@shirudo/ddd-kit 3.0.0-rc.10 → 3.0.0-rc.12

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { $ as ReentrantEventRecordingError, A as IdempotencyReconciliationRequiredErrorOptions, B as MisaddressedEventError, C as IdempotencyClaimLostErrorOptions, D as IdempotencyKeyReuseError, E as IdempotencyInFlightErrorOptions, F as InvalidIntegrationMessageError, G as NonProgressingEventStreamPageErrorOptions, H as MissingFoldError, I as InvalidVersionError, J as PendingEventLimitExceededErrorOptions, K as PendingEventBatchMismatchError, L as KitErrorCode, M as InMemoryCapacityExceededErrorOptions, N as InfrastructureError, O as IdempotencyKeyReuseErrorOptions, P as InvalidCommandMessageError, Q as ProjectionReceiptViolationError, R as KitErrorOptions, S as IdempotencyClaimLostError, T as IdempotencyInFlightError, U as MissingHandlerError, V as MissingEntityIdError, W as NonProgressingEventStreamPageError, X as ProjectionIdentityViolationError, Y as ProjectionGapError, Z as ProjectionOrderViolationError, _ as ErrorMapperFailedErrorOptions, a as CapabilityRegistryConflictError, at as SnapshotVersionNotRestoredError, b as ForeignEventError, c as ConcurrencyConflictReason, ct as UnmanagedInstanceError, d as DuplicateAggregateError, dt as UnregisteredHandlerError, et as ReplayHeadMismatchError, f as DuplicateAggregateErrorOptions, ft as UnregisteredHandlerErrorOptions, g as ErrorMapperFailedError, gt as isWiringErrorLike, h as DuplicateHandlerRegistrationErrorOptions, ht as isInfrastructureErrorLike, i as AggregateNotFoundErrorOptions, it as SnapshotSchemaMismatchErrorOptions, j as InMemoryCapacityExceededError, k as IdempotencyReconciliationRequiredError, l as DirectStateMutationError, lt as UnmintedEventError, m as DuplicateHandlerRegistrationError, mt as isDomainErrorLike, n as AggregateDeletedError, nt as SnapshotCorruptedError, o as ConcurrencyConflictError, ot as SnapshotVersionNotRestoredErrorOptions, p as DuplicateEventIdError, pt as UnreplayableAggregateError, q as PendingEventLimitExceededError, r as AggregateNotFoundError, rt as SnapshotSchemaMismatchError, s as ConcurrencyConflictErrorOptions, st as UnenrolledChangesError, t as AggregateAddressMismatchOptions, tt as ReplayHeadMismatchErrorOptions, u as DomainError, ut as UnprojectableEventError, v as EventHarvestError, w as IdempotencyCompletionWithoutClaimError, x as HostileStateKeyError, y as FoldReturnedNoStateError, z as KitWiringError } from "./chunks/kit-errors.js";
-import { $ as routeEventsToCommandOutbox, A as WithCommitWorkResult, At as defaultDomainEventFactory, B as ReplayableAggregate, Bt as JsonValue, C as DeadLetterDeadline, Ct as UncommittedDomainEvent, D as CommitEnrollment, Dt as createDomainEventFactory, E as AggregateCommitToken, Et as createDomainEvent, F as EventHandler, Ft as Command, G as IdGenerator, H as sameVersion, I as OnceOptions, It as CommandHandler, J as CommandMessageRelationships, K as CommandCommitOriginCandidate, L as PublishOptions, Lt as PublishedCommand, M as TransactionScope, Mt as recordDomainEvent, N as TransactionalOptions, Nt as ClockFactory, O as CommitEnrollmentOptions, Ot as createDomainEventFromFacts, P as EventBus, Pt as AggregateAddress, Q as DurableCommandMessage, R as Aggregate, Rt as JsonObject, S as withIdempotentCommit, St as PendingDomainEvent, T as DueDeadline, Tt as copyMetadata, U as toVersion, V as Version, W as Id, X as CommandOutboxMapper, Y as CommandOutboxCommitCandidate, Z as CommandOutboxWriter, _ as IdempotencyStore, _t as DomainEventFactory, a as StreamReadResult, at as ExecutionContext, b as IdempotentExecution, bt as EventIdFactory, c as ProjectionCheckpointStore, ct as EventCommitCandidate, d as IdempotencyClaim, dt as AnyUncommittedDomainEvent, et as DeadLetterRecord, f as IdempotencyClaimHandle, ft as CreateDomainEventFromFactsOptions, g as IdempotencyReconciliationDecision, gt as DomainEvent, h as IdempotencyReconciliation, ht as CreateUncommittedDomainEventOptions, i as ReadStreamOptions, it as OutboxWriter, j as withCommit, jt as mergeMetadata, k as WithCommitDeps, kt as createUncommittedDomainEvent, l as ProjectionPosition, lt as EventCommitCandidatePosition, m as IdempotencyOperationErrorContext, mt as CreateDomainEventStampOptions, n as EventStore, nt as Outbox, o as Projection, ot as CommitPosition, p as IdempotencyLease, pt as CreateDomainEventOptions, q as CommandMessageContent, r as EventStoreAppendOptions, rt as OutboxRecord, s as ProjectionCheckpoint, st as CommittedDomainEvent, t as SnapshotStore, tt as DispatchTrackingOutbox, u as isPositionAfter, ut as AnyDomainEvent, v as IdempotentCommitRequest, vt as DomainEventFactoryOptions, w as DeadlineStore, wt as UncommittedDomainEventOf, x as WithIdempotentCommitDeps, xt as EventMetadata, y as IdempotentCommitResult, yt as DomainEventStamp, z as AggregateSnapshot, zt as JsonPrimitive } from "./chunks/snapshot-store.js";
+import { $ as PendingEventLimitExceededErrorOptions, A as IdempotencyInFlightErrorOptions, B as InvalidEventStreamPageErrorOptions, C as FoldReturnedNoStateError, Ct as UnreplayableAggregateError, D as IdempotencyClaimLostErrorOptions, Dt as isWiringErrorLike, E as IdempotencyClaimLostError, Et as isInfrastructureErrorLike, F as InMemoryCapacityExceededError, G as KitWiringError, H as InvalidVersionError, I as InMemoryCapacityExceededErrorOptions, J as MissingFoldError, K as MisattributedEventError, L as InfrastructureError, M as IdempotencyKeyReuseErrorOptions, N as IdempotencyReconciliationRequiredError, O as IdempotencyCompletionWithoutClaimError, P as IdempotencyReconciliationRequiredErrorOptions, Q as PendingEventLimitExceededError, R as InvalidCommandMessageError, S as EventStreamPageReason, St as UnregisteredHandlerErrorOptions, T as HostileStateKeyError, Tt as isDomainErrorLike, U as KitErrorCode, V as InvalidIntegrationMessageError, W as KitErrorOptions, X as PendingEventBatchMismatchError, Y as MissingHandlerError, Z as PendingEventBatchMismatchErrorOptions, _ as DuplicateHandlerRegistrationError, _t as UnenrolledChangesErrorOptions, a as AggregateNotFoundErrorOptions, at as ReentrantEventRecordingErrorOptions, b as ErrorMapperFailedErrorOptions, bt as UnprojectableEventError, c as ConcurrencyConflictErrorOptions, ct as ReplayTargetMismatchError, d as DirectStateMutationErrorOptions, dt as SnapshotCorruptedError, et as ProjectionGapError, f as DomainError, ft as SnapshotSchemaMismatchError, g as DuplicateEventIdErrorOptions, gt as UnenrolledChangesError, h as DuplicateEventIdError, ht as SnapshotVersionNotRestoredErrorOptions, i as AggregateNotFoundError, it as ReentrantEventRecordingError, j as IdempotencyKeyReuseError, k as IdempotencyInFlightError, l as ConcurrencyConflictReason, lt as ReplayTargetMismatchErrorOptions, m as DuplicateAggregateErrorOptions, mt as SnapshotVersionNotRestoredError, n as AggregateDeletedErrorOptions, nt as ProjectionOrderViolationError, o as CapabilityRegistryConflictError, ot as ReplayRejectedError, p as DuplicateAggregateError, pt as SnapshotSchemaMismatchErrorOptions, q as MissingEntityIdError, r as AggregateIdentityMismatchOptions, rt as ProjectionReceiptViolationError, s as ConcurrencyConflictError, st as ReplayRejectedErrorOptions, t as AggregateDeletedError, tt as ProjectionIdentityViolationError, u as DirectStateMutationError, ut as ReplayTargetMismatchReason, v as DuplicateHandlerRegistrationErrorOptions, vt as UnmanagedInstanceError, w as ForeignEventError, wt as UnreplayableAggregateErrorOptions, x as EventHarvestError, xt as UnregisteredHandlerError, y as ErrorMapperFailedError, yt as UnmintedEventError, z as InvalidEventStreamPageError } from "./chunks/kit-errors.js";
+import { $ as EventHandler, $t as Command, A as IdempotencyClaimHandle, At as CreateDomainEventFromFactsOptions, B as withIdempotentCommit, Bt as PendingDomainEvent, C as IdentityMap, Ct as ExecutionContext, D as ProjectionPosition, Dt as EventCommitCandidatePosition, E as ProjectionCheckpointStore, Et as EventCommitCandidate, F as IdempotencyStore, Ft as DomainEventFactory, G as CommitEnrollment, Gt as createDomainEventFactory, H as DeadlineStore, Ht as UncommittedDomainEventOf, I as IdempotentCommitRequest, It as DomainEventFactoryOptions, J as WithCommitWorkResult, Jt as defaultDomainEventFactory, K as CommitEnrollmentOptions, Kt as createDomainEventFromFacts, L as IdempotentCommitResult, Lt as DomainEventStamp, M as IdempotencyOperationErrorContext, Mt as CreateDomainEventStampOptions, N as IdempotencyReconciliation, Nt as CreateUncommittedDomainEventOptions, O as isPositionAfter, Ot as AnyDomainEvent, P as IdempotencyReconciliationDecision, Pt as DomainEvent, Q as EventBus, Qt as AggregateIdentity, R as IdempotentExecution, Rt as EventIdFactory, S as AggregateClass, St as OutboxWriter, T as ProjectionCheckpoint, Tt as CommittedDomainEvent, U as DueDeadline, Ut as copyMetadata, V as DeadLetterDeadline, Vt as UncommittedDomainEvent, W as AggregateCommitToken, Wt as createDomainEvent, X as TransactionScope, Xt as recordDomainEvent, Y as withCommit, Yt as mergeMetadata, Z as TransactionalOptions, Zt as ClockFactory, _ as capturePersistenceBaseline, _t as routeEventsToCommandOutbox, a as EventStoreAppendOptions, at as Version, b as persistenceProjectionDrifted, bt as Outbox, c as StreamReadResult, ct as Id, d as RepositoryTracking, dt as CommandMessageContent, en as CommandHandler, et as OnceOptions, f as UnitOfWorkIdentityMap, ft as CommandMessageRelationships, g as PersistenceModel, gt as DurableCommandMessage, h as PersistenceLifecycle, ht as CommandOutboxWriter, i as EventStore, in as JsonValue, it as ReplayableAggregate, j as IdempotencyLease, jt as CreateDomainEventOptions, k as IdempotencyClaim, kt as AnyUncommittedDomainEvent, l as AggregatePersistenceWrite, lt as IdGenerator, m as PersistenceChanges, mt as CommandOutboxMapper, n as ReplayableStreamPages, nn as JsonObject, nt as Aggregate, o as EventStreamReader, ot as sameVersion, p as PersistenceBaseline, pt as CommandOutboxCommitCandidate, q as WithCommitDeps, qt as createUncommittedDomainEvent, r as reconstituteAggregateFromStreamPages, rn as JsonPrimitive, rt as AggregateSnapshot, s as ReadStreamOptions, st as toVersion, t as SnapshotStore, tn as PublishedCommand, tt as PublishOptions, u as AggregateWriteIntent, ut as CommandCommitOriginCandidate, v as derivePersistenceChanges, vt as DeadLetterRecord, w as Projection, wt as CommitPosition, x as recapturePersistenceBaseline, xt as OutboxRecord, y as insertPersistenceBaseline, yt as DispatchTrackingOutbox, z as WithIdempotentCommitDeps, zt as EventMetadata } from "./chunks/snapshot-store.js";
 import { Result } from "@shirudo/result";
 import { ValidationError } from "@shirudo/base-error";
 //#region src/application/cqrs/internal/bus-internals.d.ts
@@ -410,6 +410,32 @@ declare class QueryBus<TMap extends QueryTypeMap = QueryTypeMap, E = string> imp
   executeUnsafe<Q extends Query, R>(query: UntypedMapDispatch<TMap, Q>): Promise<R>;
 }
 //#endregion
+//#region src/persistence/repository/in-memory-transaction.d.ts
+/**
+ * The transaction of one registered store inside an
+ * `InMemoryTransactionScope`. The scope ends it once, with `commit` or
+ * `rollback`.
+ */
+interface InMemoryTransaction {
+  /**
+   * Ends the transaction and keeps its writes. It must not throw. If a commit
+   * throws, the scope still commits the other stores and rejects with the
+   * first failure, so the writes stay partly committed.
+   */
+  commit(): void;
+  /** Ends the transaction and undoes its writes. */
+  rollback(): void;
+}
+/**
+ * An in-memory store that you can register with an
+ * `InMemoryTransactionScope`. The store prepares its rollback when a
+ * transaction begins. The scope never reads the state of a store.
+ */
+interface InMemoryTransactionParticipant {
+  /** Begins a transaction. Only an `InMemoryTransactionScope` calls this method. */
+  beginTransaction(): InMemoryTransaction;
+}
+//#endregion
 //#region src/application/deadlines/adapters/in-memory-deadline-store.d.ts
 /** Construction options for {@link InMemoryDeadlineStore}. */
 interface InMemoryDeadlineStoreOptions {
@@ -428,23 +454,46 @@ interface InMemoryDeadlineStoreOptions {
  * limit rejects a new address before mutation; delivery state is never
  * silently evicted.
  *
- * **Not transaction-aware**, the same documented limitation as the
- * other in-memory references: a rolled-back `schedule` or `cancel`
- * stays applied here. The transactional half of the contract is the
- * SQL adapter's job; prove it with `createDeadlineStoreContractTests`
- * and its rollback capability.
+ * On its own, the store knows nothing about your `TransactionScope`
+ * rollbacks: a rolled-back `schedule` or `cancel` stays applied. Register
+ * the store with an `InMemoryTransactionScope` for tests that roll back or
+ * retry.
+ *
+ * A processor reads only committed deadlines. While a transaction is open,
+ * `due` skips a deadline that the transaction scheduled. For an address that
+ * the transaction rescheduled or cancelled, it returns the committed
+ * deadline as it was at the first write of the transaction. A failure report
+ * against that deadline counts its attempts. At the ceiling, `due` stops
+ * returning it until the transaction ends. A rollback also undoes an acknowledgement or a failure report
+ * that a processor made while the transaction was open. The processor then
+ * delivers that deadline again. For production, prove the transactional half
+ * of the contract with `createDeadlineStoreContractTests` and its rollback
+ * capability.
