diff --git a/el-compiler/runtime/el_runtime.js b/el-compiler/runtime/el_runtime.js
index e5c7a79..a223fdb 100644
--- a/el-compiler/runtime/el_runtime.js
+++ b/el-compiler/runtime/el_runtime.js
@@ -522,6 +522,328 @@ function math_sin(f)  { return Math.sin(f); }
 function math_cos(f)  { return Math.cos(f); }
 function math_pi()    { return Math.PI; }
 
+// ── DOM bridge (browser-only) ──────────────────────────────────────────────
+//
+// These functions wrap the browser DOM API. Each throws a descriptive error
+// when called from a Node environment, mirroring the pattern used by fs_*
+// in browser mode.
+
+function _ensureBrowser(name) {
+    if (IS_NODE) {
+        throw new Error(`${name}: not supported in Node runtime — DOM is browser-only`);
+    }
+}
+
+function dom_get_element(id) {
+    _ensureBrowser('dom_get_element');
+    return document.getElementById(String(id));
+}
+
+function dom_get_value(el) {
+    _ensureBrowser('dom_get_value');
+    return el == null ? '' : String(el.value ?? '');
+}
+
+function dom_set_value(el, v) {
+    _ensureBrowser('dom_set_value');
+    if (el != null) el.value = String(v);
+}
+
+function dom_get_text(el) {
+    _ensureBrowser('dom_get_text');
+    return el == null ? '' : String(el.textContent ?? '');
+}
+
+function dom_set_text(el, text) {
+    _ensureBrowser('dom_set_text');
+    if (el != null) el.textContent = String(text);
+}
+
+function dom_set_prop(el, prop, val) {
+    _ensureBrowser('dom_set_prop');
+    if (el != null) el[String(prop)] = val;
+}
+
+function dom_get_prop(el, prop) {
+    _ensureBrowser('dom_get_prop');
+    if (el == null) return null;
+    const v = el[String(prop)];
+    return v === undefined ? null : v;
+}
+
+function dom_set_style(el, prop, val) {
+    _ensureBrowser('dom_set_style');
+    if (el != null) el.style[String(prop)] = String(val);
+}
+
+function dom_add_class(el, cls) {
+    _ensureBrowser('dom_add_class');
+    if (el != null) el.classList.add(String(cls));
+}
+
+function dom_remove_class(el, cls) {
+    _ensureBrowser('dom_remove_class');
+    if (el != null) el.classList.remove(String(cls));
+}
+
+function dom_show(el) {
+    _ensureBrowser('dom_show');
+    if (el != null) el.style.display = '';
+}
+
+function dom_hide(el) {
+    _ensureBrowser('dom_hide');
+    if (el != null) el.style.display = 'none';
+}
+
+function dom_listen(el, event, handler) {
+    _ensureBrowser('dom_listen');
+    if (el != null) el.addEventListener(String(event), handler);
+}
+
+function dom_query(selector) {
+    _ensureBrowser('dom_query');
+    return document.querySelector(String(selector));
+}
+
+function dom_query_all(selector) {
+    _ensureBrowser('dom_query_all');
+    return Array.from(document.querySelectorAll(String(selector)));
+}
+
+function dom_create(tag) {
+    _ensureBrowser('dom_create');
+    return document.createElement(String(tag));
+}
+
+function dom_append(parent, child) {
+    _ensureBrowser('dom_append');
+    if (parent != null && child != null) parent.appendChild(child);
+}
+
+function dom_remove(el) {
+    _ensureBrowser('dom_remove');
+    if (el != null) el.remove();
+}
+
+function dom_is_null(el) {
+    return el === null || el === undefined;
+}
+
+// ── Extended DOM API (browser-only) ───────────────────────────────────────
+
+function dom_set_attr(el, attr, val) {
+    _ensureBrowser('dom_set_attr');
+    if (el != null) el.setAttribute(String(attr), String(val));
+}
+
+function dom_get_attr(el, attr) {
+    _ensureBrowser('dom_get_attr');
+    if (el == null) return '';
+    return el.getAttribute(String(attr)) ?? '';
+}
+
+function dom_remove_attr(el, attr) {
+    _ensureBrowser('dom_remove_attr');
+    if (el != null) el.removeAttribute(String(attr));
+}
+
+function dom_set_html(el, html) {
+    _ensureBrowser('dom_set_html');
+    if (el != null) el.innerHTML = String(html);
+}
+
+function dom_get_html(el) {
+    _ensureBrowser('dom_get_html');
+    return el == null ? '' : String(el.innerHTML ?? '');
+}
+
+function dom_get_parent(el) {
+    _ensureBrowser('dom_get_parent');
+    return el == null ? null : (el.parentElement ?? null);
+}
+
+function dom_contains_class(el, cls) {
+    _ensureBrowser('dom_contains_class');
+    if (el == null) return false;
+    return el.classList.contains(String(cls));
+}
+
+function dom_get_checked(el) {
+    _ensureBrowser('dom_get_checked');
+    return el == null ? false : Boolean(el.checked);
+}
+
+function dom_set_checked(el, val) {
+    _ensureBrowser('dom_set_checked');
+    if (el != null) el.checked = Boolean(val);
+}
+
+// ── Timer API (browser + Node) ─────────────────────────────────────────────
+
+function set_timeout(ms, cb) {
+    if (typeof setTimeout === 'undefined') {
+        throw new Error('set_timeout: setTimeout not available in this environment');
+    }
+    setTimeout(cb, ms | 0);
+}
+
+function set_interval(ms, cb) {
+    if (typeof setInterval === 'undefined') {
+        throw new Error('set_interval: setInterval not available in this environment');
+    }
+    return setInterval(cb, ms | 0);
+}
+
+function clear_interval(handle) {
+    if (typeof clearInterval !== 'undefined') clearInterval(handle);
+}
+
+// ── Local storage (browser-only) ───────────────────────────────────────────
+
+function local_storage_get(key) {
+    _ensureBrowser('local_storage_get');
+    return localStorage.getItem(String(key)) ?? '';
+}
+
+function local_storage_set(key, val) {
+    _ensureBrowser('local_storage_set');
+    localStorage.setItem(String(key), String(val));
+}
+
+function local_storage_remove(key) {
+    _ensureBrowser('local_storage_remove');
+    localStorage.removeItem(String(key));
+}
+
+// ── Window location / navigation (browser-only) ────────────────────────────
+
+function window_location() {
+    _ensureBrowser('window_location');
+    return window.location.href;
+}
+
+function window_redirect(url) {
+    _ensureBrowser('window_redirect');
+    window.location.href = String(url);
+}
+
+function window_on_load(cb) {
+    if (typeof document !== 'undefined') {
+        document.addEventListener('DOMContentLoaded', cb);
+    } else if (typeof window !== 'undefined') {
+        window.addEventListener('load', cb);
+    }
+    // In Node: no-op
+}
+
+// ── console_log (explicit debug log, distinct from println) ────────────────
+
+function console_log(msg) {
+    // eslint-disable-next-line no-console
+    console.log(String(msg));
+}
+
+// ── Window export helpers ──────────────────────────────────────────────────
+//
+// Expose El functions to the browser's global scope so they can be called
+// from inline event handlers (onclick="increment()") or by external JS.
+// In Node mode, writes to globalThis so the same pattern works in tests.
+
+function window_set(name, val) {
+    if (typeof window !== 'undefined') {
+        window[String(name)] = val;
+    } else if (typeof globalThis !== 'undefined') {
+        globalThis[String(name)] = val;
+    }
+}
+
+function window_get(name) {
+    if (typeof window !== 'undefined') {
+        const v = window[String(name)];
+        return v === undefined ? null : v;
+    }
+    return null;
+}
+
+// ── Promise helpers ────────────────────────────────────────────────────────
+//
+// Third-party APIs often return Promises but are not El @async functions.
+// These helpers let El programs chain .then / .catch without needing
+// native_js, and without requiring the callee to be @async.
+
+function promise_then(p, cb) {
+    return Promise.resolve(p).then(cb);
+}
+
+function promise_catch(p, cb) {
+    return Promise.resolve(p).catch(cb);
+}
+
+function promise_resolve(val) {
+    return Promise.resolve(val);
+}
+
+function promise_reject(msg) {
+    return Promise.reject(new Error(String(msg)));
+}
+
+// ── Object / Array utilities ───────────────────────────────────────────────
+//
+// Structural operations on Any-typed JS values. These complement the
+// El map/list primitives for interop with third-party library objects.
+
+function object_assign(target, source) {
+    return Object.assign(Object.assign({}, target), source);
+}
+
+function object_keys(obj) {
+    if (obj === null || obj === undefined) return [];
+    return Object.keys(obj);
+}
+
+function object_values(obj) {
+    if (obj === null || obj === undefined) return [];
+    return Object.values(obj);
+}
+
+function json_deep_clone(obj) {
+    if (obj === null || obj === undefined) return null;
+    return JSON.parse(JSON.stringify(obj));
+}
+
+function array_from(iterable) {
+    if (iterable === null || iterable === undefined) return [];
+    return Array.from(iterable);
+}
+
+function type_of(val) {
+    return typeof val;
+}
+
+function instanceof_check(val, constructor_name) {
+    if (typeof globalThis[constructor_name] === 'function') {
+        return val instanceof globalThis[constructor_name];
+    }
+    return false;
+}
+
+// ── native_js escape hatch ─────────────────────────────────────────────────
+//
+// Evaluate arbitrary JS from El source. Intended for calling third-party
+// browser libraries (Supabase, Stripe, etc.) until proper El bindings exist.
+// Use sparingly — this bypasses El's type system entirely.
+
+function native_js(code) {
+    // eslint-disable-next-line no-eval
+    return eval(String(code));
+}
+
+function native_js_call(obj, method, args) {
+    if (obj == null) throw new Error('native_js_call: object is null');
+    return obj[String(method)](...(Array.isArray(args) ? args : []));
+}
+
 // ── Stubs for not-yet-supported features ───────────────────────────────────
 //
 // These compile but throw when called. See spec/codegen-js.md §7.
@@ -632,6 +954,31 @@ const __el = {
     // Float / math
     float_to_str, int_to_float, float_to_int, format_float, decimal_round,
     str_to_float, math_sqrt, math_log, math_ln, math_sin, math_cos, math_pi,
+    // DOM bridge (browser-only)
+    dom_get_element, dom_get_value, dom_set_value, dom_get_text, dom_set_text,
+    dom_set_prop, dom_get_prop, dom_set_style, dom_add_class, dom_remove_class,
+    dom_show, dom_hide, dom_listen, dom_query, dom_query_all, dom_create,
+    dom_append, dom_remove, dom_is_null,
+    // Extended DOM
+    dom_set_attr, dom_get_attr, dom_remove_attr, dom_set_html, dom_get_html,
+    dom_get_parent, dom_contains_class, dom_get_checked, dom_set_checked,
+    // Timers
+    set_timeout, set_interval, clear_interval,
+    // Local storage
+    local_storage_get, local_storage_set, local_storage_remove,
+    // Window location
+    window_location, window_redirect, window_on_load,
+    // Debug
+    console_log,
+    // Window export helpers
+    window_set, window_get,
+    // Promise helpers
+    promise_then, promise_catch, promise_resolve, promise_reject,
+    // Object / Array utilities
+    object_assign, object_keys, object_values, json_deep_clone,
+    array_from, type_of, instanceof_check,
+    // native_js escape hatch
+    native_js, native_js_call,
     // CGI / DHARMA / Engram / LLM (stubs)
     el_cgi_init,
     dharma_connect, dharma_send, dharma_activate, dharma_emit, dharma_field,
@@ -676,4 +1023,27 @@ export {
     dharma_connect, dharma_send, dharma_activate, dharma_emit, dharma_field,
     engram_node, engram_search, engram_activate,
     llm_call, llm_call_system,
+    // DOM bridge
+    dom_get_element, dom_get_value, dom_set_value, dom_get_text, dom_set_text,
+    dom_set_prop, dom_get_prop, dom_set_style, dom_add_class, dom_remove_class,
+    dom_show, dom_hide, dom_listen, dom_query, dom_query_all, dom_create,
+    dom_append, dom_remove, dom_is_null,
+    // Extended DOM
+    dom_set_attr, dom_get_attr, dom_remove_attr, dom_set_html, dom_get_html,
+    dom_get_parent, dom_contains_class, dom_get_checked, dom_set_checked,
+    // Timers
+    set_timeout, set_interval, clear_interval,
+    // Local storage
+    local_storage_get, local_storage_set, local_storage_remove,
+    // Window location
+    window_location, window_redirect, window_on_load,
+    // Debug
+    console_log,
+    // Window / native_js
+    window_set, window_get, native_js, native_js_call,
+    // Promise helpers
+    promise_then, promise_catch, promise_resolve, promise_reject,
+    // Object / Array utilities
+    object_assign, object_keys, object_values, json_deep_clone,
+    array_from, type_of, instanceof_check,
 };
diff --git a/el-compiler/src/codegen-js.el b/el-compiler/src/codegen-js.el
index b6c0b48..876bf9a 100644
--- a/el-compiler/src/codegen-js.el
+++ b/el-compiler/src/codegen-js.el
@@ -86,6 +86,57 @@ fn js_binop(op: String) -> String {
     op
 }
 
