sandboxedjs 0.1.8 → 0.1.10

package/dist/index.cjs

@@ -13328,11 +13328,11 @@ sys	${fmt2(Math.floor(ms * 0.2))}
     if (fn) return await this.callFunction(name, fn, args, assignments, io);
     const builtin = getBuiltin(name);
     if (builtin) {
-      const restore = await this.applyTemporaryAssignments(assignments, isSpecialBuiltin(name));
+      const restore2 = await this.applyTemporaryAssignments(assignments, isSpecialBuiltin(name));
       try {
         return await builtin({ shell: this, argv: words, io });
       } finally {
-        restore();
+        restore2();
       }
     }
     return await this.runExternal(words, assignments, io);
@@ -13345,7 +13345,7 @@ sys	${fmt2(Math.floor(ms * 0.2))}
     }
     const savedPositional = this.positional;
     const savedName = this.scriptName;
-    const restore = await this.applyTemporaryAssignments(assignments, true);
+    const restore2 = await this.applyTemporaryAssignments(assignments, true);
     this.positional = args;
     this.vars.pushScope();
     this.functionDepth++;
@@ -13360,7 +13360,7 @@ sys	${fmt2(Math.floor(ms * 0.2))}
       this.vars.popScope();
       this.positional = savedPositional;
       this.scriptName = savedName;
-      restore();
+      restore2();
     }
   }
   async runExternal(words, assignments, io) {
@@ -17074,7 +17074,7 @@ var AwkParser = class {
   /** `print a, b` — a comma list where `>` means redirection, not comparison. */
   parseExprList(noGt) {
     if (this.isOp("(")) {
-      const save = this.i;
+      const save2 = this.i;
       this.i++;
       const items = [];
       try {
@@ -17086,7 +17086,7 @@ var AwkParser = class {
         }
       } catch {
       }
-      this.i = save;
+      this.i = save2;
     }
     const out = [this.parseTernary(noGt)];
     while (this.eatOp(",")) {
@@ -21565,6 +21565,208 @@ var helpCmd = defineCommand({
 });
 var commands10 = [man, whatis, apropos, less, helpCmd];
 
+// src/runtime/child-process-shim.ts
+var CHILD_PROCESS_SHIM = `
+(function () {
+ try {
+  var cp;
+  try { cp = require('child_process'); } catch (e) { return; }
+  if (!cp) return;
+  // The module is a proxy that rejects plain assignment, so the "already
+  // patched" flag cannot live on it.
+  if (globalThis.__sbxChildProcessPatched) return;
+  globalThis.__sbxChildProcessPatched = true;
+
+  var fs = require('fs');
+  var path = require('path');
+
+  function head(file) {
+    try {
+      var fd = fs.openSync(file, 'r');
+      var buf = Buffer.alloc(64);
+      var read = fs.readSync(fd, buf, 0, 64, 0);
+      fs.closeSync(fd);
+      return buf.subarray(0, read);
+    } catch (e) { return null; }
+  }
+
+  // Kept in step with src/runtime/native-format.ts and src/runtime/wasm.ts.
+  var MACHINES = { 0x03: 'x86', 0x28: 'ARM', 0x3e: 'x86-64', 0xb7: 'AArch64', 0xf3: 'RISC-V' };
+  function classify(bytes) {
+    if (!bytes || bytes.length < 4) return null;
+    if (bytes[0] === 0x00 && bytes[1] === 0x61 && bytes[2] === 0x73 && bytes[3] === 0x6d) {
+      return 'WebAssembly module';
+    }
+    if (bytes[0] === 0x7f && bytes[1] === 0x45 && bytes[2] === 0x4c && bytes[3] === 0x46) {
+      var machine = bytes.length >= 20 ? bytes.readUInt16LE(18) : 0;
+      return 'ELF ' + (bytes[4] === 2 ? '64-bit' : '32-bit') + ' executable, ' +
+        (MACHINES[machine] || ('machine 0x' + machine.toString(16)));
+    }
+    var magic = bytes.readUInt32BE(0);
+    if (magic === 0xfeedface || magic === 0xfeedfacf || magic === 0xcefaedfe ||
+        magic === 0xcffaedfe || magic === 0xcafebabe) return 'Mach-O executable (macOS)';
+    if (bytes[0] === 0x4d && bytes[1] === 0x5a) return 'PE executable (Windows)';
+    return null;
+  }
+
+  function locate(command) {
+    if (typeof command !== 'string' || command === '') return null;
+    if (command.indexOf('/') >= 0) {
+      try { return fs.existsSync(command) ? command : null; } catch (e) { return null; }
+    }
+    var dirs = String(process.env.PATH || '').split(':');
+    for (var i = 0; i < dirs.length; i++) {
+      if (!dirs[i]) continue;
+      var candidate = path.join(dirs[i], command);
+      try { if (fs.existsSync(candidate)) return candidate; } catch (e) {}
+    }
+    return null;
+  }
+
+  /** null when the command looks runnable; otherwise why it is not. */
+  function diagnose(command) {
+    var found = locate(command);
+    if (found === null) {
+      return {
+        code: 'ENOENT',
+        lines: [
+          command + ': not found.',
+          'Nothing at that path, and nothing by that name on $PATH. A package whose',
+          'install step downloads a prebuilt binary will land here, because the',
+          'download either failed or produced a file this container cannot use.',
+        ],
+      };
+    }
+    var kind = classify(head(found));
+    if (kind === null || kind === 'WebAssembly module') return null;
+    if (kind.indexOf('ELF') === 0) {
+      // The container does run these \u2014 on the emulated CPU, dispatched by the
+      // kernel. What cannot reach that is child_process from inside a Node
+      // script, which is served by the pod's own shell.
+      return {
+        code: 'ENOEXEC',
+        lines: [
+          found + ': ' + kind + '.',
+          'The container can run this from the shell, on its emulated x86-64 CPU, but',
+          'child_process inside a Node script cannot reach it. Run it from the shell.',
+        ],
+      };
+    }
+    return {
+      code: 'ENOEXEC',
+      lines: [
+        found + ': ' + kind + '.',
+        'This container runs x86-64 Linux binaries, JavaScript and WebAssembly. It',
+        'does not emulate other operating systems, so this file cannot start.',
+      ],
+    };
+  }
+
+  function report(problem) {
+    try {
+      for (var i = 0; i < problem.lines.length; i++) {
+        process.stderr.write(problem.lines[i] + '\\n');
+      }
+    } catch (e) {}
+  }
+
+  /** A plain, writable stand-in for the module, with the wrappers applied. */
+  var replacement = null;
+  function wrapModule(module) {
+    if (replacement) return replacement;
+    var out = {};
+    try {
+      for (var key in module) {
+        try { out[key] = module[key]; } catch (e) {}
+      }
+    } catch (e) {}
+    // Reading through the proxy by name, in case enumeration reported nothing.
+    ['spawn', 'spawnSync', 'exec', 'execSync', 'execFile', 'execFileSync', 'fork', 'ChildProcess']
+      .forEach(function (name) {
+        try { if (out[name] === undefined) out[name] = module[name]; } catch (e) {}
+      });
+
+    var spawn = out.spawn;
+    if (typeof spawn === 'function') {
+      out.spawn = function (command) {
+        var problem = diagnose(command);
+        if (problem) report(problem);
+        var child = spawn.apply(module, arguments);
+        if (problem && child && typeof child.emit === 'function') {
+          // Real Node reports a failed exec through 'error', not 'exit'.
+          // Scripts that listen get their handler; scripts that do not get a
+          // crash, which is the point \u2014 an unnoticed failure is worse.
+          var error = new Error('spawn ' + command + ' ' + problem.code);
+          error.code = problem.code;
+          error.syscall = 'spawn ' + command;
+          error.path = command;
+          process.nextTick(function () {
+            try { child.emit('error', error); } catch (e) {}
+          });
+        }
+        return child;
+      };
+    }
+
+    ['spawnSync', 'execFile', 'execFileSync', 'exec', 'execSync'].forEach(function (name) {
+      var original = out[name];
+      if (typeof original !== 'function') return;
+      out[name] = function (command) {
+        // exec/execSync take a whole command line; the program is its first word.
+        var program = (name === 'exec' || name === 'execSync')
+          ? String(command || '').trim().split(/\\s+/)[0]
+          : command;
+        var problem = diagnose(program);
+        if (problem) report(problem);
+        return original.apply(module, arguments);
+      };
+    });
+
+    replacement = out;
+    return out;
+  }
+
+  function isChildProcess(id) {
+    return id === 'child_process' || id === 'node:child_process';
+  }
+
+  // Preferred: patch the loader itself, so a spawn inside a dependency is
+  // covered too. Not always reachable, hence the fallback below.
+  try {
+    var moduleModule = require('module');
+    var Mod = moduleModule && (moduleModule.Module || moduleModule.default);
+    if (Mod && Mod.prototype && typeof Mod.prototype.require === 'function') {
+      var protoRequire = Mod.prototype.require;
+      Mod.prototype.require = function (id) {
+        var loaded = protoRequire.apply(this, arguments);
+        return isChildProcess(id) ? wrapModule(loaded) : loaded;
+      };
+    }
+  } catch (e) { /* fall through to the local require */ }
+
+  // Always: this script's own require, which is where launcher scripts call in.
+  try {
+    var realRequire = require;
+    require = function (id) {
+      var loaded = realRequire.apply(this, arguments);
+      return isChildProcess(id) ? wrapModule(loaded) : loaded;
+    };
+    // require.main === module, and require.resolve, are load-bearing for many
+    // entry points; carry every property across.
+    for (var prop in realRequire) {
+      try { require[prop] = realRequire[prop]; } catch (e) {}
+    }
+    ['main', 'resolve', 'cache', 'extensions'].forEach(function (prop) {
+      try { if (require[prop] === undefined) require[prop] = realRequire[prop]; } catch (e) {}
+    });
+  } catch (e) { /* nothing else to try */ }
+ } catch (e) {
+  /* The pod may expose child_process as a sealed proxy. Diagnosis is a
+   * courtesy; never let it stop the script it was meant to help. */
+ }
+})();
+`;
+
 // src/runtime/node.ts
 init_path();
 var NODE_VERSION = "v22.12.0";
@@ -21600,7 +21802,7 @@ function buildPrelude(scriptPath, argv, stdinPath) {
   const argvLiteral = JSON.stringify(["/usr/bin/node", scriptPath, ...argv]);
   const pathLiteral = JSON.stringify(scriptPath);
   const stdinLiteral = JSON.stringify(stdinPath);
-  return `${BUFFER_COMPAT_SHIM}
+  return `${BUFFER_COMPAT_SHIM}${CHILD_PROCESS_SHIM}
 process.argv = ${argvLiteral};
 try {
   __filename = ${pathLiteral};
@@ -21823,7 +22025,7 @@ __sbxStdin.isTTY = false;
 __sbxStdin.setRawMode = function () { return this; };
 try { Object.defineProperty(process, 'stdin', { value: __sbxStdin, configurable: true, writable: true }); } catch (e) { process.stdin = __sbxStdin; }
 ` : "";
-  return `${BUFFER_COMPAT_SHIM}process.argv = ${JSON.stringify(argv)};
+  return `${BUFFER_COMPAT_SHIM}${CHILD_PROCESS_SHIM}process.argv = ${JSON.stringify(argv)};
 ${prelude}${source}
 `;
 }
@@ -22796,14 +22998,14 @@ var WasiPreview1 = class {
     this.randomFill = opts.randomFill ?? ((buffer) => {
       for (let i = 0; i < buffer.length; i++) buffer[i] = Math.floor(Math.random() * 256);
     });
-    const blank = { pos: 0, data: new Uint8Array(0), dirty: false, fdflags: 0, rights: RIGHTS_ALL };
-    this.fds.set(0, { kind: "stdin", path: "/dev/stdin", ...blank, data: opts.stdin ?? new Uint8Array(0) });
-    this.fds.set(1, { kind: "stdout", path: "/dev/stdout", ...blank });
-    this.fds.set(2, { kind: "stderr", path: "/dev/stderr", ...blank });
+    const blank2 = { pos: 0, data: new Uint8Array(0), dirty: false, fdflags: 0, rights: RIGHTS_ALL };
+    this.fds.set(0, { kind: "stdin", path: "/dev/stdin", ...blank2, data: opts.stdin ?? new Uint8Array(0) });
+    this.fds.set(1, { kind: "stdout", path: "/dev/stdout", ...blank2 });
+    this.fds.set(2, { kind: "stderr", path: "/dev/stderr", ...blank2 });
     const preopens = opts.preopens ?? { "/": "/", ".": opts.cwd };
     for (const [name, path] of Object.entries(preopens)) {
       const fd = this.nextFd++;
-      this.fds.set(fd, { kind: "dir", path, ...blank, preopen: name });
+      this.fds.set(fd, { kind: "dir", path, ...blank2, preopen: name });
     }
   }
   /** Give the host access to the instantiated module's memory. */
@@ -23462,6 +23664,9 @@ async function compile(ctx, path) {
   compiled2.set(path, { mtimeMs: st.mtimeMs, size: st.size, module });
   return module;
 }
+function clearWasmCache() {
+  compiled2.clear();
+}
 async function runWasi(ctx, path, argv0) {
   let module;
   try {
@@ -23633,50 +23838,13 @@ function wasmCommands() {
 
 // src/runtime/native-format.ts
 init_path();
-var ELF_MACHINES = {
-  2: "SPARC",
-  3: "x86",
-  8: "MIPS",
-  20: "PowerPC",
-  21: "PowerPC 64-bit",
-  22: "S/390",
-  40: "ARM",
-  42: "SuperH",
-  50: "IA-64",
-  62: "x86-64",
-  183: "AArch64",
-  243: "RISC-V"
-};
-var ELF_TYPES = {
-  1: "relocatable",
-  2: "executable",
-  3: "shared object",
-  4: "core dump"
-};
-function describeElf(head2) {
-  const bits = head2[4] === 2 ? "64-bit" : "32-bit";
-  const endian = head2[5] === 2 ? "MSB" : "LSB";
-  if (head2.length < 20) return `ELF ${bits} ${endian} object`;
-  const view = new DataView(head2.buffer, head2.byteOffset, head2.byteLength);
-  const little = head2[5] !== 2;
-  const type = ELF_TYPES[view.getUint16(16, little)] ?? "object";
-  const machine = view.getUint16(18, little);
-  return `ELF ${bits} ${endian} ${type}, ${ELF_MACHINES[machine] ?? `machine 0x${machine.toString(16)}`}`;
-}
 var SUGGEST_WASM = [
-  "Nothing in this container can execute machine code \u2014 there is no CPU here to",
-  "run it on, only JavaScript and WebAssembly.",
+  "This container runs x86-64 Linux binaries on an emulated CPU, plus JavaScript",
+  "and WebAssembly natively. It does not emulate other operating systems.",
   "",
-  "If the tool has a WebAssembly build, it will run here as-is: drop the .wasm",
-  "file in /usr/local/bin, chmod +x it, and call it by name."
+  "A Linux build of the same tool will run here. So will a WebAssembly build:",
+  "drop the .wasm file in /usr/local/bin, chmod +x it, and call it by name."
 ];
-var elfFormat = {
-  name: "elf",
-  priority: 20,
-  matches: (head2) => head2.length >= 4 && head2[0] === 127 && head2[1] === 69 && head2[2] === 76 && head2[3] === 70,
-  describe: describeElf,
-  explain: (head2, path) => [`${basename(path)}: ${describeElf(head2)}.`, ...SUGGEST_WASM]
-};
 var machoFormat = {
   name: "mach-o",
   priority: 20,
@@ -23697,146 +23865,3149 @@ var peFormat = {
   explain: (_head, path) => [`${basename(path)}: PE executable (Windows native binary).`, ...SUGGEST_WASM]
 };
 function nativeFormats() {
-  return [elfFormat, machoFormat, peFormat];
+  return [machoFormat, peFormat];
 }
-var DECLARES_EXPORTS = /(?:^|[\s;{)])(?:var|let|const|function|class)\s+exports\b/;
-var NAME = "exports";
-function renameShadowedExports(source) {
-  if (!DECLARES_EXPORTS.test(source)) return null;
-  let ast;
-  try {
-    ast = acorn.parse(source, {
-      ecmaVersion: "latest",
-      sourceType: "module",
-      allowAwaitOutsideFunction: true,
-      allowHashBang: true
-    });
-  } catch {
-    return null;
+
+// src/runtime/x86/cpu.ts
+var RAX = 0;
+var RCX = 1;
+var RDX = 2;
+var RBX = 3;
+var RSP = 4;
+var RBP = 5;
+var RSI = 6;
+var RDI = 7;
+var R8 = 8;
+var R9 = 9;
+var R10 = 10;
+var R11 = 11;
+var MASK64 = (1n << 64n) - 1n;
+function maskFor(size) {
+  return (1n << BigInt(size * 8)) - 1n;
+}
+function signed(value, size) {
+  const bits = BigInt(size * 8);
+  const sign = 1n << bits - 1n;
+  return value & sign ? value - (1n << bits) : value;
+}
+var ProcessExit = class extends Error {
+  constructor(code) {
+    super(`exit ${code}`);
+    this.code = code;
+    this.name = "ProcessExit";
   }
-  const body = ast.body;
-  const isModule = body.some(
-    (node2) => node2.type.startsWith("Import") || node2.type.startsWith("Export")
-  );
-  if (!isModule) return null;
-  const programScope = { bindsExports: hoistedNames(body).has(NAME), parent: null };
-  if (!programScope.bindsExports) return null;
-  const targets = [];
-  let bail = false;
-  visit(ast, programScope);
-  if (bail || targets.length === 0) return null;
-  const replacement = freshName(source);
-  let out = source;
-  for (const target of [...targets].sort((a, b) => b.start - a.start)) {
-    const text = target.shorthand ? `${NAME}: ${replacement}` : replacement;
-    out = out.slice(0, target.start) + text + out.slice(target.end);
+  code;
+};
+var UnsupportedInstruction = class extends Error {
+  constructor(opcode, rip) {
+    super(`unsupported instruction ${opcode} at 0x${rip.toString(16)}`);
+    this.opcode = opcode;
+    this.rip = rip;
+    this.name = "UnsupportedInstruction";
+  }
+  opcode;
+  rip;
+};
+var Cpu = class _Cpu {
+  memory;
+  regs = new BigUint64Array(16);
+  rip = 0;
+  // Flags, held individually rather than packed: every arithmetic instruction
+  // touches several, and packing would mean masking on each one.
