@shirudo/ddd-kit 3.0.0-rc.11 → 3.0.0-rc.13

package/dist/index.js

@@ -1,5 +1,6 @@
-import { $ as isDomainErrorLike, A as MissingHandlerError, B as SnapshotCorruptedError, C as InvalidEventStreamPageError, D as MisattributedEventError, E as KitWiringError, F as ProjectionOrderViolationError, G as UnmintedEventError, H as SnapshotVersionNotRestoredError, I as ProjectionReceiptViolationError, J as UnreplayableAggregateError, K as UnprojectableEventError, L as ReentrantEventRecordingError, M as PendingEventLimitExceededError, N as ProjectionGapError, O as MissingEntityIdError, P as ProjectionIdentityViolationError, Q as detachAggregateIdentity, R as ReplayRejectedError, S as InvalidCommandMessageError, T as InvalidVersionError, U as UnenrolledChangesError, V as SnapshotSchemaMismatchError, W as UnmanagedInstanceError, X as attributeConflictIntent, Y as assertNoHostileOwnProtoKey, Z as describeAggregateIdentity, _ as IdempotencyInFlightError, a as DirectStateMutationError, b as InMemoryCapacityExceededError, c as DuplicateEventIdError, d as EventHarvestError, et as isInfrastructureErrorLike, f as FoldReturnedNoStateError, g as IdempotencyCompletionWithoutClaimError, h as IdempotencyClaimLostError, i as ConcurrencyConflictError, j as PendingEventBatchMismatchError, k as MissingFoldError, l as DuplicateHandlerRegistrationError, m as HostileStateKeyError, n as AggregateNotFoundError, nt as rewriteErrorMessage, o as DomainError, p as ForeignEventError, q as UnregisteredHandlerError, r as CapabilityRegistryConflictError, s as DuplicateAggregateError, t as AggregateDeletedError, tt as isWiringErrorLike, u as ErrorMapperFailedError, v as IdempotencyKeyReuseError, w as InvalidIntegrationMessageError, x as InfrastructureError, y as IdempotencyReconciliationRequiredError, z as ReplayTargetMismatchError } from "./chunks/kit-errors.js";
-import { A as SnapshotTimeValidationError, B as voWithValidation, C as defaultDomainEventFactory, D as mintUncommittedDomainEvent, E as mergeMetadata, F as ValueObject, G as isBuiltInObject, H as deepOmit, I as deepFreeze, K as isIntrinsicConstructorPrototype, L as vo, M as detachState, N as hasCooperativeBrand, O as recordDomainEvent, P as stampCooperativeBrand, R as voEquals, S as createUncommittedDomainEvent, T as isUncommittedDomainEvent, U as deepEqual, V as deepEqualExcept, W as findPropertyDescriptor, _ as adoptUncommittedDomainEvent, a as isDispatchTrackingOutbox, b as createDomainEventFactory, c as runBoundedExecution, d as assertPositiveInteger, f as assertPositiveSafeInteger, g as adoptRecordedDomainEvent, h as waitRejectingOnAbort, i as assertPageWithinWindow, j as detachFreezableState, k as DomainEventValidationError, l as MAX_TIMER_DELAY_MS, m as abortReason, n as readStreamPages, o as DEFAULT_EXECUTION_TIMEOUT_MS, p as assertTimerDelay, q as isWeakMap, r as assertPageNotEmpty, s as ownerSignalOf, t as pinTargetVersion, u as assertNonNegativeSafeInteger, v as copyMetadata, w as isRecordedDomainEvent, x as createDomainEventFromFacts, y as createDomainEvent, z as voEqualsExcept } from "./chunks/read-stream-pages.js";
+import { $ as isDomainErrorLike, A as MissingHandlerError, B as ReplayTargetMismatchError, C as InvalidEventStreamPageError, D as MisattributedEventError, E as KitWiringError, F as ProjectionOrderViolationError, G as UnprojectableEventError, H as SnapshotSchemaMismatchError, I as ProjectionReceiptViolationError, J as UnreplayableAggregateError, K as UnregisteredChangesError, L as PrototypePollutionError, M as PendingEventLimitExceededError, N as ProjectionGapError, O as MissingEntityIdError, P as ProjectionIdentityViolationError, Q as describeAggregateIdentity, R as ReentrantEventRecordingError, S as InvalidCommandMessageError, T as InvalidVersionError, U as SnapshotVersionNotRestoredError, V as SnapshotCorruptedError, W as UnmanagedInstanceError, X as attributeConflictIntent, Y as assertNoOwnProtoKey, Z as copyAggregateIdentity, _ as IdempotencyInFlightError, a as DirectStateMutationError, b as InMemoryCapacityExceededError, c as DuplicateEventIdError, d as EventCollectionError, et as isInfrastructureErrorLike, f as FoldReturnedNoStateError, g as IdempotencyCompletionWithoutClaimError, h as IdempotencyClaimLostError, i as ConcurrencyConflictError, j as PendingEventBatchMismatchError, k as MissingFoldError, l as DuplicateHandlerRegistrationError, m as HandBuiltEventError, n as AggregateNotFoundError, nt as rewriteErrorMessage, o as DomainError, p as ForeignEventError, q as UnregisteredHandlerError, r as CapabilityRegistryConflictError, s as DuplicateAggregateError, t as AggregateDeletedError, tt as isWiringErrorLike, u as ErrorMapperFailedError, v as IdempotencyKeyReuseError, w as InvalidIntegrationMessageError, x as InfrastructureError, y as IdempotencyReconciliationRequiredError, z as ReplayRejectedError } from "./chunks/kit-errors.js";
+import { a as valueObjectEqualsExcept, c as applyCooperativeBrand, d as deepEqual, i as valueObjectEquals, l as hasCooperativeBrand, n as deepFreeze, o as valueObjectOrError, r as valueObject, t as ValueObject, u as deepOmit, v as isWeakMap } from "./chunks/value-object.js";
+import { A as copyFreezableState, C as defaultDomainEventFactory, D as stampDomainEvent, E as mergeMetadata, O as DomainEventValidationError, S as createStampedDomainEvent, T as isUnstampedDomainEvent, _ as adoptUnstampedDomainEvent, a as isDispatchTrackingOutbox, b as createDomainEvent, c as runBoundedExecution, d as assertPositiveInteger, f as assertPositiveSafeInteger, g as adoptStampedDomainEvent, h as waitRejectingOnAbort, i as assertPageWithinWindow, j as copyPlainState, k as SnapshotTimeValidationError, l as MAX_TIMER_DELAY_MS, m as abortReason, n as readStreamPages, o as DEFAULT_EXECUTION_TIMEOUT_MS, p as assertTimerDelay, r as assertPageNotEmpty, s as ownerSignalOf, t as pinTargetVersion, u as assertNonNegativeSafeInteger, v as buildUnstampedDomainEvent, w as isStampedDomainEvent, x as createDomainEventFactory, y as copyMetadata } from "./chunks/read-stream-pages.js";
 import { err, ok } from "@shirudo/result";
 import { ValidationError, someChainRetryable } from "@shirudo/base-error";
 
@@ -407,11 +408,11 @@ function captureObserverFunctions(context, observers, required) {
 //#region src/application/cqrs/handler.ts
 /**
 * True when the aggregate's live version or pending-event batch no longer
-* matches its enrollment-time snapshot. Shared by the duplicate-enrollment
-* gate and the harvest-time recheck: both must reject the same divergence,
-* or events recorded after enrollment would be silently dropped.
+* matches its registration-time snapshot. Shared by the duplicate-registration
+* gate and the collection-time recheck: both must reject the same divergence,
+* or events recorded after registration would be silently dropped.
 */
-function enrollmentDiverged(record) {
+function registrationDiverged(record) {
 	const pending = record.aggregate.pendingEvents;
 	return record.aggregate.version !== record.version || pending.length !== record.events.length || record.events.some((event, index) => event !== pending[index]);
 }
@@ -419,24 +420,24 @@ function enrollmentDiverged(record) {
 function createCommitTokenScope() {
 	const recordsByToken = /* @__PURE__ */ new WeakMap();
 	const tokensByAggregate = /* @__PURE__ */ new WeakMap();
-	let mintedTokenCount = 0;
+	let issuedTokenCount = 0;
 	let open = true;
-	const enroll = (aggregate, disposition, options) => {
-		if (!open) throw new EventHarvestError("withCommit: commit enrollment was used after its work callback settled. Await every repository write and return its token before leaving the callback.");
+	const register = (aggregate, disposition, options) => {
+		if (!open) throw new EventCollectionError("withCommit: commit registration was used after its work callback settled. Await every repository write and return its token before leaving the callback.");
 		const existing = tokensByAggregate.get(aggregate);
 		if (existing) {
 			const record = recordsByToken.get(existing);
-			if (!record) throw new EventHarvestError("withCommit: internal commit-token registry is inconsistent.");
-			if (record.disposition === "deleted" && disposition === "saved") throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(aggregate.aggregateIdentity)} was enrolled as saved after it was enrolled as deleted in the same transaction.`);
-			if (options?.expectedVersion !== void 0 && options.expectedVersion !== record.expectedVersion) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(aggregate.aggregateIdentity)} was re-enrolled with expectedVersion ${String(options.expectedVersion)}, but its enrollment recorded ${String(record.expectedVersion)}. Duplicate enrollment must assert the same OCC baseline or none.`);
-			if (enrollmentDiverged(record)) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(aggregate.aggregateIdentity)} changed after its commit batch was enrolled. Register persistence intent last.`);
+			if (!record) throw new EventCollectionError("withCommit: internal commit-token registry is inconsistent.");
+			if (record.disposition === "deleted" && disposition === "saved") throw new EventCollectionError(`withCommit: aggregate ${describeAggregateIdentity(aggregate.aggregateIdentity)} was registered as saved after it was registered as deleted in the same transaction.`);
+			if (options?.expectedVersion !== void 0 && options.expectedVersion !== record.expectedVersion) throw new EventCollectionError(`withCommit: aggregate ${describeAggregateIdentity(aggregate.aggregateIdentity)} was re-registered with expectedVersion ${String(options.expectedVersion)}, but its registration recorded ${String(record.expectedVersion)}. Duplicate registration must assert the same OCC baseline or none.`);
+			if (registrationDiverged(record)) throw new EventCollectionError(`withCommit: aggregate ${describeAggregateIdentity(aggregate.aggregateIdentity)} changed after its commit batch was registered. Register persistence intent last.`);
 			if (disposition === "deleted") record.disposition = "deleted";
 			return existing;
 		}
-		const eventLifecycle = requirePendingEventLifecycleCapability(aggregate, "withCommit enrollment");
+		const eventLifecycle = requirePendingEventLifecycleCapability(aggregate, "withCommit registration");
 		const token = Object.freeze(Object.create(null));
 		const events = aggregate.pendingEvents;
-		for (const event of events) if (!isRecordedDomainEvent(event)) throw new EventHarvestError(`withCommit: event "${event.type}" has not been recorded. Call recordPendingEvents(aggregate, createStamp) in the application shell before persistence or outbox harvest.`, event.type);
+		for (const event of events) if (!isStampedDomainEvent(event)) throw new EventCollectionError(`withCommit: event "${event.type}" has not been stamped. Call stampPendingEvents(aggregate, createStamp) in the application shell before persistence or outbox collection.`, event.type);
 		const persistedVersion = eventLifecycle.persistedVersion();
 		tokensByAggregate.set(aggregate, token);
 		recordsByToken.set(token, {
@@ -448,32 +449,32 @@ function createCommitTokenScope() {
 			persistedVersion,
 			events
 		});
-		mintedTokenCount += 1;
+		issuedTokenCount += 1;
 		return token;
 	};
 	return {
-		enrollment: Object.freeze({
-			enrollSaved: (aggregate, options) => enroll(aggregate, "saved", options),
-			enrollDeleted: (aggregate, options) => enroll(aggregate, "deleted", options)
+		registration: Object.freeze({
+			registerSaved: (aggregate, options) => register(aggregate, "saved", options),
+			registerRemoved: (aggregate, options) => register(aggregate, "deleted", options)
 		}),
 		close: () => {
 			open = false;
 		},
 		resolve: (tokens) => {
-			if (!Array.isArray(tokens)) throw new EventHarvestError("withCommit: the work callback must return `commits` containing tokens from the current enrollment capability. Naked aggregate arrays are not commit evidence.");
+			if (!Array.isArray(tokens)) throw new EventCollectionError("withCommit: the work callback must return `commits` containing tokens from the current registration capability. Naked aggregate arrays are not commit evidence.");
 			const seen = /* @__PURE__ */ new Set();
 			const records = [];
 			for (const token of tokens) {
-				if (token === null || typeof token !== "object" && typeof token !== "function") throw new EventHarvestError("withCommit: a commit token was not minted by this callback's enrollment capability. Forged and stale tokens are rejected.");
+				if (token === null || typeof token !== "object" && typeof token !== "function") throw new EventCollectionError("withCommit: a commit token was not issued by this callback's registration capability. Forged and stale tokens are rejected.");
 				const tokenObject = token;
 				const record = recordsByToken.get(tokenObject);
-				if (!record) throw new EventHarvestError("withCommit: a commit token was not minted by this callback's enrollment capability. Forged and stale tokens are rejected.");
+				if (!record) throw new EventCollectionError("withCommit: a commit token was not issued by this callback's registration capability. Forged and stale tokens are rejected.");
 				if (seen.has(tokenObject)) continue;
 				seen.add(tokenObject);
-				if (enrollmentDiverged(record)) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(record.aggregate.aggregateIdentity)} changed after its commit batch was enrolled; events recorded after enrollment are not part of the attested write and would be silently dropped. Make domain decisions first, write, and enroll last.`);
+				if (registrationDiverged(record)) throw new EventCollectionError(`withCommit: aggregate ${describeAggregateIdentity(record.aggregate.aggregateIdentity)} changed after its commit batch was registered; events recorded after registration are not part of the attested write and would be silently dropped. Make domain decisions first, write, and register last.`);
 				records.push(record);
 			}
-			if (seen.size !== mintedTokenCount) throw new EventHarvestError("withCommit: every token minted by the current enrollment capability must be returned in `commits`. If an enrolled write must not commit, throw so the transaction rolls back.");
+			if (seen.size !== issuedTokenCount) throw new EventCollectionError("withCommit: every token issued by the current registration capability must be returned in `commits`. If a registered write must not commit, throw so the transaction rolls back.");
 			return records;
 		}
 	};
@@ -481,29 +482,29 @@ function createCommitTokenScope() {
 /**
 * Helper for executing a write Use Case inside a transaction scope.
 *
-* The use-case callback receives an invocation-scoped enrollment capability
+* The use-case callback receives an invocation-scoped registration capability
 * and returns opaque commit tokens for the repository writes that completed
-* in the transaction. `withCommit` owns the post-commit lifecycle (harvest,
+* in the transaction. `withCommit` owns the post-commit lifecycle (collection,
 * outbox, mark-persisted, publish). A naked aggregate is not commit evidence:
 * merely touching or constructing one must never make it look persisted.
 *
-* **Trust boundary.** A token proves invocation-local enrollment, not that the
+* **Trust boundary.** A token proves invocation-local registration, not that the
 * kit inspected a database write; a generic transaction helper cannot observe
-* adapter internals. Repository code must enroll only writes participating in
+* adapter internals. Repository code must register only writes participating in
 * this transaction. `UnitOfWork` centralizes that rule in repository methods.
