dsh-ptc-plus 0.4.1 → 0.4.2

package/README.en.md

@@ -115,16 +115,16 @@ The Agent can test and revise the helper incrementally with in-memory REPL examp
 
 The panel can be collapsed or closed; the sparkle button's badge reopens it. A successful save or discard closes the panel automatically. The original request retains its source and outcome in history.
 
-Before the first message, hover over or click the sparkle button to view and toggle global bindings. These choices apply to all sessions, while the entry itself is registered only while the current session uses the `ptc` or compatible `code` preset. The menu also provides new-binding authoring, existing-binding revision, full management, and a PTC Plus settings shortcut. The settings shortcut opens an in-app dialog containing every plugin setting, while its hover hint still names the host's native settings path. The reusable REPL binding list shows per-binding and total reuse counts from static references in later cells' compiled source, and a redeclaration never resets them.
+Before the first message, hover over or click the sparkle button to view and toggle global bindings. These choices apply to all sessions. The shortcut appears only while the current session uses the `ptc` or compatible `code` preset. The menu also provides new-binding authoring, existing-binding revision, full management, and a PTC Plus settings shortcut. The settings shortcut opens an in-app dialog containing every plugin setting, while its hover hint still names the host's native settings path. The reusable REPL binding list shows per-binding and total reuse counts, and a redeclaration never resets them.
 
-Enabled binding interfaces are supplied to the model in new sessions and updated at the next permitted request in an existing session. Each binding can include a separate usage prompt or omit its interface. Changing only the prompt preserves the helper's runtime state. Assigning or redeclaring one name in a session overrides only that name; the entry's other names keep working, and the session-local override never writes back to the saved entry. See the [global binding guide](docs/user-bindings.en.md) for details.
+Enabled binding interfaces are supplied to the model in new sessions and updated at the next permitted request in an existing session. A source-derived interface retains standard global types, referenced local types, representable class heritage, and class instance fields used by its public signatures; abstract classes remain non-constructable, and an imported type that cannot form a self-contained interface produces an explicit error before save. Each binding can include a separate usage prompt or omit its interface. Changing only the prompt preserves the helper's runtime state. Assigning or redeclaring one name in a session overrides only that name; the entry's other names keep working, and the session-local override never writes back to the saved entry. See the [global binding guide](docs/user-bindings.en.md) for details.
 
 ## Settings
 
-Choose **PTC Plus settings** in the sparkle menu beside the composer to open the complete settings dialog directly. The host's native entry remains available: on the current release, find the plugin's entry on the side-bar **Plugins** page and choose **Configure**; on the preceding release, open **Settings → Plugin configuration → PTC Plus**. The main switch controls the plugin; other settings are grouped by purpose:
+Choose **PTC Plus settings** in the sparkle menu beside the composer to open the complete settings dialog directly. The host's native entry remains available. Depending on the DSH interface, find the plugin on the side-bar **Plugins** page and choose **Configure**, or open **Settings → Plugin configuration → PTC Plus**. The main switch controls the plugin; other settings are grouped by purpose:
 
 - **Tool call tolerance**: accept `run_code` without a summary and repair uniquely identifiable top-level native-tool miscalls.
-- **REPL syntax**: `bindingUpdates` defaults to `stateful`, allowing cross-cell updates of variables, functions, classes, and import aliases, and letting a repeated declaration in one logical scope of one cell update the same identity; choose `protected` to keep name protection. The five legacy switches apply only while migrating an old configuration; the settings page identifies that state and lets you choose either unified policy directly. Module syntax is enabled by default. `tools` and the injected error classes are request-reserved program bindings that can be neither redeclared nor written: a declaration collision reports `PTC-N001` in preflight, and an assignment fails during execution with an error that names the binding instead of being discarded silently.
+- **REPL syntax**: `bindingUpdates` defaults to `stateful`, allowing cross-cell updates of variables, functions, classes, and import aliases, and letting a repeated declaration in one logical scope of one cell update the same identity; choose `protected` to keep name protection. `tools` and the injected error classes can be neither redeclared nor written: a declaration collision reports `PTC-N001`, and a failed assignment names the affected binding. Existing configurations that still contain five separate switches appear as pending migration, and the settings page lets you choose either unified policy directly. Module syntax is enabled by default.
 - **Module interoperability**: PTC-managed namespaces support live reads and local overrides, including when passed to external functions. External code independently importing a compiled module through native APIs does not receive the same namespace or writable-export guarantee. See the [runtime reference](docs/runtime-reference.md#cell-semantics).
 - **State and recovery**: control restart recovery and contextual error tips.
 - **Tool extensions**: enable global bindings or official Cordis tools for advanced use.
@@ -133,11 +133,7 @@ Choose **PTC Plus settings** in the sparkle menu beside the composer to open the
 
 Global bindings and Cordis tools default to off. Settings generally apply immediately; a worker's memory limit cannot change while it is active. See the [configuration reference](docs/runtime-reference.md#configuration) for fields, defaults, and limits.
 
