@shirudo/ddd-kit 3.0.0-rc.12 → 3.0.0-rc.14

package/dist/chunks/snapshot-store.d.ts

@@ -1,4 +1,4 @@
-import { f as DomainError, ot as ReplayRejectedError } from "./kit-errors.js";
+import { f as DomainError, st as ReplayRejectedError } from "./kit-errors.js";
 import { Result } from "@shirudo/result";
 //#region src/internal/json-value.d.ts
 /** A primitive value represented without loss by JSON. */
@@ -193,15 +193,16 @@ type ClockFactory = () => Date;
 /**
  * Factory function producing a fresh, unique event identifier for each call.
  *
- * The library ships a default that uses Web Crypto `crypto.randomUUID()`
- * (works on Node 19+, modern browsers in secure contexts, Deno, Bun,
- * Cloudflare Workers, Vercel Edge, and any runtime that implements Web
- * Crypto). Note that `crypto.randomUUID()` returns **UUID v4** (purely
- * random); for production event stores prefer a **time-ordered** id
- * format (UUID v7 / ULID / KSUID) so B-tree indexes on the eventId
- * column stay clustered and `ORDER BY eventId` matches creation order.
- * Supply one to {@link createDomainEventFactory} to use UUID v7, ULID,
- * KSUID, or another collision-safe format without mutating module state.
+ * The library ships a default that creates a time-ordered **UUID v7** from
+ * Web Crypto random bits (works on Node 19+, modern browsers in secure
+ * contexts, Deno, Bun, Cloudflare Workers, Vercel Edge, and any runtime that
+ * implements Web Crypto). A B-tree index on the eventId column stays
+ * clustered. The id is no ordering authority: ids from several processes
+ * interleave within one millisecond, and clock skew can invert them. Order
+ * events by aggregate version or stream position. Supply another generator
+ * to {@link createDomainEventFactory} to
+ * use ULID, KSUID, or another collision-safe format without mutating module
+ * state.
  */
 type EventIdFactory = () => string;
 /**
@@ -250,7 +251,7 @@ interface EventMetadata {
  * Events are immutable and carry information about what occurred.
  *
  * **Events are PLAIN DATA objects**, constructed via `createDomainEvent`
- * (or the aggregate's `createEvent` plus application-shell recording path)
+ * (or the aggregate's `createEvent` plus application-shell stamping)
  * and deeply frozen. Class-based
  * event objects that satisfy this shape structurally via prototype
  * members are unsupported.
@@ -266,8 +267,8 @@ interface DomainEvent<T extends string, P = void> {
   /**
    * Unique identifier for this specific event instance. Used by idempotent
    * consumers, outbox dispatch tracking, and as the target of
-   * `metadata.causationId`. Convenience constructors default to
-   * `crypto.randomUUID()`; strict construction requires the caller to supply it.
+   * `metadata.causationId`. Convenience constructors default to a UUID v7;
+   * strict construction requires the caller to supply it.
    */
   readonly eventId: string;
   /**
@@ -291,7 +292,7 @@ interface DomainEvent<T extends string, P = void> {
    */
   readonly payload: P;
   /**
-   * Timestamp when the accepted fact was recorded by the application shell.
+   * Timestamp when the application shell stamped the accepted fact.
    * Put business-relevant time in the payload under a domain name.
    */
   readonly occurredAt: Date;
@@ -321,29 +322,29 @@ interface DomainEvent<T extends string, P = void> {
  */
 type AnyDomainEvent = DomainEvent<string, unknown>;
 /**
- * A domain event accepted by an aggregate but not yet given its recording
- * identity, recording time, or delivery metadata.
+ * A domain event accepted by an aggregate but not yet given its event id,
+ * stamp time, or delivery metadata.
  *
  * The aggregate owns the event type, payload, source aggregate identity,
  * and payload schema version because those values describe the business
  * fact it produced.
  * The application shell later turns this value into a {@link DomainEvent}.