+  cf = false;
+  zf = false;
+  sf = false;
+  of = false;
+  pf = false;
+  af = false;
+  df = false;
+  /** `%fs` base, which is where thread-local storage lives on x86-64 Linux. */
+  fsBase = 0;
+  gsBase = 0;
+  /**
+   * The sixteen 128-bit vector registers, split into halves.
+   *
+   * Not optional extras: a compiler zeroes memory with `xorps`/`movups` and
+   * finds a NUL byte with `pcmpeqb`/`pmovmskb`, so ordinary code reaches for
+   * these within the first hundred instructions. Only the moves, the bitwise
+   * operations and the byte compares are implemented — the arithmetic that
+   * makes SSE interesting for numerics is not, and raises the usual error.
+   */
+  xmmLo = new BigUint64Array(16);
+  xmmHi = new BigUint64Array(16);
+  instructions = 0;
+  limit;
+  onSyscall;
+  /* Decoder state for the instruction being executed. */
+  rex = 0;
+  hasRex = false;
+  opSize = 4;
+  addrSize = 8;
+  rep = 0;
+  // 0xf3 or 0xf2 when present
+  opcodeStart = 0;
+  constructor(opts) {
+    this.memory = opts.memory;
+    this.onSyscall = opts.onSyscall;
+    this.limit = opts.instructionLimit ?? 2e9;
   }
-  return out;
-  function visit(node2, scope) {
-    if (bail) return;
-    let childScope = scope;
-    let skip = NOTHING;
-    switch (node2.type) {
-      case "FunctionDeclaration":
-      case "FunctionExpression":
-      case "ArrowFunctionExpression": {
-        const names = /* @__PURE__ */ new Set();
-        for (const param of node2.params ?? []) collectPattern(param, names);
-        if (isExports(node2.id) && node2.type === "FunctionExpression") names.add(NAME);
-        const fnBody = node2.body;
-        if (fnBody?.type === "BlockStatement") {
-          for (const name of hoistedNames(fnBody.body)) names.add(name);
-        }
-        childScope = { bindsExports: names.has(NAME), parent: scope };
-        break;
-      }
-      case "CatchClause": {
-        const names = /* @__PURE__ */ new Set();
-        if (node2.param) collectPattern(node2.param, names);
-        childScope = { bindsExports: names.has(NAME), parent: scope };
-        break;
+  get(index) {
+    return this.regs[index];
+  }
+  set(index, value) {
+    this.regs[index] = value & MASK64;
+  }
+  /* ── instruction stream ─────────────────────────────────────────────────── */
+  fetch8() {
+    return this.memory.read8(this.rip++);
+  }
+  fetch(size) {
+    const value = this.memory.read(this.rip, size);
+    this.rip += size;
+    return value;
+  }
+  fetchSigned(size) {
+    return signed(this.fetch(size), size);
+  }
+  /* ── register file ──────────────────────────────────────────────────────── */
+  /**
+   * Read a register at a given width.
+   *
+   * The 8-bit encodings are the awkward part: with no REX prefix, indices 4–7
+   * name AH/CH/DH/BH — the *high* byte of the first four registers — while any
+   * REX prefix at all reassigns them to SPL/BPL/SIL/DIL.
+   */
+  readReg(index, size) {
+    if (size === 1 && !this.hasRex && index >= 4 && index < 8) {
+      return this.regs[index - 4] >> 8n & 0xffn;
+    }
+    return this.regs[index] & maskFor(size);
+  }
+  writeReg(index, size, value) {
+    if (size === 1 && !this.hasRex && index >= 4 && index < 8) {
+      const target = index - 4;
+      this.regs[target] = this.regs[target] & ~0xff00n | (value & 0xffn) << 8n;
+      return;
+    }
+    if (size === 8) {
+      this.regs[index] = value & MASK64;
+    } else if (size === 4) {
+      this.regs[index] = value & 0xffffffffn;
+    } else {
+      const mask = maskFor(size);
+      this.regs[index] = this.regs[index] & ~mask | value & mask;
+    }
+  }
+  /* ── ModRM ──────────────────────────────────────────────────────────────── */
+  modrm = {
+    mod: 0,
+    reg: 0,
+    rm: 0,
+    address: 0,
+    isReg: false
+  };
+  /** Decode a ModRM byte, resolving the effective address when there is one. */
+  decodeModrm() {
+    const byte = this.fetch8();
+    const mod = byte >> 6;
+    const reg = byte >> 3 & 7 | ((this.rex & 4) !== 0 ? 8 : 0);
+    let rm2 = byte & 7 | ((this.rex & 1) !== 0 ? 8 : 0);
+    const segment = this.takeSegment();
+    if (mod === 3) {
+      this.modrm = { mod, reg, rm: rm2, address: 0, isReg: true };
+      return;
+    }
+    let address = segment;
+    const rmLow = byte & 7;
+    if (rmLow === 4) {
+      const sib = this.fetch8();
+      const scale = 1 << (sib >> 6);
+      const indexReg = sib >> 3 & 7 | ((this.rex & 2) !== 0 ? 8 : 0);
+      const baseReg = sib & 7 | ((this.rex & 1) !== 0 ? 8 : 0);
+      if (indexReg !== 4) address += Number(BigInt.asIntN(64, this.regs[indexReg])) * scale;
+      if ((sib & 7) === 5 && mod === 0) {
+        address += Number(this.fetchSigned(4));
+      } else {
+        address += Number(BigInt.asIntN(64, this.regs[baseReg]));
       }
-      case "ClassDeclaration":
-      case "ClassExpression":
-        if (isExports(node2.id) && node2.type === "ClassExpression") {
-          childScope = { bindsExports: true, parent: scope };
-        }
-        break;
-      case "BlockStatement":
-      case "StaticBlock":
-        if (node2 !== ast.body) {
-          childScope = {
-            bindsExports: blockNames(node2.body).has(NAME),
-            parent: scope
-          };
-        }
-        break;
-      case "ForStatement":
-      case "ForInStatement":
-      case "ForOfStatement": {
-        const head2 = node2.init ?? node2.left;
-        if (head2?.type === "VariableDeclaration" && head2.kind !== "var") {
-          const names = /* @__PURE__ */ new Set();
-          for (const declarator of head2.declarations) {
-            collectPattern(declarator.id, names);
+      rm2 = baseReg;
+    } else if (rmLow === 5 && mod === 0) {
+      const displacement = Number(this.fetchSigned(4));
+      this.modrm = { mod, reg, rm: -1, address: displacement + segment, isReg: false };
+      this.ripRelative = true;
+      return;
+    } else {
+      address += Number(BigInt.asIntN(64, this.regs[rm2]));
+    }
+    if (mod === 1) address += Number(this.fetchSigned(1));
+    else if (mod === 2) address += Number(this.fetchSigned(4));
+    this.modrm = { mod, reg, rm: rm2, address, isReg: false };
+  }
+  ripRelative = false;
+  /**
+   * Finish a RIP-relative address once the whole instruction has been decoded.
+   * Called by the operand accessors, which run after any immediate is read.
+   */
+  effectiveAddress() {
+    if (this.ripRelative) {
+      this.ripRelative = false;
+      this.modrm.address += this.rip;
+    }
+    return this.modrm.address;
+  }
+  readRm(size) {
+    if (this.modrm.isReg) return this.readReg(this.modrm.rm, size);
+    return this.memory.read(this.effectiveAddress(), size);
+  }
+  writeRm(size, value) {
+    if (this.modrm.isReg) this.writeReg(this.modrm.rm, size, value);
+    else this.memory.write(this.effectiveAddress(), size, value & maskFor(size));
+  }
+  /* ── flags ──────────────────────────────────────────────────────────────── */
+  setLogicFlags(result, size) {
+    const masked = result & maskFor(size);
+    this.zf = masked === 0n;
+    this.sf = signed(masked, size) < 0n;
+    this.cf = false;
+    this.of = false;
+    this.pf = parity(masked);
+  }
+  setAddFlags(a, b, result, size) {
+    const mask = maskFor(size);
+    const masked = result & mask;
+    this.zf = masked === 0n;
+    this.sf = signed(masked, size) < 0n;
+    this.cf = result > mask;
+    const sa = signed(a & mask, size) < 0n;
+    const sb = signed(b & mask, size) < 0n;
+    const sr = signed(masked, size) < 0n;
+    this.of = sa === sb && sr !== sa;
+    this.af = ((a ^ b ^ masked) & 0x10n) !== 0n;
+    this.pf = parity(masked);
+  }
+  setSubFlags(a, b, result, size) {
+    const mask = maskFor(size);
+    const masked = result & mask;
+    this.zf = masked === 0n;
+    this.sf = signed(masked, size) < 0n;
+    this.cf = (a & mask) < (b & mask);
+    const sa = signed(a & mask, size) < 0n;
+    const sb = signed(b & mask, size) < 0n;
+    const sr = signed(masked, size) < 0n;
+    this.of = sa !== sb && sr !== sa;
+    this.af = ((a ^ b ^ masked) & 0x10n) !== 0n;
+    this.pf = parity(masked);
+  }
+  /** Evaluate one of the sixteen condition codes shared by Jcc/SETcc/CMOVcc. */
+  condition(code) {
+    switch (code) {
+      case 0:
+        return this.of;
+      case 1:
+        return !this.of;
+      case 2:
+        return this.cf;
+      case 3:
+        return !this.cf;
+      case 4:
+        return this.zf;
+      case 5:
+        return !this.zf;
+      case 6:
+        return this.cf || this.zf;
+      case 7:
+        return !this.cf && !this.zf;
+      case 8:
+        return this.sf;
+      case 9:
+        return !this.sf;
+      case 10:
+        return this.pf;
+      case 11:
+        return !this.pf;
+      case 12:
+        return this.sf !== this.of;
+      case 13:
+        return this.sf === this.of;
+      case 14:
+        return this.zf || this.sf !== this.of;
+      default:
+        return !this.zf && this.sf === this.of;
+    }
+  }
+  /* ── stack ──────────────────────────────────────────────────────────────── */
+  push(value) {
+    const rsp = Number(this.regs[RSP]) - 8;
+    this.regs[RSP] = BigInt(rsp);
+    this.memory.write(rsp, 8, value & MASK64);
+  }
+  pop() {
+    const rsp = Number(this.regs[RSP]);
+    const value = this.memory.read(rsp, 8);
+    this.regs[RSP] = BigInt(rsp + 8);
+    return value;
+  }
+  /* ── main loop ──────────────────────────────────────────────────────────── */
+  /**
+   * Run until the guest exits.
+   *
+   * Yields to the event loop periodically: the interpreter is synchronous, and
+   * without this a long-running guest would block the host completely.
+   */
+  async run() {
+    for (; ; ) {
+      try {
+        for (let slice = 0; slice < 2e5; slice++) {
+          const pending = this.step();
+          if (pending !== null) await pending;
+          if (++this.instructions > this.limit) {
+            throw new Error(`instruction limit reached (${this.limit})`);
           }
-          childScope = { bindsExports: names.has(NAME), parent: scope };
         }
-        break;
+      } catch (e) {
+        if (e instanceof ProcessExit) return e.code;
+        throw e;
       }
-      /* `export { exports }` would have to become `exports as exports`, and
-       * `import { exports as x }` names someone else's binding. Neither is
-       * worth handling; refuse rather than rewrite them wrongly. */
-      case "ExportSpecifier":
-      case "ImportSpecifier":
-        if (isExports(node2.local) || isExports(node2.exported) || isExports(node2.imported)) {
-          bail = true;
-        }
-        return;
-      case "Identifier":
-        if (node2.name === NAME && resolvesToProgram(scope)) {
-          targets.push({ start: node2.start, end: node2.end, shorthand: false });
-        }
-        return;
-      // Property positions are names, not references to the binding.
-      case "MemberExpression":
-      case "MethodDefinition":
-      case "PropertyDefinition":
-        skip = node2.computed ? NOTHING : PROPERTY;
-        break;
-      case "Property":
-        if (node2.computed) break;
-        if (node2.shorthand) {
-          const value = node2.value;
-          if (isExports(value) && resolvesToProgram(scope)) {
-            targets.push({ start: value.start, end: value.end, shorthand: true });
-          }
-          return;
-        }
-        skip = PROPERTY;
-        break;
-      case "LabeledStatement":
-      case "BreakStatement":
-      case "ContinueStatement":
-        skip = LABEL;
-        break;
+      await new Promise((resolve2) => setImmediate(resolve2));
     }
-    for (const [key, value] of Object.entries(node2)) {
-      if (key === "type" || key === "start" || key === "end" || skip.includes(key)) continue;
-      if (Array.isArray(value)) {
-        for (const item of value) if (isNode2(item)) visit(item, childScope);
-      } else if (isNode2(value)) {
-        visit(value, childScope);
+  }
+  /**
+   * Execute one instruction. Returns a promise only when the instruction was a
+   * syscall that needs to await, so the common path allocates nothing.
