@shirudo/ddd-kit 3.0.0-rc.10 → 3.0.0-rc.12

package/dist/chunks/{ports.js → read-stream-pages.js}

@@ -1,4 +1,4 @@
-import { J as assertNoHostileOwnProtoKey } from "./kit-errors.js";
+import { C as InvalidEventStreamPageError, Y as assertNoHostileOwnProtoKey } from "./kit-errors.js";
 import { err, ok } from "@shirudo/result";
 
 //#region src/internal/structural/is-built-in.ts
@@ -49,7 +49,7 @@ const sharedArrayBufferByteLengthGet = typeof SharedArrayBuffer === "undefined"
 const regExpSourceGet = intrinsicGetter(RegExp.prototype, "source");
 const booleanValueOf = Boolean.prototype.valueOf;
 const numberValueOf = Number.prototype.valueOf;
-const stringValueOf = String.prototype.valueOf;
+const stringValueOf$1 = String.prototype.valueOf;
 const bigIntValueOf = BigInt.prototype.valueOf;
 const functionToString = Function.prototype.toString;
 const PROBE_KEY = {};
@@ -91,9 +91,9 @@ const intrinsicConstructorSources = new Map([
 	"BigUint64Array"
 ].flatMap((name) => {
 	const intrinsic = Object.getOwnPropertyDescriptor(globalThis, name)?.value;
-	return typeof intrinsic === "function" ? [[name, functionToString.call(intrinsic)]] : [];
+	return typeof intrinsic === "function" ? [[name, /* @__PURE__ */ new Set([functionToString.call(intrinsic), `function ${name}() { [native code] }`])]] : [];
 }));
-const intrinsicConstructorSourceSet = new Set(intrinsicConstructorSources.values());
+const intrinsicConstructorSourceSet = new Set([...intrinsicConstructorSources.values()].flatMap((sources) => [...sources]));
 const ERROR_INTRINSIC_NAMES = [
 	"Error",
 	"EvalError",
@@ -114,13 +114,13 @@ function isIntrinsicConstructorPrototype(prototype, expectedName) {
 	} catch {
 		return false;
 	}
-	const expectedSource = expectedName === void 0 ? void 0 : intrinsicConstructorSources.get(expectedName);
-	if (expectedSource !== void 0 && candidateSource !== expectedSource || expectedSource === void 0 && !intrinsicConstructorSourceSet.has(candidateSource)) return false;
+	const expectedSources = expectedName === void 0 ? void 0 : intrinsicConstructorSources.get(expectedName);
+	if (expectedSources !== void 0 && !expectedSources.has(candidateSource) || expectedSources === void 0 && !intrinsicConstructorSourceSet.has(candidateSource)) return false;
 	const nameDescriptor = Object.getOwnPropertyDescriptor(candidateConstructor, "name");
 	const candidateName = nameDescriptor !== void 0 && "value" in nameDescriptor && typeof nameDescriptor.value === "string" ? nameDescriptor.value : void 0;
 	const intrinsicName = expectedName ?? candidateName;
-	const intrinsicSource = intrinsicName === void 0 ? void 0 : intrinsicConstructorSources.get(intrinsicName);
-	return candidateName === intrinsicName && intrinsicSource !== void 0 && candidateSource === intrinsicSource && Object.getOwnPropertyDescriptor(candidateConstructor, "prototype")?.value === prototype;
+	const intrinsicSources = intrinsicName === void 0 ? void 0 : intrinsicConstructorSources.get(intrinsicName);
+	return candidateName === intrinsicName && intrinsicSources !== void 0 && intrinsicSources.has(candidateSource) && Object.getOwnPropertyDescriptor(candidateConstructor, "prototype")?.value === prototype;
 }
 /**
 * Accepts an intrinsic prototype, optionally behind transparent
@@ -197,6 +197,10 @@ function builtInTagWithoutInvokingAccessors(value) {
 	if (BUILT_IN_TAGS.has(tag) && hasBrand(value, tag)) return tag;
 	return descriptor === void 0 ? void 0 : builtInTagFromBrand(value);
 }
+/** The type name in a tag: `"Map"` for `"[object Map]"`. */
+function builtInTypeName(tag) {
+	return tag.slice(8, -1);
+}
 function builtInTagFromBrand(value) {
 	if (hasBrand(value, "[object Date]")) return "[object Date]";
 	if (hasBrand(value, "[object RegExp]")) return "[object RegExp]";
@@ -268,7 +272,7 @@ function hasBrand(obj, tag) {
 				numberValueOf.call(obj);
 				return true;
 			case "[object String]":
-				stringValueOf.call(obj);
+				stringValueOf$1.call(obj);
 				return true;
 			case "[object BigInt]":
 				bigIntValueOf.call(obj);
@@ -646,47 +650,106 @@ function deepEqualExcept(a, b, options) {
 }
 
 //#endregion
-//#region src/domain/value-object/value-object.ts
+//#region src/internal/cooperative-brand.ts
+/**
+* A cooperative brand marks an object that a kit constructor produced, so
+* a second loaded copy of the kit (duplicate npm dependency, dual CJS/ESM
+* load, plugin bundle) recognizes it. A module-private WeakSet cannot do
+* that: it is bound to one loaded copy. The brand is a `Symbol.for` key
+* with the value `true`. The property is non-enumerable, so it never
+* leaks into spreads, JSON, or equality, and non-writable and
+* non-configurable, so nothing edits it after the stamp.
+*
+* The probe reads the brand as an OWN property with exactly these
+* attributes and requires the carrier to be frozen. An object that
+* inherits a branded object through its prototype can carry mutable own
+* overrides; a branded object that is still open can change after the
+* stamp. Neither is what the constructor produced. Every stamp site
+* therefore freezes the carrier right after {@link stampCooperativeBrand}.
+*
+* The brand is forgeable BY DESIGN. It catches accidental hand-rolled
+* literals; it is not a security boundary against code in the same
+* process that fakes it on purpose.
+*
+* Internal utility (not exported from the package barrels).
+*/
+function stampCooperativeBrand(target, brand) {
+	Object.defineProperty(target, brand, {
+		value: true,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+}
+/**
+* Whether `value` carries `brand` as an own, non-enumerable, non-writable,
+* non-configurable `true` and is frozen. A Proxy trap that throws reads
+* as unbranded.
+*/
+function hasCooperativeBrand(value, brand) {
+	if (value === null || typeof value !== "object" && typeof value !== "function") return false;
+	try {
+		const marker = Reflect.getOwnPropertyDescriptor(value, brand);
+		return marker?.value === true && marker.enumerable === false && marker.writable === false && marker.configurable === false && Object.isFrozen(value);
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/internal/structural/shadowed-mutators.ts
 /**
 * `Object.freeze` does not protect internal slots: a frozen Date still
-* accepts `setTime`, a frozen Map still accepts `set`. To make the
-* "deeply immutable" guarantee real, the mutator methods are shadowed
-* with own throwing functions BEFORE the freeze. The shadows are
-* non-enumerable, so they are invisible to `Object.keys`/spread (deep
-* equality is unaffected) and `structuredClone` drops them (a `vo()`
-* round-trip never sees them).
+* accepts `setTime`, a frozen Map still accepts `set`. A deep freeze
+* therefore shadows these mutators with own throwing functions. The
+* shadows are non-enumerable, so they are invisible to `Object.keys` and
+* spread, and `structuredClone` drops them. A walk that checks a copy
+* accepts them as machinery, not data.
