jz 0.7.0 → 0.8.0

package/src/helper-counters.js

@@ -0,0 +1,137 @@
+import { ctx, declGlobal, inc } from './ctx.js'
+import { findBodyStart } from './ir.js'
+
+export const HELPER_COUNTERS = [
+  ['__eq', 'eq'],
+  ['__same_value_zero', 'same_value_zero'],
+  ['__is_truthy', 'is_truthy'],
+  ['__ptr_type', 'ptr_type'],
+  ['__ptr_offset', 'ptr_offset'],
+  ['__len', 'len'],
+  ['__length', 'length'],
+  ['__typed_idx', 'typed_idx'],
+  ['__str_len', 'str_len'],
+  ['__str_eq', 'str_eq'],
+  ['__str_eq_cold', 'str_eq_cold'],
+  ['__str_hash', 'str_hash'],
+  ['__map_hash', 'map_hash'],
+  ['__hash_get_local', 'hash_get_local'],
+  ['__hash_set_local', 'hash_set_local'],
+  ['__ihash_get_local', 'ihash_get_local'],
+  ['__ihash_set_local', 'ihash_set_local'],
+  ['__dyn_get', 'dyn_get'],
+  ['__dyn_get_t', 'dyn_get_t'],
+  ['__dyn_get_t_h', 'dyn_get_t_h'],
+  ['__dyn_set', 'dyn_set'],
+  ['__arr_grow', 'arr_grow'],
+  ['__arr_grow_known', 'arr_grow_known'],
+  ['__arr_push1', 'arr_push1'],
+  ['__arr_shift', 'arr_shift'],
+  ['__alloc', 'alloc'],
+  ['__alloc_hdr', 'alloc_hdr'],
+  ['__alloc_hdr_n', 'alloc_hdr_n'],
+  ['__memgrow', 'memgrow'],
+]
+
+const COUNTER_BY_HELPER = new Map(HELPER_COUNTERS.map(([helper, label]) => [helper, `__hc_${label}`]))
+const LABEL_BY_WAT_HELPER = new Map(HELPER_COUNTERS.map(([helper, label]) => [`$${helper}`, label]))
+
+export const HELPER_SITE_PREFIX = '__hcs_'
+
+export const helperCounterName = helper => COUNTER_BY_HELPER.get(helper)
+
+export function installHelperCounters() {
+  if (!ctx.transform.helperCounters) return
+  for (const counter of COUNTER_BY_HELPER.values()) {
+    if (!ctx.scope.globals.has(counter)) declGlobal(counter, 'i64', 0, { export: counter })
+  }
+  ctx.core.stdlib.__helper_counts_reset = `(func $__helper_counts_reset (export "__helper_counts_reset")
+${[...COUNTER_BY_HELPER.values()].map(counter => `    (global.set $${counter} (i64.const 0))`).join('\n')})`
+  inc('__helper_counts_reset')
+}
+
+// Bump the helper's counter once on entry. NOTE the semantics: this counts FUNCTION
+// ENTRIES at runtime — a call site that jz inlined or specialized away (fusedRewrite,
+// specializeMkptr/specializePtrBase, …) never enters the function and is NOT counted. So
+// the numbers are a relative ranking / lower bound for picking hot helpers, not exact
+// operation counts. Good enough to choose targets; don't read them as call totals.
+export function instrumentHelperCounter(helper, fn) {
+  const counter = ctx.transform.helperCounters && helperCounterName(helper)
+  if (!counter || !Array.isArray(fn) || fn[0] !== 'func') return fn
+  fn.splice(findBodyStart(fn), 0,
+    ['global.set', `$${counter}`, ['i64.add', ['global.get', `$${counter}`], ['i64.const', 1]]])
+  return fn
+}
+