+   */
+  step() {
+    this.opcodeStart = this.rip;
+    this.rex = 0;
+    this.hasRex = false;
+    this.opSize = 4;
+    this.addrSize = 8;
+    this.rep = 0;
+    this.ripRelative = false;
+    for (; ; ) {
+      const byte = this.memory.read8(this.rip);
+      if (byte === 102) {
+        this.opSize = 2;
+        this.rip++;
+      } else if (byte === 103) {
+        this.addrSize = 4;
+        this.rip++;
+      } else if (byte === 242 || byte === 243) {
+        this.rep = byte;
+        this.rip++;
+      } else if (byte === 46 || byte === 54 || byte === 62 || byte === 38) {
+        this.rip++;
+      } else if (byte === 100) {
+        this.rip++;
+        this.segmentBase = this.fsBase;
+      } else if (byte === 101) {
+        this.rip++;
+        this.segmentBase = this.gsBase;
+      } else if (byte === 240) {
+        this.rip++;
+      } else if (byte >= 64 && byte <= 79) {
+        this.rex = byte & 15;
+        this.hasRex = true;
+        if (byte & 8) this.opSize = 8;
+        this.rip++;
+      } else {
+        break;
       }
     }
+    const opcode = this.fetch8();
+    return this.execute(opcode);
   }
-}
-function resolvesToProgram(scope) {
-  for (let current = scope; current; current = current.parent) {
-    if (current.bindsExports) return current.parent === null;
+  /** Set by an `fs:`/`gs:` prefix, consumed by the next memory operand. */
+  segmentBase = 0;
+  takeSegment() {
+    const base = this.segmentBase;
+    this.segmentBase = 0;
+    return base;
   }
-  return false;
-}
+  execute(opcode) {
+    const size = this.opSize;
+    const arith = ARITH_BY_OPCODE[opcode & 248];
+    if (arith !== void 0 && (opcode & 7) <= 5) {
+      const form = opcode & 7;
+      if (form === 0 || form === 1) {
+        const width = form === 0 ? 1 : size;
+        this.decodeModrm();
+        const b = this.readReg(this.modrm.reg, width);
+        const a = this.readRm(width);
+        const result = this.applyArith(arith, a, b, width);
+        if (arith !== "cmp") this.writeRm(width, result);
+      } else if (form === 2 || form === 3) {
+        const width = form === 2 ? 1 : size;
+        this.decodeModrm();
+        const a = this.readReg(this.modrm.reg, width);
+        const b = this.readRm(width);
+        const result = this.applyArith(arith, a, b, width);
+        if (arith !== "cmp") this.writeReg(this.modrm.reg, width, result);
+      } else {
+        const width = form === 4 ? 1 : size;
+        const immSize = width === 8 ? 4 : width;
+        const b = signed(this.fetch(immSize), immSize) & maskFor(width);
+        const a = this.readReg(RAX, width);
+        const result = this.applyArith(arith, a, b, width);
+        if (arith !== "cmp") this.writeReg(RAX, width, result);
+      }
+      return null;
+    }
+    switch (opcode) {
+      case 15:
+        return this.executeTwoByte(this.fetch8());
+      /* ── stack ────────────────────────────────────────────────────────── */
+      case 80:
+      case 81:
+      case 82:
+      case 83:
+      case 84:
+      case 85:
+      case 86:
+      case 87:
+        this.push(this.regs[opcode - 80 | ((this.rex & 1) !== 0 ? 8 : 0)]);
+        return null;
+      case 88:
+      case 89:
+      case 90:
+      case 91:
+      case 92:
+      case 93:
+      case 94:
+      case 95:
+        this.regs[opcode - 88 | ((this.rex & 1) !== 0 ? 8 : 0)] = this.pop();
+        return null;
+      case 104:
+        this.push(signed(this.fetch(4), 4) & MASK64);
+        return null;
+      case 106:
+        this.push(signed(this.fetch(1), 1) & MASK64);
+        return null;
+      /* ── movsxd ───────────────────────────────────────────────────────── */
+      case 99: {
+        this.decodeModrm();
+        const value = signed(this.readRm(4), 4);
+        this.writeReg(this.modrm.reg, size, value & maskFor(size));
+        return null;
+      }
+      /* ── imul with immediate ──────────────────────────────────────────── */
+      case 105:
+      case 107: {
+        this.decodeModrm();
+        const a = signed(this.readRm(size), size);
+        const immSize = opcode === 107 ? 1 : size === 8 ? 4 : size;
+        const b = signed(this.fetch(immSize), immSize);
+        const full = a * b;
+        const truncated = full & maskFor(size);
+        this.writeReg(this.modrm.reg, size, truncated);
+        this.of = this.cf = signed(truncated, size) !== full;
+        return null;
+      }
+      /* ── conditional jumps ────────────────────────────────────────────── */
+      case 112:
+      case 113:
+      case 114:
+      case 115:
+      case 116:
+      case 117:
+      case 118:
+      case 119:
+      case 120:
+      case 121:
+      case 122:
+      case 123:
+      case 124:
+      case 125:
+      case 126:
+      case 127: {
+        const offset = Number(this.fetchSigned(1));
+        if (this.condition(opcode & 15)) this.rip += offset;
+        return null;
+      }
+      /* ── group 1: arithmetic with immediate ───────────────────────────── */
+      case 128:
+      case 129:
+      case 131: {
+        const width = opcode === 128 ? 1 : size;
+        this.decodeModrm();
+        const immSize = opcode === 129 ? width === 8 ? 4 : width : 1;
+        this.rip;
+        const peek = this.peekImmediate(immSize);
+        const b = signed(peek, immSize) & maskFor(width);
+        const a = this.readRm(width);
+        const op = ARITH_BY_INDEX[this.modrm.reg & 7];
+        const result = this.applyArith(op, a, b, width);
+        if (op !== "cmp") this.writeRm(width, result);
+        return null;
+      }
+      /* ── test / xchg / mov ────────────────────────────────────────────── */
+      case 132:
+      case 133: {
+        const width = opcode === 132 ? 1 : size;
+        this.decodeModrm();
+        const a = this.readRm(width);
+        const b = this.readReg(this.modrm.reg, width);
+        this.setLogicFlags(a & b, width);
+        return null;
+      }
+      case 134:
+      case 135: {
+        const width = opcode === 134 ? 1 : size;
+        this.decodeModrm();
+        const a = this.readRm(width);
+        const b = this.readReg(this.modrm.reg, width);
+        this.writeRm(width, b);
+        this.writeReg(this.modrm.reg, width, a);
+        return null;
+      }
+      case 136:
+      case 137: {
+        const width = opcode === 136 ? 1 : size;
+        this.decodeModrm();
+        this.writeRm(width, this.readReg(this.modrm.reg, width));
+        return null;
+      }
+      case 138:
+      case 139: {
+        const width = opcode === 138 ? 1 : size;
+        this.decodeModrm();
+        this.writeReg(this.modrm.reg, width, this.readRm(width));
+        return null;
+      }
+      case 141: {
+        this.decodeModrm();
+        this.writeReg(this.modrm.reg, size, BigInt(this.effectiveAddress()) & maskFor(size));
+        return null;
+      }
+      case 143:
+        this.decodeModrm();
+        this.writeRm(8, this.pop());
+        return null;
+      case 144:
+        return null;
+      // NOP (XCHG rax, rax)
+      case 152:
+        this.writeReg(RAX, size, signed(this.readReg(RAX, size / 2), size / 2) & maskFor(size));
+        return null;
+      case 153: {
+        const value = signed(this.readReg(RAX, size), size);
+        this.writeReg(RDX, size, value < 0n ? maskFor(size) : 0n);
+        return null;
+      }
+      /* ── string operations ────────────────────────────────────────────── */
+      case 164:
+      case 165:
+        return this.stringOp("movs", opcode === 164 ? 1 : size);
+      case 166:
+      case 167:
+        return this.stringOp("cmps", opcode === 166 ? 1 : size);
+      case 170:
+      case 171:
+        return this.stringOp("stos", opcode === 170 ? 1 : size);
+      case 172:
+      case 173:
+        return this.stringOp("lods", opcode === 172 ? 1 : size);
+      case 174:
+      case 175:
+        return this.stringOp("scas", opcode === 174 ? 1 : size);
+      case 168:
+      case 169: {
+        const width = opcode === 168 ? 1 : size;
+        const immSize = width === 8 ? 4 : width;
+        const b = signed(this.fetch(immSize), immSize) & maskFor(width);
+        this.setLogicFlags(this.readReg(RAX, width) & b, width);
+        return null;
+      }
+      /* ── mov immediate ────────────────────────────────────────────────── */
+      case 176:
+      case 177:
+      case 178:
+      case 179:
+      case 180:
+      case 181:
+      case 182:
+      case 183:
+        this.writeReg(opcode - 176 | ((this.rex & 1) !== 0 ? 8 : 0), 1, this.fetch(1));
+        return null;
+      case 184:
+      case 185:
+      case 186:
+      case 187:
+      case 188:
+      case 189:
+      case 190:
+      case 191: {
+        const index = opcode - 184 | ((this.rex & 1) !== 0 ? 8 : 0);
+        this.writeReg(index, size, this.fetch(size === 8 ? 8 : size));
+        return null;
+      }
+      /* ── shifts ───────────────────────────────────────────────────────── */
+      case 192:
+      case 193: {
+        const width = opcode === 192 ? 1 : size;
+        this.decodeModrm();
+        const count = Number(this.peekImmediate(1)) & (width === 8 ? 63 : 31);
+        this.shift(this.modrm.reg & 7, width, count);
+        return null;
+      }
+      case 208:
+      case 209: {
+        const width = opcode === 208 ? 1 : size;
+        this.decodeModrm();
+        this.shift(this.modrm.reg & 7, width, 1);
+        return null;
+      }
+      case 210:
+      case 211: {
+        const width = opcode === 210 ? 1 : size;
+        this.decodeModrm();
+        this.shift(this.modrm.reg & 7, width, Number(this.readReg(RCX, 1)) & (width === 8 ? 63 : 31));
+        return null;
+      }
+      /* ── control flow ─────────────────────────────────────────────────── */
+      case 194: {
+        const extra = Number(this.fetch(2));
+        this.rip = Number(this.pop());
+        this.regs[RSP] = this.regs[RSP] + BigInt(extra) & MASK64;
+        return null;
+      }
+      case 195:
+        this.rip = Number(this.pop());
+        return null;
+      case 198:
+      case 199: {
+        const width = opcode === 198 ? 1 : size;
+        this.decodeModrm();
+        const immSize = width === 8 ? 4 : width;
+        const value = signed(this.peekImmediate(immSize), immSize) & maskFor(width);
+        this.writeRm(width, value);
+        return null;
+      }
+      case 201: {
+        this.regs[RSP] = this.regs[RBP];
+        this.regs[RBP] = this.pop();
+        return null;
+      }
+      case 204:
+        throw new UnsupportedInstruction("int3", this.opcodeStart);
+      case 232: {
+        const offset = Number(this.fetchSigned(4));
+        this.push(BigInt(this.rip));
+        this.rip += offset;
+        return null;
+      }
+      // The displacement must be fetched into a local first: `rip += fetch()`
+      // reads rip before the fetch advances it, landing short by the width of
+      // the immediate.
+      case 233: {
+        const offset = Number(this.fetchSigned(4));
+        this.rip += offset;
+        return null;
+      }
+      case 235: {
+        const offset = Number(this.fetchSigned(1));
+        this.rip += offset;
+        return null;
+      }
+      case 224:
+      case 225:
+      case 226: {
+        const offset = Number(this.fetchSigned(1));
+        const next = this.regs[RCX] - 1n & MASK64;
+        this.regs[RCX] = next;
+        const taken = next !== 0n && (opcode === 226 || (opcode === 225 ? this.zf : !this.zf));
+        if (taken) this.rip += offset;
+        return null;
+      }
+      case 227: {
+        const offset = Number(this.fetchSigned(1));
+        if (this.regs[RCX] === 0n) this.rip += offset;
+        return null;
+      }
+      /* ── group 3 ──────────────────────────────────────────────────────── */
+      case 246:
+      case 247: {
+        const width = opcode === 246 ? 1 : size;
+        this.decodeModrm();
+        return this.group3(width);
+      }
+      case 248:
+        this.cf = false;
+        return null;
+      case 249:
+        this.cf = true;
+        return null;
+      case 252:
+        this.df = false;
+        return null;
+      case 253:
+        this.df = true;
+        return null;
+      /* ── group 4 and 5 ────────────────────────────────────────────────── */
+      case 254:
+      case 255: {
+        const width = opcode === 254 ? 1 : size;
+        this.decodeModrm();
+        const op = this.modrm.reg & 7;
+        if (op === 0 || op === 1) {
+          const carry = this.cf;
+          const a = this.readRm(width);
+          const result = op === 0 ? a + 1n : a - 1n;
+          if (op === 0) this.setAddFlags(a, 1n, result, width);
+          else this.setSubFlags(a, 1n, result, width);
+          this.cf = carry;
+          this.writeRm(width, result);
+          return null;
+        }
+        if (op === 2) {
+          const target = Number(this.readRm(8));
+          this.push(BigInt(this.rip));
+          this.rip = target;
+          return null;
+        }
+        if (op === 4) {
+          this.rip = Number(this.readRm(8));
+          return null;
+        }
+        if (op === 6) {
+          this.push(this.readRm(8));
+          return null;
+        }
+        throw new UnsupportedInstruction(`ff /${op}`, this.opcodeStart);
+      }
+      default:
+        throw new UnsupportedInstruction(`0x${opcode.toString(16)}`, this.opcodeStart);
+    }
+  }
+  /**
+   * Read an immediate that follows the ModRM byte without disturbing the
+   * pending RIP-relative displacement.
+   *
+   * x86 puts the immediate after the address bytes but resolves RIP-relative
+   * addresses against the end of the *whole* instruction, so the immediate has
+   * to be consumed first and the address computed afterwards.
+   */
+  peekImmediate(size) {
+    const value = this.memory.read(this.rip, size);
+    this.rip += size;
+    return value;
+  }
+  applyArith(op, a, b, size) {
+    const mask = maskFor(size);
+    switch (op) {
+      case "add": {
+        const result = (a & mask) + (b & mask);
+        this.setAddFlags(a, b, result, size);
+        return result & mask;
+      }
+      case "adc": {
+        const carry = this.cf ? 1n : 0n;
+        const result = (a & mask) + (b & mask) + carry;
+        this.setAddFlags(a, b + carry, result, size);
+        return result & mask;
+      }
+      case "sub":
+      case "cmp": {
+        const result = (a & mask) - (b & mask);
+        this.setSubFlags(a, b, result, size);
+        return result & mask;
+      }
+      case "sbb": {
+        const borrow = this.cf ? 1n : 0n;
+        const result = (a & mask) - (b & mask) - borrow;
+        this.setSubFlags(a, b + borrow, result, size);
+        return result & mask;
+      }
+      case "and": {
+        const result = a & b & mask;
+        this.setLogicFlags(result, size);
+        return result;
+      }
+      case "or": {
+        const result = (a | b) & mask;
+        this.setLogicFlags(result, size);
+        return result;
+      }
+      case "xor": {
+        const result = (a ^ b) & mask;
+        this.setLogicFlags(result, size);
+        return result;
+      }
+    }
+  }
+  shift(op, size, count) {
+    if (count === 0) {
+      this.readRm(size);
+      return;
+    }
+    const mask = maskFor(size);
+    const bits = BigInt(size * 8);
+    const value = this.readRm(size) & mask;
+    const n = BigInt(count);
+    let result;
+    switch (op) {
+      case 0:
+        result = (value << n % bits | value >> bits - n % bits) & mask;
+        this.cf = (result & 1n) !== 0n;
+        break;
+      case 1:
+        result = (value >> n % bits | value << bits - n % bits) & mask;
+        this.cf = result >> bits - 1n !== 0n;
+        break;
+      case 2:
+      // RCL
+      case 3: {
+        const total = bits + 1n;
+        const n2 = BigInt(count) % total;
+        if (n2 === 0n) {
+          this.writeRm(size, value);
+          return;
+        }
+        const wide = value | (this.cf ? 1n << bits : 0n);
+        const wideMask = (1n << total) - 1n;
+        const rotated = op === 2 ? (wide << n2 | wide >> total - n2) & wideMask : (wide >> n2 | wide << total - n2) & wideMask;
+        result = rotated & mask;
+        this.cf = (rotated >> bits & 1n) !== 0n;
+        this.of = (result >> bits - 1n & 1n) !== (this.cf ? 1n : 0n);
+        this.writeRm(size, result);
+        return;
+      }
+      case 4:
+      // SHL
+      case 6:
+        result = value << n & mask;
+        this.cf = n <= bits && (value >> bits - n & 1n) !== 0n;
+        this.setShiftFlags(result, size);
+        this.of = (result >> bits - 1n & 1n) !== (this.cf ? 1n : 0n);
+        this.writeRm(size, result);
+        return;
+      case 5:
+        result = value >> n;
+        this.cf = (value >> n - 1n & 1n) !== 0n;
+        this.setShiftFlags(result, size);
+        this.of = (value >> bits - 1n & 1n) !== 0n;
+        this.writeRm(size, result);
+        return;
+      case 7: {
+        const s = signed(value, size);
+        result = s >> n & mask;
+        this.cf = (s >> n - 1n & 1n) !== 0n;
+        this.setShiftFlags(result, size);
+        this.of = false;
+        this.writeRm(size, result);
+        return;
+      }
+      default:
+        throw new UnsupportedInstruction(`shift /${op}`, this.opcodeStart);
+    }
+    this.writeRm(size, result);
+  }
+  setShiftFlags(result, size) {
+    const masked = result & maskFor(size);
+    this.zf = masked === 0n;
+    this.sf = signed(masked, size) < 0n;
+    this.pf = parity(masked);
+  }
+  group3(size) {
+    const op = this.modrm.reg & 7;
+    const mask = maskFor(size);
+    switch (op) {
+      case 0:
+      case 1: {
+        const immSize = size === 8 ? 4 : size;
+        const b = signed(this.peekImmediate(immSize), immSize) & mask;
+        this.setLogicFlags(this.readRm(size) & b, size);
+        return null;
+      }
+      case 2: {
+        this.writeRm(size, ~this.readRm(size) & mask);
+        return null;
+      }
+      case 3: {
+        const a = this.readRm(size);
+        const result = 0n - a & mask;
+        this.setSubFlags(0n, a, 0n - a, size);
+        this.cf = (a & mask) !== 0n;
+        this.writeRm(size, result);
+        return null;
+      }
+      case 4: {
+        const a = this.readReg(RAX, size);
+        const b = this.readRm(size);
+        const full = a * b;
+        this.writeReg(RAX, size, full & mask);
+        if (size === 1) this.writeReg(RAX, 2, full & 0xffffn);
+        else this.writeReg(RDX, size, full >> BigInt(size * 8) & mask);
+        this.cf = this.of = full >> BigInt(size * 8) !== 0n;
+        return null;
+      }
+      case 5: {
+        const a = signed(this.readReg(RAX, size), size);
+        const b = signed(this.readRm(size), size);
+        const full = a * b;
+        this.writeReg(RAX, size, full & mask);
+        if (size === 1) this.writeReg(RAX, 2, full & 0xffffn);
+        else this.writeReg(RDX, size, full >> BigInt(size * 8) & mask);
+        this.cf = this.of = signed(full & mask, size) !== full;
+        return null;
+      }
+      case 6: {
+        const divisor = this.readRm(size);
+        if (divisor === 0n) throw new UnsupportedInstruction("divide by zero", this.opcodeStart);
+        const high = size === 1 ? 0n : this.readReg(RDX, size);
+        const low = this.readReg(RAX, size);
+        const dividend = size === 1 ? this.readReg(RAX, 2) : high << BigInt(size * 8) | low;
+        this.writeReg(RAX, size, dividend / divisor & mask);
+        if (size === 1) this.writeReg(RAX, 1, dividend / divisor & 0xffn);
+        else this.writeReg(RDX, size, dividend % divisor & mask);
+        return null;
+      }
+      case 7: {
+        const divisor = signed(this.readRm(size), size);
+        if (divisor === 0n) throw new UnsupportedInstruction("divide by zero", this.opcodeStart);
+        const high = size === 1 ? 0n : this.readReg(RDX, size);
+        const low = this.readReg(RAX, size);
+        const raw = size === 1 ? this.readReg(RAX, 2) : high << BigInt(size * 8) | low;
+        const dividend = signed(raw, size === 1 ? 2 : size * 2);
+        this.writeReg(RAX, size, dividend / divisor & mask);
+        if (size !== 1) this.writeReg(RDX, size, dividend % divisor & mask);
+        return null;
+      }
+      default:
+        throw new UnsupportedInstruction(`f7 /${op}`, this.opcodeStart);
+    }
+  }
+  /**
+   * MOVS/STOS/LODS/SCAS/CMPS, with the REP prefixes.
+   *
+   * These are how a compiler open-codes `memcpy`, `memset` and `strlen`, so a
+   * program that never calls libc still leans on them heavily.