 */
-const DATE_MUTATORS = [
-	"setTime",
-	"setMilliseconds",
-	"setUTCMilliseconds",
-	"setSeconds",
-	"setUTCSeconds",
-	"setMinutes",
-	"setUTCMinutes",
-	"setHours",
-	"setUTCHours",
-	"setDate",
-	"setUTCDate",
-	"setMonth",
-	"setUTCMonth",
-	"setFullYear",
-	"setUTCFullYear",
-	"setYear"
-];
-const mutationThrowers = /* @__PURE__ */ new Map();
-const mapEntries = Map.prototype.entries;
-const setValues = Set.prototype.values;
-function mutationThrower(typeName, method) {
+const mutatorsByTag = /* @__PURE__ */ new Map([
+	["[object Date]", [
+		"setTime",
+		"setMilliseconds",
+		"setUTCMilliseconds",
+		"setSeconds",
+		"setUTCSeconds",
+		"setMinutes",
+		"setUTCMinutes",
+		"setHours",
+		"setUTCHours",
+		"setDate",
+		"setUTCDate",
+		"setMonth",
+		"setUTCMonth",
+		"setFullYear",
+		"setUTCFullYear",
+		"setYear"
+	]],
+	["[object Map]", [
+		"set",
+		"delete",
+		"clear"
+	]],
+	["[object Set]", [
+		"add",
+		"delete",
+		"clear"
+	]]
+]);
+const mutatorShadowBrand = Symbol.for("@shirudo/ddd-kit/mutator-shadow/v1");
+const shadows = /* @__PURE__ */ new Map();
+function shadowOf(typeName, method) {
 	const key = `${typeName}.${method}`;
-	let thrower = mutationThrowers.get(key);
-	if (!thrower) {
-		thrower = function throwFrozenMutation() {
+	let shadow = shadows.get(key);
+	if (shadow === void 0) {
+		shadow = function throwFrozenMutation() {
 			throw new TypeError(`Cannot call ${method}() on a ${typeName} inside a deeply frozen value`);
 		};
-		mutationThrowers.set(key, thrower);
+		stampCooperativeBrand(shadow, mutatorShadowBrand);
+		Object.freeze(shadow);
+		shadows.set(key, shadow);
 	}
-	return thrower;
+	return shadow;
 }
 const shadowDescriptor = {
 	value: void 0,
@@ -694,15 +757,36 @@ const shadowDescriptor = {
 	enumerable: false,
 	configurable: false
 };
-/** Returns whether the shadows were installed. */
-function shadowMutators(obj, typeName, methods) {
-	if (!Object.isExtensible(obj)) return false;
-	for (const method of methods) {
-		shadowDescriptor.value = mutationThrower(typeName, method);
-		Object.defineProperty(obj, method, shadowDescriptor);
+/**
+* Installs the mutator shadows on a Date, a Map, or a Set whose tag is
+* `tag`. Returns whether it installed them: a built-in of another kind has
+* no mutator shadows, and a non-extensible one cannot take them.
+*/
+function installMutatorShadows(object, tag) {
+	const mutators = mutatorsByTag.get(tag);
+	if (mutators === void 0 || !Object.isExtensible(object)) return false;
+	const typeName = builtInTypeName(tag);
+	for (const method of mutators) {
+		shadowDescriptor.value = shadowOf(typeName, method);
+		Object.defineProperty(object, method, shadowDescriptor);
 	}
 	return true;
 }
+/**
+* Whether the own property `key` of a built-in whose tag is `tag` is a
+* mutator shadow: a locked, non-enumerable function with the cooperative
+* brand of a shadow, under a mutator key of that built-in. The brand
+* catches accidents, not a forgery.
+*/
+function isMutatorShadow(tag, key, descriptor) {
+	const shadow = descriptor.value;
+	return (mutatorsByTag.get(tag)?.includes(key) ?? false) && typeof shadow === "function" && descriptor.enumerable === false && descriptor.writable === false && descriptor.configurable === false && hasCooperativeBrand(shadow, mutatorShadowBrand);
+}
+
+//#endregion
+//#region src/domain/value-object/value-object.ts
+const mapEntries$1 = Map.prototype.entries;
+const setValues$1 = Set.prototype.values;
 const VALUE_OBJECT_CLASS = Symbol.for("@shirudo/ddd-kit/value-object-class/v1");
 function recordValueObjectClass(instance, valueObjectClass) {
 	Object.defineProperty(instance, VALUE_OBJECT_CLASS, {
@@ -795,27 +879,14 @@ function freezeDeep(obj, walk) {
 	walk.inProgress.add(obj);
 	let sealed = true;
 	if (builtInTag === "[object Date]" || builtInTag === "[object Map]" || builtInTag === "[object Set]") {
-		let shadowed = KIT_SHADOWED.has(obj);
-		if (builtInTag === "[object Date]") shadowed = shadowMutators(obj, "Date", DATE_MUTATORS) || shadowed;
-		else if (builtInTag === "[object Map]") {
-			for (const [key, value] of obj) {
-				if (!freezeDeep(key, walk)) sealed = false;
-				if (!freezeDeep(value, walk)) sealed = false;
-			}
-			shadowed = shadowMutators(obj, "Map", [
-				"set",
-				"delete",
-				"clear"
-			]) || shadowed;
-		} else if (builtInTag === "[object Set]") {
+		if (builtInTag === "[object Map]") for (const [key, value] of obj) {
+			if (!freezeDeep(key, walk)) sealed = false;
+			if (!freezeDeep(value, walk)) sealed = false;
+		}
+		else if (builtInTag === "[object Set]") {
 			for (const member of obj) if (!freezeDeep(member, walk)) sealed = false;
-			shadowed = shadowMutators(obj, "Set", [
-				"add",
-				"delete",
-				"clear"
-			]) || shadowed;
 		}
-		if (shadowed) KIT_SHADOWED.add(obj);
+		if (installMutatorShadows(obj, builtInTag) || KIT_SHADOWED.has(obj)) KIT_SHADOWED.add(obj);
 		else sealed = false;
 	}
 	const keys = Reflect.ownKeys(obj);
@@ -880,7 +951,7 @@ function cloneForVo(value, visited) {
 		if (tag === "[object Map]") {
 			const clone = /* @__PURE__ */ new Map();
 			visited.set(obj, clone);
-			for (const [key, entry] of mapEntries.call(obj)) {
+			for (const [key, entry] of mapEntries$1.call(obj)) {
 				if (!isPrimitiveValue(key)) throw new TypeError("vo() Map keys must be primitive values to preserve value equality");
 				clone.set(key, cloneForVo(entry, visited));
 			}
@@ -889,7 +960,7 @@ function cloneForVo(value, visited) {
 		if (tag === "[object Set]") {
 			const clone = /* @__PURE__ */ new Set();
 			visited.set(obj, clone);
-			for (const member of setValues.call(obj)) {
+			for (const member of setValues$1.call(obj)) {
 				if (!isPrimitiveValue(member)) throw new TypeError("vo() Set members must be primitive values to preserve value equality");
 				clone.add(member);
 			}
@@ -1201,50 +1272,279 @@ var ValueObject = class {
 };
 
 //#endregion
-//#region src/internal/cooperative-brand.ts
+//#region src/internal/structural/detach-state.ts
 /**
-* A cooperative brand marks an object that a kit constructor produced, so
-* a second loaded copy of the kit (duplicate npm dependency, dual CJS/ESM
-* load, plugin bundle) recognizes it. A module-private WeakSet cannot do
-* that: it is bound to one loaded copy. The brand is a `Symbol.for` key
-* with the value `true`. The property is non-enumerable, so it never
-* leaks into spreads, JSON, or equality, and non-writable and
-* non-configurable, so nothing edits it after the stamp.
+* Returns a copy of `state` that shares no object with the original.
