@shirudo/ddd-kit 2.0.0 → 2.2.0

package/dist/index.js

@@ -17,6 +17,7 @@ var BUILT_IN_TAGS = /* @__PURE__ */ new Set([
   "[object Boolean]",
   "[object Number]",
   "[object String]",
+  "[object BigInt]",
   "[object ArrayBuffer]",
   "[object SharedArrayBuffer]",
   "[object DataView]"
@@ -37,11 +38,117 @@ var arrayBufferByteLengthGet = intrinsicGetter(
   ArrayBuffer.prototype,
   "byteLength"
 );
+var sharedArrayBufferByteLengthGet = typeof SharedArrayBuffer === "undefined" ? void 0 : intrinsicGetter(SharedArrayBuffer.prototype, "byteLength");
 var regExpSourceGet = intrinsicGetter(RegExp.prototype, "source");
 var booleanValueOf = Boolean.prototype.valueOf;
 var numberValueOf = Number.prototype.valueOf;
 var stringValueOf = String.prototype.valueOf;
+var bigIntValueOf = BigInt.prototype.valueOf;
+var functionToString = Function.prototype.toString;
 var PROBE_KEY = {};
+var INTRINSIC_CONSTRUCTOR_NAMES = [
+  "Object",
+  "Array",
+  "Date",
+  "RegExp",
+  "Map",
+  "Set",
+  "WeakMap",
+  "WeakSet",
+  "Promise",
+  "Error",
+  "EvalError",
+  "RangeError",
+  "ReferenceError",
+  "SyntaxError",
+  "TypeError",
+  "URIError",
+  "AggregateError",
+  "Boolean",
+  "Number",
+  "String",
+  "BigInt",
+  "ArrayBuffer",
+  "SharedArrayBuffer",
+  "DataView",
+  "Int8Array",
+  "Uint8Array",
+  "Uint8ClampedArray",
+  "Int16Array",
+  "Uint16Array",
+  "Int32Array",
+  "Uint32Array",
+  "Float32Array",
+  "Float64Array",
+  "BigInt64Array",
+  "BigUint64Array"
+];
+var intrinsicConstructorSources = new Map(
+  INTRINSIC_CONSTRUCTOR_NAMES.flatMap((name) => {
+    const descriptor = Object.getOwnPropertyDescriptor(globalThis, name);
+    const intrinsic = descriptor?.value;
+    return typeof intrinsic === "function" ? [[name, functionToString.call(intrinsic)]] : [];
+  })
+);
+var intrinsicConstructorSourceSet = new Set(
+  intrinsicConstructorSources.values()
+);
+var ERROR_INTRINSIC_NAMES = [
+  "Error",
+  "EvalError",
+  "RangeError",
+  "ReferenceError",
+  "SyntaxError",
+  "TypeError",
+  "URIError",
+  "AggregateError"
+];
+function isIntrinsicConstructorPrototype(prototype, expectedName) {
+  const constructorDescriptor = Object.getOwnPropertyDescriptor(
+    prototype,
+    "constructor"
+  );
+  const candidateConstructor = constructorDescriptor?.value;
+  if (constructorDescriptor === void 0 || !("value" in constructorDescriptor) || typeof candidateConstructor !== "function") {
+    return false;
+  }
+  let candidateSource;
+  try {
+    candidateSource = functionToString.call(candidateConstructor);
+  } catch {
+    return false;
+  }
+  const expectedSource = expectedName === void 0 ? void 0 : intrinsicConstructorSources.get(expectedName);
+  if (expectedSource !== void 0 && candidateSource !== expectedSource || expectedSource === void 0 && !intrinsicConstructorSourceSet.has(candidateSource)) {
+    return false;
+  }
+  const nameDescriptor = Object.getOwnPropertyDescriptor(
+    candidateConstructor,
+    "name"
+  );
+  const candidateName = nameDescriptor !== void 0 && "value" in nameDescriptor && typeof nameDescriptor.value === "string" ? nameDescriptor.value : void 0;
+  const intrinsicName = expectedName ?? candidateName;
+  const intrinsicSource = intrinsicName === void 0 ? void 0 : intrinsicConstructorSources.get(intrinsicName);
+  return candidateName === intrinsicName && intrinsicSource !== void 0 && candidateSource === intrinsicSource && Object.getOwnPropertyDescriptor(candidateConstructor, "prototype")?.value === prototype;
+}
+__name(isIntrinsicConstructorPrototype, "isIntrinsicConstructorPrototype");
+function hasIntrinsicPrototypeChain(value, expectedName) {
+  const visited = /* @__PURE__ */ new WeakSet();
+  let prototype = Object.getPrototypeOf(value);
+  while (prototype !== null && !visited.has(prototype)) {
+    visited.add(prototype);
+    if (Object.hasOwn(prototype, "constructor")) {
+      return isIntrinsicConstructorPrototype(prototype, expectedName);
+    }
+    const ownKeys2 = Reflect.ownKeys(prototype);
+    if (ownKeys2.length !== 1 || ownKeys2[0] !== Symbol.toStringTag) {
+      return false;
+    }
+    prototype = Object.getPrototypeOf(prototype);
+  }
+  return false;
+}
+__name(hasIntrinsicPrototypeChain, "hasIntrinsicPrototypeChain");
 var REFERENCE_COMPARED_TAGS = /* @__PURE__ */ new Set([
   "[object Error]",
   "[object ArrayBuffer]",
@@ -50,6 +157,72 @@ var REFERENCE_COMPARED_TAGS = /* @__PURE__ */ new Set([
   "[object WeakMap]",
   "[object WeakSet]"
 ]);
+function findPropertyDescriptor(value, key) {
+  const visited = /* @__PURE__ */ new WeakSet();
+  let current = value;
+  while (current !== null && !visited.has(current)) {
+    visited.add(current);
+    const descriptor = Object.getOwnPropertyDescriptor(current, key);
+    if (descriptor !== void 0) return descriptor;
+    current = Object.getPrototypeOf(current);
+  }
+  return void 0;
+}
+__name(findPropertyDescriptor, "findPropertyDescriptor");
+function builtInTagWithoutInvokingAccessors(value) {
+  if (ArrayBuffer.isView(value)) {
+    return hasBrand(value, "[object DataView]") ? "[object DataView]" : "[object TypedArray]";
+  }
+  const descriptor = findPropertyDescriptor(value, Symbol.toStringTag);
+  if (descriptor !== void 0 && !("value" in descriptor)) {
+    return builtInTagFromBrand(value);
+  }
+  const tag = Object.prototype.toString.call(value);
+  if (BUILT_IN_TAGS.has(tag) && hasBrand(value, tag)) {
+    return tag;
+  }
+  return descriptor === void 0 ? void 0 : builtInTagFromBrand(value);
+}
+__name(builtInTagWithoutInvokingAccessors, "builtInTagWithoutInvokingAccessors");
+function mutableBuiltInTagWithoutInvokingAccessors(value) {
+  const tag = builtInTagWithoutInvokingAccessors(value);
+  return tag === "[object Date]" || tag === "[object Map]" || tag === "[object Set]" ? tag : void 0;
+}
+__name(mutableBuiltInTagWithoutInvokingAccessors, "mutableBuiltInTagWithoutInvokingAccessors");
+function builtInTagFromBrand(value) {
+  if (hasBrand(value, "[object Date]")) return "[object Date]";
+  if (hasBrand(value, "[object RegExp]")) return "[object RegExp]";
+  if (hasBrand(value, "[object Map]")) return "[object Map]";
+  if (hasBrand(value, "[object Set]")) return "[object Set]";
+  if (hasBrand(value, "[object WeakMap]")) return "[object WeakMap]";
+  if (hasBrand(value, "[object WeakSet]")) return "[object WeakSet]";
+  if (hasBrand(value, "[object DataView]")) return "[object DataView]";
+  if (hasBrand(value, "[object ArrayBuffer]")) return "[object ArrayBuffer]";
+  if (hasBrand(value, "[object SharedArrayBuffer]")) {
+    return "[object SharedArrayBuffer]";
+  }
+  if (hasBrand(value, "[object Boolean]")) return "[object Boolean]";
+  if (hasBrand(value, "[object Number]")) return "[object Number]";
+  if (hasBrand(value, "[object String]")) return "[object String]";
+  if (hasBrand(value, "[object BigInt]")) return "[object BigInt]";
+  if (hasNativePrototype(value, "Promise")) return "[object Promise]";
+  if (hasNativePrototype(value, "Error")) return "[object Error]";
+  return void 0;
+}
+__name(builtInTagFromBrand, "builtInTagFromBrand");
+function hasNativePrototype(value, expectedName) {
+  const visited = /* @__PURE__ */ new WeakSet();
+  let prototype = Object.getPrototypeOf(value);
+  while (prototype !== null && !visited.has(prototype)) {
+    visited.add(prototype);
+    if (isIntrinsicConstructorPrototype(prototype, expectedName)) {
+      return true;
+    }
+    prototype = Object.getPrototypeOf(prototype);
+  }
+  return false;
+}
+__name(hasNativePrototype, "hasNativePrototype");
 function hasBrand(obj, tag) {
   try {
     switch (tag) {
@@ -77,6 +250,10 @@ function hasBrand(obj, tag) {
       case "[object ArrayBuffer]":
         arrayBufferByteLengthGet.call(obj);
         return true;
+      case "[object SharedArrayBuffer]":
+        if (!sharedArrayBufferByteLengthGet) return false;
+        sharedArrayBufferByteLengthGet.call(obj);
+        return true;
       case "[object Boolean]":
         booleanValueOf.call(obj);
         return true;
@@ -86,8 +263,17 @@ function hasBrand(obj, tag) {
       case "[object String]":
         stringValueOf.call(obj);
         return true;
-      default:
+      case "[object BigInt]":
+        bigIntValueOf.call(obj);
         return true;
+      case "[object Promise]":
+        return hasNativePrototype(obj, "Promise");
+      case "[object Error]":
+        return ERROR_INTRINSIC_NAMES.some(
+          (name) => hasNativePrototype(obj, name)
+        );
+      default:
+        return false;
     }
   } catch {
     return false;
@@ -160,12 +346,17 @@ function deepEqualInner(a, b, visited) {
   }
   if (Array.isArray(objA) || Array.isArray(objB)) {
     if (!Array.isArray(objA) || !Array.isArray(objB)) return false;
+    if (objA.length !== objB.length) return false;
+    const keysA = Reflect.ownKeys(objA).filter((key) => key !== "length");
+    const keysB = Reflect.ownKeys(objB).filter((key) => key !== "length");
+    if (keysA.length !== keysB.length) return false;
     const arrA = objA;
     const arrB = objB;
-    const len = arrA.length;
-    if (len !== arrB.length) return false;
-    for (let i = 0; i < len; i++) {
-      if (!deepEqualInner(arrA[i], arrB[i], visited)) return false;
+    for (const key of keysA) {
+      if (!objHasOwn.call(objB, key)) return false;
+      if (!deepEqualInner(arrA[key], arrB[key], visited)) {
+        return false;
+      }
     }
     return true;
   }
@@ -209,7 +400,8 @@ function deepEqualInner(a, b, visited) {
     }
     case "[object Boolean]":
     case "[object Number]":
-    case "[object String]": {
+    case "[object String]":
+    case "[object BigInt]": {
       return sameValueZero(
         objA.valueOf(),
         objB.valueOf()
@@ -224,8 +416,8 @@ __name(deepEqualInner, "deepEqualInner");
 function comparePlainObjects(objA, objB, visited) {
   const recA = objA;
   const recB = objB;
-  const stringKeysA = Object.keys(objA);
-  const stringKeysB = Object.keys(objB);
+  const stringKeysA = Object.getOwnPropertyNames(objA);
+  const stringKeysB = Object.getOwnPropertyNames(objB);
   if (stringKeysA.length !== stringKeysB.length) return false;
   const symbolKeysA = Object.getOwnPropertySymbols(objA);
   const symbolKeysB = Object.getOwnPropertySymbols(objB);
@@ -275,19 +467,33 @@ function omitInternal(value, options, ignoreKeys, path, visited, budget) {
   if (Array.isArray(obj)) {
     const arr = obj;
     const clone2 = new Array(arr.length);
+    const lengthDescriptor = Object.getOwnPropertyDescriptor(arr, "length");
     visited.set(obj, clone2);
-    for (let i = 0; i < arr.length; i++) {
-      path.push(i);
-      clone2[i] = omitInternal(
-        arr[i],
-        options,
-        ignoreKeys,
-        path,
-        visited,
-        budget
-      );
+    for (const key of Reflect.ownKeys(arr)) {
+      if (key === "length") continue;
+      const segment = arrayPathSegment(key);
+      if (typeof segment !== "number" && shouldIgnoreKey(key, path, ignoreKeys, options)) {
+        continue;
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(arr, key);
+      if (descriptor === void 0) continue;
+      path.push(segment);
+      if ("value" in descriptor) {
+        descriptor.value = omitInternal(
+          descriptor.value,
+          options,
+          ignoreKeys,
+          path,
+          visited,
+          budget
+        );
+      }
+      Object.defineProperty(clone2, key, descriptor);
       path.pop();
     }
+    if (lengthDescriptor !== void 0) {
+      Object.defineProperty(clone2, "length", lengthDescriptor);
+    }
     if (budget) visited.delete(obj);
     return clone2;
   }
@@ -339,6 +545,12 @@ function omitInternal(value, options, ignoreKeys, path, visited, budget) {
   return clone;
 }
 __name(omitInternal, "omitInternal");
+function arrayPathSegment(key) {
+  if (typeof key === "symbol") return key;
+  const index = Number(key);
+  return Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key ? index : key;
+}
+__name(arrayPathSegment, "arrayPathSegment");
 function assignOwn(target, key, value) {
   Object.defineProperty(target, key, {
     value,
@@ -405,6 +617,8 @@ var DATE_MUTATORS = [
   "setYear"
 ];
 var mutationThrowers = /* @__PURE__ */ new Map();
+var mapEntries = Map.prototype.entries;
+var setValues = Set.prototype.values;
 function mutationThrower(typeName, method) {
   const key = `${typeName}.${method}`;
   let thrower = mutationThrowers.get(key);
@@ -444,17 +658,19 @@ function deepFreeze(obj, visited = /* @__PURE__ */ new WeakSet()) {
     return obj;
   }
   visited.add(obj);