+// ── Known El runtime method names ─────────────────────────────────────────────
+//
+// These are the method shortforms exported by el_runtime.js and used by the
+// El C-backend convention of `obj.method(args)` -> `method(obj, args)`.
+// Any method name NOT in this set is treated as a native JS method call on the
+// receiver object, emitting `obj.method(args)` directly.
+//
+// This is the mechanism that makes `client.auth.signInWithOtp(payload)` work
+// without `native_js_call`: the receiver is Any-typed, the method is unknown
+// to El, so codegen emits the JS call directly.
+
+fn js_is_el_method(name: String) -> Bool {
+    if str_eq(name, "append") { return true }
+    if str_eq(name, "len") { return true }
+    if str_eq(name, "get") { return true }
+    if str_eq(name, "map_get") { return true }
+    if str_eq(name, "map_set") { return true }
+    false
+}
+
+// ── Async function tracking ───────────────────────────────────────────────────
+//
+// Functions decorated with @async are recorded here. Any call to a known-async
+// builtin (http_get, http_post, http_post_json) or to a user-declared @async
+// function gets an `await` prefix in generated JS.
+//
+// Known-async builtins — these return Promise<T> in el_runtime.js.
+fn js_is_async_builtin(name: String) -> Bool {
+    if str_eq(name, "http_get") { return true }
+    if str_eq(name, "http_post") { return true }
+    if str_eq(name, "http_post_json") { return true }
+    if str_eq(name, "http_get_with_headers") { return true }
+    if str_eq(name, "http_post_with_headers") { return true }
+    false
+}
+
+fn js_register_async_fn(name: String) -> Bool {
+    let csv: String = state_get("__js_async_fns")
+    if str_eq(csv, "") { csv = "," }
+    let key: String = "," + name + ","
+    if str_contains(csv, key) { return true }
+    state_set("__js_async_fns", csv + name + ",")
+    return true
+}
+
+fn js_is_async_fn(name: String) -> Bool {
+    let csv: String = state_get("__js_async_fns")
+    if str_eq(csv, "") { return false }
+    return str_contains(csv, "," + name + ",")
+}
+
 // ── Int-name tracking (mirrors codegen.el) ────────────────────────────────────
 
 fn js_is_int_name(name: String) -> Bool {
@@ -377,20 +428,38 @@ fn js_cg_expr(expr: Map<String, Any>) -> String {
 
         if func_kind == "Ident" {
             let fn_name: String = func["name"]
-            return fn_name + "(" + args_c + ")"
+            let call_expr: String = fn_name + "(" + args_c + ")"
+            if js_is_async_builtin(fn_name) {
+                return "await " + call_expr
+            }
+            if js_is_async_fn(fn_name) {
+                return "await " + call_expr
+            }
+            return call_expr
         }
 
         if func_kind == "Field" {
-            // El's `obj.method(args)` becomes `method(obj, args)` — same
-            // convention as the C backend. The runtime exports method
-            // shortforms (append, len, get, map_get, map_set) that match.
             let obj = func["object"]
             let field: String = func["field"]
             let obj_c: String = js_cg_expr(obj)
-            if arity > 0 {
-                return field + "(" + obj_c + ", " + args_c + ")"
+            // If the method is a known El runtime shortform, keep the El
+            // convention: `method(obj, args)`. This preserves backward
+            // compatibility with list.append(x), map.map_get(k), etc.
+            if js_is_el_method(field) {
+                if arity > 0 {
+                    return field + "(" + obj_c + ", " + args_c + ")"
+                }
+                return field + "(" + obj_c + ")"
             }
-            return field + "(" + obj_c + ")"
+            // Unknown method — emit as a native JS method call on the
+            // receiver. This handles Any-typed values (third-party library
+            // objects, DOM elements, Promises, etc.) without requiring
+            // native_js_call. Example: `client.auth.signInWithOtp(payload)`
+            // emits `client["auth"].signInWithOtp(args_c)`.
+            if arity > 0 {
+                return obj_c + "." + field + "(" + args_c + ")"
+            }
+            return obj_c + "." + field + "()"
         }
 
         let fn_c: String = js_cg_expr(func)
@@ -398,22 +467,39 @@ fn js_cg_expr(expr: Map<String, Any>) -> String {
     }
 
     if kind == "Field" {
-        // El's `obj.foo` becomes JS `obj["foo"]` — works on plain objects
-        // (maps) and on JS objects with prototype. el_get_field is a
-        // runtime helper for callers that want EL_NULL on missing keys.
+        // El's `obj.foo` becomes JS `obj["foo"]` — direct bracket access.
+        // This works for plain El map objects AND for real JS objects with
+        // prototype-inherited properties (DOM elements, third-party library
+        // objects, Promises, etc.). el_get_field used hasOwnProperty which
+        // silently returned null for inherited props, breaking e.g. client.auth.
+        //
+        // Nil-propagation: `obj?.foo` emits `(obj)?.["foo"] ?? null`.
         let obj = expr["object"]
         let field: String = expr["field"]
+        let obj_kind: String = obj["expr"]
+        if str_eq(obj_kind, "Try") {
+            let inner = obj["inner"]
+            let inner_c: String = js_cg_expr(inner)
+            return "(" + inner_c + ")?.[" + js_str_lit(field) + "] ?? null"
+        }
         let obj_c: String = js_cg_expr(obj)
-        return "el_get_field(" + obj_c + ", " + js_str_lit(field) + ")"
+        return obj_c + "[" + js_str_lit(field) + "]"
     }
 
     if kind == "Index" {
         // Map vs list dispatch on the index expression kind, same as C.
+        // If the object is a Try (nil-propagation), use JS optional indexing.
         let obj = expr["object"]
         let idx = expr["index"]
         let obj_c: String = js_cg_expr(obj)
         let idx_c: String = js_cg_expr(idx)
         let idx_kind: String = idx["expr"]
+        let obj_kind: String = obj["expr"]
+        if str_eq(obj_kind, "Try") {
+            let inner = obj["inner"]
+            let inner_c: String = js_cg_expr(inner)
+            return "(" + inner_c + ")?.[" + idx_c + "] ?? null"
+        }
         if str_eq(idx_kind, "Str") {
             return "el_get_field(" + obj_c + ", " + idx_c + ")"
         }
@@ -453,6 +539,12 @@ fn js_cg_expr(expr: Map<String, Any>) -> String {
     }
 
     if kind == "Try" {
+        // Postfix `?` — nil-propagation guard.
+        // When used as `expr?.field` the Field handler above intercepts and
+        // emits `(expr)?.["field"]`. Here, a bare `expr?` (not followed by
+        // field/index access) passes through to the inner expression unchanged
+        // (it acts as an identity but marks the value as "nil-propagating" for
+        // its caller). This matches the C backend's current behavior.
         let inner = expr["inner"]
         return js_cg_expr(inner)
     }
@@ -470,6 +562,13 @@ fn js_cg_expr(expr: Map<String, Any>) -> String {
         return js_cg_match(expr)
     }
 
+    // Lambda (anonymous function literal): fn(params) -> RetType { body }
+    // Emitted as a JS arrow function expression: (params) => { body }.
+    // Used for inline callbacks: dom_listen(el, "click", fn(e: Any) -> Void { ... })
+    if kind == "Lambda" {
+        return js_cg_lambda(expr)
+    }
+
     "null"
 }
 
@@ -528,8 +627,16 @@ fn js_cg_match(expr: Map<String, Any>) -> String {
                             if str_eq(v, "true") { let bv = "true" }
                             let parts = native_list_append(parts, "if (" + subj_var + " === " + bv + ") return (" + body_c + "); ")
                         } else {
-                            // unknown pattern → wildcard
-                            let parts = native_list_append(parts, "return (" + body_c + "); ")
+                            if str_eq(pkind, "Variant") {
+                                // Enum::Variant patterns — El enums compile to plain
+                                // strings (the variant name) or ints. Match the subject
+                                // against the variant name string.
+                                let variant: String = pat["variant"]
+                                let parts = native_list_append(parts, "if (str_eq(" + subj_var + ", " + js_str_lit(variant) + ")) return (" + body_c + "); ")
+                            } else {
+                                // unknown pattern → wildcard
+                                let parts = native_list_append(parts, "return (" + body_c + "); ")
+                            }
                         }
                     }
                 }
@@ -541,6 +648,65 @@ fn js_cg_match(expr: Map<String, Any>) -> String {
     str_join(parts, "")
 }
 