+* Throws a `TypeError` that names the path when the graph carries a value
+* a structured clone would lose or silently degrade. A class instance, a
+* subclass of a built-in included, loses the methods on its prototype. A
+* symbol-keyed, non-enumerable, or accessor property and an expando on a
+* built-in are dropped. A function or a symbol value throws a raw
+* `DataCloneError`. An Error, a Promise, a WeakMap, or a WeakSet cannot be
+* detached at all. A SharedArrayBuffer and a view over one keep sharing
+* their memory. A Proxy fails in the walk or in the clone; a failure in
+* the clone is rethrown as a `TypeError` with the cause. An error that a
+* Proxy trap throws in the walk passes unchanged, so a coded error of the
+* caller keeps its code.
 *
-* The probe reads the brand as an OWN property with exactly these
-* attributes and requires the carrier to be frozen. An object that
-* inherits a branded object through its prototype can carry mutable own
-* overrides; a branded object that is still open can change after the
-* stamp. Neither is what the constructor produced. Every stamp site
-* therefore freezes the carrier right after {@link stampCooperativeBrand}.
+* The walk reads the graph through property descriptors and walks a Map
+* or a Set with the built-in iteration, so no accessor and no own iterator
+* of the state runs. A Proxy runs its traps during the walk. A trap can
+* change the graph, and an accessor that a trap adds runs during the
+* clone. A second walk checks the clone, so a value that a trap swapped in
+* and the content of a built-in whose prototype was replaced are rejected
+* too. A trap that changes the graph after the first walk can still hide a
+* value that the copy drops: the walks catch accidents, not a hostile
+* Proxy. The second walk also follows the steps of the first walk: the kind
+* of each object and the key of each data property, in walk order. A copy
+* that differs throws, because a built-in whose prototype was replaced is
+* a built-in again in the copy and loses its own properties. `subject`
+* names the state in the messages.
 *
-* The brand is forgeable BY DESIGN. It catches accidental hand-rolled
-* literals; it is not a security boundary against code in the same
-* process that fakes it on purpose.
+* Plain objects (from any realm), arrays, Dates, Maps, Sets, bigints, and
+* typed arrays pass. A RegExp passes: pattern and flags survive the clone,
+* and `lastIndex` restores as 0. The scan state of a global or sticky
+* pattern is not domain data. On a built-in, the mutator shadows of a deep
+* freeze, the `lastIndex` of a RegExp, and the `length` of a boxed String
+* pass: they are machinery, not data. Every other non-enumerable property
+* throws. A non-enumerable symbol key passes anywhere: it is metadata by
+* convention.
 *
-* Internal utility (not exported from the package barrels).
+* The concrete entity uses it for a detached read DTO of a plain-data
+* state. The snapshot model uses it for the captured DTO and the restored
+* state. A state that carries a class-based child is mapped to plain data
+* first, in the entity or in the model.
 */
-function stampCooperativeBrand(target, brand) {
-	Object.defineProperty(target, brand, {
-		value: true,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
+function detachState(state, subject = "detachState: state") {
+	return detach(state, subject, "clone");
 }
 /**
-* Whether `value` carries `brand` as an own, non-enumerable, non-writable,
-* non-configurable `true` and is frozen. A Proxy trap that throws reads
-* as unbranded.
+* {@link detachState} that also rejects what `deepFreeze` cannot make
+* immutable: binary data (a typed array, a DataView, an ArrayBuffer, or a
+* SharedArrayBuffer) and a RegExp. The walk rejects such a value at its
+* tag, before it reads the indices of a typed array. Kit modules only.
 */
-function hasCooperativeBrand(value, brand) {
-	if (value === null || typeof value !== "object" && typeof value !== "function") return false;
+function detachFreezableState(state, subject) {
+	return detach(state, subject, "freeze");
+}
+function detach(state, subject, rule) {
+	const recording = new StepRecording();
+	assertDetachable(state, "", newWalk(subject, rule, recording));
+	let copy;
 	try {
-		const marker = Reflect.getOwnPropertyDescriptor(value, brand);
-		return marker?.value === true && marker.enumerable === false && marker.writable === false && marker.configurable === false && Object.isFrozen(value);
-	} catch {
-		return false;
+		copy = structuredClone(state);
+	} catch (cause) {
+		throw new TypeError(`${subject} holds a Proxy or a host object that cannot be cloned, or a view over a detached or shrunk buffer; the cause names the value; map it to plain data`, { cause });
+	}
+	const comparison = new StepComparison(recording, subject);
+	assertDetachable(copy, "", newWalk(subject, rule, comparison));
+	comparison.assertComplete();
+	return copy;
+}
+const INDEX_KEY = /^(0|[1-9]\d*)$/;
+const BINARY_DATA_TAGS = /* @__PURE__ */ new Set([
+	"[object TypedArray]",
+	"[object DataView]",
+	"[object ArrayBuffer]",
+	"[object SharedArrayBuffer]"
+]);
+const REGEXP_TAG = "[object RegExp]";
+const STRING_TAG = "[object String]";
+const mapEntries = Map.prototype.entries;
+const setValues = Set.prototype.values;
+const RECORD_STEP = Symbol("record");
+const ARRAY_STEP = Symbol("array");
+const builtInSteps = /* @__PURE__ */ new Map();
+function builtInStep(tag) {
+	let kind = builtInSteps.get(tag);
+	if (kind === void 0) {
+		kind = Symbol(tag);
+		builtInSteps.set(tag, kind);
 	}
+	return kind;
+}
+/**
+* The steps of the walk over the original, in walk order.
+*/
+var StepRecording = class {
+	steps = [];
+	take(next) {
+		this.steps.push(next);
+	}
+};
+/**
+* The walk over the copy compares each of its steps with the step of the
+* walk over the original at the same position. Structured clone keeps the
+* order of the keys, of Map entries, and of Set members, and it keeps
+* shared references, so the walk over an unchanged copy takes the same
+* steps. A step that differs, or a step that is missing, means that the
+* copy changed.