  *
  * Payloads are deep-copied on schedule and on delivery
  * (`structuredClone`), so neither side can mutate the other's copy.
  */
-declare class InMemoryDeadlineStore<TPayload = unknown> implements DeadlineStore<TPayload> {
+declare class InMemoryDeadlineStore<TPayload = unknown> implements DeadlineStore<TPayload>, InMemoryTransactionParticipant {
   private readonly pending;
   /** Keyed by deliveryId: several incarnations of one address can be dead. */
   private readonly dead;
   private readonly maxDeliveryAttempts;
   private readonly maxRecords;
   private nextSequence;
+  /**
+   * The committed deadline of each address that the open transaction wrote,
+   * captured at its first write. `undefined` marks an address without one.
+   */
+  private committedVersions;
   constructor(options?: InMemoryDeadlineStoreOptions);
+  /**
+   * Records the state that a rollback of an `InMemoryTransactionScope`
+   * returns to: the pending and the dead-letter records. The rollback
+   * keeps the sequence counter, as a database sequence does, so a
+   * delivery id stays unique. Until the transaction ends, `due` returns the
+   * committed deadline of each address that the transaction writes.
+   */
+  beginTransaction(): InMemoryTransaction;
   schedule(deadline: {
     scope: string;
     key: string;
@@ -453,6 +502,15 @@ declare class InMemoryDeadlineStore<TPayload = unknown> implements DeadlineStore
   }): Promise<void>;
   cancel(scope: string, key: string): Promise<void>;
   due(now: Date, limit: number): Promise<ReadonlyArray<DueDeadline<TPayload>>>;
+  private recordCommittedVersion;
+  /**
+   * The pending deadlines that a processor may see. For an address that the
+   * open transaction wrote, it is the committed deadline, if any, and not
+   * the live record.
+   */
+  private committedPending;
+  /** The address of the committed deadline with this delivery id, if any. */
+  private committedVersionAddress;
   markDelivered(deliveryIds: ReadonlyArray<string>): Promise<void>;
   markFailed(deliveryId: string, error?: unknown): Promise<DeadLetterDeadline<TPayload> | undefined>;
   deadLetters(): Promise<ReadonlyArray<DeadLetterDeadline<TPayload>>>;
@@ -728,14 +786,26 @@ interface InMemoryIdempotencyStoreOptions {
  * process must configure the limit or use a durable adapter; exhaustion
  * rejects new keys before mutation and never forgets an idempotency decision.
  *
- * It is deliberately not transaction-aware. Claims and staged outcomes carry
- * bounded leases, while every mutation compares the store-minted token. An
- * expired pending claim may be replaced; an expired staged outcome cannot be
- * guessed away and instead returns `reconciliation-required`. Only an
- * authoritative `committed` / `not-committed` decision can settle it.
+ * On its own, the store is the reference for the leased family: it cannot
+ * see commits or rollbacks. Claims and staged outcomes carry bounded leases,
+ * while every mutation compares the store-minted token. An expired pending
+ * claim may be replaced; an expired staged outcome cannot be guessed away and
+ * instead returns `reconciliation-required`. Only an authoritative
+ * `committed` / `not-committed` decision can settle it.
+ *
+ * Register the store with an `InMemoryTransactionScope` for tests that roll
+ * back or retry. A rollback then undoes the writes of `claim` and `complete`,
+ * which the port runs inside the transaction. It returns each key that they
+ * wrote to its earlier entry. The lease operations `renew`, `confirm`,
+ * `abandon`, and `reconcile` stay out of band, as the port defines them. A
+ * rollback keeps their writes on every other key. A confirmation that
+ * arrives after the next transaction began therefore survives the rollback
+ * of that transaction.
  */
-declare class InMemoryIdempotencyStore<TCtx = unknown> implements IdempotencyStore<TCtx> {
+declare class InMemoryIdempotencyStore<TCtx = unknown> implements IdempotencyStore<TCtx>, InMemoryTransactionParticipant {
   private readonly entries;
+  /** The entries that `claim` and `complete` replaced in the open transaction. */
+  private replacedInTransaction;
   private readonly clock;
   private readonly claimTokenFactory;
   private readonly leaseDurationMs;
@@ -743,6 +813,12 @@ declare class InMemoryIdempotencyStore<TCtx = unknown> implements IdempotencySto
   private readonly maxEntries;
   private tokenGeneration;
   constructor(options?: InMemoryIdempotencyStoreOptions);
+  /**
+   * Starts to record the entries that `claim` and `complete` replace. The
+   * rollback restores them in reverse order. It keeps the token generation,
+   * so a token from a rolled-back claim never names a later claim.
+   */
+  beginTransaction(): InMemoryTransaction;
   claim(_ctx: TCtx, key: string, fingerprint: string): Promise<IdempotencyClaim>;
   complete(_ctx: TCtx, claim: IdempotencyClaimHandle, outcome: unknown): Promise<void>;
   renew(claim: IdempotencyClaimHandle): Promise<IdempotencyLease | undefined>;
@@ -753,7 +829,15 @@ declare class InMemoryIdempotencyStore<TCtx = unknown> implements IdempotencySto
   get size(): number;
   /** Test hook: drops every record. */
   clear(): void;
+  /**
+   * Returns the claim that the stored entry of the key decides, or
+   * `undefined` when the store can create a pending claim. Throws for a
+   * reused key, a claim in flight, and a full store.
+   */
+  private decideFromStoredEntry;
+  private newTokenPart;
   private createPending;
+  private writeInTransaction;
   private lease;
   private nowMs;
   private claimLost;
@@ -761,7 +845,7 @@ declare class InMemoryIdempotencyStore<TCtx = unknown> implements IdempotencySto
 //#endregion
 //#region src/application/projections/adapters/in-memory-checkpoint-store.d.ts
 interface InMemoryProjectionCheckpointStoreOptions {
-  /** Maximum checkpoints across all projection names and aggregate addresses. */
+  /** Maximum checkpoints across all projection names and aggregate identities. */
   readonly maxCheckpoints?: number;
 }
 /**
@@ -770,16 +854,19 @@ interface InMemoryProjectionCheckpointStoreOptions {
  * serves tests and in-memory read models.
  *
  * Its checkpoint-key locks serialize competing projectors only inside one
- * process and only when they share this store instance. It is **not
- * transaction-aware** (the `ctx` parameter is ignored): a rolled-back
- * projector batch does not roll back its checkpoints. Use it for tests and
- * disposable in-memory read models; production atomicity is the durable
- * adapter's contract, proved with `createProjectionCheckpointStoreContractTests`
- * and its rollback capability.
+ * process and only when they share this store instance. The store ignores
+ * the `ctx` parameter. On its own, it knows nothing about your
+ * `TransactionScope` rollbacks: a rolled-back projector batch keeps its
+ * checkpoints. Register the store with an `InMemoryTransactionScope` for
+ * tests that roll back or retry. While a transaction is open, `hasReached`
+ * answers from the checkpoints at the start of the transaction. Use it for
+ * tests and disposable in-memory read models; production atomicity is the
+ * durable adapter's contract, proved with
+ * `createProjectionCheckpointStoreContractTests` and its rollback capability.
  *
  * Without `maxCheckpoints`, checkpoint retention is unbounded and supported
  * only for finite-lifetime tests and demos. A configured limit rejects a new
- * address before mutation; existing watermarks remain updatable and are never
+ * identity before mutation; existing watermarks remain updatable and are never
  * evicted because forgetting one would change projection correctness.
  *
  * Do not nest `withCheckpointLocks` calls whose key sets overlap. This
@@ -787,18 +874,27 @@ interface InMemoryProjectionCheckpointStoreOptions {
  * on the key its caller still holds and therefore neither enters nor fails
  * loudly.
  */
-declare class InMemoryProjectionCheckpointStore implements ProjectionCheckpointStore<unknown> {
+declare class InMemoryProjectionCheckpointStore implements ProjectionCheckpointStore<unknown>, InMemoryTransactionParticipant {
   /** projection name -> JSON [aggregateType, aggregateId] -> receipt */
   private readonly checkpoints;
   /** Full checkpoint key -> tail of the process-local exclusive-access queue. */
   private readonly lockTails;
   private readonly maxCheckpoints;
   private checkpointCount;
+  /** The checkpoints at the start of the open transaction. */
+  private committedCheckpoints;
   constructor(options?: InMemoryProjectionCheckpointStoreOptions);
-  withCheckpointLocks<R>(_ctx: unknown, projection: string, addresses: ReadonlyArray<AggregateAddress>, work: () => Promise<R>): Promise<R>;
-  load(_ctx: unknown, projection: string, address: AggregateAddress): Promise<ProjectionCheckpoint | undefined>;
-  save(_ctx: unknown, projection: string, address: AggregateAddress, checkpoint: ProjectionCheckpoint): Promise<void>;
-  hasReached(projection: string, address: AggregateAddress, position: ProjectionPosition): Promise<boolean>;
+  /**
+   * Records the state that a rollback of an `InMemoryTransactionScope`
+   * returns to: the checkpoints and their count. Until the transaction
+   * ends, `hasReached` reads these recorded checkpoints. The rollback
+   * keeps the checkpoint locks, because a caller still holds them.
+   */
+  beginTransaction(): InMemoryTransaction;
+  withCheckpointLocks<R>(_ctx: unknown, projection: string, identities: ReadonlyArray<AggregateIdentity>, work: () => Promise<R>): Promise<R>;
+  load(_ctx: unknown, projection: string, identity: AggregateIdentity): Promise<ProjectionCheckpoint | undefined>;
+  save(_ctx: unknown, projection: string, identity: AggregateIdentity, checkpoint: ProjectionCheckpoint): Promise<void>;
+  hasReached(projection: string, identity: AggregateIdentity, position: ProjectionPosition): Promise<boolean>;
   reset(_ctx: unknown, projection: string): Promise<void>;
 }
 //#endregion
@@ -1181,8 +1277,8 @@ interface ProjectionBatchResult {
  *   Because checkpoints advance only across a verified chain, a position
  *   at or behind the watermark is already traversed and can be skipped under
  *   the source's one-logical-event-per-position contract.
- * - **Feeds are complete per aggregate address.** Once a feed supplies one
- *   address, it must supply every committed envelope in that address's cursor
+ * - **Feeds are complete per aggregate identity.** Once a feed supplies one
+ *   identity, it must supply every committed envelope in that aggregate's cursor
  *   chain. Do not event-type-filter a projector subscription. Irrelevant event
  *   types are explicit no-ops in `Projection.apply`; invoking the handler and
  *   checkpointing their positions preserves continuity.
@@ -1201,13 +1297,13 @@ interface ProjectionBatchResult {
  *   redeliveries.
  * - **Malformed envelopes reject loudly.** A missing/empty `eventId`, a
  *   missing/invalid `position`, missing `source.aggregateId` /
- *   `source.aggregateType`, or an optional event address contradicting its
+ *   `source.aggregateType`, or an optional event identity contradicting its
  *   authoritative envelope source fails the batch BEFORE anything is applied.
  *   The domain event remains persistence-agnostic.
  * - **Competing instances serialize by checkpoint key.** The required
  *   {@link ProjectionCheckpointStore.withCheckpointLocks} callback covers the
- *   complete load / apply / save critical section for every addressed
- *   aggregate. The adapter must lock a key even when its checkpoint row does
+ *   complete load / apply / save critical section for every aggregate of
+ *   the batch. The adapter must lock a key even when its checkpoint row does
  *   not exist yet; a plain row lock is insufficient at genesis. Without that
  *   adapter guarantee, only a hard single-projector deployment is safe.
  *
@@ -1231,7 +1327,7 @@ declare class Projector<Evt extends AnyDomainEvent, TCtx = unknown> {
    * per advanced aggregate. Rejects
    * (after rollback) when a handler throws or an envelope carries no
    * valid cursor; the caller's at-least-once redelivery retries the batch.
-   * The input must be a complete, ordered feed per aggregate address; an
+   * The input must be a complete, ordered feed per aggregate identity; an
    * event-type-filtered subscription cannot satisfy the cursor contract.
    * An already-aborted signal rejects before validation or transaction setup.
    * In-flight cancellation is forwarded to the transaction scope rather than
@@ -1240,19 +1336,19 @@ declare class Projector<Evt extends AnyDomainEvent, TCtx = unknown> {
   project(events: ReadonlyArray<CommittedDomainEvent<Evt>>, options?: ProjectOptions): Promise<ProjectionBatchResult>;
   /**
    * The wait-for-version query: `true` when this projection has
-   * processed the addressed aggregate at least up to `position`. Pass the
+   * processed the given aggregate at least up to `position`. Pass the
    * position of the last event the awaited commit emitted (see
    * {@link ProjectionCheckpointStore.hasReached} for why the full
    * cursor, not just the version).
    */
-  hasProcessed(address: AggregateAddress, position: ProjectionPosition): Promise<boolean>;
+  hasProcessed(identity: AggregateIdentity, position: ProjectionPosition): Promise<boolean>;
   /**
    * Rebuild entry point: one transaction that clears this
    * projection's checkpoints and, when the projection provides
    * `truncate`, the read model with them. Replay the source through
    * {@link Projector.project} afterwards. Stop all live consumers for this
    * projection before reset and keep them stopped through catch-up replay;
-   * rebuild is not coordinated by the per-address delivery locks.
+   * rebuild is not coordinated by the per-aggregate delivery locks.
    */
   reset(): Promise<void>;
   /**
@@ -1271,291 +1367,6 @@ declare class Projector<Evt extends AnyDomainEvent, TCtx = unknown> {
   toOutboxSink(): OutboxSink<Evt>;
 }
 //#endregion
-//#region src/persistence/repository/identity-map.d.ts
-/**
- * A class reference used as the type key of the identity map. Keying
- * on the CLASS (not a name string) makes collisions impossible by
- * construction: `Restaurant` and `Booking` are different keys even if
- * someone names two aggregates identically across modules, and there
- * is no string-discipline to maintain.
- *
- * `Function & { prototype: TAgg }` carries this alone. The kit's aggregate
- * convention is a **protected constructor** plus static factories, and
- * TypeScript rejects assigning such a class to a construct-signature type, so
- * the prototype witness is what accepts them. It infers `TAgg` as well.
- * Measured: a construct signature beside it changes neither what the type
- * accepts nor what it infers, and it was the last `any` in the published
- * types.
- */
-type AggregateClass<TAgg> = Function & {
-  prototype: TAgg;
-};
-/**
- * Per-unit-of-work Identity Map (Fowler, PoEAA): within one operation,
- * one aggregate type+id maps to exactly ONE in-memory instance.