  */
-interface UncommittedDomainEvent<T extends string, P = void> {
+interface UnstampedDomainEvent<T extends string, P = void> {
   readonly type: T;
   readonly aggregateId?: string;
   readonly aggregateType?: string;
   readonly payload: P;
   readonly schemaVersion: number;
 }
-/** Upper-bound alias for any uncommitted domain-event shape. */
-type AnyUncommittedDomainEvent = UncommittedDomainEvent<string, unknown>;
-/** Derives the uncommitted shape represented by a concrete event or event union. */
-type UncommittedDomainEventOf<TEvent extends AnyDomainEvent> = TEvent extends DomainEvent<infer TType, infer TPayload> ? UncommittedDomainEvent<TType, TPayload> : never;
-/** An aggregate may hold unstamped decisions and already recorded events together. */
-type PendingDomainEvent<TEvent extends AnyDomainEvent> = TEvent | UncommittedDomainEventOf<TEvent>;
-/** Producer-owned options for an uncommitted event. */
-interface CreateUncommittedDomainEventOptions {
+/** Upper-bound alias for any unstamped domain-event shape. */
+type AnyUnstampedDomainEvent = UnstampedDomainEvent<string, unknown>;
+/** Derives the unstamped shape represented by a concrete event or event union. */
+type UnstampedDomainEventOf<TEvent extends AnyDomainEvent> = TEvent extends DomainEvent<infer TType, infer TPayload> ? UnstampedDomainEvent<TType, TPayload> : never;
+/** An aggregate may hold unstamped decisions and already stamped events together. */
+type PendingDomainEvent<TEvent extends AnyDomainEvent> = TEvent | UnstampedDomainEventOf<TEvent>;
+/** Producer-owned options for an unstamped event. */
+interface CreateUnstampedDomainEventOptions {
   readonly aggregateId?: string;
   readonly aggregateType?: string;
   readonly schemaVersion?: number;
@@ -355,7 +356,7 @@ interface CreateDomainEventOptions {
   /**
    * Override for the auto-generated `eventId`. Pass an existing id (for
    * replay, tests, or deterministic event sourcing) instead of letting the
-   * factory call `crypto.randomUUID()`.
+   * factory generate a UUID v7.
    */
   eventId?: string;
   /**
@@ -379,7 +380,7 @@ interface CreateDomainEventOptions {
    */
   metadata?: EventMetadata;
 }
-/** Technical recording data attached by the application shell. */
+/** Technical stamp data attached by the application shell. */
 interface DomainEventStamp {
   /** Stable identity for this event instance. */
   readonly eventId: string;
@@ -389,7 +390,7 @@ interface DomainEventStamp {
   readonly metadata?: EventMetadata;
 }
 /** Full strict-construction options, including producer-owned event fields. */
-interface CreateDomainEventFromFactsOptions extends DomainEventStamp {
+interface CreateStampedDomainEventOptions extends DomainEventStamp {
   readonly aggregateId?: string;
   readonly aggregateType?: string;
   readonly schemaVersion?: number;
@@ -402,16 +403,16 @@ interface CreateDomainEventStampOptions {
 }
 /** Dependencies captured by one immutable domain-event factory instance. */
 interface DomainEventFactoryOptions {
-  /** Event-id generator. Defaults to Web Crypto `crypto.randomUUID()`. */
+  /** Event-id generator. Defaults to a UUID v7 from Web Crypto random bits. */
   readonly eventIdFactory?: EventIdFactory;
   /** Event-recording clock. Defaults to `() => new Date()`. */
   readonly clock?: ClockFactory;
   /**
-   * Origin stamped on every event this factory mints, unless the call site
+   * Origin stamped on every event this factory builds, unless the call site
    * names one itself.
    *
    * A plain value, not a factory like the two above. Those produce a new
-   * value for each event. An origin identifies the system that mints them
+   * value for each event. An origin identifies the system that builds them
    * and does not change between two of them.
    */
   readonly source?: string;
@@ -423,7 +424,7 @@ interface DomainEventFactoryOptions {
  */
 interface DomainEventFactory {
   /**
-   * Creates immutable technical recording data in the application shell.
+   * Creates immutable technical stamp data in the application shell.