+*/
+var StepComparison = class {
+	recording;
+	subject;
+	#position = 0;
+	constructor(recording, subject) {
+		this.recording = recording;
+		this.subject = subject;
+	}
+	take(next, path) {
+		const expected = this.recording.steps[this.#position];
+		if (expected !== next) throwChangedInCopy(this.subject, path, expected, next);
+		this.#position += 1;
+	}
+	assertComplete() {
+		if (this.#position < this.recording.steps.length) throwChangedInCopy(this.subject, "", this.recording.steps[this.#position], void 0);
+	}
+};
+function newWalk(subject, rule, trace) {
+	return {
+		seen: /* @__PURE__ */ new WeakSet(),
+		subject,
+		rule,
+		trace
+	};
+}
+function step(walk, next, path) {
+	walk.trace.take(next, path);
+}
+function throwChangedInCopy(subject, path, expected, found) {
+	throw new TypeError(`${subject}${path} changed in the copy: the state has ${describeStep(expected)} there, and the copy has ${describeStep(found)}; a built-in whose prototype was replaced is a built-in again in the copy and loses its own properties, and a Proxy trap can change the graph; map it to plain data`);
+}
+function describeStep(step) {
+	if (step === void 0) return "nothing";
+	if (typeof step === "string") return `the key "${step}"`;
+	if (step === RECORD_STEP) return "a record";
+	if (step === ARRAY_STEP) return "an array";
+	const name = builtInTypeName(step.description);
+	return /^[AEIOU]/.test(name) ? `an ${name}` : `a ${name}`;
+}
+function assertDetachable(value, path, walk) {
+	if (typeof value === "function") throw new TypeError(`${walk.subject}${path} is a function; map it to plain data`);
+	if (typeof value === "symbol") throw new TypeError(`${walk.subject}${path} is a symbol; map it to plain data`);
+	if (value === null || typeof value !== "object") return;
+	const object = value;
+	if (walk.seen.has(object)) return;
+	walk.seen.add(object);
+	if (Array.isArray(object)) {
+		if (!hasIntrinsicPrototypeChain(object, "Array")) throwClassInstance(object, path, walk.subject);
+		step(walk, ARRAY_STEP, path);
+		assertOwnPropertiesDetachable(object, path, walk, "array");
+		return;
+	}
+	const tag = builtInTagWithoutInvokingAccessors(object);
+	if (tag !== void 0) {
+		if (walk.rule === "freeze") assertFreezable(tag, path, walk.subject);
+		if (!hasIntrinsicPrototypeChain(object)) throwClassInstance(object, path, walk.subject);
+		step(walk, builtInStep(tag), path);
+		if (tag === "[object Map]") {
+			let index = 0;
+			for (const [key, entry] of mapEntries.call(object)) {
+				assertDetachable(key, `${path}<map key #${index}>`, walk);
+				assertDetachable(entry, `${path}<map value #${index}>`, walk);
+				index++;
+			}
+		} else if (tag === "[object Set]") {
+			let index = 0;
+			for (const member of setValues.call(object)) {
+				assertDetachable(member, `${path}<set member #${index}>`, walk);
+				index++;
+			}
+		} else if (tag === "[object Promise]" || tag === "[object WeakMap]" || tag === "[object WeakSet]") throw new TypeError(`${walk.subject}${path} is a ${builtInTypeName(tag)} and cannot be detached`);
+		else if (tag === "[object Error]") throw new TypeError(`${walk.subject}${path} is an Error; map it to plain data`);
+		else if (sharesMemory(object, tag)) throw new TypeError(`${walk.subject}${path} is backed by a SharedArrayBuffer and the copy would share its memory; map it to plain data`);
+		assertOwnPropertiesDetachable(object, path, walk, tag);
+		return;
+	}
+	const prototype = Object.getPrototypeOf(object);
+	if (!(prototype === null || isIntrinsicConstructorPrototype(prototype, "Object") && Object.getPrototypeOf(prototype) === null)) throwClassInstance(object, path, walk.subject);
+	step(walk, RECORD_STEP, path);
+	assertOwnPropertiesDetachable(object, path, walk, "record");
+}
+/**
+* Audits the own properties the clone would copy or drop. The clone keeps
+* the enumerable own keys of a record and of an array, expandos included,
+* and drops every own key of another built-in. `length` on an array is
+* its own machinery, not data, and so are the keys that
+* {@link isBuiltInMachinery} names. The index keys of a built-in below its
+* content length are its content and pass as such. Another index key of a
+* built-in is an expando. `owner` is the kind of `object`: an array, a
+* record, or the tag of a built-in.
+*/
+function assertOwnPropertiesDetachable(object, path, walk, owner) {
+	const tag = owner === "array" || owner === "record" ? void 0 : owner;
+	const contentLength = tag === void 0 ? 0 : contentLengthOf(object, tag);
+	for (const key of Reflect.ownKeys(object)) {
+		const descriptor = Object.getOwnPropertyDescriptor(object, key);
+		if (descriptor === void 0) continue;
+		if (typeof key === "symbol") {
+			if (!descriptor.enumerable) continue;
+			throw new TypeError(`${walk.subject}${path} has a symbol-keyed property; map it to plain data`);
+		}
+		if (owner === "array" && key === "length") continue;
+		const isIndex = INDEX_KEY.test(key);
+		const memberPath = isIndex ? `${path}[${key}]` : `${path}.${key}`;
+		if (!descriptor.enumerable) {
+			if (tag !== void 0 && isBuiltInMachinery(tag, key, descriptor)) continue;
+			throw new TypeError(`${walk.subject}${memberPath} is not enumerable and the clone would drop it; map it to plain data`);
+		}
+		if (tag !== void 0 && isIndex && Number(key) < contentLength) continue;
+		if (!("value" in descriptor)) throw new TypeError(`${walk.subject}${memberPath} is an accessor property; map it to plain data`);
+		if (tag !== void 0) throw new TypeError(`${walk.subject}${memberPath} is an expando on a ${constructorName(Object.getPrototypeOf(object)) ?? "built-in"} and the clone would drop it; map it to plain data`);
+		step(walk, key, memberPath);
+		assertDetachable(descriptor.value, memberPath, walk);
+	}
+}
+/**
+* Whether an own non-enumerable property of a built-in is machinery, not
+* data: a function that shadows a mutator of a frozen Date, Map, or Set,
+* the scan position of a RegExp, or the length of a boxed String. The
+* clone drops the shadow and rebuilds the other two from the internal
+* slots.
+*/
+function isBuiltInMachinery(tag, key, descriptor) {
+	return isMutatorShadow(tag, key, descriptor) || tag === REGEXP_TAG && key === "lastIndex" || tag === STRING_TAG && key === "length";
+}
+/**
+* The number of index keys that hold the content of a built-in: the
+* elements of a typed array and the characters of a boxed String.
+*/
+function contentLengthOf(object, tag) {
+	if (tag === "[object TypedArray]") return typedArrayLength.call(object);
+	if (tag === STRING_TAG) return stringValueOf.call(object).length;
+	return 0;
+}
+const typedArrayLength = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), "length")?.get;
+const stringValueOf = String.prototype.valueOf;
+const typedArrayBuffer = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), "buffer")?.get;
+const dataViewBuffer = Object.getOwnPropertyDescriptor(DataView.prototype, "buffer")?.get;
+function sharesMemory(object, tag) {
+	if (tag === "[object SharedArrayBuffer]") return true;
+	if (tag === "[object TypedArray]") return isSharedArrayBuffer(typedArrayBuffer.call(object));
+	if (tag === "[object DataView]") return isSharedArrayBuffer(dataViewBuffer.call(object));
+	return false;
+}
+function isSharedArrayBuffer(buffer) {
+	return builtInTagWithoutInvokingAccessors(buffer) === "[object SharedArrayBuffer]";
+}
+function assertFreezable(tag, path, subject) {
+	if (BINARY_DATA_TAGS.has(tag)) throw new TypeError(`${subject}${path} is binary data; binary buffers (a typed array, a DataView, an ArrayBuffer, or a SharedArrayBuffer) stay mutable under freezing and JSON does not keep them; encode the data as a string, for example base64`);
+	if (tag === REGEXP_TAG) throw new TypeError(`${subject}${path} is a RegExp; a freeze cannot make it immutable, because compile() changes the pattern of a frozen RegExp before it throws, and a frozen global or sticky pattern throws on a match; keep its source and flags as strings`);
+}
+function throwClassInstance(object, path, subject) {
+	const name = constructorName(Object.getPrototypeOf(object)) ?? "anonymous class";
+	throw new TypeError(`${subject}${path} is a class instance (${name}); map it to plain data`);
+}
+/**
+* The name of the constructor of `prototype`, read through property
+* descriptors, so that no accessor runs.
+*/
+function constructorName(prototype) {
+	if (prototype === null) return void 0;
+	const owner = Object.getOwnPropertyDescriptor(prototype, "constructor")?.value;
+	if (typeof owner !== "function") return void 0;
+	const name = Object.getOwnPropertyDescriptor(owner, "name")?.value;
+	return typeof name === "string" && name !== "" ? name : void 0;
 }
 
 //#endregion
@@ -1313,28 +1613,15 @@ const defaultEventIdFactory = () => crypto.randomUUID();
 * recordPendingEvents(order, domainEvents);
 * ```
 */
-/**
-* Fills the origin of a factory into options that name none.