-PTC Plus uses a shared stateful computation contract for `run_code`, `edit_run_code`, plugin-owned child computation, and user binding entry points. Source passed to `eval`, `Function`, `node:vm`, or other external engines retains the corresponding native syntax rules and results. Direct `eval` must still access its caller's logical scope; indirect `eval` and `Function` use their owning realm's logical root. Internal name rewriting must not change which state they read. The module interface and native interoperability boundary are described in [ADR 0025](docs/adr/0025-use-versioned-logical-binding-identities.md#managed-module-interface).
-
-Indirect `eval` and all four `Function` constructors use their owning realm's root, including when passed as native callbacks: after `const value=41`, `["typeof value"].map(eval)` returns `["number"]`. Function source observations retain original JavaScript source and its actual dependencies, so self-contained functions can be recompiled with `Function`. Function values, user overrides, and separately created realms retain their respective semantics.
-
-Switching computation modes preserves existing closures' execution environments and saved function identities, including direct `eval` in asynchronous continuations and `Function.prototype.toString`. Each source generation selects stable callback interfaces while global and prototype properties retain their original values. Legacy code reuses established logical bindings through its native REPL environment, with existing native declarations retaining precedence, and reads modules through PTC-managed namespaces.
+`run_code`, `edit_run_code`, binding workbench runs, and user binding execution follow the same stateful semantics. Within each computation environment, cells, PTC-managed modules, `require`, and binding modules share the worker's Node realm, so `Error` subclass checks and `globalThis` writes retain Node behavior. Explicit use of `eval`, `Function`, `node:vm`, or an independent runtime retains its native boundary. Changing the binding update policy does not rewrite the execution environment of existing closures and functions. See the [runtime reference](docs/runtime-reference.md#cell-semantics) for scope, source observation, module interoperability, and recorded-session compatibility rules.
 
 ![PTC Plus settings card](assets/ptc-plus-settings-en.png)
 
@@ -151,7 +147,7 @@ On wide screens, the green **PTC Plus** header indicator offers a quick binding
 
 ## Scope
 
-DSH continues to own tool permissions, approvals, cancellation, and sandbox policy. Session evaluation runs in a plugin-owned helper process; a stuck or unresponsive helper is reclaimed there, and DSH does not perform an in-host worker kill. PTC Plus cannot recover every state across restarts: external inputs, unverifiable history, and context compaction can reduce the recovered state. Recovery neither repeats nor reverses historical external operations.
+DSH continues to own tool permissions, approvals, cancellation, and sandbox policy. PTC Plus evaluates session code in a reclaimable helper process, so stuck or unresponsive computation can be terminated without ending DSH; this process boundary is not a security sandbox. Electron Desktop compatibility does not change the environment visible to evaluated code or its child processes. PTC Plus cannot recover every state across restarts: external inputs, unverifiable history, and context compaction can reduce the recovered state. Recovery neither repeats nor reverses historical external operations.
 
 Value previews have size and type limits; objects that cannot be read reliably appear as unavailable. An enabled binding can also fail initialization, with failures reported in execution results. See the [runtime reference](docs/runtime-reference.md) for details.
 

package/README.md

@@ -115,16 +115,16 @@ Agent 可以在会话 REPL 中用内存样例逐步测试和修正，再交出
 
 草稿面板可折叠或关闭，输入框星光按钮上的角标可重新打开。保存或丢弃成功后自动关闭，历史请求保留当时的源码和结果。
 
-会话开始前也可以悬停或点击星光按钮，查看并启停全局绑定；这些选择对所有会话生效，但该入口只在当前会话使用 `ptc` 或兼容 `code` preset 时注册。菜单同时提供编写新绑定、修改已有绑定、完整管理入口和 PTC Plus 设置快捷入口；设置快捷入口直接打开包含全部插件配置的应用内窗口，悬浮提示仍标明宿主原生设置页的路径。REPL 可复用绑定列表按后续 cell 源码中的静态引用显示每项复用次数和总复用次数，重定义或重声明不会清零。
+会话开始前也可以悬停或点击星光按钮，查看并启停全局绑定；这些选择对所有会话生效。快捷入口只在当前会话使用 `ptc` 或兼容 `code` preset 时显示。菜单同时提供编写新绑定、修改已有绑定、完整管理入口和 PTC Plus 设置快捷入口；设置快捷入口直接打开包含全部插件配置的应用内窗口，悬浮提示仍标明宿主原生设置页的路径。REPL 可复用绑定列表显示每项复用次数和总复用次数，重定义或重声明不会清零。
 
-已启用绑定的接口会提供给新会话中的模型，也会在现有会话的下一次允许请求中更新。每个绑定可以另写使用提示词，或关闭接口展示；仅改提示词不会重置 helper 的运行状态。在会话中给某个名字赋值或重声明只覆盖该名字，同一条目的其他名字继续可用，会话内的覆盖也不会写回保存的条目。详细操作见[全局绑定使用指南](docs/user-bindings.md)。
+已启用绑定的接口会提供给新会话中的模型，也会在现有会话的下一次允许请求中更新。接口从源码保留公开签名引用的标准全局类型、本地类型、可表示的类继承链和类实例字段；抽象类仍不可直接构造，无法生成自足接口的导入类型会在保存前明确报错。每个绑定可以另写使用提示词，或关闭接口展示；仅改提示词不会重置 helper 的运行状态。在会话中给某个名字赋值或重声明只覆盖该名字，同一条目的其他名字继续可用，会话内的覆盖也不会写回保存的条目。详细操作见[全局绑定使用指南](docs/user-bindings.md)。
 