-  const tag = Object.prototype.toString.call(obj);
-  if (isBuiltInObject(obj, tag)) {
-    if (tag === "[object Date]") {
+  const mutableBuiltInTag = mutableBuiltInTagWithoutInvokingAccessors(
+    obj
+  );
+  if (mutableBuiltInTag !== void 0) {
+    if (mutableBuiltInTag === "[object Date]") {
       shadowMutators(obj, "Date", DATE_MUTATORS);
-    } else if (tag === "[object Map]") {
+    } else if (mutableBuiltInTag === "[object Map]") {
       for (const [key, value] of obj) {
         deepFreeze(key, visited);
         deepFreeze(value, visited);
       }
       shadowMutators(obj, "Map", ["set", "delete", "clear"]);
-    } else if (tag === "[object Set]") {
+    } else if (mutableBuiltInTag === "[object Set]") {
       for (const member of obj) {
         deepFreeze(member, visited);
       }
@@ -481,32 +697,63 @@ function cloneForVo(value, visited) {
     return value;
   }
   const obj = value;
+  if (ArrayBuffer.isView(obj)) {
+    throwUnsupportedValueSemantics(
+      builtInTagWithoutInvokingAccessors(obj) ?? "[object ArrayBuffer view]"
+    );
+  }
   if (visited.has(obj)) {
     return visited.get(obj);
   }
   if (Array.isArray(obj)) {
+    if (!hasIntrinsicPrototypeChain(obj, "Array")) {
+      throwUnsupportedClassInstance();
+    }
     const clone2 = new Array(obj.length);
     visited.set(obj, clone2);
-    for (let i = 0; i < obj.length; i++) {
-      clone2[i] = cloneForVo(obj[i], visited);
+    for (const key of Reflect.ownKeys(obj)) {
+      if (key === "length") continue;
+      const descriptor = Object.getOwnPropertyDescriptor(obj, key);
+      if (descriptor === void 0) continue;
+      if (!("value" in descriptor)) {
+        throwUnsupportedAccessorProperty();
+      }
+      if (typeof key === "string" && !descriptor.enumerable) continue;
+      descriptor.value = cloneForVo(descriptor.value, visited);
+      Object.defineProperty(clone2, key, descriptor);
     }
     return clone2;
   }
-  const tag = Object.prototype.toString.call(obj);
-  if (isBuiltInObject(obj, tag)) {
+  const tag = builtInTagWithoutInvokingAccessors(obj);
+  if (tag !== void 0) {
+    if (!hasIntrinsicPrototypeChain(obj)) {
+      throwUnsupportedClassInstance();
+    }
     if (tag === "[object Map]") {
       const clone2 = /* @__PURE__ */ new Map();
       visited.set(obj, clone2);
-      for (const [key, entry] of obj) {
-        clone2.set(cloneForVo(key, visited), cloneForVo(entry, visited));
+      for (const [key, entry] of mapEntries.call(
+        obj
+      )) {
+        if (!isPrimitiveValue(key)) {
+          throw new TypeError(
+            "vo() Map keys must be primitive values to preserve value equality"
+          );
+        }
+        clone2.set(key, cloneForVo(entry, visited));
       }
       return clone2;
     }
     if (tag === "[object Set]") {
       const clone2 = /* @__PURE__ */ new Set();
       visited.set(obj, clone2);
-      for (const member of obj) {
-        clone2.add(cloneForVo(member, visited));
+      for (const member of setValues.call(obj)) {
+        if (!isPrimitiveValue(member)) {
+          throw new TypeError(
+            "vo() Set members must be primitive values to preserve value equality"
+          );
+        }
+        clone2.add(member);
       }
       return clone2;
     }
@@ -515,28 +762,67 @@ function cloneForVo(value, visited) {
         `vo() cannot clone a ${tag.slice(8, -1)}: Value Objects are plain data`
       );
     }
+    if (tag === "[object Error]" || tag === "[object ArrayBuffer]" || tag === "[object SharedArrayBuffer]") {
+      throwUnsupportedValueSemantics(tag);
+    }
+    if (tag === "[object RegExp]") {
+      const regExp = obj;
+      if (regExp.global || regExp.sticky) {
+        throw new TypeError(
+          "vo() cannot accept a global or sticky RegExp: its lastIndex is mutable scan state, not an immutable value"
+        );
+      }
+    }
     const builtInClone = structuredClone(obj);
     visited.set(obj, builtInClone);
     return builtInClone;
   }
-  const clone = Object.create(Object.getPrototypeOf(obj));
+  const prototype = Object.getPrototypeOf(obj);
+  if (prototype !== null && (!isIntrinsicConstructorPrototype(prototype, "Object") || Object.getPrototypeOf(prototype) !== null)) {
+    throwUnsupportedClassInstance();
+  }
+  const clone = Object.create(prototype === null ? null : Object.prototype);
   visited.set(obj, clone);
   for (const key of Reflect.ownKeys(obj)) {
     const descriptor = Object.getOwnPropertyDescriptor(obj, key);
-    if (!descriptor?.enumerable) continue;
+    if (descriptor === void 0) continue;
+    if (!("value" in descriptor)) {
+      throwUnsupportedAccessorProperty();
+    }
+    if (typeof key === "string" && !descriptor.enumerable) continue;
     Object.defineProperty(clone, key, {
-      value: cloneForVo(
-        obj[key],
-        visited
-      ),
+      value: cloneForVo(descriptor.value, visited),
       writable: true,
-      enumerable: true,
+      enumerable: descriptor.enumerable,
       configurable: true
     });
   }
   return clone;
 }
 __name(cloneForVo, "cloneForVo");
+function throwUnsupportedClassInstance() {
+  throw new TypeError(
+    "vo() cannot clone custom class instances: Value Objects are plain data"
+  );
+}
+__name(throwUnsupportedClassInstance, "throwUnsupportedClassInstance");
+function throwUnsupportedAccessorProperty() {
+  throw new TypeError(
+    "vo() cannot clone accessor properties: Value Objects are plain data"
+  );
+}
+__name(throwUnsupportedAccessorProperty, "throwUnsupportedAccessorProperty");
+function throwUnsupportedValueSemantics(tag) {
+  const name = tag.startsWith("[object ") ? tag.slice(8, -1) : tag;
+  throw new TypeError(
+    `vo() cannot accept ${name} values: Value Objects require immutable value semantics`
+  );
+}
+__name(throwUnsupportedValueSemantics, "throwUnsupportedValueSemantics");
+function isPrimitiveValue(value) {
+  return value === null || typeof value !== "object" && typeof value !== "function";
+}
+__name(isPrimitiveValue, "isPrimitiveValue");
 function vo(t) {
   return deepFreeze(cloneForVo(t, /* @__PURE__ */ new WeakMap()));
 }
@@ -574,7 +860,7 @@ var ValueObject = class {
   props;
   /**
    * Creates a new ValueObject.
-   * The properties are deep-cloned (prototype-preserving) and then deeply
+   * The plain-data properties are deep-cloned and then deeply
    * frozen, so the caller's own object graph is never frozen or mutated,
    * and later mutation of the input does not bleed into the value object.
    *
@@ -629,7 +915,19 @@ var ValueObject = class {
    */
   clone(props) {
     const Constructor = this.constructor;
-    return new Constructor({ ...this.props, ...props || {} });
+    const merged = { ...this.props, ...props || {} };
+    for (const key of Reflect.ownKeys(this.props)) {
+      const descriptor = Object.getOwnPropertyDescriptor(this.props, key);
+      if (descriptor === void 0 || descriptor.enumerable) continue;
+      if (props && Object.hasOwn(props, key)) continue;
+      Object.defineProperty(merged, key, {
+        value: this.props[key],
+        writable: true,
+        enumerable: false,
+        configurable: true
+      });
+    }
+    return new Constructor(merged);
   }
   /**
    * Serializes the value object to its raw properties for JSON operations.
@@ -641,13 +939,33 @@ var ValueObject = class {
   }
 };
 
-// src/aggregate/domain-event.ts
-var defaultEventIdFactory = /* @__PURE__ */ __name(() => crypto.randomUUID(), "defaultEventIdFactory");
-var currentEventIdFactory = defaultEventIdFactory;
-function setEventIdFactory(factory) {
-  currentEventIdFactory = factory;
+// src/aggregate/clock.ts
+var defaultClockFactory = /* @__PURE__ */ __name(() => /* @__PURE__ */ new Date(), "defaultClockFactory");
+var currentClockFactory = defaultClockFactory;
+function now() {
+  return currentClockFactory();
 }
-__name(setEventIdFactory, "setEventIdFactory");
+__name(now, "now");
+function setClockFactory(factory) {
+  currentClockFactory = factory;
+}
+__name(setClockFactory, "setClockFactory");
+function withClockFactory(factory, fn) {
+  const previous = currentClockFactory;
+  currentClockFactory = factory;
+  try {
+    const result = fn();
+    assertNotThenable(result, "withClockFactory");
+    return result;
+  } finally {
+    currentClockFactory = previous;
+  }
+}
+__name(withClockFactory, "withClockFactory");
+function resetClockFactory() {
+  currentClockFactory = defaultClockFactory;
+}
+__name(resetClockFactory, "resetClockFactory");
 function assertNotThenable(result, helperName) {
   if (result !== null && (typeof result === "object" || typeof result === "function") && typeof result.then === "function") {
     throw new Error(
@@ -656,6 +974,14 @@ function assertNotThenable(result, helperName) {
   }
 }
 __name(assertNotThenable, "assertNotThenable");
+
+// src/aggregate/domain-event.ts
+var defaultEventIdFactory = /* @__PURE__ */ __name(() => crypto.randomUUID(), "defaultEventIdFactory");
+var currentEventIdFactory = defaultEventIdFactory;
+function setEventIdFactory(factory) {
+  currentEventIdFactory = factory;
+}
+__name(setEventIdFactory, "setEventIdFactory");
 function withEventIdFactory(factory, fn) {
   const previous = currentEventIdFactory;
   currentEventIdFactory = factory;
@@ -672,45 +998,46 @@ function resetEventIdFactory() {
   currentEventIdFactory = defaultEventIdFactory;
 }
 __name(resetEventIdFactory, "resetEventIdFactory");
-var defaultClockFactory = /* @__PURE__ */ __name(() => /* @__PURE__ */ new Date(), "defaultClockFactory");
-var currentClockFactory = defaultClockFactory;
-function setClockFactory(factory) {
-  currentClockFactory = factory;
-}
-__name(setClockFactory, "setClockFactory");
-function withClockFactory(factory, fn) {
-  const previous = currentClockFactory;
-  currentClockFactory = factory;
-  try {
-    const result = fn();
-    assertNotThenable(result, "withClockFactory");
-    return result;
-  } finally {
-    currentClockFactory = previous;
-  }
-}
-__name(withClockFactory, "withClockFactory");
-function resetClockFactory() {
-  currentClockFactory = defaultClockFactory;
-}
-__name(resetClockFactory, "resetClockFactory");
 function createDomainEvent(type, payload, options) {
   const event = {
     eventId: options?.eventId ?? currentEventIdFactory(),
     type,
     aggregateId: options?.aggregateId,
     aggregateType: options?.aggregateType,
-    payload,
-    // Defensive copy: the event must not share the caller's live Date
-    // instance, or a later mutation of it would bleed into the event.
-    occurredAt: options?.occurredAt ? new Date(options.occurredAt.getTime()) : currentClockFactory(),
+    // Defensive copies throughout: the deep-freeze below must never
+    // reach the caller's own object graph. Without the clone, passing
+    // (parts of) live aggregate state as payload, or reusing a metadata
+    // object across events, would freeze the caller's objects in place;
+    // the next mutation then throws far away from the cause. Same
+    // ownership contract as `vo()` and the occurredAt copy.
+    payload: cloneOwnedEventData(payload, "payload"),
+    occurredAt: options?.occurredAt ? new Date(options.occurredAt.getTime()) : now(),
     version: options?.version ?? 1,
     aggregateVersion: options?.aggregateVersion,
-    metadata: options?.metadata
+    metadata: cloneOwnedEventData(options?.metadata, "metadata")
   };
   return deepFreeze(event);
 }
 __name(createDomainEvent, "createDomainEvent");
+function cloneOwnedEventData(value, field) {
+  if (typeof value === "function") {
+    throw new TypeError(
+      `createDomainEvent: ${field} must not be a function: domain events are plain data`
+    );
+  }
+  if (value === null || typeof value !== "object") {
+    return value;
+  }
+  try {
+    return structuredClone(value);
+  } catch (cause) {
+    throw new TypeError(
+      `createDomainEvent: ${field} must be plain, structured-cloneable data (no functions, Promises, or WeakMap/WeakSet values): domain events are plain data`,
+      { cause }
+    );
+  }
+}
+__name(cloneOwnedEventData, "cloneOwnedEventData");
 function copyMetadata(sourceEvent, additionalMetadata) {
   return {
     ...sourceEvent.metadata ?? {},
@@ -742,93 +1069,275 @@ function sameVersion(a, b) {
   return a.id === b.id && a.version === b.version;
 }
 __name(sameVersion, "sameVersion");
-
-// src/entity/entity.ts
-var Entity = class {
+var DomainError = class extends BaseError {
   static {
-    __name(this, "Entity");
+    __name(this, "DomainError");
   }
-  id;
-  /**
-   * Returns the current state of the entity.
