@shirudo/ddd-kit 3.0.0-rc.10 → 3.0.0-rc.12

package/dist/chunks/snapshot-store.d.ts

@@ -1,4 +1,4 @@
-import { u as DomainError } from "./kit-errors.js";
+import { f as DomainError, ot as ReplayRejectedError } from "./kit-errors.js";
 import { Result } from "@shirudo/result";
 //#region src/internal/json-value.d.ts
 /** A primitive value represented without loss by JSON. */
@@ -160,9 +160,9 @@ interface PublishedCommand<TType extends string = string, TPayload extends JsonV
  */
 type CommandHandler<C extends Command, R, E = string> = (cmd: C) => Promise<Result<R, E>>;
 //#endregion
-//#region src/domain/aggregate/aggregate-address.d.ts
+//#region src/domain/aggregate/aggregate-identity.d.ts
 /**
- * Stable value address of one aggregate instance.
+ * The identity of one aggregate instance, as a value.
  *
  * Aggregate ids are type-scoped, so the raw id alone is not globally unique:
  * `SalesOrder 1` and `FulfillmentOrder 1` are different aggregates. Event
@@ -170,13 +170,14 @@ type CommandHandler<C extends Command, R, E = string> = (cmd: C) => Promise<Resu
  * therefore carry both fields instead of defining boundary-specific variants.
  *
  * `aggregateType` is a stable technical stream category. Renaming it changes
- * persistence keys and orphans checkpoints unless the stored addresses are
- * migrated. When bounded contexts share infrastructure and reuse a domain
- * name, qualify it at the source (`sales.order`, `fulfillment.order`). The kit
+ * persistence keys and orphans checkpoints unless the stored aggregate
+ * identities are migrated. When bounded contexts share infrastructure and
+ * reuse a domain name, qualify it at the source (`sales.order`,
+ * `fulfillment.order`). The kit
  * deliberately adds no separate `boundedContext` field: qualification remains
  * the consumer's naming decision.
  */
-interface AggregateAddress<TAggregateId extends string = string> {
+interface AggregateIdentity<TAggregateId extends string = string> {
   readonly aggregateType: string;
   readonly aggregateId: TAggregateId;
 }
@@ -323,8 +324,9 @@ type AnyDomainEvent = DomainEvent<string, unknown>;
  * A domain event accepted by an aggregate but not yet given its recording
  * identity, recording time, or delivery metadata.
  *
- * The aggregate owns the event type, payload, source address, and payload
- * schema version because those values describe the business fact it produced.
+ * The aggregate owns the event type, payload, source aggregate identity,
+ * and payload schema version because those values describe the business
+ * fact it produced.
  * The application shell later turns this value into a {@link DomainEvent}.
  */
 interface UncommittedDomainEvent<T extends string, P = void> {
@@ -434,6 +436,27 @@ interface DomainEventFactory {
    */
   readonly now: () => Date;
 }
+/**
+ * Creates an immutable, instance-bound domain-event factory.
+ *
+ * The supplied functions are read once and captured by value. The returned
+ * object is frozen, so another request, test, or library cannot replace its
+ * policy. Its {@link DomainEventFactory.createStamp} method is the
+ * application-shell bridge that records an accepted aggregate decision.
+ * Passing the factory through `AggregateConfig`
+ * enables the explicitly named convenience methods, whose defaults read time
+ * and randomness.
+ *
+ * @example
+ * ```ts
+ * const domainEvents = createDomainEventFactory({
+ *   eventIdFactory: () => uuidv7(),
+ *   clock: () => new Date(),
+ * });
+ * order.confirm();
+ * recordPendingEvents(order, domainEvents);
+ * ```
+ */
 declare function createDomainEventFactory(options?: DomainEventFactoryOptions): DomainEventFactory;
 /**
  * Immutable UUID-v4/platform-clock factory used by the top-level
@@ -441,16 +464,71 @@ declare function createDomainEventFactory(options?: DomainEventFactoryOptions):
  * with {@link createDomainEventFactory} for custom policy.
  */
 declare const defaultDomainEventFactory: DomainEventFactory;
+/**
+ * Creates an uncommitted domain event: the event that an aggregate method
+ * returns before the application shell records it. The payload and the
+ * metadata follow the input ownership rule of {@link createDomainEvent}.
+ */
 declare function createUncommittedDomainEvent<T extends string>(type: T, payload?: undefined, options?: CreateUncommittedDomainEventOptions): UncommittedDomainEvent<T, void>;
 declare function createUncommittedDomainEvent<T extends string, P>(type: T, payload: P, options?: CreateUncommittedDomainEventOptions): UncommittedDomainEvent<T, P>;
 /**
  * Attaches shell-owned recording data to an accepted aggregate decision.
  *
- * The decision supplies the domain type, payload, source address, and payload
- * schema version. The stamp supplies only event identity, recording time, and
- * trace metadata.
+ * The decision supplies the domain type, payload, source aggregate
+ * identity, and payload schema version. The stamp supplies only event
+ * identity, recording time, and trace metadata.
  */
 declare function recordDomainEvent<T extends string, P>(event: UncommittedDomainEvent<T, P>, stamp: DomainEventStamp): DomainEvent<T, P>;
+/**
+ * Creates a domain event with default values.
+ * Sets occurredAt to current date and schemaVersion to 1 if not provided.
+ *
+ * **Input ownership.** The event is deeply frozen, and `payload` and
+ * `metadata` are deep-cloned first, so the caller's own objects are never
+ * frozen in place and later mutation of them does not bleed into the event
+ * (same contract as `vo()`). The event data rule checks the data before the
+ * copy and the copy after it. So the copy loses no data without an error,
+ * and no getter of the data runs. The in-memory event store applies the
+ * same rule on append. The checks catch accidents, not a hostile `Proxy`: a
+ * trap that changes the data during the check can hide a loss. An error
+ * that a `Proxy` trap throws passes unchanged, so a coded error of the
+ * caller keeps its code. These values throw a `TypeError`: a function, a
+ * Promise, a WeakMap or a WeakSet, an `Error`, a host object such as a
+ * `File`, a binary buffer, a `RegExp`, and shared memory. The same holds
+ * for what the copy would lose or change: a class instance, an accessor, an
+ * enumerable symbol-keyed property, a non-enumerable data property, and an
+ * expando on a built-in. A non-enumerable symbol key is metadata by
+ * convention, and the event does not get it. Map a value object to plain
+ * data before it goes into an event. `toJSON()` of a `ValueObject` is
+ * shallow, so map a nested value object too.
+ *
+ * **For aggregate-internal events, prefer `this.createEvent(...)` on
+ * `StateStoredAggregate` / `EventSourcedAggregate`.** That helper auto-injects
+ * `aggregateId` (from `this.id`) and `aggregateType` (from the
+ * aggregate's declared `aggregateType` property), which downstream
+ * consumers (outbox dispatchers, projection handlers, audit logs)
+ * route by. The commit boundary validates that both fields are present
+ * and throws if they are missing, so a direct `createDomainEvent(...)`
+ * call inside an aggregate that forgets the options is caught at
+ * runtime. Record pending decisions in the application
+ * shell before repository persistence or outbox harvest.