+   */
+  stringOp(kind, size) {
+    const step = BigInt(this.df ? -size : size);
+    const repeat = this.rep !== 0;
+    const whileEqual = this.rep === 243;
+    for (; ; ) {
+      if (repeat && this.regs[RCX] === 0n) break;
+      const source = Number(this.regs[RSI]);
+      const dest = Number(this.regs[RDI]);
+      switch (kind) {
+        case "movs":
+          this.memory.write(dest, size, this.memory.read(source, size));
+          this.regs[RSI] = this.regs[RSI] + step & MASK64;
+          this.regs[RDI] = this.regs[RDI] + step & MASK64;
+          break;
+        case "stos":
+          this.memory.write(dest, size, this.readReg(RAX, size));
+          this.regs[RDI] = this.regs[RDI] + step & MASK64;
+          break;
+        case "lods":
+          this.writeReg(RAX, size, this.memory.read(source, size));
+          this.regs[RSI] = this.regs[RSI] + step & MASK64;
+          break;
+        case "scas": {
+          const a = this.readReg(RAX, size);
+          const b = this.memory.read(dest, size);
+          this.setSubFlags(a, b, a - b, size);
+          this.regs[RDI] = this.regs[RDI] + step & MASK64;
+          break;
+        }
+        case "cmps": {
+          const a = this.memory.read(source, size);
+          const b = this.memory.read(dest, size);
+          this.setSubFlags(a, b, a - b, size);
+          this.regs[RSI] = this.regs[RSI] + step & MASK64;
+          this.regs[RDI] = this.regs[RDI] + step & MASK64;
+          break;
+        }
+      }
+      if (!repeat) break;
+      this.regs[RCX] = this.regs[RCX] - 1n & MASK64;
+      if ((kind === "scas" || kind === "cmps") && this.zf !== whileEqual) break;
+    }
+    return null;
+  }
+  executeTwoByte(opcode) {
+    const size = this.opSize;
+    switch (opcode) {
+      case 5: {
+        const result = this.onSyscall(this);
+        this.regs[R11] = 0x202n;
+        return result instanceof Promise ? result : null;
+      }
+      case 11:
+        throw new UnsupportedInstruction("ud2", this.opcodeStart);
+      case 30: {
+        this.fetch8();
+        return null;
+      }
+      case 31:
+        this.decodeModrm();
+        this.effectiveAddress();
+        return null;
+      // multi-byte NOP
+      case 13:
+      case 24:
+      case 25:
+      case 26:
+      case 27:
+      case 28:
+      case 29:
+        this.decodeModrm();
+        this.effectiveAddress();
+        return null;
+      // prefetch / hint NOPs
+      case 49: {
+        const ticks = BigInt(this.instructions) * 3n;
+        this.writeReg(RAX, 4, ticks & 0xffffffffn);
+        this.writeReg(RDX, 4, ticks >> 32n & 0xffffffffn);
+        return null;
+      }
+      case 162:
+        this.cpuid();
+        return null;
+      /* ── cmovcc ───────────────────────────────────────────────────────── */
+      case 64:
+      case 65:
+      case 66:
+      case 67:
+      case 68:
+      case 69:
+      case 70:
+      case 71:
+      case 72:
+      case 73:
+      case 74:
+      case 75:
+      case 76:
+      case 77:
+      case 78:
+      case 79: {
+        this.decodeModrm();
+        const value = this.readRm(size);
+        if (this.condition(opcode & 15)) this.writeReg(this.modrm.reg, size, value);
+        else if (size === 4) {
+          this.writeReg(this.modrm.reg, 4, this.readReg(this.modrm.reg, 4));
+        }
+        return null;
+      }
+      /* ── jcc rel32 ────────────────────────────────────────────────────── */
+      case 128:
+      case 129:
+      case 130:
+      case 131:
+      case 132:
+      case 133:
+      case 134:
+      case 135:
+      case 136:
+      case 137:
+      case 138:
+      case 139:
+      case 140:
+      case 141:
+      case 142:
+      case 143: {
+        const offset = Number(this.fetchSigned(4));
+        if (this.condition(opcode & 15)) this.rip += offset;
+        return null;
+      }
+      /* ── setcc ────────────────────────────────────────────────────────── */
+      case 144:
+      case 145:
+      case 146:
+      case 147:
+      case 148:
+      case 149:
+      case 150:
+      case 151:
+      case 152:
+      case 153:
+      case 154:
+      case 155:
+      case 156:
+      case 157:
+      case 158:
+      case 159:
+        this.decodeModrm();
+        this.writeRm(1, this.condition(opcode & 15) ? 1n : 0n);
+        return null;
+      /* ── bit test ─────────────────────────────────────────────────────── */
+      case 163:
+      case 171:
+      case 179:
+      case 187: {
+        this.decodeModrm();
+        const bits = BigInt(size * 8);
+        const offset = signed(this.readReg(this.modrm.reg, size), size);
+        const value = this.readRm(size);
+        const bit = (offset % bits + bits) % bits;
+        this.cf = (value >> bit & 1n) !== 0n;
+        if (opcode === 171) this.writeRm(size, value | 1n << bit);
+        else if (opcode === 179) this.writeRm(size, value & ~(1n << bit));
+        else if (opcode === 187) this.writeRm(size, value ^ 1n << bit);
+        return null;
+      }
+      case 186: {
+        this.decodeModrm();
+        const op = this.modrm.reg & 7;
+        const bits = BigInt(size * 8);
+        const bit = BigInt(Number(this.peekImmediate(1))) % bits;
+        const value = this.readRm(size);
+        this.cf = (value >> bit & 1n) !== 0n;
+        if (op === 5) this.writeRm(size, value | 1n << bit);
+        else if (op === 6) this.writeRm(size, value & ~(1n << bit));
+        else if (op === 7) this.writeRm(size, value ^ 1n << bit);
+        return null;
+      }
+      case 175: {
+        this.decodeModrm();
+        const a = signed(this.readReg(this.modrm.reg, size), size);
+        const b = signed(this.readRm(size), size);
+        const full = a * b;
+        const truncated = full & maskFor(size);
+        this.writeReg(this.modrm.reg, size, truncated);
+        this.of = this.cf = signed(truncated, size) !== full;
+        return null;
+      }
+      /* ── zero and sign extension ──────────────────────────────────────── */
+      case 182:
+      case 183: {
+        const from = opcode === 182 ? 1 : 2;
+        this.decodeModrm();
+        this.writeReg(this.modrm.reg, size, this.readRm(from));
+        return null;
+      }
+      case 190:
+      case 191: {
+        const from = opcode === 190 ? 1 : 2;
+        this.decodeModrm();
+        this.writeReg(this.modrm.reg, size, signed(this.readRm(from), from) & maskFor(size));
+        return null;
+      }
+      /* ── bit scan ─────────────────────────────────────────────────────── */
+      case 188:
+      case 189: {
+        this.decodeModrm();
+        const value = this.readRm(size);
+        if (value === 0n) {
+          this.zf = true;
+          return null;
+        }
+        this.zf = false;
+        let index = 0n;
+        if (opcode === 188) {
+          while ((value >> index & 1n) === 0n) index++;
+        } else {
+          index = BigInt(value.toString(2).length - 1);
+        }
+        this.writeReg(this.modrm.reg, size, index);
+        return null;
+      }
+      case 176:
+      case 177: {
+        const width = opcode === 176 ? 1 : size;
+        this.decodeModrm();
+        const destination = this.readRm(width);
+        const accumulator = this.readReg(RAX, width);
+        this.setSubFlags(accumulator, destination, accumulator - destination, width);
+        if (accumulator === destination) {
+          this.writeRm(width, this.readReg(this.modrm.reg, width));
+        } else {
+          this.writeReg(RAX, width, destination);
+        }
+        return null;
+      }
+      case 192:
+      case 193: {
+        const width = opcode === 192 ? 1 : size;
+        this.decodeModrm();
+        const a = this.readRm(width);
+        const b = this.readReg(this.modrm.reg, width);
+        const sum = a + b;
+        this.setAddFlags(a, b, sum, width);
+        this.writeReg(this.modrm.reg, width, a);
+        this.writeRm(width, sum & maskFor(width));
+        return null;
+      }
+      case 200:
+      case 201:
+      case 202:
+      case 203:
+      case 204:
+      case 205:
+      case 206:
+      case 207: {
+        const index = opcode - 200 | ((this.rex & 1) !== 0 ? 8 : 0);
+        const value = this.readReg(index, size);
+        let swapped = 0n;
+        for (let i = 0; i < size; i++) {
+          swapped = swapped << 8n | value >> BigInt(i * 8) & 0xffn;
+        }
+        this.writeReg(index, size, swapped);
+        return null;
+      }
+      case 174:
+        this.decodeModrm();
+        if (this.modrm.isReg) return null;
+        this.effectiveAddress();
+        return null;
+      default:
+        return this.executeSse(opcode);
+    }
+  }
+  /* ── SSE ────────────────────────────────────────────────────────────────── */
+  readXmmRm() {
+    if (this.modrm.isReg) return [this.xmmLo[this.modrm.rm], this.xmmHi[this.modrm.rm]];
+    const address = this.effectiveAddress();
+    return [this.memory.read(address, 8), this.memory.read(address + 8, 8)];
+  }
+  writeXmmRm(lo, hi) {
+    if (this.modrm.isReg) {
+      this.xmmLo[this.modrm.rm] = lo;
+      this.xmmHi[this.modrm.rm] = hi;
+      return;
+    }
+    const address = this.effectiveAddress();
+    this.memory.write(address, 8, lo);
+    this.memory.write(address + 8, 8, hi);
+  }
+  /** Byte `index` of a 128-bit value held as two halves. */
+  static byteOf(lo, hi, index) {
+    const half = index < 8 ? lo : hi;
+    return Number(half >> BigInt(index % 8 * 8) & 0xffn);
+  }
+  static fromBytes(bytes) {
+    let lo = 0n;
+    let hi = 0n;
+    for (let i = 7; i >= 0; i--) lo = lo << 8n | BigInt(bytes[i] & 255);
+    for (let i = 15; i >= 8; i--) hi = hi << 8n | BigInt(bytes[i] & 255);
+    return [lo, hi];
+  }
+  /** Shift each element of a vector register: /2 logical right, /4 arithmetic right, /6 left. */
+  packedShift(target, element, op, count) {
+    const bytes = bytesOf(this.xmmLo[target], this.xmmHi[target]);
+    const out = new Array(16).fill(0);
+    BigInt(element * 8);
+    const n = BigInt(count);
+    for (let at = 0; at < 16; at += element) {
+      const value = elementAt(bytes, at, element);
+      let result;
+      if (count >= element * 8) {
+        result = op === 4 && signed(value, element) < 0n ? maskFor(element) : 0n;
+      } else if (op === 2) {
+        result = value >> n;
+      } else if (op === 4) {
+        result = signed(value, element) >> n;
+      } else if (op === 6) {
+        result = value << n;
+      } else {
+        throw new UnsupportedInstruction(`packed shift /${op}`, this.opcodeStart);
+      }
+      putElement(out, at, element, result);
+    }
+    const [lo, hi] = _Cpu.fromBytes(out);
+    this.xmmLo[target] = lo;
+    this.xmmHi[target] = hi;
+  }
+  executeSse(opcode) {
+    const packed = this.opSize === 2;
+    const scalarSingle = this.rep === 243;
+    const scalarDouble = this.rep === 242;
+    switch (opcode) {
+      /* ── moves ────────────────────────────────────────────────────────── */
+      case 16: {
+        this.decodeModrm();
+        const reg = this.modrm.reg;
+        if (scalarSingle || scalarDouble) {
+          const [lo2, hi2] = this.readXmmRm();
+          const width = scalarSingle ? 0xffffffffn : 0xffffffffffffffffn;
+          if (this.modrm.isReg) {
+            this.xmmLo[reg] = this.xmmLo[reg] & ~width | lo2 & width;
+          } else {
+            this.xmmLo[reg] = lo2 & width;
+            this.xmmHi[reg] = 0n;
+          }
+          return null;
+        }
+        const [lo, hi] = this.readXmmRm();
+        this.xmmLo[reg] = lo;
+        this.xmmHi[reg] = hi;
+        return null;
+      }
+      case 17: {
+        this.decodeModrm();
+        const reg = this.modrm.reg;
+        if (scalarSingle || scalarDouble) {
+          const width = scalarSingle ? 0xffffffffn : 0xffffffffffffffffn;
+          if (this.modrm.isReg) {
+            this.xmmLo[this.modrm.rm] = this.xmmLo[this.modrm.rm] & ~width | this.xmmLo[reg] & width;
+          } else {
+            this.memory.write(this.effectiveAddress(), scalarSingle ? 4 : 8, this.xmmLo[reg] & width);
+          }
+          return null;
+        }
+        this.writeXmmRm(this.xmmLo[reg], this.xmmHi[reg]);
+        return null;
+      }
+      case 40: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        this.xmmLo[this.modrm.reg] = lo;
+        this.xmmHi[this.modrm.reg] = hi;
+        return null;
+      }
+      case 41:
+        this.decodeModrm();
+        this.writeXmmRm(this.xmmLo[this.modrm.reg], this.xmmHi[this.modrm.reg]);
+        return null;
+      case 111: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        this.xmmLo[this.modrm.reg] = lo;
+        this.xmmHi[this.modrm.reg] = hi;
+        return null;
+      }
+      case 127:
+        this.decodeModrm();
+        this.writeXmmRm(this.xmmLo[this.modrm.reg], this.xmmHi[this.modrm.reg]);
+        return null;
+      case 18:
+      case 22: {
+        this.decodeModrm();
+        const [lo] = this.readXmmRm();
+        if (opcode === 18) this.xmmLo[this.modrm.reg] = lo;
+        else this.xmmHi[this.modrm.reg] = lo;
+        return null;
+      }
+      case 19:
+      case 23: {
+        this.decodeModrm();
+        const value = opcode === 19 ? this.xmmLo[this.modrm.reg] : this.xmmHi[this.modrm.reg];
+        this.memory.write(this.effectiveAddress(), 8, value);
+        return null;
+      }
+      case 110: {
+        this.decodeModrm();
+        const width = this.opSize === 8 ? 8 : 4;
+        const value = this.modrm.isReg ? this.readReg(this.modrm.rm, width) : this.memory.read(this.effectiveAddress(), width);
+        this.xmmLo[this.modrm.reg] = value;
+        this.xmmHi[this.modrm.reg] = 0n;
+        return null;
+      }
+      case 126: {
+        this.decodeModrm();
+        if (scalarSingle) {
+          const [lo] = this.readXmmRm();
+          this.xmmLo[this.modrm.reg] = lo;
+          this.xmmHi[this.modrm.reg] = 0n;
+          return null;
+        }
+        const width = this.opSize === 8 ? 8 : 4;
+        const value = this.xmmLo[this.modrm.reg] & maskFor(width);
+        if (this.modrm.isReg) this.writeReg(this.modrm.rm, width, value);
+        else this.memory.write(this.effectiveAddress(), width, value);
+        return null;
+      }
+      case 214:
+        this.decodeModrm();
+        if (this.modrm.isReg) {
+          this.xmmLo[this.modrm.rm] = this.xmmLo[this.modrm.reg];
+          this.xmmHi[this.modrm.rm] = 0n;
+        } else {
+          this.memory.write(this.effectiveAddress(), 8, this.xmmLo[this.modrm.reg]);
+        }
+        return null;
+      /* ── bitwise ──────────────────────────────────────────────────────── */
+      case 87:
+      // xorps / xorpd
+      case 239: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        this.xmmLo[this.modrm.reg] ^= lo;
+        this.xmmHi[this.modrm.reg] ^= hi;
+        return null;
+      }
+      case 84:
+      // andps / andpd
+      case 219: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        this.xmmLo[this.modrm.reg] &= lo;
+        this.xmmHi[this.modrm.reg] &= hi;
+        return null;
+      }
+      case 86:
+      // orps / orpd
+      case 235: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        this.xmmLo[this.modrm.reg] |= lo;
+        this.xmmHi[this.modrm.reg] |= hi;
+        return null;
+      }
+      case 85:
+      // andnps
+      case 223: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        const reg = this.modrm.reg;
+        this.xmmLo[reg] = ~this.xmmLo[reg] & lo;
+        this.xmmHi[reg] = ~this.xmmHi[reg] & hi;
+        return null;
+      }
+      /* ── byte compare and mask: how strlen and memchr are written ─────── */
+      case 116: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        const reg = this.modrm.reg;
+        const out = [];
+        for (let i = 0; i < 16; i++) {
+          const a = _Cpu.byteOf(this.xmmLo[reg], this.xmmHi[reg], i);
+          const b = _Cpu.byteOf(lo, hi, i);
+          out.push(a === b ? 255 : 0);
+        }
+        const [resultLo, resultHi] = _Cpu.fromBytes(out);
+        this.xmmLo[reg] = resultLo;
+        this.xmmHi[reg] = resultHi;
+        return null;
+      }
+      case 215: {
+        this.decodeModrm();
+        const [lo, hi] = this.modrm.isReg ? [this.xmmLo[this.modrm.rm], this.xmmHi[this.modrm.rm]] : this.readXmmRm();
+        let mask = 0n;
+        for (let i = 0; i < 16; i++) {
+          if ((_Cpu.byteOf(lo, hi, i) & 128) !== 0) mask |= 1n << BigInt(i);
+        }
+        this.writeReg(this.modrm.reg, 4, mask);
+        return null;
+      }
+      case 113:
+      case 114:
+      case 115: {
+        this.decodeModrm();
+        const op = this.modrm.reg & 7;
+        const count = Number(this.peekImmediate(1));
+        const target = this.modrm.rm;
+        const element = opcode === 113 ? 2 : opcode === 114 ? 4 : 8;
+        if (opcode === 115 && (op === 3 || op === 7)) {
+          const bytes = bytesOf(this.xmmLo[target], this.xmmHi[target]);