 ## 设置
 
-可以从输入框旁的星光菜单选择 **PTC Plus 设置**，直接打开完整设置窗口。宿主原生入口也保留：当前 DSH 在侧栏 **Plugins** 页面里找到本插件的条目并点 **Configure**，旧版 DSH 在 **设置 → 插件配置 → PTC Plus**。总开关控制插件，其余设置按用途分组：
+可以从输入框旁的星光菜单选择 **PTC Plus 设置**，直接打开完整设置窗口。宿主原生入口也保留；根据 DSH 界面，可在侧栏 **Plugins** 页面找到本插件并点 **Configure**，或打开 **设置 → 插件配置 → PTC Plus**。总开关控制插件，其余设置按用途分组：
 
 - **调用容错**：允许缺少摘要的 `run_code`，修复可以准确识别的顶层工具误调用。
-- **REPL 语法**：`bindingUpdates` 默认是 `stateful`，允许跨 cell 更新变量、函数、类和 import alias，也允许同一 cell 内同一逻辑 scope 的重复声明更新同一身份；`protected` 可选择名称保护。`tools` 与注入的错误类是请求保留的程序绑定，既不能重声明也不能写入：冲突在 preflight 报 `PTC-N001`，赋值在执行时以指明该名称的错误失败，不会静默丢弃。旧版五个细分开关仅在迁移旧配置时生效；设置页明确显示尚未迁移的状态，可直接选择任一种统一策略。模块语法默认可用。
+- **REPL 语法**：`bindingUpdates` 默认是 `stateful`，允许跨 cell 更新变量、函数、类和 import alias，也允许同一 cell 内同一逻辑 scope 的重复声明更新同一身份；`protected` 可选择名称保护。`tools` 与注入的错误类不能重声明或写入：声明冲突报 `PTC-N001`，赋值失败时会指出对应名称。已有配置若仍含五个细分开关，设置页会显示待迁移状态，可直接选择任一种统一策略。模块语法默认可用。
 - **模块互操作**：PTC 管理的 namespace 支持实时读取和局部覆盖，传给外部函数后仍保留这些语义。外部代码自行原生导入编译模块不承诺同一 namespace 或可写导出语义，详见[运行时说明](docs/runtime-reference.md#cell-semantics)。
 - **状态与恢复**：控制重启恢复和按需错误提示。
 - **工具扩展**：开启全局绑定，或供高级用户使用的官方 Cordis 工具。
@@ -133,11 +133,7 @@ Agent 可以在会话 REPL 中用内存样例逐步测试和修正，再交出
 
 全局绑定与 Cordis 工具默认关闭。设置通常即时生效；活动 worker 存在时不能更改其内存上限。字段、默认值和限制见[配置参考](docs/runtime-reference.md#configuration)。
 
-PTC Plus 对 `run_code`、`edit_run_code`、插件自有子计算及用户绑定入口使用共同的有状态计算契约。用户主动调用 `eval`、`Function`、`node:vm` 或其他外部引擎时，动态源码保留对应的原生语法规则与结果；直接 `eval` 仍须访问调用处的逻辑作用域，间接 `eval` 和 `Function` 使用所属 realm 的逻辑根环境，不能因内部名称改写而读错状态。模块接口与原生互操作边界见 [ADR 0025](docs/adr/0025-use-versioned-logical-binding-identities.md#managed-module-interface)。
-
-间接 `eval` 和四种 `Function` 构造器使用所属 realm 的 root，作为原生回调传递时也一样，例如 `const value=41` 后的 `["typeof value"].map(eval)` 返回 `["number"]`。函数源码观察保留原始 JavaScript 源码及其真实依赖，自包含函数可用 `Function` 重新编译；函数值本身、用户改写和另外创建的 realm 保持各自语义。
-
-切换计算模式时，旧闭包仍保留原有执行环境和已保存的函数身份，包括异步继续执行中的直接 `eval` 与 `Function.prototype.toString`。各代源码取得稳定的回调接口，全局和原型属性保持原值；兼容模式通过原生 REPL 环境复用已有逻辑绑定，原有原生声明仍优先，其模块导入也通过 PTC 管理的 namespace 读取。
+`run_code`、`edit_run_code`、绑定试运行和用户绑定执行遵循同一套有状态语义。每个计算环境中的 cell、PTC 管理模块、`require` 和绑定模块共享该 worker 的 Node realm，因此 `Error` 子类判断与 `globalThis` 写入保持 Node 语义。显式使用 `eval`、`Function`、`node:vm` 或独立运行时仍遵循对应的原生边界；切换绑定更新策略不会改写已有闭包和函数的执行环境。完整的作用域、源码观察、模块互操作和已记录会话兼容规则见[运行时参考](docs/runtime-reference.md#cell-semantics)。
 
 ![PTC Plus 设置卡片](assets/ptc-plus-settings-zh.png)
 
@@ -151,7 +147,7 @@ PTC Plus 对 `run_code`、`edit_run_code`、插件自有子计算及用户绑定
 
 ## 范围
 
-DSH 继续负责工具权限、审批、取消和沙箱策略。会话求值运行在插件自有的 helper 进程内；卡住或无响应的 helper 会被回收，DSH 宿主进程不执行 in-host worker 强杀。PTC Plus 不保证所有状态都能跨重启恢复；外部输入、无法验证的历史或上下文压缩都可能缩小恢复范围。恢复不会重做或撤销历史外部操作。
+DSH 继续负责工具权限、审批、取消和沙箱策略。PTC Plus 在可回收的 helper 进程中执行会话代码，因此卡住或无响应的计算可以在不结束 DSH 的情况下终止；这一进程边界不是安全沙箱。Electron Desktop 兼容处理不会改变求值代码及其子进程看到的环境。PTC Plus 不保证所有状态都能跨重启恢复；外部输入、无法验证的历史或上下文压缩都可能缩小恢复范围。恢复不会重做或撤销历史外部操作。
 