-*
-* A call site that states its own source keeps it: an explicit fact about one
-* event outranks the default of the factory that mints it.
-*/
-function withFactorySource(options, source) {
-	const given = options ?? {};
-	if (source === void 0 || given.metadata?.source !== void 0) return given;
-	return {
-		...given,
-		metadata: {
-			...given.metadata,
-			source
-		}
-	};
-}
 function createDomainEventFactory(options = {}) {
+	return buildDomainEventFactory(options, "DomainEventFactory.create");
+}
+/** `createOperation` is the name that the errors of `create` give. */
+function buildDomainEventFactory(options, createOperation) {
 	const eventIdFactory = options.eventIdFactory ?? defaultEventIdFactory;
 	const clock = options.clock ?? defaultClockFactory;
 	const { source } = options;
-	const create = ((type, payload, createOptions) => mintDomainEvent(type, payload, withFactorySource(createOptions, source), eventIdFactory, clock));
+	const create = ((type, payload, createOptions) => mintDomainEvent(type, payload, createOptions, eventIdFactory, clock, createOperation, source));
 	const createStamp = (stampOptions = {}) => {
 		const explicitOccurredAt = stampOptions.occurredAt === void 0 ? void 0 : copyValidEventDate(stampOptions.occurredAt);
 		if (stampOptions.eventId !== void 0) assertNonBlankEventField(stampOptions.eventId, "eventId", "EVENT_ID_INVALID");
@@ -1343,7 +1630,7 @@ function createDomainEventFactory(options = {}) {
 		const stamp = {
 			eventId,
 			occurredAt: explicitOccurredAt ?? readEventClock(clock),
-			metadata: cloneOwnedEventData(withFactorySource(stampOptions, source).metadata, "metadata")
+			metadata: ownedEventMetadata(stampOptions.metadata, "DomainEventFactory.createStamp", source)
 		};
 		const owned = deepFreeze(stamp);
 		FACTORY_OWNED_EVENT_STAMPS.add(owned);
@@ -1360,46 +1647,7 @@ function createDomainEventFactory(options = {}) {
 * {@link createDomainEvent}. It cannot be reconfigured; construct an instance
 * with {@link createDomainEventFactory} for custom policy.
 */
-const defaultDomainEventFactory = createDomainEventFactory();
-/**
-* Creates a domain event with default values.
-* Sets occurredAt to current date and schemaVersion to 1 if not provided.
-*
-* **Input ownership.** The event is deeply frozen, and `payload` and
-* `metadata` are deep-cloned first, so the caller's own objects are never
-* frozen in place and later mutation of them does not bleed into the
-* event (same contract as `vo()`). The clone follows the plain-data event
-* contract via `structuredClone`: functions, Promise, and WeakMap/WeakSet
-* values throw a `TypeError`; symbol-keyed properties are not carried
-* over.
-*
-* **For aggregate-internal events, prefer `this.createEvent(...)` on
-* `StateStoredAggregate` / `EventSourcedAggregate`.** That helper auto-injects
-* `aggregateId` (from `this.id`) and `aggregateType` (from the
-* aggregate's declared `aggregateType` property), which downstream
-* consumers (outbox dispatchers, projection handlers, audit logs)
-* route by. The commit boundary validates that both fields are present
-* and throws if they are missing, so a direct `createDomainEvent(...)`
-* call inside an aggregate that forgets the options is caught at
-* runtime. Record pending decisions in the application
-* shell before repository persistence or outbox harvest.
-*
-* Use `createDomainEvent(...)` directly for events that don't belong to
-* an aggregate: system events, integration events, configuration events,
-* test fixtures. For those, set `aggregateId` / `aggregateType` in
-* `options` if downstream consumers expect routing metadata.
-*
-* @param type - The event type
-* @param payload - The event payload
-* @param options - Optional event configuration (including `aggregateId`
-*   and `aggregateType` for routing)
-* @returns A domain event
-*
-* @example
-* ```typescript
-* const event = createDomainEvent("OrderCreated", { orderId: "123" });
-* ```
-*/
+const defaultDomainEventFactory = buildDomainEventFactory({}, "createDomainEvent");
 const RECORDED_EVENTS = /* @__PURE__ */ new WeakSet();
 const UNCOMMITTED_EVENTS = /* @__PURE__ */ new WeakSet();
 const FACTORY_OWNED_EVENT_STAMPS = /* @__PURE__ */ new WeakSet();
@@ -1435,12 +1683,20 @@ function isUncommittedDomainEvent(event) {
 	return UNCOMMITTED_EVENTS.has(event) || hasCooperativeBrand(event, UNCOMMITTED_BRAND);
 }
 function createUncommittedDomainEvent(type, payload, options) {
+	return mintUncommittedDomainEvent(type, payload, options, "createUncommittedDomainEvent");
+}
+/**
+* {@link createUncommittedDomainEvent} whose errors name `operation`, the
+* function that the caller called. Module-internal export; not part of the
+* package entries.
+*/
+function mintUncommittedDomainEvent(type, payload, options, operation) {
 	assertProducerOwnedEventFields(type, options);
 	const event = {
 		type,
 		aggregateId: options?.aggregateId,
 		aggregateType: options?.aggregateType,
-		payload: cloneOwnedEventData(payload, "payload"),
+		payload: cloneOwnedEventData(payload, "payload", operation),
 		schemaVersion: options?.schemaVersion ?? 1
 	};
 	stampUncommittedBrand(event);
@@ -1458,16 +1714,16 @@ function adoptUncommittedDomainEvent(copy) {
 /**
 * Attaches shell-owned recording data to an accepted aggregate decision.
 *
-* The decision supplies the domain type, payload, source address, and payload
-* schema version. The stamp supplies only event identity, recording time, and
-* trace metadata.
+* The decision supplies the domain type, payload, source aggregate
+* identity, and payload schema version. The stamp supplies only event
+* identity, recording time, and trace metadata.
 */
 function recordDomainEvent(event, stamp) {
 	if (!isUncommittedDomainEvent(event)) throw new TypeError("recordDomainEvent requires an event created by createUncommittedDomainEvent");
 	if (isFactoryOwnedDomainEventStamp(stamp)) return mintRecordedEvent(event, stamp.eventId, stamp.occurredAt, stamp.metadata);
 	assertNonBlankEventField(stamp.eventId, "eventId", "EVENT_ID_INVALID");
 	const occurredAt = deepFreeze(copyValidEventDate(stamp.occurredAt));
-	const metadata = cloneOwnedEventData(stamp.metadata, "metadata");
+	const metadata = ownedEventMetadata(stamp.metadata, "recordDomainEvent");
 	return mintRecordedEvent(event, stamp.eventId, occurredAt, metadata === void 0 ? void 0 : deepFreeze(metadata));
 }
 /**
@@ -1496,7 +1752,8 @@ function mintRecordedEvent(event, eventId, occurredAt, metadata) {
 }
 /**
 * Brands, freezes, and registers a kit-derived copy of a recorded event
-* (e.g. the address-stamped copy `apply()` creates) as recorded itself.
+* (e.g. the copy `apply()` stamps with the aggregate identity) as recorded
+* itself.