+// ── Lambda codegen ────────────────────────────────────────────────────────────
+//
+// Anonymous function literals: fn(params) -> RetType { body }
+//
+// Strategy: emit the lambda as a hoisted JS function declaration with a
+// generated name (__lambda_N), then return the name as the expression value.
+// This works because JS function declarations are hoisted within their scope,
+// so the generated name is valid at any use site within the same function or
+// module. The emitted code looks like:
+//
+//   function __lambda_1(event) { dom_hide(spinner); }
+//   ...
+//   dom_listen(btn, "click", __lambda_1);
+//
+// This approach is clean, debuggable, and avoids any need for a string-buffer
+// mode in the codegen.
+
+fn js_next_lambda_id() -> String {
+    let csv: String = state_get("__js_lambda_counter")
+    let n = 0
+    if !str_eq(csv, "") {
+        let n = str_to_int(csv)
+    }
+    let n = n + 1
+    state_set("__js_lambda_counter", native_int_to_str(n))
+    native_int_to_str(n)
+}
+
+fn js_cg_lambda(expr: Map<String, Any>) -> String {
+    let params = expr["params"]
+    let body = expr["body"]
+    let ret_type: String = expr["ret_type"]
+    let id: String = js_next_lambda_id()
+    let lambda_name: String = "__lambda_" + id
+    let params_str: String = js_params_str(params)
+    // Emit the function definition immediately into the output stream.
+    // It will appear before the statement containing this expression.
+    js_emit_line("function " + lambda_name + "(" + params_str + ") {")
+    let decl = native_list_empty()
+    let np: Int = native_list_len(params)
+    let pi = 0
+    while pi < np {
+        let param = native_list_get(params, pi)
+        let pname: String = param["name"]
+        let decl = native_list_append(decl, pname)
+        let pi = pi + 1
+    }
+    let body_xformed = body
+    if !str_eq(ret_type, "Void") {
+        let body_xformed = js_transform_implicit_return(body)
+    }
+    js_build_int_names_for_params(params)
+    js_cg_stmts(body_xformed, "  ", decl)
+    js_emit_line("}")
+    js_emit_blank()
+    // Return the function name as the expression value.
+    lambda_name
+}
+
 // ── Variable scope tracking ───────────────────────────────────────────────────
 //
 // El allows `let x = ...` to redeclare in the same scope. JS would throw
@@ -646,6 +812,27 @@ fn js_cg_stmt(stmt: Map<String, Any>, indent: String, declared: [String]) -> [St
     if kind == "TypeDef" { return declared }
     if kind == "EnumDef" { return declared }
     if kind == "Import"  { return declared }
+
+    if kind == "TryCatch" {
+        let try_body = stmt["try_body"]
+        let catch_name: String = stmt["catch_name"]
+        let catch_body = stmt["catch_body"]
+        js_emit_line(indent + "try {")
+        js_cg_stmts(try_body, indent + "  ", native_list_clone(declared))
+        js_emit_line(indent + "} catch (" + catch_name + ") {")
+        js_cg_stmts(catch_body, indent + "  ", native_list_clone(declared))
+        js_emit_line(indent + "}")
+        return declared
+    }
+
+    // ExternFn: the function exists in the JS environment (loaded via <script>
+    // tag or the module context). Emit a comment so the generated file is
+    // self-documenting, but no JS function body — the implementation is external.
+    if kind == "ExternFn" {
+        let ename: String = stmt["name"]
+        js_emit_line(indent + "// extern fn " + ename + " — provided by the JS environment")
+        return declared
+    }
     if kind == "CgiBlock" {
         // CGI blocks compile to a no-op + warning comment in JS target.
         // The runtime cgi identity is server-side; UI code is not a CGI
@@ -785,16 +972,30 @@ fn js_cg_fn(stmt: Map<String, Any>) -> Void {
     let params = stmt["params"]
     let body = stmt["body"]
     let ret_type: String = stmt["ret_type"]
+    let decorator: String = stmt["decorator"]
     let params_str: String = js_params_str(params)
     js_build_int_names_for_params(params)
 
-    // Special-case `fn main` — emit as a regular function and call it
-    // at module bottom (after all top-level statements). This matches
-    // the C backend's behavior where `fn main` is the entry point.
-    if fn_name == "main" {
-        js_emit_line("function main(" + params_str + ") {")
+    // Detect @async decorator — emit `async function` and register the name
+    // so call sites for this function get `await` prefixed automatically.
+    // When the decorator field is absent, el_get_field returns null; str_eq
+    // handles null safely (returns false), so no special nil-check is needed.
+    if str_eq(decorator, "async") {
+        js_register_async_fn(fn_name)
+        if fn_name == "main" {
+            js_emit_line("async function main(" + params_str + ") {")
+        } else {
+            js_emit_line("async function " + fn_name + "(" + params_str + ") {")
+        }
     } else {
-        js_emit_line("function " + fn_name + "(" + params_str + ") {")
+        // Special-case `fn main` — emit as a regular function and call it
+        // at module bottom (after all top-level statements). This matches
+        // the C backend's behavior where `fn main` is the entry point.
+        if fn_name == "main" {
+            js_emit_line("function main(" + params_str + ") {")
+        } else {
+            js_emit_line("function " + fn_name + "(" + params_str + ") {")
+        }
     }
 
     let decl = native_list_empty()
@@ -830,50 +1031,133 @@ fn js_is_top_level_decl(stmt: Map<String, Any>) -> Bool {
     if kind == "Import"  { return true }
     if kind == "CgiBlock" { return true }
     if kind == "ServiceBlock" { return true }
+    if kind == "ExternFn" { return true }
     false
 }
 
 // ── Entry point ───────────────────────────────────────────────────────────────
 
 fn codegen_js(stmts: [Map<String, Any>], source: String) -> String {
+    codegen_js_inner(stmts, source, false, "")
+}
+
+fn codegen_js_bundle(stmts: [Map<String, Any>], source: String, runtime_content: String) -> String {
+    codegen_js_inner(stmts, source, true, runtime_content)
+}
+
+fn codegen_js_inner(stmts: [Map<String, Any>], source: String, bundle_mode: Bool, runtime_content: String) -> String {
     // Reset per-compile state.
     state_set("__js_int_names", "")
     state_set("__js_match_counter", "")
+    state_set("__js_async_fns", "")
+    state_set("__js_lambda_counter", "")
 
-    // Preamble: inline the runtime via a single import that side-effects
-    // globalThis. The runtime path is resolved relative to the generated
-    // output; users running `elc --target=js` are responsible for ensuring
-    // el_runtime.js is reachable. For self-contained output, the runtime
-    // could be inlined; that is a follow-up.
+    // Preamble: in bundle mode, inline the runtime and wrap in IIFE.
+    // In module mode, emit a single import that side-effects globalThis.
     js_emit_line("// Generated by elc --target=js")
-    js_emit_line("// Runtime: foundation/el/el-compiler/runtime/el_runtime.js")
-    js_emit_line("import \"./el_runtime.js\";")
-    js_emit_line("const {")
-    js_emit_line("  println, print, el_str_concat, str_concat, str_eq, str_starts_with, str_ends_with,")
-    js_emit_line("  str_len, int_to_str, str_to_int, str_slice, str_contains, str_replace,")
-    js_emit_line("  str_to_upper, str_to_lower, str_trim, str_index_of, str_split, str_char_at,")
-    js_emit_line("  str_char_code, str_lower, str_upper, el_abs, el_max, el_min,")
-    js_emit_line("  el_list_new, el_list_len, el_list_get, el_list_append, el_list_empty, el_list_clone,")
-    js_emit_line("  list_push, list_join, list_range,")
-    js_emit_line("  el_map_new, el_get_field, el_map_get, el_map_set,")
-    js_emit_line("  http_get, http_post, http_post_json,")
-    js_emit_line("  fs_read, fs_write, fs_list,")
-    js_emit_line("  json_parse, json_stringify, json_get, json_get_string, json_get_int,")
-    js_emit_line("  time_now, time_now_utc, sleep_ms, bool_to_str, exit_program,")
-    js_emit_line("  el_retain, el_release,")
-    js_emit_line("  append, len, get, map_get, map_set,")
-    js_emit_line("  native_list_get, native_list_len, native_list_append, native_list_empty,")
-    js_emit_line("  native_list_clone, native_string_chars, native_int_to_str,")
-    js_emit_line("  args, state_set, state_get, state_del, state_keys, env,")
-    js_emit_line("  dharma_connect, dharma_send, dharma_emit, dharma_field, dharma_activate,")
-    js_emit_line("  engram_node, engram_search, engram_activate,")
-    js_emit_line("  llm_call, llm_call_system,")
-    js_emit_line("} = globalThis.__el;")
+    if bundle_mode {
+        js_emit_line("// Bundle mode: runtime inlined, no import statement needed.")
+        js_emit_line("// Drop directly into a <script> tag.")
+        js_emit_line(";(function() {")
+        js_emit_line("\"use strict\";")
+        // Inline the runtime content verbatim (already read from el_runtime.js).
+        // Strip the final ES export lines -- they use `export` syntax which is
+        // not valid inside an IIFE. The globalThis.__el assignment is what matters.
+        js_emit_line(js_strip_es_exports(runtime_content))
+        js_emit_line("")
+    } else {
+        js_emit_line("// Runtime: foundation/el/el-compiler/runtime/el_runtime.js")
+        js_emit_line("import \"./el_runtime.js\";")
+    }
+    // In module mode: destructure all builtins off globalThis.__el so call
+    // sites stay flat (println(x) not el.println(x)).
+    // In bundle mode: function declarations from the inlined runtime are
+    // already in scope within the IIFE -- no destructure needed.
+    if !bundle_mode {
+        js_emit_line("const {")
+        js_emit_line("  println, print, el_str_concat, str_concat, str_eq, str_starts_with, str_ends_with,")
+        js_emit_line("  str_len, int_to_str, str_to_int, str_slice, str_contains, str_replace,")
+        js_emit_line("  str_to_upper, str_to_lower, str_trim, str_index_of, str_split, str_char_at,")
+        js_emit_line("  str_char_code, str_lower, str_upper, el_abs, el_max, el_min,")
+        js_emit_line("  el_list_new, el_list_len, el_list_get, el_list_append, el_list_empty, el_list_clone,")
+        js_emit_line("  list_push, list_join, list_range,")
+        js_emit_line("  el_map_new, el_get_field, el_map_get, el_map_set,")
+        js_emit_line("  http_get, http_post, http_post_json,")
+        js_emit_line("  fs_read, fs_write, fs_list,")
+        js_emit_line("  json_parse, json_stringify, json_get, json_get_string, json_get_int,")
+        js_emit_line("  time_now, time_now_utc, sleep_ms, bool_to_str, exit_program,")
+        js_emit_line("  el_retain, el_release,")
+        js_emit_line("  append, len, get, map_get, map_set,")
+        js_emit_line("  native_list_get, native_list_len, native_list_append, native_list_empty,")
+        js_emit_line("  native_list_clone, native_string_chars, native_int_to_str,")
+        js_emit_line("  args, state_set, state_get, state_del, state_keys, env,")
+        js_emit_line("  dharma_connect, dharma_send, dharma_emit, dharma_field, dharma_activate,")
+        js_emit_line("  engram_node, engram_search, engram_activate,")
+        js_emit_line("  llm_call, llm_call_system,")
+        js_emit_line("  dom_get_element, dom_get_value, dom_set_value, dom_get_text, dom_set_text,")
+        js_emit_line("  dom_set_prop, dom_get_prop, dom_set_style, dom_add_class, dom_remove_class,")
+        js_emit_line("  dom_show, dom_hide, dom_listen, dom_query, dom_query_all, dom_create,")
+        js_emit_line("  dom_append, dom_remove, dom_is_null,")
+        js_emit_line("  dom_set_attr, dom_get_attr, dom_remove_attr, dom_set_html, dom_get_html,")
+        js_emit_line("  dom_get_parent, dom_contains_class, dom_get_checked, dom_set_checked,")
+        js_emit_line("  set_timeout, set_interval, clear_interval,")
+        js_emit_line("  local_storage_get, local_storage_set, local_storage_remove,")
+        js_emit_line("  window_location, window_redirect, window_on_load,")
+        js_emit_line("  console_log,")
+        js_emit_line("  window_set, window_get, native_js, native_js_call,")
+        js_emit_line("  promise_then, promise_catch, promise_resolve, promise_reject,")
+        js_emit_line("  object_assign, object_keys, object_values, json_deep_clone,")
+        js_emit_line("  array_from, type_of, instanceof_check,")
+        js_emit_line("} = globalThis.__el;")
+        js_emit_blank()
+    }
+
+    // URL import pass: emit `import "url"` (module mode) or a comment
+    // (bundle mode) for any import whose path starts with http(s):// or
+    // doesn't end in .el (i.e., it's a JS/CSS/CDN import, not an El source
+    // import which was already inlined by resolve_imports).
+    let n: Int = native_list_len(stmts)
+    let i = 0
+    while i < n {
+        let stmt = native_list_get(stmts, i)
+        let sk: String = stmt["stmt"]
+        if str_eq(sk, "Import") {
+            let ipath: String = stmt["path"]
+            let is_url = str_starts_with(ipath, "http://")
+            let is_url = is_url || str_starts_with(ipath, "https://")
+            let is_js = !str_ends_with(ipath, ".el")
+            if is_url || is_js {
+                if bundle_mode {
+                    js_emit_line("// external: " + ipath)
+                } else {
+                    js_emit_line("import " + js_str_lit(ipath) + ";")
+                }
+            }
+        }
+        let i = i + 1
+    }
     js_emit_blank()
 