+const safeExportPart = name => String(name || 'anon')
+  .replace(/^\$/, '')
+  .replace(/[^A-Za-z0-9_.-]+/g, '_')
+  .slice(0, 80) || 'anon'
+
+const helperSiteFilter = () => {
+  const opt = ctx.transform.helperCallsites
+  if (opt === true) return null
+  const raw = Array.isArray(opt) ? opt : String(opt || '').split(',')
+  const labels = raw.map(s => String(s).trim()).filter(Boolean).map(s => s.replace(/^\$?__/, ''))
+  return labels.length ? new Set(labels) : null
+}
+
+const funcResults = fn => {
+  const out = []
+  if (!Array.isArray(fn) || fn[0] !== 'func') return out
+  for (let i = 2; i < fn.length; i++) {
+    const n = fn[i]
+    if (Array.isArray(n) && n[0] === 'result') out.push(...n.slice(1))
+  }
+  return out
+}
+
+const bumpCounter = counter =>
+  ['global.set', `$${counter}`, ['i64.add', ['global.get', `$${counter}`], ['i64.const', 1]]]
+
+// Profiling-only helper-callsite counters. Unlike instrumentHelperCounter(), this
+// answers "which compiled function executed the helper call?" by wrapping each
+// final `(call $__helper ...)` with a tiny counter block:
+//   (block (result T) (global.set $__hcs_N ...) (call $__helper ...))
+//
+// This intentionally runs after whole-module optimization. The profile should
+// observe final codegen, while production output remains byte-identical because
+// ctx.transform.helperCallsites is build-time opt-in.
+export function instrumentHelperCallsites(funcs) {
+  if (!ctx.transform.helperCallsites) return 0
+  const only = helperSiteFilter()
+
+  const resultsByName = new Map()
+  for (const fn of funcs) {
+    if (Array.isArray(fn) && fn[0] === 'func' && typeof fn[1] === 'string')
+      resultsByName.set(fn[1], funcResults(fn))
+  }
+
+  let id = 0
+  const wrap = (node, owner) => {
+    if (!Array.isArray(node)) return node
+    for (let i = 1; i < node.length; i++) node[i] = wrap(node[i], owner)
+
+    if (node[0] !== 'call' || typeof node[1] !== 'string') return node
+    const label = LABEL_BY_WAT_HELPER.get(node[1])
+    if (!label) return node
+    if (only && !only.has(label) && !only.has(node[1].replace(/^\$?__/, ''))) return node
+    const results = resultsByName.get(node[1])
+    if (!results) return node
+
+    const counter = `${HELPER_SITE_PREFIX}${id++}`
+    const ownerPart = safeExportPart(owner)
+    declGlobal(counter, 'i64', 0, { export: `${counter}:${label}:${ownerPart}` })
+    const block = ['block']
+    for (const type of results) block.push(['result', type])
+    block.push(bumpCounter(counter), node)
+    return block
+  }
+
+  for (const fn of funcs) {
+    if (!Array.isArray(fn) || fn[0] !== 'func' || typeof fn[1] !== 'string') continue
+    const bodyStart = findBodyStart(fn)
+    for (let i = bodyStart; i < fn.length; i++) fn[i] = wrap(fn[i], fn[1])
+  }
+  return id
+}