+ *
+ * Use `createDomainEvent(...)` directly for events that don't belong to
+ * an aggregate: system events, integration events, configuration events,
+ * test fixtures. For those, set `aggregateId` / `aggregateType` in
+ * `options` if downstream consumers expect routing metadata.
+ *
+ * @param type - The event type
+ * @param payload - The event payload
+ * @param options - Optional event configuration (including `aggregateId`
+ *   and `aggregateType` for routing)
+ * @returns A domain event
+ *
+ * @example
+ * ```typescript
+ * const event = createDomainEvent("OrderCreated", { orderId: "123" });
+ * ```
+ */
 declare function createDomainEvent<T extends string>(type: T, payload?: undefined, options?: CreateDomainEventOptions): DomainEvent<T, void>;
 declare function createDomainEvent<T extends string, P>(type: T, payload: P, options?: CreateDomainEventOptions): DomainEvent<T, P>;
 /**
@@ -531,7 +609,7 @@ type EventCommitCandidatePosition = Omit<CommitPosition, "previousEventfulAggreg
  */
 interface EventCommitCandidate<Evt extends AnyDomainEvent> {
   readonly event: Evt;
-  readonly source: AggregateAddress;
+  readonly source: AggregateIdentity;
   readonly position: EventCommitCandidatePosition;
 }
 /**
@@ -541,7 +619,7 @@ interface EventCommitCandidate<Evt extends AnyDomainEvent> {
  */
 interface CommittedDomainEvent<Evt extends AnyDomainEvent> {
   readonly event: Evt;
-  readonly source: AggregateAddress;
+  readonly source: AggregateIdentity;
   readonly position: CommitPosition;
 }
 //#endregion
@@ -625,6 +703,22 @@ interface OutboxWriter<Evt extends AnyDomainEvent> {
    * should reject it rather than replace or silently reinterpret it as a retry.
    */
   add: (events: ReadonlyArray<EventCommitCandidate<Evt>>) => Promise<void>;
+  /**
+   * Ends the event sources of removed aggregates. Called from inside
+   * `withCommit`'s transactional callback, after `add()`, atomically with
+   * the removal.
+   *
+   * For every source that has a head, the adapter marks the head as ended
+   * in the SAME transaction. The mark must outlive any retention of heads:
+   * a pruned ended head opens the source again. A source without a head
+   * has no events, so it has no continuity to protect: it stays open, and
+   * its first event starts a new head. After the mark, `add()` must reject
+   * a new event of that source: its aggregate was created again under a
+   * removed identity, which the kit does not support. An exact retry of a
+   * stored event stays idempotent, and ending a source twice is not an
+   * error.
+   */
+  endEventSources: (sources: ReadonlyArray<AggregateIdentity>) => Promise<void>;
 }
 /**
  * Transactional outbox port: the bridge between the write-side
@@ -773,7 +867,7 @@ interface DurableCommandMessage<C extends PublishedCommand> extends CommandMessa
  */
 interface CommandCommitOriginCandidate {
   readonly eventId: string;
-  readonly source: AggregateAddress;
+  readonly source: AggregateIdentity;
   readonly position: EventCommitCandidatePosition;
 }
 /**
@@ -801,6 +895,14 @@ interface CommandOutboxCommitCandidate<C extends PublishedCommand> {
  */
 interface CommandOutboxWriter<C extends PublishedCommand> {
   add(commits: ReadonlyArray<CommandOutboxCommitCandidate<C>>): Promise<void>;
+  /**
+   * Ends the source cursors of removed aggregates, in the same transaction
+   * as the removal. After the mark, `add()` must reject a new commit whose
+   * origin comes from an ended source; an exact retry by `origin.eventId`
+   * stays idempotent. A source without a cursor stays open, and ending a
+   * source twice is not an error. See `OutboxWriter.endEventSources`.
+   */
+  endEventSources(sources: ReadonlyArray<AggregateIdentity>): Promise<void>;
 }
 /** Maps one private accepted event to zero or more addressed commands. */
 type CommandOutboxMapper<Evt extends AnyDomainEvent, C extends PublishedCommand> = (event: Evt) => ReadonlyArray<CommandMessageContent<C>>;
@@ -937,6 +1039,8 @@ interface AggregateSnapshot<TState> {
  */
 interface Aggregate<TId extends Id<string>, TEvent extends AnyDomainEvent = AnyDomainEvent> {
   readonly id: TId;
+  /** The aggregate type and the id: the full identity of the aggregate. */
+  readonly aggregateIdentity: AggregateIdentity<TId>;
   readonly version: Version;
   readonly pendingEvents: ReadonlyArray<PendingDomainEvent<TEvent>>;
 }
@@ -953,7 +1057,8 @@ interface ReplayableAggregate<TId extends Id<string>, TEvent extends AnyDomainEv
    * `Result` because event-stream corruption is an expected
    * recoverable failure at the infrastructure boundary: a `DomainError`
    * thrown by a fold arrives as `Err`. Every other failure propagates
-   * after the all-or-nothing rollback.
+   * after the all-or-nothing rollback. The pending-decisions guard runs
+   * for an empty history as well; an empty history is otherwise a no-op.
    *
    * @throws ForeignEventError when a history event names another aggregate
    * @throws UnreplayableAggregateError when the target carries pending
@@ -1238,6 +1343,15 @@ interface TransactionalOptions {
    * eagerly cancellable.
    */
   readonly signal?: AbortSignal;
+  /**
+   * Tells the caller that a new attempt starts. A scope that can open more
+   * than one transaction for one call (a retrying scope) calls it before
+   * each attempt opens its transaction. The caller can then tell a failure
+   * to open the next attempt apart from a failure of the previous one. A
+   * scope that opens one transaction per call can ignore it. A scope that
+   * wraps another scope passes the options on unchanged.
+   */
+  readonly onAttemptStart?: () => void;
 }
 /**
  * Transaction-scope abstraction.
@@ -1759,15 +1873,15 @@ type IdempotencyClaim = {
  * production pattern and the only family that proves atomic command effect +
  * idempotency completion without reconciliation.
  *
- * A NON-transactional store (the in-memory reference, a separate durable
- * store) cannot see commits or rollbacks. Every fresh claim therefore returns
- * a store-minted token and bounded lease. The wrapper renews it while the
- * transaction runs; `complete`, `renew`, `confirm`, `abandon`, and `reconcile`
- * compare the token so a stale owner cannot mutate a successor claim. An
- * expired PENDING claim may be replaced. An expired STAGED outcome is never
- * replayed or released automatically: `claim` returns
- * `reconciliation-required`, and the application must consult the source of
- * truth. `unknown` keeps it blocked.
+ * A NON-transactional store (the in-memory reference on its own, a separate
+ * durable store) cannot see commits or rollbacks. Every fresh claim
+ * therefore returns a store-minted token and bounded lease. The wrapper
+ * renews it while the transaction runs; `complete`, `renew`, `confirm`,
+ * `abandon`, and `reconcile` compare the token so a stale owner cannot
+ * mutate a successor claim. An expired PENDING claim may be replaced. An
+ * expired STAGED outcome is never replayed or released automatically:
+ * `claim` returns `reconciliation-required`, and the application must
+ * consult the source of truth. `unknown` keeps it blocked.