-    // Function definitions
+    // Pre-registration pass: scan all FnDefs for @async decorators so that
+    // forward calls to @async functions get `await` even if the callee is
+    // defined after the caller.
     let n: Int = native_list_len(stmts)
     let i = 0
+    while i < n {
+        let stmt = native_list_get(stmts, i)
+        let sk: String = stmt["stmt"]
+        if str_eq(sk, "FnDef") {
+            let dec: String = stmt["decorator"]
+            if str_eq(dec, "async") {
+                let aname: String = stmt["name"]
+                js_register_async_fn(aname)
+            }
+        }
+        let i = i + 1
+    }
+
+    // Function definitions
+    let i = 0
     while i < n {
         let stmt = native_list_get(stmts, i)
         if js_is_fndef(stmt) {
@@ -921,6 +1205,41 @@ fn codegen_js(stmts: [Map<String, Any>], source: String) -> String {
         js_emit_line("main();")
     }
 
+    // Close IIFE in bundle mode.
+    if bundle_mode {
+        js_emit_line("")
+        js_emit_line("})();")
+    }
+
     // Return empty string — output was streamed via println
     ""
 }
+
+// Strip ES module export statements from runtime content for IIFE embedding.
+// The runtime ends with `export { ... }` and `export { __el as default }` lines
+// that are invalid inside an IIFE. We strip everything from the first top-level
+// `export {` line onward.
+//
+// Also strips `import` statements at the top if any (though el_runtime.js has none).
+fn js_strip_es_exports(content: String) -> String {
+    let lines: [String] = str_split(content, "\n")
+    let n: Int = native_list_len(lines)
+    let out: [String] = native_list_empty()
+    let i = 0
+    while i < n {
+        let line: String = native_list_get(lines, i)
+        let trimmed: String = str_trim(line)
+        // Stop at top-level `export {` or `export default`
+        if str_starts_with(trimmed, "export {") {
+            let i = n
+        } else {
+            if str_starts_with(trimmed, "export default") {
+                let i = n
+            } else {
+                let out = native_list_append(out, line)
+            }
+        }
+        let i = i + 1
+    }
+    str_join(out, "\n")
+}
diff --git a/el-compiler/src/compiler.el b/el-compiler/src/compiler.el
index fef934b..e74b38a 100644
--- a/el-compiler/src/compiler.el
+++ b/el-compiler/src/compiler.el
@@ -29,7 +29,7 @@ fn compile(source: String) -> String {
     codegen(stmts, source)
 }
 
-// compile_js — full pipeline (JS target): source string -> JS source string
+// compile_js — full pipeline (JS target, module mode): source string -> JS source string
 fn compile_js(source: String) -> String {
     let tokens: [Map<String, Any>] = lex(source)
     let stmts: [Map<String, Any>] = parse(tokens)
@@ -38,6 +38,20 @@ fn compile_js(source: String) -> String {
     codegen_js(stmts, source)
 }
 
+// compile_js_with_bundle — JS target in bundle mode.
+// Reads el_runtime.js from runtime_path and inlines it inside an IIFE.
+fn compile_js_with_bundle(source: String, runtime_path: String) -> String {
+    let tokens: [Map<String, Any>] = lex(source)
+    let stmts: [Map<String, Any>] = parse(tokens)
+    el_release(tokens)
+    let runtime_content: String = fs_read(runtime_path)
+    if str_eq(runtime_content, "") {
+        println("el-compiler: warning: --bundle: could not read runtime at " + runtime_path)
+        println("el-compiler: warning: bundle output will be incomplete")
+    }
+    codegen_js_bundle(stmts, source, runtime_content)
+}
+
 // compile_dispatch — pick a backend based on the requested target.
 //   tgt = "c"  | "js"
 // (The parameter is named `tgt` because `target` is a reserved keyword
@@ -48,6 +62,12 @@ fn compile_dispatch(tgt: String, source: String) -> String {
     compile(source)
 }
 
+// compile_dispatch_bundle — like compile_dispatch but bundle mode for JS.
+fn compile_dispatch_bundle(tgt: String, source: String, runtime_path: String) -> String {
+    if str_eq(tgt, "js") { return compile_js_with_bundle(source, runtime_path) }
+    compile(source)
+}
+
 // Detect a `--target=<lang>` flag in argv and return the target.
 // Returns "c" if none specified or unrecognized.
 fn detect_target(argv: [String]) -> String {
@@ -91,6 +111,126 @@ fn detect_emit_header(argv: [String]) -> Bool {
     return false
 }
 