- *
- * This is the shipped implementation of the contract the
- * Repository guide (`docs/guide/repository.md`) places on
- * `AggregatePersistence` implementations: two `findById(id)` calls in the same
- * unit of work MUST return the same instance, because commit-token
- * write registration dedupes by JavaScript object identity. Two instances for
- * one logical aggregate can otherwise produce two tokens, two harvests,
- * and two post-commit lifecycle calls.
- *
- * Storage is two-level (per-type stores created lazily), so
- * `Restaurant:123` and `Booking:123` can never collide: the type key
- * is the aggregate CLASS, not the id alone and not a name string.
- *
- * Repository read-path contract:
- *
- * ```ts
- * async findById(id: OrderId): Promise<Order | undefined> {
- *   const cached = this.tracking.identityMap.get(Order, id);
- *   if (cached) return cached;
- *   // Deleted in this unit of work = gone, even if the physical
- *   // delete is deferred and the row is still visible in the tx.
- *   if (this.tracking.identityMap.isDeleted(Order, id)) return undefined;
- *
- *   const row = await this.loadRow(id);
- *   if (!row) return undefined;
- *   const order = Order.reconstitute(row.id, row.state, row.version);
- *   return this.tracking.trackLoaded(order);
- * }
- * ```
- *
- * Deletion is final within an operation: {@link delete} removes the
- * entry AND records a tombstone, so a later {@link set} of the same
- * type+id throws `AggregateDeletedError`: a second instance of a
- * deleted aggregate can never sneak back into the unit of work, even
- * through a repository whose row delete is deferred.
- *
- * Lifetime is ONE unit of work: the `UnitOfWork` creates a fresh map
- * per `run()` and clears it on close. Never cache across operations;
- * that would silently bypass optimistic concurrency control.
- */
-declare class IdentityMap {
-  private readonly _stores;
-  private readonly _deleted;
-  private _pendingAtRegistration;
-  /** The cached instance for type+id, or `undefined` (also after {@link delete}). */
-  get<TAgg>(type: AggregateClass<TAgg>, id: Id<string>): TAgg | undefined;
-  /** Whether an instance is registered for type+id (false after {@link delete}). */
-  has<TAgg>(type: AggregateClass<TAgg>, id: Id<string>): boolean;
-  /**
-   * Whether type+id was {@link delete}d in this unit of work. The
-   * read path checks this BEFORE hydrating and returns `null`, so
-   * "deleted in this operation" reads uniformly as not-found,
-   * regardless of whether the repository's physical delete already
-   * removed the row or is deferred within the transaction. Without
-   * the check, a read-only probe of a deleted aggregate would crash
-   * in {@link set} for deferred-write repositories and return `null`
-   * for immediate-write ones.
-   */
-  isDeleted<TAgg>(type: AggregateClass<TAgg>, id: Id<string>): boolean;
-  /**
-   * Registers the hydrated instance for type+id.
-   *
-   * - Re-registering the SAME instance is a no-op (idempotent).
-   * - Registering a DIFFERENT instance for an occupied type+id throws:
-   *   that is precisely the identity-map violation this class exists
-   *   to prevent (the repository hydrated twice instead of checking
-   *   {@link get} first), and letting it pass would double-harvest
-   *   events downstream.
-   * - Registering a type+id that was {@link delete}d in this unit of
-   *   work throws `AggregateDeletedError`: deletion is final within
-   *   the operation.
-   */
-  set<TAgg>(type: AggregateClass<TAgg>, id: Id<string>, aggregate: TAgg): void;
-  /**
-   * Registered instances that have recorded MORE pending events than they
-   * carried when first registered (loaded). Used by the unit of work's
-   * end-of-run guard: an aggregate that gained events after load but was
-   * never enrolled would silently drop them. A read-only load, or a
-   * reconstitution that already carried events, shows no increase and is
-   * not reported.
-   */
-  instancesWithNewPendingEvents(): unknown[];
-  /**
-   * Takes back a registration WITHOUT a tombstone: the entry is removed
-   * only when the stored instance IS the given one, and a later
-   * {@link set} of the same type+id stays legal. The Unit of Work calls
-   * this when a registration step fails after {@link set} already ran, so
-   * the failed instance cannot be served by `findById` as a phantom.
-   * This is rollback, not deletion; deletion finality belongs to
-   * {@link delete}.
-   */
-  discard<TAgg>(type: AggregateClass<TAgg>, id: Id<string>, aggregate: TAgg): void;
-  /**
-   * Removes the entry for type+id and records a tombstone: subsequent
-   * {@link get} / {@link has} report absence, and a subsequent
-   * {@link set} of the same type+id throws `AggregateDeletedError`.
-   * The Unit of Work calls this as part of `repository.remove(aggregate)`;
-   * repository adapters receive only the read-only
-   * identity-map view.
-   */
-  delete<TAgg>(type: AggregateClass<TAgg>, id: Id<string>): void;
-  /** Empties all stores and tombstones. Called by the unit of work on close. */
-  clear(): void;
-}
-//#endregion
-//#region src/persistence/repository/persistence-model.d.ts
-/** Whether a baseline represents an existing row or a pending insert. */
-type PersistenceLifecycle = "loaded" | "new";
-/**
- * Adapter-owned projection and change derivation for one aggregate type.
- *
- * The domain model does not implement this contract. A repository adapter
- * chooses what it persists, how that projection is captured at load, and
- * whether a change set is a partial diff or a full replacement.
- */
-interface PersistenceModel<TAggregate, TBaseline, TChangeSet> {
-  /**
-   * Captures the adapter's persistence projection at the current moment.
-   * Return a detached value or an immutable value object: the Unit of Work
-   * retains it as a baseline and cannot make an arbitrary adapter type safe.
-   *
-   * Capture must be deterministic for an unchanged aggregate: the Unit of
-   * Work compares successive captures to detect mutation after write
-   * registration. A capture that embeds ambient values (clock reads,
-   * random ids) would make every commit look mutated. The default
-   * comparison is the package's structural deep equality, which matches
-   * `Set` members and `Map` keys by reference (JS `SameValueZero`
-   * semantics): a capture that re-materializes object Set members or Map
-   * keys on every call must supply {@link captureEquals}.
-   *
-   * A column that the store owns stays out of the capture, for example an
-   * `updatedAt` that the adapter stamps; `flush` writes it. A captured store
-   * column pushes a stale value back on the next write, or it marks every
-   * row as changed.
-   */
-  capture(aggregate: TAggregate): TBaseline;
-  /**
-   * Adapter-owned equality for two captures of the persistence projection.
-   * Optional: the default is the package's structural deep equality (Set
-   * members and Map keys by reference). Supply it when the capture shape
-   * needs domain-specific comparison, for example rebuilt value-object Set
-   * members compared by value.
-   */
-  readonly captureEquals?: (a: TBaseline, b: TBaseline) => boolean;
-  /**
-   * Derives the adapter's write payload from its own baseline.
-   *
-   * `baseline` is absent for a new aggregate. `lifecycle` disambiguates that
-   * case from an adapter whose loaded baseline type itself admits `undefined`.
-   * The returned payload must not share mutable references with the aggregate;
-   * it is the exact value later handed to `flush`.
-   */
-  changes(baseline: TBaseline | undefined, aggregate: TAggregate, lifecycle: PersistenceLifecycle): TChangeSet;
-  /** Tells orchestration whether the derived state write is empty. */
-  isEmpty(changes: TChangeSet): boolean;
-}
-declare const persistenceBaselineBrand: unique symbol;
-/**
- * Opaque, typed receipt for an adapter-owned persistence baseline.
- *
- * It intentionally exposes no data. The Unit of Work may retain the token and
- * ask the owning adapter capability to derive changes, but cannot branch on or
- * couple itself to the baseline's shape.
- */
-interface PersistenceBaseline<TAggregate, TChangeSet> {
-  readonly [persistenceBaselineBrand]: (aggregate: TAggregate) => TChangeSet;
-}
-/** A derived adapter change set plus its adapter-defined emptiness result. */
-interface PersistenceChanges<TChangeSet> {
-  readonly value: TChangeSet;
-  readonly empty: boolean;
-}
-/** Captures a baseline for an aggregate restored by a repository adapter. */
-declare function capturePersistenceBaseline<TAggregate, TBaseline, TChangeSet>(model: PersistenceModel<TAggregate, TBaseline, TChangeSet>, aggregate: TAggregate): PersistenceBaseline<TAggregate, TChangeSet>;
-/** Creates the explicit no-row baseline for a newly added aggregate. */
-declare function insertPersistenceBaseline<TAggregate, TBaseline, TChangeSet>(model: PersistenceModel<TAggregate, TBaseline, TChangeSet>): PersistenceBaseline<TAggregate, TChangeSet>;
-/**
- * Captures the aggregate's current adapter projection using the capability
- * carried by an existing baseline. Used to seal persistence-last registration.
- */
-declare function recapturePersistenceBaseline<TAggregate, TChangeSet>(baseline: PersistenceBaseline<TAggregate, TChangeSet>, aggregate: TAggregate): PersistenceBaseline<TAggregate, TChangeSet>;
-/**
- * Recaptures the adapter projection and reports whether it drifted from the
- * baseline's stored capture, using the model's `captureEquals` when supplied
- * and structural deep equality otherwise.
- *
- * This, not `changes()`/`isEmpty()`, is the mutation detector: the
- * `PersistenceModel` contract explicitly permits a full-replacement change
- * set whose `isEmpty` is never true, so a non-empty change set proves
- * nothing about mutation. Comparing capture to capture asks the honest
- * question independent of the model's diffing strategy. A `"new"` lifecycle
- * baseline has no stored capture and never reports drift.
- */
-declare function persistenceProjectionDrifted<TAggregate, TChangeSet>(baseline: PersistenceBaseline<TAggregate, TChangeSet>, aggregate: TAggregate): boolean;
-/** Derives a typed adapter change set without exposing the stored baseline. */
-declare function derivePersistenceChanges<TAggregate, TChangeSet>(baseline: PersistenceBaseline<TAggregate, TChangeSet>, aggregate: TAggregate): PersistenceChanges<TChangeSet>;
-//#endregion
-//#region src/application/unit-of-work/persistence-contract.d.ts
-/** The explicit persistence intent registered for one tracked aggregate. */
-type AggregateWriteIntent = "add" | "update" | "remove";
-/** Read-only Identity Map operations available to repository adapters. */
-type UnitOfWorkIdentityMap = Pick<IdentityMap, "get" | "has" | "isDeleted">;
-/**
- * Repository-specific tracking capability handed only to its adapter.
- *
- * Read paths call {@link RepositoryTracking.trackLoaded} before returning a
- * restored aggregate.
- * Write methods exposed to application code are replaced by Unit-of-Work-owned
- * `add`, `update`, and `remove` registrations, so an adapter implementation of
- * those methods cannot perform durable I/O early or skip event harvesting.
- *
- * Contract for repository implementations:
- * - `findById(id)` checks `identityMap.get` BEFORE hydrating, treats
- *   `identityMap.isDeleted` as not-found (`undefined`), and returns
- *   `tracking.trackLoaded(aggregate)` after hydration. This captures the
- *   expected version before application code can mutate the instance.
- * - Adapter objects do not need lifecycle methods; the facade installs the
- *   Unit-of-Work-owned `add`, `update` unless the definition is append-only,
- *   and `remove` with `physicalRemoval`. If a concrete adapter has a method
- *   named `add`, `update`, or `remove` anyway, the facade masks it, installed
- *   or not.
- * - Other repository methods are reads. A custom method that performs a write
- *   would bypass the Unit of Work and violates the adapter contract.
- */
-interface RepositoryTracking<TAggregate extends Aggregate<Id<string>, AnyDomainEvent>> {
-  /**
-   * Registers an aggregate restored by a repository before returning it to
-   * application code. The Unit of Work identity-maps the instance and captures
-   * its current version as the optimistic-concurrency expectation.
-   */
-  trackLoaded(aggregate: TAggregate): TAggregate;
-  /**
-   * Read-only view of the per-operation Identity Map (Fowler): one aggregate type+id,
-   * one in-memory instance. Created fresh per `run()`, cleared on
-   * close; accessing it after close throws
-   * {@link TransactionClosedError}.
-   */
-  readonly identityMap: UnitOfWorkIdentityMap;
-}
-/**
- * Immutable adapter input for one registered aggregate write.
- *
- * `expectedVersion` is captured when a loaded aggregate joins the Unit of
- * Work and is absent for `add`. `version`, `changes`, and `events` describe
- * the exact moment at which the application registered its write intent.
- * Adapters must use the expected/current version pair for their OCC predicate
- * and must not read mutable write state back from an aggregate reference.
- *
- * The predicate itself is adapter code. The compare-and-set must run in the
- * store's own write statement. The kit does not know the store, so it cannot
- * write that statement. The kit owns the version pair and
- * {@link ConcurrencyConflictError}; the repository contract suite proves the
- * predicate.
- */
-interface AggregatePersistenceWrite<TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TChangeSet> {
-  readonly intent: AggregateWriteIntent;
-  readonly aggregateId: TAggregate["id"];
-  readonly expectedVersion: Version | undefined;
-  readonly version: Version;
-  readonly changes: PersistenceChanges<TChangeSet>;
-  readonly events: TAggregate["pendingEvents"];
-}
-//#endregion
 //#region src/application/unit-of-work/errors.d.ts
 /**
  * Thrown when `UnitOfWork.run()` is called while the same instance is
@@ -1579,10 +1390,13 @@ declare class NestedUnitOfWorkError extends KitWiringError<"NESTED_UNIT_OF_WORK"
   constructor();
 }
 /**
- * Thrown when the unit-of-work context is used after `run()` has
- * settled: reading `context.repositories`, calling an adapter-held
- * `tracking.trackLoaded`, or using a repository facade after the transaction
- * has committed or rolled back.
+ * Thrown when the unit-of-work context is used after the unit of work closed
+ * it: reading `context.repositories`, calling an adapter-held
+ * `tracking.trackLoaded`, or using a repository facade after the flush of its
+ * attempt, while the transaction commits, or after it committed or rolled
+ * back. An `add`, `update`, or `remove` between the start of the flush and the
+ * last check before the commit fails the attempt with `AggregateTrackingError`
+ * instead.