  *
  * A lease is coordination, not a security or exactly-once boundary. To return
  * `not-committed` safely, the source transaction must persist an idempotency
@@ -2026,23 +2140,23 @@ interface ProjectionCheckpointStore<TCtx = unknown> {
    * Implementations may serialize more than the requested keys, but never
    * less. The callback is non-reentrant for an overlapping key set.
    */
-  withCheckpointLocks<R>(ctx: TCtx, projection: string, addresses: ReadonlyArray<AggregateAddress>, work: () => Promise<R>): Promise<R>;
+  withCheckpointLocks<R>(ctx: TCtx, projection: string, identities: ReadonlyArray<AggregateIdentity>, work: () => Promise<R>): Promise<R>;
   /**
-   * The stored watermark receipt for `(projection, address)`, or `undefined`
+   * The stored watermark receipt for `(projection, identity)`, or `undefined`
    * when this projection has never applied an event of that
    * aggregate. Called inside the projector's transaction.
    */
-  load(ctx: TCtx, projection: string, address: AggregateAddress): Promise<ProjectionCheckpoint | undefined>;
+  load(ctx: TCtx, projection: string, identity: AggregateIdentity): Promise<ProjectionCheckpoint | undefined>;
   /**
    * Persists the watermark receipt, overwriting a previous one (last write
    * wins; the projector only calls this with advancing checkpoints).
    * Called inside the projector's transaction, after the read-model
    * update it accounts for.
    */
-  save(ctx: TCtx, projection: string, address: AggregateAddress, checkpoint: ProjectionCheckpoint): Promise<void>;
+  save(ctx: TCtx, projection: string, identity: AggregateIdentity, checkpoint: ProjectionCheckpoint): Promise<void>;
   /**
    * The wait-for-version building block: `true` when the stored
-   * watermark for `(projection, address)` is at or past
+   * watermark for `(projection, identity)` is at or past
    * `position`. Runs OUTSIDE any transaction (a query-side poll).
    *
    * Pass the position of the LAST event your commit emitted: all
@@ -2050,7 +2164,7 @@ interface ProjectionCheckpointStore<TCtx = unknown> {
    * on the version alone would report "reached" while later events
    * of the same commit are still unapplied.
    */
-  hasReached(projection: string, address: AggregateAddress, position: ProjectionPosition): Promise<boolean>;
+  hasReached(projection: string, identity: AggregateIdentity, position: ProjectionPosition): Promise<boolean>;
   /**
    * Deletes every checkpoint of `projection` (other projections'
    * checkpoints are untouched): the rebuild entry point. Called
@@ -2067,7 +2181,7 @@ interface ProjectionCheckpointStore<TCtx = unknown> {
  * read-model writes.
  *
  * The projector feed MUST contain every committed envelope for each aggregate
- * address it carries, including event types this read model does not use.
+ * identity it carries, including event types this read model does not use.
  * Handle those events as explicit no-ops in `apply`: the projector still
  * advances their cursor. Filtering a broker subscription by event type drops
  * positions from the source chain and turns the next commit into a real gap.
@@ -2106,6 +2220,298 @@ interface Projection<Evt extends AnyDomainEvent, TCtx = unknown> {
   truncate?(ctx: TCtx): Promise<void>;
 }
 //#endregion
+//#region src/persistence/repository/identity-map.d.ts
+/**
+ * A class reference used as the type key of the identity map. Keying
+ * on the CLASS (not a name string) makes collisions impossible by
+ * construction: `Restaurant` and `Booking` are different keys even if
+ * someone names two aggregates identically across modules, and there
+ * is no string-discipline to maintain.
+ *
+ * `Function & { prototype: TAgg }` carries this alone. The kit's aggregate
+ * convention is a **protected constructor** plus static factories, and
+ * TypeScript rejects assigning such a class to a construct-signature type, so
+ * the prototype witness is what accepts them. It infers `TAgg` as well.
+ * Measured: a construct signature beside it changes neither what the type
+ * accepts nor what it infers, and it was the last `any` in the published
+ * types.
+ */
+type AggregateClass<TAgg> = Function & {
+  prototype: TAgg;
+};
+/**
+ * Per-unit-of-work Identity Map (Fowler, PoEAA): within one operation,
+ * one aggregate type+id maps to exactly ONE in-memory instance.
+ *
+ * This is the shipped implementation of the contract the
+ * Repository guide (`docs/guide/repository.md`) places on
+ * `AggregatePersistence` implementations: two `findById(id)` calls in the same
+ * unit of work MUST return the same instance, because commit-token
+ * write registration dedupes by JavaScript object identity. Two instances for
+ * one logical aggregate can otherwise produce two tokens, two harvests,
+ * and two post-commit lifecycle calls.
+ *
+ * Storage is two-level (per-type stores created lazily), so
+ * `Restaurant:123` and `Booking:123` can never collide: the type key
+ * is the aggregate CLASS, not the id alone and not a name string.
+ *
+ * Repository read-path contract:
+ *
+ * ```ts
+ * async findById(id: OrderId): Promise<Order | undefined> {
+ *   const cached = this.tracking.identityMap.get(Order, id);
+ *   if (cached) return cached;
+ *   // Deleted in this unit of work = gone, even if the physical
+ *   // delete is deferred and the row is still visible in the tx.
+ *   if (this.tracking.identityMap.isDeleted(Order, id)) return undefined;
+ *
+ *   const row = await this.loadRow(id);
+ *   if (!row) return undefined;
+ *   const order = Order.reconstitute(row.id, row.state, row.version);
+ *   return this.tracking.trackLoaded(order);
+ * }
+ * ```
+ *
+ * Deletion is final within an operation: {@link delete} removes the
+ * entry AND records a tombstone, so a later {@link set} of the same
+ * type+id throws `AggregateDeletedError`: a second instance of a
+ * deleted aggregate can never sneak back into the unit of work, even
+ * through a repository whose row delete is deferred.
+ *
+ * Lifetime is ONE unit of work: the `UnitOfWork` creates a fresh map
+ * per `run()` and clears it on close. Never cache across operations;
+ * that would silently bypass optimistic concurrency control.
+ */
+declare class IdentityMap {
+  private readonly _stores;
+  private readonly _deleted;
+  private _pendingAtRegistration;
+  /** The cached instance for type+id, or `undefined` (also after {@link delete}). */
+  get<TAgg>(type: AggregateClass<TAgg>, id: Id<string>): TAgg | undefined;
+  /** Whether an instance is registered for type+id (false after {@link delete}). */
+  has<TAgg>(type: AggregateClass<TAgg>, id: Id<string>): boolean;
+  /**
+   * Whether type+id was {@link delete}d in this unit of work. The
+   * read path checks this BEFORE hydrating and returns `null`, so
+   * "deleted in this operation" reads uniformly as not-found,
+   * regardless of whether the repository's physical delete already
+   * removed the row or is deferred within the transaction. Without
+   * the check, a read-only probe of a deleted aggregate would crash
+   * in {@link set} for deferred-write repositories and return `null`
+   * for immediate-write ones.
