-value, `,` of object-pattern items (id / `:` / `...` / `= default`),
-    //         lone string shorthand. Empty `{}` outputs the same string either way.
-    const body = a[0]
-    const isObjItem = (n) => typeof n === 'string' ||
-      (Array.isArray(n) && (n[0] === ':' || n[0] === '...' || n[0] === 'as' ||
-        (n[0] === '=' && typeof n[1] === 'string')))
-    const isObj = body == null ? false
-      : typeof body === 'string' ? true
-      : Array.isArray(body) && (body[0] === ':' || body[0] === '...' || body[0] === 'as' ||
-          (body[0] === ',' && body.slice(1).every(isObjItem)))
-    if (isObj) {
-      if (typeof body === 'string') return '{ ' + body + ' }'
-      if (body[0] === ',') return '{ ' + body.slice(1).map(x => codegen(x)).join(', ') + ' }'
-      return '{ ' + codegen(body) + ' }'
-    }
-    // Block: body is null, a single statement, or [';', ...stmts]
-    const stmts = body == null ? [] : (Array.isArray(body) && body[0] === ';' ? body.slice(1) : [body])
-    const rendered = stmts.map(s => codegen(s, depth + 1)).filter(Boolean).join(';\n' + ind1)
-    return '{\n' + ind1 + rendered + (rendered ? ';' : '') + '\n' + ind + '}'
-  }
-
-  // Declarations
-  if (op === 'let' || op === 'const') return op + ' ' + a.map(d => codegen(d, depth)).join(', ')
-  if (op === 'export') { const inner = codegen(a[0], depth); return inner ? 'export ' + inner : '' }
-  if (op === 'default') return 'default ' + codegen(a[0], depth)
-
-  // Control flow
-  if (op === 'if') {
-    const cond = codegen(a[0]), then = wrapBlock(a[1], depth)
-    return a[2] != null
-      ? 'if (' + cond + ') ' + then + ' else ' + wrapBlock(a[2], depth)
-      : 'if (' + cond + ') ' + then
-  }
-  if (op === 'while') return 'while (' + codegen(a[0]) + ') ' + wrapBlock(a[1], depth)
-  if (op === 'for') {
-    if (a.length === 2) { // ['for', head, body] — subscript shape
-      const [head, body] = a
-      if (Array.isArray(head) && (head[0] === 'of' || head[0] === 'in'))
-        return 'for (' + codegen(head[1]) + ' ' + head[0] + ' ' + codegen(head[2]) + ') ' + wrapBlock(body, depth)
-      // ['let'/'const', ['in'/'of', name, obj]] — subscript wraps var→let around in/of
-      if (Array.isArray(head) && (head[0] === 'let' || head[0] === 'const') && Array.isArray(head[1]) && (head[1][0] === 'in' || head[1][0] === 'of'))
-        return 'for (' + head[0] + ' ' + codegen(head[1][1]) + ' ' + head[1][0] + ' ' + codegen(head[1][2]) + ') ' + wrapBlock(body, depth)
-      // C-style head [';', init, cond, update] is positional — empty slots are valid,
-      // must not flow through the generic `;` joiner (which adds newlines + a trailing `;`).
-      if (Array.isArray(head) && head[0] === ';')
-        return 'for (' + (head[1] == null ? '' : codegen(head[1])) + '; ' + (head[2] == null ? '' : codegen(head[2])) + '; ' + (head[3] == null ? '' : codegen(head[3])) + ') ' + wrapBlock(body, depth)
-      return 'for (' + codegen(head) + ') ' + wrapBlock(body, depth)
-    }
-    return 'for (' + (codegen(a[0]) || '') + '; ' + (codegen(a[1]) || '') + '; ' + (codegen(a[2]) || '') + ') ' + wrapBlock(a[3], depth)
-  }
-  if (op === 'return') return 'return ' + codegen(a[0])
-  if (op === 'throw') return 'throw ' + codegen(a[0])
-  if (op === 'break') return 'break'
-  if (op === 'continue') return 'continue'
-  // catch with optional binding: ['catch', tryBlock, catchBody] or ['catch', tryBlock, paramName, catchBody]
-  if (op === 'catch') {
-    if (a.length === 3) return 'try ' + codegen(a[0], depth) + ' catch (' + a[1] + ') ' + codegen(a[2], depth)
-    return 'try ' + codegen(a[0], depth) + ' catch ' + codegen(a[1], depth)
-  }
-
-  // Arrow
-  if (op === '=>') {
-    // Params: already wrapped in () by parser, or bare name