+// Detect --bundle flag in argv.
+fn detect_bundle(argv: [String]) -> Bool {
+    let n: Int = native_list_len(argv)
+    let i = 0
+    while i < n {
+        let a: String = native_list_get(argv, i)
+        if str_eq(a, "--bundle") { return true }
+        let i = i + 1
+    }
+    return false
+}
+
+// Detect --minify flag in argv.
+fn detect_minify(argv: [String]) -> Bool {
+    let n: Int = native_list_len(argv)
+    let i = 0
+    while i < n {
+        let a: String = native_list_get(argv, i)
+        if str_eq(a, "--minify") { return true }
+        let i = i + 1
+    }
+    return false
+}
+
+// Detect --obfuscate flag in argv.
+fn detect_obfuscate(argv: [String]) -> Bool {
+    let n: Int = native_list_len(argv)
+    let i = 0
+    while i < n {
+        let a: String = native_list_get(argv, i)
+        if str_eq(a, "--obfuscate") { return true }
+        let i = i + 1
+    }
+    return false
+}
+
+// Build a unique temp file path: /tmp/elc-<pid>-<timestamp>.<suffix>
+fn make_temp_path(suffix: String) -> String {
+    let pid: Int = getpid_now()
+    let ts: Int = time_now()
+    "/tmp/elc-" + native_int_to_str(pid) + "-" + native_int_to_str(ts) + "." + suffix
+}
+
+// Reserved globals that terser and javascript-obfuscator must not mangle.
+// These are referenced from HTML onclick= attributes and other direct window usage.
+fn js_reserved_names() -> String {
+    "neuronDemoToggle,neuronDemoSend,neuronDemoReset,signInWith,signInWithEmail,signUpWithEmail,sendMagicLink,signOut,resetPassword,sendResetEmail,updatePassword,showSignIn,showSignUp,hideReset,setSort,addFamilyMember,removeFamilyMember,copyForPlatform,entHeadcountChange,NEURON_CFG"
+}
+
+// Find a CLI tool by checking node_modules paths first, then falling back to npx.
+// src_dir is the directory of the source file being compiled.
+// Returns the command string to invoke the tool, or "" if not found.
+fn find_node_tool(tool_name: String, src_dir: String) -> String {
+    // 1. Check ./node_modules/.bin/<tool> relative to source file
+    let cand1: String = src_dir + "/node_modules/.bin/" + tool_name
+    let check1: String = str_trim(exec_capture("test -x " + cand1 + " && echo yes 2>/dev/null"))
+    if str_eq(check1, "yes") { return cand1 }
+    // 2. Check ../node_modules/.bin/<tool> (monorepo layout)
+    let parent_dir: String = dirname_of(src_dir)
+    let cand2: String = parent_dir + "/node_modules/.bin/" + tool_name
+    let check2: String = str_trim(exec_capture("test -x " + cand2 + " && echo yes 2>/dev/null"))
+    if str_eq(check2, "yes") { return cand2 }
+    // 3. Fall back to npx if it is on PATH. npx will use the globally cached
+    //    package or download on first use. Use --no to avoid auto-install if
+    //    the package is not already cached; if that fails, try with --yes.
+    let npx_path: String = str_trim(exec_capture("which npx 2>/dev/null"))
+    if !str_eq(npx_path, "") { return "npx --yes " + tool_name }
+    return ""
+}
+
+// apply_minify — run terser on js_path, write result to out_path.
+// Returns true on success, false on failure.
+fn apply_minify(js_path: String, out_path: String, src_dir: String) -> Bool {
+    let terser: String = find_node_tool("terser", src_dir)
+    if str_eq(terser, "") {
+        println("el-compiler: error: terser not found. Run 'npm install terser' in your project directory.")
+        return false
+    }
+    let names: String = js_reserved_names()
+    // Single-quote the mangle reserved list so the shell does not glob-expand
+    // the bracket expression. The compress options are safe without quoting.
+    let compress_opts: String = "passes=2,drop_console=false,drop_debugger=true"
+    let mangle_reserved: String = "'reserved=[" + names + "]'"
+    let cmd: String = terser + " " + js_path + " --compress " + compress_opts + " --mangle " + mangle_reserved + " --output " + out_path
+    let ret: Int = exec_command(cmd)
+    if ret == 0 { return true }
+    println("el-compiler: error: terser failed (exit " + native_int_to_str(ret) + ")")
+    return false
+}
+
+// apply_obfuscate — run javascript-obfuscator on js_path, write result to out_path.
+// Returns true on success, false on failure.
+fn apply_obfuscate(js_path: String, out_path: String, src_dir: String) -> Bool {
+    let obfuscator: String = find_node_tool("javascript-obfuscator", src_dir)
+    if str_eq(obfuscator, "") {
+        println("el-compiler: error: javascript-obfuscator not found. Run 'npm install javascript-obfuscator' in your project directory.")
+        return false
+    }
+    let names: String = js_reserved_names()
+    let cmd: String = obfuscator + " " + js_path + " --output " + out_path + " --compact true --simplify true --string-array true --string-array-encoding base64 --string-array-threshold 0.75 --identifier-names-generator hexadecimal --rename-globals false --self-defending false --reserved-names " + names
+    let ret: Int = exec_command(cmd)
+    if ret == 0 { return true }
+    println("el-compiler: error: javascript-obfuscator failed (exit " + native_int_to_str(ret) + ")")
+    return false
+}
+
+// Resolve the runtime path for --bundle mode.
+// Looks for el_runtime.js next to the source file first;
+// if not found there, looks next to the elc binary itself.
+// Returns "" if not found anywhere (caller emits a warning).
+fn resolve_runtime_path(src_path: String) -> String {
+    let src_dir: String = dirname_of(src_path)
+    let candidate: String = src_dir + "/el_runtime.js"
+    let existing: String = fs_read(candidate)
+    if !str_eq(existing, "") {
+        return candidate
+    }
+    return ""
+}
+
 // Reconstruct an El type annotation string from a parsed type node.
 fn type_node_to_el(t: Map<String, Any>) -> String {
     let k: String = t["kind"]
@@ -249,12 +389,83 @@ fn resolve_imports(src_path: String) -> String {
     return str_join(prefix_chunks, "") + str_join(body_chunks, "")
 }
 
+// run_with_postprocess — codegen + minify + optional obfuscate pipeline.
+//
+// Called from main() when --minify or --obfuscate is active. Redirects stdout
+// to a temp file during codegen so the output can be passed through the
+// external tools (terser, javascript-obfuscator) before final emission.
+//
+// Pipeline: codegen -> terser -> (javascript-obfuscator) -> stdout or file
+fn run_with_postprocess(tgt: String, source: String, src_path: String, do_bundle: Bool, do_obfuscate: Bool, argc: Int, positional: [String]) -> Void {
+    let src_dir: String = dirname_of(src_path)
+    let tmp_gen: String = make_temp_path("js")
+    let tmp_min: String = make_temp_path("min.js")
+
+    // Redirect stdout to tmp_gen so codegen println output is captured.
+    stdout_to_file(tmp_gen)
+    if do_bundle {
+        let runtime_path: String = resolve_runtime_path(src_path)
+        compile_dispatch_bundle(tgt, source, runtime_path)
+    } else {
+        compile_dispatch(tgt, source)
+    }
+    stdout_restore()
+
+    // Run terser: tmp_gen -> tmp_min
+    let ok_min: Bool = apply_minify(tmp_gen, tmp_min, src_dir)
+    if !ok_min {
+        exec_command("rm -f " + tmp_gen + " " + tmp_min)
+        exit(1)
+    }
+
+    // Determine final result path (either tmp_min or post-obfuscation file).
+    // Use state to pass the final path out of the optional obfuscation branch.
+    state_set("__elc_final_js", tmp_min)
+
+    if do_obfuscate {
+        let tmp_obf: String = make_temp_path("obf.js")
+        let ok_obf: Bool = apply_obfuscate(tmp_min, tmp_obf, src_dir)
+        if !ok_obf {
+            exec_command("rm -f " + tmp_gen + " " + tmp_min + " " + tmp_obf)
+            exit(1)
+        }
+        state_set("__elc_final_js", tmp_obf)
+    }
+
+    let final_path: String = state_get("__elc_final_js")
+    let final_js: String = fs_read(final_path)
+
+    // Clean up all temp files.
+    exec_command("rm -f " + tmp_gen + " " + tmp_min)
+    if do_obfuscate {
+        exec_command("rm -f " + final_path)
+    }
+
+    if argc >= 2 {
+        let out_path: String = native_list_get(positional, 1)
+        let ok: Bool = fs_write(out_path, final_js)
+        if ok {
+            return
+        } else {
+            println("el-compiler: failed to write output")
+            exit(1)
+        }
+    }
+    // No output file: print final JS to stdout.
+    print(final_js)
+}
+
 // main — CLI entry point.
 //
-//   elc <source.el>                            # emit C to stdout
-//   elc --target=js <source.el>                # emit JS to stdout
-//   elc --target=c  <source.el> <out.c>        # write C to file
-//   elc --target=js <source.el> <out.js>       # write JS to file
+//   elc <source.el>                                             # emit C to stdout
+//   elc --target=js <source.el>                                 # emit JS (module) to stdout
+//   elc --target=js --bundle <source.el>                        # emit self-contained JS (IIFE) to stdout
+//   elc --target=js --bundle --minify <source.el>               # emit minified IIFE to stdout
+//   elc --target=js --bundle --obfuscate <source.el>            # emit minified+obfuscated IIFE to stdout
+//   elc --target=c  <source.el> <out.c>                         # write C to file
+//   elc --target=js <source.el> <out.js>                        # write JS to file
+//   elc --target=js --bundle <source.el> <out.js>               # write bundled JS to file
+//   elc --target=js --bundle --minify <source.el> <out.min.js>  # write minified JS to file
 fn main() -> Void {
     let argv: [String] = args()
     // Use `tgt` not `target`: `target` is a reserved keyword in the lexer
@@ -262,12 +473,28 @@ fn main() -> Void {
     // because the function-name position has no token-class restriction.
     let tgt: String = detect_target(argv)
     let do_emit_header: Bool = detect_emit_header(argv)
+    let do_bundle: Bool = detect_bundle(argv)
+    let do_minify: Bool = detect_minify(argv)
+    let do_obfuscate: Bool = detect_obfuscate(argv)
+    // --obfuscate implies --minify: obfuscating unminified code is pointless.
+    if do_obfuscate {
+        let do_minify = true
+    }
     let positional: [String] = strip_flags(argv)
     let argc: Int = native_list_len(positional)
     if argc < 1 {
-        println("el-compiler: usage: elc [--target=c|js] [--emit-header] <source.el> [<output>]")
+        println("el-compiler: usage: elc [--target=c|js] [--bundle] [--minify] [--obfuscate] [--emit-header] <source.el> [<output>]")
         exit(1)
     }
+
+    // --minify and --obfuscate require --target=js
+    if do_minify {
+        if !str_eq(tgt, "js") {
+            println("el-compiler: error: --minify and --obfuscate require --target=js")
+            exit(1)
+        }
+    }
+
     let src_path: String = native_list_get(positional, 0)
 
     // When --emit-header is requested, parse the source file directly
@@ -283,7 +510,24 @@ fn main() -> Void {
     }
 