 * The opaque, scoped token prevents accidental aggregate smuggling and stale
 * reuse; it is not a security boundary against code that deliberately lies to
 * its own persistence capability.
 *
 * Order of operations:
-*  1. `fn(ctx, enrollment)` runs inside `scope.transactional(...)`; domain
+*  1. `fn(ctx, registration)` runs inside `scope.transactional(...)`; domain
 *     mutations + repo writes happen here. After a repository write has
-*     enrolled an aggregate, the callback includes that opaque token in its
+*     registered an aggregate, the callback includes that opaque token in its
 *     `commits` result. Tokens are invocation-bound: forged or stale tokens
-*     fail before harvest. `ctx` is whatever transaction handle the `scope`
+*     fail before collection. `ctx` is whatever transaction handle the `scope`
 *     exposes (Drizzle `tx`, Prisma `tx`, Mongo session, or `undefined` for
 *     context-free scopes).
-*  2. **Still inside the transaction**, `withCommit` harvests every
+*  2. **Still inside the transaction**, `withCommit` collects every
 *     aggregate's `pendingEvents` and writes them via `outbox.add` (so
 *     events persist atomically with the state change). Skipped when no
 *     events were recorded. Each bare domain event is composed into an
@@ -513,7 +514,7 @@ function createCommitTokenScope() {
 *     resulting `CommittedDomainEvent`. The domain event itself is never
 *     stamped or copied.
 *
-*     **Harvest order.** Events are concatenated in the order
+*     **Collection order.** Events are concatenated in the order
 *     tokens appear in the returned `commits` array, then in
 *     each aggregate's `pendingEvents` order (insertion order via
 *     `apply` / `commit` / `addDomainEvent`). So tokens for `[a, b]`
@@ -537,7 +538,7 @@ function createCommitTokenScope() {
 *     across aggregates at delivery time.
 *  3. The transaction commits.
 *  4. **After** the commit, a non-exported capability acknowledges every
-*     saved enrollment and discards pending events for deleted enrollments.
+*     saved registration and discards pending events for deleted registrations.
 *     Only after the complete commit set is clean does the optional
 *     application-shell `onPersisted(aggregate, version, context)` observer run for
 *     saved aggregates. Deleted rows never trigger that observer.
@@ -567,16 +568,16 @@ function createCommitTokenScope() {
 * If the transaction rolls back, no acknowledgement occurs: the aggregate
 * keeps its pending events, so the caller can retry or discard the instance.
 *
-* Enrollment captures an exact version and event batch. Re-enrolling the same
+* Registration captures an exact version and event batch. Re-registering the same
 * aggregate after it changes rejects. `UnitOfWork` additionally seals the
-* adapter persistence projection and rejects later mutation before flush. For
-* direct `withCommit` use, make domain decisions first, write, and enroll last.
+* adapter persistence capture and rejects later mutation before flush. For
+* direct `withCommit` use, make domain decisions first, write, and register last.
 *
-* **Duplicate enrollment is idempotent by reference.** Enrolling the same
+* **Duplicate registration is idempotent by reference.** Registering the same
 * instance repeatedly returns the same token, and a repeated token in
-* `commits` is harvested once. A repeat call that omits `expectedVersion`
+* `commits` is collected once. A repeat call that omits `expectedVersion`
 * makes no OCC assertion; only a supplied value that contradicts the
-* enrollment-time baseline rejects. Each event lands in the outbox exactly once
+* registration-time baseline rejects. Each event lands in the outbox exactly once
 * and post-commit acknowledgement runs exactly once. Two
 * *different* instances with the same logical id cannot be detected
 * at this layer; that is a Repository contract violation (failure to
@@ -587,19 +588,19 @@ function createCommitTokenScope() {
 *
 * @example Tx-bound repos (Drizzle, Prisma, Mongo, …)
 * ```typescript
-* const result = await withCommit({ outbox, bus, scope }, async (tx, enrollment) => {
+* const result = await withCommit({ outbox, bus, scope }, async (tx, registration) => {
 *   const orderRepository = makeOrderRepository(tx); // your factory binds tx to the repo
 *   const order = await orderRepository.getById(orderId);
 *   order.confirm();
 *   await persistOrder(tx, order);                 // low-level adapter write
-*   const commit = enrollment.enrollSaved(order);   // attest the repository write
+*   const commit = registration.registerSaved(order);   // attest the repository write
 *   return { result: order.id, commits: [commit] };
 * });
 * ```
 */
 async function withCommit(deps, fn) {
-	return withCheckedCommit(deps, async (ctx, enrollment) => {
-		const { result, commits } = await fn(ctx, enrollment);
+	return withCheckedCommit(deps, async (ctx, registration) => {
+		const { result, commits } = await fn(ctx, registration);
 		return {
 			result,
 			commits
@@ -618,19 +619,19 @@ async function withCheckedCommit(deps, fn, onAttemptStart) {
 		const tokenScope = createCommitTokenScope();
 		let fnResult;
 		try {
-			fnResult = await fn(ctx, tokenScope.enrollment);
+			fnResult = await fn(ctx, tokenScope.registration);
 		} finally {
 			tokenScope.close();
 		}
 		try {
 			const commitRecords = tokenScope.resolve(fnResult.commits);
 			const candidates = commitRecords.flatMap((record) => {
-				const enrolled = record.aggregate.aggregateIdentity;
-				if (record.events.length > 0 && record.persistedVersion !== void 0 && record.version <= record.persistedVersion) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(enrolled)} recorded events but did not advance its version beyond the persisted version (${String(record.persistedVersion)}). An eventful commit needs a unique cursor; use StateStoredAggregate.setState(currentState, event) instead of addDomainEvent(event) alone.`);
-				const enrolledId = enrolled.aggregateId;
-				const enrolledType = enrolled.aggregateType;
+				const registered = record.aggregate.aggregateIdentity;
+				if (record.events.length > 0 && record.persistedVersion !== void 0 && record.version <= record.persistedVersion) throw new EventCollectionError(`withCommit: aggregate ${describeAggregateIdentity(registered)} recorded events but did not advance its version beyond the persisted version (${String(record.persistedVersion)}). An eventful commit needs a unique cursor; use StateStoredAggregate.setState(currentState, event) instead of addDomainEvent(event) alone.`);
+				const registeredId = registered.aggregateId;
+				const registeredType = registered.aggregateType;
 				return record.events.map((event, index) => {
-					if (!isRecordedDomainEvent(event)) throw new EventHarvestError(`withCommit: event "${event.type}" has not been recorded. Call recordPendingEvents(aggregate, createStamp) in the application shell before persistence or outbox harvest.`, event.type);
+					if (!isStampedDomainEvent(event)) throw new EventCollectionError(`withCommit: event "${event.type}" has not been stamped. Call stampPendingEvents(aggregate, createStamp) in the application shell before persistence or outbox collection.`, event.type);
 					const recordedEvent = event;
 					const commitSize = record.events.length;
 					const aggregateId = recordedEvent.aggregateId;
@@ -638,14 +639,14 @@ async function withCheckedCommit(deps, fn, onAttemptStart) {
 					const missing = [];
 					if (!aggregateId) missing.push("aggregateId");
 					if (!aggregateType) missing.push("aggregateType");
-					if (!aggregateId || !aggregateType) throw new EventHarvestError(`withCommit: event "${recordedEvent.type}" is missing ${missing.join(" and ")}. Use this.createEvent(type, payload) inside aggregate methods instead of createDomainEvent(...); createEvent auto-injects aggregateId and aggregateType. Outbox dispatchers and projection handlers rely on the envelope source.`, recordedEvent.type);
-					if (aggregateId !== enrolledId || aggregateType !== enrolledType) throw new EventHarvestError(`withCommit: event "${recordedEvent.type}" belongs to ${describeAggregateIdentity({
+					if (!aggregateId || !aggregateType) throw new EventCollectionError(`withCommit: event "${recordedEvent.type}" is missing ${missing.join(" and ")}. Use this.createEvent(type, payload) inside aggregate methods instead of createDomainEvent(...); createEvent auto-injects aggregateId and aggregateType. Outbox dispatchers and projection handlers rely on the envelope source.`, recordedEvent.type);
+					if (aggregateId !== registeredId || aggregateType !== registeredType) throw new EventCollectionError(`withCommit: event "${recordedEvent.type}" belongs to ${describeAggregateIdentity({
 						aggregateType,
 						aggregateId
-					})} but was enrolled under ${describeAggregateIdentity({
-						aggregateType: enrolledType,
-						aggregateId: enrolledId
-					})}. The aggregate base classes stamp the aggregate identity on every recording path; an instance from another package copy must stamp it the same way.`, recordedEvent.type);
+					})} but was registered under ${describeAggregateIdentity({
+						aggregateType: registeredType,
+						aggregateId: registeredId
+					})}. The aggregate base classes attribute every event to the aggregate on every recording path; an instance from another package copy must stamp it the same way.`, recordedEvent.type);
 					return Object.freeze({
 						event: recordedEvent,
 						source: Object.freeze({
@@ -660,12 +661,12 @@ async function withCheckedCommit(deps, fn, onAttemptStart) {
 					});
 				});
 			});
-			const endedSources = commitRecords.filter((record) => record.disposition === "deleted").map((record) => detachAggregateIdentity(record.aggregate.aggregateIdentity));
+			const endedSources = commitRecords.filter((record) => record.disposition === "deleted").map((record) => copyAggregateIdentity(record.aggregate.aggregateIdentity));
 			if (candidates.length > 0) await deps.outbox.add(Object.freeze(candidates));
 			if (endedSources.length > 0) await deps.outbox.endEventSources(Object.freeze(endedSources));
 			fnResult.checkBeforeCommit?.();
 			if (candidates.length > 0 || endedSources.length > 0) {
-				for (const record of commitRecords) if (enrollmentDiverged(record)) throw new EventHarvestError(`withCommit: aggregate ${describeAggregateIdentity(record.aggregate.aggregateIdentity)} changed while its outbox write ran. Await every change inside the work callback.`);
+				for (const record of commitRecords) if (registrationDiverged(record)) throw new EventCollectionError(`withCommit: aggregate ${describeAggregateIdentity(record.aggregate.aggregateIdentity)} changed while its outbox write ran. Await every change inside the work callback.`);
 			}
 			return {
 				result: fnResult.result,
@@ -1406,7 +1407,7 @@ function positiveSafeInteger(value) {
 *
 * On its own, the store is the reference for the leased family: it cannot
 * see commits or rollbacks. Claims and staged outcomes carry bounded leases,
-* while every mutation compares the store-minted token. An expired pending
+* while every mutation compares the store-issued token. An expired pending
 * claim may be replaced; an expired staged outcome cannot be guessed away and
 * instead returns `reconciliation-required`. Only an authoritative
 * `committed` / `not-committed` decision can settle it.
@@ -1669,20 +1670,20 @@ function startLeaseHeartbeat(store, claim) {
 		failure: () => heartbeatFailure
 	};
 }
-function scopeWorkEnrollment(parent) {
+function scopeWorkRegistration(parent) {
 	let open = true;
 	const assertOpen = () => {
-		if (!open) throw new EventHarvestError("withIdempotentCommit: commit enrollment was used after the user work callback settled. Await every repository write before returning from the callback.");
+		if (!open) throw new EventCollectionError("withIdempotentCommit: commit registration was used after the user work callback settled. Await every repository write before returning from the callback.");
 	};
 	return {
-		enrollment: Object.freeze({
-			enrollSaved: (aggregate) => {
+		registration: Object.freeze({
+			registerSaved: (...args) => {
 				assertOpen();
-				return parent.enrollSaved(aggregate);
+				return parent.registerSaved(...args);
 			},
-			enrollDeleted: (aggregate) => {
+			registerRemoved: (...args) => {
 				assertOpen();
-				return parent.enrollDeleted(aggregate);
+				return parent.registerRemoved(...args);
 			}
 		}),
 		close: () => {
@@ -1705,12 +1706,12 @@ function scopeWorkEnrollment(parent) {
 *  2. A fresh claim carries an opaque ownership token. For a leased store the
 *     wrapper renews it at `renewAfterMs` until the transaction callback is
 *     ready to commit. A renewal failure rejects before commit and releases
-*     the claim. `fn(ctx, enrollment, execution)` receives the same token so a
+*     the claim. `fn(ctx, registration, execution)` receives the same token so a
 *     source-side marker can make later reconciliation conclusive.
 *  3. `store.complete(ctx, claim, fn's result)` stages or completes the outcome
-*     in the same transaction as aggregate writes and outbox. The enrollment
+*     in the same transaction as aggregate writes and outbox. The registration
 *     capability is sealed and its token array copied before `complete` can
-*     yield, so leaked callback state cannot change the harvest receipt.
+*     yield, so leaked callback state cannot change the collection receipt.
 *  4. After commit, `store.confirm(claim)` finalizes a leased store's staged
 *     outcome; it is a no-op for transactional stores. A failure cannot reject
 *     an already committed write, so it is sent to `onIdempotencyError` and the
@@ -1798,7 +1799,7 @@ async function withIdempotentCommit(deps, request, fn) {
 	const outcome = await withCommit({
 		...deps,
 		scope
-	}, async (ctx, enrollment) => {
+	}, async (ctx, registration) => {
 		let claim = await store.claim(ctx, request.key, request.fingerprint);
 		if (claim.status === "reconciliation-required") {
 			const decision = deps.reconcileIdempotency ? await deps.reconcileIdempotency(claim.reconciliation, ctx) : "unknown";
@@ -1817,16 +1818,16 @@ async function withIdempotentCommit(deps, request, fn) {
 		};
 		attempt.claim = claim.claim;
 		attempt.heartbeat = startLeaseHeartbeat(store, claim.claim);
-		const workEnrollment = scopeWorkEnrollment(enrollment);
+		const workRegistration = scopeWorkRegistration(registration);
 		let work;
 		try {
-			work = await fn(ctx, workEnrollment.enrollment, {
+			work = await fn(ctx, workRegistration.registration, {
 				key: request.key,
 				fingerprint: request.fingerprint,
 				claimToken: claim.claim.token
 			});
 		} finally {
-			workEnrollment.close();
+			workRegistration.close();
 		}
 		const result = work.result;
 		const commits = Array.isArray(work.commits) ? Object.freeze([...work.commits]) : work.commits;
@@ -1841,7 +1842,7 @@ async function withIdempotentCommit(deps, request, fn) {
 	});
 	if (!outcome.replayed) {
 		const committedClaim = attempt.claim;
-		if (!committedClaim) throw new EventHarvestError("withIdempotentCommit: a fresh result committed without its claim receipt.");
+		if (!committedClaim) throw new EventCollectionError("withIdempotentCommit: a fresh result committed without its claim receipt.");
 		try {
 			await store.confirm(committedClaim);
 		} catch (confirmError) {
@@ -2438,7 +2439,7 @@ var RepositoryErrorMappingFailedError = class extends KitWiringError {
 	mapperCause;
 	constructor(options) {
 		super("REPOSITORY_ERROR_MAPPING_FAILED", `The repository error mapper failed for ${options.intent} of aggregate ${describeAggregateIdentity(options.identity)}. The original persistence failure is preserved as cause; the mapper failure is available as mapperCause.`, options.persistenceError);
-		this.identity = detachAggregateIdentity(options.identity);
+		this.identity = copyAggregateIdentity(options.identity);
 		this.intent = options.intent;
 		this.mapperCause = options.mapperError;
 	}
@@ -2463,7 +2464,7 @@ var InvalidFlushStatementError = class extends KitWiringError {
 	classifierCause;
 	constructor(options) {
 		super("INVALID_FLUSH_STATEMENT", flushStatementReasonMessage(options), options.cause);
-		this.identity = detachAggregateIdentity(options.identity);
+		this.identity = copyAggregateIdentity(options.identity);
 		this.intent = options.intent ?? null;
 		this.reason = options.reason;
 		this.received = options.received;
@@ -2510,7 +2511,7 @@ var AggregateTrackingError = class extends KitWiringError {
 	registeredIntent;
 	constructor(options) {
 		super("AGGREGATE_TRACKING", trackingReasonMessage(options));
-		this.identity = detachAggregateIdentity(options.identity);
+		this.identity = copyAggregateIdentity(options.identity);
 		this.operation = options.operation;
 		this.reason = options.reason;
 		this.registeredIntent = options.registeredIntent;
@@ -2543,10 +2544,10 @@ function trackingReasonMessage(options) {
 * A `CommitError` is the **potentially transient** post-completion
 * failure (a commit-time serialization failure is the classic case), so
 * it is the one a retrying caller should consider re-running. The
-* deterministic post-completion failure, a harvest-guard violation (an
+* deterministic post-completion failure, a collection-guard violation (an
 * event missing `aggregateId` / `aggregateType`, or an eventful persisted
 * aggregate that did not advance its version), is a programming bug and surfaces as
-* {@link EventHarvestError} instead, which does NOT extend
+* {@link EventCollectionError} instead, which does NOT extend
 * `InfrastructureError`, so it stays out of retry paths by construction.