-   *
-   * The state object is **shallowly frozen**: direct property writes
-   * (`entity.state.foo = …`) throw in strict mode, but writes to nested
-   * objects (`entity.state.address.zip = …`) bypass the freeze. For deep
-   * immutability either model nested data with `vo()` (which freezes
-   * deeply) or reach for a structural-sharing library like Immer at the
-   * App layer. The shallow contract is intentional: deep freezing on
-   * every state write is too expensive for hot paths, and DDD aggregates
-   * normally treat their own state as private (`Tell, Don't Ask`).
-   */
-  get state() {
-    return this._state;
+};
+var InfrastructureError = class extends BaseError {
+  static {
+    __name(this, "InfrastructureError");
   }
-  /**
-   * The state is 'protected' so that only the subclass can modify it.
-   * Subclasses can mutate this directly or use helper methods.
-   */
-  _state;
-  /**
-   * **State ownership.** Plain-object and array states are shallow-copied
-   * before the freeze, so the caller's own object stays mutable. A CLASS
-   * INSTANCE passed as state is an ownership transfer: it is frozen
-   * in place (a copy would strip its prototype). Do not keep mutating
-   * the instance after handing it to the entity. The same contract
-   * applies to {@link setState}.
-   */
-  constructor(id, initialState) {
-    if (id === null || id === void 0) {
-      throw new Error("Entity ID cannot be null or undefined");
-    }
-    this.id = id;
-    this._state = freezeShallow(shallowCopyOwned(initialState));
-    this.validateState(this._state);
+};
+var MissingHandlerError = class extends BaseError {
+  constructor(eventType, cause) {
+    super(`Missing handler for event type: ${eventType}`, cause, {
+      name: "MissingHandlerError"
+    });
+    this.eventType = eventType;
   }
-  /**
-   * Optional validation hook to ensure state invariants. Called during
-   * construction (from `Entity`'s constructor) and again on every
-   * `setState()` call. Throw to reject invalid state.
-   *
-   * **⚠️ Must not read subclass instance fields via `this`.** The
-   * constructor calls `validateState(initialState)` BEFORE the subclass's
-   * field initializers run, so `this.someField` is `undefined` at that
-   * point, a classic TypeScript/JavaScript constructor-ordering footgun.
-   * The `state` argument is the single source of truth; treat the method
-   * as pure with respect to `this`.
-   *
-   * If your invariants genuinely depend on per-instance configuration
-   * that isn't part of the state, pass that configuration into the state
-   * itself (DDD-canonical: the aggregate's state contains everything it
-   * needs) or perform the additional check after construction in a
-   * dedicated factory method.
-   *
-   * @param state - The state to validate
-   * @throws Error (or `DomainError` subclass) if validation fails
-   */
-  validateState(_state) {
+  static {
+    __name(this, "MissingHandlerError");
   }
-  /**
-   * Sets the state of the entity.
-   * This is a convenience method for state mutations.
-   * Automatically validates the newState using `validateState()`.
-   *
-   * Plain-object and array states are shallow-copied before the freeze
-   * (the caller's object stays mutable); a class-instance state is an
-   * ownership transfer and is frozen in place; see the constructor.
-   *
-   * @param newState - The new state
-   */
-  setState(newState) {
-    this.validateState(newState);
-    this._state = freezeShallow(shallowCopyOwned(newState));
+};
+var UnreplayableAggregateError = class extends BaseError {
+  constructor(aggregateId, reason) {
+    super(
+      `Cannot replay history onto aggregate ${aggregateId}: ${reason}. Reconstitute on a fresh instance (no factory-recorded events, no unpersisted mutations), or markPersisted the aggregate before a catch-up replay.`,
+      void 0,
+      { name: "UnreplayableAggregateError" }
+    );
+    this.aggregateId = aggregateId;
+  }
+  static {
+    __name(this, "UnreplayableAggregateError");
   }
 };
-function freezeShallow(value) {
-  if (value !== null && typeof value === "object") {
-    return Object.freeze(value);
+var EventHarvestError = class extends BaseError {
+  constructor(message, eventType) {
+    super(message, void 0, { name: "EventHarvestError" });
+    this.eventType = eventType;
   }
-  return value;
+  static {
+    __name(this, "EventHarvestError");
+  }
+};
+var UnregisteredHandlerError = class extends BaseError {
+  static {
+    __name(this, "UnregisteredHandlerError");
+  }
+  busKind;
+  messageType;
+  constructor(options) {
+    super(
+      `No handler registered for ${options.busKind} type: ${options.messageType}`,
+      void 0,
+      { name: "UnregisteredHandlerError" }
+    );
+    this.busKind = options.busKind;
+    this.messageType = options.messageType;
+  }
+};
+var UnenrolledChangesError = class extends BaseError {
+  constructor(aggregateId) {
+    super(
+      `Aggregate ${aggregateId} was loaded in this unit of work and has pending events, but was never enrolled (no save), so its events would be silently dropped. Call repository.save(aggregate), and ensure save() calls session.enrollSaved before the row write.`,
+      void 0,
+      { name: "UnenrolledChangesError" }
+    );
+    this.aggregateId = aggregateId;
+  }
+  static {
+    __name(this, "UnenrolledChangesError");
+  }
+};
+var AggregateDeletedError = class extends BaseError {
+  constructor(aggregateId) {
+    super(
+      `Aggregate ${aggregateId} was deleted in this unit of work and cannot be saved or registered again. Deletion is final within an operation; if the aggregate must live, do not delete it.`,
+      void 0,
+      { name: "AggregateDeletedError" }
+    );
+    this.aggregateId = aggregateId;
+  }
+  static {
+    __name(this, "AggregateDeletedError");
+  }
+};
+var AggregateNotFoundError = class extends InfrastructureError {
+  static {
+    __name(this, "AggregateNotFoundError");
+  }
+  aggregateType;
+  id;
+  constructor(options) {
+    super(
+      `Aggregate not found: ${options.aggregateType}(${options.id})`,
+      options.cause,
+      { name: "AggregateNotFoundError" }
+    );
+    this.aggregateType = options.aggregateType;
+    this.id = options.id;
+  }
+};
+var DuplicateAggregateError = class extends InfrastructureError {
+  static {
+    __name(this, "DuplicateAggregateError");
+  }
+  aggregateType;
+  aggregateId;
+  constructor(options) {
+    super(
+      `Duplicate aggregate: ${options.aggregateType}(${options.aggregateId}) already exists`,
+      options.cause,
+      { name: "DuplicateAggregateError" }
+    );
+    this.aggregateType = options.aggregateType;
+    this.aggregateId = options.aggregateId;
+  }
+};
+var SnapshotSchemaMismatchError = class extends InfrastructureError {
+  static {
+    __name(this, "SnapshotSchemaMismatchError");
+  }
+  aggregateType;
+  aggregateId;
+  expectedSchemaVersion;
+  actualSchemaVersion;
+  constructor(options) {
+    super(
+      `Snapshot schema mismatch on ${options.aggregateType}(${options.aggregateId}): the aggregate expects snapshot schema ${options.expectedSchemaVersion}, the stored snapshot carries ${options.actualSchemaVersion}. Override migrateSnapshotState to upgrade old snapshots, or discard the snapshot and refold from the full event stream.`,
+      void 0,
+      { name: "SnapshotSchemaMismatchError" }
+    );
+    this.aggregateType = options.aggregateType;
+    this.aggregateId = options.aggregateId;
+    this.expectedSchemaVersion = options.expectedSchemaVersion;
+    this.actualSchemaVersion = options.actualSchemaVersion;
+  }
+};
+var ConcurrencyConflictError = class extends InfrastructureError {
+  static {
+    __name(this, "ConcurrencyConflictError");
+  }
+  /**
+   * Marks this error as retryable so `isRetryable(err)` returns
+   * true. The canonical OCC pattern is to reload the aggregate, re-apply
+   * the use case, and retry on this exception.
+   */
+  retryable = true;
+  aggregateType;
+  aggregateId;
+  expectedVersion;
+  actualVersion;
+  constructor(options) {
+    super(
+      `Concurrency conflict on ${options.aggregateType}(${options.aggregateId}): expected version ${options.expectedVersion}, actual ${options.actualVersion}`,
+      options.cause,
+      { name: "ConcurrencyConflictError" }
+    );
+    this.aggregateType = options.aggregateType;
+    this.aggregateId = options.aggregateId;
+    this.expectedVersion = options.expectedVersion;
+    this.actualVersion = options.actualVersion;
+  }
+};
+
+// src/entity/entity.ts
+var Entity = class {
+  static {
+    __name(this, "Entity");
+  }
+  id;
+  /**
+   * Returns the current state of the entity.
+   *
+   * By default the state object is **shallowly frozen**: direct property
+   * writes (`entity.state.foo = …`) throw in strict mode, but writes to
+   * nested objects (`entity.state.address.zip = …`) bypass the freeze.
+   * For deep immutability either enable the opt-in
+   * {@link EntityConfig.deepFreezeState} (plain-data states only), model
+   * nested data with `vo()` (which freezes deeply), or reach for a
+   * structural-sharing library like Immer at the App layer. The shallow
+   * default is intentional: deep freezing on every state write is too
+   * expensive for hot paths, and DDD aggregates normally treat their own
+   * state as private (`Tell, Don't Ask`).
+   */
+  get state() {
+    return this._state;
+  }
+  /**
+   * The state is 'protected' so that only the subclass can modify it.
+   * Subclasses can mutate this directly or use helper methods; direct
+   * assignments should freeze through {@link freezeState} so the
+   * configured freeze mode is honored.
+   */
+  _state;
+  _deepFreezeState;
+  /**
+   * **State ownership.** Plain-object and array states are shallow-copied
+   * before the freeze, so the caller's own object stays mutable. A CLASS
+   * INSTANCE passed as state is an ownership transfer: it is frozen
+   * in place (a copy would strip its prototype). Do not keep mutating
+   * the instance after handing it to the entity. The same contract
+   * applies to {@link setState}. With
+   * {@link EntityConfig.deepFreezeState} enabled, the ownership transfer
+   * widens to the whole graph: NESTED objects are frozen in place too.
+   */
+  constructor(id, initialState, config) {
+    if (id === null || id === void 0) {
+      throw new Error("Entity ID cannot be null or undefined");
+    }
+    this.id = id;
+    this._deepFreezeState = config?.deepFreezeState ?? false;
+    this._state = this.freezeState(shallowCopyOwned(initialState));
+    this.validateState(this._state);
+  }
+  /**
+   * Freezes a state value according to this entity's configured freeze
+   * mode: the default shallow freeze, or `deepFreeze` when
+   * {@link EntityConfig.deepFreezeState} was enabled at construction.
+   * Subclass code that assigns `this._state` directly (bypassing
+   * `setState`) must freeze through this method, not `freezeShallow`,
+   * or the opt-in silently degrades to shallow for that path.
+   */
+  freezeState(value) {
+    return this._deepFreezeState ? deepFreeze(value) : freezeShallow(value);
+  }
+  /**
+   * Optional validation hook to ensure state invariants. Called during
+   * construction (from `Entity`'s constructor) and again on every
+   * `setState()` call. Throw to reject invalid state.
+   *
+   * **⚠️ Must not read subclass instance fields via `this`.** The
+   * constructor calls `validateState(initialState)` BEFORE the subclass's
+   * field initializers run, so `this.someField` is `undefined` at that
+   * point, a classic TypeScript/JavaScript constructor-ordering footgun.
+   * The `state` argument is the single source of truth; treat the method
+   * as pure with respect to `this`.
+   *
+   * If your invariants genuinely depend on per-instance configuration
+   * that isn't part of the state, pass that configuration into the state
+   * itself (DDD-canonical: the aggregate's state contains everything it
+   * needs) or perform the additional check after construction in a
+   * dedicated factory method.
+   *
+   * @param state - The state to validate
+   * @throws Error (or `DomainError` subclass) if validation fails
+   */
+  validateState(_state) {
+  }
+  /**
+   * Sets the state of the entity.
+   * This is a convenience method for state mutations.
+   * Automatically validates the newState using `validateState()`.
+   *
+   * Plain-object and array states are shallow-copied before the freeze
+   * (the caller's object stays mutable); a class-instance state is an
+   * ownership transfer and is frozen in place; see the constructor.
+   *
+   * @param newState - The new state
+   */
+  setState(newState) {
+    this.validateState(newState);
+    this._state = this.freezeState(shallowCopyOwned(newState));
+  }
+};
+function freezeShallow(value) {
+  if (value !== null && typeof value === "object") {
+    return Object.freeze(value);
+  }
+  return value;
 }
 __name(freezeShallow, "freezeShallow");
 function shallowCopyOwned(value) {
@@ -1037,14 +1546,66 @@ var BaseAggregate = class extends Entity {
    *
    * The state is converted via {@link toSnapshotState}; the default
    * requires plain, serialisable data and fails fast otherwise.