 值预览有大小和类型限制，无法可靠读取的对象会显示“不可读取”。绑定的启用配置也不等于初始化一定成功，具体失败会在执行结果中说明。更多行为见[运行时参考](docs/runtime-reference.md)。
 

package/client.js

@@ -679,25 +679,25 @@
     if (!strict) merge(result, data);
     return [result];
   });
-  Schema.extend("union", (data, { list, toString: toString2 }, options, strict) => {
+  Schema.extend("union", (data, { list, toString: toString3 }, options, strict) => {
     const messages = [];
     for (const inner of list) try {
       return Schema.resolve(data, inner, options, strict);
     } catch (error) {
       messages.push(error);
     }
-    throw new ValidationError(`expected ${toString2()} but got ${JSON.stringify(data)}`, options);
+    throw new ValidationError(`expected ${toString3()} but got ${JSON.stringify(data)}`, options);
   });
-  Schema.extend("intersect", (data, { list, toString: toString2 }, options, strict) => {
+  Schema.extend("intersect", (data, { list, toString: toString3 }, options, strict) => {
     if (!list.length) return [data];
     let result;
     for (const inner of list) {
       const value = Schema.resolve(data, inner, options, true)[0];
       if (isNullable(value)) continue;
       if (isNullable(result)) result = value;
-      else if (typeof result !== typeof value) throw new ValidationError(`expected ${toString2()} but got ${JSON.stringify(data)}`, options);
+      else if (typeof result !== typeof value) throw new ValidationError(`expected ${toString3()} but got ${JSON.stringify(data)}`, options);
       else if (typeof value === "object") merge(result ??= {}, value);
-      else if (result !== value) throw new ValidationError(`expected ${toString2()} but got ${JSON.stringify(data)}`, options);
+      else if (result !== value) throw new ValidationError(`expected ${toString3()} but got ${JSON.stringify(data)}`, options);
     }
     if (!strict && isPlainObject(data)) merge(result, data);
     return [result];
@@ -1228,7 +1228,8 @@
   var IMPORT_BOUNDARY_JOURNAL_VERSION = 7;
   var PER_NAME_USER_BINDINGS_JOURNAL_VERSION = 8;
   var LANGUAGE_SEMANTICS_JOURNAL_VERSION = 9;
-  var JOURNAL_VERSION = LANGUAGE_SEMANTICS_JOURNAL_VERSION;
+  var MODULE_TRANSFORM_JOURNAL_VERSION = 10;
+  var JOURNAL_VERSION = MODULE_TRANSFORM_JOURNAL_VERSION;
   var LIVE_USER_BINDINGS_SHADOW_POLICY = "per-name";
   var LEGACY_USER_BINDINGS_SHADOW_POLICY = "whole-entry";
   var LIVE_USER_BINDINGS_REUSE_POLICY = "implementation-v1";
@@ -1243,7 +1244,8 @@
   var BINDING_MODES = /* @__PURE__ */ new Set(["loose", "strict"]);
   var WHOLE_ENTRY_JOURNAL_FIELDS = /* @__PURE__ */ new Set(["version", "bindingPolicy", "rewritePolicy", "moduleSemantics", "userBindingsFingerprint", "userBindingsReusePolicy", "status", "calls", "operations", "confirms", "diagnostics", "completion", "volatileReason"]);
   var PER_NAME_JOURNAL_FIELDS = /* @__PURE__ */ new Set([...WHOLE_ENTRY_JOURNAL_FIELDS, "userBindingsShadowPolicy", "userBindingNames"]);
-  var JOURNAL_FIELDS = /* @__PURE__ */ new Set([...PER_NAME_JOURNAL_FIELDS, "languageSemantics"]);
+  var LANGUAGE_SEMANTICS_JOURNAL_FIELDS = /* @__PURE__ */ new Set([...PER_NAME_JOURNAL_FIELDS, "languageSemantics"]);
+  var JOURNAL_FIELDS = /* @__PURE__ */ new Set([...LANGUAGE_SEMANTICS_JOURNAL_FIELDS, "moduleTransform"]);
   var FINGERPRINT_REUSE_JOURNAL_FIELDS = new Set([...WHOLE_ENTRY_JOURNAL_FIELDS].filter((field) => field !== "userBindingsReusePolicy"));
   var RELATIONLESS_JOURNAL_FIELDS = new Set([...FINGERPRINT_REUSE_JOURNAL_FIELDS].filter((field) => field !== "userBindingsFingerprint"));
   var PREDECESSOR_JOURNAL_FIELDS = /* @__PURE__ */ new Set(["version", "bindingMode", "rewritePolicy", "status", "calls", "operations", "confirms", "diagnostics", "completion", "volatileReason"]);
@@ -1268,26 +1270,46 @@
   var ERROR_FIELDS = /* @__PURE__ */ new Set(["kind", "message"]);
   var EDIT_TARGET_FIELDS = /* @__PURE__ */ new Set(["targetCallSeq"]);
   var DERIVED_RUN_FIELDS = /* @__PURE__ */ new Set(["code", "description"]);