 */
 var CommitError = class extends InfrastructureError {
@@ -2610,9 +2611,9 @@ function registerPendingEventRecordingCapability(aggregate, capability) {
 }
 
 //#endregion
-//#region src/application/unit-of-work/record-pending-events.ts
-function recordPendingEvents(aggregate, source, stampOptions) {
-	const capability = requirePendingEventRecordingCapability(aggregate, "recordPendingEvents");
+//#region src/application/unit-of-work/stamp-pending-events.ts
+function stampPendingEvents(aggregate, source, stampOptions) {
+	const capability = requirePendingEventRecordingCapability(aggregate, "stampPendingEvents");
 	const shared = {
 		occurredAt: stampOptions?.occurredAt,
 		metadata: stampOptions?.metadata
@@ -2836,7 +2837,7 @@ function deleteRepositoryFacadeProperty(state, target, property) {
 * `AggregatePersistence` implementations: two `findById(id)` calls in the same
 * unit of work MUST return the same instance, because commit-token
 * write registration dedupes by JavaScript object identity. Two instances for
-* one logical aggregate can otherwise produce two tokens, two harvests,
+* one logical aggregate can otherwise produce two tokens, two collections,
 * and two post-commit lifecycle calls.
 *
 * Storage is two-level (per-type stores created lazily), so
@@ -2903,7 +2904,7 @@ var IdentityMap = class {
 	* - Registering a DIFFERENT instance for an occupied type+id throws:
 	*   that is precisely the identity-map violation this class exists
 	*   to prevent (the repository hydrated twice instead of checking
-	*   {@link get} first), and letting it pass would double-harvest
+	*   {@link get} first), and letting it pass would double-collect
 	*   events downstream.
 	* - Registering a type+id that was {@link delete}d in this unit of
 	*   work throws `AggregateDeletedError`: deletion is final within
@@ -2918,7 +2919,7 @@ var IdentityMap = class {
 			this._stores.set(type, store);
 		}
 		const existing = store.get(id);
-		if (existing !== void 0 && existing !== aggregate) throw new Error(`IdentityMap: a different instance is already registered for ${describeAggregateIdentity(aggregate.aggregateIdentity)}. Check get() before hydrating: two live instances of one aggregate break the one-instance-per-unit-of-work contract that exactly-once event harvest relies on.`);
+		if (existing !== void 0 && existing !== aggregate) throw new Error(`IdentityMap: a different instance is already registered for ${describeAggregateIdentity(aggregate.aggregateIdentity)}. Check get() before hydrating: two live instances of one aggregate break the one-instance-per-unit-of-work contract that exactly-once event collection relies on.`);
 		store.set(id, aggregate);
 		if (aggregate !== null && typeof aggregate === "object" && !this._pendingAtRegistration.has(aggregate)) {
 			const pending = pendingEventCountOf(aggregate);
@@ -2929,7 +2930,7 @@ var IdentityMap = class {
 	* Registered instances that have recorded MORE pending events than they
 	* carried when first registered (loaded). Used by the unit of work's
 	* end-of-run guard: an aggregate that gained events after load but was
-	* never enrolled would silently drop them. A read-only load, or a
+	* never registered would silently drop them. A read-only load, or a
 	* reconstitution that already carried events, shows no increase and is
 	* not reported.
 	*/
@@ -3008,7 +3009,7 @@ function insertPersistenceBaseline(model) {
 	return createBaselineToken(model, void 0, "new");
 }
 /**
-* Captures the aggregate's current adapter projection using the capability
+* Captures the aggregate's current adapter capture using the capability
 * carried by an existing baseline. Used to seal persistence-last registration.
 */
 function recapturePersistenceBaseline(baseline, aggregate) {
@@ -3020,7 +3021,7 @@ function recapturePersistenceBaseline(baseline, aggregate) {
 	});
 }
 /**
-* Recaptures the adapter projection and reports whether it drifted from the
+* Recaptures the adapter capture and reports whether it drifted from the
 * baseline's stored capture, using the model's `captureEquals` when supplied
 * and structural deep equality otherwise.
 *
@@ -3031,8 +3032,8 @@ function recapturePersistenceBaseline(baseline, aggregate) {
 * question independent of the model's diffing strategy. A `"new"` lifecycle
 * baseline has no stored capture and never reports drift.
 */
-function persistenceProjectionDrifted(baseline, aggregate) {
-	const capability = capabilityFor(baseline, "persistenceProjectionDrifted");
+function persistenceCaptureDrifted(baseline, aggregate) {
+	const capability = capabilityFor(baseline, "persistenceCaptureDrifted");
 	if (capability.lifecycle === "new") return false;
 	return !capability.captureEquals(capability.baseline, capability.capture(aggregate));
 }
@@ -3076,7 +3077,7 @@ function capabilityFor(baseline, operation) {
 * the public API.
 */
 var Session = class {
-	commitEnrollment;
+	commitRegistration;
 	_registeredWrites = [];
 	_commitTokens = /* @__PURE__ */ new Set();
 	_identityMap = new IdentityMap();
@@ -3092,15 +3093,15 @@ var Session = class {
 	/**
 	* True from the start of the flush until the last check before the
 	* commit ran or the run ended. A write registered in that window would
-	* be committed and harvested without its flush, so it is rejected, and
+	* be committed and collected without its flush, so it is rejected, and
 	* the first rejection also fails the attempt, even when the caller
 	* swallows it. After the window, a registration reports a closed unit of
 	* work: nothing can fail the attempt any more.
 	*/
 	_lateRegistrationsFailAttempt = false;
 	_registrationDuringFlush;
-	constructor(commitEnrollment) {
-		this.commitEnrollment = commitEnrollment;
+	constructor(commitRegistration) {
+		this.commitRegistration = commitRegistration;
 	}
 	get identityMap() {
 		this.assertOpen("tracking.identityMap");
@@ -3195,7 +3196,7 @@ var Session = class {
 			throw error;
 		}
 	}
-	/** Two live instances of one identity would each flush and harvest. */
+	/** Two live instances of one identity would each flush and collect. */
 	assertIdentityNotTaken(aggregate, definition) {
 		const tracked = this._identityMap.get(definition.aggregate, aggregate.id);
 		if (tracked === void 0 || tracked === aggregate) return;
@@ -3221,7 +3222,7 @@ var Session = class {
 		const loaded = this.loadedEntryFor(aggregate, "remove", definition);
 		this.registerWrite(loaded, "remove", definition);
 	}
-	/** Registers persistence intent and commit enrollment as one operation. */
+	/** Registers persistence intent and commit registration as one operation. */
 	registerWrite(entry, intent, definition) {
 		const newlyRegistered = this.registerIntent(entry, intent);
 		try {
@@ -3279,7 +3280,7 @@ var Session = class {
 		this._registeredWrites.push(entry);
 		return true;
 	}
-	/** Restores the pre-registration state when commit enrollment rejects. */
+	/** Restores the pre-registration state when commit registration rejects. */
 	rollbackIntentRegistration(entry) {
 		const index = this._registeredWrites.lastIndexOf(entry);
 		if (index >= 0) this._registeredWrites.splice(index, 1);
@@ -3289,7 +3290,7 @@ var Session = class {
 		const registration = entry.registration;
 		if (registration === void 0) return;
 		const currentEvents = entry.aggregate.pendingEvents;
-		const persistenceChanged = persistenceProjectionDrifted(registration.baseline, entry.aggregate);
+		const persistenceChanged = persistenceCaptureDrifted(registration.baseline, entry.aggregate);
 		const sameEvents = currentEvents.length === registration.events.length && currentEvents.every((event, index) => event === registration.events[index]);
 		if (registration.version !== entry.aggregate.version || !sameEvents || persistenceChanged) throw new AggregateTrackingError({
 			identity: entry.aggregate.aggregateIdentity,
@@ -3301,13 +3302,13 @@ var Session = class {
 	registerSavedCommit(aggregate, definition, expectedVersion) {
 		this.assertOpen("repository.add/update");
 		if (this.isRemovedInstance(aggregate) || this._identityMap.isDeleted(definition.aggregate, aggregate.id)) throw new AggregateDeletedError({ identity: aggregate.aggregateIdentity });
-		const token = this.commitEnrollment.enrollSaved(aggregate, { expectedVersion });
+		const token = this.commitRegistration.registerSaved(aggregate, { expectedVersion });
 		this._commitTokens.add(token);
 		return token;
 	}
 	registerRemovedCommit(aggregate, definition, expectedVersion) {
 		this.assertOpen("repository.remove");
-		const token = this.commitEnrollment.enrollDeleted(aggregate, { expectedVersion });
+		const token = this.commitRegistration.registerRemoved(aggregate, { expectedVersion });
 		this._identityMap.delete(definition.aggregate, aggregate.id);
 		this._commitTokens.add(token);
 		return token;
@@ -3326,7 +3327,7 @@ var Session = class {
 				this.assertUnchangedAfterRegistration(entry, "commit");
 				continue;
 			}
-			if (entry.lifecycle === "loaded" && (entry.aggregate.version !== entry.expectedVersion || persistenceProjectionDrifted(entry.baseline, entry.aggregate))) throw new UnenrolledChangesError({
+			if (entry.lifecycle === "loaded" && (entry.aggregate.version !== entry.expectedVersion || persistenceCaptureDrifted(entry.baseline, entry.aggregate))) throw new UnregisteredChangesError({
 				identity: entry.aggregate.aggregateIdentity,
 				appendOnly: entry.definition.appendOnly === true
 			});
@@ -3334,7 +3335,7 @@ var Session = class {
 		for (const instance of this._identityMap.instancesWithNewPendingEvents()) {
 			if (instance !== null && typeof instance === "object" && this.registrationOf(instance) !== void 0) continue;
 			const aggregate = instance;
-			throw new UnenrolledChangesError({
+			throw new UnregisteredChangesError({
 				identity: aggregate.aggregateIdentity,
 				appendOnly: this._trackingByAggregate.get(aggregate)?.definition.appendOnly === true
 			});
@@ -3524,7 +3525,7 @@ function defineRepository() {
 	const builder = (definition) => {
 		const branded = { ...definition };
 		assertRepositoryDefinitionMembers(branded);
-		stampCooperativeBrand(branded, repositoryDefinitionBrand);
+		applyCooperativeBrand(branded, repositoryDefinitionBrand);
 		return Object.freeze(branded);
 	};
 	return builder;
@@ -3535,7 +3536,7 @@ function defineRepository() {
 * transaction and either persist completely or not at all.
 *
 * Built ON TOP of `withCommit` - the commit orchestration (event
-* harvest into the outbox inside the transaction, internal acknowledgement
+* collection into the outbox inside the transaction, internal acknowledgement
 * after the commit, best-effort in-process publish last) is inherited,
 * not reimplemented. What this layer adds:
 *
@@ -3603,7 +3604,7 @@ var UnitOfWork = class {
 	* Execute one unit of work: open the transaction, hand the callback
 	* tx-bound repositories, commit on resolve, roll back on throw,
 	* run the post-commit lifecycle (acknowledge, observe, publish) for every
-	* enrolled aggregate. Returns the callback's result.
+	* registered aggregate. Returns the callback's result.
 	*/
 	async run(work, options) {
 		if (options?.signal?.aborted) throw abortReason(options.signal, "UnitOfWork.run aborted before opening a transaction");
@@ -3622,9 +3623,9 @@ var UnitOfWork = class {
 				onPersistError: this.deps.onPersistError,
 				postCommitTimeoutMs: this.deps.postCommitTimeoutMs,
 				signal: options?.signal
-			}, async (tx, enrollment) => {
+			}, async (tx, registration) => {
 				session?.close();
-				const s = new Session(enrollment);
+				const s = new Session(registration);
 				session = s;
 				sessions.push(s);
 				const current = startAttempt();
@@ -3712,7 +3713,7 @@ function startAttempt() {
 *   {@link RollbackError}.
 * - `workCompleted`: the callback finished; the failure is post-completion.
 *   The checks run in this order. First, a wiring error in the rejection (a
-*   harvest-guard violation, or an aggregate that changed after its
+*   collection-guard violation, or an aggregate that changed after its
 *   registration) is a deterministic programming bug and passes through; it
 *   does NOT extend `InfrastructureError`, so a retry-on-Infrastructure
 *   handler skips it. It is thrown inside `scope.transactional()`, so a
@@ -4097,7 +4098,7 @@ var Entity = class {
 	* `TState` publicly would expose the aggregate's live object graph and
 	* let nested mutation bypass behavior, validation, versioning, and
 	* dirty tracking. Concrete entities should expose business-meaningful queries or
-	* detached immutable DTOs (`deepFreeze(detachState(this.state))` for a
+	* immutable DTOs (`deepFreeze(copyPlainState(this.state))` for a
 	* plain-data state). Snapshot projection belongs to the persistence
 	* adapter, which captures the aggregate from outside through those
 	* queries and DTOs rather than asking the entity to create its own
@@ -4130,7 +4131,7 @@ var Entity = class {
 	* widens to the whole graph: NESTED objects are frozen in place too.
 	*
 	* @throws MissingEntityIdError when `id` is not a non-blank string.
-	* @throws HostileStateKeyError when a plain-object, null-prototype,
+	* @throws PrototypePollutionError when a plain-object, null-prototype,
 	* or array state carries an own `"__proto__"` data key; validate and
 	* strip untrusted input at the boundary.
 	*/
@@ -4154,7 +4155,7 @@ var Entity = class {
 	* ownership transfer and is frozen in place; see the constructor.