+   *
+   * `snapshotAt` is read from the kit's swappable clock, the same one
+   * `createDomainEvent` stamps `occurredAt` from, so
+   * `setClockFactory` / `withClockFactory` pin snapshot timestamps in
+   * deterministic tests too. `schemaVersion` is stamped from
+   * {@link snapshotSchemaVersion} so a later restore can detect
+   * snapshots written against an older `TSnapshotState` shape.
    */
   createSnapshot() {
     return {
       state: this.toSnapshotState(this._state),
       version: this.version,
-      snapshotAt: /* @__PURE__ */ new Date()
+      snapshotAt: now(),
+      schemaVersion: this.snapshotSchemaVersion
     };
   }
+  /**
+   * Schema version of the shape {@link toSnapshotState} produces.
+   * Defaults to `1`. Bump it whenever `TSnapshotState` changes
+   * incompatibly (renamed or removed fields, changed representations):
+   * `createSnapshot` stamps it onto every snapshot, and the restore
+   * paths compare it, so an outdated stored snapshot surfaces as a
+   * `SnapshotSchemaMismatchError` at restore time (or is upgraded via
+   * {@link migrateSnapshotState}) instead of crashing on the first
+   * method call much later.
+   */
+  snapshotSchemaVersion = 1;
+  /**
+   * Resolves a stored snapshot's state against the aggregate's current
+   * snapshot schema: pass-through when the versions match (a missing
+   * `schemaVersion` counts as `1`, the pre-versioning era), otherwise
+   * routed through {@link migrateSnapshotState}. Called by both restore
+   * paths BEFORE anything is assigned, so a rejected snapshot leaves
+   * the aggregate untouched.
+   */
+  resolveSnapshotState(snapshot) {
+    const storedSchemaVersion = snapshot.schemaVersion ?? 1;
+    if (storedSchemaVersion === this.snapshotSchemaVersion) {
+      return snapshot.state;
+    }
+    return this.migrateSnapshotState(snapshot.state, storedSchemaVersion);
+  }
+  /**
+   * Upgrade hook for snapshots written against an older
+   * `TSnapshotState` shape. Receives the stored state as `unknown`
+   * (its shape is, by definition, not the current `TSnapshotState`)
+   * plus the schema version it was written with, and returns the
+   * current shape. The default rejects with
+   * `SnapshotSchemaMismatchError`: discard-and-refold from the full
+   * event stream is the safe default strategy; override this only when
+   * upgrading in place is cheaper than refolding.
+   */
+  migrateSnapshotState(_stored, storedSchemaVersion) {
+    throw new SnapshotSchemaMismatchError({
+      aggregateType: this.aggregateType,
+      aggregateId: String(this.id),
+      expectedSchemaVersion: this.snapshotSchemaVersion,
+      actualSchemaVersion: storedSchemaVersion
+    });
+  }
   /**
    * Converts live aggregate state into the plain-data shape stored in a
    * snapshot. The default validates that the state graph is plain,
@@ -1213,7 +1774,7 @@ var AggregateRoot = class extends BaseAggregate {
    */
   _hasBaseline = false;
   constructor(id, initialState, config) {
-    super(id, initialState);
+    super(id, initialState, config);
     this._autoVersionBump = config?.autoVersionBump ?? false;
   }
   /**
@@ -1368,6 +1929,14 @@ var AggregateRoot = class extends BaseAggregate {
    * Sets the state and optionally bumps the version automatically.
    * Validates `newState` via `validateState()`.
    *
+   * **State the OCC intent explicitly.** With neither the per-call
+   * `bumpVersion` argument nor an `autoVersionBump` config, the version
+   * does not move, and an un-bumped mutation can be silently overwritten
+   * by a concurrent writer (see the {@link AggregateConfig.autoVersionBump}
+   * warning for the mechanics). Prefer `commit()` for domain mutations,
+   * or pass `bumpVersion` explicitly; relying on the implicit default is
+   * deprecated and v3 makes the argument required.
+   *
    * @param newState - The new state
    * @param bumpVersion - Whether to bump the version (defaults to autoVersionBump config)
    */
@@ -1386,9 +1955,9 @@ var AggregateRoot = class extends BaseAggregate {
    * @param snapshot - The snapshot to restore from
    */
   restoreFromSnapshot(snapshot) {
-    const restored = this.fromSnapshotState(snapshot.state);
+    const restored = this.fromSnapshotState(this.resolveSnapshotState(snapshot));
     this.validateState(restored);
-    this._state = freezeShallow(restored);
+    this._state = this.freezeState(restored);
     this.markRestored(snapshot.version);
   }
 };
@@ -1419,153 +1988,37 @@ function computeChangedKeys(baseline, current) {
   return dirty;
 }
 __name(computeChangedKeys, "computeChangedKeys");
-var DomainError = class extends BaseError {
-  static {
-    __name(this, "DomainError");
-  }
-};
-var InfrastructureError = class extends BaseError {
-  static {
-    __name(this, "InfrastructureError");
-  }
-};
-var MissingHandlerError = class extends BaseError {
-  constructor(eventType, cause) {
-    super(`Missing handler for event type: ${eventType}`, cause, {
-      name: "MissingHandlerError"
-    });
-    this.eventType = eventType;
-  }
+var EventSourcedAggregate = class extends BaseAggregate {
   static {
-    __name(this, "MissingHandlerError");
+    __name(this, "EventSourcedAggregate");
   }
-};
-var EventHarvestError = class extends BaseError {
-  constructor(message, eventType) {
-    super(message, void 0, { name: "EventHarvestError" });
-    this.eventType = eventType;
+  /**
+   * Validates an event before it is applied. Default is no-op.
+   * Subclasses override to throw a concrete `DomainError` subclass when
+   * the event violates an invariant in the current state.
+   */
+  validateEvent(_event) {
   }
-  static {
-    __name(this, "EventHarvestError");
-  }
-};
-var UnenrolledChangesError = class extends BaseError {
-  constructor(aggregateId) {
-    super(
-      `Aggregate ${aggregateId} was loaded in this unit of work and has pending events, but was never enrolled (no save), so its events would be silently dropped. Call repository.save(aggregate), and ensure save() calls session.enrollSaved before the row write.`,
-      void 0,
-      { name: "UnenrolledChangesError" }
-    );
-    this.aggregateId = aggregateId;
-  }
-  static {
-    __name(this, "UnenrolledChangesError");
-  }
-};
-var AggregateDeletedError = class extends BaseError {
-  constructor(aggregateId) {
-    super(
-      `Aggregate ${aggregateId} was deleted in this unit of work and cannot be saved or registered again. Deletion is final within an operation; if the aggregate must live, do not delete it.`,
-      void 0,
-      { name: "AggregateDeletedError" }
-    );
-    this.aggregateId = aggregateId;
-  }
-  static {
-    __name(this, "AggregateDeletedError");
-  }
-};
-var AggregateNotFoundError = class extends InfrastructureError {
-  static {
-    __name(this, "AggregateNotFoundError");
-  }
-  aggregateType;
-  id;
-  constructor(options) {
-    super(
-      `Aggregate not found: ${options.aggregateType}(${options.id})`,
-      options.cause,
-      { name: "AggregateNotFoundError" }
-    );
-    this.aggregateType = options.aggregateType;
-    this.id = options.id;
-  }
-};
-var DuplicateAggregateError = class extends InfrastructureError {
-  static {
-    __name(this, "DuplicateAggregateError");
-  }
-  aggregateType;
-  aggregateId;
-  constructor(options) {
-    super(
-      `Duplicate aggregate: ${options.aggregateType}(${options.aggregateId}) already exists`,
-      options.cause,
-      { name: "DuplicateAggregateError" }
-    );
-    this.aggregateType = options.aggregateType;
-    this.aggregateId = options.aggregateId;
-  }
-};
-var ConcurrencyConflictError = class extends InfrastructureError {
-  static {
-    __name(this, "ConcurrencyConflictError");
-  }
-  /**
-   * Marks this error as retryable so `isRetryable(err)` returns
-   * true. The canonical OCC pattern is to reload the aggregate, re-apply
-   * the use case, and retry on this exception.
-   */
-  retryable = true;
-  aggregateType;
-  aggregateId;
-  expectedVersion;
-  actualVersion;
-  constructor(options) {
-    super(
-      `Concurrency conflict on ${options.aggregateType}(${options.aggregateId}): expected version ${options.expectedVersion}, actual ${options.actualVersion}`,
-      options.cause,
-      { name: "ConcurrencyConflictError" }
-    );
-    this.aggregateType = options.aggregateType;
-    this.aggregateId = options.aggregateId;
-    this.expectedVersion = options.expectedVersion;
-    this.actualVersion = options.actualVersion;
-  }
-};
-
-// src/aggregate/event-sourced-aggregate.ts
-var EventSourcedAggregate = class extends BaseAggregate {
-  static {
-    __name(this, "EventSourcedAggregate");
-  }
-  /**
-   * Validates an event before it is applied. Default is no-op.
-   * Subclasses override to throw a concrete `DomainError` subclass when
-   * the event violates an invariant in the current state.
-   */
-  validateEvent(_event) {
-  }
-  /**
-   * Applies an event: validates, locates the handler, computes the next
-   * state, then commits state + pending event + version bump atomically.
-   *
-   * Throws `DomainError` (or a subclass) on validation failure.
-   * Throws `MissingHandlerError` if no handler is registered for `event.type`.
-   *
-   * State is not mutated if any step throws: the handler is invoked into
-   * a local and only assigned to `_state` once all checks pass.
-   *
-   * The method is generic in the event tag `K`, so concrete callers
-   * (`this.apply(orderCreated)`) narrow to the literal tag and the
-   * dispatched handler is typed as `Handler<TState, Extract<TEvent, { type: K }>>`,
-   * with no `as` cast required at the call site.
-   *
-   * @param event - The domain event to apply
-   * @param isNew - Whether the event is new (needs persisting) or replayed from history
-   */
-  apply(event, isNew = true) {
-    this.dispatchAndCommit(event, isNew);
+  /**
+   * Applies an event: validates, locates the handler, computes the next
+   * state, then commits state + pending event + version bump atomically.
+   *
+   * Throws `DomainError` (or a subclass) on validation failure.
+   * Throws `MissingHandlerError` if no handler is registered for `event.type`.
+   *
+   * State is not mutated if any step throws: the handler is invoked into
+   * a local and only assigned to `_state` once all checks pass.
+   *
+   * The method is generic in the event tag `K`, so concrete callers
+   * (`this.apply(orderCreated)`) narrow to the literal tag and the
+   * dispatched handler is typed as `Handler<TState, Extract<TEvent, { type: K }>>`,
+   * with no `as` cast required at the call site.
+   *
+   * @param event - The domain event to apply
+   * @param isNew - Whether the event is new (needs persisting) or replayed from history
+   */
+  apply(event, isNew = true) {
+    this.dispatchAndCommit(event, isNew);
   }
   /**
    * Internal dispatch path used by `apply()` and the replay methods
@@ -1581,7 +2034,7 @@ var EventSourcedAggregate = class extends BaseAggregate {
       throw new MissingHandlerError(event.type);
     }
     const nextState = handler(this._state, event);
-    this._state = freezeShallow(nextState);
+    this._state = this.freezeState(nextState);
     if (isNew) {
       this.addDomainEvent(event);
       this.bumpVersion();
@@ -1600,11 +2053,24 @@ var EventSourcedAggregate = class extends BaseAggregate {
    * which never bumps it; only the final `markRestored` advances it.)
    *
    * Version advances additively: the aggregate's pre-existing version plus
-   * `history.length`. A fresh aggregate (v=0) loading 3 events ends at v=3;
-   * an aggregate already at v=1 (e.g. after a creation event) loading
-   * 2 events ends at v=3, not v=2.
+   * `history.length`. A fresh aggregate (v=0) loading 3 events ends at
+   * v=3; a PERSISTED aggregate at v=P (`persistedVersion === P`) catching
+   * up on M newer events ends at v=P+M.
+   *
+   * **The replay target must be fresh or persisted.** An aggregate with
+   * unflushed `pendingEvents`, or with an in-memory version that was
+   * never persisted (a factory-created instance), throws
+   * {@link UnreplayableAggregateError} BEFORE anything moves: replaying
+   * onto it would `markRestored` a `persistedVersion` that counts
+   * unpersisted history, flipping repository routing from INSERT to
+   * UPDATE (or appending with a wrong expected version). The throw is
+   * deliberate (crash-loud programming bug), never a `Result` `Err`, and
+   * runs before the empty-history fast path so the misuse is caught
+   * deterministically rather than only when the stream happens to be
+   * non-empty.
    */
   loadFromHistory(history) {
+    this.assertReplayTargetFresh(true);
     if (history.length === 0) return ok();
     const previousState = this._state;
     const startVersion = this.version;
@@ -1629,11 +2095,29 @@ var EventSourcedAggregate = class extends BaseAggregate {
    * All-or-nothing: if any event mid-stream throws a `DomainError`, the
    * aggregate is rolled back to its pre-call state + version. Partial
    * restoration is never observable to the caller.
+   *
+   * **The restore target must not carry pending events.** Events recorded
+   * before the restore are unrelated to the restored stream; harvesting
+   * them after `markRestored` would emit them with a version baseline
+   * they were never part of. Such a target throws
+   * {@link UnreplayableAggregateError} before anything moves (crash-loud
+   * programming bug, never a `Result` `Err`). Unlike `loadFromHistory`,
+   * a never-persisted in-memory version is fine here: the snapshot
+   * overwrites state and version entirely instead of adding to them.