    */
   readonly createStamp: (options?: CreateDomainEventStampOptions) => DomainEventStamp;
   readonly create: {
@@ -442,7 +443,7 @@ interface DomainEventFactory {
  * The supplied functions are read once and captured by value. The returned
  * object is frozen, so another request, test, or library cannot replace its
  * policy. Its {@link DomainEventFactory.createStamp} method is the
- * application-shell bridge that records an accepted aggregate decision.
+ * application-shell bridge that stamps an accepted aggregate decision.
  * Passing the factory through `AggregateConfig`
  * enables the explicitly named convenience methods, whose defaults read time
  * and randomness.
@@ -453,8 +454,7 @@ interface DomainEventFactory {
  *   eventIdFactory: () => uuidv7(),
  *   clock: () => new Date(),
  * });
- * order.confirm();
- * recordPendingEvents(order, domainEvents);
+ * const uow = new UnitOfWork({ ...deps, eventStampFactory: domainEvents });
  * ```
  */
 declare function createDomainEventFactory(options?: DomainEventFactoryOptions): DomainEventFactory;
@@ -464,21 +464,6 @@ declare function createDomainEventFactory(options?: DomainEventFactoryOptions):
  * with {@link createDomainEventFactory} for custom policy.
  */
 declare const defaultDomainEventFactory: DomainEventFactory;
-/**
- * Creates an uncommitted domain event: the event that an aggregate method
- * returns before the application shell records it. The payload and the
- * metadata follow the input ownership rule of {@link createDomainEvent}.
- */
-declare function createUncommittedDomainEvent<T extends string>(type: T, payload?: undefined, options?: CreateUncommittedDomainEventOptions): UncommittedDomainEvent<T, void>;
-declare function createUncommittedDomainEvent<T extends string, P>(type: T, payload: P, options?: CreateUncommittedDomainEventOptions): UncommittedDomainEvent<T, P>;
-/**
- * Attaches shell-owned recording data to an accepted aggregate decision.
- *
- * The decision supplies the domain type, payload, source aggregate
- * identity, and payload schema version. The stamp supplies only event
- * identity, recording time, and trace metadata.
- */
-declare function recordDomainEvent<T extends string, P>(event: UncommittedDomainEvent<T, P>, stamp: DomainEventStamp): DomainEvent<T, P>;
 /**
  * Creates a domain event with default values.
  * Sets occurredAt to current date and schemaVersion to 1 if not provided.
@@ -486,7 +471,7 @@ declare function recordDomainEvent<T extends string, P>(event: UncommittedDomain
  * **Input ownership.** The event is deeply frozen, and `payload` and
  * `metadata` are deep-cloned first, so the caller's own objects are never
  * frozen in place and later mutation of them does not bleed into the event
- * (same contract as `vo()`). The event data rule checks the data before the
+ * (same contract as `valueObject()`). The event data rule checks the data before the
  * copy and the copy after it. So the copy loses no data without an error,
  * and no getter of the data runs. The in-memory event store applies the
  * same rule on append. The checks catch accidents, not a hostile `Proxy`: a
@@ -510,8 +495,8 @@ declare function recordDomainEvent<T extends string, P>(event: UncommittedDomain
  * route by. The commit boundary validates that both fields are present
  * and throws if they are missing, so a direct `createDomainEvent(...)`
  * call inside an aggregate that forgets the options is caught at
- * runtime. Record pending decisions in the application
- * shell before repository persistence or outbox harvest.
+ * runtime. Stamp pending decisions in the application
+ * shell before repository persistence or outbox collection.
  *
  * Use `createDomainEvent(...)` directly for events that don't belong to
  * an aggregate: system events, integration events, configuration events,
@@ -532,17 +517,17 @@ declare function recordDomainEvent<T extends string, P>(event: UncommittedDomain
 declare function createDomainEvent<T extends string>(type: T, payload?: undefined, options?: CreateDomainEventOptions): DomainEvent<T, void>;
 declare function createDomainEvent<T extends string, P>(type: T, payload: P, options?: CreateDomainEventOptions): DomainEvent<T, P>;
 /**
- * Creates an already minted domain event exclusively from explicit envelope
+ * Creates a kit-built, stamped domain event exclusively from explicit envelope
  * facts. Unlike {@link createDomainEvent}, it has no clock or event-id fallback
  * and is useful when replay, migration, or a caller-owned boundary already has
  * the final identity and occurrence time.