 	*
 	* @param newState - The new state
-	* @throws HostileStateKeyError when the state carries an own
+	* @throws PrototypePollutionError when the state carries an own
 	* `"__proto__"` data key; the previous state is kept.
 	*/
 	setState(newState) {
@@ -4215,15 +4216,15 @@ function freezeShallow(value) {
 * @internal Shared by the kit's own entity subclasses; not part of the
 * public API.
 */
-function assertStateHasNoHostileOwnKey(state, subject) {
+function assertStateHasNoOwnProtoKey(state, subject) {
 	if (state === null || typeof state !== "object") return;
 	if (Array.isArray(state)) {
-		assertNoHostileOwnProtoKey(state, subject);
+		assertNoOwnProtoKey(state, subject);
 		return;
 	}
 	const proto = Object.getPrototypeOf(state);
 	if (proto !== Object.prototype && proto !== null) return;
-	assertNoHostileOwnProtoKey(state, subject);
+	assertNoOwnProtoKey(state, subject);
 }
 /**
 * Returns a shallow copy for plain objects and arrays so the subsequent
@@ -4235,7 +4236,7 @@ function assertStateHasNoHostileOwnKey(state, subject) {
 */
 function shallowCopyOwned(value) {
 	if (value === null || typeof value !== "object") return value;
-	assertStateHasNoHostileOwnKey(value, "Entity state");
+	assertStateHasNoOwnProtoKey(value, "Entity state");
 	if (Array.isArray(value)) {
 		const copy = [...value];
 		for (const key of Reflect.ownKeys(value)) {
@@ -4344,7 +4345,7 @@ function removeEntityById(entities, id) {
 /**
 * Updates an entity with the given ID in the collection.
 * Returns a new array with the updated entity.
-* Structural sharing for adapter-owned persistence projections: returns
+* Structural sharing for adapter-owned persistence captures: returns
 * the ORIGINAL array when nothing changed (no match, or the element kept
 * its reference), so a partial-write adapter can skip the untouched
 * collection; a new array only when an
@@ -4383,7 +4384,7 @@ function updateEntityById(entities, id, updater) {
 /**
 * Replaces an entity with the given ID in the collection.
 * Returns a new array with the replaced entity.
-* Structural sharing for adapter-owned persistence projections: returns
+* Structural sharing for adapter-owned persistence captures: returns
 * the ORIGINAL array when nothing changed (no match, or the element kept
 * its reference), so a partial-write adapter can skip the untouched
 * collection; a new array only when an
@@ -4448,8 +4449,8 @@ function entityIds(entities) {
 * tracking, the kit-internal post-commit acknowledgement capability,
 * the `markReconstituted` post-load marker, and the `createEvent` helper
 * that auto-injects `aggregateId` + `aggregateType` on every event the
-* aggregate emits. The application shell records the pending decisions
-* with `recordPendingEvents` before persistence.
+* aggregate emits. The application shell stamps the pending decisions
+* with `stampPendingEvents` before persistence.
 *
 * Consumers do NOT extend this class directly; extend
 * `StateStoredAggregate` for state-stored aggregates or
@@ -4509,24 +4510,24 @@ var BaseAggregate = class extends Entity {
 		registerPendingEventRecordingCapability(this, { record: (createStamp) => this.recordPendingDecisions(createStamp) });
 	}
 	/**
-	* Stamps every uncommitted decision in the pending list with identity
-	* and time from `createStamp`, passes an already recorded event through,
+	* Stamps every unstamped decision in the pending list with identity
+	* and time from `createStamp`, passes an already stamped event through,
 	* and replaces the list atomically. Three guards run before the
-	* assignment: an event that no kit constructor minted is rejected
-	* ({@link UnmintedEventError}); a stamp provider that recorded a new
+	* assignment: an event that no kit constructor built is rejected
+	* ({@link HandBuiltEventError}); a stamp provider that recorded a new
 	* decision on this aggregate mid-map is rejected
 	* ({@link ReentrantEventRecordingError}); and two decisions that
 	* received one eventId are rejected ({@link DuplicateEventIdError}).
-	* When a guard fires, every decision stays unrecorded.
+	* When a guard fires, every decision stays unstamped.
 	*/
 	recordPendingDecisions(createStamp) {
 		const stamped = this._pendingEvents;
 		const stampedCount = stamped.length;
 		const recorded = stamped.map((event, index) => {
 			const candidate = event;
-			if (isRecordedDomainEvent(candidate)) return candidate;
-			if (!isUncommittedDomainEvent(candidate)) throw new UnmintedEventError(event.type);
-			return recordDomainEvent(candidate, createStamp(candidate, index));
+			if (isStampedDomainEvent(candidate)) return candidate;
+			if (!isUnstampedDomainEvent(candidate)) throw new HandBuiltEventError(event.type);
+			return stampDomainEvent(candidate, createStamp(candidate, index));
 		});
 		if (this._pendingEvents !== stamped || this._pendingEvents.length !== stampedCount) throw new ReentrantEventRecordingError({ identity: this.aggregateIdentity });
 		const seenEventIds = /* @__PURE__ */ new Set();
@@ -4549,7 +4550,7 @@ var BaseAggregate = class extends Entity {
 	/**
 	* Post-commit cleanup for the deleted disposition. The row is gone, so
 	* there is no persisted version to advance: stamping the marker from the
-	* live instance would make a later legitimate re-enrollment of this
+	* live instance would make a later legitimate re-registration of this
 	* instance trip the unique-cursor guard for a row that does not exist.
 	*/
 	discardPendingEventsAfterDeletion(events) {
@@ -4636,12 +4637,12 @@ var BaseAggregate = class extends Entity {
 		this._persistedVersion = restored;
 	}
 	/**
-	* Appends a domain event to the pending list. The event must be minted
+	* Appends a domain event to the pending list. The event must be kit-built
 	* by a kit constructor; a missing `aggregateId` or `aggregateType` is
 	* stamped from this aggregate, and an aggregate identity that names another
 	* aggregate throws {@link MisattributedEventError} before anything is
 	* recorded. Each append is one fact. A decision appended twice becomes
-	* two facts with distinct ids. A recorded event that is already pending
+	* two facts with distinct ids. A stamped event that is already pending
 	* throws {@link DuplicateEventIdError}, and a list at `maxPendingEvents`
 	* throws {@link PendingEventLimitExceededError}, before anything is
 	* recorded. Prefer the higher-level `StateStoredAggregate.setState()`
@@ -4654,23 +4655,23 @@ var BaseAggregate = class extends Entity {
 	* application shell rejects it; use `setState(currentState, event)`.
 	*/
 	addDomainEvent(event) {
-		const stamped = this.stampNewEventIdentity(event);
+		const stamped = this.attributeNewEvent(event);
 		this.assertEventIdsNotPending([stamped]);
 		this.assertPendingEventLimit(1);
 		this.appendStampedEvent(stamped);
 	}
 	/**
 	* One identity per fact, checked before the change becomes observable:
-	* a recorded event whose `eventId` is already pending, or appears twice
+	* a stamped event whose `eventId` is already pending, or appears twice
 	* in one batch, throws {@link DuplicateEventIdError}. A decision has no
 	* `eventId` yet, so a stamp provider that reuses one is caught at
 	* recording instead.
 	*/
 	assertEventIdsNotPending(batch) {
 		const pendingIds = /* @__PURE__ */ new Set();
-		for (const pending of this._pendingEvents) if (isRecordedDomainEvent(pending)) pendingIds.add(pending.eventId);
+		for (const pending of this._pendingEvents) if (isStampedDomainEvent(pending)) pendingIds.add(pending.eventId);
 		for (const event of batch) {
-			if (!isRecordedDomainEvent(event)) continue;
+			if (!isStampedDomainEvent(event)) continue;
 			if (pendingIds.has(event.eventId)) throw new DuplicateEventIdError({
 				identity: this.aggregateIdentity,
 				eventId: event.eventId
@@ -4698,7 +4699,7 @@ var BaseAggregate = class extends Entity {
 	}
 	/**
 	* Appends an event that the caller already passed through
-	* {@link stampNewEventIdentity}, {@link assertEventIdsNotPending} and
+	* {@link attributeNewEvent}, {@link assertEventIdsNotPending} and
 	* {@link assertPendingEventLimit}. `setState()` and `apply()` run the
 	* three before the state moves and append afterwards, so each gate
 	* runs once per event.
@@ -4719,15 +4720,15 @@ var BaseAggregate = class extends Entity {
 	* present-but-foreign `aggregateId` / `aggregateType` is a wiring bug and
 	* throws {@link MisattributedEventError}; missing fields are filled in
 	* from the aggregate, so a recorded event always carries its full
-	* aggregate identity and can never fail the harvest or the replay guard
-	* later. The mint gate
-	* runs first, so an unminted event fails before anything else. The
+	* aggregate identity and can never fail the collection or the replay guard
+	* later. The kit-built check
+	* runs first, so a hand-built event fails before anything else. The
 	* stamped copy is frozen like the original (payload and metadata are
 	* shared, already deep-frozen by the constructors); a fully stamped
 	* event is returned as is.
 	*/
-	stampNewEventIdentity(event) {
-		this.assertMintedEvent(event);
+	attributeNewEvent(event) {
+		this.assertKitBuiltEvent(event);
 		const { aggregateId, aggregateType } = event;
 		const idForeign = aggregateId !== void 0 && aggregateId !== this.id;
 		const typeForeign = aggregateType !== void 0 && aggregateType !== this.aggregateType;
@@ -4748,32 +4749,31 @@ var BaseAggregate = class extends Entity {
 			aggregateId: this.id,
 			aggregateType: this.aggregateType
 		};
-		return isRecordedDomainEvent(event) ? adoptRecordedDomainEvent(copy) : adoptUncommittedDomainEvent(copy);
+		return isStampedDomainEvent(event) ? adoptStampedDomainEvent(copy) : adoptUnstampedDomainEvent(copy);
 	}
 	/**
-	* Mint gate for every recording path: only an event that a kit
-	* constructor produced passes. The kit marks two shapes: a recorded
-	* event carries the recorded brand (`createDomainEvent`,
-	* `createDomainEventFromFacts`) and a decision carries the uncommitted
-	* brand (`createUncommittedDomainEvent`, the aggregate `createEvent`
-	* helper). Either brand implies deeply frozen with defensively copied
+	* Kit-built check for every recording path: only an event that a kit
+	* constructor produced passes. The kit marks two shapes: a stamped
+	* event carries the stamped brand (`createDomainEvent`,
+	* `createStampedDomainEvent`) and a decision carries the unstamped
+	* brand (the aggregate `createEvent` helper). Either brand implies deeply frozen with defensively copied
 	* payload and metadata, a guarantee no frozen-ness probe can establish
 	* (a shallow-frozen literal with mutable nested data would fool it).
 	* O(1): one brand check per shape.
 	*/
-	assertMintedEvent(event) {
-		if (!isRecordedDomainEvent(event) && !isUncommittedDomainEvent(event)) throw new UnmintedEventError(event.type);
+	assertKitBuiltEvent(event) {
+		if (!isStampedDomainEvent(event) && !isUnstampedDomainEvent(event)) throw new HandBuiltEventError(event.type);
 	}
 	/**
 	* Creates the immutable business fact accepted by this aggregate without
 	* reading a clock, generating an id, or attaching tracing metadata.
 	*
-	* The application shell records pending events after the domain operation
+	* The application shell stamps pending events after the domain operation
 	* and before persistence. Payload schema version stays here, next to the
-	* concrete event producer, rather than in shell-owned recording data.
+	* concrete event producer, rather than in shell-owned stamp data.
 	*/
 	createEvent(type, payload, options) {
-		return mintUncommittedDomainEvent(type, payload, {
+		return buildUnstampedDomainEvent(type, payload, {
 			...options,
 			aggregateId: this.id,
 			aggregateType: this.aggregateType
@@ -4785,7 +4785,7 @@ var BaseAggregate = class extends Entity {
 * `EventSourcedAggregate.replayHistory`: a target carrying unflushed
 * `pendingEvents` throws {@link UnreplayableAggregateError} BEFORE anything
 * moves. A restore advances the aggregate's current version, so unflushed
-* events recorded against the old version would later be harvested claiming
+* events recorded against the old version would later be collected claiming
 * a version baseline they were never part of. When the discard is
 * deliberate, discard this dirty instance and reconstitute a fresh aggregate
 * instead of mutating persistence lifecycle state publicly.
@@ -4793,8 +4793,8 @@ var BaseAggregate = class extends Entity {
 * Deliberately a module-level function, not a class method: it MUST not be
 * overridable by consumer subclasses (a no-op override would silently
 * disable the guard at every call site). The callers pass the count of
-* the private list; the commit harvest reads the public `pendingEvents`
-* getter, so a subclass that overrides the getter changes the harvest,
+* the private list; the commit collection reads the public `pendingEvents`
+* getter, so a subclass that overrides the getter changes the collection,
 * not this guard.
 *
 * @internal Shared by the aggregate flavours in this package; not part of
@@ -4926,12 +4926,12 @@ var EventSourcedAggregate = class extends BaseAggregate {
 	* @param event - The domain event to apply
 	*/
 	apply(event) {
-		const stamped = this.stampNewEventIdentity(event);
+		const stamped = this.attributeNewEvent(event);
 		this.assertEventIdsNotPending([stamped]);
 		this.assertPendingEventLimit(1);
 		this.validateEvent(stamped);
 		const next = freezeEntityState(this, this.fold(stamped));
-		assertStateHasNoHostileOwnKey(next, "Aggregate state");
+		assertStateHasNoOwnProtoKey(next, "Aggregate state");
 		assertStateInvariant(this, next);
 		this.bumpVersion();
 		storeTrustedState(this, next);
@@ -4959,7 +4959,7 @@ var EventSourcedAggregate = class extends BaseAggregate {
 	* stream corruption) after the all-or-nothing rollback. History
 	* events without the optional aggregate identity fields pass unchecked (the
 	* fields are optional on the event shape); NEW events are covered
-	* by the stricter `stampNewEventIdentity` on the apply path.
+	* by the stricter `attributeNewEvent` on the apply path.
 	*/
 	assertReplayedEventBelongsHere(event) {
 		const idMismatch = event.aggregateId !== void 0 && event.aggregateId !== this.id;
@@ -5020,7 +5020,7 @@ var EventSourcedAggregate = class extends BaseAggregate {
 				this.assertReplayedEventBelongsHere(event);
 				storeTrustedState(this, this.fold(event));
 			}
-			assertStateHasNoHostileOwnKey(this.state, "Aggregate state");
+			assertStateHasNoOwnProtoKey(this.state, "Aggregate state");
 			this.markReconstituted(startVersion + history.length);
 		} catch (e) {
 			storeTrustedState(this, previousState);
@@ -5057,20 +5057,20 @@ function reconstituteAggregateFromHistory(createReplayTarget, history) {
 * The aggregate owns identity, valid domain state, behavior, its current
 * domain version, and pending domain events. It deliberately does not own a
 * database baseline or dirty-key bookkeeping. A repository adapter defines
-* its own persistence projection; the application shell retains that opaque
+* its own persistence capture; the application shell retains that opaque
 * baseline and derives the adapter's change set at flush.