package/src/ir.js

@@ -21,8 +21,8 @@
  */
 
 import { ctx, err, inc, PTR, LAYOUT } from './ctx.js'
-import { ptrBoxPrefixBigInt, atomNanHex, nanPrefixHex } from '../layout.js'
-import { I32_MIN, I32_MAX, isI32, isLiteralStr, isFuncRef } from './ast.js'
+import { ptrBoxPrefixBigInt, ptrBits, i64Hex, atomNanHex, nanPrefixHex } from '../layout.js'
+import { I32_MIN, I32_MAX, isI32, isLiteralStr, isFuncRef, isLeaf } from './ast.js'
 import { VAL, lookupValType, repOf, repOfGlobal } from './reps.js'
 import { valTypeOf } from './kind.js'
 import { T } from './ast.js'
@@ -182,6 +182,82 @@ const narrowI32 = (x, isRoot) => {
   return null
 }
 
+// Conservative VALUE-RANGE for a pure f64 expression tree: returns { lo, hi } bounding
+// every value the node can take, or null when unknown. SOUND by construction — each rule
+// over-approximates using the SAME f64 ops the runtime uses (f64 +/−/× are monotone in
+// each argument, so combining endpoint-bounds with plain JS doubles yields bounds that
+// contain the true value). A null/non-finite endpoint anywhere collapses to null, so a
+// non-null result also PROVES the value is finite (never NaN, never ±∞). Used by toI32 to
+// drop the +∞-guard `select` (and the i64 round-trip when the value fits i32) — the guard
+// exists only to remap +∞→0, so a proof of finiteness retires it.
+const fin = (lo, hi) => (Number.isFinite(lo) && Number.isFinite(hi) && lo <= hi) ? { lo, hi } : null
+// Range of the i32 that feeds an `f64.convert_i32_*`, refined by a narrowing load width.
+const convRange = (child, signed) => {
+  if (Array.isArray(child)) {
+    const o = child[0]
+    if (o === 'i32.load8_u') return { lo: 0, hi: 255 }
+    if (o === 'i32.load8_s') return { lo: -128, hi: 127 }
+    if (o === 'i32.load16_u') return { lo: 0, hi: 65535 }
+    if (o === 'i32.load16_s') return { lo: -32768, hi: 32767 }
+    if (o === 'i32.const' && typeof child[1] === 'number') return signed ? { lo: child[1] | 0, hi: child[1] | 0 } : { lo: child[1] >>> 0, hi: child[1] >>> 0 }
+  }
+  return signed ? { lo: I32_MIN, hi: I32_MAX } : { lo: 0, hi: 4294967295 }
+}
+// `get`, when supplied, resolves a `(local.get $V)` to $V's single defining value node
+// (a `name → defExpr | null` map/function built from a one-def-per-local scan). This lets the
+// range see through the temps that inlining introduces — e.g. `floor(mul(convert($px),0.03125))`
+// stashed in `$xi` before truncation — so the i32-fit proof survives the indirection. SOUND
+// without code motion: a single-textual-def local holds exactly the value its def computes, so
+// the def's range bounds every value the local can take, even if the def's inputs vary across
+// iterations. A self-referential (loop-carried) single def is caught by the `seen` cycle guard
+// and yields null (unknown), which is conservative.
+export const f64Range = (n, get) => {
+  const seen = get ? new Set() : null
+  const r = (n) => {
+    if (!Array.isArray(n)) return null
+    const op = n[0]
+    if (op === 'local.get' && get && typeof n[1] === 'string') {
+      if (seen.has(n[1])) return null               // loop-carried / cyclic def → unknown
+      const def = typeof get === 'function' ? get(n[1]) : get.get(n[1])
+      if (!def) return null
+      seen.add(n[1]); const rng = r(def); seen.delete(n[1])
+      return rng
+    }
+    if (op === 'f64.const') return typeof n[1] === 'number' ? fin(n[1], n[1]) : null   // `nan:…`/Inf literal strings → null
+    if (op === 'f64.convert_i32_s') return convRange(n[1], true)
+    if (op === 'f64.convert_i32_u') return convRange(n[1], false)
+    if (op === 'f64.neg') { const a = r(n[1]); return a && fin(-a.hi, -a.lo) }
+    if (op === 'f64.abs') { const a = r(n[1]); return a && fin(a.lo > 0 ? a.lo : a.hi < 0 ? -a.hi : 0, Math.max(-a.lo, a.hi)) }
+    if (op === 'f64.sqrt') { const a = r(n[1]); return a && a.lo >= 0 && fin(Math.sqrt(a.lo), Math.sqrt(a.hi)) }
+    // Rounding ops preserve finiteness and are monotonic, so the range maps elementwise. This lets
+    // `Math.floor(x)|0` over a bounded x (every grid/image/audio index: `px*scale`, perm[] lookups)