  *
  * Use-after-close is a programming bug (typically a leaked context
  * reference or a fire-and-forget promise outliving the callback), so
@@ -1599,11 +1413,27 @@ declare class TransactionClosedError extends KitWiringError<"TRANSACTION_CLOSED"
   readonly operation: string;
   constructor(operation: string);
 }
+/** Why a repository factory result cannot become a facade. */
+type InvalidRepositoryAdapterReason = "not_an_object" | "defines_lifecycle_operation";
+/** Constructor options for {@link InvalidRepositoryAdapterError}. */
+type InvalidRepositoryAdapterErrorOptions = {
+  readonly repository: string;
+  readonly reason: "not_an_object";
+  /** The `typeof` of the value that the factory returned, or `null`. */
+  readonly receivedType: string;
+} | {
+  readonly repository: string;
+  readonly reason: "defines_lifecycle_operation";
+  /** The lifecycle member that the adapter defines. */
+  readonly operation: AggregateWriteIntent;
+};
 /** A repository factory returned a value that cannot be wrapped as a facade. */
 declare class InvalidRepositoryAdapterError extends KitWiringError<"INVALID_REPOSITORY_ADAPTER"> {
   readonly repository: string;
-  readonly receivedType: string;
-  constructor(repository: string, receivedType: string);
+  readonly reason: InvalidRepositoryAdapterReason;
+  readonly receivedType: string | undefined;
+  readonly operation: AggregateWriteIntent | undefined;
+  constructor(options: InvalidRepositoryAdapterErrorOptions);
 }
 /** A Unit of Work received repository wiring that bypassed {@link defineRepository}. */
 declare class InvalidRepositoryDefinitionError extends KitWiringError<"INVALID_REPOSITORY_DEFINITION"> {
@@ -1612,34 +1442,38 @@ declare class InvalidRepositoryDefinitionError extends KitWiringError<"INVALID_R
 }
 /** A repository's persistence-error policy threw or returned a non-kit error. */
 declare class RepositoryErrorMappingFailedError extends KitWiringError<"REPOSITORY_ERROR_MAPPING_FAILED"> {
-  readonly aggregateId: string;
+  readonly identity: AggregateIdentity;
   readonly intent: AggregateWriteIntent;
   readonly mapperCause: unknown;
-  constructor(options: {
-    readonly aggregateId: string;
-    readonly intent: AggregateWriteIntent;
-    readonly persistenceError: unknown;
-    readonly mapperError: unknown;
-  });
+  constructor(options: RepositoryErrorMappingFailedErrorOptions);
+}
+/** Constructor options for {@link RepositoryErrorMappingFailedError}. */
+interface RepositoryErrorMappingFailedErrorOptions {
+  /** The aggregate the error names. */
+  readonly identity: AggregateIdentity;
+  readonly intent: AggregateWriteIntent;
+  /** The store failure the mapper was translating. */
+  readonly persistenceError: unknown;
+  /** The failure of the mapper itself. */
+  readonly mapperError: unknown;
 }
 /** What is wrong with the store statements that build a flush. */
-type FlushStatementReason = "statement_absent" | "no_row_count" | "no_expected_version" | "duplicate_check_failed";
+type FlushStatementReason = "statement_absent" | "no_row_count" | "no_expected_version" | "no_version" | "duplicate_check_failed";
 /**
  * A deterministic defect in the store statements that build a flush.
  *
  * This is a wiring error, not a persistence failure: the statements cannot
  * run the write the Unit of Work registered, and a retry repeats the same
- * outcome. {@link versionedFlush} raises it during the commit phase, so the
- * repository's `mapError` receives it like a store failure. A mapper must
- * return an `InfrastructureError`. So the use case receives the mapper's own
- * error, and the reason stays in the cause chain.
+ * outcome. The commit phase hands it to the caller unchanged, never to the
+ * repository's `mapError`, because a mapper returns an `InfrastructureError`
+ * and would relabel the defect as a store failure.
  */
 declare class InvalidFlushStatementError extends KitWiringError<"INVALID_FLUSH_STATEMENT"> {
-  readonly aggregateType: string;
-  readonly aggregateId: string;
-  readonly intent: AggregateWriteIntent;
+  readonly identity: InvalidFlushStatementErrorOptions["identity"];
+  /** The write, or `null` when the code that found the defect does not know it. */
+  readonly intent: AggregateWriteIntent | null;
   readonly reason: FlushStatementReason;
-  /** What the statement returned instead of a row count. */
+  /** The value that the flush received in place of a valid one. */
   readonly received: string | undefined;
   /** The failure of `isDuplicate`, when the classifier itself threw. */
   readonly classifierCause: unknown;
@@ -1647,9 +1481,9 @@ declare class InvalidFlushStatementError extends KitWiringError<"INVALID_FLUSH_S
 }
 /** The fields that describe one defect of the flush statements. */
 interface InvalidFlushStatementErrorOptions {
-  readonly aggregateType: string;
-  readonly aggregateId: string;
-  readonly intent: AggregateWriteIntent;
+  /** The aggregate the error names. */
+  readonly identity: AggregateIdentity;
+  readonly intent?: AggregateWriteIntent | null;
   readonly reason: FlushStatementReason;
   readonly received?: string;
   /** The store failure that the flush was handling, kept for diagnosis. */
@@ -1657,7 +1491,7 @@ interface InvalidFlushStatementErrorOptions {
   readonly classifierCause?: unknown;
 }
 /** Why an aggregate lifecycle registration was rejected. */
-type AggregateTrackingReason = "not_loaded" | "loaded_as_new" | "different_repository" | "conflicting_intent" | "mutated_after_registration";
+type AggregateTrackingReason = "not_loaded" | "loaded_as_new" | "different_repository" | "conflicting_intent" | "mutated_after_registration" | "registered_during_flush" | "identity_already_tracked";
 /**
  * A deterministic violation of the Unit of Work's aggregate lifecycle.
  *
@@ -1666,13 +1500,23 @@ type AggregateTrackingReason = "not_loaded" | "loaded_as_new" | "different_repos
  * cannot execute truthfully. Retrying the same callback cannot repair it.
  */
 declare class AggregateTrackingError extends KitWiringError<"AGGREGATE_TRACKING"> {
-  readonly aggregateId: string;
+  readonly identity: AggregateIdentity;
   readonly operation: AggregateWriteIntent | "load" | "commit";
   readonly reason: AggregateTrackingReason;
-  readonly registeredIntent?: AggregateWriteIntent | undefined;
-  constructor(aggregateId: string, operation: AggregateWriteIntent | "load" | "commit", reason: AggregateTrackingReason, registeredIntent?: AggregateWriteIntent | undefined, options?: {
-    readonly appendOnly?: boolean;
-  });
+  readonly registeredIntent: AggregateWriteIntent | undefined;
+  constructor(options: AggregateTrackingErrorOptions);
+}
+/** Constructor options for {@link AggregateTrackingError}. */
+interface AggregateTrackingErrorOptions {
+  /** The aggregate the error names. */
+  readonly identity: AggregateIdentity;
+  /** The registration or phase that failed. */
+  readonly operation: AggregateWriteIntent | "load" | "commit";
+  readonly reason: AggregateTrackingReason;
+  /** The intent registered before, for the reasons that name one. */
+  readonly registeredIntent?: AggregateWriteIntent;
+  /** Whether the repository of the aggregate is append-only. */
+  readonly appendOnly?: boolean;
 }
 /**
  * The unit of work failed AFTER the work callback completed
@@ -1698,17 +1542,21 @@ declare class CommitError extends InfrastructureError<"COMMIT_FAILED"> {
   constructor(cause: unknown);
 }
 /**
- * The work callback threw AND the transaction scope rejected with a
- * DIFFERENT error that does not wrap the callback's error in its cause
- * chain - the strongest available signal that the rollback itself
- * failed. The callback's (primary) error is preserved as `cause`, so
- * cause-chain helpers (`someChainRetryable`, `findInCauseChain`) still
- * see a wrapped `ConcurrencyConflictError` & co.; the scope's error is
- * carried in {@link rollbackCause}.
- *
- * Scopes that rethrow the original error (Drizzle, Prisma do) never
- * produce this; scopes that WRAP the original are detected via the
- * cause chain and passed through unchanged instead.
+ * A step inside the transaction threw, and the transaction scope rejected
+ * with a different error that does not wrap that failure in its cause chain.
+ * This is the strongest available signal that the rollback itself failed.
+ * The step is the work callback, or a step after it and before the commit,
+ * for example the outbox write. The failure inside the transaction is the
+ * `cause`, so cause-chain helpers (`someChainRetryable`, `findInCauseChain`)
+ * still see a wrapped `ConcurrencyConflictError` & co. The scope's error is
+ * in {@link rollbackCause}. A wiring error as that failure is the cause too,
+ * so both facts stay visible.
+ *
+ * A scope that rethrows the failure (Drizzle and Prisma do) never produces
+ * this. A scope that wraps the failure is detected through the cause chain.
+ * A wrapped failure of the work passes through unchanged. A wrapped failure
+ * after the work becomes a `CommitError`, or passes through when it is a
+ * wiring error.
  */
 declare class RollbackError extends InfrastructureError<"ROLLBACK_FAILED"> {
   readonly rollbackCause: unknown;
@@ -1856,20 +1704,49 @@ type Then<TChecked, TNext> = unknown extends TChecked ? TNext : TChecked;
 type IsUnion<T, TEach = T> = T extends unknown ? [TEach] extends [T] ? false : true : never;
 /** @inline */
 type PortShapeConstraint<TRepositoryPort> = [Extract<TRepositoryPort, CallableValue>] extends [never] ? true extends IsUnion<TRepositoryPort> ? RepositoryPortViolation<"the port must be one object type, not a union"> : unknown : RepositoryPortViolation<"the port must be an object type, not a function">;
+/** @inline */
+type InstalledRegistration<TAggregate extends Aggregate<Id<string>, AnyDomainEvent>> = AggregateWriteRegistration<TAggregate> & PhysicalRemovalRegistration<TAggregate>;
+/**
+ * Checks a lifecycle member that the port declares: it is required, it
+ * accepts the definition's aggregate, and it returns what the installed
+ * registration returns. An optional member is the trap of a port that
+ * extends a type with `update?` or `remove?`, so it gets its own message.
+ * The return check exists because TypeScript lets a member that returns a
+ * promise or `this` stand in for one that returns void.
+ * @inline
+ */
+type MemberAcceptsAggregate<TRepositoryPort, TMember extends "add" | "update" | "remove", TAggregate extends Aggregate<Id<string>, AnyDomainEvent>> = undefined extends TRepositoryPort[TMember & keyof TRepositoryPort] ? RepositoryPortViolation<`the port's ${TMember} must not be optional`> : [TRepositoryPort] extends [Pick<InstalledRegistration<TAggregate>, TMember>] ? ReturnsWhatTheRegistrationReturns<ReturnType<Extract<TRepositoryPort[TMember & keyof TRepositoryPort], CallableValue>>, ReturnType<InstalledRegistration<TAggregate>[TMember]>> extends true ? unknown : RepositoryPortViolation<`the port's ${TMember} must return void`> : RepositoryPortViolation<`the port's ${TMember} must accept the definition's aggregate`>;
+/**
+ * An `any` result would let a caller use a value that the installed
+ * registration never returns, so it does not count as a match.
+ * @inline
+ */
+type ReturnsWhatTheRegistrationReturns<TDeclared, TInstalled> = 0 extends 1 & TDeclared ? false : [TDeclared] extends [TInstalled] ? true : false;
 /**
- * Checks a lifecycle member that the port declares: it is required, and it
- * accepts the definition's aggregate. An optional member is the trap of a
- * port that extends a type with `update?` or `remove?`, so it gets its own
- * message.
+ * What an adapter type may say about `add`, `update`, and `remove`: nothing.
+ * The Unit of Work installs them on the facade, and a raw adapter that can
+ * write would bypass it wherever it leaves the facade. As a bound on the
+ * adapter type, the rule also holds for a generic adapter and for each
+ * member of a union.
  * @inline
  */
-type MemberAcceptsAggregate<TRepositoryPort, TMember extends "add" | "update" | "remove", TAggregate extends Aggregate<Id<string>, AnyDomainEvent>> = undefined extends TRepositoryPort[TMember & keyof TRepositoryPort] ? RepositoryPortViolation<`the port's ${TMember} must not be optional`> : [TRepositoryPort] extends [Pick<AggregateWriteRegistration<TAggregate> & PhysicalRemovalRegistration<TAggregate>, TMember>] ? unknown : RepositoryPortViolation<`the port's ${TMember} must accept the definition's aggregate`>;
+type LifecycleFreeAdapter = {
+  readonly add?: RepositoryPortViolation<"the adapter must not define add; the unit of work installs it">;
+  readonly update?: RepositoryPortViolation<"the adapter must not define update; the unit of work installs it">;
+  readonly remove?: RepositoryPortViolation<"the adapter must not define remove; the unit of work installs it">;
+};
+/**
+ * The keys that a port declares by name. A string index signature makes every
+ * name a key, which would count an undeclared `update` or `remove` as present.