+          const clamped = Math.min(count, 16);
+          const shifted = op === 3 ? [...bytes.slice(clamped), ...new Array(clamped).fill(0)] : [...new Array(clamped).fill(0), ...bytes.slice(0, 16 - clamped)];
+          const [lo, hi] = _Cpu.fromBytes(shifted.slice(0, 16));
+          this.xmmLo[target] = lo;
+          this.xmmHi[target] = hi;
+          return null;
+        }
+        this.packedShift(target, element, op, count);
+        return null;
+      }
+      case 209:
+      case 210:
+      case 211:
+      // psrlw / psrld / psrlq, count in xmm
+      case 225:
+      case 226:
+      // psraw / psrad
+      case 241:
+      case 242:
+      case 243: {
+        this.decodeModrm();
+        const [countLo] = this.readXmmRm();
+        const count = countLo > 255n ? 255 : Number(countLo);
+        const element = opcode === 209 || opcode === 225 || opcode === 241 ? 2 : opcode === 210 || opcode === 226 || opcode === 242 ? 4 : 8;
+        const op = opcode >= 241 ? 6 : opcode >= 225 ? 4 : 2;
+        this.packedShift(this.modrm.reg, element, op, count);
+        return null;
+      }
+      /* ── packed integer ───────────────────────────────────────────────── */
+      case 96:
+      case 97:
+      case 98:
+      case 108:
+      // punpckl bw / wd / dq / qdq
+      case 104:
+      case 105:
+      case 106:
+      case 109: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        const reg = this.modrm.reg;
+        const destination = bytesOf(this.xmmLo[reg], this.xmmHi[reg]);
+        const source = bytesOf(lo, hi);
+        const element = opcode === 96 || opcode === 104 ? 1 : opcode === 97 || opcode === 105 ? 2 : opcode === 98 || opcode === 106 ? 4 : 8;
+        const high = opcode >= 104 && opcode <= 109;
+        const offset = high ? 8 : 0;
+        const out = [];
+        for (let i = 0; out.length < 16; i++) {
+          for (let b = 0; b < element; b++) out.push(destination[offset + i * element + b]);
+          for (let b = 0; b < element; b++) out.push(source[offset + i * element + b]);
+        }
+        const [resultLo, resultHi] = _Cpu.fromBytes(out.slice(0, 16));
+        this.xmmLo[reg] = resultLo;
+        this.xmmHi[reg] = resultHi;
+        return null;
+      }
+      case 112: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        const order = Number(this.peekImmediate(1));
+        const reg = this.modrm.reg;
+        const source = bytesOf(lo, hi);
+        const out = new Array(16).fill(0);
+        if (packed) {
+          for (let lane = 0; lane < 4; lane++) {
+            const from = order >> lane * 2 & 3;
+            for (let b = 0; b < 4; b++) out[lane * 4 + b] = source[from * 4 + b];
+          }
+        } else if (scalarSingle || scalarDouble) {
+          const half = scalarSingle ? 8 : 0;
+          for (let i = 0; i < 16; i++) out[i] = source[i];
+          for (let lane = 0; lane < 4; lane++) {
+            const from = order >> lane * 2 & 3;
+            for (let b = 0; b < 2; b++) out[half + lane * 2 + b] = source[half + from * 2 + b];
+          }
+        } else {
+          throw new UnsupportedInstruction("0f 70 (mmx pshufw)", this.opcodeStart);
+        }
+        const [resultLo, resultHi] = _Cpu.fromBytes(out);
+        this.xmmLo[reg] = resultLo;
+        this.xmmHi[reg] = resultHi;
+        return null;
+      }
+      case 252:
+      case 253:
+      case 254:
+      case 212:
+      // paddb / paddw / paddd / paddq
+      case 248:
+      case 249:
+      case 250:
+      case 251:
+      // psubb / psubw / psubd / psubq
+      case 100:
+      case 101:
+      case 102:
+      // pcmpgtb / w / d
+      case 117:
+      case 118:
+      // pcmpeqw / pcmpeqd
+      case 218:
+      case 222: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        const reg = this.modrm.reg;
+        const a = bytesOf(this.xmmLo[reg], this.xmmHi[reg]);
+        const b = bytesOf(lo, hi);
+        const element = opcode === 252 || opcode === 248 || opcode === 100 || opcode === 218 || opcode === 222 ? 1 : opcode === 253 || opcode === 249 || opcode === 101 || opcode === 117 ? 2 : opcode === 254 || opcode === 250 || opcode === 102 || opcode === 118 ? 4 : 8;
+        const out = new Array(16).fill(0);
+        for (let at = 0; at < 16; at += element) {
+          const x = elementAt(a, at, element);
+          const y = elementAt(b, at, element);
+          let value;
+          switch (opcode) {
+            case 252:
+            case 253:
+            case 254:
+            case 212:
+              value = x + y;
+              break;
+            case 248:
+            case 249:
+            case 250:
+            case 251:
+              value = x - y;
+              break;
+            case 100:
+            case 101:
+            case 102:
+              value = signed(x, element) > signed(y, element) ? maskFor(element) : 0n;
+              break;
+            case 117:
+            case 118:
+              value = x === y ? maskFor(element) : 0n;
+              break;
+            case 218:
+              value = x < y ? x : y;
+              break;
+            default:
+              value = x > y ? x : y;
+          }
+          putElement(out, at, element, value);
+        }
+        const [resultLo, resultHi] = _Cpu.fromBytes(out);
+        this.xmmLo[reg] = resultLo;
+        this.xmmHi[reg] = resultHi;
+        return null;
+      }
+      /* ── floating point ───────────────────────────────────────────────── */
+      case 46:
+      // ucomiss / ucomisd
+      case 47: {
+        this.decodeModrm();
+        const [lo] = this.readXmmRm();
+        const a = packed ? f64(this.xmmLo[this.modrm.reg]) : f32(this.xmmLo[this.modrm.reg]);
+        const b = packed ? f64(lo) : f32(lo);
+        if (Number.isNaN(a) || Number.isNaN(b)) {
+          this.zf = this.pf = this.cf = true;
+        } else {
+          this.pf = false;
+          this.zf = a === b;
+          this.cf = a < b;
+        }
+        this.of = this.sf = this.af = false;
+        return null;
+      }
+      case 42: {
+        this.decodeModrm();
+        const width = this.opSize === 8 ? 8 : 4;
+        const source = this.modrm.isReg ? this.readReg(this.modrm.rm, width) : this.memory.read(this.effectiveAddress(), width);
+        const value = Number(signed(source, width));
+        this.xmmLo[this.modrm.reg] = scalarDouble ? bitsF64(value) : bitsF32(value);
+        return null;
+      }
+      case 44:
+      // cvttss2si / cvttsd2si — truncating
+      case 45: {
+        this.decodeModrm();
+        const [lo] = this.readXmmRm();
+        const value = scalarDouble ? f64(lo) : f32(lo);
+        const converted = opcode === 44 ? Math.trunc(value) : Math.round(value);
+        const width = this.opSize === 8 ? 8 : 4;
+        this.writeReg(this.modrm.reg, width, BigInt(Number.isFinite(converted) ? converted : 0) & maskFor(width));
+        return null;
+      }
+      case 90: {
+        this.decodeModrm();
+        const [lo] = this.readXmmRm();
+        this.xmmLo[this.modrm.reg] = scalarDouble ? bitsF32(f64(lo)) : bitsF64(f32(lo));
+        return null;
+      }
+      case 81:
+      // sqrt
+      case 88:
+      // add
+      case 89:
+      // mul
+      case 92:
+      // sub
+      case 94:
+      // div
+      case 93:
+      // min
+      case 95: {
+        this.decodeModrm();
+        const [lo, hi] = this.readXmmRm();
+        const reg = this.modrm.reg;
+        const apply = (x, y) => {
+          switch (opcode) {
+            case 81:
+              return Math.sqrt(y);
+            case 88:
+              return x + y;
+            case 89:
+              return x * y;
+            case 92:
+              return x - y;
+            case 94:
+              return x / y;
+            case 93:
+              return Math.min(x, y);
+            default:
+              return Math.max(x, y);
+          }
+        };
+        if (scalarDouble) {
+          this.xmmLo[reg] = bitsF64(apply(f64(this.xmmLo[reg]), f64(lo)));
+        } else if (scalarSingle) {
+          this.xmmLo[reg] = this.xmmLo[reg] & ~0xffffffffn | bitsF32(apply(f32(this.xmmLo[reg]), f32(lo)));
+        } else if (packed) {
+          this.xmmLo[reg] = bitsF64(apply(f64(this.xmmLo[reg]), f64(lo)));
+          this.xmmHi[reg] = bitsF64(apply(f64(this.xmmHi[reg]), f64(hi)));
+        } else {
+          const lanes = (a, b) => {
+            const low = bitsF32(apply(f32(a), f32(b)));
+            const high = bitsF32(apply(f32(a >> 32n), f32(b >> 32n)));
+            return low | high << 32n;
+          };
+          this.xmmLo[reg] = lanes(this.xmmLo[reg], lo);
+          this.xmmHi[reg] = lanes(this.xmmHi[reg], hi);
+        }
+        return null;
+      }
+      case 174:
+        throw new UnsupportedInstruction("0f ae (fxsave family)", this.opcodeStart);
+      default:
+        throw new UnsupportedInstruction(
+          `0f 0x${opcode.toString(16)}${packed ? " (66)" : scalarSingle ? " (f3)" : scalarDouble ? " (f2)" : ""}`,
+          this.opcodeStart
+        );
+    }
+  }
+  /**
+   * CPUID, reporting a deliberately plain processor.
+   *
+   * Advertising SSE4.2 or AVX would be a trap: glibc's IFUNC resolvers select
+   * string routines by feature bit, and would immediately pick vector code
+   * this interpreter does not implement. Claiming the x86-64 baseline steers
+   * every such resolver to the generic path.
+   */
+  cpuid() {
+    const leaf = Number(this.readReg(RAX, 4));
+    let eax = 0n, ebx = 0n, ecx = 0n, edx = 0n;
+    if (leaf === 0) {
+      eax = 1n;
+      ebx = 0x756e6547n;
+      edx = 0x49656e69n;
+      ecx = 0x6c65746en;
+    } else if (leaf === 1) {
+      eax = 0x00000f00n;
+      ebx = 0n;
+      ecx = 0x00000001n;
+      edx = 1n << 0n | 1n << 4n | 1n << 15n | 1n << 23n | 1n << 24n | 1n << 25n | 1n << 26n;
+    }
+    this.writeReg(RAX, 4, eax);
+    this.writeReg(RBX, 4, ebx);
+    this.writeReg(RCX, 4, ecx);
+    this.writeReg(RDX, 4, edx);
+  }
+  /** A snapshot for diagnostics when something goes wrong. */
+  describe() {
+    const names = [
+      "rax",
+      "rcx",
+      "rdx",
+      "rbx",
+      "rsp",
+      "rbp",
+      "rsi",
+      "rdi",
+      "r8",
+      "r9",
+      "r10",
+      "r11",
+      "r12",
+      "r13",
+      "r14",
+      "r15"
+    ];
+    const lines = [`rip 0x${this.rip.toString(16)}  instructions ${this.instructions}`];
+    for (let i = 0; i < 16; i += 4) {
+      lines.push(
+        names.slice(i, i + 4).map((name, j) => `${name.padStart(3)} 0x${this.regs[i + j].toString(16).padStart(16, "0")}`).join("  ")
+      );
+    }
+    return lines.join("\n");
+  }
+};
+var ARITH_BY_INDEX = ["add", "or", "adc", "sbb", "and", "sub", "xor", "cmp"];
+var ARITH_BY_OPCODE = {
+  0: "add",
+  8: "or",
+  16: "adc",
+  24: "sbb",
+  32: "and",
+  40: "sub",
+  48: "xor",
+  56: "cmp"
+};
+function bytesOf(lo, hi) {
+  const out = new Array(16);
+  for (let i = 0; i < 8; i++) out[i] = Number(lo >> BigInt(i * 8) & 0xffn);
+  for (let i = 0; i < 8; i++) out[8 + i] = Number(hi >> BigInt(i * 8) & 0xffn);
+  return out;
+}
+function elementAt(bytes, at, size) {
+  let value = 0n;
+  for (let i = size - 1; i >= 0; i--) value = value << 8n | BigInt(bytes[at + i]);
+  return value;
+}
+function putElement(bytes, at, size, value) {
+  let remaining = value & maskFor(size);
+  for (let i = 0; i < size; i++) {
+    bytes[at + i] = Number(remaining & 0xffn);
+    remaining >>= 8n;
+  }
+}
+var scratch = new DataView(new ArrayBuffer(8));
+function f64(bits) {
+  scratch.setBigUint64(0, bits & MASK64);
+  return scratch.getFloat64(0);
+}
+function bitsF64(value) {
+  scratch.setFloat64(0, value);
+  return scratch.getBigUint64(0);
+}
+function f32(bits) {
+  scratch.setUint32(0, Number(bits & 0xffffffffn));
+  return scratch.getFloat32(0);
+}
+function bitsF32(value) {
+  scratch.setFloat32(0, value);
+  return BigInt(scratch.getUint32(0));
+}
+function parity(value) {
+  let byte = Number(value & 0xffn);
+  let bits = 0;
+  while (byte) {
+    bits ^= byte & 1;
+    byte >>= 1;
+  }
+  return bits === 0;
+}
+
+// src/runtime/x86/linux.ts
+init_mode();
+init_errno();
+
+// src/runtime/x86/memory.ts
+var PAGE_SIZE = 4096;
+var PAGE_MASK = PAGE_SIZE - 1;
+var SegFault = class extends Error {
+  constructor(address, kind) {
+    super(`segmentation fault: ${kind} at 0x${address.toString(16)}`);
+    this.address = address;
+    this.kind = kind;
+    this.name = "SegFault";
+  }
+  address;
+  kind;
+};
+var Memory = class {
+  pages = /* @__PURE__ */ new Map();
+  /** Bump pointer for anonymous `mmap`, below the stack and above the heap. */
+  mmapNext = 35184372088832;
+  /** Current program break, set by the loader and moved by `brk`. */
+  brk = 0;
+  page(address, create, kind) {
+    const index = Math.floor(address / PAGE_SIZE);
+    let page = this.pages.get(index);
+    if (page === void 0) {
+      if (!create) throw new SegFault(address, kind);
+      page = new Uint8Array(PAGE_SIZE);
+      this.pages.set(index, page);
+    }
+    return page;
+  }
+  /** Make `[address, address+length)` readable and writable. */
+  map(address, length) {
+    const start = Math.floor(address / PAGE_SIZE);
+    const end = Math.floor((address + Math.max(length, 1) - 1) / PAGE_SIZE);
+    for (let i = start; i <= end; i++) {
+      if (!this.pages.has(i)) this.pages.set(i, new Uint8Array(PAGE_SIZE));
+    }
+  }
+  unmap(address, length) {
+    const start = Math.floor(address / PAGE_SIZE);
+    const end = Math.floor((address + Math.max(length, 1) - 1) / PAGE_SIZE);
+    for (let i = start; i <= end; i++) this.pages.delete(i);
+  }
+  isMapped(address) {
+    return this.pages.has(Math.floor(address / PAGE_SIZE));
+  }
+  /** Reserve `length` bytes of anonymous space, page-aligned. */
+  mmapAnonymous(length) {
+    const size = Math.ceil(length / PAGE_SIZE) * PAGE_SIZE;
+    const address = this.mmapNext;
+    this.mmapNext += size + PAGE_SIZE;
+    this.map(address, size);
+    return address;
+  }
+  read8(address) {
+    return this.page(address, false, "read")[address & PAGE_MASK];
+  }
+  write8(address, value) {
+    this.page(address, true, "write")[address & PAGE_MASK] = value & 255;
+  }
+  /**
+   * Read `size` bytes little-endian. Split across pages byte by byte rather
+   * than assuming an access stays inside one — unaligned loads that straddle a
+   * page boundary are entirely legal on x86.
+   */
+  read(address, size) {
+    let value = 0n;
+    for (let i = size - 1; i >= 0; i--) {
+      value = value << 8n | BigInt(this.read8(address + i));
+    }
+    return value;
+  }
+  write(address, size, value) {
+    let remaining = value;
+    for (let i = 0; i < size; i++) {
+      this.write8(address + i, Number(remaining & 0xffn));
+      remaining >>= 8n;
+    }
+  }
+  readBytes(address, length) {
+    const out = new Uint8Array(length);
+    for (let i = 0; i < length; i++) out[i] = this.read8(address + i);
+    return out;
+  }
+  writeBytes(address, bytes) {
+    this.map(address, bytes.length);
+    for (let i = 0; i < bytes.length; i++) this.write8(address + i, bytes[i]);
+  }
+  /** Read a NUL-terminated string, as every path argument to a syscall is. */
+  readCString(address, limit = 4096) {
+    const bytes = [];
+    for (let i = 0; i < limit; i++) {
+      const byte = this.read8(address + i);
+      if (byte === 0) break;
+      bytes.push(byte);
+    }
+    return new TextDecoder().decode(new Uint8Array(bytes));
+  }
+  writeCString(address, text) {
+    const bytes = new TextEncoder().encode(text);
+    this.writeBytes(address, bytes);
+    this.write8(address + bytes.length, 0);
+    return bytes.length + 1;
+  }
+  get pageCount() {
+    return this.pages.size;
+  }
+};
+
+// src/runtime/x86/linux.ts
+init_path();
+var E2 = {
+  PERM: 1,
+  NOENT: 2,
+  BADF: 9,
+  NOMEM: 12,
+  ACCES: 13,
+  EXIST: 17,
+  NOTDIR: 20,
+  ISDIR: 21,
+  INVAL: 22,
+  MFILE: 24,
+  NOTTY: 25,
+  SPIPE: 29,
+  ROFS: 30,
+  NOSYS: 38,
+  NOTEMPTY: 39,
+  LOOP: 40,
+  NAMETOOLONG: 36,
+  XDEV: 18
+};
+var ERRNO_MAP2 = {
+  EPERM: E2.PERM,
+  ENOENT: E2.NOENT,
+  EBADF: E2.BADF,
+  ENOMEM: E2.NOMEM,
+  EACCES: E2.ACCES,
+  EEXIST: E2.EXIST,
+  ENOTDIR: E2.NOTDIR,
+  EISDIR: E2.ISDIR,
+  EINVAL: E2.INVAL,
+  EMFILE: E2.MFILE,
+  ENFILE: E2.MFILE,
+  ENOTTY: E2.NOTTY,
+  ESPIPE: E2.SPIPE,
+  EROFS: E2.ROFS,
+  ENOSYS: E2.NOSYS,
+  ENOTEMPTY: E2.NOTEMPTY,
+  ELOOP: E2.LOOP,
+  ENAMETOOLONG: E2.NAMETOOLONG,
+  EXDEV: E2.XDEV,
+  ENOTSUP: E2.NOSYS,
+  EIO: 5
+};
+var AT_FDCWD = -100;
+var SIZEOF_STAT = 144;
+var LinuxSyscalls = class {
+  files = /* @__PURE__ */ new Map();
+  nextFd = 3;
+  stdinPosition = 0;
+  cwd;
+  opts;
+  /** Syscall numbers the guest asked for that are not implemented. */
+  unimplemented = /* @__PURE__ */ new Set();
+  /**
+   * Descriptors with no file behind them — epoll sets and eventfds. Tracked so
+   * `close` accepts them and `epoll_ctl` can tell a real one from a wrong one.