 * The copy shares the already-frozen payload/metadata of its source,
 * so the mint guarantee carries over. Stamping the cooperative brand
 * before freezing keeps the copy recognizable by another loaded kit
@@ -1515,7 +1772,7 @@ function createDomainEvent(type, payload, options) {
 function createDomainEventFromFacts(type, payload, options) {
 	if (options?.eventId === void 0) missingExplicitEventId();
 	if (options.occurredAt === void 0) missingExplicitOccurredAt();
-	return mintDomainEvent(type, payload, options, missingExplicitEventId, missingExplicitOccurredAt);
+	return mintDomainEvent(type, payload, options, missingExplicitEventId, missingExplicitOccurredAt, "createDomainEventFromFacts");
 }
 function missingExplicitEventId() {
 	throw new DomainEventValidationError("EVENT_ID_REQUIRED", "eventId", "createDomainEventFromFacts requires an explicit eventId");
@@ -1523,7 +1780,7 @@ function missingExplicitEventId() {
 function missingExplicitOccurredAt() {
 	throw new DomainEventValidationError("EVENT_OCCURRED_AT_REQUIRED", "occurredAt", "createDomainEventFromFacts requires an explicit occurredAt");
 }
-function mintDomainEvent(type, payload, options, eventIdFactory, clock) {
+function mintDomainEvent(type, payload, options, eventIdFactory, clock, operation, factorySource) {
 	assertProducerOwnedEventFields(type, options);
 	const eventId = options?.eventId ?? eventIdFactory();
 	assertNonBlankEventField(eventId, "eventId", "EVENT_ID_INVALID");
@@ -1534,10 +1791,10 @@ function mintDomainEvent(type, payload, options, eventIdFactory, clock) {
 		type,
 		aggregateId: options?.aggregateId,
 		aggregateType: options?.aggregateType,
-		payload: cloneOwnedEventData(payload, "payload"),
+		payload: cloneOwnedEventData(payload, "payload", operation),
 		occurredAt,
 		schemaVersion,
-		metadata: cloneOwnedEventData(options?.metadata, "metadata")
+		metadata: ownedEventMetadata(options?.metadata, operation, factorySource)
 	};
 	stampRecordedBrand(event);
 	const minted = deepFreeze(event);
@@ -1548,8 +1805,8 @@ function assertProducerOwnedEventFields(type, options) {
 	assertNonBlankEventField(type, "type", "EVENT_TYPE_INVALID");
 	const schemaVersion = options?.schemaVersion ?? 1;
 	if (!Number.isSafeInteger(schemaVersion) || typeof schemaVersion !== "number" || schemaVersion < 1) throw new DomainEventValidationError("EVENT_SCHEMA_VERSION_INVALID", "schemaVersion", "domain-event schemaVersion must be a safe integer greater than or equal to 1");
-	if (options?.aggregateId !== void 0) assertNonBlankEventField(options.aggregateId, "aggregateId", "EVENT_ADDRESS_INVALID");
-	if (options?.aggregateType !== void 0) assertNonBlankEventField(options.aggregateType, "aggregateType", "EVENT_ADDRESS_INVALID");
+	if (options?.aggregateId !== void 0) assertNonBlankEventField(options.aggregateId, "aggregateId", "EVENT_AGGREGATE_IDENTITY_INVALID");
+	if (options?.aggregateType !== void 0) assertNonBlankEventField(options.aggregateType, "aggregateType", "EVENT_AGGREGATE_IDENTITY_INVALID");
 }
 function assertNonBlankEventField(value, field, code) {
 	if (typeof value !== "string" || value.trim().length === 0) throw new DomainEventValidationError(code, field, `domain-event ${field} must be a non-blank string`);
@@ -1562,59 +1819,47 @@ function readEventClock(clock) {
 	return copyValidEventDate(clock());
 }
 /**
-* Deep-clones caller-supplied event data (payload, metadata) before the
-* event is frozen, so `createDomainEvent` never freezes or aliases the
-* caller's own object graph. Primitives pass through unchanged.
-*
-* Uses `structuredClone`, which matches the documented plain-data event
-* contract: functions, Promise, and WeakMap/WeakSet values throw a
-* descriptive `TypeError` (they are not data); symbol-keyed properties
-* are not carried over; a class instance would silently lose its
-* prototype, which the plain-data contract already rules out.
+* Copies the caller's metadata and checks the copy. Metadata is a plain
+* record or absent; a null from a JSON envelope would mint and then fail
+* every metadata read far from the producer. A factory origin fills
+* `source` only after the check, and a call site that names its own source
+* keeps it: an explicit fact about one event outranks the default of the
+* factory that mints it.
 */
-function cloneOwnedEventData(value, field) {
-	if (typeof value === "function") throw new TypeError(`createDomainEvent: ${field} must not be a function: domain events are plain data`);
-	if (value === null && field === "metadata") throw new TypeError("createDomainEvent: metadata must be an object or undefined; received null");
-	if (value === null || typeof value !== "object") return value;
-	assertNoHostileOwnProtoKey(value, field === "payload" ? "Event payload" : "Event metadata");
-	assertNoBinaryData(value, field);
-	try {
-		return structuredClone(value);
-	} catch (cause) {
-		throw new TypeError(`createDomainEvent: ${field} must be plain, structured-cloneable data (no functions, Promises, or WeakMap/WeakSet values): domain events are plain data`, { cause });
+function ownedEventMetadata(metadata, operation, factorySource) {
+	if (metadata === void 0) return factorySource === void 0 ? void 0 : { source: factorySource };
+	const owned = cloneOwnedEventData(metadata, "metadata", operation);
+	if (!isPlainRecordCopy(owned)) {
+		const received = typeof owned === "object" ? owned === null ? "null" : Object.prototype.toString.call(owned) : `a ${typeof owned}`;
+		throw new TypeError(`${operation}: metadata must be an object or undefined, and a plain record; received ${received}`);
 	}
+	const record = owned;
+	if (factorySource === void 0 || record.source !== void 0) return record;
+	return {
+		...record,
+		source: factorySource
+	};
 }
-function isBinaryData(value) {
-	return ArrayBuffer.isView(value) || value instanceof ArrayBuffer || typeof SharedArrayBuffer !== "undefined" && value instanceof SharedArrayBuffer;
+/**
+* True for a structured-clone copy of a plain record. A runtime such as
+* Vercel Edge returns the copy with the `Object.prototype` of another realm,
+* so the check compares the source text of the constructor, not the
+* prototype object.
+*/
+function isPlainRecordCopy(copy) {
+	if (typeof copy !== "object" || copy === null) return false;
+	const prototype = Object.getPrototypeOf(copy);
+	return prototype !== null && isIntrinsicConstructorPrototype(prototype, "Object") && Object.getPrototypeOf(prototype) === null;
 }
 /**
-* Walks caller-supplied event data and rejects binary buffers anywhere
-* in the graph (TypedArray, DataView, ArrayBuffer, SharedArrayBuffer):
-* they are mutable by construction, so the deep-freeze that backs the
-* mint guarantee cannot cover them. Runs before the structured clone,
-* on the small plain-data graphs events are documented to carry.
+* Deep-clones caller-supplied event data (payload, metadata) before the
+* event is frozen, so a constructor never freezes or aliases the caller's
+* own object graph. {@link detachFreezableState} checks the data and the
+* clone; its JSDoc states the rule and its limits.
 */
-function assertNoBinaryData(value, field, visited = /* @__PURE__ */ new WeakSet()) {
-	if (value === null || typeof value !== "object") return;
-	if (isBinaryData(value)) throw new TypeError(`createDomainEvent: ${field} must not contain binary buffers (TypedArray, DataView, ArrayBuffer, SharedArrayBuffer): they stay mutable under freezing and do not survive JSON. Encode binary as a string (base64/hex) or store it outside the event.`);
-	if (visited.has(value)) return;
-	visited.add(value);
-	if (value instanceof Map) {
-		for (const [k, v] of value) {
-			assertNoBinaryData(k, field, visited);
-			assertNoBinaryData(v, field, visited);
-		}
-		return;
-	}
-	if (value instanceof Set) {
-		for (const v of value) assertNoBinaryData(v, field, visited);
-		return;
-	}
-	if (Array.isArray(value)) {
-		for (const v of value) assertNoBinaryData(v, field, visited);
-		return;
-	}
-	for (const key of Object.keys(value)) assertNoBinaryData(value[key], field, visited);
+function cloneOwnedEventData(value, field, operation) {
+	if (value !== null && typeof value === "object") assertNoHostileOwnProtoKey(value, `Event ${field} of ${operation}`);
+	return detachFreezableState(value, `${operation}: ${field}`);
 }
 /**
 * Copies metadata from a source event to a new event.