+    // drop the +∞-guard + i64 round-trip in toI32 down to a single i32.trunc_sat_f64_s. `nearest`
+    // (round-half-to-even) lands in {floor,ceil} so its bounds are floor(lo)..ceil(hi).
+    if (op === 'f64.floor') { const a = r(n[1]); return a && fin(Math.floor(a.lo), Math.floor(a.hi)) }
+    if (op === 'f64.ceil')  { const a = r(n[1]); return a && fin(Math.ceil(a.lo), Math.ceil(a.hi)) }
+    if (op === 'f64.trunc') { const a = r(n[1]); return a && fin(Math.trunc(a.lo), Math.trunc(a.hi)) }
+    if (op === 'f64.nearest') { const a = r(n[1]); return a && fin(Math.floor(a.lo), Math.ceil(a.hi)) }
+    if (op === 'f64.add') { const a = r(n[1]), b = r(n[2]); return a && b && fin(a.lo + b.lo, a.hi + b.hi) }
+    if (op === 'f64.sub') { const a = r(n[1]), b = r(n[2]); return a && b && fin(a.lo - b.hi, a.hi - b.lo) }
+    if (op === 'f64.mul') {
+      const a = r(n[1]), b = r(n[2]); if (!a || !b) return null
+      const p = [a.lo * b.lo, a.lo * b.hi, a.hi * b.lo, a.hi * b.hi]
+      return fin(Math.min(...p), Math.max(...p))
+    }
+    if (op === 'f64.div') {
+      const c = Array.isArray(n[2]) && n[2][0] === 'f64.const' && typeof n[2][1] === 'number' ? n[2][1] : null
+      if (c == null || c === 0) return null               // variable / zero divisor → may be ±∞
+      const a = r(n[1]); if (!a) return null
+      const p = [a.lo / c, a.hi / c]
+      return fin(Math.min(...p), Math.max(...p))
+    }
+    if (op === 'f64.min') { const a = r(n[1]), b = r(n[2]); return a && b && fin(Math.min(a.lo, b.lo), Math.min(a.hi, b.hi)) }
+    if (op === 'f64.max') { const a = r(n[1]), b = r(n[2]); return a && b && fin(Math.max(a.lo, b.lo), Math.max(a.hi, b.hi)) }
+    return null
+  }
+  return r(n)
+}
+
 /** Coerce node to i32 with wrapping (JS `|0` semantics: values > 2^31 wrap to negative).
  *  Per ECMAScript ToInt32, NaN and ±∞ map to 0. `i64.trunc_sat_f64_s` handles NaN
  *  and -∞ correctly, but +∞ saturates to i64_max which wraps to -1 — guard +∞ via
@@ -204,15 +280,27 @@ export const toI32 = n => {
   // computes in i32 (mod-2^32 ring) — no trunc/guard at all.
   const nw = narrowI32(n, true)
   if (nw) return nw.node
+  // Value-range narrowing: a NON-integer f64 tree (e.g. `10 + 200·(u8[i]/255)`) the ring
+  // path rejects, but whose value is PROVABLY FINITE — so the +∞-guard `select` is dead.
+  // When the value also provably fits i32, a single `i32.trunc_sat_f64_s` IS exact ToInt32
+  // (no saturation can fire in-range, no NaN, no ±∞) — dropping the i64 round-trip AND the
+  // guard. Pervasive in pixel/colour packing: `(base + scale·v)|0`.
+  const rng = f64Range(n)
+  if (rng) {
+    if (rng.lo >= I32_MIN && rng.hi <= I32_MAX) return typed(['i32.trunc_sat_f64_s', n], 'i32')
+    // Finite and within (−2^63, 2^63): keep the mod-2^32 wrap, drop the (now-dead) +∞ guard.
+    // i64.trunc_sat does not saturate in this window, so wrap_i64 == ToInt32. Beyond ±2^63 we
+    // fall through to the guarded path (which already saturates there — the documented boundary).
+    if (rng.lo >= -9223372036854775808 && rng.hi < 9223372036854775808)
+      return typed(['i32.wrap_i64', ['i64.trunc_sat_f64_s', n]], 'i32')
+  }
   // Leaf nodes are cheap to duplicate; for everything else, evaluate once via local.tee.
-  const isLeaf = Array.isArray(n) && n.length <= 2 &&
-    (n[0] === 'f64.const' || n[0] === 'local.get' || n[0] === 'global.get')
   // `i32.wrap_i64(i64.trunc_sat_f64_s x)` is exact ToInt32 for |x| < 2^63 (the
   // overwhelming common range), maps NaN/−∞→0, and +∞ is guarded to 0 by the
   // select. For |x| ≥ 2^63 it saturates rather than wrapping mod 2^32 — a
   // deliberately-allowed asm.js-style boundary (no per-`|0` helper/guard cost).
   const wrap = x => typed(['i32.wrap_i64', ['i64.trunc_sat_f64_s', x]], 'i32')
-  if (isLeaf) {
+  if (isLeaf(n)) {
     return typed(['select', wrap(n), ['i32.const', 0], ['f64.ne', n, ['f64.const', Infinity]]], 'i32')
   }
   const t = temp('inf')
@@ -317,13 +405,7 @@ export const BOXED_MUTATORS = new Set(['push', 'pop', 'shift', 'unshift', 'splic
 const litI32 = n => Array.isArray(n) && n[0] === 'i32.const' && typeof n[1] === 'number' ? n[1] : null
 