-    const p = a[0]
-    const params = Array.isArray(p) && p[0] === '()' ? codegen(p) : '(' + codegen(p) + ')'
-    const body = a[1]
-    const isBlock = Array.isArray(body) && (body[0] === '{}' || body[0] === ';' || body[0] === 'return')
-    const bodyStr = Array.isArray(body) && body[0] !== '{}' && isBlock
-      ? '{ ' + codegen(body, depth) + '; }'
-      : codegen(body, depth)
-    return params + ' => ' + bodyStr
-  }
-
-  // Grouping parens / function call
-  if (op === '()') {
-    if (a.length === 1) return '(' + (a[0] == null ? '' : codegen(a[0])) + ')'
-    return codegen(a[0]) + '(' + a.slice(1).map(x => codegen(x)).join(', ') + ')'
-  }
-
-  // Property access
-  if (op === '.') return codegen(a[0]) + '.' + a[1]
-  if (op === '?.') return codegen(a[0]) + '?.' + a[1]
-  if (op === '?.[]') return codegen(a[0]) + '?.[' + codegen(a[1]) + ']'
-  if (op === '?.()') return codegen(a[0]) + '?.(' + a.slice(1).map(x => codegen(x)).join(', ') + ')'
-  if (op === '[]') {
-    // Array literal: ['[]', body] (length 2 → a.length 1). body may be null (empty),
-    // a single element, or a [',', ...items] sequence.
-    if (a.length === 1) {
-      if (a[0] == null) return '[]'
-      const body = a[0]
-      if (Array.isArray(body) && body[0] === ',') return '[' + body.slice(1).map(x => codegen(x)).join(', ') + ']'
-      return '[' + codegen(body) + ']'
-    }
-    // Subscript: ['[]', obj, idx]
-    return codegen(a[0]) + '[' + codegen(a[1]) + ']'
-  }
-  if (op === ':') return codegen(a[0]) + ': ' + codegen(a[1])
-  if (op === 'str') return JSON.stringify(a[0])
-  if (op === '//') return '/' + a[0] + '/' + (a[1] || '')
-
-  // Comma
-  if (op === ',') return a.map(x => codegen(x)).join(', ')
-  // Template literal: alternating string/expr parts. String parts are [null, "str"], expr parts are AST nodes.
-  if (op === '`') return '`' + a.map(p => {
-    if (Array.isArray(p) && p[0] == null && typeof p[1] === 'string') return p[1].replace(/[`\\$]/g, c => '\\' + c)
-    return '${' + codegen(p) + '}'
-  }).join('') + '`'
-
-  // Spread
-  if (op === '...') return '...' + codegen(a[0])
-
-  // Import / export rename
-  if (op === 'import') return 'import ' + codegen(a[0])
-  if (op === 'from') return codegen(a[0]) + ' from ' + codegen(a[1])
-  if (op === 'as') return codegen(a[0]) + ' as ' + codegen(a[1])
-
-  // Unary prefix
-  if (a.length === 1) {
-    if (op === '++' || op === '--') return a[0] == null ? op : op + codegen(a[0])
-    if (op === 'typeof') return 'typeof ' + codegen(a[0])
-    if (op === 'u-') return '-' + codegen(a[0])
-    if (op === 'u+') return '+' + codegen(a[0])
-    return op + codegen(a[0])
-  }
-
-  // Postfix
-  if (a.length === 2 && a[1] === null) return codegen(a[0]) + op
-
-  // Binary
-  if (a.length === 2 && prec[op]) return codegen(a[0]) + ' ' + op + ' ' + codegen(a[1])
-
-  // Ternary
-  if (op === '?' || op === '?:') return codegen(a[0]) + ' ? ' + codegen(a[1]) + ' : ' + codegen(a[2])
-
-  // Fallback
-  return op + '(' + a.map(x => codegen(x)).join(', ') + ')'
-}

package/src/narrow.js

@@ -192,11 +192,20 @@ function enrichCallerValTypesFromPointerParams(callerCtx) {
 function refreshCallerLocals(callerCtx) {
   for (const func of ctx.func.list) {
     if (!func.body || func.raw) continue
+    // Seed pointer-narrowed params' val-kind so analyzeBody recognises e.g.
+    // `n = arr.length` (arr a TYPED/BUFFER pointer param) as an i32 local — without
+    // this, post-G `refreshCallerLocals` still walks bodies with arr untyped, the
+    // length stays f64, and any callee taking that length never gets an i32 param
+    // (heapsort→siftDown's `end`). analyzeFuncForEmit re-seeds + re-invalidates at
+    // emit time, so this transient repByLocal doesn't leak past narrowing.