    */
   restoreFromSnapshotWithEvents(snapshot, eventsAfterSnapshot) {
+    this.assertReplayTargetFresh(false);
     const previousState = this._state;
     const previousVersion = this.version;
-    this._state = freezeShallow(this.fromSnapshotState(snapshot.state));
+    let restored;
+    try {
+      restored = this.fromSnapshotState(this.resolveSnapshotState(snapshot));
+      this.validateState(restored);
+    } catch (e) {
+      if (e instanceof DomainError) return err(e);
+      throw e;
+    }
+    this._state = this.freezeState(restored);
     this.setVersion(snapshot.version);
     for (const event of eventsAfterSnapshot) {
       try {
@@ -1650,6 +2134,29 @@ var EventSourcedAggregate = class extends BaseAggregate {
     );
     return ok();
   }
+  /**
+   * Replay-target freshness guard shared by `loadFromHistory` and
+   * `restoreFromSnapshotWithEvents`. See {@link UnreplayableAggregateError}
+   * for the desync both conditions prevent. `checkUnpersistedVersion` is
+   * `true` for the additive `loadFromHistory` path only: the snapshot
+   * restore overwrites version wholesale, so a never-persisted in-memory
+   * version is harmless there.
+   */
+  assertReplayTargetFresh(checkUnpersistedVersion) {
+    const pending = this.pendingEvents.length;
+    if (pending > 0) {
+      throw new UnreplayableAggregateError(
+        String(this.id),
+        `it carries ${pending} unflushed pending event(s) that are not part of the persisted stream`
+      );
+    }
+    if (checkUnpersistedVersion && this.version > 0 && this.persistedVersion === void 0) {
+      throw new UnreplayableAggregateError(
+        String(this.id),
+        `its in-memory version (${this.version}) was never persisted (persistedVersion is undefined), so additive replay would mark unpersisted history as persisted`
+      );
+    }
+  }
 };
 
 // src/app/describe-thrown.ts
@@ -1687,7 +2194,10 @@ var CommandBus = class {
     if (!handler) {
       return err(
         this.errorMapper(
-          new Error(`No handler registered for command type: ${command.type}`)
+          new UnregisteredHandlerError({
+            busKind: "command",
+            messageType: command.type
+          })
         )
       );
     }
@@ -1705,6 +2215,21 @@ function abortReason(signal, fallbackMessage) {
 }
 __name(abortReason, "abortReason");
 
+// src/utils/observer.ts
+function reportToObserver(invoke) {
+  let result;
+  try {
+    result = invoke();
+  } catch {
+    return;
+  }
+  if (result !== null && typeof result === "object" && typeof result.then === "function") {
+    result.then(void 0, () => {
+    });
+  }
+}
+__name(reportToObserver, "reportToObserver");
+
 // src/app/handler.ts
 async function withCommit(deps, fn) {
   if (deps.signal?.aborted) {
@@ -1763,22 +2288,67 @@ async function withCommit(deps, fn) {
       } else {
         agg.markPersisted(agg.version);
       }
-    } catch {
+    } catch (error) {
+      reportToObserver(() => deps.onPersistError?.(error, agg));
     }
   }
   if (deps.bus && events.length > 0) {
     try {
       await deps.bus.publish(events);
     } catch (error) {
-      try {
-        deps.onPublishError?.(error, events);
-      } catch {
-      }
+      reportToObserver(() => deps.onPublishError?.(error, events));
     }
   }
   return result;
 }
 __name(withCommit, "withCommit");
+var QueryBus = class {
+  static {
+    __name(this, "QueryBus");
+  }
+  handlers = /* @__PURE__ */ new Map();
+  errorMapper;
+  constructor(...args) {
+    this.errorMapper = args[0]?.errorMapper ?? describeThrown;
+  }
+  register(queryType, handler) {
+    if (this.handlers.has(queryType)) {
+      throw new Error(
+        `QueryBus: a handler for query type "${queryType}" is already registered`
+      );
+    }
+    this.handlers.set(queryType, (query) => handler(query));
+  }
+  async execute(query) {
+    const handler = this.handlers.get(query.type);
+    if (!handler) {
+      return err(
+        this.errorMapper(
+          new UnregisteredHandlerError({
+            busKind: "query",
+            messageType: query.type
+          })
+        )
+      );
+    }
+    try {
+      const result = await handler(query);
+      return ok(result);
+    } catch (error) {
+      return err(this.errorMapper(error));
+    }
+  }
+  async executeUnsafe(query) {
+    const handler = this.handlers.get(query.type);
+    if (!handler) {
+      throw new UnregisteredHandlerError({
+        busKind: "query",
+        messageType: query.type
+      });
+    }
+    return await handler(query);
+  }
+};
 
 // src/repo/identity-map.ts
 var IdentityMap = class {
@@ -1983,6 +2553,7 @@ var UnitOfWork = class {
           bus: this.deps.bus,
           scope: this.deps.scope,
           onPublishError: this.deps.onPublishError,
+          onPersistError: this.deps.onPersistError,
           signal: options?.signal
         },
         async (tx) => {
@@ -2010,20 +2581,11 @@ var UnitOfWork = class {
         }
       );
     } catch (error) {
-      if (workThrew) {
-        if (error === workError || causeChainContains(error, workError)) {
-          throw error;
-        }
-        throw new RollbackError(workError, error);
-      }
-      if (workCompleted) {
-        const harvestError = findHarvestErrorInChain(error);
-        if (harvestError) {
-          throw harvestError;
-        }
-        throw new CommitError(error);
-      }
-      throw error;
+      throw classifyRunError(error, {
+        workThrew,
+        workCompleted,
+        workError
+      });
     } finally {
       session?.close();
       this._active = false;
@@ -2121,6 +2683,23 @@ function makeContext(repositories, transaction, session, signal) {
   };
 }
 __name(makeContext, "makeContext");
+function classifyRunError(error, state) {
+  if (state.workThrew) {
+    if (error === state.workError || causeChainContains(error, state.workError)) {
+      return error;
+    }
+    return new RollbackError(state.workError, error);
+  }
+  if (state.workCompleted) {
+    const harvestError = findHarvestErrorInChain(error);
+    if (harvestError) {
+      return harvestError;
+    }
+    return new CommitError(error);
+  }
+  return error;
+}
+__name(classifyRunError, "classifyRunError");
 function findHarvestErrorInChain(error) {
   const seen = /* @__PURE__ */ new Set();
   let current = error;
@@ -2162,82 +2741,1057 @@ function causeChainContains(error, target) {
   return false;
 }
 __name(causeChainContains, "causeChainContains");
-var QueryBus = class {
+var InvalidDomainTransitionError = class extends DomainError {
+  constructor(state, inputType) {
+    super(`No domain transition from "${state}" on "${inputType}".`);
+    this.state = state;
+    this.inputType = inputType;
+  }
   static {
-    __name(this, "QueryBus");
+    __name(this, "InvalidDomainTransitionError");
   }
-  handlers = /* @__PURE__ */ new Map();
-  errorMapper;
-  constructor(...args) {
-    this.errorMapper = args[0]?.errorMapper ?? describeThrown;
+};
+var DomainTransitionGuardRejectedError = class extends DomainError {
+  constructor(state, inputType) {
+    super(`Domain transition guard rejected "${inputType}" from "${state}".`);
+    this.state = state;
+    this.inputType = inputType;
   }
-  register(queryType, handler) {
-    if (this.handlers.has(queryType)) {
-      throw new Error(
-        `QueryBus: a handler for query type "${queryType}" is already registered`
-      );
-    }
-    this.handlers.set(queryType, (query) => handler(query));
+  static {
+    __name(this, "DomainTransitionGuardRejectedError");
   }
-  async execute(query) {
-    const handler = this.handlers.get(query.type);
-    if (!handler) {
-      return err(
-        this.errorMapper(
-          new Error(`No handler registered for query type: ${query.type}`)
-        )
-      );
-    }
-    try {
-      const result = await handler(query);
-      return ok(result);
-    } catch (error) {
-      return err(this.errorMapper(error));
-    }
+};
+var InvalidDomainMachineDefinitionError = class extends BaseError {
+  static {
+    __name(this, "InvalidDomainMachineDefinitionError");
   }
-  async executeUnsafe(query) {
-    const handler = this.handlers.get(query.type);
-    if (!handler) {
-      throw new Error(`No handler registered for query type: ${query.type}`);
-    }
-    return await handler(query);
+  constructor(message, cause) {
+    super(message, cause, { name: "InvalidDomainMachineDefinitionError" });
   }
 };
-
-// src/events/event-bus.ts
-var EventBusImpl = class {
+var InvalidDomainMachineContextError = class extends BaseError {
   static {
-    __name(this, "EventBusImpl");
+    __name(this, "InvalidDomainMachineContextError");
   }
-  handlers = /* @__PURE__ */ new Map();
-  subscribe(eventType, handler) {
-    const type = eventType;
-    if (!this.handlers.has(type)) {
-      this.handlers.set(type, []);
-    }
-    const handlersForType = this.handlers.get(type);
-    const casted = handler;
-    handlersForType.push(casted);
-    let removed = false;
-    return () => {
-      if (removed) return;
-      const idx = handlersForType.indexOf(casted);
-      if (idx !== -1) {
-        handlersForType.splice(idx, 1);
-        removed = true;
-      }
-      if (handlersForType.length === 0) {
-        this.handlers.delete(type);
-      }
-    };
+  constructor(message, cause) {
+    super(message, cause, { name: "InvalidDomainMachineContextError" });
   }
-  once(eventType, options) {
-    return new Promise((resolve, reject) => {
-      if (options?.signal?.aborted) {
-        reject(abortReason(options.signal, "EventBus.once aborted"));
-        return;
-      }
-      let timer;
+};
+var InvalidDomainMachineSnapshotError = class extends BaseError {
+  static {
+    __name(this, "InvalidDomainMachineSnapshotError");
+  }
+  constructor(message, cause) {
+    super(message, cause, { name: "InvalidDomainMachineSnapshotError" });
+  }
+};
+var InvalidDomainMachineInputError = class extends BaseError {
+  static {
+    __name(this, "InvalidDomainMachineInputError");
+  }
+  constructor(message, cause) {
+    super(message, cause, { name: "InvalidDomainMachineInputError" });
+  }
+};
+var InvalidDomainTransitionGuardResultError = class extends BaseError {
+  static {
+    __name(this, "InvalidDomainTransitionGuardResultError");
+  }
+  constructor(message, cause) {
+    super(message, cause, { name: "InvalidDomainTransitionGuardResultError" });
+  }
+};
+var InvalidDomainTransitionResultError = class extends BaseError {
+  static {
+    __name(this, "InvalidDomainTransitionResultError");
+  }
+  constructor(message, cause) {
+    super(message, cause, { name: "InvalidDomainTransitionResultError" });
+  }
+};
+var ReentrantDomainStateMachineEvaluationError = class extends BaseError {
+  static {
+    __name(this, "ReentrantDomainStateMachineEvaluationError");
+  }
+  constructor() {
+    super(
+      "Domain state machine callbacks cannot evaluate the same machine.",
+      void 0,
+      { name: "ReentrantDomainStateMachineEvaluationError" }
+    );
+  }
+};
+
+// src/domain-state-machine/machine-data.ts
+var DOMAIN_MACHINE_DATA_MAX_DEPTH = 256;
+var DOMAIN_MACHINE_DATA_MAX_NODES = 1e4;
+var DOMAIN_MACHINE_DATA_MAX_PROPERTIES = 1e5;
+function copyDomainMachineOutputs(outputs) {
+  try {
+    const copiedOutputs = cloneDomainMachineDataValue(
+      outputs ?? [],
+      createDomainTransitionOutputError
+    );
+    return deepFreeze(
+      copiedOutputs
+    );
+  } catch (cause) {
+    if (cause instanceof InvalidDomainTransitionResultError) {
+      throw cause;
+    }
+    throw new InvalidDomainTransitionResultError(
+      "Domain transition result outputs must contain cloneable, deeply immutable data.",
+      cause
+    );
+  }
+}
+__name(copyDomainMachineOutputs, "copyDomainMachineOutputs");
+function copyDomainMachineInput(input) {
+  try {
+    return deepFreeze(
+      cloneDomainMachineDataValue(input, createDomainMachineInputError)
+    );
+  } catch (cause) {
+    if (cause instanceof InvalidDomainMachineInputError) {
+      throw cause;
+    }
+    throw new InvalidDomainMachineInputError(
+      "Domain machine input must contain cloneable, deeply immutable data.",
+      cause
+    );
+  }
+}
+__name(copyDomainMachineInput, "copyDomainMachineInput");
+function copyDomainMachineContext(context) {
+  try {
+    return deepFreeze(
+      cloneDomainMachineDataValue(context, createDomainMachineContextError)
+    );
+  } catch (cause) {
+    if (cause instanceof InvalidDomainMachineContextError) {
+      throw cause;
+    }
+    throw new InvalidDomainMachineContextError(
+      "Domain machine context must contain cloneable, deeply immutable data.",
+      cause
+    );
+  }
+}
+__name(copyDomainMachineContext, "copyDomainMachineContext");
+function createDomainMachineContextError(message, cause) {
+  return new InvalidDomainMachineContextError(message, cause);
+}
+__name(createDomainMachineContextError, "createDomainMachineContextError");
+function createDomainMachineInputError(message, cause) {
+  return new InvalidDomainMachineInputError(message, cause);
+}
+__name(createDomainMachineInputError, "createDomainMachineInputError");
+function createDomainTransitionOutputError(message, cause) {
+  return new InvalidDomainTransitionResultError(message, cause);
+}
+__name(createDomainTransitionOutputError, "createDomainTransitionOutputError");
+function cloneDomainMachineDataValue(value, errorFactory, seen = /* @__PURE__ */ new WeakMap(), traversal = { nodes: 0, properties: 0 }, depth = 0) {
+  if (typeof value === "function") {
+    throw errorFactory("Domain machine data cannot contain function values.");
+  }
+  if (value === null || typeof value !== "object") return value;
+  const source = value;
+  if (depth > DOMAIN_MACHINE_DATA_MAX_DEPTH) {
+    throw errorFactory(
+      `Domain machine data exceeds the maximum depth of ${DOMAIN_MACHINE_DATA_MAX_DEPTH}.`
+    );
+  }
+  const existing = seen.get(source);
+  if (existing !== void 0) return existing;
+  traversal.nodes += 1;
+  if (traversal.nodes > DOMAIN_MACHINE_DATA_MAX_NODES) {
+    throw errorFactory(
+      `Domain machine data contains more than ${DOMAIN_MACHINE_DATA_MAX_NODES.toLocaleString("en-US")} object nodes.`
+    );
+  }
+  const toStringTagDescriptor = findPropertyDescriptor(
+    source,
+    Symbol.toStringTag
+  );
+  if (toStringTagDescriptor !== void 0 && !("value" in toStringTagDescriptor)) {
+    throw errorFactory(
+      "Domain machine data cannot contain accessor properties."