 /** Pack (type, aux, offset) into the f64 NaN-box bit pattern as a hex string. */
-function packPtrBits(type, aux, offset) {
-  const bits = LAYOUT.NAN_PREFIX_BITS
-    | ((BigInt(type) & BigInt(LAYOUT.TAG_MASK)) << BigInt(LAYOUT.TAG_SHIFT))
-    | ((BigInt(aux) & BigInt(LAYOUT.AUX_MASK)) << BigInt(LAYOUT.AUX_SHIFT))
-    | (BigInt(offset >>> 0) & BigInt(LAYOUT.OFFSET_MASK))
-  return '0x' + bits.toString(16).toUpperCase().padStart(16, '0')
-}
+const packPtrBits = (type, aux, offset) => i64Hex(ptrBits(type, aux, offset))
 
 /** Build `__mkptr(type, aux, offset)` IR. Folds to `(f64.const nan:0x...)` — 9 bytes
  *  vs 12 for `f64.reinterpret_i64 (i64.const ...)` — when all args are i32 literals.
@@ -384,7 +466,7 @@ export function ptrTypeIR(valIR, valType) {
 // op on it misdispatches; BigInt64Array/BigUint64Array views and
 // DataView.{get,set}BigUint64 are a legacy f64-value shim there. Strings are
 // tagged and survive every boundary; BigInt math happens only inside single
-// expressions. (Same contract as wat/optimize.js's i64 VALUE CONTRACT.)
+// expressions. (Same contract as watr/optimize's i64 VALUE CONTRACT.)
 const _F64_BITS_BUF = new ArrayBuffer(8)
 const _F64_BITS_F = new Float64Array(_F64_BITS_BUF)
 const _F64_BITS_U32 = new Uint32Array(_F64_BITS_BUF)  // LE halves: [0]=lo, [1]=hi
@@ -1009,6 +1091,13 @@ export function readVar(name) {
     return typed(['f64.load', boxedAddr(name)], 'f64')
   }
   if (isGlobal(name)) {
+    // A module-level integer const (`const N = 16384`) is an immutable compile-time
+    // value: emit i32.const directly (when it fits i32) so `x % N` / `x & N` / `x / N`
+    // and counters bounded by N take the native integer path, instead of the global
+    // folding to an f64 constant and routing through the f64 round-trip. Value-preserving
+    // — an f64 consumer widens the i32.const via convert, which folds back to f64.const.
+    const ci = ctx.scope.constInts?.get?.(name)
+    if (ci != null && isI32(ci)) return typed(['i32.const', ci], 'i32')
     const gt = ctx.scope.globalTypes.get(name) || 'f64'
     const node = typed(['global.get', dollar(name)], gt)
     const grep = repOfGlobal(name)

package/src/kind-traits.js

@@ -5,9 +5,13 @@
 
 import { VAL } from './reps.js'
 