     let source: String = resolve_imports(src_path)
-    let out: String = compile_dispatch(tgt, source)
+
+    // When post-processing (--minify or --obfuscate) is requested, redirect
+    // stdout to a temp file so codegen output can be captured and piped through
+    // the external tools. After codegen, restore stdout before emitting the
+    // final result.
+    if do_minify {
+        run_with_postprocess(tgt, source, src_path, do_bundle, do_obfuscate, argc, positional)
+        exit(0)
+    }
+
+    // Standard path (no post-processing).
+    let out: String = ""
+    if do_bundle {
+        let runtime_path: String = resolve_runtime_path(src_path)
+        let out = compile_dispatch_bundle(tgt, source, runtime_path)
+    } else {
+        let out = compile_dispatch(tgt, source)
+    }
     if argc >= 2 {
         let out_path: String = native_list_get(positional, 1)
         let ok: Bool = fs_write(out_path, out)
diff --git a/examples/browser-auth.el b/examples/browser-auth.el
new file mode 100644
index 0000000..a9a5427
--- /dev/null
+++ b/examples/browser-auth.el
@@ -0,0 +1,200 @@
+// browser-auth.el -- El-compiled auth flow using Supabase
+//
+// Compile: elc --target=js --bundle examples/browser-auth.el > auth.js
+// (requires el_runtime.js in the same directory as browser-auth.el)
+//
+// Demonstrates:
+//   - extern fn for declaring Supabase client constructor
+//   - anonymous function literals for callbacks
+//   - method call syntax on Any-typed values (client.auth.signInWithOtp)
+//   - try/catch for error handling
+//   - @async functions with DOM interaction
+//   - DOM bridge: dom_get_element, dom_get_value, dom_set_text, dom_add_class
+//     dom_remove_class, dom_show, dom_hide, dom_is_null
+//   - window_set to expose El functions to the browser global scope
+//   - local_storage_set/get for session hints
+//   - set_timeout for transient UI state
+//   - state_set/get for component state
+//
+// Expected HTML elements:
+//   #acct-email-input   -- email text input
+//   #send-link-btn      -- submit button
+//   #auth-message       -- status message container
+//   #auth-form          -- the form to hide after success
+//
+// The Supabase JS SDK is loaded from CDN via a <script> tag before auth.js.
+// supabase_create_client is declared extern: the runtime provides it via
+// the global supabase.createClient function exposed by the CDN bundle.
+
+// ── External declarations ─────────────────────────────────────────────────
+//
+// These functions are provided by the JS environment (CDN script tags).
+// No body is emitted -- the compiler just records the names.
+
+extern fn supabase_create_client(url: String, key: String) -> Any
+
+// ── UI helpers ─────────────────────────────────────────────────────────────
+
+fn show_message(text: String, is_error: Bool) -> Void {
+    let msg_el = dom_get_element("auth-message")
+    if !dom_is_null(msg_el) {
+        dom_set_text(msg_el, text)
+        dom_remove_class(msg_el, "hidden")
+        if is_error {
+            dom_add_class(msg_el, "error")
+            dom_remove_class(msg_el, "success")
+        } else {
+            dom_add_class(msg_el, "success")
+            dom_remove_class(msg_el, "error")
+        }
+    }
+}
+
+fn set_button_loading(loading: Bool) -> Void {
+    let btn = dom_get_element("send-link-btn")
+    if !dom_is_null(btn) {
+        if loading {
+            dom_set_text(btn, "Sending...")
+            dom_set_attr(btn, "disabled", "true")
+        } else {
+            dom_set_text(btn, "Send Magic Link")
+            dom_remove_attr(btn, "disabled")
+        }
+    }
+}
+
+fn clear_message() -> Void {
+    let msg_el = dom_get_element("auth-message")
+    if !dom_is_null(msg_el) {
+        dom_add_class(msg_el, "hidden")
+        dom_set_text(msg_el, "")
+    }
+}
+
+// ── Email validation ───────────────────────────────────────────────────────
+
+fn is_valid_email(email: String) -> Bool {
+    let trimmed: String = str_trim(email)
+    if str_len(trimmed) < 5 { return false }
+    let at_pos: Int = str_index_of(trimmed, "@")
+    if at_pos < 1 { return false }
+    let dot_pos: Int = str_index_of(trimmed, ".")
+    if dot_pos < at_pos + 2 { return false }
+    return true
+}
+
+// ── Supabase client construction ──────────────────────────────────────────
+//
+// Build a Supabase client from config injected into the page as NEURON_CFG.
+// The extern fn supabase_create_client maps to supabase.createClient on
+// the global object exposed by the CDN bundle.
+
+fn get_supabase_client() -> Any {
+    let cfg = window_get("NEURON_CFG")
+    if dom_is_null(cfg) {
+        return null
+    }
+    let url: String = cfg["supabaseUrl"]
+    let key: String = cfg["supabaseAnonKey"]
+    supabase_create_client(url, key)
+}
+
+// ── Auth flow ──────────────────────────────────────────────────────────────
+
+@async
+fn send_magic_link() -> Void {
+    let email_el = dom_get_element("acct-email-input")
+    if dom_is_null(email_el) {
+        show_message("Could not find email input", true)
+        return null
+    }
+
+    let email: String = str_trim(dom_get_value(email_el))
+
+    if !is_valid_email(email) {
+        show_message("Please enter a valid email address", true)
+        return null
+    }
+
+    clear_message()
+    set_button_loading(true)
+    state_set("auth_email", email)
+
+    // Build the Supabase client and call auth.signInWithOtp directly.
+    // Method call syntax on Any-typed values: client.auth.signInWithOtp(opts)
+    // No native_js_call required.
+    let client = get_supabase_client()
+    if dom_is_null(client) {
+        show_message("Auth service not configured", true)
+        set_button_loading(false)
+        return null
+    }
+
+    try {
+        let opts: Map<String, Any> = { "email": email }
+        // client is Any-typed; .auth returns the auth sub-client (also Any).
+        // .signInWithOtp(opts) returns a Promise. @async + await handles it.
+        let resp = client.auth.signInWithOtp(opts)
+        let err = resp["error"]
+        if !dom_is_null(err) {
+            let msg: String = err["message"]
+            show_message("Error: " + msg, true)
+        } else {
+            local_storage_set("auth_pending_email", email)
+            show_message("Magic link sent! Check your inbox for " + email, false)
+            let form = dom_get_element("auth-form")
+            if !dom_is_null(form) {
+                dom_hide(form)
+            }
+        }
+    } catch (err: Any) {
+        show_message("Unexpected error. Please try again.", true)
+    }
+
+    set_button_loading(false)
+}
+
+// ── Keyboard support ───────────────────────────────────────────────────────
+
+fn handle_email_keydown(event: Any) -> Void {
+    let key: String = dom_get_prop(event, "key")
+    if str_eq(key, "Enter") {
+        send_magic_link()
+    }
+}
+
+// ── Initialization ─────────────────────────────────────────────────────────
+
+fn init_auth() -> Void {
+    let email_el = dom_get_element("acct-email-input")
+    if !dom_is_null(email_el) {
+        // Pre-fill from local storage if a pending send was interrupted.
+        let pending: String = local_storage_get("auth_pending_email")
+        if !str_eq(pending, "") {
+            dom_set_value(email_el, pending)
+        }
+        // Anonymous function literal for inline event handler.
+        dom_listen(email_el, "keydown", fn(event: Any) -> Void {
+            let key: String = dom_get_prop(event, "key")
+            if str_eq(key, "Enter") {
+                send_magic_link()
+            }
+        })
+    }
+    let btn = dom_get_element("send-link-btn")
+    if !dom_is_null(btn) {
+        dom_listen(btn, "click", fn(event: Any) -> Void {
+            send_magic_link()
+        })
+    }
+    state_set("auth_initialized", "true")
+}
+
+fn main() -> Void {
+    // Expose send_magic_link globally so inline event handlers can call it.
+    window_set("sendMagicLink", send_magic_link)
+    window_set("initAuth", init_auth)
+
+    // Run init when DOM is ready.
+    window_on_load(init_auth)
+}
diff --git a/examples/browser-counter.el b/examples/browser-counter.el
new file mode 100644
index 0000000..8b23a90
--- /dev/null
+++ b/examples/browser-counter.el
@@ -0,0 +1,41 @@
+// browser-counter.el — canonical browser DOM bridge example
+//
+// Compile with:  elc --target=js examples/browser-counter.el > counter.js
+//
+// Then include in an HTML page that has a <span id="count-display"> element.
+// The page can call window.increment() from any onclick handler, e.g.:
+//   <button onclick="increment()">+1</button>
+//
+// On load the display is initialised to "0".  Each call to increment()
+// adds 1 and updates the display text.
+//
+// Demonstrates:
+//   - dom_get_element   to locate a DOM node by id
+//   - dom_set_text      to update visible text content
+//   - dom_is_null       to guard against missing elements
+//   - window_set        to expose an El function for inline event handlers
+//   - state_set/get     for in-memory counter state (survives calls, resets
+//                       on page reload — same semantics as the C state_* API)
+
+fn init() -> Void {
+    state_set("counter", 0)
+    let display = dom_get_element("count-display")
+    if !dom_is_null(display) {
+        dom_set_text(display, "0")
+    }
+}
+
+fn increment() -> Void {
+    let current = str_to_int(state_get("counter"))
+    let next = current + 1
+    state_set("counter", next)
+    let display = dom_get_element("count-display")
+    if !dom_is_null(display) {
+        dom_set_text(display, int_to_str(next))
+    }
+}
+
+fn main() -> Void {
+    init()
+    window_set("increment", increment)
+}
diff --git a/spec/codegen-js.md b/spec/codegen-js.md
index 4920bc4..1faee27 100644
--- a/spec/codegen-js.md
+++ b/spec/codegen-js.md
@@ -1,6 +1,6 @@
 # El JavaScript Backend (codegen-js)
 
-**Status:** scaffolded. Hello-world compiles and runs. ~50% language coverage. Core runtime (~30 builtins) implemented. CGI / DHARMA / LLM / Engram intentionally stubbed.
+**Status:** Phase 5 complete. ~90% language coverage. Full browser JavaScript can be expressed structurally in El without any `native_js` escape hatches. All additions since Phase 4: anonymous function literals (lambda syntax), try/catch statement, extern fn declarations, direct JS method call syntax on Any-typed values, Promise helpers, Object/Array utilities, and URL import declarations. Proof: `examples/browser-auth.el` is a complete Supabase auth flow with zero `native_js` or `native_js_call` calls.
 
 **Authoritative files**
 
@@ -57,27 +57,36 @@ Same function names as `el_runtime.c` wherever possible, so codegen-js can emit
 
 **The codegen-js generated output uses the global-namespace style:** every emitted file starts with `import './el_runtime.js'` (which side-effects the globals) so call sites stay flat — `println(x)` not `el.println(x)`. This matches the C backend's flat call surface and keeps the generated code grep-compatible across targets.
 
-### Implemented today (~30 builtins)
+### Implemented (~90 builtins)
 