+ * @inline
+ */
+type DeclaredKeys<T> = keyof { [TKey in keyof T as string extends TKey ? never : number extends TKey ? never : symbol extends TKey ? never : TKey]: T[TKey]; };
 /** @inline */
-type AddConstraint<TRepositoryPort, TAggregate extends Aggregate<Id<string>, AnyDomainEvent>> = "add" extends keyof TRepositoryPort ? MemberAcceptsAggregate<TRepositoryPort, "add", TAggregate> : RepositoryPortViolation<"the port must declare add(aggregate): void">;
+type AddConstraint<TRepositoryPort, TAggregate extends Aggregate<Id<string>, AnyDomainEvent>> = "add" extends DeclaredKeys<TRepositoryPort> ? MemberAcceptsAggregate<TRepositoryPort, "add", TAggregate> : RepositoryPortViolation<"the port must declare add(aggregate): void">;
 /** @inline */
-type UpdateConstraint<TRepositoryPort, TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TAppendOnly extends boolean> = "update" extends keyof TRepositoryPort ? boolean extends TAppendOnly ? RepositoryPortViolation<"the port declares update, so the definition must not set appendOnly"> : [TAppendOnly] extends [true] ? RepositoryPortViolation<"appendOnly is true, so the port must not declare update"> : MemberAcceptsAggregate<TRepositoryPort, "update", TAggregate> : [TAppendOnly] extends [true] ? unknown : RepositoryPortViolation<"the port declares no update, so the definition must set appendOnly: true">;
+type UpdateConstraint<TRepositoryPort, TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TAppendOnly extends boolean> = "update" extends DeclaredKeys<TRepositoryPort> ? boolean extends TAppendOnly ? RepositoryPortViolation<"the port declares update, so the definition must not set appendOnly"> : [TAppendOnly] extends [true] ? RepositoryPortViolation<"appendOnly is true, so the port must not declare update"> : MemberAcceptsAggregate<TRepositoryPort, "update", TAggregate> : [TAppendOnly] extends [true] ? unknown : RepositoryPortViolation<"the port declares no update, so the definition must set appendOnly: true">;
 /** @inline */
-type RemovalConstraint<TRepositoryPort, TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TRemoval extends boolean> = "remove" extends keyof TRepositoryPort ? [TRemoval] extends [true] ? MemberAcceptsAggregate<TRepositoryPort, "remove", TAggregate> : RepositoryPortViolation<"the port declares remove, so the definition must set physicalRemoval: true"> : [TRemoval] extends [true] ? RepositoryPortViolation<"physicalRemoval is true, so the port must declare remove(aggregate): void"> : unknown;
+type RemovalConstraint<TRepositoryPort, TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TRemoval extends boolean> = "remove" extends DeclaredKeys<TRepositoryPort> ? [TRemoval] extends [true] ? MemberAcceptsAggregate<TRepositoryPort, "remove", TAggregate> : RepositoryPortViolation<"the port declares remove, so the definition must set physicalRemoval: true"> : [TRemoval] extends [true] ? RepositoryPortViolation<"physicalRemoval is true, so the port must declare remove(aggregate): void"> : unknown;
 /**
  * Checks the port against every constraint of {@link defineRepository}, one
  * at a time, so the report names the first violated constraint. Resolves to
@@ -1881,7 +1758,7 @@ type RemovalConstraint<TRepositoryPort, TAggregate extends Aggregate<Id<string>,
  */
 type RepositoryPortConstraint<TRepositoryPort, TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TRemoval extends boolean, TAppendOnly extends boolean> = unknown extends TRepositoryPort ? unknown : Then<PortShapeConstraint<TRepositoryPort>, Then<AddConstraint<TRepositoryPort, TAggregate>, Then<UpdateConstraint<TRepositoryPort, TAggregate, TAppendOnly>, RemovalConstraint<TRepositoryPort, TAggregate, TRemoval>>>>;
 /** @inline */
-type RepositoryDefinitionBuilder<TRepositoryPort extends object> = <TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TCreate extends (transaction: never, tracking: RepositoryTracking<TAggregate>) => Omit<TRepositoryPort, "add" | "update" | "remove">, TBaseline, TChangeSet, TRemoval extends boolean = false, TAppendOnly extends boolean = false>(definition: RepositoryDefinitionOptions<Parameters<TCreate>[0], TRepositoryPort, TAggregate, TBaseline, TChangeSet, TRemoval, TAppendOnly> & {
+type RepositoryDefinitionBuilder<TRepositoryPort extends object> = <TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TCreate extends (transaction: never, tracking: RepositoryTracking<TAggregate>) => Omit<TRepositoryPort, "add" | "update" | "remove"> & LifecycleFreeAdapter, TBaseline, TChangeSet, TRemoval extends boolean = false, TAppendOnly extends boolean = false>(definition: RepositoryDefinitionOptions<Parameters<TCreate>[0], TRepositoryPort, TAggregate, TBaseline, TChangeSet, TRemoval, TAppendOnly> & {
   readonly create: TCreate;
 } & RepositoryPortConstraint<TRepositoryPort, TAggregate, TRemoval, TAppendOnly>) => RepositoryDefinition<Parameters<TCreate>[0], TRepositoryPort, TAggregate, TBaseline, TChangeSet, TRemoval, TAppendOnly>;
 /**
@@ -1891,7 +1768,8 @@ type RepositoryDefinitionBuilder<TRepositoryPort extends object> = <TAggregate e
  * aggregate, persistence, event, and lifecycle types from the adapter wiring.
  * The port must declare `add` for the aggregate. It declares `update` unless
  * the definition sets `appendOnly: true`. If it declares `remove`, the
- * definition must set `physicalRemoval: true`. A violated constraint fails
+ * definition must set `physicalRemoval: true`. The adapter that `create`
+ * returns does not define `add`, `update`, or `remove`. A violated constraint fails
  * the call with a compiler error that names the constraint. The adapter
  * created by the definition implements only the remaining methods because
  * lifecycle writes are installed by the Unit of Work.
@@ -2062,8 +1940,6 @@ type VersionedWrite<TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TC
  * A statements object that changes later has no effect.
  */
 type VersionedFlushStatements<TCtx, TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TChangeSet> = {
-  /** The aggregate type that the raised errors name. */
-  readonly aggregateType: string;
   /**
    * Inserts the rows of a new aggregate and stamps `write.version`. The
    * store's unique constraint on the aggregate id rejects a second insert.
@@ -2120,6 +1996,31 @@ type VersionedFlushStatements<TCtx, TAggregate extends Aggregate<Id<string>, Any
  * `currentVersion` fail here, when the flush is built.
  */
 declare function versionedFlush<TCtx, TAggregate extends Aggregate<Id<string>, AnyDomainEvent>, TChangeSet>(statements: VersionedFlushStatements<TCtx, TAggregate, TChangeSet>): (transaction: TCtx, write: AggregatePersistenceWrite<TAggregate, TChangeSet>) => Promise<void>;
+/** Options of {@link classifyConcurrencyConflict}. */
+interface ClassifyConcurrencyConflictOptions<TCtx, TAggregateId extends string> {
+  /** The aggregate of the write whose compare-and-set matched no row. */
+  readonly identity: AggregateIdentity<TAggregateId>;
+  /** The version that the compare-and-set predicate used. */
+  readonly expectedVersion: number;
+  readonly transaction: TCtx;
+  /**
+   * Reads the version that the store holds now, or `undefined` when the
+   * aggregate no longer exists. It is the same statement as the
+   * `currentVersion` of {@link VersionedFlushStatements}.
+   */
+  readonly currentVersion: (transaction: TCtx, aggregateId: TAggregateId) => number | undefined | Promise<number | undefined>;
+}
+/**
+ * Builds the conflict of a compare-and-set that matched no row. It reads the
+ * stored version and names the reason of the conflict. The zero row count
+ * already proves the conflict, so the read is diagnostic: a read that fails
+ * becomes `version_unknown`, with the failure as the cause.
+ *
+ * A version read that returns neither a stored version nor `undefined`, and
+ * an expected version that is no version, are defects of the statements. They
+ * throw {@link InvalidFlushStatementError}.
+ */
+declare function classifyConcurrencyConflict<TCtx, TAggregateId extends string>(options: ClassifyConcurrencyConflictOptions<TCtx, TAggregateId>): Promise<ConcurrencyConflictError>;
 //#endregion
 //#region src/domain/entity/entity.d.ts
 /** A pure invariant check that throws when a candidate state is invalid. */
@@ -2516,6 +2417,7 @@ interface AggregateConfig<TState = unknown> extends EntityConfig<TState> {
  *   (emitting any event becomes a compile error).
  */
 declare abstract class BaseAggregate<TState, TId extends Id<string>, TEvent extends AnyDomainEvent = never> extends Entity<TState, TId> implements Aggregate<TId, TEvent> {
+  #private;
   /**
    * The aggregate's domain type as a string, used to populate
    * `aggregateType` on events created via {@link createEvent}.
@@ -2537,6 +2439,12 @@ declare abstract class BaseAggregate<TState, TId extends Id<string>, TEvent exte
    * subclass renaming).
    */
   protected abstract readonly aggregateType: string;
+  /**
+   * The full identity of the aggregate: its declared `aggregateType` and
+   * its `id`, as one frozen value. The id alone is unique only within the
+   * type, so this value names the aggregate unambiguously.
+   */
+  get aggregateIdentity(): AggregateIdentity<TId>;
   private _version;
   /**
    * Version the persistence layer last confirmed for this instance:
@@ -2630,8 +2538,8 @@ declare abstract class BaseAggregate<TState, TId extends Id<string>, TEvent exte
   /**
    * Appends a domain event to the pending list. The event must be minted
    * by a kit constructor; a missing `aggregateId` or `aggregateType` is
-   * stamped from this aggregate, and an address that names another
-   * aggregate throws {@link MisaddressedEventError} before anything is
+   * stamped from this aggregate, and an aggregate identity that names another
+   * aggregate throws {@link MisattributedEventError} before anything is
    * recorded. Each append is one fact. A decision appended twice becomes
    * two facts with distinct ids. A recorded event that is already pending
    * throws {@link DuplicateEventIdError}, and a list at `maxPendingEvents`
@@ -2663,7 +2571,7 @@ declare abstract class BaseAggregate<TState, TId extends Id<string>, TEvent exte
   protected assertPendingEventLimit(added: number): void;
   /**
    * Appends an event that the caller already passed through
-   * {@link addressNewEvent}, {@link assertEventIdsNotPending} and
+   * {@link stampNewEventIdentity}, {@link assertEventIdsNotPending} and
    * {@link assertPendingEventLimit}. `setState()` and `apply()` run the
    * three before the state moves and append afterwards, so each gate
    * runs once per event.
@@ -2676,17 +2584,18 @@ declare abstract class BaseAggregate<TState, TId extends Id<string>, TEvent exte
    */
   protected discardPendingDecisions(): void;
   /**
-   * Address discipline for NEW facts, shared by both flavours: a
+   * Aggregate identity discipline for NEW facts, shared by both flavours: a
    * present-but-foreign `aggregateId` / `aggregateType` is a wiring bug and
-   * throws {@link MisaddressedEventError}; missing fields are filled in
-   * from the aggregate, so a recorded event is always fully addressed and
-   * can never fail the harvest or the replay guard later. The mint gate
+   * throws {@link MisattributedEventError}; missing fields are filled in
+   * from the aggregate, so a recorded event always carries its full
+   * aggregate identity and can never fail the harvest or the replay guard
+   * later. The mint gate
    * runs first, so an unminted event fails before anything else. The
    * stamped copy is frozen like the original (payload and metadata are
-   * shared, already deep-frozen by the constructors); a fully addressed
+   * shared, already deep-frozen by the constructors); a fully stamped
    * event is returned as is.
    */
-  protected addressNewEvent<E extends PendingDomainEvent<TEvent>>(event: E): E;
+  protected stampNewEventIdentity<E extends PendingDomainEvent<TEvent>>(event: E): E;
   /**
    * Mint gate for every recording path: only an event that a kit
    * constructor produced passes. The kit marks two shapes: a recorded
@@ -2808,9 +2717,9 @@ declare abstract class EventSourcedAggregate<TState, TId extends Id<string>, TEv
    * Throws `MissingFoldError` if no fold is declared for `event.type`.
    * Throws `FoldReturnedNoStateError` (wiring) when the fold returns
    * `undefined`, the signature of a fold without a `return`.
-   * Throws `MisaddressedEventError` (wiring) when the event carries an
+   * Throws `MisattributedEventError` (wiring) when the event carries an
    * `aggregateId` or `aggregateType` naming a different aggregate;
-   * missing address fields are stamped from the aggregate instead.
+   * missing aggregate identity fields are stamped from the aggregate instead.
    *
    * State is not mutated if any step throws: the fold is invoked into
    * a local and only stored once all checks pass.
@@ -2842,16 +2751,16 @@ declare abstract class EventSourcedAggregate<TState, TId extends Id<string>, TEv
    * and the discriminator is resolved via the (statically-sound)
    * `folds` map.
    *
-   * Replay address check: a history event that names a DIFFERENT
+   * Replay aggregate identity check: a history event that names a DIFFERENT
    * aggregate id or type is a persisted row that belongs to someone
    * else (a miswired stream read, colliding ids across types, a
    * corrupted store). Throws `ForeignEventError`, an
    * `InfrastructureError`, which PROPAGATES through the replay
    * methods (their `Result` channel is reserved for `DomainError`
    * stream corruption) after the all-or-nothing rollback. History
-   * events without the optional address fields pass unchecked (the
+   * events without the optional aggregate identity fields pass unchecked (the
    * fields are optional on the event shape); NEW events are covered
-   * by the stricter `addressNewEvent` on the apply path.
+   * by the stricter `stampNewEventIdentity` on the apply path.
    */
   private assertReplayedEventBelongsHere;
   private fold;
@@ -2875,8 +2784,8 @@ declare abstract class EventSourcedAggregate<TState, TId extends Id<string>, TEv
    * a reconstituted aggregate at v=P catching up on M newer events ends at
    * v=P+M. Events carry no stream position, so an overlap with the current
    * version is invisible here: the caller passes only the events after
-   * that version and checks the final version against the pinned stream
-   * head ({@link ReplayHeadMismatchError}).
+   * that version, and it compares the final version with the version it
+   * expects.
    *
    * The replay target must not carry pending decisions. Factory-vs-load
    * lifecycle is owned by the Unit of Work rather than inferred from an
@@ -2908,10 +2817,10 @@ declare abstract class EventSourcedAggregate<TState, TId extends Id<string>, TEv
 /**
  * Reconstitutes an event-sourced aggregate from one page of history and
  * yields it only on success. `createReplayTarget` builds the instance: a
- * fresh one, or one restored from a snapshot. The instance exists only
+ * fresh one, or one reconstituted from a snapshot. The instance exists only
  * inside this call. A rejected replay therefore leaves the caller with
- * nothing to return by mistake. Later catch-up pages go through
- * `replayHistory` on the value. A `DomainError` from a fold rides the
+ * nothing to return by mistake. A stream read in pages goes through
+ * `reconstituteAggregateFromStreamPages` instead. A `DomainError` from a fold rides the
  * `Result`; wiring errors and a foreign row throw, as in `replayHistory`.
  * The creator runs outside the `Result`: what it throws propagates.
  */
@@ -2931,10 +2840,10 @@ declare abstract class StateStoredAggregate<TState, TId extends Id<string>, TEve
   /**
    * Replaces the state, advances the OCC version, and records the events
    * of the change, in that order. State validation, the event mint gate,
-   * the event address check, the pending-identity check, and the pending
-   * event limit check run before the change becomes observable, so a
-   * rejected decision records nothing and moves nothing. Without events the call is a plain versioned state
-   * change.
+   * the aggregate identity check of the event, the pending event-id check,
+   * and the pending event limit check run before the change becomes
+   * observable, so a rejected decision records nothing and moves nothing.
+   * Without events the call is a plain versioned state change.
    */
   protected setState(newState: TState, events?: PendingDomainEvent<TEvent> | readonly PendingDomainEvent<TEvent>[]): void;
   /**
@@ -2947,7 +2856,7 @@ declare abstract class StateStoredAggregate<TState, TId extends Id<string>, TEve
 }
 //#endregion
 //#region src/domain/event/domain-event-errors.d.ts
-type DomainEventValidationCode = "EVENT_ID_REQUIRED" | "EVENT_ID_INVALID" | "EVENT_TYPE_INVALID" | "EVENT_OCCURRED_AT_REQUIRED" | "EVENT_OCCURRED_AT_INVALID" | "EVENT_SCHEMA_VERSION_INVALID" | "EVENT_ADDRESS_INVALID";
+type DomainEventValidationCode = "EVENT_ID_REQUIRED" | "EVENT_ID_INVALID" | "EVENT_TYPE_INVALID" | "EVENT_OCCURRED_AT_REQUIRED" | "EVENT_OCCURRED_AT_INVALID" | "EVENT_SCHEMA_VERSION_INVALID" | "EVENT_AGGREGATE_IDENTITY_INVALID";
 type DomainEventValidationField = "eventId" | "type" | "occurredAt" | "schemaVersion" | "aggregateId" | "aggregateType";
 /**
  * Stable contract error for malformed domain-event data.