-export const BOOL_OPS = new Set([
-  '!', '<', '<=', '>', '>=', '==', '!=', '===', '!==', 'in', 'instanceof',
-])
+// Comparison / logical-not ops — result is a 0|1 boolean carried as i32. The one
+// source of truth for "this operator yields a boolean": valTypeOf reads it as
+// VAL.BOOL, exprType/isIntExpr read it as integer-certain. `in`/`instanceof` also
+// yield a boolean but are membership ops, kept out of the integer-certainty set
+// (they throw on BigInt operands and never reach numeric analysis).
+export const CMP_OPS = new Set(['!', '<', '<=', '>', '>=', '==', '!=', '===', '!=='])
+export const BOOL_OPS = new Set([...CMP_OPS, 'in', 'instanceof'])
 
 export const NUMERIC_BINARY_OPS = ['-', 'u-', '*', '/', '%', '&', '|', '^', '<<', '>>']
 export const NUMERIC_UNARY_OPS = new Set(['**', '++', '--', '~', '>>>', 'u+'])

package/src/kind.js

@@ -137,7 +137,16 @@ VT['?:'] = (args) => {
   const truthy = literalTruthiness(args[0])
   if (truthy != null) return valTypeOf(truthy ? args[1] : args[2])
   const ta = valTypeOf(args[1]), tb = valTypeOf(args[2])
-  return ta && ta === tb ? ta : null
+  if (ta && ta === tb) return ta
+  // A boolean branch coerces to 0/1 in numeric context (same rule as &&/||/?? below):
+  // when the other branch has a known non-boolean type, the conditional carries it.
+  // Without this, `num + (cond ? num : num>k)` sees a null-typed operand and emits the
+  // polymorphic string-concat dispatch on two pure-numeric subexprs — which pins the
+  // whole number→string formatter (__str_concat → __to_str → __static_str), a pure-int
+  // program ballooning 1 → ~19 funcs (see test/wat-invariants.js, .work/todo.md).
+  if (ta === VAL.BOOL && tb && tb !== VAL.BOOL) return tb
+  if (tb === VAL.BOOL && ta && ta !== VAL.BOOL) return ta
+  return null
 }
 
 // Value-preserving logical: `&&`/`||` return one of their operands.
@@ -162,6 +171,10 @@ VT['&&'] = VT['||'] = VT['??'] = (args) => {
 // Index access:  `arr[i]` → ['[]', arr, i].
 VT['[]'] = (args) => {
   if (args.length < 2) return VAL.ARRAY
+  // A literal NEGATIVE index is always out of range → reads undefined, not the
+  // element type. Returning a numeric elem type here would let `a[-1] === undefined`
+  // fold to false (a NUMBER can't be undefined), silently dropping the guard.
+  { const li = intLiteralValue(args[1]); if (li != null && li < 0) return null }
   // SRoA flat-array slot read: `a[k]` (static index) where `a` dissolved into
   // scalar `a#i` locals (scanFlatObjects). A write-once slot's value-type is its
   // element literal's — same numeric-binding as the `VT['.']` object case, so

package/src/op-policy.js

@@ -22,7 +22,10 @@ export const REJECT_OPS = {
 }
 
 /** Bare identifiers prepare rejects (no jzify lowering). */
-export const REJECT_IDENTS = {
+// Prototype-less (Object.create(null)): a plain `{}` inherits Object.prototype in V8, so
+// `REJECT_IDENTS['valueOf']` would return the inherited method (truthy) and wrongly reject
+// a user identifier named like an Object method. Kernel objects are already prototype-less.
+export const REJECT_IDENTS = Object.assign(Object.create(null), {
   with: '`with` not supported',
   class: '`class` not supported',
   yield: '`yield` not supported',
@@ -36,7 +39,7 @@ export const REJECT_IDENTS = {
   // identifier in sloppy JS (`var let = 5`), so rejecting it would refuse valid JS
   // (test262 language/expressions/object/let-non-strict-*).
   const: '`const` is a reserved word, not a valid name',
-}
+})
 
 /** jzify-only errors for class lowering (no prepare counterpart). */
 export const JZIFY_CLASS_ERRORS = {