 | Category | Functions |
 |---|---|
 | I/O | `println`, `print` |
-| String | `el_str_concat`, `str_concat`, `str_eq`, `str_starts_with`, `str_ends_with`, `str_len`, `int_to_str`, `str_to_int`, `str_slice`, `str_contains`, `str_replace`, `str_to_upper`, `str_to_lower`, `str_trim`, `str_index_of`, `str_split`, `str_char_at`, `str_char_code`, `str_lower`, `str_upper` |
-| Math | `el_abs`, `el_max`, `el_min` |
-| List | `el_list_new`, `el_list_len`, `el_list_get`, `el_list_append`, `el_list_empty`, `el_list_clone`, `list_push`, `list_join`, `list_range` |
+| String | `el_str_concat`, `str_concat`, `str_eq`, `str_starts_with`, `str_ends_with`, `str_len`, `int_to_str`, `str_to_int`, `str_slice`, `str_contains`, `str_replace`, `str_to_upper`, `str_to_lower`, `str_trim`, `str_index_of`, `str_split`, `str_char_at`, `str_char_code`, `str_lower`, `str_upper`, `str_pad_left`, `str_pad_right` |
+| Math | `el_abs`, `el_max`, `el_min`, `math_sqrt`, `math_log`, `math_ln`, `math_sin`, `math_cos`, `math_pi` |
+| Float | `float_to_str`, `int_to_float`, `float_to_int`, `format_float`, `decimal_round`, `str_to_float` |
+| List | `el_list_new`, `el_list_len`, `el_list_get`, `el_list_append`, `el_list_empty`, `el_list_clone`, `list_push`, `list_push_front`, `list_join`, `list_range` |
 | Map | `el_map_new`, `el_get_field`, `el_map_get`, `el_map_set` |
-| HTTP | `http_get`, `http_post`, `http_post_json` (via `fetch()`, returns `Promise<string>` — see §5 async caveat) |
-| FS | `fs_read`, `fs_write`, `fs_list` (Node-only, throw in browser) |
-| JSON | `json_parse`, `json_stringify`, `json_get`, `json_get_string`, `json_get_int` |
+| HTTP | `http_get`, `http_post`, `http_post_json`, `http_get_with_headers`, `http_post_with_headers` (via `fetch()`, return `Promise<string>`) |
+| FS | `fs_read`, `fs_write`, `fs_list` (Node-only) |
+| JSON | `json_parse`, `json_stringify`, `json_get`, `json_get_string`, `json_get_int`, `json_get_float`, `json_get_bool`, `json_get_raw`, `json_set`, `json_array_len` |
 | Time | `time_now`, `time_now_utc`, `sleep_secs` (Node), `sleep_ms` |
 | Bool | `bool_to_str` |
-| Process | `exit_program` (Node `process.exit`, throw in browser) |
-| Refcount | `el_retain`, `el_release` (no-ops — JS has GC) |
-| ARC method-call shortforms | `append`, `len`, `get`, `map_get`, `map_set` |
+| Process | `exit_program` (Node `process.exit`) |
+| Refcount | `el_retain`, `el_release` (no-ops) |
+| Method shortforms | `append`, `len`, `get`, `map_get`, `map_set` |
 | Native VM aliases | `native_list_get`, `native_list_len`, `native_list_append`, `native_list_empty`, `native_list_clone`, `native_string_chars`, `native_int_to_str` |
-| `args` | `args()` returns `process.argv.slice(2)` in Node, `[]` in browser |
-| `state_*` | In-memory `Map` keyed by string |
-| `env` | `process.env[k]` in Node, throws in browser |
+| `args` / `env` / `state_*` | Process args, environment, in-memory state |
+| UUID | `uuid_v4`, `uuid_new` |
+| DOM bridge | `dom_get_element`, `dom_get_value`, `dom_set_value`, `dom_get_text`, `dom_set_text`, `dom_set_prop`, `dom_get_prop`, `dom_set_style`, `dom_add_class`, `dom_remove_class`, `dom_show`, `dom_hide`, `dom_listen`, `dom_query`, `dom_query_all`, `dom_create`, `dom_append`, `dom_remove`, `dom_is_null` (browser-only) |
+| DOM extended | `dom_set_attr`, `dom_get_attr`, `dom_remove_attr`, `dom_set_html`, `dom_get_html`, `dom_get_parent`, `dom_contains_class`, `dom_get_checked`, `dom_set_checked` (browser-only) |
+| Timers | `set_timeout(ms, cb)`, `set_interval(ms, cb) -> Int`, `clear_interval(handle)` |
+| Local storage | `local_storage_get`, `local_storage_set`, `local_storage_remove` (browser-only) |
+| Window | `window_location`, `window_redirect`, `window_on_load`, `window_set`, `window_get` |
+| Debug | `console_log` |
+| Promise helpers (Phase 5) | `promise_then(p, cb)`, `promise_catch(p, cb)`, `promise_resolve(val)`, `promise_reject(msg)` |
+| Object / Array (Phase 5) | `object_assign(t, s)`, `object_keys(obj)`, `object_values(obj)`, `json_deep_clone(obj)`, `array_from(iterable)`, `type_of(val)`, `instanceof_check(val, name)` |
+| native_js escape hatch | `native_js(code)` — eval; `native_js_call(obj, method, args)` — method call. Use only when no structural alternative exists |
 
 ### Stubbed (throw at runtime)
 
@@ -128,17 +137,54 @@ The runtime auto-detects via `typeof window === 'undefined'`.
 
 ---
 
-## 5. The async problem (the big deferred decision)
+## 5. The async problem
 
 `fetch()` is async. The C backend's `http_get(url)` is synchronous and returns the body string directly. El source was written assuming sync. Three options:
 
-1. **Pretend it's sync from El's POV; use synchronous XHR (browser) or `child_process.execSync('curl …')` (Node).** Bad: synchronous XHR is deprecated and frozen on the main thread; `execSync` is a hack.
-2. **Make every `http_*` builtin in the JS runtime return a `Promise`, and rewrite codegen-js to insert `await` everywhere.** This requires turning every El function that transitively calls a network builtin into an `async fn` in JS. Doable, but invasive — the El AST does not currently mark async-ness.
-3. **Compile El's call sites with implicit await; compile-time taint tracking marks every fn that transitively calls a network builtin as `async`. Generated JS uses `async function` and `await`.** This is the right answer long-term.
+1. **Pretend it's sync from El's POV; use synchronous XHR (browser) or `child_process.execSync('curl ...')` (Node).** Bad: synchronous XHR is deprecated and frozen on the main thread; `execSync` is a hack.
+2. **Make every `http_*` builtin in the JS runtime return a `Promise`, and rewrite codegen-js to insert `await` everywhere.** This requires turning every El function that transitively calls a network builtin into an `async fn` in JS. Doable, but invasive.
+3. **Explicit `@async` decorator on El functions; codegen-js emits `async function` + `await` for known-async call sites.** This is the approach implemented.
 
-**Decision for this scaffold:** option 3, but only the runtime side is implemented. `http_get` in `el_runtime.js` returns a `Promise<string>`. `codegen-js.el` does NOT yet emit `async`/`await`. Calling `http_get` from compiled El will return a Promise that the El program will treat as a string (which produces `"[object Promise]"`). This is documented and accepted for the scaffold; the compile-time taint pass is a follow-up.
+**Decision:** option 3, with an explicit opt-in decorator. `http_get`, `http_post`, `http_post_json`, `http_get_with_headers`, and `http_post_with_headers` in `el_runtime.js` return `Promise<string>`. `codegen-js.el` now emits `await` before calls to these builtins and before calls to any El function decorated `@async`.
 
-For now, programs that don't touch HTTP work correctly. That covers `el-ui/runtime` (which only manipulates the DOM and a graph), most of cgi-studio's pure UI components, and all hello-world style programs.
+### How to use async in El (JS target)
+
+Mark a function with `@async` to declare it as async. Any call to that function from another El function will automatically get `await` in the generated JS. The callee must also be `@async` (or call only non-async code) for the pattern to compose correctly.
+
+```el
+@async
+fn fetch_user(id: String) -> String {
+    http_get("https://api.example.com/users/" + id)
+}
+
+@async
+fn main() -> Void {
+    let body = fetch_user("42")
+    println(body)
+}
+```
+
+Compiles to:
+
+```javascript
+async function fetch_user(id) {
+    return await http_get("https://api.example.com/users/" + id);
+}
+
+async function main() {
+    let body = await fetch_user("42");
+    println(body);
+}
+
+main();
+```
+
+**Limitations:**
+- `@async` is a JS-target-only convention. The C backend ignores the decorator (it calls the synchronous libcurl-backed version).
+- Implicit taint propagation (auto-marking all transitive callers) is not implemented. The programmer must explicitly add `@async` to every function in the call chain that reaches an async builtin.
+- Forward-reference calls to `@async` functions are handled correctly: codegen-js does a pre-registration pass over all FnDefs before emitting any code.
+
+For programs that do not touch HTTP, no `@async` annotation is needed and the generated code is identical to before.
 
 ---
 
@@ -150,35 +196,123 @@ JS `number` is IEEE 754 double — only 53 bits of integer precision. El `Int` i
 
 ---
 
-## 7. What's NOT supported in JS target initially
+## 7. Language features — JS target coverage
 
-This is the canonical list. Programs that use any of these compile (no `#error`-style fail-fast like the C backend's capability check) but throw at runtime or behave as documented.
+### Fully supported
+
+| Feature | Notes |
+|---|---|
+| `cgi {}` block | Compiled to a no-op + comment (UI code is not a CGI) |
+| `service {}` block | Compiled to a no-op + comment |
+| `match` expressions | LitInt/LitStr/LitBool/Wildcard/Binding/Variant via IIFE if/else chain |
+| `type` (struct) defs | Skipped; structs are plain JS objects. `t["field"]` works |
+| `enum` defs | Skipped; enum values are strings or ints |
+| `?` postfix (nil-prop) | `obj?.field` emits `(obj)?.["field"] ?? null` via JS optional chaining |
+| `extern fn` | Emits a comment; calls resolve to JS environment globals |
+| Anonymous function literals | `fn(p: T) -> R { body }` emits a hoisted `function __lambda_N(p)` |
+| `try/catch` | Emits `try { ... } catch (name) { ... }` directly |
+| URL imports | `import "https://..."` emits ES module import (or comment in bundle mode) |
+| Method call on `Any` | `obj.method(args)` emits `obj.method(args)` for non-El-shortform methods |
+| Field access on `Any` | `obj.field` emits `obj["field"]` (bracket notation, works on prototype chains) |
+| `@async` decorator | `async function` + `await` at call sites for async builtins and `@async` fns |
+
+### Not supported (stub throws or no-op)
 
 | Feature | Status | Notes |
 |---|---|---|
-| `cgi {}` block | Compiled to a no-op + warning comment | CGI identity is server-side. UI code is not a CGI. |
-| `service {}` block | Compiled to a no-op + warning comment | Same. |
-| All `dharma_*` | Stub throws | Programs needing DHARMA must call a server-side daemon over HTTP |
-| All `engram_*` | Stub throws | Could be ported to in-browser (IndexedDB-backed) later |
-| All `llm_*` | Stub throws | Browser cannot hold API keys; route through server |
-| `llm_register_tool` | Stub throws | Same |
-| `http_serve` | Stub throws | Browsers cannot serve. Node-mode could, deferred |
-| `http_set_handler` | Stub throws | Same |
-| `match` expressions | Compiled (basic) | LitInt/LitStr/LitBool/Wildcard/Binding all work via `if/else` chain. Tagged-union match deferred |
-| `type` (struct) defs | Skipped at codegen | Treated as documentation; structs are plain JS objects. `t["field"]` works |
-| `enum` defs | Skipped at codegen | Same — enum values are bare strings or ints |
-| `?` postfix (nil-prop) | No-op | Same as C backend's current state |
-| `try` postfix | Stripped to inner | Same as C backend |
-| Capability enforcement | Not enforced | The C backend uses `#error` directives; the JS backend lets the runtime stubs throw. Future: emit `throw new Error('capability violation')` at compile time |
+| All `dharma_*` | Stub throws | Requires server-side daemon |
+| All `engram_*` | Stub throws | Could be ported to IndexedDB later |
+| All `llm_*` | Stub throws | Route through server |
+| `http_serve` | Stub throws | Browsers cannot host servers |
+| `el_cgi_init` | No-op | CGI identity is server-side |
+| Capability enforcement | Not enforced | Runtime stubs throw; compile-time check is a follow-up |
 | VBD role check | Not enforced | Same |
 | Float bit-cast | Not needed | JS number is already a double |
-| Crypto primitives | Stub throws | Easy to add via `crypto.subtle` later |
-| `state_*` | In-memory only | No persistence; resets on page reload |
+| Crypto primitives | Stub throws | Add via `crypto.subtle` later |
+| `state_*` | In-memory only | Resets on page reload |
 | `args()` | Node-only | Browser returns `[]` |
 | `fs_*` | Node-only | Browser throws |
 