+   */
+  pseudoFds = /* @__PURE__ */ new Set();
+  /** Threads the guest believes it started; see the `clone` case. */
+  threadsRequested = 0;
+  constructor(opts) {
+    this.opts = opts;
+    this.cwd = opts.cwd;
+  }
+  /** Thread scheduler, attached once the CPU exists. */
+  scheduler = null;
+  /**
+   * Set by a syscall that switched threads. The result register then belongs to
+   * the thread we switched *to*, and must not be overwritten with ours.
+   */
+  switched = false;
+  /** Entry point handed to the CPU. */
+  handle = (cpu) => {
+    const number = Number(cpu.get(RAX) & 0xffffffffn);
+    const args = [
+      cpu.get(RDI),
+      cpu.get(RSI),
+      cpu.get(RDX),
+      cpu.get(R10),
+      cpu.get(R8),
+      cpu.get(R9)
+    ];
+    this.switched = false;
+    let result;
+    try {
+      result = this.dispatch(cpu, number, args);
+    } catch (e) {
+      if (e instanceof ProcessExit) throw e;
+      result = BigInt(-this.errnoOf(e));
+    }
+    this.opts.trace?.(`syscall ${number}(${args.slice(0, 3).map((a) => a.toString()).join(", ")}) = ${result}`);
+    if (!this.switched) cpu.set(RAX, result);
+  };
+  errnoOf(e) {
+    if (isSysError(e)) return ERRNO_MAP2[e.code] ?? 5;
+    return 5;
+  }
+  resolve(path, dirfd = AT_FDCWD) {
+    if (isAbsolute(path)) return normalize(path);
+    if (dirfd !== AT_FDCWD) {
+      const dir3 = this.files.get(dirfd);
+      if (dir3) return resolve(dir3.path, path);
+    }
+    return resolve(this.cwd, path);
+  }
+  dispatch(cpu, number, args) {
+    const mem = this.opts.memory;
+    const vfs = this.opts.vfs;
+    const cred = this.opts.cred;
+    const a = (i) => Number(BigInt.asIntN(64, args[i]));
+    const u = (i) => Number(args[i]);
+    switch (number) {
+      /* ── file descriptors ─────────────────────────────────────────────── */
+      case 0: {
+        const fd = a(0);
+        const buffer = u(1);
+        const count = u(2);
+        if (fd === 0) {
+          const slice2 = this.opts.stdin.subarray(this.stdinPosition, this.stdinPosition + count);
+          mem.writeBytes(buffer, slice2);
+          this.stdinPosition += slice2.length;
+          return BigInt(slice2.length);
+        }
+        const file3 = this.files.get(fd);
+        if (!file3) return BigInt(-9);
+        const slice = file3.data.subarray(file3.position, file3.position + count);
+        mem.writeBytes(buffer, slice);
+        file3.position += slice.length;
+        return BigInt(slice.length);
+      }
+      case 1: {
+        const fd = a(0);
+        const bytes = mem.readBytes(u(1), u(2));
+        return this.writeTo(fd, bytes);
+      }
+      case 20: {
+        const fd = a(0);
+        const iov = u(1);
+        const count = u(2);
+        let total = 0;
+        for (let i = 0; i < count; i++) {
+          const base = Number(mem.read(iov + i * 16, 8));
+          const length = Number(mem.read(iov + i * 16 + 8, 8));
+          if (length === 0) continue;
+          const written = this.writeTo(fd, mem.readBytes(base, length));
+          if (written < 0n) return written;
+          total += Number(written);
+        }
+        return BigInt(total);
+      }
+      case 2:
+        return this.open(this.resolve(mem.readCString(u(0))), u(1), u(2));
+      case 257:
+        return this.open(this.resolve(mem.readCString(u(1)), a(0)), u(2), u(3));
+      case 3: {
+        if (this.pseudoFds.delete(a(0))) return 0n;
+        const file3 = this.files.get(a(0));
+        if (!file3) return a(0) <= 2 ? 0n : BigInt(-9);
+        this.flush(file3);
+        this.files.delete(a(0));
+        return 0n;
+      }
+      case 8: {
+        const file3 = this.files.get(a(0));
+        if (!file3) return BigInt(-29);
+        const offset = a(1);
+        const whence = a(2);
+        const next = whence === 0 ? offset : whence === 1 ? file3.position + offset : file3.data.length + offset;
+        if (next < 0) return BigInt(-22);
+        file3.position = next;
+        return BigInt(next);
+      }
+      case 4:
+        return this.stat(this.resolve(mem.readCString(u(0))), u(1), true);
+      case 6:
+        return this.stat(this.resolve(mem.readCString(u(0))), u(1), false);
+      case 5: {
+        const fd = a(0);
+        if (fd >= 0 && fd <= 2) return this.statCharDevice(u(1));
+        const file3 = this.files.get(fd);
+        if (!file3) return BigInt(-9);
+        return this.stat(file3.path, u(1), true);
+      }
+      case 262: {
+        const path = mem.readCString(u(1));
+        if (path === "" && (u(3) & 4096) !== 0) {
+          const file3 = this.files.get(a(0));
+          return file3 ? this.stat(file3.path, u(2), true) : this.statCharDevice(u(2));
+        }
+        return this.stat(this.resolve(path, a(0)), u(2), (u(3) & 256) === 0);
+      }
+      case 217:
+        return this.getdents64(a(0), u(1), u(2));
+      case 21: {
+        const path = this.resolve(mem.readCString(u(0)));
+        return vfs.lexists(path) ? 0n : BigInt(-2);
+      }
+      case 269: {
+        const path = this.resolve(mem.readCString(u(1)), a(0));
+        return vfs.lexists(path) ? 0n : BigInt(-2);
+      }
+      case 87: {
+        vfs.unlink(this.resolve(mem.readCString(u(0))), cred);
+        return 0n;
+      }
+      case 263: {
+        const path = this.resolve(mem.readCString(u(1)), a(0));
+        if ((u(2) & 512) !== 0) vfs.rmdir(path, cred);
+        else vfs.unlink(path, cred);
+        return 0n;
+      }
+      case 83:
+        vfs.mkdir(this.resolve(mem.readCString(u(0))), { cred, mode: u(1) & 511 });
+        return 0n;
+      case 258:
+        vfs.mkdir(this.resolve(mem.readCString(u(1)), a(0)), { cred, mode: u(2) & 511 });
+        return 0n;
+      case 84:
+        vfs.rmdir(this.resolve(mem.readCString(u(0))), cred);
+        return 0n;
+      case 82:
+        vfs.rename(this.resolve(mem.readCString(u(0))), this.resolve(mem.readCString(u(1))), cred);
+        return 0n;
+      case 89: {
+        const target = vfs.readlink(this.resolve(mem.readCString(u(0))), cred);
+        return this.writeBounded(u(1), u(2), target);
+      }
+      case 267: {
+        const target = vfs.readlink(this.resolve(mem.readCString(u(1)), a(0)), cred);
+        return this.writeBounded(u(2), u(3), target);
+      }
+      case 79: {
+        const bytes = new TextEncoder().encode(this.cwd);
+        if (bytes.length + 1 > u(1)) return BigInt(-34);
+        mem.writeCString(u(0), this.cwd);
+        return BigInt(bytes.length + 1);
+      }
+      case 80: {
+        const path = this.resolve(mem.readCString(u(0)));
+        if (!vfs.stat(path, { cred }).isDirectory()) return BigInt(-20);
+        this.cwd = path;
+        return 0n;
+      }
+      case 16: {
+        return BigInt(-25);
+      }
+      case 72: {
+        const command = a(1);
+        if (command === 1 || command === 3) return 0n;
+        return 0n;
+      }
+      case 32:
+      case 33:
+      case 292:
+        return BigInt(-38);
+      /* ── memory ───────────────────────────────────────────────────────── */
+      case 12: {
+        const requested = u(0);
+        if (requested === 0) return BigInt(mem.brk);
+        if (requested > mem.brk) mem.map(mem.brk, requested - mem.brk);
+        mem.brk = requested;
+        return BigInt(requested);
+      }
+      case 9: {
+        const addr = u(0);
+        const length = u(1);
+        const fd = a(4);
+        const offset = u(5);
+        const base = addr !== 0 && (u(3) & 16) !== 0 ? addr : mem.mmapAnonymous(length);
+        if (addr !== 0 && (u(3) & 16) !== 0) mem.map(addr, length);
+        if (fd >= 0) {
+          const file3 = this.files.get(fd);
+          if (file3) mem.writeBytes(base, file3.data.subarray(offset, offset + length));
+        }
+        return BigInt(base);
+      }
+      case 10:
+        return 0n;
+      case 11:
+        mem.unmap(u(0), u(1));
+        return 0n;
+      case 25:
+        return BigInt(-38);
+      case 28:
+        return 0n;
+      /* ── process and identity ─────────────────────────────────────────── */
+      case 39:
+        return 1n;
+      // getpid
+      case 102:
+      case 104:
+      case 107:
+      case 108:
+        return 0n;
+      // getuid/getgid/geteuid/getegid
+      case 110:
+        return 0n;
+      // getppid
+      case 186:
+        return 1n;
+      // gettid
+      case 39 + 4096:
+        return 0n;
+      case 60: {
+        if (this.scheduler && this.scheduler.count > 1) {
+          if (this.scheduler.exit(this.opts.now())) {
+            this.switched = true;
+            return 0n;
+          }
+        }
+        throw new ProcessExit(a(0) & 255);
+      }
+      case 231:
+        throw new ProcessExit(a(0) & 255);
+      case 63:
+        return this.uname(u(0));
+      case 158: {
+        const code = a(0);
+        if (code === 4098) {
+          cpu.fsBase = u(1);
+          return 0n;
+        }
+        if (code === 4097) {
+          cpu.gsBase = u(1);
+          return 0n;
+        }
+        if (code === 4099) {
+          mem.write(u(1), 8, BigInt(cpu.fsBase));
+          return 0n;
+        }
+        return BigInt(-22);
+      }
+      case 218:
+        return 1n;
+      // set_tid_address
+      case 273:
+        return 0n;
+      // set_robust_list
+      case 334:
+        return 0n;
+      // rseq
+      case 302: {
+        const out = u(3);
+        if (out !== 0) {
+          mem.write(out, 8, 8n * 1024n * 1024n);
+          mem.write(out + 8, 8, 0xffffffffffffffffn);
+        }
+        return 0n;
+      }
+      /* ── signals: recorded and ignored, since nothing raises them ─────── */
+      case 13:
+      case 14:
+      case 131:
+        return 0n;
+      // rt_sigaction, rt_sigprocmask, sigaltstack
+      /* ── time ─────────────────────────────────────────────────────────── */
+      case 96: {
+        const now = this.opts.now();
+        if (u(0) !== 0) {
+          mem.write(u(0), 8, BigInt(Math.floor(now / 1e3)));
+          mem.write(u(0) + 8, 8, BigInt(Math.floor(now % 1e3 * 1e3)));
+        }
+        return 0n;
+      }
+      case 201:
+        return BigInt(Math.floor(this.opts.now() / 1e3));
+      // time
+      case 228:
+      case 229: {
+        const now = this.opts.now();
+        mem.write(u(1), 8, BigInt(Math.floor(now / 1e3)));
+        mem.write(u(1) + 8, 8, BigInt(Math.floor(now % 1e3 * 1e6)));
+        return 0n;
+      }
+      case 35:
+      case 230: {
+        if (this.scheduler?.yieldNow(this.opts.now())) this.switched = true;
+        return 0n;
+      }
+      case 318: {
+        const length = u(1);
+        const bytes = new Uint8Array(length);
+        for (let i = 0; i < length; i++) bytes[i] = Math.floor(Math.random() * 256);
+        mem.writeBytes(u(0), bytes);
+        return BigInt(length);
+      }
+      case 56: {
+        if (!this.scheduler) return BigInt(-38);
+        const flags = u(0);
+        const CLONE_PARENT_SETTID = 1048576;
+        const CLONE_CHILD_SETTID = 16777216;
+        const CLONE_SETTLS = 524288;
+        const tid = this.scheduler.spawn(args[1], u(4), (flags & CLONE_SETTLS) !== 0);
+        if ((flags & CLONE_PARENT_SETTID) !== 0 && u(2) !== 0) mem.write(u(2), 4, BigInt(tid));
+        if ((flags & CLONE_CHILD_SETTID) !== 0 && u(3) !== 0) mem.write(u(3), 4, BigInt(tid));
+        this.threadsRequested++;
+        return BigInt(tid);
+      }
+      case 435:
+        return BigInt(-38);
+      // clone3: callers fall back to clone
+      /* ── epoll ────────────────────────────────────────────────────────────
+       * Go initialises its network poller the first time any file descriptor
+       * is opened — including a plain file — and treats a failure as fatal. So
+       * `os.ReadFile` on a static Go binary depends on epoll existing.