-  var JOURNAL_VERSIONS = /* @__PURE__ */ new Set([LEGACY_JOURNAL_VERSION, INTERMEDIATE_JOURNAL_VERSION, PREVIOUS_JOURNAL_VERSION, USER_BINDING_RELATIONLESS_JOURNAL_VERSION, FINGERPRINT_REUSE_JOURNAL_VERSION, VERSIONED_BINDING_REUSE_JOURNAL_VERSION, IMPORT_BOUNDARY_JOURNAL_VERSION, PER_NAME_USER_BINDINGS_JOURNAL_VERSION, JOURNAL_VERSION]);
+  var JOURNAL_VERSIONS = /* @__PURE__ */ new Set([LEGACY_JOURNAL_VERSION, INTERMEDIATE_JOURNAL_VERSION, PREVIOUS_JOURNAL_VERSION, USER_BINDING_RELATIONLESS_JOURNAL_VERSION, FINGERPRINT_REUSE_JOURNAL_VERSION, VERSIONED_BINDING_REUSE_JOURNAL_VERSION, IMPORT_BOUNDARY_JOURNAL_VERSION, PER_NAME_USER_BINDINGS_JOURNAL_VERSION, LANGUAGE_SEMANTICS_JOURNAL_VERSION, JOURNAL_VERSION]);
   var USER_BINDINGS_REUSE_POLICIES = /* @__PURE__ */ new Set([LEGACY_USER_BINDINGS_REUSE_POLICY, LIVE_USER_BINDINGS_REUSE_POLICY]);
   var USER_BINDINGS_SHADOW_POLICIES = /* @__PURE__ */ new Set([LEGACY_USER_BINDINGS_SHADOW_POLICY, LIVE_USER_BINDINGS_SHADOW_POLICY]);
   var USER_BINDING_NAME_STATES = /* @__PURE__ */ new Set(["provider", "local", "absent", "unknown"]);
+  var isArray = Array.isArray;
+  var freeze = Object.freeze;
+  var ownKeys = Reflect.ownKeys;
+  var defineProperty = Object.defineProperty;
+  var uncurry = Function.prototype.bind.bind(Function.prototype.call);
+  var setHas = uncurry(Set.prototype.has);
+  var setAdd = uncurry(Set.prototype.add);
+  var sort = uncurry(Array.prototype.sort);
+  var enumerable = uncurry(Object.prototype.propertyIsEnumerable);
   function normalizeUserBindingNames(value) {
-    if (!Array.isArray(value)) throw new TypeError("invalid user binding name evidence");
+    if (!isArray(value)) throw new TypeError("invalid user binding name evidence");
     const names = /* @__PURE__ */ new Set();
-    return Object.freeze(value.map((fact) => {
-      if (fact === null || typeof fact !== "object" || !USER_BINDING_NAME_STATES.has(fact.state) || typeof fact.name !== "string" || fact.name.length > 128 || !/^[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*$/u.test(fact.name) || names.has(fact.name)) throw new TypeError("invalid user binding name evidence");
+    const normalized = [];
+    for (let index = 0; index < value.length; index++) {
+      const fact = value[index];
+      if (fact === null || typeof fact !== "object" || !setHas(USER_BINDING_NAME_STATES, fact.state) || typeof fact.name !== "string" || fact.name.length > 128 || !/^[$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*$/u.test(fact.name) || setHas(names, fact.name)) throw new TypeError("invalid user binding name evidence");
       const fields = fact.state === "provider" ? ["name", "state", "entryId"] : ["name", "state"];
-      if (Reflect.ownKeys(fact).length !== fields.length || !fields.every((key) => Object.prototype.propertyIsEnumerable.call(fact, key)) || fact.state === "provider" && (typeof fact.entryId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(fact.entryId))) {
+      let validFields = ownKeys(fact).length === fields.length;
+      for (let field = 0; validFields && field < fields.length; field++) validFields = enumerable(fact, fields[field]);
+      if (!validFields || fact.state === "provider" && (typeof fact.entryId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(fact.entryId))) {
         throw new TypeError("invalid user binding name evidence");
       }
-      names.add(fact.name);
-      return Object.freeze({
-        name: fact.name,
-        state: fact.state,
-        ...fact.state === "provider" ? { entryId: fact.entryId } : {}
+      setAdd(names, fact.name);
+      defineProperty(normalized, normalized.length, {
+        configurable: true,
+        enumerable: true,
+        writable: true,
+        value: freeze({
+          name: fact.name,
+          state: fact.state,
+          ...fact.state === "provider" ? { entryId: fact.entryId } : {}
+        })
       });
-    }).sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0));
+    }
+    sort(normalized, (left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+    return freeze(normalized);
   }
   function normalizeJournalUserBindingNames(journal) {
     if (!USER_BINDINGS_SHADOW_POLICIES.has(journal.userBindingsShadowPolicy)) {
@@ -1317,6 +1339,31 @@
     return value;
   }
 