+    );
+  }
+  if (Array.isArray(value)) {
+    if (!isIntrinsicArrayPrototype(Object.getPrototypeOf(value))) {
+      throw errorFactory(
+        "Domain machine data cannot contain custom Array instances."
+      );
+    }
+    const cloned2 = new Array(value.length);
+    seen.set(source, cloned2);
+    for (const key of readDomainMachineDataKeys(
+      source,
+      errorFactory,
+      traversal
+    )) {
+      const descriptor = Object.getOwnPropertyDescriptor(source, key);
+      if (!descriptor) continue;
+      if (!("value" in descriptor)) {
+        throw errorFactory(
+          "Domain machine data cannot contain accessor properties."
+        );
+      }
+      if (key === "length") continue;
+      descriptor.value = cloneDomainMachineDataValue(
+        descriptor.value,
+        errorFactory,
+        seen,
+        traversal,
+        depth + 1
+      );
+      Object.defineProperty(cloned2, key, descriptor);
+    }
+    return cloned2;
+  }
+  const prototype = Object.getPrototypeOf(source);
+  if (prototype !== null && !isIntrinsicObjectPrototype(prototype)) {
+    throw errorFactory(
+      "Domain machine data cannot contain custom class instances."
+    );
+  }
+  const tag = Object.prototype.toString.call(source);
+  if (isBuiltInObject(source, tag) || ArrayBuffer.isView(source)) {
+    throw errorFactory(
+      `Domain machine data cannot contain ${tag.slice(8, -1)} object values.`
+    );
+  }
+  const cloned = Object.create(prototype === null ? null : Object.prototype);
+  seen.set(source, cloned);
+  for (const key of readDomainMachineDataKeys(
+    source,
+    errorFactory,
+    traversal
+  )) {
+    const descriptor = Object.getOwnPropertyDescriptor(source, key);
+    if (!descriptor) continue;
+    if (!("value" in descriptor)) {
+      throw errorFactory(
+        "Domain machine data cannot contain accessor properties."
+      );
+    }
+    descriptor.value = cloneDomainMachineDataValue(
+      descriptor.value,
+      errorFactory,
+      seen,
+      traversal,
+      depth + 1
+    );
+    Object.defineProperty(cloned, key, descriptor);
+  }
+  return cloned;
+}
+__name(cloneDomainMachineDataValue, "cloneDomainMachineDataValue");
+function readDomainMachineDataKeys(value, errorFactory, traversal) {
+  const keys = Reflect.ownKeys(value);
+  traversal.properties += keys.length;
+  if (traversal.properties > DOMAIN_MACHINE_DATA_MAX_PROPERTIES) {
+    throw errorFactory(
+      `Domain machine data contains more than ${DOMAIN_MACHINE_DATA_MAX_PROPERTIES.toLocaleString("en-US")} own properties.`
+    );
+  }
+  return keys;
+}
+__name(readDomainMachineDataKeys, "readDomainMachineDataKeys");
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
+function isPlainRecord(value) {
+  if (!isRecord(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === null || isIntrinsicObjectPrototype(prototype);
+}
+__name(isPlainRecord, "isPlainRecord");
+function isIntrinsicArrayPrototype(prototype) {
+  if (prototype === null || !Array.isArray(prototype)) return false;
+  if (!isIntrinsicConstructorPrototype(prototype, "Array")) return false;
+  const parentPrototype = Object.getPrototypeOf(prototype);
+  return parentPrototype !== null && isIntrinsicObjectPrototype(parentPrototype);
+}
+__name(isIntrinsicArrayPrototype, "isIntrinsicArrayPrototype");
+function isIntrinsicObjectPrototype(prototype) {
+  return Object.getPrototypeOf(prototype) === null && isIntrinsicConstructorPrototype(prototype, "Object");
+}
+__name(isIntrinsicObjectPrototype, "isIntrinsicObjectPrototype");
+function hasOwn(value, key) {
+  return Object.hasOwn(value, key);
+}
+__name(hasOwn, "hasOwn");
+
+// src/domain-state-machine/definition.ts
+var DOMAIN_MACHINE_DEFINITION_KEYS = /* @__PURE__ */ new Set([
+  "initial",
+  "initialContext",
+  "validateSnapshot",
+  "states"
+]);
+var DOMAIN_MACHINE_STATE_NODE_KEYS = /* @__PURE__ */ new Set([
+  "terminal",
+  "validateContext",
+  "on"
+]);
+var DOMAIN_MACHINE_TRANSITION_KEYS = /* @__PURE__ */ new Set([
+  "target",
+  "guard",
+  "reduce"
+]);
+function copyDomainMachineDefinition(definition) {
+  const states = readDomainMachineDefinitionProperty(
+    definition,
+    "states"
+  );
+  const copiedStates = /* @__PURE__ */ Object.create(null);
+  for (const state of Object.keys(states)) {
+    const node = readDomainMachineDefinitionProperty(
+      states,
+      state
+    );
+    const transitions = readOptionalDomainMachineDefinitionProperty(
+      node,
+      "on"
+    );
+    const copiedTransitions = /* @__PURE__ */ Object.create(null);
+    for (const inputType of Object.keys(
+      transitions ?? {}
+    )) {
+      const transition = readDomainMachineDefinitionProperty(
+        transitions,
+        inputType
+      );
+      if (transition) {
+        const copiedTransition = Object.freeze({
+          target: readDomainMachineDefinitionProperty(transition, "target"),
+          guard: readOptionalDomainMachineDefinitionProperty(
+            transition,
+            "guard"
+          ),
+          reduce: readOptionalDomainMachineDefinitionProperty(
+            transition,
+            "reduce"
+          )
+        });
+        Object.defineProperty(copiedTransitions, inputType, {
+          value: copiedTransition,
+          enumerable: true
+        });
+      }
+    }
+    Object.defineProperty(copiedStates, state, {
+      value: Object.freeze({
+        terminal: readOptionalDomainMachineDefinitionProperty(node, "terminal"),
+        validateContext: readOptionalDomainMachineDefinitionProperty(
+          node,
+          "validateContext"
+        ),
+        on: Object.freeze(copiedTransitions)
+      }),
+      enumerable: true
+    });
+  }
+  return Object.freeze({
+    initial: readDomainMachineDefinitionProperty(
+      definition,
+      "initial"
+    ),
+    initialContext: readDomainMachineDefinitionProperty(
+      definition,
+      "initialContext"
+    ),
+    validateSnapshot: readOptionalDomainMachineDefinitionProperty(
+      definition,
+      "validateSnapshot"
+    ),
+    states: Object.freeze(copiedStates)
+  });
+}
+__name(copyDomainMachineDefinition, "copyDomainMachineDefinition");
+var preparedDefinitions = /* @__PURE__ */ new WeakSet();
+function ensureStableDomainMachineDefinition(definition) {
+  if (preparedDefinitions.has(definition)) return definition;
+  validateDomainMachineDefinition(definition);
+  return copyDomainMachineDefinition(definition);
+}
+__name(ensureStableDomainMachineDefinition, "ensureStableDomainMachineDefinition");
+function prepareDomainMachineDefinition(definition) {
+  const stable = ensureStableDomainMachineDefinition(definition);
+  preparedDefinitions.add(stable);
+  return stable;
+}
+__name(prepareDomainMachineDefinition, "prepareDomainMachineDefinition");
+function getTransition(definition, state, input) {
+  const transitions = definition.states[state].on;
+  if (!transitions || !hasOwn(transitions, input.type)) return void 0;
+  return transitions[input.type];
+}
+__name(getTransition, "getTransition");
+function validateDomainMachineDefinition(definition) {
+  const candidate = definition;
+  if (!isPlainRecord(candidate)) {
+    throw new InvalidDomainMachineDefinitionError(
+      "Domain machine definition must be a plain object."
+    );
+  }
+  assertDomainMachineDefinitionDataProperties(
+    candidate,
+    DOMAIN_MACHINE_DEFINITION_KEYS
+  );
+  const initial = readDomainMachineDefinitionProperty(candidate, "initial");
+  if (typeof initial !== "string") {
+    throw new InvalidDomainMachineDefinitionError(
+      "Domain machine initial state must be a string data property."
+    );
+  }
+  if (typeof readDomainMachineDefinitionProperty(candidate, "initialContext") !== "function") {
+    throw new InvalidDomainMachineDefinitionError(
+      "Domain machine initialContext must be a function data property."
+    );
+  }
+  const validateSnapshot = readOptionalDomainMachineDefinitionProperty(
+    candidate,
+    "validateSnapshot"
+  );
+  if (validateSnapshot !== void 0 && typeof validateSnapshot !== "function") {
+    throw new InvalidDomainMachineDefinitionError(
+      "Domain machine validateSnapshot must be a function data property."
+    );
+  }
+  const statesCandidate = readDomainMachineDefinitionProperty(
+    candidate,
+    "states"
+  );
+  if (!isPlainRecord(statesCandidate)) {
+    throw new InvalidDomainMachineDefinitionError(
+      "Domain machine states must be a plain object data property."
+    );
+  }
+  const states = statesCandidate;
+  assertDomainMachineDefinitionEntryMap(states, "state");
+  if (!hasOwn(states, initial)) {
+    throw new InvalidDomainMachineDefinitionError(
+      `Initial domain machine state "${initial}" is not defined.`
+    );
+  }
+  for (const state of Object.keys(states)) {
+    const node = readDomainMachineDefinitionProperty(states, state);
+    if (!isPlainRecord(node)) {
+      throw new InvalidDomainMachineDefinitionError(
+        `Domain machine state "${state}" must be a plain object data property.`
+      );
+    }
+    assertDomainMachineDefinitionDataProperties(
+      node,
+      DOMAIN_MACHINE_STATE_NODE_KEYS
+    );
+    const terminal = readOptionalDomainMachineDefinitionProperty(
+      node,
+      "terminal"
+    );
+    if (terminal !== void 0 && typeof terminal !== "boolean") {
+      throw new InvalidDomainMachineDefinitionError(
+        `Domain machine state "${state}" terminal flag must be a boolean.`
+      );
+    }
+    const validateContext = readOptionalDomainMachineDefinitionProperty(node, "validateContext");
+    if (validateContext !== void 0 && typeof validateContext !== "function") {
+      throw new InvalidDomainMachineDefinitionError(
+        `Domain machine state "${state}" validateContext must be a function.`
+      );
+    }
+    const transitions = readOptionalDomainMachineDefinitionProperty(
+      node,
+      "on"
+    );
+    if (transitions !== void 0 && !isPlainRecord(transitions)) {
+      throw new InvalidDomainMachineDefinitionError(
+        `Domain machine state "${state}" transitions must be a plain object.`
+      );
+    }
+    if (isPlainRecord(transitions)) {
+      assertDomainMachineDefinitionEntryMap(transitions, "input");
+    }
+    const inputTypes = Object.keys(transitions ?? {});
+    if (terminal === true && inputTypes.length > 0) {
+      throw new InvalidDomainMachineDefinitionError(
+        `Terminal domain machine state "${state}" cannot declare transitions.`
+      );
+    }
+    for (const inputType of inputTypes) {
+      const transition = readDomainMachineDefinitionProperty(
+        transitions,
+        inputType
+      );
+      if (!isPlainRecord(transition)) {
+        throw new InvalidDomainMachineDefinitionError(
+          `Domain transition from "${state}" on "${inputType}" must be a plain object.`
+        );
+      }
+      assertDomainMachineDefinitionDataProperties(
+        transition,
+        DOMAIN_MACHINE_TRANSITION_KEYS
+      );
+      const target = readDomainMachineDefinitionProperty(
+        transition,
+        "target"
+      );
+      if (typeof target !== "string") {
+        throw new InvalidDomainMachineDefinitionError(
+          `Domain transition from "${state}" on "${inputType}" must target a string state.`
+        );
+      }
+      if (!hasOwn(states, target)) {
+        throw new InvalidDomainMachineDefinitionError(
+          `Domain transition from "${state}" on "${inputType}" targets unknown state "${target}".`
+        );
+      }
+      const guard = readOptionalDomainMachineDefinitionProperty(
+        transition,
+        "guard"
+      );
+      if (guard !== void 0 && typeof guard !== "function") {
+        throw new InvalidDomainMachineDefinitionError(
+          `Domain transition from "${state}" on "${inputType}" guard must be a function.`
+        );
+      }
+      const reduce = readOptionalDomainMachineDefinitionProperty(
+        transition,
+        "reduce"
+      );
+      if (reduce !== void 0 && typeof reduce !== "function") {
+        throw new InvalidDomainMachineDefinitionError(
+          `Domain transition from "${state}" on "${inputType}" reduce must be a function.`
+        );
+      }
+    }
+  }
+}
+__name(validateDomainMachineDefinition, "validateDomainMachineDefinition");
+function assertDomainMachineDefinitionDataProperties(value, allowedKeys) {
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor !== void 0 && !("value" in descriptor)) {
+      throw new InvalidDomainMachineDefinitionError(
+        "Domain machine definition must contain data properties only."