+       *
+       * Registration is accepted and no event is ever reported, which is
+       * correct for this machine: regular files are always ready and are read
+       * directly, and there are no sockets to become ready. */
+      case 213:
+      case 291: {
+        const fd = this.nextFd++;
+        this.pseudoFds.add(fd);
+        return BigInt(fd);
+      }
+      case 233:
+        return this.pseudoFds.has(a(0)) ? 0n : BigInt(-9);
+      case 232:
+      case 281:
+        return 0n;
+      case 284:
+      case 290: {
+        const fd = this.nextFd++;
+        this.pseudoFds.add(fd);
+        return BigInt(fd);
+      }
+      case 234:
+        return 0n;
+      // tgkill — signals are not delivered here
+      case 157:
+        return 0n;
+      // prctl — thread names and similar, nothing to store
+      case 202: {
+        if (!this.scheduler) return 0n;
+        const address = u(0);
+        const operation = a(1) & 127;
+        const FUTEX_WAIT = 0, FUTEX_WAKE = 1;
+        if (operation === FUTEX_WAIT) {
+          if (mem.read(address, 4) !== (args[2] & 0xffffffffn)) return BigInt(-11);
+          const timeout = u(3) !== 0 ? Number(mem.read(u(3), 8)) * 1e3 + Number(mem.read(u(3) + 8, 8)) / 1e6 : 0;
+          if (this.scheduler.wait(address, timeout, this.opts.now())) {
+            this.switched = true;
+            return 0n;
+          }
+          return BigInt(-11);
+        }
+        if (operation === FUTEX_WAKE) return BigInt(this.scheduler.wake(address, u(2)));
+        return 0n;
+      }
+      case 24: {
+        if (this.scheduler?.yieldNow(this.opts.now())) this.switched = true;
+        return 0n;
+      }
+      case 204: {
+        mem.write(u(2), 8, 1n);
+        return 8n;
+      }
+      default:
+        this.unimplemented.add(number);
+        return BigInt(-38);
+    }
+  }
+  /* ── helpers ────────────────────────────────────────────────────────────── */
+  writeTo(fd, bytes) {
+    if (fd === 1) {
+      this.opts.stdout(bytes);
+      return BigInt(bytes.length);
+    }
+    if (fd === 2) {
+      this.opts.stderr(bytes);
+      return BigInt(bytes.length);
+    }
+    const file3 = this.files.get(fd);
+    if (!file3) return BigInt(-9);
+    const position = file3.append ? file3.data.length : file3.position;
+    const end = Math.max(file3.data.length, position + bytes.length);
+    if (end > file3.data.length) {
+      const grown = new Uint8Array(end);
+      grown.set(file3.data);
+      file3.data = grown;
+    }
+    file3.data.set(bytes, position);
+    file3.position = position + bytes.length;
+    file3.dirty = true;
+    this.flush(file3);
+    return BigInt(bytes.length);
+  }
+  flush(file3) {
+    if (!file3.dirty || file3.isDirectory) return;
+    this.opts.vfs.writeFile(file3.path, file3.data, { cred: this.opts.cred });
+    file3.dirty = false;
+  }
+  open(path, flags, mode) {
+    const vfs = this.opts.vfs;
+    const cred = this.opts.cred;
+    const O_CREAT2 = 64, O_EXCL2 = 128, O_TRUNC2 = 512, O_APPEND = 1024;
+    const exists = vfs.lexists(path);
+    if (!exists && (flags & O_CREAT2) === 0) return BigInt(-2);
+    if (exists && (flags & O_CREAT2) !== 0 && (flags & O_EXCL2) !== 0) return BigInt(-17);
+    if (!exists) vfs.writeFile(path, new Uint8Array(0), { cred, mode: mode & 511 || 420 });
+    const stats = vfs.stat(path, { cred });
+    const isDirectory = stats.isDirectory();
+    let data = new Uint8Array(0);
+    if (!isDirectory) {
+      data = (flags & O_TRUNC2) !== 0 ? new Uint8Array(0) : vfs.readFile(path, cred);
+      if ((flags & O_TRUNC2) !== 0) vfs.writeFile(path, data, { cred });
+    }
+    const fd = this.nextFd++;
+    this.files.set(fd, {
+      path,
+      position: 0,
+      data,
+      dirty: false,
+      isDirectory,
+      append: (flags & O_APPEND) !== 0,
+      dirOffset: 0
+    });
+    return BigInt(fd);
+  }
+  /** Fill a 144-byte `struct stat`. */
+  stat(path, out, follow) {
+    const stats = follow ? this.opts.vfs.stat(path, { cred: this.opts.cred }) : this.opts.vfs.lstat(path);
+    const mem = this.opts.memory;
+    mem.map(out, SIZEOF_STAT);
+    for (let i = 0; i < SIZEOF_STAT; i++) mem.write8(out + i, 0);
+    mem.write(out, 8, BigInt(stats.dev));
+    mem.write(out + 8, 8, BigInt(stats.ino));
+    mem.write(out + 16, 8, BigInt(stats.nlink));
+    mem.write(out + 24, 4, BigInt(stats.mode));
+    mem.write(out + 28, 4, BigInt(stats.uid));
+    mem.write(out + 32, 4, BigInt(stats.gid));
+    mem.write(out + 40, 8, BigInt(stats.rdev));
+    mem.write(out + 48, 8, BigInt(stats.size));
+    mem.write(out + 56, 8, 4096n);
+    mem.write(out + 64, 8, BigInt(Math.ceil(stats.size / 512)));
+    mem.write(out + 72, 8, BigInt(Math.floor(stats.atimeMs / 1e3)));
+    mem.write(out + 88, 8, BigInt(Math.floor(stats.mtimeMs / 1e3)));
+    mem.write(out + 104, 8, BigInt(Math.floor(stats.ctimeMs / 1e3)));
+    return 0n;
+  }
+  /** `fstat` on stdin/stdout/stderr, which are character devices. */
+  statCharDevice(out) {
+    const mem = this.opts.memory;
+    mem.map(out, SIZEOF_STAT);
+    for (let i = 0; i < SIZEOF_STAT; i++) mem.write8(out + i, 0);
+    mem.write(out + 24, 4, BigInt(8592));
+    mem.write(out + 56, 8, 4096n);
+    return 0n;
+  }
+  getdents64(fd, buffer, size) {
+    const file3 = this.files.get(fd);
+    if (!file3) return BigInt(-9);
+    if (!file3.isDirectory) return BigInt(-20);
+    const names = [".", "..", ...this.opts.vfs.readdir(file3.path, this.opts.cred)];
+    const mem = this.opts.memory;
+    let used = 0;
+    while (file3.dirOffset < names.length) {
+      const name = names[file3.dirOffset];
+      const bytes = new TextEncoder().encode(name);
+      const length = Math.ceil((19 + bytes.length + 1) / 8) * 8;
+      if (used + length > size) break;
+      let type = 0;
+      try {
+        const mode = this.opts.vfs.lstat(
+          name === "." ? file3.path : name === ".." ? dirname(file3.path) : join(file3.path, name)
+        ).mode;
+        type = (mode & 61440) === S_IFDIR ? 4 : (mode & 61440) === S_IFREG ? 8 : (mode & 61440) === S_IFLNK ? 10 : 0;
+      } catch {
+      }
+      const at = buffer + used;
+      mem.write(at, 8, BigInt(file3.dirOffset + 1));
+      mem.write(at + 8, 8, BigInt(file3.dirOffset + 1));
+      mem.write(at + 16, 2, BigInt(length));
+      mem.write8(at + 18, type);
+      mem.writeBytes(at + 19, bytes);
+      mem.write8(at + 19 + bytes.length, 0);
+      used += length;
+      file3.dirOffset++;
+    }
+    return BigInt(used);
+  }
+  writeBounded(buffer, size, text) {
+    const bytes = new TextEncoder().encode(text);
+    const length = Math.min(bytes.length, size);
+    this.opts.memory.writeBytes(buffer, bytes.subarray(0, length));
+    return BigInt(length);
+  }
+  /** `struct utsname`: six fixed 65-byte character arrays. */
+  uname(out) {
+    const fields = ["Linux", this.opts.hostname, "6.1.0-sandboxedjs", "#1 SMP SandboxedJS", "x86_64", "(none)"];
+    const mem = this.opts.memory;
+    mem.map(out, 65 * 6);
+    fields.forEach((value, index) => {
+      const at = out + index * 65;
+      for (let i = 0; i < 65; i++) mem.write8(at + i, 0);
+      mem.writeCString(at, value);
+    });
+    return 0n;
+  }
+  /** Persist everything still open. Called when the guest exits. */
+  close() {
+    for (const file3 of this.files.values()) this.flush(file3);
+    this.files.clear();
+  }
+};
+
+// src/runtime/x86/threads.ts
+function blank(id) {
+  return {
+    id,
+    regs: new BigUint64Array(16),
+    xmmLo: new BigUint64Array(16),
+    xmmHi: new BigUint64Array(16),
+    rip: 0,
+    fsBase: 0,
+    gsBase: 0,
+    cf: false,
+    zf: false,
+    sf: false,
+    of: false,
+    pf: false,
+    af: false,
+    df: false,
+    state: "runnable",
+    waitAddress: 0,
+    waitUntil: 0
+  };
+}
+function save(cpu, context) {
+  context.regs.set(cpu.regs);
+  context.xmmLo.set(cpu.xmmLo);
+  context.xmmHi.set(cpu.xmmHi);
+  context.rip = cpu.rip;
+  context.fsBase = cpu.fsBase;
+  context.gsBase = cpu.gsBase;
+  context.cf = cpu.cf;
+  context.zf = cpu.zf;
+  context.sf = cpu.sf;
+  context.of = cpu.of;
+  context.pf = cpu.pf;
+  context.af = cpu.af;
+  context.df = cpu.df;
+}
+function restore(cpu, context) {
+  cpu.regs.set(context.regs);
+  cpu.xmmLo.set(context.xmmLo);
+  cpu.xmmHi.set(context.xmmHi);
+  cpu.rip = context.rip;
+  cpu.fsBase = context.fsBase;
+  cpu.gsBase = context.gsBase;
+  cpu.cf = context.cf;
+  cpu.zf = context.zf;
+  cpu.sf = context.sf;
+  cpu.of = context.of;
+  cpu.pf = context.pf;
+  cpu.af = context.af;
+  cpu.df = context.df;
+}
+var Scheduler = class {
+  constructor(cpu) {
+    this.cpu = cpu;
+    this.current = blank(1);
+    this.threads.push(this.current);
+  }
+  cpu;
+  threads = [];
+  current;
+  nextId = 2;
+  get currentId() {
+    return this.current.id;
+  }
+  get count() {
+    return this.threads.filter((t) => t.state !== "done").length;
+  }
+  /**
+   * Start a new thread at the caller's return address.
+   *
+   * A cloned thread resumes exactly where its parent is — immediately after the
+   * `syscall` instruction — with its own stack and `rax` of zero, which is how
+   * the child tells itself apart from the parent.
+   */
+  spawn(stackPointer, tlsBase, setTls) {
+    save(this.cpu, this.current);
+    const child = blank(this.nextId++);
+    child.regs.set(this.cpu.regs);
+    child.xmmLo.set(this.cpu.xmmLo);
+    child.xmmHi.set(this.cpu.xmmHi);
+    child.rip = this.cpu.rip;
+    child.fsBase = setTls ? tlsBase : this.cpu.fsBase;
+    child.gsBase = this.cpu.gsBase;
+    if (stackPointer !== 0n) child.regs[4] = stackPointer;
+    child.regs[0] = 0n;
+    this.threads.push(child);
+    return child.id;
+  }
+  /** Park the running thread on a futex, and run something else. */
+  wait(address, timeoutMs, now) {
+    this.current.state = "waiting";
+    this.current.waitAddress = address;
+    this.current.waitUntil = timeoutMs > 0 ? now + timeoutMs : 0;
+    return this.yieldNow(now);
+  }
+  /** Make up to `count` threads parked on `address` runnable. Returns how many. */
+  wake(address, count) {
+    let woken = 0;
+    for (const thread of this.threads) {
+      if (woken >= count) break;
+      if (thread.state === "waiting" && thread.waitAddress === address) {
+        thread.state = "runnable";
+        thread.waitAddress = 0;
+        woken++;
+      }
+    }
+    return woken;
+  }
+  /** Retire the running thread. Returns false when it was the last one. */
+  exit(now) {
+    this.current.state = "done";
+    return this.yieldNow(now);
+  }
+  /**
+   * Switch to the next runnable thread.
+   *
+   * Returns false when there is nothing else to run — the caller then has to
+   * decide whether that is a finished program or a deadlock.
+   */
+  yieldNow(now) {
+    for (const thread of this.threads) {
+      if (thread.state === "waiting" && thread.waitUntil !== 0 && now >= thread.waitUntil) {
+        thread.state = "runnable";
+        thread.waitAddress = 0;
+        thread.waitUntil = 0;
+      }
+    }
+    const start = this.threads.indexOf(this.current);
+    for (let i = 1; i <= this.threads.length; i++) {
+      const candidate = this.threads[(start + i) % this.threads.length];
+      if (candidate.state !== "runnable" || candidate === this.current) continue;
+      if (this.current.state !== "done") save(this.cpu, this.current);
+      restore(this.cpu, candidate);
+      this.current = candidate;
+      return true;
+    }
+    if (this.current.state === "waiting") {
+      this.current.state = "runnable";
+      this.current.waitAddress = 0;
+    }
+    return false;
+  }
+  /** True when every thread is parked — a genuine deadlock rather than a wait. */
+  get allBlocked() {
+    return this.threads.every((t) => t.state !== "runnable");
+  }
+};
+
+// src/runtime/x86/elf.ts
+var ELF_MAGIC = [127, 69, 76, 70];
+var PT_LOAD = 1;
+var PT_INTERP = 3;
+var PT_PHDR = 6;
+var AT_NULL = 0;
+var AT_PHDR = 3;
+var AT_PHENT = 4;
+var AT_PHNUM = 5;
+var AT_PAGESZ = 6;
+var AT_BASE = 7;
+var AT_FLAGS = 8;
+var AT_ENTRY = 9;
+var AT_UID = 11;
+var AT_EUID = 12;
+var AT_GID = 13;
+var AT_EGID = 14;
+var AT_HWCAP = 16;
+var AT_CLKTCK = 17;
+var AT_SECURE = 23;
+var AT_RANDOM = 25;
+var AT_HWCAP2 = 26;
+var AT_EXECFN = 31;
+function isElf(bytes) {
+  return bytes.length >= 4 && ELF_MAGIC.every((byte, i) => bytes[i] === byte);
+}
+var EM_X86_64 = 62;
+function summarize(bytes) {
+  if (!isElf(bytes) || bytes.length < 64) return null;
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const little = bytes[5] !== 2;
+  const type = view.getUint16(16, little);
+  const machine = view.getUint16(18, little);
+  let interpreter = null;
+  try {
+    const phoff = Number(view.getBigUint64(32, little));
+    const phentsize = view.getUint16(54, little);
+    const phnum = view.getUint16(56, little);
+    for (let i = 0; i < phnum; i++) {
+      const at = phoff + i * phentsize;
+      if (view.getUint32(at, little) !== PT_INTERP) continue;
+      const offset = Number(view.getBigUint64(at + 8, little));
+      const size = Number(view.getBigUint64(at + 32, little));
+      interpreter = new TextDecoder().decode(bytes.subarray(offset, offset + size)).replace(/\0.*$/, "");
+    }
+  } catch {
+  }
+  return {
+    machine,
+    type,
+    is64Bit: bytes[4] === 2,
+    isLittleEndian: little,
+    isDynamic: interpreter !== null,
+    interpreter
+  };
+}
+function loadElf(memory, bytes, loadBias = 0) {
+  if (!isElf(bytes)) throw new Error("not an ELF file");
+  if (bytes[4] !== 2) throw new Error("not a 64-bit ELF file");
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  const little = bytes[5] !== 2;
+  const type = view.getUint16(16, little);
+  const machine = view.getUint16(18, little);
+  const entry = Number(view.getBigUint64(24, little));
+  const phoff = Number(view.getBigUint64(32, little));
+  const phentSize = view.getUint16(54, little);
+  const phnum = view.getUint16(56, little);
+  const isPie = type === 3;
+  const bias = isPie ? loadBias : 0;
+  let brk = 0;
+  let interpreter = null;
+  let phdrAddress = 0;
+  for (let i = 0; i < phnum; i++) {
+    const at = phoff + i * phentSize;
+    const pType = view.getUint32(at, little);
+    const offset = Number(view.getBigUint64(at + 8, little));
+    const vaddr = Number(view.getBigUint64(at + 16, little)) + bias;
+    const filesz = Number(view.getBigUint64(at + 32, little));
+    const memsz = Number(view.getBigUint64(at + 40, little));
+    if (pType === PT_INTERP) {
+      interpreter = new TextDecoder().decode(bytes.subarray(offset, offset + filesz)).replace(/\0.*$/, "");
+      continue;
+    }
+    if (pType === PT_PHDR) {
+      phdrAddress = vaddr;
+      continue;
+    }
+    if (pType !== PT_LOAD) continue;
+    memory.map(vaddr, Math.max(memsz, 1));
+    if (filesz > 0) memory.writeBytes(vaddr, bytes.subarray(offset, offset + filesz));
+    brk = Math.max(brk, vaddr + memsz);
+  }
+  if (phdrAddress === 0) phdrAddress = bias + phoff;
+  brk = Math.ceil(brk / PAGE_SIZE) * PAGE_SIZE;
+  memory.brk = brk;
+  return {
+    entry: entry + bias,
+    base: bias,
+    interpreter,
+    phdrAddress,
+    phentSize,
+    phnum,
+    brk,
+    machine,
+    isPie
+  };
+}
+function buildStack(memory, elf, opts) {
+  const top2 = opts.top ?? 140737488289792;
+  const size = opts.size ?? 8 * 1024 * 1024;
+  memory.map(top2 - size, size);
+  let cursor = top2 - 4096;
+  const putString = (text) => {
+    const bytes = new TextEncoder().encode(text);
+    cursor -= bytes.length + 1;
+    memory.writeBytes(cursor, bytes);
+    memory.write8(cursor + bytes.length, 0);
+    return cursor;
+  };
+  const argvPointers = opts.argv.map(putString);
+  const envPointers = Object.entries(opts.env).filter(([, value]) => value !== void 0).map(([key, value]) => putString(`${key}=${value}`));
+  const execfn = argvPointers[0] ?? putString("");
+  cursor -= 16;
+  const randomAddress = cursor;
+  for (let i = 0; i < 16; i++) memory.write8(randomAddress + i, Math.floor(Math.random() * 256));
+  const auxv = [
+    [AT_PHDR, elf.phdrAddress],
+    [AT_PHENT, elf.phentSize],
+    [AT_PHNUM, elf.phnum],
+    [AT_PAGESZ, PAGE_SIZE],
+    [AT_BASE, opts.interpreterBase ?? 0],
+    [AT_FLAGS, 0],
+    [AT_ENTRY, elf.entry],
+    [AT_UID, 0],
+    [AT_EUID, 0],
+    [AT_GID, 0],
+    [AT_EGID, 0],
+    // Advertise only the baseline. Reporting SSE4/AVX would invite glibc's
+    // IFUNC resolvers to select string routines this interpreter cannot run.