  *
- * Aggregate behavior normally creates an {@link UncommittedDomainEvent} through
+ * Aggregate behavior normally creates an {@link UnstampedDomainEvent} through
  * its protected `createEvent` helper. The application shell later records that
  * pending fact with caller-owned time and identity.
  */
-declare function createDomainEventFromFacts<T extends string>(type: T, payload: undefined, options: CreateDomainEventFromFactsOptions): DomainEvent<T, void>;
-declare function createDomainEventFromFacts<T extends string, P>(type: T, payload: P, options: CreateDomainEventFromFactsOptions): DomainEvent<T, P>;
+declare function createStampedDomainEvent<T extends string>(type: T, payload: undefined, options: CreateStampedDomainEventOptions): DomainEvent<T, void>;
+declare function createStampedDomainEvent<T extends string, P>(type: T, payload: P, options: CreateStampedDomainEventOptions): DomainEvent<T, P>;
 /**
  * Copies metadata from a source event to a new event.
  * Useful for maintaining correlation chains in event-driven architectures.
@@ -952,7 +937,7 @@ type Id<Tag extends string> = string & {
  * The kit makes no attempt to dedupe or detect collisions: a collision
  * silently overwrites earlier rows (under unique-key constraints) or
  * silently aliases two different entities (without them). Safe choices:
- * `crypto.randomUUID()` (UUIDv4, the default for events), ULID, UUIDv7,
+ * UUIDv7 (the default for events), `crypto.randomUUID()` (UUIDv4), ULID,
  * KSUID: all collision-resistant by design. Unsafe choices: `Date.now()`
  * alone (duplicates within the same millisecond), a process-local
  * counter without persistence (resets to 1 on restart, collides with
@@ -1065,7 +1050,7 @@ interface ReplayableAggregate<TId extends Id<string>, TEvent extends AnyDomainEv
    *   decisions, or a fold records one
    * @throws MissingFoldError when no fold is declared for an event type
    * @throws FoldReturnedNoStateError when a fold returns `undefined`
-   * @throws HostileStateKeyError when the folded state carries an own
+   * @throws PrototypePollutionError when the folded state carries an own
    *   `__proto__` key
    */
   replayHistory(history: ReadonlyArray<TEvent>): Result<void, DomainError>;
@@ -1411,6 +1396,43 @@ interface TransactionScope<TCtx> {
   transactional<T>(fn: (ctx: TCtx) => Promise<T>, options?: TransactionalOptions): Promise<T>;
 }
 //#endregion
+//#region src/application/unit-of-work/stamp-pending-events.d.ts
+/** Minimal shell role accepted by {@link stampPendingEvents}. */
+type DomainEventStampFactory = Pick<DomainEventFactory, "createStamp">;
+/** Per-decision stamp provider for metadata that depends on the event. */
+type DomainEventStampProvider<TEvent extends AnyDomainEvent> = (event: UnstampedDomainEventOf<TEvent>, index: number) => DomainEventStamp;
+/**
+ * Stamp options that every decision of one stamping shares: a stamp time
+ * and metadata such as the correlation id of the request. An `eventId` is per
+ * fact, so the factory creates it for each decision.
+ */
+type SharedDomainEventStampOptions = Omit<CreateDomainEventStampOptions, "eventId">;
+/**
+ * Stamps every still-unstamped event accepted by an aggregate.
+ *
+ * The commit stamps every still-unstamped event when it registers the
+ * aggregate, so a use case does not need this function. Call it first when
+ * the metadata depends on the concrete decision, for an import, or for a test
+ * that needs fixed ids. The commit keeps the stamps that this function set.
+ *
+ * The function is a command that also returns the stamped batch, a
+ * deliberate exception to command-query separation: the caller hands the
+ * batch on to persistence and needs no second read of `pendingEvents`.
+ *
+ * Stamping is atomic with respect to the aggregate's pending list: if stamp
+ * creation or validation fails, every decision remains unstamped. A
+ * successful second call returns the same event objects and does not read the
+ * factory again, so an instance that a retried attempt registers again keeps
+ * its event identities.