+      );
+    }
+    if (allowedKeys !== void 0 && !allowedKeys.has(key)) {
+      throw new InvalidDomainMachineDefinitionError(
+        `Domain machine definition contains unknown property "${String(key)}".`
+      );
+    }
+  }
+}
+__name(assertDomainMachineDefinitionDataProperties, "assertDomainMachineDefinitionDataProperties");
+function assertDomainMachineDefinitionEntryMap(value, entryName) {
+  assertDomainMachineDefinitionDataProperties(value);
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (typeof key !== "string" || descriptor?.enumerable !== true) {
+      throw new InvalidDomainMachineDefinitionError(
+        `Domain machine ${entryName} names must be enumerable string properties.`
+      );
+    }
+  }
+}
+__name(assertDomainMachineDefinitionEntryMap, "assertDomainMachineDefinitionEntryMap");
+function readDomainMachineDefinitionProperty(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  if (descriptor === void 0 || !("value" in descriptor)) {
+    throw new InvalidDomainMachineDefinitionError(
+      "Domain machine definition must contain data properties only."
+    );
+  }
+  return descriptor.value;
+}
+__name(readDomainMachineDefinitionProperty, "readDomainMachineDefinitionProperty");
+function readOptionalDomainMachineDefinitionProperty(value, key) {
+  const descriptor = Object.getOwnPropertyDescriptor(value, key);
+  if (descriptor === void 0) return void 0;
+  if (!("value" in descriptor)) {
+    throw new InvalidDomainMachineDefinitionError(
+      "Domain machine definition must contain data properties only."
+    );
+  }
+  return descriptor.value;
+}
+__name(readOptionalDomainMachineDefinitionProperty, "readOptionalDomainMachineDefinitionProperty");
+
+// src/domain-state-machine/snapshot.ts
+var DOMAIN_TRANSITION_RESULT_KEYS = /* @__PURE__ */ new Set([
+  "context",
+  "outputs"
+]);
+function prepareDomainMachineSnapshot(definition, snapshot) {
+  validateDomainMachineSnapshot(definition, snapshot);
+  const preparedSnapshot = createDomainMachineSnapshot(
+    snapshot
+  );
+  validateDomainMachineSnapshotInvariant(definition, preparedSnapshot);
+  return preparedSnapshot;
+}
+__name(prepareDomainMachineSnapshot, "prepareDomainMachineSnapshot");
+function createDomainMachineSnapshotFromPreparedContext(state, context) {
+  return Object.freeze({ state, context });
+}
+__name(createDomainMachineSnapshotFromPreparedContext, "createDomainMachineSnapshotFromPreparedContext");
+function createDomainMachineSnapshot(snapshot) {
+  return Object.freeze({
+    state: readDomainMachineSnapshotState(snapshot),
+    context: copyDomainMachineContext(
+      readDomainMachineSnapshotContext(snapshot)
+    )
+  });
+}
+__name(createDomainMachineSnapshot, "createDomainMachineSnapshot");
+function validateDomainMachineSnapshot(definition, snapshot) {
+  if (!isRecord(snapshot)) {
+    throw new InvalidDomainMachineSnapshotError(
+      "Domain machine snapshot must be an object."
+    );
+  }
+  const state = readDomainMachineSnapshotState(snapshot);
+  readDomainMachineSnapshotContext(snapshot);
+  if (!hasOwn(definition.states, state)) {
+    throw new InvalidDomainMachineSnapshotError(
+      `Domain machine snapshot state "${state}" is not defined.`
+    );
+  }
+}
+__name(validateDomainMachineSnapshot, "validateDomainMachineSnapshot");
+function validateDomainMachineSnapshotInvariant(definition, snapshot) {
+  const stateNode = definition.states[snapshot.state];
+  if (stateNode.validateContext !== void 0) {
+    const validContext = stateNode.validateContext({
+      state: snapshot.state,
+      context: snapshot.context
+    });
+    if (typeof validContext !== "boolean") {
+      throw new InvalidDomainMachineDefinitionError(
+        `Domain machine state "${snapshot.state}" validateContext must return a boolean.`
+      );
+    }
+    if (!validContext) {
+      throw new InvalidDomainMachineSnapshotError(
+        `Domain machine snapshot violates the context invariant for state "${snapshot.state}".`
+      );
+    }
+  }
+  if (definition.validateSnapshot === void 0) return;
+  const valid = definition.validateSnapshot(snapshot);
+  if (typeof valid !== "boolean") {
+    throw new InvalidDomainMachineDefinitionError(
+      "Domain machine validateSnapshot must return a boolean."
+    );
+  }
+  if (!valid) {
+    throw new InvalidDomainMachineSnapshotError(
+      `Domain machine snapshot violates invariants for state "${snapshot.state}".`
+    );
+  }
+}
+__name(validateDomainMachineSnapshotInvariant, "validateDomainMachineSnapshotInvariant");
+function readDomainMachineSnapshotState(snapshot) {
+  const stateDescriptor = Object.getOwnPropertyDescriptor(snapshot, "state");
+  if (stateDescriptor === void 0 || !("value" in stateDescriptor) || typeof stateDescriptor.value !== "string") {
+    throw new InvalidDomainMachineSnapshotError(
+      "Domain machine snapshot state must be a string data property."
+    );
+  }
+  return stateDescriptor.value;
+}
+__name(readDomainMachineSnapshotState, "readDomainMachineSnapshotState");
+function readDomainMachineSnapshotContext(snapshot) {
+  const contextDescriptor = Object.getOwnPropertyDescriptor(
+    snapshot,
+    "context"
+  );
+  if (contextDescriptor === void 0 || !("value" in contextDescriptor)) {
+    throw new InvalidDomainMachineSnapshotError(
+      "Domain machine snapshot context must be present as a data property."
+    );
+  }
+  return contextDescriptor.value;
+}
+__name(readDomainMachineSnapshotContext, "readDomainMachineSnapshotContext");
+function validateDomainMachineInput(input) {
+  if (!isDomainMachineInput(input)) {
+    throw new InvalidDomainMachineInputError(
+      "Domain machine input must be an object with a string type."
+    );
+  }
+}
+__name(validateDomainMachineInput, "validateDomainMachineInput");
+function isDomainMachineInput(input) {
+  if (!isRecord(input)) return false;
+  const typeDescriptor = Object.getOwnPropertyDescriptor(input, "type");
+  return typeDescriptor !== void 0 && "value" in typeDescriptor && typeof typeDescriptor.value === "string";
+}
+__name(isDomainMachineInput, "isDomainMachineInput");
+function resolveDomainTransitionGuardResult(result) {
+  if (typeof result === "boolean") return { allowed: result };
+  if (result instanceof DomainError) {
+    return { allowed: false, rejection: result };
+  }
+  throw new InvalidDomainTransitionGuardResultError(
+    "Domain transition guard must return a boolean or DomainError."
+  );
+}
+__name(resolveDomainTransitionGuardResult, "resolveDomainTransitionGuardResult");
+function validateDomainTransitionResult(result) {
+  if (result === void 0) return;
+  if (!isPlainRecord(result)) {
+    throw new InvalidDomainTransitionResultError(
+      "Domain transition result must be a plain object when returned."
+    );
+  }
+  for (const key of Reflect.ownKeys(result)) {
+    if (!DOMAIN_TRANSITION_RESULT_KEYS.has(key)) {
+      throw new InvalidDomainTransitionResultError(
+        `Domain transition result contains unknown property "${String(key)}".`
+      );
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(result, key);
+    if (descriptor !== void 0 && !("value" in descriptor)) {
+      throw new InvalidDomainTransitionResultError(
+        "Domain transition result must contain data properties only."
+      );
+    }
+  }
+  const outputs = readDomainTransitionResultOutputs(result);
+  if (outputs !== void 0 && !Array.isArray(outputs)) {
+    throw new InvalidDomainTransitionResultError(
+      "Domain transition result outputs must be an array when provided."
+    );
+  }
+}
+__name(validateDomainTransitionResult, "validateDomainTransitionResult");
+function readDomainTransitionResultContext(result) {
+  if (result === void 0) return { hasContext: false };
+  const contextDescriptor = Object.getOwnPropertyDescriptor(result, "context");
+  if (contextDescriptor === void 0) return { hasContext: false };
+  if (!("value" in contextDescriptor)) {
+    throw new InvalidDomainTransitionResultError(
+      "Domain transition result context must be a data property when provided."
+    );
+  }
+  return { hasContext: true, context: contextDescriptor.value };
+}
+__name(readDomainTransitionResultContext, "readDomainTransitionResultContext");
+function readDomainTransitionResultOutputs(result) {
+  if (result === void 0) return void 0;
+  const outputsDescriptor = Object.getOwnPropertyDescriptor(result, "outputs");
+  if (outputsDescriptor === void 0) return void 0;
+  if (!("value" in outputsDescriptor)) {
+    throw new InvalidDomainTransitionResultError(
+      "Domain transition result outputs must be a data property when provided."