+   */
+  isDeleted<TAgg>(type: AggregateClass<TAgg>, id: Id<string>): boolean;
+  /**
+   * Registers the hydrated instance under its class and the id of its
+   * `aggregateIdentity`.
+   *
+   * - Re-registering the SAME instance is a no-op (idempotent).
+   * - Registering a DIFFERENT instance for an occupied type+id throws:
+   *   that is precisely the identity-map violation this class exists
+   *   to prevent (the repository hydrated twice instead of checking
+   *   {@link get} first), and letting it pass would double-harvest
+   *   events downstream.
+   * - Registering a type+id that was {@link delete}d in this unit of
+   *   work throws `AggregateDeletedError`: deletion is final within
+   *   the operation.
+   */
+  set<TAgg extends {
+    readonly aggregateIdentity: AggregateIdentity;
+  }>(type: AggregateClass<TAgg>, aggregate: TAgg): void;
+  /**
+   * Registered instances that have recorded MORE pending events than they
+   * carried when first registered (loaded). Used by the unit of work's
+   * end-of-run guard: an aggregate that gained events after load but was
+   * never enrolled would silently drop them. A read-only load, or a
+   * reconstitution that already carried events, shows no increase and is
+   * not reported.
+   */
+  instancesWithNewPendingEvents(): unknown[];
+  /**
+   * Takes back a registration WITHOUT a tombstone: the entry is removed
+   * only when the stored instance IS the given one, and a later
+   * {@link set} of the same type+id stays legal. The Unit of Work calls
+   * this when a registration step fails after {@link set} already ran, so
+   * the failed instance cannot be served by `findById` as a phantom.
+   * This is rollback, not deletion; deletion finality belongs to
+   * {@link delete}.
+   */
+  discard<TAgg>(type: AggregateClass<TAgg>, id: Id<string>, aggregate: TAgg): void;
+  /**
+   * Removes the entry for type+id and records a tombstone: subsequent
+   * {@link get} / {@link has} report absence, and a subsequent
+   * {@link set} of the same type+id throws `AggregateDeletedError`.
+   * The Unit of Work calls this as part of `repository.remove(aggregate)`;
+   * repository adapters receive only the read-only
+   * identity-map view.
+   */
+  delete<TAgg>(type: AggregateClass<TAgg>, id: Id<string>): void;
+  /** Empties all stores and tombstones. Called by the unit of work on close. */
+  clear(): void;
+}
+//#endregion
+//#region src/persistence/repository/persistence-model.d.ts
+/** Whether a baseline represents an existing row or a pending insert. */
+type PersistenceLifecycle = "loaded" | "new";
+/**
+ * Adapter-owned projection and change derivation for one aggregate type.
+ *
+ * The domain model does not implement this contract. A repository adapter
+ * chooses what it persists, how that projection is captured at load, and
+ * whether a change set is a partial diff or a full replacement.
+ */
+interface PersistenceModel<TAggregate, TBaseline, TChangeSet> {
+  /**
+   * Captures the adapter's persistence projection at the current moment.
+   * Return a detached value or an immutable value object: the Unit of Work
+   * retains it as a baseline and cannot make an arbitrary adapter type safe.
+   *
+   * Capture must be deterministic for an unchanged aggregate: the Unit of
+   * Work compares successive captures to detect mutation after write
+   * registration. A capture that embeds ambient values (clock reads,
+   * random ids) would make every commit look mutated. The default
+   * comparison is the package's structural deep equality, which matches
+   * `Set` members and `Map` keys by reference (JS `SameValueZero`
+   * semantics): a capture that re-materializes object Set members or Map
+   * keys on every call must supply {@link captureEquals}.
+   *
+   * A column that the store owns stays out of the capture, for example an
+   * `updatedAt` that the adapter stamps; `flush` writes it. A captured store
+   * column pushes a stale value back on the next write, or it marks every
+   * row as changed.
+   */
+  capture(aggregate: TAggregate): TBaseline;
+  /**
+   * Adapter-owned equality for two captures of the persistence projection.
+   * Optional: the default is the package's structural deep equality (Set
+   * members and Map keys by reference). Supply it when the capture shape
+   * needs domain-specific comparison, for example rebuilt value-object Set
+   * members compared by value.
+   */
+  readonly captureEquals?: (a: TBaseline, b: TBaseline) => boolean;
+  /**
+   * Derives the adapter's write payload from its own baseline.
+   *
+   * `baseline` is absent for a new aggregate. `lifecycle` disambiguates that
+   * case from an adapter whose loaded baseline type itself admits `undefined`.
+   * The returned payload must not share mutable references with the aggregate;
+   * it is the exact value later handed to `flush`.
+   */
+  changes(baseline: TBaseline | undefined, aggregate: TAggregate, lifecycle: PersistenceLifecycle): TChangeSet;
+  /** Tells orchestration whether the derived state write is empty. */
+  isEmpty(changes: TChangeSet): boolean;
+}
+declare const persistenceBaselineBrand: unique symbol;
+/**
+ * Opaque, typed receipt for an adapter-owned persistence baseline.
+ *
+ * It intentionally exposes no data. The Unit of Work may retain the token and
+ * ask the owning adapter capability to derive changes, but cannot branch on or
+ * couple itself to the baseline's shape.
+ */
+interface PersistenceBaseline<TAggregate, TChangeSet> {
+  readonly [persistenceBaselineBrand]: (aggregate: TAggregate) => TChangeSet;
+}
+/** A derived adapter change set plus its adapter-defined emptiness result. */
+interface PersistenceChanges<TChangeSet> {
+  readonly value: TChangeSet;
+  readonly empty: boolean;
+}
+/** Captures a baseline for an aggregate restored by a repository adapter. */
+declare function capturePersistenceBaseline<TAggregate, TBaseline, TChangeSet>(model: PersistenceModel<TAggregate, TBaseline, TChangeSet>, aggregate: TAggregate): PersistenceBaseline<TAggregate, TChangeSet>;
+/** Creates the explicit no-row baseline for a newly added aggregate. */
+declare function insertPersistenceBaseline<TAggregate, TBaseline, TChangeSet>(model: PersistenceModel<TAggregate, TBaseline, TChangeSet>): PersistenceBaseline<TAggregate, TChangeSet>;
+/**
+ * Captures the aggregate's current adapter projection using the capability
+ * carried by an existing baseline. Used to seal persistence-last registration.
+ */
+declare function recapturePersistenceBaseline<TAggregate, TChangeSet>(baseline: PersistenceBaseline<TAggregate, TChangeSet>, aggregate: TAggregate): PersistenceBaseline<TAggregate, TChangeSet>;
+/**
+ * Recaptures the adapter projection and reports whether it drifted from the
+ * baseline's stored capture, using the model's `captureEquals` when supplied
+ * and structural deep equality otherwise.