+ *
+ * Pass a `DomainEventFactory` (only its `createStamp` role is required) for one
+ * uniform stamping policy. Add `stampOptions` for metadata that every
+ * decision of the batch shares, such as the correlation id of the request.
+ * Pass a callback instead when metadata depends on the concrete decision.
+ */
+declare function stampPendingEvents<TId extends Id<string>, TEvent extends AnyDomainEvent>(aggregate: Aggregate<TId, TEvent>, factory: DomainEventStampFactory, stampOptions?: SharedDomainEventStampOptions): ReadonlyArray<TEvent>;
+declare function stampPendingEvents<TId extends Id<string>, TEvent extends AnyDomainEvent>(aggregate: Aggregate<TId, TEvent>, createStamp: DomainEventStampProvider<TEvent>): ReadonlyArray<TEvent>;
+//#endregion
 //#region src/application/cqrs/handler.d.ts
 /** Dependencies for {@link withCommit}. */
 interface WithCommitDeps<Evt extends AnyDomainEvent, TCtx> {
@@ -1474,12 +1496,25 @@ interface WithCommitDeps<Evt extends AnyDomainEvent, TCtx> {
    * unless the scope honors the signal.
    */
   signal?: AbortSignal;
+  /**
+   * Stamps every pending event that is still unstamped when its aggregate is
+   * registered: the event id, the stamp time, and the metadata. Defaults to
+   * `createDomainEventFactory()`, a UUID v7 from Web Crypto random bits and
+   * the system clock. An event that is already stamped, for example by an
+   * explicit `stampPendingEvents` call, keeps its stamp.
+   */
+  eventStampFactory?: DomainEventStampFactory;
+  /**
+   * Stamp options that every event stamped in this commit shares, for
+   * example the correlation id of the request.
+   */
+  stampOptions?: SharedDomainEventStampOptions;
 }
 declare const aggregateCommitTokenBrand: unique symbol;
 /**
- * Opaque receipt that one aggregate was explicitly enrolled in the current
- * {@link withCommit} invocation. Tokens are minted only by the invocation's
- * {@link CommitEnrollment} capability and are bound to that invocation at
+ * Opaque receipt that one aggregate was explicitly registered in the current
+ * {@link withCommit} invocation. Tokens are issued only by the invocation's
+ * {@link CommitRegistration} capability and are bound to that invocation at
  * runtime; a forged token or one retained from an earlier call is rejected
  * inside the transaction.
  */
@@ -1487,26 +1522,26 @@ interface AggregateCommitToken<Evt extends AnyDomainEvent = AnyDomainEvent> {
   readonly [aggregateCommitTokenBrand]: Evt;
 }
 /**
- * Invocation-scoped enrollment capability handed to a {@link withCommit}
- * callback. Call `enrollSaved` only for an aggregate participating in the
+ * Invocation-scoped registration capability handed to a {@link withCommit}
+ * callback. Call `registerSaved` only for an aggregate participating in the
  * repository write, and return every resulting token in `commits`. Omitting
- * any token rejects the transaction: an enrolled write may not commit without
- * its event harvest and post-commit acknowledgement. Enrollable instances
+ * any token rejects the transaction: a registered write may not commit without
+ * its event collection and post-commit acknowledgement. Registrable instances
  * must extend `StateStoredAggregate` or `EventSourcedAggregate`; structural
  * `Aggregate` lookalikes have no internal lifecycle capability and fail
  * before commit.
  */
-interface CommitEnrollment<Evt extends AnyDomainEvent> {
-  enrollSaved(aggregate: Aggregate<Id<string>, Evt>, options?: CommitEnrollmentOptions): AggregateCommitToken<Evt>;
+interface CommitRegistration<Evt extends AnyDomainEvent> {
+  registerSaved(aggregate: Aggregate<Id<string>, Evt>, options?: CommitRegistrationOptions): AggregateCommitToken<Evt>;
   /**
-   * Enroll an aggregate whose row is deleted by the current transaction.
-   * Its events are harvested and discarded after commit, but the saved-only
+   * Register an aggregate whose row the current transaction removes.