@@ -1687,6 +1932,29 @@ function mergeMetadata(...metadataObjects) {
 function abortReason(signal, fallbackMessage) {
 	return signal.reason ?? new Error(fallbackMessage);
 }
+/**
+* Waits for `promise`, but REJECTS with the signal's reason as soon as the
+* signal fires. The promise keeps running; only the wait ends. The abort
+* listener goes away when the promise settles.
+*/
+function waitRejectingOnAbort(promise, signal, abortMessage) {
+	if (signal === void 0) return promise;
+	return new Promise((resolve, reject) => {
+		if (signal.aborted) {
+			reject(abortReason(signal, abortMessage));
+			return;
+		}
+		const onAbort = () => reject(abortReason(signal, abortMessage));
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then((value) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+	});
+}
 
 //#endregion
 //#region src/internal/validate.ts
@@ -1699,6 +1967,15 @@ function abortReason(signal, fallbackMessage) {
 function assertNonNegativeFinite(context, field, value) {
 	if (!Number.isFinite(value) || value < 0) throw new Error(`${context}: ${field} must be a non-negative finite number, got ${value}`);
 }
+/**
+* The largest delay that `setTimeout` honors. A larger delay does not wait
+* longer: the runtime fires the timer after about 1 ms.
+*/
+const MAX_TIMER_DELAY_MS = 2147483647;
+/** Guard for time options that a timer waits for, in milliseconds. */
+function assertTimerDelay(context, field, value) {
+	if (!Number.isFinite(value) || value < 0 || value > 2147483647) throw new RangeError(`${context}: ${field} must be a finite number of milliseconds from 0 to ${MAX_TIMER_DELAY_MS}, got ${value}`);
+}
 /** Guard for count options that must be a whole number of at least 1. */
 function assertPositiveInteger(context, field, value) {
 	if (!Number.isInteger(value) || value < 1) throw new Error(`${context}: ${field} must be an integer >= 1, got ${value}`);
@@ -1707,6 +1984,10 @@ function assertPositiveInteger(context, field, value) {
 function assertPositiveSafeInteger(context, field, value) {
 	if (!Number.isSafeInteger(value) || value < 1) throw new RangeError(`${context}: ${field} must be a positive safe integer, got ${value}`);
 }
+/** Guard for stream positions that must fit exact JS integers. */
+function assertNonNegativeSafeInteger(context, field, value) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new RangeError(`${context}: ${field} must be a non-negative safe integer, got ${value}`);
+}
 
 //#endregion
 //#region src/internal/async/execution.ts
@@ -1741,11 +2022,12 @@ function ownerSignalOf(signal) {
 * enforce a native timeout no later than `context.deadlineAt`.
 */
 function runBoundedExecution(label, options, operation) {
-	if (options.deadlineAt === void 0) assertNonNegativeFinite(label, "timeoutMs", options.timeoutMs);
+	if (options.deadlineAt === void 0) assertTimerDelay(label, "timeoutMs", options.timeoutMs);
 	else assertNonNegativeFinite(label, "deadlineAt", options.deadlineAt);
 	const startedAt = Date.now();
 	const deadlineAt = options.deadlineAt ?? startedAt + options.timeoutMs;
 	const timeoutMs = Math.max(0, deadlineAt - startedAt);
+	if (options.deadlineAt !== void 0) assertTimerDelay(label, "the time until deadlineAt", timeoutMs);
 	const timeoutError = () => new DOMException(`${label} timed out after ${timeoutMs}ms`, "TimeoutError");
 	const controller = new AbortController();
 	const context = Object.freeze({
@@ -1811,5 +2093,211 @@ function isDispatchTrackingOutbox(outbox) {
 }
 
 //#endregion
-export { voWithValidation as A, hasCooperativeBrand as C, vo as D, deepFreeze as E, findPropertyDescriptor as F, hasIntrinsicPrototypeChain as I, isBuiltInObject as L, deepOmit as M, deepEqual as N, voEquals as O, builtInTagWithoutInvokingAccessors as P, isIntrinsicConstructorPrototype as R, SnapshotTimeValidationError as S, ValueObject as T, isRecordedDomainEvent as _, assertNonNegativeFinite as a, recordDomainEvent as b, abortReason as c, copyMetadata as d, createDomainEvent as f, defaultDomainEventFactory as g, createUncommittedDomainEvent as h, runBoundedExecution as i, deepEqualExcept as j, voEqualsExcept as k, adoptRecordedDomainEvent as l, createDomainEventFromFacts as m, DEFAULT_EXECUTION_TIMEOUT_MS as n, assertPositiveInteger as o, createDomainEventFactory as p, ownerSignalOf as r, assertPositiveSafeInteger as s, isDispatchTrackingOutbox as t, adoptUncommittedDomainEvent as u, isUncommittedDomainEvent as v, stampCooperativeBrand as w, DomainEventValidationError as x, mergeMetadata as y, isWeakMap as z };
-//# sourceMappingURL=ports.js.map
+//#region src/persistence/event-store/event-stream-page-guards.ts
+function assertValidHead(stream, lastVersion, fromVersion, targetVersion) {
+	if (Number.isSafeInteger(lastVersion) && lastVersion >= 1) return;
+	throw new InvalidEventStreamPageError({
+		identity: stream,
+		reason: "invalid_head",
+		fromVersion,
+		targetVersion,
+		lastVersion
+	});
+}
+function assertHeadNotBehindFirstPage(stream, lastVersion, firstPageLastVersion, fromVersion, targetVersion) {
+	if (lastVersion >= firstPageLastVersion) return;
+	throw new InvalidEventStreamPageError({
+		identity: stream,
+		reason: "head_regressed",
+		fromVersion,
+		targetVersion,
+		lastVersion,
+		firstPageLastVersion
+	});
+}
+function assertPageNotEmpty(stream, eventCount, fromVersion, targetVersion) {
+	if (eventCount > 0) return;
+	throw new InvalidEventStreamPageError({
+		identity: stream,
+		reason: "empty_page",
+		fromVersion,
+		targetVersion
+	});
+}
+function assertPageWithinWindow(stream, eventCount, fromVersion, targetVersion) {
+	if (eventCount <= targetVersion - fromVersion) return;
+	throw new InvalidEventStreamPageError({
+		identity: stream,
+		reason: "page_past_target",
+		fromVersion,
+		targetVersion,
+		eventCount
+	});
+}
+function assertPageWithinLimit(stream, eventCount, limit, fromVersion, targetVersion) {
+	if (eventCount <= limit) return;
+	throw new InvalidEventStreamPageError({
+		identity: stream,
+		reason: "page_over_limit",
+		fromVersion,
+		targetVersion,
+		eventCount,
+		limit
+	});
+}
+
+//#endregion
+//#region src/persistence/event-store/read-stream-pages.ts
+/**
+* Pins the target version of a replay window on an existing stream, or
+* reports the window as unreachable.
+*
+* The target version is `toVersion` when given, else `lastVersion`. The
+* window is unreachable when `fromVersion` lies beyond the target version,
+* or the target version lies beyond `lastVersion`. The call never clamps
+* such a window to the head, so a request for version 10 of a stream that
+* ends at 7 never loads the latest state by accident.