+ *
+ * This, not `changes()`/`isEmpty()`, is the mutation detector: the
+ * `PersistenceModel` contract explicitly permits a full-replacement change
+ * set whose `isEmpty` is never true, so a non-empty change set proves
+ * nothing about mutation. Comparing capture to capture asks the honest
+ * question independent of the model's diffing strategy. A `"new"` lifecycle
+ * baseline has no stored capture and never reports drift.
+ */
+declare function persistenceProjectionDrifted<TAggregate, TChangeSet>(baseline: PersistenceBaseline<TAggregate, TChangeSet>, aggregate: TAggregate): boolean;
+/** Derives a typed adapter change set without exposing the stored baseline. */
+declare function derivePersistenceChanges<TAggregate, TChangeSet>(baseline: PersistenceBaseline<TAggregate, TChangeSet>, aggregate: TAggregate): PersistenceChanges<TChangeSet>;
+//#endregion
+//#region src/application/unit-of-work/persistence-contract.d.ts
+/** The explicit persistence intent registered for one tracked aggregate. */
+type AggregateWriteIntent = "add" | "update" | "remove";
+/** Read-only Identity Map operations available to repository adapters. */
+type UnitOfWorkIdentityMap = Pick<IdentityMap, "get" | "has" | "isDeleted">;
+/**
+ * Repository-specific tracking capability handed only to its adapter.
+ *
+ * Read paths call {@link RepositoryTracking.trackLoaded} before returning a
+ * restored aggregate.
+ * Write methods exposed to application code are replaced by Unit-of-Work-owned
+ * `add`, `update`, and `remove` registrations, so an adapter implementation of
+ * those methods cannot perform durable I/O early or skip event harvesting.
+ *
+ * Contract for repository implementations:
+ * - `findById(id)` checks `identityMap.get` BEFORE hydrating, treats
+ *   `identityMap.isDeleted` as not-found (`undefined`), and returns
+ *   `tracking.trackLoaded(aggregate)` after hydration. This captures the
+ *   expected version before application code can mutate the instance.
+ * - Adapter objects have no lifecycle methods; the facade installs the
+ *   Unit-of-Work-owned `add`, `update` unless the definition is append-only,
+ *   and `remove` with `physicalRemoval`. An adapter that defines `add`,
+ *   `update`, or `remove` fails with `InvalidRepositoryAdapterError`.
+ * - Other repository methods are reads. A custom method that performs a write
+ *   would bypass the Unit of Work and violates the adapter contract.
+ */
+interface RepositoryTracking<TAggregate extends Aggregate<Id<string>, AnyDomainEvent>> {
+  /**
+   * Registers an aggregate restored by a repository before returning it to
+   * application code. The Unit of Work identity-maps the instance and captures
+   * its current version as the optimistic-concurrency expectation.
+   *
+   * Return the result, not the argument. If the Unit of Work already tracks
+   * an instance with the same identity, the result is that instance: when
+   * two loads of one id overlap, the first tracked instance wins.
+   */
+  trackLoaded(aggregate: TAggregate): TAggregate;
+  /**
+   * Read-only view of the per-operation Identity Map (Fowler): one aggregate type+id,
+   * one in-memory instance. Created fresh per `run()`, cleared on
+   * close; accessing it after close throws
+   * {@link TransactionClosedError}.
+   */
+  readonly identityMap: UnitOfWorkIdentityMap;
+}
+/**
+ * Immutable adapter input for one registered aggregate write.
+ *
+ * `expectedVersion` is captured when a loaded aggregate joins the Unit of
+ * Work and is absent for `add`. `version`, `changes`, and `events` describe
+ * the exact moment at which the application registered its write intent.
+ * Adapters must use the expected/current version pair for their OCC predicate
+ * and must not read mutable write state back from an aggregate reference.
+ *
+ * The predicate itself is adapter code. The compare-and-set must run in the
+ * store's own write statement. The kit does not know the store, so it cannot
+ * write that statement. The kit owns the version pair and
+ * {@link ConcurrencyConflictError}; the repository contract suite proves the
+ * predicate.
+ */
+interface AggregatePersistenceWrite<TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TChangeSet> {
+  readonly intent: AggregateWriteIntent;
+  /** The aggregate type and the id of the written aggregate. */
+  readonly aggregateIdentity: AggregateIdentity<TAggregate["id"]>;
+  readonly expectedVersion: Version | undefined;
+  readonly version: Version;
+  readonly changes: PersistenceChanges<TChangeSet>;
+  readonly events: TAggregate["pendingEvents"];
+}
+//#endregion
 //#region src/persistence/event-store/event-store.d.ts
 /** Options for {@link EventStore.append}. */
 interface EventStoreAppendOptions {
@@ -2123,18 +2529,15 @@ interface ReadStreamOptions {
   /**
    * Maximum number of events returned by this page. Required so callers
    * cannot accidentally materialize an unbounded stream. Must be a positive
-   * safe integer. An adapter may return fewer events, but must return at least
-   * one while unread events remain inside the requested window.
+   * safe integer. An adapter may return fewer events, for example when it
+   * clamps `limit` to a maximum of its own. It must return at least one
+   * event while unread events remain inside the requested window.
    */
   readonly limit: number;
   /**
    * Return only events AFTER this stream position (1-based event count),
-   * the snapshot catch-up read: `readStream(stream, { fromVersion:
-   * snapshot.version, limit: 256 })` yields the next page passed to
-   * `aggregate.replayHistory`; the caller checks that the aggregate
-   * ends at the pinned head ({@link ReplayHeadMismatchError}). Defaults
-   * to `0` (the first stream page).
-   * Must be a non-negative safe integer when present.
+   * for example the version of a snapshot. Defaults to `0` (the first
+   * stream page). Must be a non-negative safe integer when present.
    */
   readonly fromVersion?: number;
   /**
@@ -2143,10 +2546,16 @@ interface ReadStreamOptions {
    * `(fromVersion, toVersion]`. Defaults to the actual stream head.
    * `0` therefore returns an empty window; a value beyond the head clamps
    * to the head; and `fromVersion >= toVersion` is an empty interval, not
-   * an error.
-   * Must be a non-negative safe integer when present.
+   * an error. Must be a non-negative safe integer when present.
    */
   readonly toVersion?: number;
+  /**
+   * Cooperative-cancellation signal of the surrounding operation. An
+   * adapter either rejects with the `reason` of an aborted signal, or
+   * bounds each page read with the timeout of its driver. So a page read
+   * that hangs cannot hang its caller.
+   */
+  readonly signal?: AbortSignal;
 }
 /**
  * State returned by {@link EventStore.readStream}.
@@ -2155,7 +2564,7 @@ interface ReadStreamOptions {
  * of the requested read window and page limit. `exists: true` implies
  * `lastVersion >= 1`: an
  * existing stream has at least one event, while metadata or tombstones without
- * events must be reported as `exists: false`. A missing stream is therefore
+ * events must be reported as `exists: false`. An absent stream is therefore
  * distinguishable from an existing stream whose requested window is empty.
  * Snapshot-backed repositories use that distinction to reject a snapshot whose
  * version lies beyond the current authoritative stream head.