package/src/ops.js

@@ -0,0 +1,119 @@
+// === AST op tags — integer-tagged-union representation ===
+// internOps (prepare->compile boundary) converts array node[0] from op STRING to its
+// integer tag; the compile half then dispatches via integer-keyed (eventually array)
+// tables, removing the per-node string-hash lookup in the self-host kernel.
+// OP: string -> int (1-based; 0 reserved => a missing tag is falsy). OPS: int -> string.
+export const OP = {
+  "!": 1,
+  "!=": 2,
+  "!==": 3,
+  "%": 4,
+  "%=": 5,
+  "&": 6,
+  "&&": 7,
+  "&&=": 8,
+  "&=": 9,
+  "(": 10,
+  "()": 11,
+  "*": 12,
+  "**": 13,
+  "*=": 14,
+  "+": 15,
+  "++": 16,
+  "+=": 17,
+  ",": 18,
+  "-": 19,
+  "--": 20,
+  "-=": 21,
+  ".": 22,
+  "...": 23,
+  "/": 24,
+  "//": 25,
+  "/=": 26,
+  ";": 27,
+  "<": 28,
+  "<<": 29,
+  "<<=": 30,
+  "<=": 31,
+  "=": 32,
+  "==": 33,
+  "===": 34,
+  "=>": 35,
+  ">": 36,
+  ">=": 37,
+  ">>": 38,
+  ">>=": 39,
+  ">>>": 40,
+  ">>>=": 41,
+  "?": 42,
+  "?:": 43,
+  "??": 44,
+  "??=": 45,
+  "[": 46,
+  "[]": 47,
+  "^": 48,
+  "^=": 49,
+  "async": 50,
+  "await": 51,
+  "bigint": 52,
+  "block": 53,
+  "bool": 54,
+  "break": 55,
+  "call": 56,
+  "catch": 57,
+  "const": 58,
+  "continue": 59,
+  "default": 60,
+  "delete": 61,
+  "export": 62,
+  "finally": 63,
+  "for": 64,
+  "if": 65,
+  "import": 66,
+  "in": 67,
+  "instanceof": 68,
+  "label": 69,
+  "let": 70,
+  "nan": 71,
+  "new": 72,
+  "return": 73,
+  "spread": 74,
+  "str": 75,
+  "strcat": 76,
+  "switch": 77,
+  "throw": 78,
+  "typeof": 79,
+  "u+": 80,
+  "u-": 81,
+  "void": 82,
+  "while": 83,
+  "yield": 84,
+  "{": 85,
+  "{}": 86,
+  "|": 87,
+  "|=": 88,
+  "||": 89,
+  "||=": 90,
+  "~": 91,
+}
+export const OPS = [null, "!", "!=", "!==", "%", "%=", "&", "&&", "&&=", "&=", "(", "()", "*", "**", "*=", "+", "++", "+=", ",", "-", "--", "-=", ".", "...", "/", "//", "/=", ";", "<", "<<", "<<=", "<=", "=", "==", "===", "=>", ">", ">=", ">>", ">>=", ">>>", ">>>=", "?", "?:", "??", "??=", "[", "[]", "^", "^=", "async", "await", "bigint", "block", "bool", "break", "call", "catch", "const", "continue", "default", "delete", "export", "finally", "for", "if", "import", "in", "instanceof", "label", "let", "nan", "new", "return", "spread", "str", "strcat", "switch", "throw", "typeof", "u+", "u-", "void", "while", "yield", "{", "{}", "|", "|=", "||", "||=", "~"]
+export const OP_COUNT = 92
+
+// Normalize an op tag to its string form for op-Set membership / switch checks,
+// so `SET.has(opStr(node[0]))` and `switch (opStr(op))` work whether node[0] is
+// still a string (intern off / non-interned op like ':') or an integer (intern
+// on). Self-host-safe: the typeof guard avoids indexing the OPS array by a string
+// (jz arrays trap on non-integer indices), and it never grows a Set.
+export const opStr = (op) => typeof op === "number" ? OPS[op] : op
+
+// Convert array node[0] from op-STRING to integer tag, recursively. Once per node at
+// the prepare boundary. Unknown op-strings stay strings (dual-keyed tables handle them
+// until the int-only phase). node[0]===null (numeric literal) stays null; identifiers
+// (bare strings at n[1+]) untouched.
+export const internOps = (n) => {
+  if (!Array.isArray(n)) return n
+  const t = n[0]
+  if (typeof t === "string") { const id = OP[t]; if (id !== undefined) n[0] = id }
+  for (let i = 1; i < n.length; i++) if (Array.isArray(n[i])) internOps(n[i])
+  return n
+}