+    [AT_HWCAP, 0],
+    [AT_HWCAP2, 0],
+    [AT_CLKTCK, 100],
+    [AT_SECURE, 0],
+    [AT_RANDOM, randomAddress],
+    [AT_EXECFN, execfn],
+    [AT_NULL, 0]
+  ];
+  const words = 1 + argvPointers.length + 1 + envPointers.length + 1 + auxv.length * 2;
+  let rsp = cursor - words * 8;
+  rsp -= rsp % 16;
+  let at = rsp;
+  const push = (value) => {
+    memory.write(at, 8, BigInt(value));
+    at += 8;
+  };
+  push(argvPointers.length);
+  for (const pointer of argvPointers) push(pointer);
+  push(0);
+  for (const pointer of envPointers) push(pointer);
+  push(0);
+  for (const [key, value] of auxv) {
+    push(key);
+    push(value);
+  }
+  return rsp;
+}
+
+// src/runtime/x86/index.ts
+init_path();
+var PIE_BASE = 93824992215040;
+var INTERPRETER_BASE = 139637976727552;
+var MACHINE_NAMES = {
+  3: "x86",
+  8: "MIPS",
+  20: "PowerPC",
+  21: "PowerPC 64-bit",
+  40: "ARM",
+  62: "x86-64",
+  183: "AArch64",
+  243: "RISC-V"
+};
+async function runElf(ctx, path, opts = {}) {
+  const image = ctx.vfs.readFile(path, ctx.cred);
+  const header = summarize(image);
+  if (!header) return ctx.fail(`${path}: not a valid ELF file`, 126);
+  if (!header.is64Bit || header.machine !== EM_X86_64) {
+    const name = MACHINE_NAMES[header.machine] ?? `machine 0x${header.machine.toString(16)}`;
+    ctx.warn(`${basename(path)}: ${name} binary; this machine emulates x86-64 only`);
+    return 126;
+  }
+  const memory = new Memory();
+  const elf = loadElf(memory, image, PIE_BASE);
+  let entry = elf.entry;
+  let interpreterBase = 0;
+  if (elf.interpreter) {
+    const loaderPath = elf.interpreter;
+    if (!ctx.vfs.lexists(loaderPath)) {
+      for (const line of missingLoader(path, loaderPath)) ctx.stderr.write(line + "\n");
+      return 126;
+    }
+    const loaderImage = ctx.vfs.readFile(loaderPath, ctx.cred);
+    const loader = loadElf(memory, loaderImage, INTERPRETER_BASE);
+    interpreterBase = loader.base;
+    entry = loader.entry;
+  }
+  let stdin = new Uint8Array(0);
+  if (!ctx.stdin.isTTY && !ctx.stdin.interactive) stdin = await ctx.stdin.readAll();
+  const syscalls = new LinuxSyscalls({
+    vfs: ctx.vfs,
+    cred: ctx.cred,
+    cwd: ctx.cwd,
+    memory,
+    stdin,
+    stdout: (bytes) => ctx.write(bytes),
+    stderr: (bytes) => ctx.stderr.write(bytes),
+    hostname: ctx.kernel.hostname,
+    now: ctx.kernel.now,
+    ...opts.trace ? { trace: opts.trace } : {}
+  });
+  const cpu = new Cpu({
+    memory,
+    onSyscall: syscalls.handle,
+    ...opts.instructionLimit !== void 0 ? { instructionLimit: opts.instructionLimit } : {}
+  });
+  syscalls.scheduler = new Scheduler(cpu);
+  cpu.rip = entry;
+  cpu.set(
+    RSP,
+    BigInt(
+      buildStack(memory, elf, {
+        argv: [ctx.name, ...ctx.args],
+        env: ctx.env,
+        interpreterBase
+      })
+    )
+  );
+  cpu.set(RDX, 0n);
+  try {
+    return await cpu.run();
+  } catch (e) {
+    if (e instanceof ProcessExit) return e.code;
+    if (e instanceof UnsupportedInstruction) {
+      ctx.warn(`${basename(path)}: ${e.message}`);
+      ctx.stderr.write(
+        "This binary uses an instruction the emulator does not implement \u2014 most\noften a vector (SSE/AVX) routine. Register state at the fault:\n"
+      );
+      for (const line of cpu.describe().split("\n")) ctx.stderr.write("  " + line + "\n");
+      return 132;
+    }
+    if (e instanceof SegFault) {
+      ctx.warn(`${basename(path)}: ${e.message}`);
+      return 139;
+    }
+    ctx.warn(e instanceof Error ? e.message : String(e));
+    return 1;
+  } finally {
+    syscalls.close();
+    if (syscalls.unimplemented.size > 0) {
+      ctx.stderr.write(
+        `note: unimplemented syscalls used: ${[...syscalls.unimplemented].sort((a, b) => a - b).join(", ")}
+`
+      );
+    }
+  }
+}
+function missingLoader(path, loader) {
+  return [
+    `${basename(path)}: needs the dynamic linker ${loader}, which is not in this container.`,
+    "",
+    "This binary is linked against shared libraries, so it cannot start until the",
+    "loader and the libraries it names are present. They are ordinary x86-64 files",
+    "and the emulator runs them as-is \u2014 copy them in from a Linux system:",
+    "",
+    `  ${loader}`,
+    "  /lib/x86_64-linux-gnu/libc.so.6",
+    "",
+    "A statically linked build needs none of this. If you control the build:",
+    "  Go     CGO_ENABLED=0 go build",
+    "  Rust   cargo build --target x86_64-unknown-linux-musl"
+  ];
+}
+var elfFormat = {
+  name: "elf",
+  priority: 20,
+  matches: (head2) => isElf(head2),
+  describe: (head2) => {
+    const header = summarize(head2);
+    if (!header) return "ELF object";
+    const machine = MACHINE_NAMES[header.machine] ?? `machine 0x${header.machine.toString(16)}`;
+    const kind = header.type === 3 ? header.isDynamic ? "pie executable" : "shared object" : header.type === 2 ? "executable" : "object";
+    return `ELF ${header.is64Bit ? "64-bit" : "32-bit"} ${header.isLittleEndian ? "LSB" : "MSB"} ${kind}, ${machine}` + (header.isDynamic ? ", dynamically linked" : ", statically linked");
+  },
+  run: (ctx, path) => runElf(ctx, path)
+};
+var x86 = defineCommand({
+  name: "x86",
+  path: "/usr/bin/x86",
+  summary: "run and inspect x86-64 Linux binaries",
+  usage: "x86 run <binary> [args...] | x86 info <binary> | x86 trace <binary>",
+  manual: `Runs a native x86-64 Linux executable on an emulated CPU, against the
+container's own filesystem.
+
+Any ELF binary marked executable also runs directly, so './tool' does the
+same thing as 'x86 run tool'.
+
+  info    report the architecture, linkage and required loader
+  trace   run with every syscall printed, for working out where a
+          program stops`,
+  async run(ctx) {
+    const [subcommand, target, ...rest] = ctx.args;
+    if (subcommand === void 0 || subcommand === "-h" || subcommand === "--help") {
+      ctx.line("Usage: x86 run <binary> [args...]");
+      ctx.line("       x86 info <binary>");
+      ctx.line("       x86 trace <binary> [args...]");
+      return subcommand === void 0 ? 2 : 0;
+    }
+    if (target === void 0) return ctx.fail(`${subcommand}: a binary is required`, 2);
+    const path = ctx.path(target);
+    if (!ctx.vfs.lexists(path)) return ctx.fail(`${target}: No such file or directory`, 1);
+    if (subcommand === "info") {
+      const header = summarize(ctx.vfs.readFile(path, ctx.cred).subarray(0, 4096));
+      if (!header) return ctx.fail(`${target}: not an ELF file`, 1);
+      const machine = MACHINE_NAMES[header.machine] ?? `0x${header.machine.toString(16)}`;
+      ctx.line(`file:      ${path}`);
+      ctx.line(`class:     ${header.is64Bit ? "ELF64" : "ELF32"}`);
+      ctx.line(`machine:   ${machine}`);
+      ctx.line(`linkage:   ${header.isDynamic ? "dynamic" : "static"}`);
+      if (header.interpreter) {
+        const present = ctx.vfs.lexists(header.interpreter);
+        ctx.line(`loader:    ${header.interpreter} ${present ? "(present)" : "(MISSING)"}`);
+      }
+      const runnable = header.is64Bit && header.machine === EM_X86_64 && (!header.interpreter || ctx.vfs.lexists(header.interpreter));
+      ctx.line(`runnable:  ${runnable ? "yes" : "no"}`);
+      return 0;
+    }
+    const forwarded = { ...ctx, args: rest, argv: [basename(path), ...rest] };
+    if (subcommand === "run") return await runElf(forwarded, path);
+    if (subcommand === "trace") {
+      return await runElf(forwarded, path, { trace: (line) => ctx.stderr.write(line + "\n") });
+    }
+    return ctx.fail(`unknown subcommand: ${subcommand}`, 2);
+  }
+});
+function x86Commands() {
+  return [x86];
+}
+var DECLARES_EXPORTS = /(?:^|[\s;{)])(?:var|let|const|function|class)\s+exports\b/;
+var NAME = "exports";
+function renameShadowedExports(source) {
+  if (!DECLARES_EXPORTS.test(source)) return null;
+  let ast;
+  try {
+    ast = acorn.parse(source, {
+      ecmaVersion: "latest",
+      sourceType: "module",
+      allowAwaitOutsideFunction: true,
+      allowHashBang: true
+    });
+  } catch {
+    return null;
+  }
+  const body = ast.body;
+  const isModule = body.some(
+    (node2) => node2.type.startsWith("Import") || node2.type.startsWith("Export")
+  );
+  if (!isModule) return null;
+  const programScope = { bindsExports: hoistedNames(body).has(NAME), parent: null };
+  if (!programScope.bindsExports) return null;
+  const targets = [];
+  let bail = false;
+  visit(ast, programScope);
+  if (bail || targets.length === 0) return null;
+  const replacement = freshName(source);
+  let out = source;
+  for (const target of [...targets].sort((a, b) => b.start - a.start)) {
+    const text = target.shorthand ? `${NAME}: ${replacement}` : replacement;
+    out = out.slice(0, target.start) + text + out.slice(target.end);
+  }
+  return out;
+  function visit(node2, scope) {
+    if (bail) return;
+    let childScope = scope;
+    let skip = NOTHING;
+    switch (node2.type) {
+      case "FunctionDeclaration":
+      case "FunctionExpression":
+      case "ArrowFunctionExpression": {
+        const names = /* @__PURE__ */ new Set();
+        for (const param of node2.params ?? []) collectPattern(param, names);
+        if (isExports(node2.id) && node2.type === "FunctionExpression") names.add(NAME);
+        const fnBody = node2.body;
+        if (fnBody?.type === "BlockStatement") {
+          for (const name of hoistedNames(fnBody.body)) names.add(name);
+        }
+        childScope = { bindsExports: names.has(NAME), parent: scope };
+        break;
+      }
+      case "CatchClause": {
+        const names = /* @__PURE__ */ new Set();
+        if (node2.param) collectPattern(node2.param, names);
+        childScope = { bindsExports: names.has(NAME), parent: scope };
+        break;
+      }
+      case "ClassDeclaration":
+      case "ClassExpression":
+        if (isExports(node2.id) && node2.type === "ClassExpression") {
+          childScope = { bindsExports: true, parent: scope };
+        }
+        break;
+      case "BlockStatement":
+      case "StaticBlock":
+        if (node2 !== ast.body) {
+          childScope = {
+            bindsExports: blockNames(node2.body).has(NAME),
+            parent: scope
+          };
+        }
+        break;
+      case "ForStatement":
+      case "ForInStatement":
+      case "ForOfStatement": {
+        const head2 = node2.init ?? node2.left;
+        if (head2?.type === "VariableDeclaration" && head2.kind !== "var") {
+          const names = /* @__PURE__ */ new Set();
+          for (const declarator of head2.declarations) {
+            collectPattern(declarator.id, names);
+          }
+          childScope = { bindsExports: names.has(NAME), parent: scope };
+        }
+        break;
+      }
+      /* `export { exports }` would have to become `exports as exports`, and
+       * `import { exports as x }` names someone else's binding. Neither is
+       * worth handling; refuse rather than rewrite them wrongly. */
+      case "ExportSpecifier":
+      case "ImportSpecifier":
+        if (isExports(node2.local) || isExports(node2.exported) || isExports(node2.imported)) {
+          bail = true;
+        }
+        return;
+      case "Identifier":
+        if (node2.name === NAME && resolvesToProgram(scope)) {
+          targets.push({ start: node2.start, end: node2.end, shorthand: false });
+        }
+        return;
+      // Property positions are names, not references to the binding.
+      case "MemberExpression":
+      case "MethodDefinition":
+      case "PropertyDefinition":
+        skip = node2.computed ? NOTHING : PROPERTY;
+        break;
+      case "Property":
+        if (node2.computed) break;
+        if (node2.shorthand) {
+          const value = node2.value;
+          if (isExports(value) && resolvesToProgram(scope)) {
+            targets.push({ start: value.start, end: value.end, shorthand: true });
+          }
+          return;
+        }
+        skip = PROPERTY;
+        break;
+      case "LabeledStatement":
+      case "BreakStatement":
+      case "ContinueStatement":
+        skip = LABEL;
+        break;
+    }
+    for (const [key, value] of Object.entries(node2)) {
+      if (key === "type" || key === "start" || key === "end" || skip.includes(key)) continue;
+      if (Array.isArray(value)) {
+        for (const item of value) if (isNode2(item)) visit(item, childScope);
+      } else if (isNode2(value)) {
+        visit(value, childScope);
+      }
+    }
+  }
+}
+function resolvesToProgram(scope) {
+  for (let current = scope; current; current = current.parent) {
+    if (current.bindsExports) return current.parent === null;
+  }
+  return false;
+}
 function hoistedNames(body) {
   const names = blockNames(body);
   collectVars(body, names);
@@ -24032,14 +27203,25 @@ function inspectPackage(ctx, packageDir, packageName) {
   const platformDeps = Object.keys(manifest.optionalDependencies ?? {}).filter(
     (dep) => /-(linux|darwin|win32|windows|freebsd)(-|$)|-(x64|arm64|ia32)(-|$)/.test(dep)
   );
-  if (nativeBins.length === 0 && platformDeps.length === 0) return { verdict: "ok", lines: [] };
+  const cpuConstrained = Array.isArray(manifest.cpu) && manifest.cpu.length > 0;
+  if (nativeBins.length === 0 && platformDeps.length === 0 && !cpuConstrained) {
+    return { verdict: "ok", lines: [] };
+  }
   const lines = [];
   const label = manifest.name ?? packageName;
   if (nativeBins.length > 0) {
     const [name, relative2] = nativeBins[0];
     lines.push(`${label}: '${name}' points at ${relative2}, which is a compiled executable, not JavaScript.`);
-  } else {
+  } else if (platformDeps.length > 0) {
     lines.push(`${label}: ships its executable as a platform-specific package, not as JavaScript.`);
+  } else {
+    const targets = [
+      ...manifest.os ?? [],
+      ...manifest.cpu ?? []
+    ].join(", ");
+    lines.push(`${label}: declares a platform constraint (${targets}), so its payload is a native binary.`);
+    lines.push("Packages shaped like this download a prebuilt executable during install and");
+    lines.push("run it from a JavaScript launcher.");
   }
   if (platformDeps.length > 0) {
     const shown = platformDeps.slice(0, 3).join(", ");
@@ -24048,10 +27230,18 @@ function inspectPackage(ctx, packageDir, packageName) {
     );
     lines.push("each of which is native machine code for one OS and CPU.");
   }
+  const hasLinuxBuild = platformDeps.some((dep) => /linux/.test(dep)) || platformDeps.length === 0;
   lines.push("");
-  lines.push("This container has no CPU to run machine code on \u2014 only JavaScript and");
-  lines.push("WebAssembly. The package is installed and its files are on disk, but the");
-  lines.push("command it provides cannot start.");
+  if (hasLinuxBuild) {
+    lines.push("This container emulates x86-64 Linux, so a linux-x64 build can run \u2014 but it");
+    lines.push("has to be on disk, and a dynamically linked one also needs its loader:");
+    lines.push("  x86 info <binary>            what it is and whether it can start");
+    lines.push("  /lib64/ld-linux-x86-64.so.2  copy in from any Linux system, with libc.so.6");
+    lines.push("Builds for macOS or Windows will not run.");
+  } else {
+    lines.push("This container emulates x86-64 Linux only. None of the platform packages");
+    lines.push("above target it, so there is no build here that can start.");
+  }
   return { verdict: "native", lines };
 }
 
@@ -24188,8 +27378,6 @@ async function linkGlobalPackages(ctx, stagingRoot, specs, quiet, runScripts) {
       ctx.stderr.write("\n");
       for (const line of report.lines) ctx.stderr.write(`npm warn ${line}
 `);
-      status = report.verdict === "native" ? 1 : status;
-      continue;
     }
     if (!quiet) {
       if (linked.length > 0) {
@@ -24399,8 +27587,6 @@ var npm = defineCommand({
           if (report.verdict !== "ok") {
             for (const line of report.lines) ctx.stderr.write(`npm warn ${line}
 `);
-            status = 1;
-            continue;
           }
           for (const bin of linked) ctx.line(`${join(binDir, bin)} -> ${dir3}`);
         }
@@ -24826,11 +28012,12 @@ function allCommands() {
     ...pythonCommands(),
     ...ffmpegCommands(),
     ...wasmCommands(),
+    ...x86Commands(),
     ...packageCommands()
   ];
 }
 function allFormats() {
-  return [wasmFormat, ...nativeFormats()];
+  return [wasmFormat, elfFormat, ...nativeFormats()];
 }
 function installUserland(kernel) {
   kernel.installCommands(allCommands());
@@ -25947,12 +29134,16 @@ exports.CallbackSink = CallbackSink;
 exports.CommandRegistry = CommandRegistry;
 exports.Container = Container;
 exports.ContainerFs = ContainerFs;
+exports.ExecFormatRegistry = ExecFormatRegistry;
 exports.FileInput = FileInput;
 exports.FileOutput = FileOutput;
+exports.GuestMemory = Memory;
 exports.IncompleteInputError = IncompleteInputError;
 exports.KERNEL_NAME = KERNEL_NAME;
 exports.KERNEL_RELEASE = KERNEL_RELEASE;
 exports.Kernel = Kernel;
+exports.LinuxSyscalls = LinuxSyscalls;
+exports.MAGIC_BYTES = MAGIC_BYTES;
 exports.NODE_VERSION = NODE_VERSION;
 exports.NPM_VERSION = NPM_VERSION;
 exports.NetworkStack = NetworkStack;
@@ -25974,16 +29165,22 @@ exports.TeeOutput = TeeOutput;
 exports.Terminal = Terminal;
 exports.UserDatabase = UserDatabase;
 exports.Vfs = Vfs;
+exports.WasiExit = WasiExit;
+exports.WasiPreview1 = WasiPreview1;
+exports.X86Cpu = Cpu;
 exports.allCommands = allCommands;
+exports.analyseWasm = analyse;
 exports.applyChmod = applyChmod;
 exports.braceExpand = braceExpand;
 exports.buildRootfs = buildRootfs;
 exports.builtinNames = builtinNames;
 exports.captureStdio = captureStdio;
+exports.clearWasmCache = clearWasmCache;
 exports.createContainer = createContainer;
 exports.createContext = createContext;
 exports.default = src_default;
 exports.defineCommand = defineCommand;
+exports.elfFormat = elfFormat;
 exports.evalArith = evalArith;
 exports.exitCodeForSignal = exitCodeForSignal;
 exports.expandPrompt = expandPrompt;
@@ -25999,15 +29196,23 @@ exports.installUserland = installUserland;
 exports.isBuiltinName = isBuiltinName;
 exports.isPythonAvailable = isPythonAvailable;
 exports.isSysError = isSysError;
+exports.isWasmBinary = isWasmBinary;
+exports.machoFormat = machoFormat;
 exports.makeCred = makeCred;
+exports.nativeFormats = nativeFormats;
 exports.normalizeSignal = normalizeSignal;
 exports.octalMode = octalMode;
 exports.parseShell = parse;
 exports.parseUmask = parseUmask;
+exports.peFormat = peFormat;
 exports.posixPath = path_exports;
 exports.resetPidCounter = resetPidCounter;
+exports.runElf = runElf;
+exports.runWasi = runWasi;
 exports.shellQuote = shellQuote;
 exports.strerror = strerror;
 exports.unameInfo = unameInfo;
+exports.wasmFormat = wasmFormat;
+exports.x86Commands = x86Commands;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map