@@ -2169,9 +2578,50 @@ type StreamReadResult<Evt extends AnyDomainEvent> = {
   readonly lastVersion: number;
   readonly events: ReadonlyArray<Evt>;
 };
+/**
+ * The read half of the store: one bounded page of a stream at a time. A
+ * store implements both halves; a read-only implementation offers this
+ * role alone.
+ */
+interface EventStreamReader<Evt extends AnyDomainEvent> {
+  /**
+   * Reads one bounded page of the qualified stream in append order. An absent stream returns
+   * `{ exists: false, lastVersion: 0, events: [] }`; an existing stream keeps
+   * `exists: true` even when its requested window is empty. An existing stream
+   * has at least one event, so `exists: true` implies `lastVersion >= 1`;
+   * metadata or tombstones without events must be reported as absent.
+   * `lastVersion` is always the actual stream head. `options.limit` is
+   * mandatory and caps the returned array. An adapter may return fewer than
+   * the requested limit, but if the requested window still contains unread
+   * events it must return a non-empty contiguous prefix so callers can make
+   * progress. Each returned event occupies one stream position, so the
+   * events of a page fill the positions after `fromVersion` without a gap.
+   * `options.fromVersion`
+   * excludes positions at or below its 1-based event count;
+   * `options.toVersion` includes positions through its count, so both bounds
+   * describe `(fromVersion, toVersion]`. `toVersion: 0` and inverted ranges
+   * return an empty existing window, while a bound beyond the head clamps to
+   * the head. This distinction is load-bearing for snapshot catch-up and
+   * point-in-time reconstruction: a repository can verify the requested
+   * historical window against the authoritative head. `limit` must be a
+   * positive safe integer; present bounds must be non-negative safe integers.
+   * Invalid options reject with `RangeError` before querying storage.
+   *
+   * Each page's `exists`, `lastVersion`, and `events` must describe one
+   * consistent view of the stream. Multiple page reads are not one database
+   * snapshot. A caller that reads a stream in several pages pins a target
+   * version on the first page, passes it as `toVersion` on every
+   * continuation, and advances `fromVersion` by the number of events each
+   * page returned. Because streams are append-only, that yields a stable
+   * prefix even if new events arrive while replay is in progress. The returned
+   * event array is owned by the caller; implementations must not hand out
+   * mutable live internal state.
+   */
+  readStream(stream: AggregateIdentity, options: ReadStreamOptions): Promise<StreamReadResult<Evt>>;
+}
 /**
  * Driven port for event-sourced aggregate persistence: an append-only
- * store with one stream per aggregate. Each stream is addressed by the
+ * store with one stream per aggregate. Each stream is identified by the
  * qualified tuple `(aggregateType, aggregateId)`, because aggregate ids
  * are type-scoped rather than globally unique.
  *
@@ -2187,58 +2637,38 @@ type StreamReadResult<Evt extends AnyDomainEvent> = {
  * Repository usage (see the event-sourcing guide):
  *
  * ```ts
- * private stream(id: OrderId): AggregateAddress<OrderId> {
+ * private stream(id: OrderId): AggregateIdentity<OrderId> {
  *   return { aggregateType: "Order", aggregateId: id };
  * }
  *
  * async findById(id: OrderId): Promise<Order | undefined> {
  *   const cached = this.tracking.identityMap.get(Order, id);
  *   if (cached) return cached;
- *   const address = this.stream(id);
- *   const first = await this.eventStore.readStream(address, { limit: 256 });
- *   if (!first.exists) return undefined;
- *   const targetVersion = first.lastVersion; // pin the first observed head
- *   const reconstituted = reconstituteAggregateFromHistory(
+ *   const read = await readStreamPages(this.eventStore, this.stream(id), {
+ *     limit: 256,
+ *   });
+ *   if (!read.reachable) return undefined;
+ *   const loaded = await reconstituteAggregateFromStreamPages(
  *     () => Order.reconstitute(id), // bare instance, no events
- *     first.events,
+ *     read,
  *   );
- *   if (reconstituted.isErr()) throw reconstituted.error; // corrupt stream
- *   const order = reconstituted.value;
- *   let fromVersion = first.events.length;
- *   while (fromVersion < targetVersion) {
- *     const page = await this.eventStore.readStream(address, {
- *       fromVersion,
- *       toVersion: targetVersion,
- *       limit: 256,
- *     });
- *     if (!page.exists || page.events.length === 0) {
- *       throw new NonProgressingEventStreamPageError({
- *         ...address,
- *         fromVersion,
- *         targetVersion,
- *       });
- *     }
- *     const catchUp = order.replayHistory(page.events);
- *     if (catchUp.isErr()) throw catchUp.error; // corrupt stream
- *     fromVersion += page.events.length;
- *   }
- *   if (order.version !== targetVersion) {
- *     throw new ReplayHeadMismatchError({
- *       ...address,
- *       targetVersion,
- *       actualVersion: order.version,
- *     });
- *   }
- *   return this.tracking.trackLoaded(order);
+ *   if (loaded.isErr()) throw loaded.error; // corrupt stream
+ *   return this.tracking.trackLoaded(loaded.value);
  * }
  *
  * flush(write: AggregatePersistenceWrite<Order, number | undefined>) {
- *   return this.eventStore.append(this.stream(write.aggregateId), write.events, {
+ *   return this.eventStore.append(write.aggregateIdentity, write.events, {
  *     expectedVersion: write.expectedVersion ?? 0,
  *   });
  * }
  * ```
  *
+ * `readStreamPages` pins the head on the first page as the target version
+ * and reads the rest in bounded pages up to it.
+ * `reconstituteAggregateFromStreamPages` replays the pages and checks that
+ * the replay ends at the target version. The long form, for an adapter that
+ * pages on its own, is in the event-sourcing guide.
+ *
  * `flush` appends the exact event batch registered by `add` or `update`;
  * `withCommit`
  * separately composes them into outbox envelopes. The event store's own
@@ -2247,7 +2677,7 @@ type StreamReadResult<Evt extends AnyDomainEvent> = {
  * The exact appended event batch is acknowledged only after the surrounding
  * transaction commits. Rollback leaves it pending.
  */
-interface EventStore<Evt extends AnyDomainEvent> {
+interface EventStore<Evt extends AnyDomainEvent> extends EventStreamReader<Evt> {
   /**
    * Atomically appends `events` to the stream, guarded by optimistic
    * concurrency: the append succeeds only when the stream currently
@@ -2292,44 +2722,96 @@ interface EventStore<Evt extends AnyDomainEvent> {
    * touching the store (an ES repository skips `append` for aggregates
    * without pending events anyway).
    *
+   * A load that read its pages through a replica still appends here with
+   * the pinned target as `expectedVersion`. The primary rejects a stale
+   * head, so a lagging replica cannot lose an update.
+   *
    * Treat `aggregateType` as a stable technical stream category. If two
    * bounded contexts share one physical store and reuse a domain name,
    * qualify it at the source (`sales.order`, `fulfillment.order`). Renaming
    * it changes the stream key and therefore requires a data migration.