+   * Its events are collected and discarded after commit, but the saved-only
    * application `onPersisted` observer is not called.
    */
-  enrollDeleted(aggregate: Aggregate<Id<string>, Evt>, options?: CommitEnrollmentOptions): AggregateCommitToken<Evt>;
+  registerRemoved(aggregate: Aggregate<Id<string>, Evt>, options?: CommitRegistrationOptions): AggregateCommitToken<Evt>;
 }
-/** OCC baseline associated with one exact commit enrollment. */
-interface CommitEnrollmentOptions {
+/** OCC baseline associated with one exact commit registration. */
+interface CommitRegistrationOptions {
   /** Absent for a new aggregate; captured at load for update or removal. */
   readonly expectedVersion?: Version;
 }
@@ -1514,8 +1549,8 @@ interface CommitEnrollmentOptions {
 interface WithCommitWorkResult<Evt extends AnyDomainEvent, R> {
   result: R;
   /**
-   * Commit tokens returned by the invocation's enrollment capability.
-   * Every token minted during the callback must appear at least once.
+   * Commit tokens returned by the invocation's registration capability.
+   * Every token issued during the callback must appear at least once.
    * Naked aggregates are intentionally not accepted: touching an aggregate
    * does not prove that its repository write participated in the transaction.
    */
@@ -1524,29 +1559,29 @@ interface WithCommitWorkResult<Evt extends AnyDomainEvent, R> {
 /**
  * Helper for executing a write Use Case inside a transaction scope.
  *
- * The use-case callback receives an invocation-scoped enrollment capability
+ * The use-case callback receives an invocation-scoped registration capability
  * and returns opaque commit tokens for the repository writes that completed
- * in the transaction. `withCommit` owns the post-commit lifecycle (harvest,
+ * in the transaction. `withCommit` owns the post-commit lifecycle (collection,
  * outbox, mark-persisted, publish). A naked aggregate is not commit evidence:
  * merely touching or constructing one must never make it look persisted.
  *
- * **Trust boundary.** A token proves invocation-local enrollment, not that the
+ * **Trust boundary.** A token proves invocation-local registration, not that the
  * kit inspected a database write; a generic transaction helper cannot observe
- * adapter internals. Repository code must enroll only writes participating in
+ * adapter internals. Repository code must register only writes participating in
  * this transaction. `UnitOfWork` centralizes that rule in repository methods.
  * The opaque, scoped token prevents accidental aggregate smuggling and stale
  * reuse; it is not a security boundary against code that deliberately lies to
  * its own persistence capability.
  *
  * Order of operations:
- *  1. `fn(ctx, enrollment)` runs inside `scope.transactional(...)`; domain
+ *  1. `fn(ctx, registration)` runs inside `scope.transactional(...)`; domain
  *     mutations + repo writes happen here. After a repository write has
- *     enrolled an aggregate, the callback includes that opaque token in its
+ *     registered an aggregate, the callback includes that opaque token in its
  *     `commits` result. Tokens are invocation-bound: forged or stale tokens
- *     fail before harvest. `ctx` is whatever transaction handle the `scope`
+ *     fail before collection. `ctx` is whatever transaction handle the `scope`
  *     exposes (Drizzle `tx`, Prisma `tx`, Mongo session, or `undefined` for
  *     context-free scopes).
- *  2. **Still inside the transaction**, `withCommit` harvests every
+ *  2. **Still inside the transaction**, `withCommit` collects every
  *     aggregate's `pendingEvents` and writes them via `outbox.add` (so
  *     events persist atomically with the state change). Skipped when no
  *     events were recorded. Each bare domain event is composed into an
@@ -1556,7 +1591,7 @@ interface WithCommitWorkResult<Evt extends AnyDomainEvent, R> {
  *     resulting `CommittedDomainEvent`. The domain event itself is never
  *     stamped or copied.
  *
- *     **Harvest order.** Events are concatenated in the order
+ *     **Collection order.** Events are concatenated in the order
  *     tokens appear in the returned `commits` array, then in
  *     each aggregate's `pendingEvents` order (insertion order via
  *     `apply` / `commit` / `addDomainEvent`). So tokens for `[a, b]`
@@ -1580,7 +1615,7 @@ interface WithCommitWorkResult<Evt extends AnyDomainEvent, R> {
  *     across aggregates at delivery time.