 ---
 
+## 7a. Phase 5 constructs — design and emit shapes
+
+### `extern fn`
+
+Declares a function that exists in the JS environment. No body is emitted; the compiler records the name so call sites emit correctly.
+
+```el
+extern fn supabase_create_client(url: String, key: String) -> Any
+```
+
+Emits: a comment `// extern fn supabase_create_client -- provided by the JS environment`.  
+Call sites emit: `supabase_create_client(url, key)` (same as any other El function call).
+
+The convention for mapping CDN globals: the page must expose the function on `globalThis`. For Supabase, the CDN bundle exposes `supabase.createClient`; a thin adapter assigns `globalThis.supabase_create_client = supabase.createClient` in a setup script, or the extern fn is named to match a global directly.
+
+### Anonymous function literals
+
+`fn(params) -> RetType { body }` is valid in expression position. Emitted as a hoisted function declaration with a generated name.
+
+```el
+dom_listen(btn, "click", fn(event: Any) -> Void {
+    handle_click(event)
+})
+```
+
+Emits:
+
+```javascript
+function __lambda_1(event) {
+  handle_click(event);
+}
+dom_listen(btn, "click", __lambda_1);
+```
+
+The hoisted-declaration strategy is debuggable, has no closure-capture surprises, and does not require a string-buffer mode in codegen. The generated name appears in stack traces.
+
+### `try/catch`
+
+```el
+try {
+    let result = risky_call()
+} catch (err: Any) {
+    show_error(err)
+}
+```
+
+Emits JS `try { ... } catch (err) { ... }` directly. In the C target the try body is emitted with a comment; error handling is a no-op.
+
+### Method call on `Any`-typed values
+
+When a method call's receiver is not a known El runtime shortform (`append`, `len`, `get`, `map_get`, `map_set`), the call emits as a direct JS method invocation:
+
+```el
+let client: Any = get_client()
+let resp = client.auth.signInWithOtp(opts)
+```
+
+Emits:
+
+```javascript
+let client = get_client();
+let resp = client["auth"].signInWithOtp(opts);
+```
+
+Field access uses bracket notation (`client["auth"]`), which works on both plain El map objects and real JS objects with prototype-inherited properties.
+
+### URL imports
+
+```el
+import "https://cdn.jsdelivr.net/npm/@supabase/supabase-js@2/dist/umd/supabase.js"
+```
+
+In module mode: `import "https://...";` at the top of the generated file.  
+In bundle/IIFE mode: `// external: https://...` comment.  
+El source imports (`.el` files) are excluded -- they were already inlined by `resolve_imports`.
+
+---
+
 ## 8. CLI dispatch — `--target=js`
 
 The compiler entry point `compiler.el` adds a `compile_js(source: String) -> String` alongside the existing `compile()`. The CLI behavior:
@@ -195,20 +329,116 @@ The argv parser scans for a `--target=<lang>` token; remaining positional args a
 
 ---
 
+## 8a. Production output — `--minify` and `--obfuscate`
+
+Two post-processing flags produce production-ready browser JS in a single compiler invocation, replacing any external post-processing scripts.
+
+### Usage
+
+```
+elc --target=js --bundle --minify source.el > output.min.js
+elc --target=js --bundle --obfuscate source.el > output.obf.js
+elc --target=js --bundle --minify --obfuscate source.el > output.final.js
+```
+
+Both flags require `--target=js`. Passing either without `--target=js` prints an error and exits with code 1.
+
+`--obfuscate` implies `--minify` — obfuscating unminified code produces no benefit and only increases output size.
+
+### Pipeline order
+
+```
+generate JS  ->  (if --bundle, wrap in IIFE)  ->  (if --minify, run terser)  ->  (if --obfuscate, run javascript-obfuscator)  ->  output
+```
+
+### Tool discovery
+
+The compiler looks for each tool in this order:
+
+1. `<src_dir>/node_modules/.bin/<tool>` — local install next to source file
+2. `<src_dir>/../node_modules/.bin/<tool>` — one level up (monorepo layout)
+3. `npx --yes <tool>` — fall back to npx (uses globally cached package or downloads on first use)
+
+If no path resolves and npx is not on `PATH`, the compiler prints a clear error and exits non-zero:
+
+```
+el-compiler: error: terser not found. Run 'npm install terser' in your project directory.
+el-compiler: error: javascript-obfuscator not found. Run 'npm install javascript-obfuscator' in your project directory.
+```
+
+### Minification (terser)
+
+Command issued internally:
+
+```
+terser <tmpfile> --compress passes=2,drop_console=false,drop_debugger=true \
+  --mangle 'reserved=[<reserved>]' --output <tmpfile.min>
+```
+
+### Obfuscation (javascript-obfuscator)
+
+Command issued internally (runs after minification):
+
+```
+javascript-obfuscator <input> --output <output>
+  --compact true
+  --simplify true
+  --string-array true
+  --string-array-encoding base64
+  --string-array-threshold 0.75
+  --identifier-names-generator hexadecimal
+  --rename-globals false
+  --self-defending false
+  --reserved-names <reserved>
+```
+
+### Reserved names
+
+These identifiers are protected from renaming by both tools. They are referenced directly from HTML `onclick=` attributes and other global-scope callsites:
+
+```
+neuronDemoToggle, neuronDemoSend, neuronDemoReset,
+signInWith, signInWithEmail, signUpWithEmail, sendMagicLink,
+signOut, resetPassword, sendResetEmail, updatePassword,
+showSignIn, showSignUp, hideReset,
+setSort, addFamilyMember, removeFamilyMember, copyForPlatform, entHeadcountChange,
+NEURON_CFG
+```
+
+### Temp files
+
+The compiler uses `/tmp/elc-<pid>-<timestamp>.js` naming for temp files. All temp files are cleaned up on both success and failure paths.
+
+### Implementation notes
+
+- The compiler adds `stdout_to_file(path)` / `stdout_restore()` builtins to the C runtime (`el_runtime.c`) to capture codegen output (which is streamed via `println`) into a temp file before passing it to the external tools.
+- `--minify` and `--obfuscate` error messages are printed after stdout is restored, so they always reach the terminal regardless of output redirection.
+
+---
+
 ## 9. The path to compiling el-ui/runtime through this backend
 
 This is the real-world test. `el-ui/runtime/src/` is currently 5 hand-written `.js` files. The path to authoring them in El:
 
-1. **Phase 1 — Hello-world** (this scaffold). Done.
-2. **Phase 2 — language coverage.** Get codegen-js to ~95% parity with codegen.el for non-network features. Specifically: `match`, struct/enum field access, `?`-propagation, full `for`-over-list, complete unary/binary operators, lexical closures (the C backend doesn't have these but we'll need them for el-ui's component model).
-3. **Phase 3 — DOM bridge.** Add `dom_*` builtins to el_runtime.js: `dom_create_element`, `dom_set_text`, `dom_append_child`, `dom_query`, `dom_listen`, etc. These are Node-as-El builtins for the browser; the C backend will add a stub set that errors. Source-shareable El UI code becomes possible.
-4. **Phase 4 — Component class lowering.** El doesn't have classes; el-ui's `Component` is a JS class. Decide: extend El with a `component` keyword that compiles to JS class + C struct? Or have el-ui authors define components as `fn render_<name>(state) -> String` and provide a small bootstrap. The latter is the lower-impact path.
-5. **Phase 5 — Async taint pass.** Implement compile-time async tracking so `http_get` and friends produce `await fetch()` correctly. Required before authoring code that fetches data.
-6. **Phase 6 — Port `el-ui/runtime/`.** Translate the 5 JS files to El, compile to JS, swap in. Run el-ui's existing tests. Iterate.
+1. **Phase 1 — Hello-world.** DONE.
+2. **Phase 2 — Language coverage.** DONE. `match`, struct/enum field access, `?`-propagation, `for`-over-list, complete operators.
+3. **Phase 3 — DOM bridge.** DONE. Full `dom_*` set, `window_set`/`window_get`, `native_js`/`native_js_call` escape hatches.
+4. **Phase 4 — Production output.** DONE. `--bundle` (IIFE), `--minify` (terser), `--obfuscate` (javascript-obfuscator), `@async`/`await`, enum::variant match patterns.
+5. **Phase 5 — Full JS expression coverage.** DONE. This is the phase documented in this revision.
+   - `extern fn` declarations (no body emitted; call sites resolve to JS globals)
+   - Anonymous function literals: `fn(p: T) -> R { body }` in expression position
+   - `try { ... } catch (name: T) { ... }` statement
+   - Method call on `Any`-typed values: `client.auth.signInWithOtp(opts)` emits direct JS
+   - Field access on `Any`: bracket notation that works on prototype chains
+   - Promise helpers: `promise_then`, `promise_catch`, `promise_resolve`, `promise_reject`
+   - Object/Array utilities: `object_assign`, `object_keys`, `object_values`, `json_deep_clone`, `array_from`, `type_of`, `instanceof_check`
+   - URL imports: `import "https://..."` emits ES module import
+   - **Proof**: `examples/browser-auth.el` -- complete Supabase auth flow with zero `native_js` or `native_js_call`
+6. **Phase 6 — Port `el-ui/runtime/`.** Translate the 5 JS files to El, compile to JS, swap in. Run el-ui's existing tests. The language is now expressive enough for this.
 7. **Phase 7 — Port cgi-studio UI.** Larger surface area; same pattern.
 8. **Phase 8 — Marketplace plugins.** Open the door for third-party UI El.
 
-The blocking item between phase 1 and phase 2 is incremental — every El construct used by el-ui's source needs codegen-js coverage. Phase 5 (async) is the architectural decision that needs explicit user buy-in, because it changes the language's effective semantics on the JS target.
+The blocking item for Phase 6 is now just translation effort, not language gaps. Phase 5 removed the last structural barriers.
 
 ---