    */
-  append(stream: AggregateAddress, events: ReadonlyArray<Evt>, options: EventStoreAppendOptions): Promise<void>;
-  /**
-   * Reads one bounded page of the qualified stream in append order. An unknown stream returns
-   * `{ exists: false, lastVersion: 0, events: [] }`; an existing stream keeps
-   * `exists: true` even when its requested window is empty. An existing stream
-   * has at least one event, so `exists: true` implies `lastVersion >= 1`;
-   * metadata or tombstones without events must be reported as absent.
-   * `lastVersion` is always the actual stream head. `options.limit` is
-   * mandatory and caps the returned array. An adapter may return fewer than
-   * the requested limit, but if the requested window still contains unread
-   * events it must return a non-empty contiguous prefix so callers can make
-   * progress. `options.fromVersion`
-   * excludes positions at or below its 1-based event count;
-   * `options.toVersion` includes positions through its count, so both bounds
-   * describe `(fromVersion, toVersion]`. `toVersion: 0` and inverted ranges
-   * return an empty existing window, while a bound beyond the head clamps to
-   * the head. This distinction is load-bearing for snapshot catch-up and
-   * point-in-time reconstruction: a repository can verify the requested
-   * historical window against the authoritative head. `limit` must be a
-   * positive safe integer; present bounds must be non-negative safe integers.
-   * Invalid options reject with `RangeError` before querying storage.
+  append(stream: AggregateIdentity, events: ReadonlyArray<Evt>, options: EventStoreAppendOptions): Promise<void>;
+}
+//#endregion
+//#region src/persistence/event-store/reconstitute-from-stream-pages.d.ts
+/**
+ * The shape the replay reads: the stream, the window, and the pages.
+ * `readStreamPages` returns it as the reachable branch of a kit read. An
+ * adapter that pages on its own builds it directly, after it pinned the
+ * target version with `pinTargetVersion`.
+ */
+interface ReplayableStreamPages<Evt extends AnyDomainEvent> {
+  /** The qualified stream the pages come from. */
+  readonly stream: AggregateIdentity;
+  /**
+   * The cursor the read started at: `fromVersion`, or `0`. The pages hold
+   * the events after it, so the replay target must stand at this version.
+   */
+  readonly fromVersion: number;
+  /**
+   * The version the replay must end at: the head at read time, or a
+   * `toVersion` at or below it. Never a version taken from a snapshot, and
+   * never below `fromVersion`. Later appends do not move it.
+   */
+  readonly targetVersion: number;
+  /**
+   * The events after the cursor through the target version, in append
+   * order, one bounded page per iteration. Every iteration starts again
+   * from the first page, so a second replay of one read sees the same
+   * prefix. A page holds at least one event, and the pages end at the
+   * target version. The replay rejects an empty page, and a page that
+   * would run past the target version, with
+   * {@link InvalidEventStreamPageError} before any row of it reaches the
+   * aggregate. `createReplayableStreamPagesContractTests` proves these
+   * rules for an adapter.
    *
-   * Each page's `exists`, `lastVersion`, and `events` must describe one
-   * consistent view of the stream. Multiple page reads are not one database
-   * snapshot: pin the first page's `lastVersion` as `toVersion` on every
-   * continuation, then advance `fromVersion` by the number of events actually
-   * returned. Because streams are append-only, that yields a stable prefix
-   * even if new events arrive while replay is in progress. The returned
-   * event array is owned by the caller; implementations must not hand out
-   * mutable live internal state.
+   * The events of a page are stored facts: no consumer, upcaster, or fold
+   * changes one in place. `readStreamPages` reads fresh events on every
+   * later iteration, and `createReplayableStreamPages` hands out frozen
+   * ones, so a consumer that breaks this rule fails in its own tests.
    */
-  readStream(stream: AggregateAddress, options: ReadStreamOptions): Promise<StreamReadResult<Evt>>;
+  readonly pages: AsyncIterable<ReadonlyArray<Evt>>;
 }
+/**
+ * Reconstitutes an event-sourced aggregate from the pages of a stream read
+ * and yields it only when the replay ends at the target version.
+ *
+ * This is the paged form of `reconstituteAggregateFromHistory`.
+ * `createReplayTarget` builds the replay target: a fresh instance for a
+ * full replay, or an instance reconstituted from a snapshot for a read that
+ * starts at `snapshot.version`. `read` is the reachable branch of a kit
+ * read, or the value that an adapter that pages on its own built.
+ *
+ * The call checks the window first. `targetVersion` must be a positive
+ * safe integer, and `fromVersion` a non-negative one at or below it. A bad
+ * window rejects with `RangeError` before the replay target is built.
+ *
+ * The call then primes the replay target with an empty history, so the
+ * aggregate runs its own guard even when the read holds no page: a replay
+ * target with pending decisions throws `UnreplayableAggregateError`. The
+ * replay target must stand at `read.fromVersion`. A replay target at
+ * another version throws {@link ReplayTargetMismatchError} before the
+ * first page, even when it also rejected the empty history: a wiring
+ * defect wins over a rejection that the data cannot explain.
+ *
+ * Each page goes through `replayHistory` on the replay target, so
+ * allocation stays bounded by the size of a page; `readStreamPages` rejects
+ * a page over its `limit`. An empty page, and a page that would run past
+ * the target version, throw {@link InvalidEventStreamPageError} before any
+ * row of them reaches the aggregate. Events carry no stream position, so
+ * only the call can find pages that end short of the target version. After
+ * the last page it compares the final version with `read.targetVersion` and
+ * throws {@link ReplayTargetMismatchError} on a difference.
+ *
+ * When the aggregate rejects a stored event with a `DomainError`, the call
+ * stops reading and returns {@link ReplayRejectedError} as `Err`. The
+ * error names the stream and the window of the rejected page, and it holds
+ * the `DomainError` as `cause`. The replay target never escapes on that
+ * path. Wiring errors and a foreign row throw, as in `replayHistory`. What
+ * `createReplayTarget` throws propagates.
+ */
+declare function reconstituteAggregateFromStreamPages<TAggregate extends ReplayableAggregate<Id<string>, AnyDomainEvent>>(createReplayTarget: () => TAggregate, read: ReplayableStreamPages<Parameters<TAggregate["replayHistory"]>[0][number]>): Promise<Result<TAggregate, ReplayRejectedError>>;
 //#endregion
 //#region src/persistence/snapshot-store/snapshot-store.d.ts
 /**
@@ -2371,14 +2853,14 @@ interface SnapshotStore<TState = unknown> {
    * The latest snapshot for the aggregate, or `undefined` when none
    * exists. The repository falls back to a full replay then.
    */
-  load(address: AggregateAddress): Promise<AggregateSnapshot<TState> | undefined>;
+  load(identity: AggregateIdentity): Promise<AggregateSnapshot<TState> | undefined>;
   /**
    * Persists `snapshot` as the new latest for the aggregate,
    * replacing any previous one. Called AFTER the write transaction
    * committed (see the port docs); a single-row upsert is the
    * standard implementation.