+    );
+  }
+  return outputsDescriptor.value;
+}
+__name(readDomainTransitionResultOutputs, "readDomainTransitionResultOutputs");
+
+// src/domain-state-machine/transition.ts
+function createInitialDomainMachineSnapshot(definition) {
+  const stableDefinition = ensureStableDomainMachineDefinition(definition);
+  return createInitialDomainMachineSnapshotFromPrepared(stableDefinition);
+}
+__name(createInitialDomainMachineSnapshot, "createInitialDomainMachineSnapshot");
+function createInitialDomainMachineSnapshotFromPrepared(definition) {
+  const snapshot = createDomainMachineSnapshot({
+    state: definition.initial,
+    context: definition.initialContext()
+  });
+  validateDomainMachineSnapshotInvariant(definition, snapshot);
+  return snapshot;
+}
+__name(createInitialDomainMachineSnapshotFromPrepared, "createInitialDomainMachineSnapshotFromPrepared");
+function canTransitionDomainState(definition, snapshot, input) {
+  const stableDefinition = ensureStableDomainMachineDefinition(definition);
+  const currentSnapshot = prepareDomainMachineSnapshot(
+    stableDefinition,
+    snapshot
+  );
+  return canTransitionPreparedDomainState(
+    stableDefinition,
+    currentSnapshot,
+    input
+  );
+}
+__name(canTransitionDomainState, "canTransitionDomainState");
+function canTransitionPreparedDomainState(definition, snapshot, input) {
+  if (!isDomainMachineInput(input)) return false;
+  const stateNode = definition.states[snapshot.state];
+  if (stateNode.terminal === true) return false;
+  const transition = getTransition(definition, snapshot.state, input);
+  if (!transition) return false;
+  const currentInput = copyDomainMachineInput(input);
+  if (!transition.guard) return true;
+  const guardResult = transition.guard({
+    state: snapshot.state,
+    context: snapshot.context,
+    input: currentInput
+  });
+  return resolveDomainTransitionGuardResult(guardResult).allowed;
+}
+__name(canTransitionPreparedDomainState, "canTransitionPreparedDomainState");
+function transitionDomainState(definition, snapshot, input) {
+  const stableDefinition = ensureStableDomainMachineDefinition(definition);
+  const currentSnapshot = prepareDomainMachineSnapshot(
+    stableDefinition,
+    snapshot
+  );
+  return transitionPreparedDomainState(
+    stableDefinition,
+    currentSnapshot,
+    input
+  );
+}
+__name(transitionDomainState, "transitionDomainState");
+function transitionPreparedDomainState(definition, snapshot, input) {
+  validateDomainMachineInput(input);
+  const from = snapshot.state;
+  const stateNode = definition.states[from];
+  const transition = stateNode.terminal === true ? void 0 : getTransition(definition, from, input);
+  if (!transition) {
+    throw new InvalidDomainTransitionError(from, input.type);
+  }
+  const currentInput = copyDomainMachineInput(input);
+  const guardResult = transition.guard === void 0 ? true : transition.guard({
+    state: from,
+    context: snapshot.context,
+    input: currentInput
+  });
+  const guardDecision = resolveDomainTransitionGuardResult(guardResult);
+  if (!guardDecision.allowed) {
+    if (guardDecision.rejection !== void 0) {
+      throw guardDecision.rejection;
+    }
+    throw new DomainTransitionGuardRejectedError(from, currentInput.type);
+  }
+  const result = transition.reduce?.({
+    state: from,
+    context: snapshot.context,
+    input: currentInput
+  });
+  validateDomainTransitionResult(result);
+  const contextResult = readDomainTransitionResultContext(result);
+  const nextContext = contextResult.hasContext ? contextResult.context : snapshot.context;
+  const nextSnapshot = nextContext === snapshot.context ? createDomainMachineSnapshotFromPreparedContext(
+    transition.target,
+    snapshot.context
+  ) : createDomainMachineSnapshot({
+    state: transition.target,
+    context: nextContext
+  });
+  validateDomainMachineSnapshotInvariant(definition, nextSnapshot);
+  return {
+    from,
+    to: transition.target,
+    snapshot: nextSnapshot,
+    outputs: copyDomainMachineOutputs(
+      readDomainTransitionResultOutputs(result)
+    )
+  };
+}
+__name(transitionPreparedDomainState, "transitionPreparedDomainState");
+
+// src/domain-state-machine/analyzer.ts
+function analyzeDomainMachineDefinition(definition) {
+  validateDomainMachineDefinition(definition);
+  const stableDefinition = copyDomainMachineDefinition(definition);
+  const states = Object.keys(stableDefinition.states).sort(
+    compareStrings
+  );
+  const outgoing = /* @__PURE__ */ new Map();
+  const incoming = /* @__PURE__ */ new Map();
+  const transitions = [];
+  for (const state of states) {
+    outgoing.set(state, []);
+    incoming.set(state, []);
+  }
+  for (const state of states) {
+    const stateTransitions = stableDefinition.states[state].on;
+    const inputTypes = Object.keys(stateTransitions ?? {}).sort(compareStrings);
+    for (const inputType of inputTypes) {
+      const transition = stateTransitions?.[inputType];
+      if (transition === void 0) continue;
+      outgoing.get(state)?.push(transition.target);
+      incoming.get(transition.target)?.push(state);
+      transitions.push(
+        Object.freeze({
+          state,
+          inputType,
+          target: transition.target,
+          guarded: transition.guard !== void 0
+        })
+      );
+    }
+  }
+  const structurallyReachable = visitGraph(
+    [stableDefinition.initial],
+    outgoing
+  );
+  const terminalStates = states.filter(
+    (state) => stableDefinition.states[state].terminal === true
+  );
+  const statesWithTerminalPath = visitGraph(terminalStates, incoming);
+  const diagnostics = [];
+  for (const state of states) {
+    if (!structurallyReachable.has(state)) {
+      diagnostics.push(Object.freeze({ code: "unreachable-state", state }));
+    }
+  }
+  for (const state of states) {
+    if (stableDefinition.states[state].terminal !== true && outgoing.get(state)?.length === 0) {
+      diagnostics.push(Object.freeze({ code: "structural-dead-end", state }));
+    }
+  }
+  for (const state of states) {
+    if (!statesWithTerminalPath.has(state)) {
+      diagnostics.push(Object.freeze({ code: "no-terminal-path", state }));
+    }
+  }
+  return Object.freeze({
+    diagnostics: Object.freeze(diagnostics),
+    transitions: Object.freeze(transitions),
+    structurallyReachableStates: Object.freeze(
+      states.filter((state) => structurallyReachable.has(state))
+    ),
+    statesWithTerminalPath: Object.freeze(
+      states.filter((state) => statesWithTerminalPath.has(state))
+    )
+  });
+}
+__name(analyzeDomainMachineDefinition, "analyzeDomainMachineDefinition");
+function visitGraph(startStates, edges) {
+  const visited = /* @__PURE__ */ new Set();
+  const pending = [...startStates];
+  while (pending.length > 0) {
+    const state = pending.pop();
+    if (state === void 0 || visited.has(state)) continue;
+    visited.add(state);
+    for (const next of edges.get(state) ?? []) {
+      if (!visited.has(next)) pending.push(next);
+    }
+  }
+  return visited;
+}
+__name(visitGraph, "visitGraph");
+function compareStrings(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+__name(compareStrings, "compareStrings");
+
+// src/domain-state-machine/domain-state-machine.ts
+var DomainStateMachine = class {
+  static {
+    __name(this, "DomainStateMachine");
+  }
+  definition;
+  #snapshot;
+  #evaluating = false;
+  constructor(definition, ...snapshotInput) {
+    this.definition = ensureStableDomainMachineDefinition(definition);
+    const [suppliedSnapshot] = snapshotInput;
+    if (suppliedSnapshot !== void 0) {
+      validateDomainMachineSnapshot(this.definition, suppliedSnapshot);
+      this.#snapshot = createDomainMachineSnapshot(
+        suppliedSnapshot
+      );
+      validateDomainMachineSnapshotInvariant(this.definition, this.#snapshot);
+    } else {
+      this.#snapshot = createInitialDomainMachineSnapshotFromPrepared(
+        this.definition
+      );
+    }
+  }
+  /** Returns a defensive, deeply frozen copy of the current snapshot. */
+  get snapshot() {
+    return createDomainMachineSnapshot(this.#snapshot);
+  }
+  /** Current named control state. */
+  get state() {
+    return this.#snapshot.state;
+  }
+  /** Current deeply readonly context. */
+  get context() {
+    return this.#snapshot.context;
+  }
+  /** Whether the current state permanently forbids outgoing transitions. */
+  isTerminal() {
+    return this.definition.states[this.state].terminal === true;
+  }
+  /** Checks a transition without changing the current snapshot. */
+  can(input) {
+    return this.evaluate(
+      () => canTransitionPreparedDomainState(this.definition, this.#snapshot, input)
+    );
+  }
+  /** Applies an input and advances the current snapshot on success. */
+  dispatch(input) {
+    return this.evaluate(() => {
+      const result = transitionPreparedDomainState(
+        this.definition,
+        this.#snapshot,
+        input
+      );
+      this.#snapshot = result.snapshot;
+      return result;
+    });
+  }
+  evaluate(operation) {
+    if (this.#evaluating) {
+      throw new ReentrantDomainStateMachineEvaluationError();
+    }
+    this.#evaluating = true;
+    try {
+      return operation();
+    } finally {
+      this.#evaluating = false;
+    }
+  }
+};
+
+// src/events/event-bus.ts
+var EventBusImpl = class {
+  static {
+    __name(this, "EventBusImpl");
+  }
+  handlers = /* @__PURE__ */ new Map();
+  subscribe(eventType, handler) {
+    const type = eventType;
+    if (!this.handlers.has(type)) {
+      this.handlers.set(type, []);
+    }
+    const handlersForType = this.handlers.get(type);
+    const casted = handler;
+    handlersForType.push(casted);
+    let removed = false;
+    return () => {
+      if (removed) return;
+      const idx = handlersForType.indexOf(casted);
+      if (idx !== -1) {
+        handlersForType.splice(idx, 1);
+        removed = true;
+      }
+      if (handlersForType.length === 0) {
+        this.handlers.delete(type);
+      }
+    };
+  }
+  once(eventType, options) {
+    return new Promise((resolve, reject) => {
+      if (options?.signal?.aborted) {
+        reject(abortReason(options.signal, "EventBus.once aborted"));
+        return;
+      }
+      let timer;
       let settled = false;
       let abortListener;
       const cleanup = /* @__PURE__ */ __name(() => {
@@ -2319,21 +3873,98 @@ var InMemoryOutbox = class {
     __name(this, "InMemoryOutbox");
   }
   pending = /* @__PURE__ */ new Map();
+  dead = /* @__PURE__ */ new Map();
+  maxDeliveryAttempts;
+  constructor(options) {
+    const max = options?.maxDeliveryAttempts ?? 5;
+    if (!Number.isInteger(max) || max < 1) {
+      throw new Error(
+        `InMemoryOutbox: maxDeliveryAttempts must be an integer >= 1, got ${max}`
+      );
+    }
+    this.maxDeliveryAttempts = max;
+  }
   async add(events) {
     for (const event of events) {
+      if (this.dead.has(event.eventId)) {
+        this.dead.delete(event.eventId);
+        this.pending.set(event.eventId, {
+          dispatchId: event.eventId,
+          event,
+          attempts: 0
+        });
+        continue;
+      }
+      const existing = this.pending.get(event.eventId);
+      if (existing) {
+        existing.event = event;
+        continue;
+      }
       this.pending.set(event.eventId, {
         dispatchId: event.eventId,
-        event
+        event,
+        attempts: 0
       });
     }
   }
   async getPending(limit) {
-    const all = [...this.pending.values()];
+    const all = [...this.pending.values()].map((record) => ({
+      dispatchId: record.dispatchId,
+      event: record.event,
+      attempts: record.attempts
+    }));
     if (typeof limit !== "number") return all;
     return all.slice(0, Math.max(0, limit));
   }
   async markDispatched(dispatchIds) {
-    for (const id of dispatchIds) this.pending.delete(id);
+    for (const id of dispatchIds) {
+      this.pending.delete(id);
+      this.dead.delete(id);
+    }
+  }
+  async markFailed(dispatchId, error) {
+    const record = this.pending.get(dispatchId);
+    if (!record) return;
+    record.attempts += 1;
+    record.lastError = error instanceof Error ? error.message : String(error ?? "unknown");
+    if (record.attempts >= this.maxDeliveryAttempts) {
+      this.pending.delete(dispatchId);
+      this.dead.set(dispatchId, {
+        dispatchId: record.dispatchId,
+        event: record.event,
+        attempts: record.attempts,
+        lastError: record.lastError
+      });
+    }
+  }
+  async deadLetters() {
+    return [...this.dead.values()].map((record) => ({ ...record }));
+  }
+};
+
+// src/repo/in-memory-event-store.ts
+var InMemoryEventStore = class {
+  static {
+    __name(this, "InMemoryEventStore");
+  }
+  streams = /* @__PURE__ */ new Map();
+  async append(streamId, events, options) {
+    if (events.length === 0) return;
+    const stream = this.streams.get(streamId) ?? [];
+    if (stream.length !== options.expectedVersion) {
+      throw new ConcurrencyConflictError({
+        aggregateType: events[0]?.aggregateType ?? "stream",
+        aggregateId: streamId,
+        expectedVersion: options.expectedVersion,
+        actualVersion: stream.length
+      });
+    }
+    this.streams.set(streamId, [...stream, ...events]);
+  }
+  async readStream(streamId, options) {
+    const stream = this.streams.get(streamId) ?? [];
+    const fromVersion = options?.fromVersion ?? 0;
+    return stream.slice(Math.max(0, fromVersion));
   }
 };
 var DEFAULT_MAX_ATTEMPTS = 3;
@@ -2424,7 +4055,7 @@ var RetryingTransactionScope = class {
           maxDelayMs: this.maxDelayMs,
           random: this.random
         });
-        this.onRetry?.({ attempt, error, delayMs });
+        reportToObserver(() => this.onRetry?.({ attempt, error, delayMs }));
         await sleep(delayMs, signal);
       }
     }
@@ -2438,6 +4069,6 @@ function voValidated(t, validate, message = "Validation failed") {
 }
 __name(voValidated, "voValidated");
 
-export { AggregateDeletedError, AggregateNotFoundError, AggregateRoot, CommandBus, CommitError, ConcurrencyConflictError, DomainError, DuplicateAggregateError, Entity, EventBusImpl, EventHarvestError, EventSourcedAggregate, IdentityMap, InMemoryOutbox, InfrastructureError, MissingHandlerError, NestedUnitOfWorkError, QueryBus, RetryingTransactionScope, RollbackError, TransactionClosedError, UnenrolledChangesError, UnitOfWork, ValueObject, computeBackoffDelay, copyMetadata, createDomainEvent, deepEqual, deepEqualExcept, deepFreeze, deepOmit, entityIds, findEntityById, freezeShallow, hasEntityId, mergeMetadata, removeEntityById, replaceEntityById, resetClockFactory, resetEventIdFactory, sameEntity, sameVersion, setClockFactory, setEventIdFactory, updateEntityById, vo, voEquals, voEqualsExcept, voValidated, voWithValidation, withClockFactory, withCommit, withEventIdFactory };
+export { AggregateDeletedError, AggregateNotFoundError, AggregateRoot, CommandBus, CommitError, ConcurrencyConflictError, DomainError, DomainStateMachine, DomainTransitionGuardRejectedError, DuplicateAggregateError, Entity, EventBusImpl, EventHarvestError, EventSourcedAggregate, IdentityMap, InMemoryEventStore, InMemoryOutbox, InfrastructureError, InvalidDomainMachineContextError, InvalidDomainMachineDefinitionError, InvalidDomainMachineInputError, InvalidDomainMachineSnapshotError, InvalidDomainTransitionError, InvalidDomainTransitionGuardResultError, InvalidDomainTransitionResultError, MissingHandlerError, NestedUnitOfWorkError, QueryBus, ReentrantDomainStateMachineEvaluationError, RetryingTransactionScope, RollbackError, SnapshotSchemaMismatchError, TransactionClosedError, UnenrolledChangesError, UnitOfWork, UnregisteredHandlerError, UnreplayableAggregateError, ValueObject, analyzeDomainMachineDefinition, canTransitionDomainState, computeBackoffDelay, copyMetadata, createDomainEvent, createInitialDomainMachineSnapshot, deepEqual, deepEqualExcept, deepFreeze, deepOmit, entityIds, findEntityById, freezeShallow, hasEntityId, mergeMetadata, prepareDomainMachineDefinition, removeEntityById, replaceEntityById, resetClockFactory, resetEventIdFactory, sameEntity, sameVersion, setClockFactory, setEventIdFactory, transitionDomainState, updateEntityById, vo, voEquals, voEqualsExcept, voValidated, voWithValidation, withClockFactory, withCommit, withEventIdFactory };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map