 */
 var StateStoredAggregate = class extends BaseAggregate {
 	/**
 	* Replaces the state, advances the OCC version, and records the events
-	* of the change, in that order. State validation, the event mint gate,
+	* of the change, in that order. State validation, the kit-built check,
 	* the aggregate identity check of the event, the pending event-id check,
 	* and the pending event limit check run before the change becomes
 	* observable, so a rejected decision records nothing and moves nothing.
 	* Without events the call is a plain versioned state change.
 	*/
 	setState(newState, events = []) {
-		const stamped = (Array.isArray(events) ? events : [events]).map((event) => this.stampNewEventIdentity(event));
+		const stamped = (Array.isArray(events) ? events : [events]).map((event) => this.attributeNewEvent(event));
 		this.assertEventIdsNotPending(stamped);
 		this.assertPendingEventLimit(stamped.length);
 		const next = this.nextVersion();
@@ -5229,684 +5229,16 @@ var NotSpecification = class extends Specification {
 };
 
 //#endregion
-//#region src/domain/state-machine/errors.ts
-/** No transition is defined for the input in the current state. */
-var InvalidDomainTransitionError = class extends DomainError {
-	state;
-	inputType;
-	constructor(state, inputType) {
-		super({
-			code: "INVALID_DOMAIN_TRANSITION",
-			message: `No domain transition from "${state}" on "${inputType}".`
-		});
-		this.state = state;
-		this.inputType = inputType;
-	}
-};
-/** A defined transition was rejected by its domain guard. */
-var DomainTransitionGuardRejectedError = class extends DomainError {
-	state;
-	inputType;
-	constructor(state, inputType) {
-		super({
-			code: "DOMAIN_TRANSITION_GUARD_REJECTED",
-			message: `Domain transition guard rejected "${inputType}" from "${state}".`
-		});
-		this.state = state;
-		this.inputType = inputType;
-	}
-};
-/** The machine definition violates its runtime contract. */
-var InvalidDomainMachineDefinitionError = class extends KitWiringError {
-	constructor(message, cause) {
-		super("INVALID_DOMAIN_MACHINE_DEFINITION", message, cause);
-	}
-};
-/** Context contains unsupported or unsafe runtime data. */
-var InvalidDomainMachineContextError = class extends KitWiringError {
-	constructor(message, cause) {
-		super("INVALID_DOMAIN_MACHINE_CONTEXT", message, cause);
-	}
-};
-/** A supplied or produced snapshot is malformed or violates invariants. */
-var InvalidDomainMachineSnapshotError = class extends KitWiringError {
-	constructor(message, cause) {
-		super("INVALID_DOMAIN_MACHINE_SNAPSHOT", message, cause);
-	}
-};
-/** An input is malformed or contains unsupported runtime data. */
-var InvalidDomainMachineInputError = class extends KitWiringError {
-	constructor(message, cause) {
-		super("INVALID_DOMAIN_MACHINE_INPUT", message, cause);
-	}
-};
-/** A guard returned a value other than `boolean` or `DomainError`. */
-var InvalidDomainTransitionGuardResultError = class extends KitWiringError {
-	constructor(message, cause) {
-		super("INVALID_DOMAIN_TRANSITION_GUARD_RESULT", message, cause);
-	}
-};
-/** A reducer returned a malformed result or unsupported output data. */
-var InvalidDomainTransitionResultError = class extends KitWiringError {
-	constructor(message, cause) {
-		super("INVALID_DOMAIN_TRANSITION_RESULT", message, cause);
-	}
-};
-/** A callback attempted to evaluate the same stateful machine recursively. */
-var ReentrantDomainStateMachineEvaluationError = class extends KitWiringError {
-	constructor() {
-		super("REENTRANT_DOMAIN_STATE_MACHINE_EVALUATION", "Domain state machine callbacks cannot evaluate the same machine.");
-	}
-};
-
-//#endregion
-//#region src/domain/state-machine/machine-data.ts
-const DOMAIN_MACHINE_DATA_MAX_DEPTH = 256;
-const DOMAIN_MACHINE_DATA_MAX_NODES = 1e4;
-const DOMAIN_MACHINE_DATA_MAX_PROPERTIES = 1e5;
-function copyDomainMachineOutputs(outputs) {
-	try {
-		const copiedOutputs = cloneDomainMachineDataValue(outputs ?? [], createDomainTransitionOutputError);
-		return deepFreeze(copiedOutputs);
-	} catch (cause) {
-		if (cause instanceof InvalidDomainTransitionResultError) throw cause;
-		throw new InvalidDomainTransitionResultError("Domain transition result outputs must contain cloneable, deeply immutable data.", cause);
-	}
-}
-function copyDomainMachineInput(input) {
-	try {
-		return deepFreeze(cloneDomainMachineDataValue(input, createDomainMachineInputError));
-	} catch (cause) {
-		if (cause instanceof InvalidDomainMachineInputError) throw cause;
-		throw new InvalidDomainMachineInputError("Domain machine input must contain cloneable, deeply immutable data.", cause);
-	}
-}
-function copyDomainMachineContext(context) {
-	try {
-		return deepFreeze(cloneDomainMachineDataValue(context, createDomainMachineContextError));
-	} catch (cause) {
-		if (cause instanceof InvalidDomainMachineContextError) throw cause;
-		throw new InvalidDomainMachineContextError("Domain machine context must contain cloneable, deeply immutable data.", cause);
-	}
-}
-function createDomainMachineContextError(message, cause) {
-	return new InvalidDomainMachineContextError(message, cause);
-}
-function createDomainMachineInputError(message, cause) {
-	return new InvalidDomainMachineInputError(message, cause);
-}
-function createDomainTransitionOutputError(message, cause) {
-	return new InvalidDomainTransitionResultError(message, cause);
-}
-function cloneDomainMachineDataValue(value, errorFactory, seen = /* @__PURE__ */ new WeakMap(), traversal = {
-	nodes: 0,
-	properties: 0
-}, depth = 0) {
-	if (typeof value === "function") throw errorFactory("Domain machine data cannot contain function values.");
-	if (value === null || typeof value !== "object") return value;
-	const source = value;
-	if (depth > DOMAIN_MACHINE_DATA_MAX_DEPTH) throw errorFactory(`Domain machine data exceeds the maximum depth of ${DOMAIN_MACHINE_DATA_MAX_DEPTH}.`);
-	const existing = seen.get(source);
-	if (existing !== void 0) return existing;
-	traversal.nodes += 1;
-	if (traversal.nodes > DOMAIN_MACHINE_DATA_MAX_NODES) throw errorFactory(`Domain machine data contains more than ${DOMAIN_MACHINE_DATA_MAX_NODES.toLocaleString("en-US")} object nodes.`);
-	const toStringTagDescriptor = findPropertyDescriptor(source, Symbol.toStringTag);
-	if (toStringTagDescriptor !== void 0 && !("value" in toStringTagDescriptor)) throw errorFactory("Domain machine data cannot contain accessor properties.");
-	if (Array.isArray(value)) {
-		if (!isIntrinsicArrayPrototype(Object.getPrototypeOf(value))) throw errorFactory("Domain machine data cannot contain custom Array instances.");
-		const cloned = new Array(value.length);
-		seen.set(source, cloned);
-		for (const key of readDomainMachineDataKeys(source, errorFactory, traversal)) {
-			const descriptor = Object.getOwnPropertyDescriptor(source, key);
-			if (!descriptor) continue;
-			if (!("value" in descriptor)) throw errorFactory("Domain machine data cannot contain accessor properties.");
-			if (key === "length") continue;
-			descriptor.value = cloneDomainMachineDataValue(descriptor.value, errorFactory, seen, traversal, depth + 1);
-			Object.defineProperty(cloned, key, descriptor);
-		}
-		return cloned;
-	}
-	const prototype = Object.getPrototypeOf(source);
-	if (prototype !== null && !isIntrinsicObjectPrototype(prototype)) throw errorFactory("Domain machine data cannot contain custom class instances.");
-	const tag = Object.prototype.toString.call(source);
-	if (isBuiltInObject(source, tag) || ArrayBuffer.isView(source)) throw errorFactory(`Domain machine data cannot contain ${tag.slice(8, -1)} object values.`);
-	const cloned = Object.create(prototype === null ? null : Object.prototype);
-	seen.set(source, cloned);
-	for (const key of readDomainMachineDataKeys(source, errorFactory, traversal)) {
-		const descriptor = Object.getOwnPropertyDescriptor(source, key);
-		if (!descriptor) continue;
-		if (!("value" in descriptor)) throw errorFactory("Domain machine data cannot contain accessor properties.");
-		descriptor.value = cloneDomainMachineDataValue(descriptor.value, errorFactory, seen, traversal, depth + 1);
-		Object.defineProperty(cloned, key, descriptor);
-	}
-	return cloned;
-}
-function readDomainMachineDataKeys(value, errorFactory, traversal) {
-	const keys = Reflect.ownKeys(value);
-	traversal.properties += keys.length;
-	if (traversal.properties > DOMAIN_MACHINE_DATA_MAX_PROPERTIES) throw errorFactory(`Domain machine data contains more than ${DOMAIN_MACHINE_DATA_MAX_PROPERTIES.toLocaleString("en-US")} own properties.`);
-	return keys;
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isPlainRecord(value) {
-	if (!isRecord(value)) return false;
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === null || isIntrinsicObjectPrototype(prototype);
-}
-function isIntrinsicArrayPrototype(prototype) {
-	if (prototype === null || !Array.isArray(prototype)) return false;
-	if (!isIntrinsicConstructorPrototype(prototype, "Array")) return false;
-	const parentPrototype = Object.getPrototypeOf(prototype);
-	return parentPrototype !== null && isIntrinsicObjectPrototype(parentPrototype);
-}
-function isIntrinsicObjectPrototype(prototype) {
-	return Object.getPrototypeOf(prototype) === null && isIntrinsicConstructorPrototype(prototype, "Object");
-}
-function hasOwn(value, key) {
-	return Object.hasOwn(value, key);
-}
-
-//#endregion
-//#region src/domain/state-machine/definition.ts
-const DOMAIN_MACHINE_DEFINITION_KEYS = /* @__PURE__ */ new Set([
-	"initial",
-	"initialContext",
-	"validateSnapshot",
-	"states"
-]);
-const DOMAIN_MACHINE_STATE_NODE_KEYS = /* @__PURE__ */ new Set([
-	"terminal",
-	"validateContext",
-	"on"
-]);
-const DOMAIN_MACHINE_TRANSITION_KEYS = /* @__PURE__ */ new Set([
-	"target",
-	"guard",
-	"reduce"
-]);
-function copyDomainMachineDefinition(definition) {
-	const states = readDomainMachineDefinitionProperty(definition, "states");
-	const copiedStates = Object.create(null);
-	for (const state of Object.keys(states)) {
-		const node = readDomainMachineDefinitionProperty(states, state);
-		const transitions = readOptionalDomainMachineDefinitionProperty(node, "on");
-		const copiedTransitions = Object.create(null);
-		for (const inputType of Object.keys(transitions ?? {})) {
-			const transition = readDomainMachineDefinitionProperty(transitions, inputType);
-			if (transition) {
-				const copiedTransition = Object.freeze({
-					target: readDomainMachineDefinitionProperty(transition, "target"),
-					guard: readOptionalDomainMachineDefinitionProperty(transition, "guard"),
-					reduce: readOptionalDomainMachineDefinitionProperty(transition, "reduce")
-				});
-				Object.defineProperty(copiedTransitions, inputType, {
-					value: copiedTransition,
-					enumerable: true
-				});
-			}
-		}
-		Object.defineProperty(copiedStates, state, {
-			value: Object.freeze({
-				terminal: readOptionalDomainMachineDefinitionProperty(node, "terminal"),
-				validateContext: readOptionalDomainMachineDefinitionProperty(node, "validateContext"),
-				on: Object.freeze(copiedTransitions)
-			}),
-			enumerable: true
-		});
-	}
-	return Object.freeze({
-		initial: readDomainMachineDefinitionProperty(definition, "initial"),
-		initialContext: readDomainMachineDefinitionProperty(definition, "initialContext"),
-		validateSnapshot: readOptionalDomainMachineDefinitionProperty(definition, "validateSnapshot"),
-		states: Object.freeze(copiedStates)
-	});
-}
-/**
-* Registry of definitions produced by `prepareDomainMachineDefinition`:
-* validated, defensively copied, deeply frozen. The runtime membership
-* proof lives in this module-private WeakSet (the stable copies are
-* frozen and must stay pure data, so no runtime brand property); the
-* compile-time proof is the required type brand on
-* {@link PreparedDomainMachineDefinition}. Only
-* `prepareDomainMachineDefinition` below adds to the set, so membership
-* always implies validated + copied + frozen.
-*/
-const preparedDefinitions = /* @__PURE__ */ new WeakSet();
-/**
-* The entry-point normalization every pure function and the
-* `DomainStateMachine` constructor share: a prepared definition passes
-* through untouched (already validated, copied, frozen); anything else
-* pays the documented per-call validate-and-copy.
-*/
-function ensureStableDomainMachineDefinition(definition) {
-	if (preparedDefinitions.has(definition)) return definition;
-	validateDomainMachineDefinition(definition);
-	const stable = copyDomainMachineDefinition(definition);
-	validateDomainMachineDefinition(stable);
-	return stable;
-}
-/**
-* Validates and stabilizes a machine definition ONCE, for repeated use
-* with the pure functions. Without it, `transitionDomainState` and
-* `canTransitionDomainState` re-validate and defensively re-copy the
-* WHOLE definition on every call (the documented safety of the raw
-* path); on a hot dispatch path that is avoidable O(definition) work.
-* The `DomainStateMachine` class does the equivalent once in its
-* constructor; this export brings the same amortization to pure-API
-* users:
-*
-* ```ts
-* const prepared = prepareDomainMachineDefinition(orderLifecycle);
-* // per dispatch: no re-validation, no definition copy
-* const outcome = transitionDomainState(prepared, snapshot, input);
-* ```
-*
-* The returned definition is a deeply frozen copy, isolated from later
-* mutation of the input object. Preparing an already-prepared
-* definition returns it unchanged.