@@ -3679,22 +3588,40 @@ declare function deepEqual(a: unknown, b: unknown): boolean;
  * built-in are dropped. A function or a symbol value throws a raw
  * `DataCloneError`. An Error, a Promise, a WeakMap, or a WeakSet cannot be
  * detached at all. A SharedArrayBuffer and a view over one keep sharing
- * their memory. A Proxy is invisible to the walk and fails inside the
- * clone; that failure is rethrown as a `TypeError` with the cause.
+ * their memory. A Proxy fails in the walk or in the clone; a failure in
+ * the clone is rethrown as a `TypeError` with the cause. An error that a
+ * Proxy trap throws in the walk passes unchanged, so a coded error of the
+ * caller keeps its code.
+ *
+ * The walk reads the graph through property descriptors and walks a Map
+ * or a Set with the built-in iteration, so no accessor and no own iterator
+ * of the state runs. A Proxy runs its traps during the walk. A trap can
+ * change the graph, and an accessor that a trap adds runs during the
+ * clone. A second walk checks the clone, so a value that a trap swapped in
+ * and the content of a built-in whose prototype was replaced are rejected
+ * too. A trap that changes the graph after the first walk can still hide a
+ * value that the copy drops: the walks catch accidents, not a hostile
+ * Proxy. The second walk also follows the steps of the first walk: the kind
+ * of each object and the key of each data property, in walk order. A copy
+ * that differs throws, because a built-in whose prototype was replaced is
+ * a built-in again in the copy and loses its own properties. `subject`
+ * names the state in the messages.
  *
  * Plain objects (from any realm), arrays, Dates, Maps, Sets, bigints, and
  * typed arrays pass. A RegExp passes: pattern and flags survive the clone,
  * and `lastIndex` restores as 0. The scan state of a global or sticky
- * pattern is not domain data. A non-enumerable property on a built-in
- * passes: it is the built-in's own machinery (`lastIndex`), not data. A
- * non-enumerable symbol key passes anywhere: it is metadata by convention.
+ * pattern is not domain data. On a built-in, the mutator shadows of a deep
+ * freeze, the `lastIndex` of a RegExp, and the `length` of a boxed String
+ * pass: they are machinery, not data. Every other non-enumerable property
+ * throws. A non-enumerable symbol key passes anywhere: it is metadata by
+ * convention.
  *
  * The concrete entity uses it for a detached read DTO of a plain-data
  * state. The snapshot model uses it for the captured DTO and the restored
  * state. A state that carries a class-based child is mapped to plain data
  * first, in the entity or in the model.
  */
-declare function detachState<T>(state: T): T;
+declare function detachState<T>(state: T, subject?: string): T;
 //#endregion
 //#region src/messaging/event-bus/errors.d.ts
 /**
@@ -4016,7 +3943,7 @@ interface IntegrationMessageContent<TType extends string, TPayload extends JsonV
 interface IntegrationMessage<TType extends string = string, TPayload extends JsonValue = JsonValue, TMetadata extends JsonObject = JsonObject> extends IntegrationMessageContent<TType, TPayload, TMetadata> {
   readonly messageId: string;
   readonly occurredAt: string;
-  readonly source: AggregateAddress;
+  readonly source: AggregateIdentity;
   readonly position: CommitPosition;
 }
 /** Maps a private domain event to its explicit public message schema. */
@@ -4084,7 +4011,8 @@ interface InMemoryOutboxOptions {
    * candidate commit position) retained for idempotent `add` retries and
    * collision detection. Older receipts are evicted in dispatch order; a later
    * candidate behind its source head then rejects instead of rewinding the
-   * cursor.
+   * cursor. A retry of an event at its source head still dedupes, because the
+   * source cursor names that event.
    * Default `10_000`.
    */
   maxRetainedDispatchedEventIds?: number;
@@ -4103,12 +4031,16 @@ interface InMemoryOutboxOptions {
  * recent-dispatch receipt cache keeps retries idempotent after acknowledgement.
  * Re-adding a pending event refreshes the stored commit envelope while the
  * delivery attempt count survives. Its commit sequence and size remain
- * immutable; only this transaction-unaware adapter may move a still-pending
- * event to another aggregate version after an outer rollback leaked the first
- * add. Dead-lettered and acknowledged retries must match the complete original
- * candidate receipt. Reusing an `eventId` for another source or commit position
+ * immutable. Only this in-memory adapter may move a still-pending event to
+ * another aggregate version. Without an `InMemoryTransactionScope`, it keeps
+ * the first add of a rolled-back attempt. Dead-lettered and acknowledged
+ * retries must match the complete original candidate receipt. Reusing an `eventId` for another source or commit position
  * throws {@link EventHarvestError} while the pending, dead-letter, or bounded
- * dispatched receipt still proves the collision. Insertion order is preserved:
+ * dispatched receipt still proves the collision. `add` also throws
+ * {@link EventHarvestError} for a malformed candidate: a part that is not an
+ * object, an `eventId` or `type` that is not an own string data property, a
+ * source field that is not a string, or a position that is not a valid
+ * commit position. Insertion order is preserved:
  * `getPending` returns records in commit order, as the port contract requires.
  *
  * Dispatch tracking: `markFailed` increments the record's attempt count
@@ -4118,7 +4050,9 @@ interface InMemoryOutboxOptions {
  * inverse of `deadLetters()`); `markDispatched` acks pending AND
  * dead-lettered records (manual redelivery then ack).
  * To link future eventful commits, the implementation also retains one
- * source cursor per qualified aggregate after dispatch. Consequently a
+ * source cursor per qualified aggregate after dispatch. `endEventSources`
+ * marks the cursor of a removed aggregate as ended, and a new event of that
+ * source then throws {@link EventHarvestError}. Consequently a
  * long-lived instance is bounded only when `maxRecords` and `maxSources` are
  * configured, plus `maxRetainedDispatchedEventIds`; use a durable adapter with
  * an explicit source-head lifecycle and an event-id unique key for unbounded
@@ -4132,12 +4066,21 @@ interface InMemoryOutboxOptions {
  * that are never `markDispatched` accumulate until `maxRecords` rejects a new
  * add, or without that option grow unbounded. For a deliberate no-delivery
  * setup use {@link outboxWriterAcceptingEventLoss} instead. Sharper still:
- * events `add()`ed inside a transaction that later rolls back are NOT
- * removed (the Map knows nothing about your scope's rollback). Tests
- * that assert rollback purity need an outbox that participates in the
- * test store's transactional semantics; see the reference adapter at
- * https://github.com/shi-rudo/ddd-kit-ts/blob/main/src/testing/repository-contract.test.ts
- * (repo-only, not shipped to npm).
+ * on its own, the outbox knows nothing about your scope's rollback. Events
+ * `add()`ed inside a transaction that later rolls back stay, and a source
+ * that `endEventSources` ended inside such a transaction stays ended: the
+ * outbox then rejects every later event of that aggregate, also on the retry
+ * of a `RetryingTransactionScope`. For tests that roll back or retry,
+ * register the outbox with an `InMemoryTransactionScope`. A rollback then
+ * returns the outbox to its state at the start of the attempt.
+ *
+ * A relay reads only committed records. While a transaction is open,
+ * `getPending` returns a record that the transaction wrote as it was
+ * committed at the first write, with its current attempts. It skips a record
+ * that was not pending at that write, such as a new or a requeued record. A
+ * rollback also undoes an acknowledgement or a failure report that a
+ * dispatcher made while the transaction was open. The dispatcher then
+ * delivers that record again.
  *
  * @example
  * ```ts
@@ -4155,13 +4098,20 @@ interface InMemoryOutboxOptions {
  * });
  * ```
  */
-declare class InMemoryOutbox<Evt extends AnyDomainEvent> implements DispatchTrackingOutbox<Evt> {
+declare class InMemoryOutbox<Evt extends AnyDomainEvent> implements DispatchTrackingOutbox<Evt>, InMemoryTransactionParticipant {
   private readonly pending;
   private readonly dead;
   /** Latest eventful commit and its predecessor per qualified source. */
   private readonly sourceCursors;
+  /** Keys of source cursors whose aggregate was removed. */
+  private readonly endedSourceKeys;
   /** Bounded insertion-ordered receipts for exact retries after acknowledgement. */
   private readonly dispatchedEventIds;
+  /**
+   * The committed pending record of each event id that the open transaction
+   * wrote, captured at its first write. `undefined` marks an id without one.
+   */
+  private committedVersions;
   private readonly maxDeliveryAttempts;
   private readonly maxRetainedDispatchedEventIds;
   private readonly maxRecords;
@@ -4173,6 +4123,36 @@ declare class InMemoryOutbox<Evt extends AnyDomainEvent> implements DispatchTrac
   private assertBatchPositionIntegrity;
   getPending(limit?: number): Promise<ReadonlyArray<OutboxRecord<Evt>>>;
   markDispatched(dispatchIds: ReadonlyArray<string>): Promise<void>;
+  /**
+   * Records the state that a rollback of an `InMemoryTransactionScope`
+   * returns to: pending and dead-letter records, receipts, source cursors,
+   * and ended sources, in their order. Until the transaction ends,
+   * `getPending` returns the committed record of each event id that the
+   * transaction writes.
+   */
+  beginTransaction(): InMemoryTransaction;
+  /** A record that a dispatcher removed is no longer pending in the committed state. */
+  private forgetCommittedVersion;
+  private recordCommittedVersion;
+  endEventSources(sources: ReadonlyArray<AggregateIdentity>): Promise<void>;
+  /**
+   * Rejects a new event of an ended source above its head. An exact retry of
+   * a stored event of an ended source stays a retry; the caller skips
+   * retries at the source head before this check. The stale-head, commit
+   * size, and position checks reject a candidate below the head or at a
+   * position that another event owns, and their messages name the
+   * re-created identity as a cause.
+   */
+  private assertSourceNotEnded;
+  /**
+   * Event ids of the batch that the source head names at their position
+   * although no receipt, pending record, or dead letter remains: events
+   * that were dispatched and whose receipt was evicted. They are decided
+   * against the heads before the batch, so their place in the batch does
+   * not matter. Their receipts are restored after the batch.
+   */
+  private retriesAtSourceHead;
+  private recordedAtSourceHead;
   private rememberDispatched;
   markFailed(dispatchId: string, error?: unknown): Promise<DeadLetterRecord<Evt> | undefined>;
   deadLetters(): Promise<ReadonlyArray<DeadLetterRecord<Evt>>>;
@@ -4196,29 +4176,204 @@ interface InMemoryEventStoreOptions {
  * `InMemoryCapacityExceededError`; histories are never silently evicted.
  * Implements the full port contract: expectedVersion-guarded appends
  * (throwing `ConcurrencyConflictError` on mismatch), atomic rejected
- * appends, explicit missing/existing stream state with the actual head,
+ * appends, explicit absent/existing stream state with the actual head,
  * append-order reads, mandatory page bounds, and `(fromVersion, toVersion]`
- * slicing. Invalid limits or positions reject with `RangeError`.
+ * slicing. Invalid limits or positions reject with `RangeError`. A read
+ * with an aborted `signal` rejects with its `reason`.
  *
  * For production, back the port with a durable store whose append and
  * the aggregate transaction share atomicity (a table with a
  * `(aggregate_type, aggregate_id, position)` unique key inside the same
  * transaction, or a dedicated event store). Same caveat as
- * `InMemoryOutbox`: this class
- * lives in memory only and knows nothing about your `TransactionScope`
- * rollbacks; events appended inside a transaction that later rolls back
- * are NOT removed. The event-sourced repository contract suite's
- * reference environment shows the snapshot/restore pattern for
- * rollback-pure in-memory testing.
+ * `InMemoryOutbox`: this class lives in memory only. On its own, it knows
+ * nothing about your `TransactionScope` rollbacks, so events appended inside
+ * a transaction that later rolls back stay. Register the store with an
+ * `InMemoryTransactionScope` for tests that roll back or retry.
  */
-declare class InMemoryEventStore<Evt extends AnyDomainEvent> implements EventStore<Evt> {
+declare class InMemoryEventStore<Evt extends AnyDomainEvent> implements EventStore<Evt>, InMemoryTransactionParticipant {
   private readonly streams;
   private readonly maxStreams;
   private readonly maxEvents;
   private totalEvents;
   constructor(options?: InMemoryEventStoreOptions);
-  append(stream: AggregateAddress, events: ReadonlyArray<Evt>, options: EventStoreAppendOptions): Promise<void>;
-  readStream(stream: AggregateAddress, options: ReadStreamOptions): Promise<StreamReadResult<Evt>>;
+  /**
+   * Records the state that a rollback of an `InMemoryTransactionScope`
+   * returns to: every stream and the event count.
+   */
+  beginTransaction(): InMemoryTransaction;
+  append(stream: AggregateIdentity, events: ReadonlyArray<Evt>, options: EventStoreAppendOptions): Promise<void>;
+  /**
+   * The stream that an append of `count` events at `expectedVersion`
+   * writes to, or `undefined` for a new stream. Throws when the version
+   * is stale or a capacity would overflow.
+   */
+  private existingStreamForAppend;
+  readStream(stream: AggregateIdentity, options: ReadStreamOptions): Promise<StreamReadResult<Evt>>;
+}
+//#endregion
+//#region src/persistence/event-store/read-stream-pages.d.ts
+/** Options for {@link readStreamPages}. */
+interface ReadStreamPagesOptions extends Pick<ReadStreamOptions, "limit" | "fromVersion" | "signal"> {
+  /**
+   * The version a point-in-time read asks for (inclusive, 1-based event
+   * count). Without it, the target version is the head that the first page
+   * reports. A value beyond the head does not clamp: see
+   * {@link pinTargetVersion}. Must be a positive safe integer when present.
+   * Version 0 is the state before the first event, and no replay can end
+   * there.
+   */
+  readonly toVersion?: number;
+}
+/**
+ * A stream read with the target version pinned on its first page.
+ *
+ * The first page decides the state of the stream once, in three branches.
+ * An absent stream is `exists: false`. An existing stream whose window lies
+ * outside it is `reachable: false` and carries the actual head. The
+ * remaining branch carries the target version and the pages after the
+ * cursor. The other two branches both carry `reachable: false`, so one
+ * guard narrows to the branch that
+ * {@link reconstituteAggregateFromStreamPages} accepts. The caller decides
+ * what the other two branches mean before the replay.
+ */
+type StreamPages<Evt extends AnyDomainEvent> = AbsentStreamPages | UnreachableStreamPages | ReachableStreamPages<Evt>;
+/** The branch of {@link StreamPages} for a stream the store does not hold. */
+interface AbsentStreamPages {
+  readonly exists: false;
+  readonly reachable: false;
+}
+/**
+ * The branch of {@link StreamPages} for a window that lies outside an
+ * existing stream: the cursor lies beyond the target version, or the
+ * target version lies beyond the head ({@link pinTargetVersion}).
+ *
+ * The caller tells the causes apart from its own inputs. A snapshot
+ * version above `lastVersion` means that the snapshot outlived its stream:
+ * discard it and replay from zero. A `toVersion` above `lastVersion` means
+ * that the stream has not reached that version: answer not found and keep
+ * the snapshot. A snapshot version above `toVersion` means that the
+ * snapshot is too new for the request: keep it and replay from zero up to
+ * `toVersion`.