    */
-  save(address: AggregateAddress, snapshot: AggregateSnapshot<TState>): Promise<void>;
+  save(identity: AggregateIdentity, snapshot: AggregateSnapshot<TState>): Promise<void>;
   /**
    * Removes the aggregate's snapshot; a no-op when none exists. The
    * two callers: the schema-migration fallback (a
@@ -2390,8 +2872,8 @@ interface SnapshotStore<TState = unknown> {
    * which a stale snapshot resurrects the erased aggregate on the
    * snapshot load path; snapshot-first degrades to a full replay.
    */
-  delete(address: AggregateAddress): Promise<void>;
+  delete(identity: AggregateIdentity): Promise<void>;
 }
 //#endregion
-export { routeEventsToCommandOutbox as $, WithCommitWorkResult as A, defaultDomainEventFactory as At, ReplayableAggregate as B, JsonValue as Bt, DeadLetterDeadline as C, UncommittedDomainEvent as Ct, CommitEnrollment as D, createDomainEventFactory as Dt, AggregateCommitToken as E, createDomainEvent as Et, EventHandler as F, Command as Ft, IdGenerator as G, sameVersion as H, OnceOptions as I, CommandHandler as It, CommandMessageRelationships as J, CommandCommitOriginCandidate as K, PublishOptions as L, PublishedCommand as Lt, TransactionScope as M, recordDomainEvent as Mt, TransactionalOptions as N, ClockFactory as Nt, CommitEnrollmentOptions as O, createDomainEventFromFacts as Ot, EventBus as P, AggregateAddress as Pt, DurableCommandMessage as Q, Aggregate as R, JsonObject as Rt, withIdempotentCommit as S, PendingDomainEvent as St, DueDeadline as T, copyMetadata as Tt, toVersion as U, Version as V, Id as W, CommandOutboxMapper as X, CommandOutboxCommitCandidate as Y, CommandOutboxWriter as Z, IdempotencyStore as _, DomainEventFactory as _t, StreamReadResult as a, ExecutionContext as at, IdempotentExecution as b, EventIdFactory as bt, ProjectionCheckpointStore as c, EventCommitCandidate as ct, IdempotencyClaim as d, AnyUncommittedDomainEvent as dt, DeadLetterRecord as et, IdempotencyClaimHandle as f, CreateDomainEventFromFactsOptions as ft, IdempotencyReconciliationDecision as g, DomainEvent as gt, IdempotencyReconciliation as h, CreateUncommittedDomainEventOptions as ht, ReadStreamOptions as i, OutboxWriter as it, withCommit as j, mergeMetadata as jt, WithCommitDeps as k, createUncommittedDomainEvent as kt, ProjectionPosition as l, EventCommitCandidatePosition as lt, IdempotencyOperationErrorContext as m, CreateDomainEventStampOptions as mt, EventStore as n, Outbox as nt, Projection as o, CommitPosition as ot, IdempotencyLease as p, CreateDomainEventOptions as pt, CommandMessageContent as q, EventStoreAppendOptions as r, OutboxRecord as rt, ProjectionCheckpoint as s, CommittedDomainEvent as st, SnapshotStore as t, DispatchTrackingOutbox as tt, isPositionAfter as u, AnyDomainEvent as ut, IdempotentCommitRequest as v, DomainEventFactoryOptions as vt, DeadlineStore as w, UncommittedDomainEventOf as wt, WithIdempotentCommitDeps as x, EventMetadata as xt, IdempotentCommitResult as y, DomainEventStamp as yt, AggregateSnapshot as z, JsonPrimitive as zt };
+export { EventHandler as $, Command as $t, IdempotencyClaimHandle as A, CreateDomainEventFromFactsOptions as At, withIdempotentCommit as B, PendingDomainEvent as Bt, IdentityMap as C, ExecutionContext as Ct, ProjectionPosition as D, EventCommitCandidatePosition as Dt, ProjectionCheckpointStore as E, EventCommitCandidate as Et, IdempotencyStore as F, DomainEventFactory as Ft, CommitEnrollment as G, createDomainEventFactory as Gt, DeadlineStore as H, UncommittedDomainEventOf as Ht, IdempotentCommitRequest as I, DomainEventFactoryOptions as It, WithCommitWorkResult as J, defaultDomainEventFactory as Jt, CommitEnrollmentOptions as K, createDomainEventFromFacts as Kt, IdempotentCommitResult as L, DomainEventStamp as Lt, IdempotencyOperationErrorContext as M, CreateDomainEventStampOptions as Mt, IdempotencyReconciliation as N, CreateUncommittedDomainEventOptions as Nt, isPositionAfter as O, AnyDomainEvent as Ot, IdempotencyReconciliationDecision as P, DomainEvent as Pt, EventBus as Q, AggregateIdentity as Qt, IdempotentExecution as R, EventIdFactory as Rt, AggregateClass as S, OutboxWriter as St, ProjectionCheckpoint as T, CommittedDomainEvent as Tt, DueDeadline as U, copyMetadata as Ut, DeadLetterDeadline as V, UncommittedDomainEvent as Vt, AggregateCommitToken as W, createDomainEvent as Wt, TransactionScope as X, recordDomainEvent as Xt, withCommit as Y, mergeMetadata as Yt, TransactionalOptions as Z, ClockFactory as Zt, capturePersistenceBaseline as _, routeEventsToCommandOutbox as _t, EventStoreAppendOptions as a, Version as at, persistenceProjectionDrifted as b, Outbox as bt, StreamReadResult as c, Id as ct, RepositoryTracking as d, CommandMessageContent as dt, CommandHandler as en, OnceOptions as et, UnitOfWorkIdentityMap as f, CommandMessageRelationships as ft, PersistenceModel as g, DurableCommandMessage as gt, PersistenceLifecycle as h, CommandOutboxWriter as ht, EventStore as i, JsonValue as in, ReplayableAggregate as it, IdempotencyLease as j, CreateDomainEventOptions as jt, IdempotencyClaim as k, AnyUncommittedDomainEvent as kt, AggregatePersistenceWrite as l, IdGenerator as lt, PersistenceChanges as m, CommandOutboxMapper as mt, ReplayableStreamPages as n, JsonObject as nn, Aggregate as nt, EventStreamReader as o, sameVersion as ot, PersistenceBaseline as p, CommandOutboxCommitCandidate as pt, WithCommitDeps as q, createUncommittedDomainEvent as qt, reconstituteAggregateFromStreamPages as r, JsonPrimitive as rn, AggregateSnapshot as rt, ReadStreamOptions as s, toVersion as st, SnapshotStore as t, PublishedCommand as tn, PublishOptions as tt, AggregateWriteIntent as u, CommandCommitOriginCandidate as ut, derivePersistenceChanges as v, DeadLetterRecord as vt, Projection as w, CommitPosition as wt, recapturePersistenceBaseline as x, OutboxRecord as xt, insertPersistenceBaseline as y, DispatchTrackingOutbox as yt, WithIdempotentCommitDeps as z, EventMetadata as zt };
 //# sourceMappingURL=snapshot-store.d.ts.map