+*
+* This is the decision `readStreamPages` makes on its first page. An
+* adapter that pages on its own makes it with this call, then hands its
+* pages to `reconstituteAggregateFromStreamPages`. Values that are not safe
+* integers, a negative `fromVersion`, and a `toVersion` or `lastVersion`
+* below 1 reject with `RangeError`: an existing stream holds at least one
+* event, and no replay can end at version 0.
+*/
+function pinTargetVersion(options) {
+	assertNonNegativeSafeInteger("pinTargetVersion", "fromVersion", options.fromVersion);
+	if (options.toVersion !== void 0) assertPositiveSafeInteger("pinTargetVersion", "toVersion", options.toVersion);
+	assertPositiveSafeInteger("pinTargetVersion", "lastVersion", options.lastVersion);
+	return decideTargetVersion(options);
+}
+function decideTargetVersion(window) {
+	const targetVersion = window.toVersion ?? window.lastVersion;
+	if (window.fromVersion > targetVersion || targetVersion > window.lastVersion) return { reachable: false };
+	return {
+		reachable: true,
+		targetVersion
+	};
+}
+/**
+* Reads one stream in bounded pages up to a pinned target version.
+*
+* The call reads the first page. That page decides existence and reports
+* the head. The call then makes the window decision of
+* {@link pinTargetVersion}: the target version is `toVersion` when given,
+* else the head, and a window outside the stream is unreachable.
+*
+* The first iteration of `pages` yields the first page that the call read
+* and then reads the continuation pages, one page at a time. Every later
+* iteration reads all pages from the store again, so no two iterations
+* share an event object. Each of these reads passes the target version as
+* `toVersion` and starts after the events that the earlier pages
+* returned. Streams are append-only, so an iteration yields one stable
+* prefix even when another writer appends during the replay.
+*
+* The call checks every page against the `readStream` contract and throws
+* {@link InvalidEventStreamPageError} for a page that breaks it: a head
+* that is not a safe integer of at least 1, an empty page while events
+* remain in the window, a page with more events than its window has left
+* or than `limit`, and a continuation page that reports the stream absent
+* or a head below the head of the first page.
+*
+* Invalid options reject with `RangeError` before any page is read:
+* `limit` and `toVersion` must be positive safe integers, `fromVersion` a
+* non-negative one. The call passes `signal` to every page read, and it
+* checks the signal before each page read as well. An aborted signal
+* rejects with its `reason`.
+*/
+async function readStreamPages(reader, stream, options) {
+	assertPositiveSafeInteger("readStreamPages", "limit", options.limit);
+	const fromVersion = options.fromVersion ?? 0;
+	assertNonNegativeSafeInteger("readStreamPages", "fromVersion", fromVersion);
+	if (options.toVersion !== void 0) assertPositiveSafeInteger("readStreamPages", "toVersion", options.toVersion);
+	throwIfAborted(options.signal);
+	const identity = {
+		aggregateType: stream.aggregateType,
+		aggregateId: stream.aggregateId
+	};
+	const first = await reader.readStream(identity, {
+		fromVersion,
+		limit: options.limit,
+		...options.toVersion === void 0 ? {} : { toVersion: options.toVersion },
+		...options.signal === void 0 ? {} : { signal: options.signal }
+	});
+	if (!first.exists) return {
+		exists: false,
+		reachable: false
+	};
+	assertValidHead(identity, first.lastVersion, fromVersion);
+	const pinned = decideTargetVersion({
+		fromVersion,
+		toVersion: options.toVersion,
+		lastVersion: first.lastVersion
+	});
+	if (!pinned.reachable) return {
+		exists: true,
+		reachable: false,
+		fromVersion,
+		lastVersion: first.lastVersion
+	};
+	if (fromVersion < pinned.targetVersion) assertPageNotEmpty(identity, first.events.length, fromVersion, pinned.targetVersion);
+	assertPageWithinWindow(identity, first.events.length, fromVersion, pinned.targetVersion);
+	assertPageWithinLimit(identity, first.events.length, options.limit, fromVersion, pinned.targetVersion);
+	const window = {
+		stream: identity,
+		fromVersion,
+		firstPageLastVersion: first.lastVersion,
+		targetVersion: pinned.targetVersion,
+		limit: options.limit,
+		signal: options.signal
+	};
+	let unreadFirstPage = first.events;
+	return {
+		exists: true,
+		reachable: true,
+		stream: identity,
+		fromVersion,
+		targetVersion: pinned.targetVersion,
+		pages: { [Symbol.asyncIterator]: () => {
+			const firstPage = unreadFirstPage;
+			unreadFirstPage = void 0;
+			return readPinnedPages(reader, window, firstPage);
+		} }
+	};
+}
+async function* readPinnedPages(reader, window, firstPage) {
+	let cursor = window.fromVersion;
+	if (firstPage !== void 0) {
+		if (firstPage.length > 0) yield firstPage;
+		cursor += firstPage.length;
+	}
+	while (cursor < window.targetVersion) {
+		throwIfAborted(window.signal);
+		const page = await reader.readStream(window.stream, {
+			fromVersion: cursor,
+			toVersion: window.targetVersion,
+			limit: window.limit,
+			...window.signal === void 0 ? {} : { signal: window.signal }
+		});
+		if (!page.exists) throw new InvalidEventStreamPageError({
+			identity: window.stream,
+			reason: "stream_vanished",
+			fromVersion: cursor,
+			targetVersion: window.targetVersion
+		});
+		assertValidHead(window.stream, page.lastVersion, cursor, window.targetVersion);
+		assertHeadNotBehindFirstPage(window.stream, page.lastVersion, window.firstPageLastVersion, cursor, window.targetVersion);
+		assertPageNotEmpty(window.stream, page.events.length, cursor, window.targetVersion);
+		assertPageWithinWindow(window.stream, page.events.length, cursor, window.targetVersion);
+		assertPageWithinLimit(window.stream, page.events.length, window.limit, cursor, window.targetVersion);
+		yield page.events;
+		cursor += page.events.length;
+	}
+}
+function throwIfAborted(signal) {
+	if (signal?.aborted) throw abortReason(signal, "readStreamPages aborted");
+}
+
+//#endregion
+export { SnapshotTimeValidationError as A, stampCooperativeBrand as B, defaultDomainEventFactory as C, mintUncommittedDomainEvent as D, mergeMetadata as E, vo as F, isBuiltInObject as G, deepOmit as H, voEquals as I, isIntrinsicConstructorPrototype as K, voEqualsExcept as L, detachState as M, ValueObject as N, recordDomainEvent as O, deepFreeze as P, voWithValidation as R, createUncommittedDomainEvent as S, isUncommittedDomainEvent as T, deepEqual as U, deepEqualExcept as V, findPropertyDescriptor as W, adoptUncommittedDomainEvent as _, isDispatchTrackingOutbox as a, createDomainEventFactory as b, runBoundedExecution as c, assertPositiveInteger as d, assertPositiveSafeInteger as f, adoptRecordedDomainEvent as g, waitRejectingOnAbort as h, assertPageWithinWindow as i, detachFreezableState as j, DomainEventValidationError as k, MAX_TIMER_DELAY_MS as l, abortReason as m, readStreamPages as n, DEFAULT_EXECUTION_TIMEOUT_MS as o, assertTimerDelay as p, isWeakMap as q, assertPageNotEmpty as r, ownerSignalOf as s, pinTargetVersion as t, assertNonNegativeSafeInteger as u, copyMetadata as v, isRecordedDomainEvent as w, createDomainEventFromFacts as x, createDomainEvent as y, hasCooperativeBrand as z };
+//# sourceMappingURL=read-stream-pages.js.map