+ */
+interface UnreachableStreamPages {
+  readonly exists: true;
+  readonly reachable: false;
+  /** The cursor the read started at: `fromVersion`, or `0`. */
+  readonly fromVersion: number;
+  /** The actual stream head on the first page. */
+  readonly lastVersion: number;
+}
+/** The branch of {@link StreamPages} that the replay accepts. */
+interface ReachableStreamPages<Evt extends AnyDomainEvent> extends ReplayableStreamPages<Evt> {
+  readonly exists: true;
+  readonly reachable: true;
+}
+/** Options for {@link pinTargetVersion}. */
+interface PinTargetVersionOptions {
+  /** The cursor of the read: the replay starts after this version. */
+  readonly fromVersion: number;
+  /** The version a point-in-time read asks for. Defaults to `lastVersion`. */
+  readonly toVersion?: number;
+  /** The head of the existing stream: its event count. */
+  readonly lastVersion: number;
+}
+/** The verdict of {@link pinTargetVersion}. */
+type PinnedTargetVersion = {
+  readonly reachable: true;
+  readonly targetVersion: number;
+} | {
+  readonly reachable: false;
+};
+/**
+ * Pins the target version of a replay window on an existing stream, or
+ * reports the window as unreachable.
+ *
+ * The target version is `toVersion` when given, else `lastVersion`. The
+ * window is unreachable when `fromVersion` lies beyond the target version,
+ * or the target version lies beyond `lastVersion`. The call never clamps
+ * such a window to the head, so a request for version 10 of a stream that
+ * ends at 7 never loads the latest state by accident.
+ *
+ * This is the decision `readStreamPages` makes on its first page. An
+ * adapter that pages on its own makes it with this call, then hands its
+ * pages to `reconstituteAggregateFromStreamPages`. Values that are not safe
+ * integers, a negative `fromVersion`, and a `toVersion` or `lastVersion`
+ * below 1 reject with `RangeError`: an existing stream holds at least one
+ * event, and no replay can end at version 0.
+ */
+declare function pinTargetVersion(options: PinTargetVersionOptions): PinnedTargetVersion;
+/**
+ * Reads one stream in bounded pages up to a pinned target version.
+ *
+ * The call reads the first page. That page decides existence and reports
+ * the head. The call then makes the window decision of
+ * {@link pinTargetVersion}: the target version is `toVersion` when given,
+ * else the head, and a window outside the stream is unreachable.
+ *
+ * The first iteration of `pages` yields the first page that the call read
+ * and then reads the continuation pages, one page at a time. Every later
+ * iteration reads all pages from the store again, so no two iterations
+ * share an event object. Each of these reads passes the target version as
+ * `toVersion` and starts after the events that the earlier pages
+ * returned. Streams are append-only, so an iteration yields one stable
+ * prefix even when another writer appends during the replay.
+ *
+ * The call checks every page against the `readStream` contract and throws
+ * {@link InvalidEventStreamPageError} for a page that breaks it: a head
+ * that is not a safe integer of at least 1, an empty page while events
+ * remain in the window, a page with more events than its window has left
+ * or than `limit`, and a continuation page that reports the stream absent
+ * or a head below the head of the first page.
+ *
+ * Invalid options reject with `RangeError` before any page is read:
+ * `limit` and `toVersion` must be positive safe integers, `fromVersion` a
+ * non-negative one. The call passes `signal` to every page read, and it
+ * checks the signal before each page read as well. An aborted signal
+ * rejects with its `reason`.
+ */
+declare function readStreamPages<Evt extends AnyDomainEvent>(reader: EventStreamReader<Evt>, stream: AggregateIdentity, options: ReadStreamPagesOptions): Promise<StreamPages<Evt>>;
+//#endregion
+//#region src/persistence/repository/adapters/in-memory-transaction-scope.d.ts
+/**
+ * A {@link TransactionScope} for tests and demos that gives in-memory stores
+ * a rollback. Register every store that the work writes inside the
+ * transaction. When the work fails, each registered store undoes the writes
+ * of the attempt, so the retry of a `RetryingTransactionScope` does not see
+ * them. Each store decides what its rollback undoes, and its documentation
+ * says so.
+ *
+ * **One transaction at a time.** A store cannot tell which of two open
+ * transactions a write belongs to. The scope therefore runs its transactions
+ * one after the other, in call order. A queued transaction stops its wait
+ * when its abort signal fires. Work that waits inside a transaction for
+ * another transaction of the same scope never finishes, because the inner
+ * transaction waits for the outer one. Only the abort signal of the inner
+ * transaction ends that wait. A database with only one connection behaves
+ * the same way. Use a database with real isolation to test concurrent
+ * transactions.
+ *
+ * **Code outside a transaction.** A dispatcher, a deadline processor, and a
+ * `hasReached` check run outside the transactions. Outbox `getPending`,
+ * deadline `due`, and checkpoint `hasReached` read only committed writes.
+ * Other reads also see the writes of an open transaction. A store that
+ * restores its whole state on rollback also undoes the writes that code
+ * outside the transaction made meanwhile. An example is an acknowledgement
+ * of an outbox dispatcher. The dispatcher then delivers the record again,
+ * which the at-least-once contract allows.
+ *
+ * **A store belongs to one scope.** A scope works like one in-memory
+ * database, so register all stores of a test with one scope. A second scope
+ * with a registered store throws at construction, because the rollback of
+ * one scope would undo a commit of the other.
+ *
+ * A store that is not registered keeps its own behavior: it does not roll
+ * back.
+ */
+declare class InMemoryTransactionScope implements TransactionScope<undefined> {
+  private readonly participants;
+  private lastTransaction;
+  constructor(participants: ReadonlyArray<InMemoryTransactionParticipant>);
+  transactional<T>(fn: (ctx: undefined) => Promise<T>, options?: TransactionalOptions): Promise<T>;
 }
 //#endregion
 //#region src/persistence/repository/repository.d.ts
@@ -4368,6 +4523,10 @@ interface RetryPolicy {
  * After `maxAttempts` the last error is rethrown unchanged, so a caller
  * can still match `ConcurrencyConflictError` and map it to HTTP 409.
  *
+ * **Attempts.** Before each attempt, the scope calls `onAttemptStart` from
+ * the `transactional` options, so the caller can attribute a failure to the
+ * attempt that raised it.
+ *
  * **Cancellation.** The `AbortSignal` from `transactional` options is
  * checked before each attempt and aborts the backoff wait, so an
  * `AbortSignal.timeout(ms)` bounds total elapsed time (there is
@@ -4407,16 +4566,28 @@ interface InMemorySnapshotStoreOptions {
  * rebuildable derived data, so `maxEntries` may evict the least recently used
  * entry and `ttlMs` may expire it safely. A load updates LRU recency but does
  * not extend TTL; only another save does.
+ *
+ * The port keeps snapshot writes out of the write transaction, so the store
+ * does not roll back on its own. If you register it with an
+ * `InMemoryTransactionScope`, a rollback restores the snapshots, their LRU
+ * order, and their expiry from the start of the transaction. It also undoes
+ * a save or a delete that code made outside the transaction meanwhile. This
+ * is safe, because a snapshot is derived data.
  */
-declare class InMemorySnapshotStore<TState = unknown> implements SnapshotStore<TState> {
+declare class InMemorySnapshotStore<TState = unknown> implements SnapshotStore<TState>, InMemoryTransactionParticipant {
   private readonly snapshots;
   private readonly maxEntries;
   private readonly ttlMs;
   private readonly clock;
   constructor(options?: InMemorySnapshotStoreOptions);
-  load(address: AggregateAddress): Promise<AggregateSnapshot<TState> | undefined>;
-  save(address: AggregateAddress, snapshot: AggregateSnapshot<TState>): Promise<void>;
-  delete(address: AggregateAddress): Promise<void>;
+  /**
+   * Records the state that a rollback of an `InMemoryTransactionScope`
+   * returns to: every snapshot in LRU order.
+   */
+  beginTransaction(): InMemoryTransaction;
+  load(identity: AggregateIdentity): Promise<AggregateSnapshot<TState> | undefined>;
+  save(identity: AggregateIdentity, snapshot: AggregateSnapshot<TState>): Promise<void>;
+  delete(identity: AggregateIdentity): Promise<void>;
   private readClock;
   private deleteExpired;
 }
@@ -4434,7 +4605,7 @@ interface SnapshotAggregate {
  * valid domain object; it does not know when or how snapshots are stored.
  */
 interface SnapshotModel<TAggregate extends SnapshotAggregate, TSnapshotState> {
-  /** Stable type name used to address schema errors and snapshot storage. */
+  /** Stable type name that names the aggregate in schema errors and snapshot storage. */
   readonly aggregateType: string;
   /** Current schema version of the stored snapshot DTO. */
   readonly schemaVersion: number;
@@ -4489,5 +4660,5 @@ declare function captureAggregateSnapshot<TAggregate extends SnapshotAggregate,
  */
 declare function reconstituteAggregateFromSnapshot<TAggregate extends SnapshotAggregate, TSnapshotState>(model: SnapshotModel<TAggregate, TSnapshotState>, id: TAggregate["id"], snapshot: AggregateSnapshot<unknown>): TAggregate;
 //#endregion
-export { type Aggregate, type AggregateAddress, type AggregateAddressMismatchOptions, type AggregateClass, type AggregateCommitToken, type AggregateConfig, AggregateDeletedError, AggregateNotFoundError, type AggregateNotFoundErrorOptions, type AggregatePersistence, type AggregatePersistenceWrite, type AggregateSnapshot, AggregateTrackingError, type AggregateTrackingReason, type AggregateWriteIntent, type AggregateWriteRegistration, type AnyDomainEvent, type AnyUncommittedDomainEvent, type AppendOnlyWriteRegistration, CapabilityRegistryConflictError, type ClockFactory, type Command, CommandBus, type CommandBusOptions, type CommandCommitOriginCandidate, type CommandHandler, type CommandMessageContent, type CommandMessageRelationships, type CommandOutboxCommitCandidate, type CommandOutboxMapper, type CommandOutboxWriter, type CommitEnrollment, type CommitEnrollmentOptions, CommitError, type CommitPosition, type CommittedDomainEvent, type CompatibleRepositoryDefinitions, ConcurrencyConflictError, type ConcurrencyConflictErrorOptions, type ConcurrencyConflictReason, type CreateDomainEventFromFactsOptions, type CreateDomainEventOptions, type CreateDomainEventStampOptions, type CreateUncommittedDomainEventOptions, type DeadLetterDeadline, type DeadLetterRecord, DeadlineProcessor, type DeadlineProcessorObservers, type DeadlineProcessorOptions, type DeadlineStore, type DeepEqualExceptOptions, type DeepOmitKey, type DeepOmitOptions, type DeepOmitPathSegment, type DeliveryFailureAssessment, type DeliveryFailureClassifier, type DeliveryFailureKind, DirectStateMutationError, type DispatchTrackingOutbox, DomainError, type DomainErrorClass, type DomainEvent, type DomainEventFactory, type DomainEventFactoryOptions, type DomainEventStamp, type DomainEventStampFactory, type DomainEventStampProvider, type DomainEventValidationCode, DomainEventValidationError, type DomainEventValidationField, type DomainMachineDefinition, type DomainMachineDefinitionAnalysis, type DomainMachineDefinitionDiagnostic, type DomainMachineInput, type DomainMachineReadonly, type DomainMachineSnapshot, type DomainMachineTransitionDescription, DomainStateMachine, type DomainStateNode, type DomainTransition, DomainTransitionGuardRejectedError, type DomainTransitionGuardResult, type DomainTransitionOutcome, type DomainTransitionResult, type DueDeadline, DuplicateAggregateError, type DuplicateAggregateErrorOptions, DuplicateEventIdError, DuplicateHandlerRegistrationError, type DuplicateHandlerRegistrationErrorOptions, type DurableCommandMessage, Entity, type EntityConfig, ErrorMapperFailedError, type ErrorMapperFailedErrorOptions, type EventBus, EventBusClosedError, EventBusImpl, type EventBusObservers, type EventBusOptions, type EventCommitCandidate, type EventCommitCandidatePosition, type EventHandler, EventHarvestError, type EventIdFactory, type EventMetadata, EventSourcedAggregate, type EventStore, type EventStoreAppendOptions, type ExecutionContext, type FlushStatementReason, FoldReturnedNoStateError, ForeignEventError, type HandlerFailureReport, HostileStateKeyError, type ICommandBus, type IEntity, type IQueryBus, type IValueObject, type Id, type IdGenerator, type IdempotencyClaim, type IdempotencyClaimHandle, IdempotencyClaimLostError, type IdempotencyClaimLostErrorOptions, IdempotencyCompletionWithoutClaimError, IdempotencyInFlightError, type IdempotencyInFlightErrorOptions, IdempotencyKeyReuseError, type IdempotencyKeyReuseErrorOptions, type IdempotencyLease, type IdempotencyOperationErrorContext, type IdempotencyReconciliation, type IdempotencyReconciliationDecision, IdempotencyReconciliationRequiredError, type IdempotencyReconciliationRequiredErrorOptions, type IdempotencyStore, type IdempotentCommitRequest, type IdempotentCommitResult, type IdempotentExecution, type Identifiable, IdentityMap, InMemoryCapacityExceededError, type InMemoryCapacityExceededErrorOptions, InMemoryDeadlineStore, type InMemoryDeadlineStoreOptions, InMemoryEventStore, type InMemoryEventStoreOptions, InMemoryIdempotencyStore, type InMemoryIdempotencyStoreOptions, InMemoryOutbox, type InMemoryOutboxOptions, InMemoryProjectionCheckpointStore, type InMemoryProjectionCheckpointStoreOptions, InMemorySnapshotStore, type InMemorySnapshotStoreOptions, InfrastructureError, type IntegrationMessage, type IntegrationMessageContent, type IntegrationMessageMapper, type IntegrationMessageRelationships, InvalidCommandMessageError, InvalidDomainMachineContextError, InvalidDomainMachineDefinitionError, InvalidDomainMachineInputError, InvalidDomainMachineSnapshotError, InvalidDomainTransitionError, InvalidDomainTransitionGuardResultError, InvalidDomainTransitionResultError, InvalidFlushStatementError, type