-*/
-function prepareDomainMachineDefinition(definition) {
-	const stable = ensureStableDomainMachineDefinition(definition);
-	preparedDefinitions.add(stable);
-	return stable;
-}
-function getTransition(definition, state, input) {
-	const transitions = definition.states[state].on;
-	if (!transitions || !hasOwn(transitions, input.type)) return void 0;
-	return transitions[input.type];
-}
-function validateDomainMachineDefinition(definition) {
-	const candidate = definition;
-	if (!isPlainRecord(candidate)) throw new InvalidDomainMachineDefinitionError("Domain machine definition must be a plain object.");
-	assertDomainMachineDefinitionDataProperties(candidate, DOMAIN_MACHINE_DEFINITION_KEYS);
-	const initial = readDomainMachineDefinitionProperty(candidate, "initial");
-	if (typeof initial !== "string") throw new InvalidDomainMachineDefinitionError("Domain machine initial state must be a string data property.");
-	if (typeof readDomainMachineDefinitionProperty(candidate, "initialContext") !== "function") throw new InvalidDomainMachineDefinitionError("Domain machine initialContext must be a function data property.");
-	const validateSnapshot = readOptionalDomainMachineDefinitionProperty(candidate, "validateSnapshot");
-	if (validateSnapshot !== void 0 && typeof validateSnapshot !== "function") throw new InvalidDomainMachineDefinitionError("Domain machine validateSnapshot must be a function data property.");
-	const statesCandidate = readDomainMachineDefinitionProperty(candidate, "states");
-	if (!isPlainRecord(statesCandidate)) throw new InvalidDomainMachineDefinitionError("Domain machine states must be a plain object data property.");
-	const states = statesCandidate;
-	assertDomainMachineDefinitionEntryMap(states, "state");
-	if (!hasOwn(states, initial)) throw new InvalidDomainMachineDefinitionError(`Initial domain machine state "${initial}" is not defined.`);
-	for (const state of Object.keys(states)) {
-		const node = readDomainMachineDefinitionProperty(states, state);
-		if (!isPlainRecord(node)) throw new InvalidDomainMachineDefinitionError(`Domain machine state "${state}" must be a plain object data property.`);
-		assertDomainMachineDefinitionDataProperties(node, DOMAIN_MACHINE_STATE_NODE_KEYS);
-		const terminal = readOptionalDomainMachineDefinitionProperty(node, "terminal");
-		if (terminal !== void 0 && typeof terminal !== "boolean") throw new InvalidDomainMachineDefinitionError(`Domain machine state "${state}" terminal flag must be a boolean.`);
-		const validateContext = readOptionalDomainMachineDefinitionProperty(node, "validateContext");
-		if (validateContext !== void 0 && typeof validateContext !== "function") throw new InvalidDomainMachineDefinitionError(`Domain machine state "${state}" validateContext must be a function.`);
-		const transitions = readOptionalDomainMachineDefinitionProperty(node, "on");
-		if (transitions !== void 0 && !isPlainRecord(transitions)) throw new InvalidDomainMachineDefinitionError(`Domain machine state "${state}" transitions must be a plain object.`);
-		if (isPlainRecord(transitions)) assertDomainMachineDefinitionEntryMap(transitions, "input");
-		const inputTypes = Object.keys(transitions ?? {});
-		if (terminal === true && inputTypes.length > 0) throw new InvalidDomainMachineDefinitionError(`Terminal domain machine state "${state}" cannot declare transitions.`);
-		for (const inputType of inputTypes) {
-			const transition = readDomainMachineDefinitionProperty(transitions, inputType);
-			if (!isPlainRecord(transition)) throw new InvalidDomainMachineDefinitionError(`Domain transition from "${state}" on "${inputType}" must be a plain object.`);
-			assertDomainMachineDefinitionDataProperties(transition, DOMAIN_MACHINE_TRANSITION_KEYS);
-			const target = readDomainMachineDefinitionProperty(transition, "target");
-			if (typeof target !== "string") throw new InvalidDomainMachineDefinitionError(`Domain transition from "${state}" on "${inputType}" must target a string state.`);
-			if (!hasOwn(states, target)) throw new InvalidDomainMachineDefinitionError(`Domain transition from "${state}" on "${inputType}" targets unknown state "${target}".`);
-			const guard = readOptionalDomainMachineDefinitionProperty(transition, "guard");
-			if (guard !== void 0 && typeof guard !== "function") throw new InvalidDomainMachineDefinitionError(`Domain transition from "${state}" on "${inputType}" guard must be a function.`);
-			const reduce = readOptionalDomainMachineDefinitionProperty(transition, "reduce");
-			if (reduce !== void 0 && typeof reduce !== "function") throw new InvalidDomainMachineDefinitionError(`Domain transition from "${state}" on "${inputType}" reduce must be a function.`);
-		}
-	}
-}
-function assertDomainMachineDefinitionDataProperties(value, allowedKeys) {
-	for (const key of Reflect.ownKeys(value)) {
-		const descriptor = Object.getOwnPropertyDescriptor(value, key);
-		if (descriptor !== void 0 && !("value" in descriptor)) throw new InvalidDomainMachineDefinitionError("Domain machine definition must contain data properties only.");
-		if (allowedKeys !== void 0 && !allowedKeys.has(key)) throw new InvalidDomainMachineDefinitionError(`Domain machine definition contains unknown property "${String(key)}".`);
-	}
-}
-function assertDomainMachineDefinitionEntryMap(value, entryName) {
-	assertDomainMachineDefinitionDataProperties(value);
-	for (const key of Reflect.ownKeys(value)) {
-		const descriptor = Object.getOwnPropertyDescriptor(value, key);
-		if (typeof key !== "string" || descriptor?.enumerable !== true) throw new InvalidDomainMachineDefinitionError(`Domain machine ${entryName} names must be enumerable string properties.`);
-	}
-}
-function readDomainMachineDefinitionProperty(value, key) {
-	const descriptor = Object.getOwnPropertyDescriptor(value, key);
-	if (descriptor === void 0 || !("value" in descriptor)) throw new InvalidDomainMachineDefinitionError("Domain machine definition must contain data properties only.");
-	return descriptor.value;
-}
-function readOptionalDomainMachineDefinitionProperty(value, key) {
-	const descriptor = Object.getOwnPropertyDescriptor(value, key);
-	if (descriptor === void 0) return void 0;
-	if (!("value" in descriptor)) throw new InvalidDomainMachineDefinitionError("Domain machine definition must contain data properties only.");
-	return descriptor.value;
-}
-
-//#endregion
-//#region src/domain/state-machine/snapshot.ts
-const DOMAIN_TRANSITION_RESULT_KEYS = /* @__PURE__ */ new Set(["context", "outputs"]);
-function prepareDomainMachineSnapshot(definition, snapshot) {
-	validateDomainMachineSnapshot(definition, snapshot);
-	const preparedSnapshot = createDomainMachineSnapshot(snapshot);
-	validateDomainMachineSnapshot(definition, preparedSnapshot);
-	validateDomainMachineSnapshotInvariant(definition, preparedSnapshot);
-	return preparedSnapshot;
-}
-function createDomainMachineSnapshotFromPreparedContext(state, context) {
-	return Object.freeze({
-		state,
-		context
-	});
-}
-function createDomainMachineSnapshot(snapshot) {
-	return Object.freeze({
-		state: readDomainMachineSnapshotState(snapshot),
-		context: copyDomainMachineContext(readDomainMachineSnapshotContext(snapshot))
-	});
-}
-function validateDomainMachineSnapshot(definition, snapshot) {
-	if (!isRecord(snapshot)) throw new InvalidDomainMachineSnapshotError("Domain machine snapshot must be an object.");
-	const state = readDomainMachineSnapshotState(snapshot);
-	readDomainMachineSnapshotContext(snapshot);
-	if (!hasOwn(definition.states, state)) throw new InvalidDomainMachineSnapshotError(`Domain machine snapshot state "${state}" is not defined.`);
-}
-function validateDomainMachineSnapshotInvariant(definition, snapshot) {
-	const stateNode = definition.states[snapshot.state];
-	if (stateNode.validateContext !== void 0) {
-		const validContext = stateNode.validateContext({
-			state: snapshot.state,
-			context: snapshot.context
-		});
-		if (typeof validContext !== "boolean") throw new InvalidDomainMachineDefinitionError(`Domain machine state "${snapshot.state}" validateContext must return a boolean.`);
-		if (!validContext) throw new InvalidDomainMachineSnapshotError(`Domain machine snapshot violates the context invariant for state "${snapshot.state}".`);
-	}
-	if (definition.validateSnapshot === void 0) return;
-	const valid = definition.validateSnapshot(snapshot);
-	if (typeof valid !== "boolean") throw new InvalidDomainMachineDefinitionError("Domain machine validateSnapshot must return a boolean.");
-	if (!valid) throw new InvalidDomainMachineSnapshotError(`Domain machine snapshot violates invariants for state "${snapshot.state}".`);
-}
-function readDomainMachineSnapshotState(snapshot) {
-	const stateDescriptor = Object.getOwnPropertyDescriptor(snapshot, "state");
-	if (stateDescriptor === void 0 || !("value" in stateDescriptor) || typeof stateDescriptor.value !== "string") throw new InvalidDomainMachineSnapshotError("Domain machine snapshot state must be a string data property.");
-	return stateDescriptor.value;
-}
-function readDomainMachineSnapshotContext(snapshot) {
-	const contextDescriptor = Object.getOwnPropertyDescriptor(snapshot, "context");
-	if (contextDescriptor === void 0 || !("value" in contextDescriptor)) throw new InvalidDomainMachineSnapshotError("Domain machine snapshot context must be present as a data property.");
-	return contextDescriptor.value;
-}
-function validateDomainMachineInput(input) {
-	if (!isDomainMachineInput(input)) throw new InvalidDomainMachineInputError("Domain machine input must be an object with a string type.");
-}
-function isDomainMachineInput(input) {
-	if (!isRecord(input)) return false;
-	const typeDescriptor = Object.getOwnPropertyDescriptor(input, "type");
-	return typeDescriptor !== void 0 && "value" in typeDescriptor && typeof typeDescriptor.value === "string";
-}
-function resolveDomainTransitionGuardResult(result) {
-	if (typeof result === "boolean") return { allowed: result };
-	if (result instanceof DomainError) return {
-		allowed: false,
-		rejection: result
-	};
-	throw new InvalidDomainTransitionGuardResultError("Domain transition guard must return a boolean or DomainError.");
-}
-function validateDomainTransitionResult(result) {
-	if (result === void 0) return;
-	if (!isPlainRecord(result)) throw new InvalidDomainTransitionResultError("Domain transition result must be a plain object when returned.");
-	for (const key of Reflect.ownKeys(result)) {
-		if (!DOMAIN_TRANSITION_RESULT_KEYS.has(key)) throw new InvalidDomainTransitionResultError(`Domain transition result contains unknown property "${String(key)}".`);
-		const descriptor = Object.getOwnPropertyDescriptor(result, key);
-		if (descriptor !== void 0 && !("value" in descriptor)) throw new InvalidDomainTransitionResultError("Domain transition result must contain data properties only.");
-	}
-	const outputs = readDomainTransitionResultOutputs(result);
-	if (outputs !== void 0 && !Array.isArray(outputs)) throw new InvalidDomainTransitionResultError("Domain transition result outputs must be an array when provided.");
-}
-function readDomainTransitionResultContext(result) {
-	if (result === void 0) return { hasContext: false };
-	const contextDescriptor = Object.getOwnPropertyDescriptor(result, "context");
-	if (contextDescriptor === void 0) return { hasContext: false };
-	if (!("value" in contextDescriptor)) throw new InvalidDomainTransitionResultError("Domain transition result context must be a data property when provided.");
-	return {
-		hasContext: true,
-		context: contextDescriptor.value
-	};
-}
-function readDomainTransitionResultOutputs(result) {
-	if (result === void 0) return void 0;
-	const outputsDescriptor = Object.getOwnPropertyDescriptor(result, "outputs");
-	if (outputsDescriptor === void 0) return void 0;
-	if (!("value" in outputsDescriptor)) throw new InvalidDomainTransitionResultError("Domain transition result outputs must be a data property when provided.");
-	return outputsDescriptor.value;
-}
-
-//#endregion
-//#region src/domain/state-machine/transition.ts
-/** Creates and validates a fresh initial snapshot from a machine definition. */
-function createInitialDomainMachineSnapshot(definition) {
-	return createInitialDomainMachineSnapshotFromPrepared(ensureStableDomainMachineDefinition(definition));
-}
-function createInitialDomainMachineSnapshotFromPrepared(definition) {
-	const snapshot = createDomainMachineSnapshot({
-		state: definition.initial,
-		context: definition.initialContext()
-	});
-	validateDomainMachineSnapshotInvariant(definition, snapshot);
-	return snapshot;
-}
-/**
-* Checks whether an input currently has an allowed transition.
-*
-* Returns `false` for missing transitions, terminal states, rejected guards,
-* and inputs without an own string `type` property. Invalid payload data for a
-* matching transition and broken guard code still throw structured errors.
-*/
-function canTransitionDomainState(definition, snapshot, input) {
-	const stableDefinition = ensureStableDomainMachineDefinition(definition);
-	return canTransitionPreparedDomainState(stableDefinition, prepareDomainMachineSnapshot(stableDefinition, snapshot), input);
-}
-function canTransitionPreparedDomainState(definition, snapshot, input) {
-	if (!isDomainMachineInput(input)) return false;
-	if (definition.states[snapshot.state].terminal === true) return false;
-	const transition = getTransition(definition, snapshot.state, input);
-	if (!transition) return false;
-	const currentInput = copyDomainMachineInput(input);
-	if (!transition.guard) return true;
-	const guardResult = transition.guard({
-		state: snapshot.state,
-		context: snapshot.context,
-		input: currentInput
-	});
-	return resolveDomainTransitionGuardResult(guardResult).allowed;
-}
-/**
-* Applies one input without mutating the input definition or snapshot.
-*
-* @throws {@link InvalidDomainTransitionError} when no transition is defined.
-* @throws {@link DomainTransitionGuardRejectedError} when its guard rejects.
-* @throws A concrete `DomainError` returned by a rejecting guard.
-*/
-function transitionDomainState(definition, snapshot, input) {
-	const stableDefinition = ensureStableDomainMachineDefinition(definition);
-	return transitionPreparedDomainState(stableDefinition, prepareDomainMachineSnapshot(stableDefinition, snapshot), input);
-}
-function transitionPreparedDomainState(definition, snapshot, input) {
-	validateDomainMachineInput(input);
-	const from = snapshot.state;
-	const transition = definition.states[from].terminal === true ? void 0 : getTransition(definition, from, input);
-	if (!transition) throw new InvalidDomainTransitionError(from, input.type);
-	const currentInput = copyDomainMachineInput(input);
-	const guardResult = transition.guard === void 0 ? true : transition.guard({
-		state: from,
-		context: snapshot.context,
-		input: currentInput
-	});
-	const guardDecision = resolveDomainTransitionGuardResult(guardResult);
-	if (!guardDecision.allowed) {
-		if (guardDecision.rejection !== void 0) throw guardDecision.rejection;
-		throw new DomainTransitionGuardRejectedError(from, currentInput.type);
-	}
-	const result = transition.reduce?.({
-		state: from,
-		context: snapshot.context,
-		input: currentInput
-	});
-	validateDomainTransitionResult(result);
-	const contextResult = readDomainTransitionResultContext(result);
-	const nextContext = contextResult.hasContext ? contextResult.context : snapshot.context;
-	const nextSnapshot = nextContext === snapshot.context ? createDomainMachineSnapshotFromPreparedContext(transition.target, snapshot.context) : createDomainMachineSnapshot({
-		state: transition.target,
-		context: nextContext
-	});
-	validateDomainMachineSnapshotInvariant(definition, nextSnapshot);
-	return Object.freeze({
-		from,
-		to: transition.target,
-		snapshot: nextSnapshot,
-		outputs: copyDomainMachineOutputs(readDomainTransitionResultOutputs(result))
-	});
-}
-
-//#endregion
-//#region src/domain/state-machine/analyzer.ts
-/**
-* Inspects the declarative transition graph without executing definition callbacks.
-* Guarded edges are treated as possible edges, so diagnostics never claim more
-* runtime reachability than the static graph can prove.