+  // internal/module-transform-contract.js
+  var LEGACY_USER_BINDING_TRANSFORM = "amaro@1.1.11";
+  var PREVIOUS_USER_BINDING_TRANSFORM = "stateful-module-v1+amaro@1.1.11";
+  var USER_BINDING_TRANSFORM = "stateful-module-v2+amaro@1.1.11";
+  var PROTECTED_MODULE_TRANSFORM = "protected-module-v1+amaro@1.1.11";
+  var MODULE_TRANSFORMS = /* @__PURE__ */ new Set([
+    LEGACY_USER_BINDING_TRANSFORM,
+    PREVIOUS_USER_BINDING_TRANSFORM,
+    USER_BINDING_TRANSFORM,
+    PROTECTED_MODULE_TRANSFORM
+  ]);
+  function isStatefulUserBindingTransform(transform) {
+    return transform === USER_BINDING_TRANSFORM || transform === PREVIOUS_USER_BINDING_TRANSFORM;
+  }
+  function moduleTransformMatchesLanguage(transform, languageSemantics) {
+    return languageSemantics === "stateful-v1" ? isStatefulUserBindingTransform(transform) : languageSemantics === "protected-v1" ? transform === PROTECTED_MODULE_TRANSFORM : languageSemantics === "legacy-v1" ? transform === LEGACY_USER_BINDING_TRANSFORM : false;
+  }
+  function normalizeModuleTransform(transform, languageSemantics) {
+    if (!MODULE_TRANSFORMS.has(transform)) throw new TypeError("invalid dsh-ptc-plus journal module transform");
+    if (!moduleTransformMatchesLanguage(transform, languageSemantics)) {
+      throw new TypeError("dsh-ptc-plus journal module transform does not match its language semantics");
+    }
+    return transform;
+  }
+
   // internal/value-wire-schema.js
   var VALUE_CODEC = "ptc-value-graph/v1";
   var DEFAULT_VALUE_LIMITS = Object.freeze({
@@ -1529,7 +1576,7 @@
       return false;
     }
     const predecessor = value.version < 4;
-    const fields = value.version === 1 ? LEGACY_JOURNAL_FIELDS : predecessor ? PREDECESSOR_JOURNAL_FIELDS : value.version === 4 ? RELATIONLESS_JOURNAL_FIELDS : value.version === 5 ? FINGERPRINT_REUSE_JOURNAL_FIELDS : value.version < PER_NAME_USER_BINDINGS_JOURNAL_VERSION ? WHOLE_ENTRY_JOURNAL_FIELDS : value.version < LANGUAGE_SEMANTICS_JOURNAL_VERSION ? PER_NAME_JOURNAL_FIELDS : JOURNAL_FIELDS;
+    const fields = value.version === 1 ? LEGACY_JOURNAL_FIELDS : predecessor ? PREDECESSOR_JOURNAL_FIELDS : value.version === 4 ? RELATIONLESS_JOURNAL_FIELDS : value.version === 5 ? FINGERPRINT_REUSE_JOURNAL_FIELDS : value.version < PER_NAME_USER_BINDINGS_JOURNAL_VERSION ? WHOLE_ENTRY_JOURNAL_FIELDS : value.version < LANGUAGE_SEMANTICS_JOURNAL_VERSION ? PER_NAME_JOURNAL_FIELDS : value.version === LANGUAGE_SEMANTICS_JOURNAL_VERSION ? LANGUAGE_SEMANTICS_JOURNAL_FIELDS : JOURNAL_FIELDS;
     const required = predecessor ? ["version", "bindingMode", "status", "calls", "operations", "diagnostics"] : ["version", "bindingPolicy", "rewritePolicy", "moduleSemantics", "status", "calls", "operations", "diagnostics"];
     if (value.version !== 1 && value.version < 4) required.push("rewritePolicy");
     if (value.version >= 5) required.push("userBindingsFingerprint");
@@ -1542,6 +1589,10 @@
       required.push("languageSemantics");
       normalizeLanguageSemantics(value.languageSemantics);
     }
+    if (value.version > LANGUAGE_SEMANTICS_JOURNAL_VERSION) {
+      required.push("moduleTransform");
+      normalizeModuleTransform(value.moduleTransform, value.languageSemantics);
+    }
     if (!hasClosedFields(value, fields, required) || predecessor && !BINDING_MODES.has(value.bindingMode) || value.version >= 4 && !isValidBindingPolicy(value.bindingPolicy) || value.version >= 4 && !isValidModuleSemantics(value.moduleSemantics, value.version) || value.version >= VERSIONED_BINDING_REUSE_JOURNAL_VERSION && !USER_BINDINGS_REUSE_POLICIES.has(value.userBindingsReusePolicy) || value.version >= 5 && value.userBindingsFingerprint !== null && (typeof value.userBindingsFingerprint !== "string" || !/^[a-f0-9]{64}$/.test(value.userBindingsFingerprint)) || value.version !== 1 && !isValidRewritePolicy(value.rewritePolicy) || !Array.isArray(value.calls) || !value.calls.every(isValidCall) || !Array.isArray(value.operations) || !value.operations.every(isValidOperation) || !isValidConfirms(value.confirms, value.version) || !Array.isArray(value.diagnostics) || !value.diagnostics.every(isValidDiagnostic)) return false;
     const settlementOrder = value.calls.map((call) => call.settle).sort((left, right) => left - right);
     if (settlementOrder.some((settle, index) => settle !== index)) return false;
@@ -2565,14 +2616,194 @@
     return { ReplComposer, ReplConsole, ReplMemoryCard, replPopoverIsOpen, placeReplPopover };
   }
 