+    ctx.func.repByLocal = new Map()
+    for (const p of func.sig.params) if (p.ptrKind != null) ctx.func.repByLocal.set(p.name, { val: p.ptrKind })
     invalidateLocalsCache(func.body)
     const fresh = analyzeLocals(func.body)
     for (const p of func.sig.params) if (!fresh.has(p.name)) fresh.set(p.name, p.type)
     callerCtx.get(func).callerLocals = fresh
   }
+  ctx.func.repByLocal = null
 }
 
 function resetParamWasmFacts(paramReps) {
@@ -361,10 +370,24 @@ export default function narrowSignatures(programFacts, ast) {
       },
     },
   ])
+  // Transitive ctor/schema propagation down call chains. A naive single-pass
+  // mergeRule poisons a callee's param on the *first* sweep if the caller's own
+  // param (the very thing that supplies the ctor) hasn't been typed yet — and the
+  // poison is sticky, so later sweeps can't recover. Two-pass was the old patch;
+  // it still loses any chain deeper than `main→f→g→h` (e.g. heapsort's siftDown).
+  // Fix: iterate a *soft* merge — propagate known ctors, treat "can't tell yet"
+  // as skip (no poison) — to a fixpoint, then one *hard* validating sweep that
+  // poisons params whose call sites still can't be proven (genuinely-untyped args).
   const runArrElemFixpoint = (field, inferFn, elemsCtxMap) => {
-    runCallsiteLattice([mergeRule(field, (arg, _k, state) =>
-      inferFn(arg, elemsCtxMap.get(state.callerFunc), state.callerParamFacts(field))
-    )])
+    const infer = (arg, _k, state) => inferFn(arg, elemsCtxMap.get(state.callerFunc), state.callerParamFacts(field))
+    let changed
+    const bump = (r, v) => { if (v == null || r[field] === null) return; const b = r[field]; mergeParamFact(r, field, v); if (r[field] !== b) changed = true }
+    const soft = {
+      missing(r, k, state) { const def = defaultArg(state, k); if (def != null) bump(r, infer(def, k, state)) },
+      apply(r, arg, k, state) { bump(r, infer(arg, k, state)) },
+    }
+    do { changed = false; runCallsiteLattice([soft]) } while (changed)
+    runCallsiteLattice([mergeRule(field, infer)])
   }
   const runArrFixpoint = () => runArrElemFixpoint('arrayElemSchema', inferArgArrElemSchema, phase.callerElems('arrElemSchemas'))
   const runArrValTypeFixpoint = () => runArrElemFixpoint('arrayElemValType', inferArgArrElemValType, phase.callerElems('arrElemValTypes'))
@@ -423,18 +446,22 @@ export default function narrowSignatures(programFacts, ast) {
       if (isBlockBody(body) && hasBareReturn(body)) continue
       const exprs = returnExprs(body)
       if (!exprs.length) continue
-      // Skip narrowing when any return-tail is `>>>` (unsigned uint32). Narrowing to i32
-      // loses the unsigned interpretation: the wrapper rebox via `f64.convert_i32_s` would
-      // sign-flip values with bit 31 set, breaking the canonical `(x >>> 0)` uint32 idiom.
-      // A future pass could track sig.unsignedResult and emit `f64.convert_i32_u` instead.
-      if (exprs.some(e => Array.isArray(e) && e[0] === '>>>')) continue
+      // Narrow result to i32 when every return-tail types as i32 (incl. bitwise ops, `|0`,
+      // and `>>>`). When ANY tail is `>>>` (unsigned uint32 idiom) we still narrow, but tag
+      // `sig.unsignedResult` so the call-site rebox uses `f64.convert_i32_u` — preserving
+      // the [0, 2^32) range that `(x >>> 0)` carries through hash/CRC finalizers.
+      const anyUnsigned = exprs.some(e => Array.isArray(e) && e[0] === '>>>')
       const savedCurrent = ctx.func.current
       ctx.func.current = func.sig
       const locals = isBlockBody(body) ? analyzeLocals(body) : new Map()
       for (const p of func.sig.params) if (!locals.has(p.name)) locals.set(p.name, p.type)
       const allI32 = exprs.every(e => exprTypeWithCalls(e, locals) === 'i32')
       ctx.func.current = savedCurrent
-      if (allI32) { func.sig.results = ['i32']; changed = true }
+      if (allI32) {
+        func.sig.results = ['i32']
+        if (anyUnsigned) func.sig.unsignedResult = true
+        changed = true
+      }
     }
   }