-*/
-function analyzeDomainMachineDefinition(definition) {
-	const stableDefinition = ensureStableDomainMachineDefinition(definition);
-	const states = Object.keys(stableDefinition.states).sort(compareStrings);
-	const outgoing = /* @__PURE__ */ new Map();
-	const incoming = /* @__PURE__ */ new Map();
-	const transitions = [];
-	for (const state of states) {
-		outgoing.set(state, []);
-		incoming.set(state, []);
-	}
-	for (const state of states) {
-		const stateTransitions = stableDefinition.states[state].on;
-		const inputTypes = Object.keys(stateTransitions ?? {}).sort(compareStrings);
-		for (const inputType of inputTypes) {
-			const transition = stateTransitions?.[inputType];
-			if (transition === void 0) continue;
-			outgoing.get(state)?.push(transition.target);
-			incoming.get(transition.target)?.push(state);
-			transitions.push(Object.freeze({
-				state,
-				inputType,
-				target: transition.target,
-				guarded: transition.guard !== void 0
-			}));
-		}
-	}
-	const structurallyReachable = visitGraph([stableDefinition.initial], outgoing);
-	const statesWithTerminalPath = visitGraph(states.filter((state) => stableDefinition.states[state].terminal === true), incoming);
-	const diagnostics = [];
-	for (const state of states) if (!structurallyReachable.has(state)) diagnostics.push(Object.freeze({
-		code: "unreachable-state",
-		state
-	}));
-	for (const state of states) if (stableDefinition.states[state].terminal !== true && outgoing.get(state)?.length === 0) diagnostics.push(Object.freeze({
-		code: "structural-dead-end",
-		state
-	}));
-	for (const state of states) if (!statesWithTerminalPath.has(state)) diagnostics.push(Object.freeze({
-		code: "no-terminal-path",
-		state
-	}));
-	return Object.freeze({
-		diagnostics: Object.freeze(diagnostics),
-		transitions: Object.freeze(transitions),
-		structurallyReachableStates: Object.freeze(states.filter((state) => structurallyReachable.has(state))),
-		statesWithTerminalPath: Object.freeze(states.filter((state) => statesWithTerminalPath.has(state)))
-	});
-}
-function visitGraph(startStates, edges) {
-	const visited = /* @__PURE__ */ new Set();
-	const pending = [...startStates];
-	while (pending.length > 0) {
-		const state = pending.pop();
-		if (state === void 0 || visited.has(state)) continue;
-		visited.add(state);
-		for (const next of edges.get(state) ?? []) if (!visited.has(next)) pending.push(next);
-	}
-	return visited;
-}
-function compareStrings(left, right) {
-	return left < right ? -1 : left > right ? 1 : 0;
-}
-
-//#endregion
-//#region src/domain/state-machine/domain-state-machine.ts
-/**
-* Stateful convenience wrapper around the pure domain transition functions.
-*
-* Persist {@link snapshot}, not the machine instance. Pass a restored snapshot
-* to the second constructor overload to validate and reconstitute a machine.
-*/
-var DomainStateMachine = class {
-	definition;
-	#snapshot;
-	#evaluating = false;
-	constructor(definition, ...snapshotInput) {
-		this.definition = ensureStableDomainMachineDefinition(definition);
-		const [suppliedSnapshot] = snapshotInput;
-		if (suppliedSnapshot !== void 0) this.#snapshot = prepareDomainMachineSnapshot(this.definition, suppliedSnapshot);
-		else this.#snapshot = createInitialDomainMachineSnapshotFromPrepared(this.definition);
-	}
-	/** Returns a defensive, deeply frozen copy of the current snapshot. */
-	get snapshot() {
-		return createDomainMachineSnapshot(this.#snapshot);
-	}
-	/** Current named control state. */
-	get state() {
-		return this.#snapshot.state;
-	}
-	/** Current deeply readonly context. */
-	get context() {
-		return this.#snapshot.context;
-	}
-	/** Whether the current state permanently forbids outgoing transitions. */
-	isTerminal() {
-		return this.definition.states[this.state].terminal === true;
-	}
-	/** Checks a transition without changing the current snapshot. */
-	can(input) {
-		return this.evaluate(() => canTransitionPreparedDomainState(this.definition, this.#snapshot, input));
-	}
-	/** Applies an input and advances the current snapshot on success. */
-	dispatch(input) {
-		return this.evaluate(() => {
-			const result = transitionPreparedDomainState(this.definition, this.#snapshot, input);
-			this.#snapshot = result.snapshot;
-			return result;
-		});
-	}
-	evaluate(operation) {
-		if (this.#evaluating) throw new ReentrantDomainStateMachineEvaluationError();
-		this.#evaluating = true;
-		try {
-			return operation();
-		} finally {
-			this.#evaluating = false;
-		}
-	}
-};
-
-//#endregion
-//#region src/domain/value-object/vo-validated.ts
+//#region src/domain/value-object/value-object-or-issues.ts
 /**
 * Builds an immutable value object while collecting **all** validation
 * violations into a single {@link ValidationError}, instead of failing on the
 * first one. This is the Result-first, multi-error counterpart to
-* `voWithValidation` (which returns a single string message).
+* `valueObjectOrError` (which returns a single string message).
 *
 * The `validate` callback receives a fresh `ValidationError` to push field
 * issues onto (via `addIssue` / `addIssues`) and the raw input. When no issue
-* was recorded the input is frozen into a `VO<T>` and returned as `Ok`;
+* was recorded the input is frozen into a `ValueObjectOf<T>` and returned as `Ok`;
 * otherwise the populated `ValidationError` is returned as `Err`.
 *
 * `ValidationError` comes from `@shirudo/base-error`; import it from there to
@@ -5916,7 +5248,7 @@ var DomainStateMachine = class {
 *
 * @example
 * ```ts
-* const result = voValidated(
+* const result = valueObjectOrIssues(
 *   { email, age },
 *   (issues, m) => {
 *     if (!isEmail(m.email))
@@ -5929,10 +5261,10 @@ var DomainStateMachine = class {
 * // result.isErr() → result.error.publicIssues() has both violations
 * ```
 */
-function voValidated(t, validate, message = "Validation failed") {
+function valueObjectOrIssues(t, validate, message = "Validation failed") {
 	const issues = new ValidationError(message);
 	validate(issues, t);
-	return issues.hasIssues() ? err(issues) : ok(vo(t));
+	return issues.hasIssues() ? err(issues) : ok(valueObject(t));
 }
 
 //#endregion
@@ -6041,7 +5373,7 @@ var PublishChainTracker = class {
 	stateBySignal = /* @__PURE__ */ new WeakMap();
 	syncWindowState;
 	constructor(store) {
-		if (store !== void 0 && (typeof store.run !== "function" || typeof store.getStore !== "function")) throw new TypeError("EventBusImpl.chainStore must provide run and getStore");
+		if (store !== void 0 && (typeof store.run !== "function" || typeof store.getStore !== "function")) throw new TypeError("InProcessEventBus.chainStore must provide run and getStore");
 		this.store = store;
 	}
 	/** Depth, path and enclosing state that a publication on `signal` inherits. */
@@ -6152,7 +5484,7 @@ function toHandlerError(reason) {
 /** Bound for one publish chain. Real nesting stays far below this. */
 const DEFAULT_MAX_PUBLISH_DEPTH = 32;
 /** Marks the catch-all subscriptions in the reported-once set. */
-const CATCH_ALL = Symbol("EventBusImpl.subscribeAll");
+const CATCH_ALL = Symbol("InProcessEventBus.subscribeAll");
 /**
 * Subscriptions for one event type above which the bus reports a leak. A
 * fan-out of projections stays far below this.
@@ -6166,7 +5498,7 @@ const DEFAULT_MAX_SUBSCRIPTIONS_PER_EVENT_TYPE = 32;
 *
 * @example
 * ```typescript
-* const bus = new EventBusImpl<OrderEvent>();
+* const bus = new InProcessEventBus<OrderEvent>();
 *
 * bus.subscribe("OrderCreated", async (event) => {
 *   await sendEmail(event.payload.customerId);
@@ -6226,7 +5558,7 @@ const DEFAULT_MAX_SUBSCRIPTIONS_PER_EVENT_TYPE = 32;
 * the signal.
 *
 */
-var EventBusImpl = class {
+var InProcessEventBus = class {
 	handlers = /* @__PURE__ */ new Map();
 	catchAllHandlers = [];
 	maxPublishDepth;
@@ -6237,12 +5569,12 @@ var EventBusImpl = class {
 	observers;
 	reportedAt = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
-		if (options.maxPublishDepth !== void 0) assertPositiveInteger("EventBusImpl", "maxPublishDepth", options.maxPublishDepth);
-		if (options.maxSubscriptionsPerEventType !== void 0) assertPositiveInteger("EventBusImpl", "maxSubscriptionsPerEventType", options.maxSubscriptionsPerEventType);
+		if (options.maxPublishDepth !== void 0) assertPositiveInteger("InProcessEventBus", "maxPublishDepth", options.maxPublishDepth);
+		if (options.maxSubscriptionsPerEventType !== void 0) assertPositiveInteger("InProcessEventBus", "maxSubscriptionsPerEventType", options.maxSubscriptionsPerEventType);
 		this.chain = new PublishChainTracker(options.chainStore);
 		this.maxPublishDepth = options.maxPublishDepth ?? DEFAULT_MAX_PUBLISH_DEPTH;
 		this.maxSubscriptionsPerEventType = options.maxSubscriptionsPerEventType ?? DEFAULT_MAX_SUBSCRIPTIONS_PER_EVENT_TYPE;
-		this.observers = options.observers === void 0 ? void 0 : captureObserverFunctions("EventBusImpl", options.observers, [
+		this.observers = options.observers === void 0 ? void 0 : captureObserverFunctions("InProcessEventBus", options.observers, [
 			"onSubscriptionThresholdExceeded",
 			"onHandlerError",
 			"onPublishAborted"
@@ -6515,7 +5847,7 @@ function decodeIntegrationMessage(serialized) {
 	}
 }
 /**
-* Composes a validated public message into a minted local projector input.
+* Composes a validated public message into a kit-built local projector input.
 * Relationship headers become local event metadata. The public JSON schema is
 * retained; producer-private domain types are not reconstructed.
 */
@@ -6668,9 +6000,9 @@ function outboxWriterAcceptingEventLoss() {
 * another aggregate version. Without an `InMemoryTransactionScope`, it keeps
 * the first add of a rolled-back attempt. Dead-lettered and acknowledged
 * retries must match the complete original candidate receipt. Reusing an `eventId` for another source or commit position
-* throws {@link EventHarvestError} while the pending, dead-letter, or bounded
+* throws {@link EventCollectionError} while the pending, dead-letter, or bounded
 * dispatched receipt still proves the collision. `add` also throws
-* {@link EventHarvestError} for a malformed candidate: a part that is not an
+* {@link EventCollectionError} for a malformed candidate: a part that is not an
 * object, an `eventId` or `type` that is not an own string data property, a
 * source field that is not a string, or a position that is not a valid
 * commit position. Insertion order is preserved:
@@ -6685,7 +6017,7 @@ function outboxWriterAcceptingEventLoss() {
 * To link future eventful commits, the implementation also retains one
 * source cursor per qualified aggregate after dispatch. `endEventSources`
 * marks the cursor of a removed aggregate as ended, and a new event of that
-* source then throws {@link EventHarvestError}. Consequently a
+* source then throws {@link EventCollectionError}. Consequently a
 * long-lived instance is bounded only when `maxRecords` and `maxSources` are
 * configured, plus `maxRetainedDispatchedEventIds`; use a durable adapter with
 * an explicit source-head lifecycle and an event-id unique key for unbounded
@@ -6717,10 +6049,10 @@ function outboxWriterAcceptingEventLoss() {
 *
 * @example
 * ```ts
-* import { InMemoryOutbox, EventBusImpl } from "@shirudo/ddd-kit";
+* import { InMemoryOutbox, InProcessEventBus } from "@shirudo/ddd-kit";
 *
 * const outbox = new InMemoryOutbox<OrderEvent>();
-* const bus = new EventBusImpl<OrderEvent>();
+* const bus = new InProcessEventBus<OrderEvent>();
 *
 * const uow = makeOrderUnitOfWork({ outbox, bus });
 * await uow.run(async ({ repositories }) => {
@@ -7022,7 +6354,7 @@ var InMemoryOutbox = class {
 		if (this.pending.has(event.eventId) || this.dead.has(event.eventId) || this.dispatchedEventIds.has(event.eventId)) return;
 		const cursor = this.sourceCursors.get(sourceKey);
 		if (cursor !== void 0 && (position.aggregateVersion < cursor.aggregateVersion || position.aggregateVersion === cursor.aggregateVersion && cursor.eventIdsBySequence.has(position.commitSequence))) return;
-		throw new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${describeAggregateIdentity(source)}: the aggregate was removed, so its event source ended. The kit does not support an aggregate that is created again under a removed identity. Give the new aggregate a new id.`, event.type);
+		throw new EventCollectionError(`InMemoryOutbox rejected event "${event.eventId}" for ${describeAggregateIdentity(source)}: the aggregate was removed, so its event source ended. The kit does not support an aggregate that is created again under a removed identity. Give the new aggregate a new id.`, event.type);
 	}
 	/**
 	* Event ids of the batch that the source head names at their position
@@ -7091,7 +6423,7 @@ function assertSameCandidateReceipt(event, received, recorded) {
 }
 /**
 * The lenient variant for PENDING records only: an outbox without an
-* `InMemoryTransactionScope` cannot observe a rollback, so a re-harvested
+* `InMemoryTransactionScope` cannot observe a rollback, so a re-collected
 * event may legitimately arrive at a new aggregateVersion. Index and commit
 * cardinality stay immutable.
 */
@@ -7100,7 +6432,7 @@ function assertSameCandidateReceiptAllowingVersionRefresh(event, received, recor
 }
 function assertReceiptShape(event, received, recorded, allowAggregateVersionRefresh) {
 	if ((allowAggregateVersionRefresh || received.aggregateVersion === recorded.aggregateVersion) && received.commitSequence === recorded.commitSequence && received.commitSize === recorded.commitSize) return;
-	throw new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}": its commit candidate changed from (${recorded.aggregateVersion}, ${recorded.commitSequence}; commitSize=${recorded.commitSize}) to (${received.aggregateVersion}, ${received.commitSequence}; commitSize=${received.commitSize}). An exact redelivery must keep its source position immutable.`, event.type);
+	throw new EventCollectionError(`InMemoryOutbox rejected event "${event.eventId}": its commit candidate changed from (${recorded.aggregateVersion}, ${recorded.commitSequence}; commitSize=${recorded.commitSize}) to (${received.aggregateVersion}, ${received.commitSequence}; commitSize=${received.commitSize}). An exact redelivery must keep its source position immutable.`, event.type);
 }
 /**
 * The fields of a candidate that the outbox reads, read once and checked.