+  // internal/compiler-descriptors.js
+  function createCompilerDescriptors(object, reflect) {
+    const define = object.defineProperty, defineMany = object.defineProperties;
+    const ownKeys2 = reflect.ownKeys, ownField = object.getOwnPropertyDescriptor;
+    const reflectDefine = reflect.defineProperty;
+    const descriptor = (fields) => ({ __proto__: null, ...fields });
+    const ownedObject = function(value) {
+      return object(value);
+    };
+    const names = object.getOwnPropertyNames(object);
+    for (let index = 0; index < names.length; index++) {
+      const name2 = names[index];
+      if (name2 !== "name" && name2 !== "length" && name2 !== "prototype") {
+        define(ownedObject, name2, descriptor(ownField(object, name2)));
+      }
+    }
+    const operations = {
+      Object: ownedObject,
+      descriptor,
+      getOwnPropertyDescriptor(target, key) {
+        const fields = ownField(target, key);
+        return fields === void 0 ? void 0 : descriptor(fields);
+      },
+      defineProperty: (target, key, fields) => define(target, key, descriptor(fields)),
+      reflectDefineProperty: (target, key, fields) => reflectDefine(target, key, descriptor(fields)),
+      // Rehomed compiler data always writes an owned data field. The null
+      // prototype still keeps native descriptor conversion from reaching an
+      // inherited field, and this writer reaches it without the intermediate
+      // own-field descriptor the generic path copies for every property.
+      defineDataProperty(target, key, value, enumerable2) {
+        const fields = { __proto__: null };
+        fields.value = value;
+        fields.enumerable = enumerable2;
+        fields.writable = true;
+        fields.configurable = true;
+        return define(target, key, fields);
+      },
+      defineProperties(target, fields) {
+        const table = { __proto__: null }, keys2 = ownKeys2(fields);
+        for (let index = 0; index < keys2.length; index++) {
+          const key = keys2[index];
+          if (ownField(fields, key).enumerable) table[key] = descriptor(fields[key]);
+        }
+        return defineMany(target, table);
+      }
+    };
+    ownedObject.defineProperty = operations.defineProperty;
+    ownedObject.defineProperties = operations.defineProperties;
+    ownedObject.getOwnPropertyDescriptor = operations.getOwnPropertyDescriptor;
+    return operations;
+  }
+  var compilerDescriptorSource = Function.prototype.toString.call(createCompilerDescriptors);
+  var compilerDescriptors = createCompilerDescriptors(Object, Reflect);
+
+  // internal/runtime-intrinsics.js
+  var uncurry2 = Function.prototype.bind.bind(Function.prototype.call);
+  var mapKeys = uncurry2(Map.prototype.keys);
+  var mapIteratorNext = uncurry2(Object.getPrototypeOf((/* @__PURE__ */ new Map()).keys()).next);
+  var weakMapGet = uncurry2(WeakMap.prototype.get);
+  var weakMapSet = uncurry2(WeakMap.prototype.set);
+  function appendArray(target, value) {
+    compilerDescriptors.defineProperty(
+      target,
+      target.length,
+      { value, writable: true, enumerable: true, configurable: true }
+    );
+    return target;
+  }
+  function copyArray(source, start = 0, end = source.length, target = []) {
+    for (let index = start; index < end; index++) appendArray(target, source[index]);
+    return target;
+  }
+  var runtimeIntrinsics = {
+    Object: compilerDescriptors.Object,
+    Reflect: {
+      apply: Reflect.apply,
+      construct: Reflect.construct,
+      deleteProperty: Reflect.deleteProperty,
+      defineProperty: compilerDescriptors.reflectDefineProperty,
+      has: Reflect.has,
+      ownKeys: Reflect.ownKeys
+    },
+    Error,
+    TypeError,
+    Array,
+    Map,
+    Set,
+    WeakMap,
+    WeakSet,
+    RegExp,
+    Proxy,
+    objectCreate: Object.create,
+    objectDefineProperty: Object.defineProperty,
+    objectEntries: Object.entries,
+    objectFreeze: Object.freeze,
+    objectGetOwnPropertyDescriptor: Object.getOwnPropertyDescriptor,
+    objectGetPrototypeOf: Object.getPrototypeOf,
+    objectHasOwn: Object.hasOwn,
+    objectIs: Object.is,
+    objectKeys: Object.keys,
+    objectPropertyIsEnumerable: uncurry2(Object.prototype.propertyIsEnumerable),
+    reflectOwnKeys: Reflect.ownKeys,
+    numberIsFinite: Number.isFinite,
+    numberIsNaN: Number.isNaN,
+    numberIsSafeInteger: Number.isSafeInteger,
+    toBigInt: BigInt,
+    toNumber: Number,
+    toString: String,
+    mapGet: uncurry2(Map.prototype.get),
+    mapHas: uncurry2(Map.prototype.has),
+    mapSet: uncurry2(Map.prototype.set),
+    mapDelete: uncurry2(Map.prototype.delete),
+    mapClear: uncurry2(Map.prototype.clear),
+    mapSize: uncurry2(Object.getOwnPropertyDescriptor(Map.prototype, "size").get),
+    mapFirstKey: (value) => mapIteratorNext(mapKeys(value)).value,
+    mapForEach: uncurry2(Map.prototype.forEach),