InvalidFlushStatementErrorOptions, InvalidIntegrationMessageError, InvalidRepositoryAdapterError, InvalidRepositoryDefinitionError, InvalidVersionError, type JsonObject, type JsonPrimitive, type JsonValue, type KitErrorCode, type KitErrorOptions, type MatchedRows, MisaddressedEventError, MissingEntityIdError, MissingFoldError, MissingHandlerError, NestedUnitOfWorkError, NonProgressingEventStreamPageError, type NonProgressingEventStreamPageErrorOptions, type OnceOptions, type Outbox, OutboxDispatcher, type OutboxDispatcherObservers, type OutboxDispatcherOptions, type OutboxRecord, type OutboxSink, type OutboxWriter, type PendingDomainEvent, PendingEventBatchMismatchError, PendingEventLimitExceededError, type PendingEventLimitExceededErrorOptions, type PersistenceBaseline, type PersistenceChanges, type PersistenceLifecycle, type PersistenceModel, type PhysicalRemovalRegistration, type PreparedDomainMachineDefinition, type ProjectOptions, type Projection, type ProjectionBatchResult, type ProjectionCheckpoint, type ProjectionCheckpointStore, type ProjectionEventHandler, type ProjectionFromHandlersOptions, ProjectionGapError, type ProjectionHandlers, ProjectionIdentityViolationError, ProjectionOrderViolationError, type ProjectionPosition, ProjectionReceiptViolationError, Projector, type ProjectorOptions, type PublishAbortedReport, type PublishChainState, type PublishChainStore, PublishDepthExceededError, type PublishOptions, type PublishedCommand, type Query, QueryBus, type QueryBusOptions, type QueryHandler, type ReadStreamOptions, ReentrantDomainStateMachineEvaluationError, ReentrantEventRecordingError, ReplayHeadMismatchError, type ReplayHeadMismatchErrorOptions, type ReplayableAggregate, type RepositoriesOf, type Repository, type RepositoryDefinition, type RepositoryDefinitionOptions, RepositoryErrorMappingFailedError, type RepositoryTracking, type RetryPolicy, RetryingTransactionScope, RollbackError, type RunOptions, type SharedDomainEventStampOptions, SnapshotCorruptedError, type SnapshotModel, SnapshotSchemaMismatchError, type SnapshotSchemaMismatchErrorOptions, type SnapshotStore, SnapshotTimeValidationError, SnapshotVersionNotRestoredError, type SnapshotVersionNotRestoredErrorOptions, Specification, type SpecificationComposite, StateStoredAggregate, type StateValidator, type StreamReadResult, type SubscriptionThresholdReport, TransactionClosedError, type TransactionScope, type TransactionalOptions, type UncommittedDomainEvent, type UncommittedDomainEventOf, UnenrolledChangesError, UnitOfWork, type UnitOfWorkContext, type UnitOfWorkDeps, type UnitOfWorkIdentityMap, UnmanagedInstanceError, UnmintedEventError, UnprojectableEventError, UnregisteredHandlerError, type UnregisteredHandlerErrorOptions, UnreplayableAggregateError, type VO, ValueObject, type Version, type VersionedFlushStatements, type VersionedWrite, type WithCommitDeps, type WithCommitWorkResult, type WithIdempotentCommitDeps, analyzeDomainMachineDefinition, canTransitionDomainState, captureAggregateSnapshot, capturePersistenceBaseline, copyMetadata, createDomainEvent, createDomainEventFactory, createDomainEventFromFacts, createInitialDomainMachineSnapshot, createIntegrationMessage, createUncommittedDomainEvent, decodeIntegrationMessage, deepEqual, deepEqualExcept, deepFreeze, deepOmit, defaultDomainEventFactory, defineRepository, defineSnapshotModel, derivePersistenceChanges, detachState, domainErrorToResult, encodeIntegrationMessage, entityIds, eventBusSink, findEntityById, freezeShallow, hasEntityId, ignoreProjectionEvent, insertPersistenceBaseline, integrationMessageToCommittedEvent, isDomainErrorLike, isInfrastructureErrorLike, isPositionAfter, isWiringErrorLike, mergeMetadata, outboxWriterAcceptingEventLoss, persistenceProjectionDrifted, prepareDomainMachineDefinition, projectionFromHandlers, recapturePersistenceBaseline, reconstituteAggregateFromHistory, reconstituteAggregateFromSnapshot, recordDomainEvent, recordPendingEvents, removeEntityById, replaceEntityById, routeEventsToCommandOutbox, sameEntity, sameVersion, specification, toVersion, transitionDomainState, updateEntityById, versionedFlush, vo, voEquals, voEqualsExcept, voValidated, voWithValidation, withCommit, withIdempotentCommit };
+export { type AbsentStreamPages, type Aggregate, type AggregateClass, type AggregateCommitToken, type AggregateConfig, AggregateDeletedError, type AggregateDeletedErrorOptions, type AggregateIdentity, type AggregateIdentityMismatchOptions, AggregateNotFoundError, type AggregateNotFoundErrorOptions, type AggregatePersistence, type AggregatePersistenceWrite, type AggregateSnapshot, AggregateTrackingError, type AggregateTrackingErrorOptions, type AggregateTrackingReason, type AggregateWriteIntent, type AggregateWriteRegistration, type AnyDomainEvent, type AnyUncommittedDomainEvent, type AppendOnlyWriteRegistration, CapabilityRegistryConflictError, type ClassifyConcurrencyConflictOptions, type ClockFactory, type Command, CommandBus, type CommandBusOptions, type CommandCommitOriginCandidate, type CommandHandler, type CommandMessageContent, type CommandMessageRelationships, type CommandOutboxCommitCandidate, type CommandOutboxMapper, type CommandOutboxWriter, type CommitEnrollment, type CommitEnrollmentOptions, CommitError, type CommitPosition, type CommittedDomainEvent, type CompatibleRepositoryDefinitions, ConcurrencyConflictError, type ConcurrencyConflictErrorOptions, type ConcurrencyConflictReason, type CreateDomainEventFromFactsOptions, type CreateDomainEventOptions, type CreateDomainEventStampOptions, type CreateUncommittedDomainEventOptions, type DeadLetterDeadline, type DeadLetterRecord, DeadlineProcessor, type DeadlineProcessorObservers, type DeadlineProcessorOptions, type DeadlineStore, type DeepEqualExceptOptions, type DeepOmitKey, type DeepOmitOptions, type DeepOmitPathSegment, type DeliveryFailureAssessment, type DeliveryFailureClassifier, type DeliveryFailureKind, DirectStateMutationError, type DirectStateMutationErrorOptions, type DispatchTrackingOutbox, DomainError, type DomainErrorClass, type DomainEvent, type DomainEventFactory, type DomainEventFactoryOptions, type DomainEventStamp, type DomainEventStampFactory, type DomainEventStampProvider, type DomainEventValidationCode, DomainEventValidationError, type DomainEventValidationField, type DomainMachineDefinition, type DomainMachineDefinitionAnalysis, type DomainMachineDefinitionDiagnostic, type DomainMachineInput, type DomainMachineReadonly, type DomainMachineSnapshot, type DomainMachineTransitionDescription, DomainStateMachine, type DomainStateNode, type DomainTransition, DomainTransitionGuardRejectedError, type DomainTransitionGuardResult, type DomainTransitionOutcome, type DomainTransitionResult, type DueDeadline, DuplicateAggregateError, type DuplicateAggregateErrorOptions, DuplicateEventIdError, type DuplicateEventIdErrorOptions, DuplicateHandlerRegistrationError, type DuplicateHandlerRegistrationErrorOptions, type DurableCommandMessage, Entity, type EntityConfig, ErrorMapperFailedError, type ErrorMapperFailedErrorOptions, type EventBus, EventBusClosedError, EventBusImpl, type EventBusObservers, type EventBusOptions, type EventCommitCandidate, type EventCommitCandidatePosition, type EventHandler, EventHarvestError, type EventIdFactory, type EventMetadata, EventSourcedAggregate, type EventStore, type EventStoreAppendOptions, type EventStreamPageReason, type EventStreamReader, type ExecutionContext, type FlushStatementReason, FoldReturnedNoStateError, ForeignEventError, type HandlerFailureReport, HostileStateKeyError, type ICommandBus, type IEntity, type IQueryBus, type IValueObject, type Id, type IdGenerator, type IdempotencyClaim, type IdempotencyClaimHandle, IdempotencyClaimLostError, type IdempotencyClaimLostErrorOptions, IdempotencyCompletionWithoutClaimError, IdempotencyInFlightError, type IdempotencyInFlightErrorOptions, IdempotencyKeyReuseError, type IdempotencyKeyReuseErrorOptions, type IdempotencyLease, type IdempotencyOperationErrorContext, type IdempotencyReconciliation, type IdempotencyReconciliationDecision, IdempotencyReconciliationRequiredError, type IdempotencyReconciliationRequiredErrorOptions, type IdempotencyStore, type IdempotentCommitRequest, type IdempotentCommitResult, type IdempotentExecution, type Identifiable, IdentityMap, InMemoryCapacityExceededError, type InMemoryCapacityExceededErrorOptions, InMemoryDeadlineStore, type InMemoryDeadlineStoreOptions, InMemoryEventStore, type InMemoryEventStoreOptions, InMemoryIdempotencyStore, type InMemoryIdempotencyStoreOptions, InMemoryOutbox, type InMemoryOutboxOptions, InMemoryProjectionCheckpointStore, type InMemoryProjectionCheckpointStoreOptions, InMemorySnapshotStore, type InMemorySnapshotStoreOptions, type InMemoryTransaction, type InMemoryTransactionParticipant, InMemoryTransactionScope, InfrastructureError, type IntegrationMessage, type IntegrationMessageContent, type IntegrationMessageMapper, type IntegrationMessageRelationships, InvalidCommandMessageError, InvalidDomainMachineContextError, InvalidDomainMachineDefinitionError, InvalidDomainMachineInputError, InvalidDomainMachineSnapshotError, InvalidDomainTransitionError, InvalidDomainTransitionGuardResultError, InvalidDomainTransitionResultError, InvalidEventStreamPageError, type InvalidEventStreamPageErrorOptions, InvalidFlushStatementError, type InvalidFlushStatementErrorOptions, InvalidIntegrationMessageError, InvalidRepositoryAdapterError, type InvalidRepositoryAdapterErrorOptions, type InvalidRepositoryAdapterReason, InvalidRepositoryDefinitionError, InvalidVersionError, type JsonObject, type JsonPrimitive, type JsonValue, type KitErrorCode, type KitErrorOptions, type MatchedRows, MisattributedEventError, MissingEntityIdError, MissingFoldError, MissingHandlerError, NestedUnitOfWorkError, type OnceOptions, type Outbox, OutboxDispatcher, type OutboxDispatcherObservers, type OutboxDispatcherOptions, type OutboxRecord, type OutboxSink, type OutboxWriter, type PendingDomainEvent, PendingEventBatchMismatchError, type PendingEventBatchMismatchErrorOptions, PendingEventLimitExceededError, type PendingEventLimitExceededErrorOptions, type PersistenceBaseline, type PersistenceChanges, type PersistenceLifecycle, type PersistenceModel, type PhysicalRemovalRegistration, type PinTargetVersionOptions, type PinnedTargetVersion, type PreparedDomainMachineDefinition, type ProjectOptions, type Projection, type ProjectionBatchResult, type ProjectionCheckpoint, type ProjectionCheckpointStore, type ProjectionEventHandler, type ProjectionFromHandlersOptions, ProjectionGapError, type ProjectionHandlers, ProjectionIdentityViolationError, ProjectionOrderViolationError, type ProjectionPosition, ProjectionReceiptViolationError, Projector, type ProjectorOptions, type PublishAbortedReport, type PublishChainState, type PublishChainStore, PublishDepthExceededError, type PublishOptions, type PublishedCommand, type Query, QueryBus, type QueryBusOptions, type QueryHandler, type ReachableStreamPages, type ReadStreamOptions, type ReadStreamPagesOptions, ReentrantDomainStateMachineEvaluationError, ReentrantEventRecordingError, type ReentrantEventRecordingErrorOptions, ReplayRejectedError, type ReplayRejectedErrorOptions, ReplayTargetMismatchError, type ReplayTargetMismatchErrorOptions, type ReplayTargetMismatchReason, type ReplayableAggregate, type ReplayableStreamPages, type RepositoriesOf, type Repository, type RepositoryDefinition, type RepositoryDefinitionOptions, RepositoryErrorMappingFailedError, type RepositoryErrorMappingFailedErrorOptions, type RepositoryTracking, type RetryPolicy, RetryingTransactionScope, RollbackError, type RunOptions, type SharedDomainEventStampOptions, SnapshotCorruptedError, type SnapshotModel, SnapshotSchemaMismatchError, type SnapshotSchemaMismatchErrorOptions, type SnapshotStore, SnapshotTimeValidationError, SnapshotVersionNotRestoredError, type SnapshotVersionNotRestoredErrorOptions, Specification, type SpecificationComposite, StateStoredAggregate, type StateValidator, type StreamPages, type StreamReadResult, type SubscriptionThresholdReport, TransactionClosedError, type TransactionScope, type TransactionalOptions, type UncommittedDomainEvent, type UncommittedDomainEventOf, UnenrolledChangesError, type UnenrolledChangesErrorOptions, UnitOfWork, type UnitOfWorkContext, type UnitOfWorkDeps, type UnitOfWorkIdentityMap, UnmanagedInstanceError, UnmintedEventError, UnprojectableEventError, type UnreachableStreamPages, UnregisteredHandlerError, type UnregisteredHandlerErrorOptions, UnreplayableAggregateError, type UnreplayableAggregateErrorOptions, type VO, ValueObject, type Version, type VersionedFlushStatements, type VersionedWrite, type WithCommitDeps, type WithCommitWorkResult, type WithIdempotentCommitDeps, analyzeDomainMachineDefinition, canTransitionDomainState, captureAggregateSnapshot, capturePersistenceBaseline, classifyConcurrencyConflict, copyMetadata, createDomainEvent, createDomainEventFactory, createDomainEventFromFacts, createInitialDomainMachineSnapshot, createIntegrationMessage, createUncommittedDomainEvent, decodeIntegrationMessage, deepEqual, deepEqualExcept, deepFreeze, deepOmit, defaultDomainEventFactory, defineRepository, defineSnapshotModel, derivePersistenceChanges, detachState, domainErrorToResult, encodeIntegrationMessage, entityIds, eventBusSink, findEntityById, freezeShallow, hasEntityId, ignoreProjectionEvent, insertPersistenceBaseline, integrationMessageToCommittedEvent, isDomainErrorLike, isInfrastructureErrorLike, isPositionAfter, isWiringErrorLike, mergeMetadata, outboxWriterAcceptingEventLoss, persistenceProjectionDrifted, pinTargetVersion, prepareDomainMachineDefinition, projectionFromHandlers, readStreamPages, recapturePersistenceBaseline, reconstituteAggregateFromHistory, reconstituteAggregateFromSnapshot, reconstituteAggregateFromStreamPages, recordDomainEvent, recordPendingEvents, removeEntityById, replaceEntityById, routeEventsToCommandOutbox, sameEntity, sameVersion, specification, toVersion, transitionDomainState, updateEntityById, versionedFlush, vo, voEquals, voEqualsExcept, voValidated, voWithValidation, withCommit, withIdempotentCommit };
 //# sourceMappingURL=index.d.ts.map