@@ -7112,7 +6444,7 @@ function assertReceiptShape(event, received, recorded, allowAggregateVersionRefr
 function ownCandidate(candidate, index) {
 	let subject = `the candidate at index ${index}`;
 	let eventType;
-	const rejection = (field, expected, observed) => new EventHarvestError(`InMemoryOutbox rejected ${subject}: ${field} must be ${expected}, but it is ${observed}. Pass the candidates that withCommit builds.`, eventType);
+	const rejection = (field, expected, observed) => new EventCollectionError(`InMemoryOutbox rejected ${subject}: ${field} must be ${expected}, but it is ${observed}. Pass the candidates that withCommit builds.`, eventType);
 	if (typeof candidate !== "object" || candidate === null) throw rejection("the candidate", "an object", describeRejected(candidate));
 	const { event, source, position } = candidate;
 	if (typeof event !== "object" || event === null) throw rejection("event", "an object", describeRejected(event));
@@ -7162,17 +6494,17 @@ function refill(map, entries) {
 	for (const [key, value] of entries) map.set(key, value);
 }
 function commitSizeMismatchError(event, source, position, recordedCommitSize) {
-	return new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${describeAggregateIdentity(source)}: aggregate version ${position.aggregateVersion} was already recorded with commitSize ${recordedCommitSize}, not ${position.commitSize}. An aggregate that was removed and created again under the same identity causes this too; the kit does not support that, so give the new aggregate a new id.`, event.type);
+	return new EventCollectionError(`InMemoryOutbox rejected event "${event.eventId}" for ${describeAggregateIdentity(source)}: aggregate version ${position.aggregateVersion} was already recorded with commitSize ${recordedCommitSize}, not ${position.commitSize}. An aggregate that was removed and created again under the same identity causes this too; the kit does not support that, so give the new aggregate a new id.`, event.type);
 }
 function positionOwnedError(event, source, position, positionOwner) {
-	return new EventHarvestError(`InMemoryOutbox rejected event "${event.eventId}" for ${describeAggregateIdentity(source)}: source position (${position.aggregateVersion}, ${position.commitSequence}) is already owned by event "${positionOwner}". One qualified source position must identify exactly one immutable event. An aggregate that was removed and created again under the same identity causes this too; the kit does not support that, so give the new aggregate a new id.`, event.type);
+	return new EventCollectionError(`InMemoryOutbox rejected event "${event.eventId}" for ${describeAggregateIdentity(source)}: source position (${position.aggregateVersion}, ${position.commitSequence}) is already owned by event "${positionOwner}". One qualified source position must identify exactly one immutable event. An aggregate that was removed and created again under the same identity causes this too; the kit does not support that, so give the new aggregate a new id.`, event.type);
 }
 function staleHeadError(event, source, position, staleHeadVersion) {
-	return new EventHarvestError(`InMemoryOutbox rejected stale event "${event.eventId}" for ${describeAggregateIdentity(source)} at aggregate version ${position.aggregateVersion}: the event-source head is already ${staleHeadVersion}. There are two possible causes. First, the aggregate was removed and created again under the same identity. The kit does not support this, because the versions of the new aggregate restart below the head. Give the new aggregate a new id. Second, this is a retry of an event whose dispatched-id receipt expired. Use a durable outbox with a transactional eventId unique key for unbounded idempotency.`, event.type);
+	return new EventCollectionError(`InMemoryOutbox rejected stale event "${event.eventId}" for ${describeAggregateIdentity(source)} at aggregate version ${position.aggregateVersion}: the event-source head is already ${staleHeadVersion}. There are two possible causes. First, the aggregate was removed and created again under the same identity. The kit does not support this, because the versions of the new aggregate restart below the head. Give the new aggregate a new id. Second, this is a retry of an event whose dispatched-id receipt expired. Use a durable outbox with a transactional eventId unique key for unbounded idempotency.`, event.type);
 }
 function assertSameEventSource(event, received, recorded) {
 	if (received.aggregateType === recorded.aggregateType && received.aggregateId === recorded.aggregateId) return;
-	throw new EventHarvestError(`InMemoryOutbox rejected eventId collision for "${event.eventId}": it already belongs to ${describeAggregateIdentity(recorded)}, but was received for ${describeAggregateIdentity(received)}. An eventId must identify one immutable event across all aggregate sources.`, event.type);
+	throw new EventCollectionError(`InMemoryOutbox rejected eventId collision for "${event.eventId}": it already belongs to ${describeAggregateIdentity(recorded)}, but was received for ${describeAggregateIdentity(received)}. An eventId must identify one immutable event across all aggregate sources.`, event.type);
 }
 
 //#endregion
@@ -7433,7 +6765,7 @@ var OutboxDispatcher = class extends PollLoop {
 function copyForStorage(event, index, stream) {
 	const subject = `InMemoryEventStore.append (stream ${describeAggregateIdentity(stream)}): events[${index}]`;
 	if (event === null || typeof event !== "object") throw new TypeError(`${subject} is not an event object`);
-	return detachFreezableState(event, subject);
+	return copyFreezableState(event, subject);
 }
 function assertStreamPosition(name, value) {
 	if (value !== void 0 && (!Number.isSafeInteger(value) || value < 0)) throw new RangeError(`InMemoryEventStore: ${name} must be a non-negative safe integer, got ${String(value)}`);
@@ -7492,7 +6824,7 @@ var InMemoryEventStore = class {
 	async append(stream, events, options) {
 		const batch = Array.from(events);
 		if (batch.length === 0) return;
-		const identity = detachAggregateIdentity(stream);
+		const identity = copyAggregateIdentity(stream);
 		const expectedVersion = options.expectedVersion;
 		const key = encodeAggregateIdentity(identity);
 		this.existingStreamForAppend(identity, key, expectedVersion, batch.length);
@@ -7770,7 +7102,7 @@ function defaultSleep(ms, signal) {
 *
 * **Classification is by error, not by guesswork.** Only errors the
 * `isRetryable` predicate accepts are retried; everything else (a
-* `DomainError`, `EventHarvestError`, `UnenrolledChangesError`,
+* `DomainError`, `EventCollectionError`, `UnregisteredChangesError`,
 * `DuplicateAggregateError`, a non-Error throw) surfaces immediately.
 * After `maxAttempts` the last error is rethrown unchanged, so a caller
 * can still match `ConcurrencyConflictError` and map it to HTTP 409.
@@ -7936,12 +7268,12 @@ var InMemorySnapshotStore = class {
 //#region src/persistence/snapshot-store/snapshot-model.ts
 /** Type-inference helper for declaring an adapter-owned snapshot model. */
 function defineSnapshotModel(model) {
-	const detached = Object.freeze({ ...model });
-	assertSnapshotModel(detached);
-	return detached;
+	const copy = Object.freeze({ ...model });
+	assertSnapshotModel(copy);
+	return copy;
 }
 /**
-* Captures a detached persistence envelope at an application-supplied time.
+* Captures an independent persistence envelope at an application-supplied time.
 * The application decides when snapshotting is worthwhile; this function does
 * not read a clock or perform I/O. The envelope is deep-frozen, its `state`
 * and its `snapshotAt` included: a write into the captured state or a
@@ -7952,7 +7284,7 @@ function defineSnapshotModel(model) {
 function captureAggregateSnapshot(model, aggregate, snapshotAt) {
 	assertSnapshotModel(model);
 	const recordedAt = copySnapshotAt(snapshotAt);
-	const state = detachState(model.capture(aggregate));
+	const state = copyPlainState(model.capture(aggregate));
 	return deepFreeze({
 		state,
 		version: aggregate.version,
@@ -7991,8 +7323,8 @@ function reconstituteAggregateFromSnapshot(model, id, snapshot) {
 	let aggregate;
 	try {
 		let state;
-		if (storedSchemaVersion === model.schemaVersion) state = detachState(snapshot.state);
-		else if (model.migrate) state = detachState(model.migrate(detachState(snapshot.state), storedSchemaVersion));
+		if (storedSchemaVersion === model.schemaVersion) state = copyPlainState(snapshot.state);
+		else if (model.migrate) state = copyPlainState(model.migrate(copyPlainState(snapshot.state), storedSchemaVersion));
 		else throw new SnapshotSchemaMismatchError({
 			identity: {
 				aggregateType: model.aggregateType,
@@ -8031,5 +7363,5 @@ function copySnapshotAt(snapshotAt) {
 }
 
 //#endregion
-export { AggregateDeletedError, AggregateNotFoundError, AggregateTrackingError, CapabilityRegistryConflictError, CommandBus, CommitError, ConcurrencyConflictError, DeadlineProcessor, DirectStateMutationError, DomainError, DomainEventValidationError, DomainStateMachine, DomainTransitionGuardRejectedError, DuplicateAggregateError, DuplicateEventIdError, DuplicateHandlerRegistrationError, Entity, ErrorMapperFailedError, EventBusClosedError, EventBusImpl, EventHarvestError, EventSourcedAggregate, FoldReturnedNoStateError, ForeignEventError, HostileStateKeyError, IdempotencyClaimLostError, IdempotencyCompletionWithoutClaimError, IdempotencyInFlightError, IdempotencyKeyReuseError, IdempotencyReconciliationRequiredError, IdentityMap, InMemoryCapacityExceededError, InMemoryDeadlineStore, InMemoryEventStore, InMemoryIdempotencyStore, InMemoryOutbox, InMemoryProjectionCheckpointStore, InMemorySnapshotStore, InMemoryTransactionScope, InfrastructureError, InvalidCommandMessageError, InvalidDomainMachineContextError, InvalidDomainMachineDefinitionError, InvalidDomainMachineInputError, InvalidDomainMachineSnapshotError, InvalidDomainTransitionError, InvalidDomainTransitionGuardResultError, InvalidDomainTransitionResultError, InvalidEventStreamPageError, InvalidFlushStatementError, InvalidIntegrationMessageError, InvalidRepositoryAdapterError, InvalidRepositoryDefinitionError, InvalidVersionError, MisattributedEventError, MissingEntityIdError, MissingFoldError, MissingHandlerError, NestedUnitOfWorkError, OutboxDispatcher, PendingEventBatchMismatchError, PendingEventLimitExceededError, ProjectionGapError, ProjectionIdentityViolationError, ProjectionOrderViolationError, ProjectionReceiptViolationError, Projector, PublishDepthExceededError, QueryBus, ReentrantDomainStateMachineEvaluationError, ReentrantEventRecordingError, ReplayRejectedError, ReplayTargetMismatchError, RepositoryErrorMappingFailedError, RetryingTransactionScope, RollbackError, SnapshotCorruptedError, SnapshotSchemaMismatchError, SnapshotTimeValidationError, SnapshotVersionNotRestoredError, Specification, StateStoredAggregate, TransactionClosedError, UnenrolledChangesError, UnitOfWork, UnmanagedInstanceError, UnmintedEventError, UnprojectableEventError, UnregisteredHandlerError, UnreplayableAggregateError, ValueObject, analyzeDomainMachineDefinition, canTransitionDomainState, captureAggregateSnapshot, capturePersistenceBaseline, classifyConcurrencyConflict, copyMetadata, createDomainEvent, createDomainEventFactory, createDomainEventFromFacts, createInitialDomainMachineSnapshot, createIntegrationMessage, createUncommittedDomainEvent, decodeIntegrationMessage, deepEqual, deepEqualExcept, deepFreeze, deepOmit, defaultDomainEventFactory, defineRepository, defineSnapshotModel, derivePersistenceChanges, detachState, domainErrorToResult, encodeIntegrationMessage, entityIds, eventBusSink, findEntityById, freezeShallow, hasEntityId, ignoreProjectionEvent, insertPersistenceBaseline, integrationMessageToCommittedEvent, isDomainErrorLike, isInfrastructureErrorLike, isPositionAfter, isWiringErrorLike, mergeMetadata, outboxWriterAcceptingEventLoss, persistenceProjectionDrifted, pinTargetVersion, prepareDomainMachineDefinition, projectionFromHandlers, readStreamPages, recapturePersistenceBaseline, reconstituteAggregateFromHistory, reconstituteAggregateFromSnapshot, reconstituteAggregateFromStreamPages, recordDomainEvent, recordPendingEvents, removeEntityById, replaceEntityById, routeEventsToCommandOutbox, sameEntity, sameVersion, specification, toVersion, transitionDomainState, updateEntityById, versionedFlush, vo, voEquals, voEqualsExcept, voValidated, voWithValidation, withCommit, withIdempotentCommit };
+export { AggregateDeletedError, AggregateNotFoundError, AggregateTrackingError, CapabilityRegistryConflictError, CommandBus, CommitError, ConcurrencyConflictError, DeadlineProcessor, DirectStateMutationError, DomainError, DomainEventValidationError, DuplicateAggregateError, DuplicateEventIdError, DuplicateHandlerRegistrationError, Entity, ErrorMapperFailedError, EventBusClosedError, EventCollectionError, EventSourcedAggregate, FoldReturnedNoStateError, ForeignEventError, HandBuiltEventError, IdempotencyClaimLostError, IdempotencyCompletionWithoutClaimError, IdempotencyInFlightError, IdempotencyKeyReuseError, IdempotencyReconciliationRequiredError, IdentityMap, InMemoryCapacityExceededError, InMemoryDeadlineStore, InMemoryEventStore, InMemoryIdempotencyStore, InMemoryOutbox, InMemoryProjectionCheckpointStore, InMemorySnapshotStore, InMemoryTransactionScope, InProcessEventBus, InfrastructureError, InvalidCommandMessageError, InvalidEventStreamPageError, InvalidFlushStatementError, InvalidIntegrationMessageError, InvalidRepositoryAdapterError, InvalidRepositoryDefinitionError, InvalidVersionError, MisattributedEventError, MissingEntityIdError, MissingFoldError, MissingHandlerError, NestedUnitOfWorkError, OutboxDispatcher, PendingEventBatchMismatchError, PendingEventLimitExceededError, ProjectionGapError, ProjectionIdentityViolationError, ProjectionOrderViolationError, ProjectionReceiptViolationError, Projector, PrototypePollutionError, PublishDepthExceededError, QueryBus, ReentrantEventRecordingError, ReplayRejectedError, ReplayTargetMismatchError, RepositoryErrorMappingFailedError, RetryingTransactionScope, RollbackError, SnapshotCorruptedError, SnapshotSchemaMismatchError, SnapshotTimeValidationError, SnapshotVersionNotRestoredError, Specification, StateStoredAggregate, TransactionClosedError, UnitOfWork, UnmanagedInstanceError, UnprojectableEventError, UnregisteredChangesError, UnregisteredHandlerError, UnreplayableAggregateError, ValueObject, captureAggregateSnapshot, classifyConcurrencyConflict, copyMetadata, copyPlainState, createDomainEvent, createDomainEventFactory, createIntegrationMessage, createStampedDomainEvent, decodeIntegrationMessage, deepEqual, deepFreeze, deepOmit, defaultDomainEventFactory, defineRepository, defineSnapshotModel, domainErrorToResult, encodeIntegrationMessage, entityIds, eventBusSink, findEntityById, hasEntityId, ignoreProjectionEvent, integrationMessageToCommittedEvent, isDomainErrorLike, isInfrastructureErrorLike, isPositionAfter, isWiringErrorLike, mergeMetadata, outboxWriterAcceptingEventLoss, pinTargetVersion, projectionFromHandlers, readStreamPages, reconstituteAggregateFromHistory, reconstituteAggregateFromSnapshot, reconstituteAggregateFromStreamPages, removeEntityById, replaceEntityById, routeEventsToCommandOutbox, sameEntity, sameVersion, specification, stampPendingEvents, toVersion, updateEntityById, valueObject, valueObjectEquals, valueObjectEqualsExcept, valueObjectOrError, valueObjectOrIssues, versionedFlush, withCommit, withIdempotentCommit };
 //# sourceMappingURL=index.js.map