+    setHas: uncurry2(Set.prototype.has),
+    setAdd: uncurry2(Set.prototype.add),
+    setDelete: uncurry2(Set.prototype.delete),
+    setClear: uncurry2(Set.prototype.clear),
+    setSize: uncurry2(Object.getOwnPropertyDescriptor(Set.prototype, "size").get),
+    setForEach: uncurry2(Set.prototype.forEach),
+    weakMapHas: uncurry2(WeakMap.prototype.has),
+    weakMapGet,
+    weakMapSet,
+    weakSetHas: uncurry2(WeakSet.prototype.has),
+    weakSetAdd: uncurry2(WeakSet.prototype.add),
+    isArray: Array.isArray,
+    everyArray: uncurry2(Array.prototype.every),
+    includes: uncurry2(Array.prototype.includes),
+    join: uncurry2(Array.prototype.join),
+    popArray: uncurry2(Array.prototype.pop),
+    prependArray: uncurry2(Array.prototype.unshift),
+    someArray: uncurry2(Array.prototype.some),
+    sliceString: uncurry2(String.prototype.slice),
+    splitString: uncurry2(String.prototype.split),
+    searchString: uncurry2(String.prototype.search),
+    replaceString: uncurry2(String.prototype.replace),
+    trimString: uncurry2(String.prototype.trim),
+    replaceAllString: uncurry2(String.prototype.replaceAll),
+    includesString: uncurry2(String.prototype.includes),
+    startsWith: uncurry2(String.prototype.startsWith),
+    endsWith: uncurry2(String.prototype.endsWith),
+    regexpExec: uncurry2(RegExp.prototype.exec),
+    regexpTest: uncurry2(RegExp.prototype.test),
+    floor: Math.floor,
+    min: Math.min,
+    max: Math.max,
+    appendArray,
+    copyArray,
+    sort: uncurry2(Array.prototype.sort),
+    compare: uncurry2(String.prototype.localeCompare)
+  };
+  if (typeof Buffer === "function") {
+    runtimeIntrinsics.bufferByteLength = Buffer.byteLength;
+    runtimeIntrinsics.bufferConcat = Buffer.concat;
+    runtimeIntrinsics.bufferIsBuffer = Buffer.isBuffer;
+    runtimeIntrinsics.bufferSubarray = uncurry2(Buffer.prototype.subarray);
+    runtimeIntrinsics.bufferToString = uncurry2(Buffer.prototype.toString);
+  }
+
   // internal/record-utils.js
+  var {
+    TypeError: TypeError2,
+    isArray: isArray2,
+    reflectOwnKeys,
+    objectGetOwnPropertyDescriptor,
+    objectHasOwn,
+    objectPropertyIsEnumerable,
+    objectFreeze,
+    trimString,
+    toString: toString2,
+    Set: Set2,
+    setHas: setHas2,
+    setAdd: setAdd2,
+    setSize,
+    appendArray: appendArray2,
+    popArray
+  } = runtimeIntrinsics;
   function isRecord2(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
+    return value !== null && typeof value === "object" && !isArray2(value);
   }
   function assertOwnFields(value, allowed, label) {
-    for (const key of Reflect.ownKeys(value)) {
-      if (typeof key !== "string" || !allowed.has(key) || !Object.prototype.propertyIsEnumerable.call(value, key)) {
-        throw new TypeError(`invalid ${label} field ${String(key)}`);
+    const keys2 = reflectOwnKeys(value);
+    for (let index = 0; index < keys2.length; index += 1) {
+      const key = keys2[index];
+      if (typeof key !== "string" || !setHas2(allowed, key) || !objectPropertyIsEnumerable(value, key)) {
+        throw new TypeError2(`invalid ${label} field ${toString2(key)}`);
       }
     }
   }
@@ -6749,11 +6980,11 @@
     `Y`.)
     */
     update(updateSpec) {
-      let { add: add2 = [], sort = false, filterFrom = 0, filterTo = this.length } = updateSpec;
+      let { add: add2 = [], sort: sort2 = false, filterFrom = 0, filterTo = this.length } = updateSpec;
       let filter = updateSpec.filter;
       if (add2.length == 0 && !filter)
         return this;
-      if (sort)
+      if (sort2)
         add2 = add2.slice().sort(cmpRange);
       if (this.isEmpty)
         return add2.length ? _RangeSet.of(add2) : this;
@@ -6919,9 +7150,9 @@
     `value.startSide`). You can pass `true` as second argument to
     cause the method to sort them.
     */
-    static of(ranges, sort = false) {
+    static of(ranges, sort2 = false) {
       let build = new RangeSetBuilder();
-      for (let range of ranges instanceof Range ? [ranges] : sort ? lazySort(ranges) : ranges)
+      for (let range of ranges instanceof Range ? [ranges] : sort2 ? lazySort(ranges) : ranges)
         build.add(range.from, range.to, range.value);
       return build.finish();
     }
@@ -7938,8 +8169,8 @@
     decorated range or ranges. If the ranges aren't already sorted,
     pass `true` for `sort` to make the library sort them for you.
     */
-    static set(of, sort = false) {
-      return RangeSet.of(of, sort);
+    static set(of, sort2 = false) {
+      return RangeSet.of(of, sort2);
     }
     /**
     @internal
@@ -8045,8 +8276,8 @@
     /**
     Create a range set from the given block wrapper ranges.
     */
-    static set(of, sort = false) {
-      return RangeSet.of(of, sort);
+    static set(of, sort2 = false) {
+      return RangeSet.of(of, sort2);
     }
   };
   BlockWrapper.prototype.startSide = BlockWrapper.prototype.endSide = -1;