  *  3. The transaction commits.
  *  4. **After** the commit, a non-exported capability acknowledges every
- *     saved enrollment and discards pending events for deleted enrollments.
+ *     saved registration and discards pending events for deleted registrations.
  *     Only after the complete commit set is clean does the optional
  *     application-shell `onPersisted(aggregate, version, context)` observer run for
  *     saved aggregates. Deleted rows never trigger that observer.
@@ -1610,16 +1645,16 @@ interface WithCommitWorkResult<Evt extends AnyDomainEvent, R> {
  * If the transaction rolls back, no acknowledgement occurs: the aggregate
  * keeps its pending events, so the caller can retry or discard the instance.
  *
- * Enrollment captures an exact version and event batch. Re-enrolling the same
+ * Registration captures an exact version and event batch. Re-registering the same
  * aggregate after it changes rejects. `UnitOfWork` additionally seals the
- * adapter persistence projection and rejects later mutation before flush. For
- * direct `withCommit` use, make domain decisions first, write, and enroll last.
+ * adapter persistence capture and rejects later mutation before flush. For
+ * direct `withCommit` use, make domain decisions first, write, and register last.
  *
- * **Duplicate enrollment is idempotent by reference.** Enrolling the same
+ * **Duplicate registration is idempotent by reference.** Registering the same
  * instance repeatedly returns the same token, and a repeated token in
- * `commits` is harvested once. A repeat call that omits `expectedVersion`
+ * `commits` is collected once. A repeat call that omits `expectedVersion`
  * makes no OCC assertion; only a supplied value that contradicts the
- * enrollment-time baseline rejects. Each event lands in the outbox exactly once
+ * registration-time baseline rejects. Each event lands in the outbox exactly once
  * and post-commit acknowledgement runs exactly once. Two
  * *different* instances with the same logical id cannot be detected
  * at this layer; that is a Repository contract violation (failure to
@@ -1630,17 +1665,17 @@ interface WithCommitWorkResult<Evt extends AnyDomainEvent, R> {
  *
  * @example Tx-bound repos (Drizzle, Prisma, Mongo, …)
  * ```typescript
- * const result = await withCommit({ outbox, bus, scope }, async (tx, enrollment) => {
+ * const result = await withCommit({ outbox, bus, scope }, async (tx, registration) => {
  *   const orderRepository = makeOrderRepository(tx); // your factory binds tx to the repo
  *   const order = await orderRepository.getById(orderId);
  *   order.confirm();
  *   await persistOrder(tx, order);                 // low-level adapter write
- *   const commit = enrollment.enrollSaved(order);   // attest the repository write
+ *   const commit = registration.registerSaved(order);   // attest the repository write
  *   return { result: order.id, commits: [commit] };
  * });
  * ```
  */
-declare function withCommit<Evt extends AnyDomainEvent, R, TCtx>(deps: WithCommitDeps<Evt, TCtx>, fn: (ctx: TCtx, enrollment: CommitEnrollment<Evt>) => Promise<WithCommitWorkResult<Evt, R>>): Promise<R>;
+declare function withCommit<Evt extends AnyDomainEvent, R, TCtx>(deps: WithCommitDeps<Evt, TCtx>, fn: (ctx: TCtx, registration: CommitRegistration<Evt>) => Promise<WithCommitWorkResult<Evt, R>>): Promise<R>;
 //#endregion
 //#region src/application/deadlines/deadline-store.d.ts
 /**
@@ -1816,7 +1851,7 @@ interface IdempotencyLease {
   /** Delay after which the wrapper should renew this lease. */
   readonly renewAfterMs: number;
 }
-/** Store-minted ownership receipt for one successful claim. */
+/** Store-issued ownership receipt for one successful claim. */
 interface IdempotencyClaimHandle {
   readonly key: string;
   /** Unique across ownership generations for this key; treat as opaque. */
@@ -1875,7 +1910,7 @@ type IdempotencyClaim = {
  *
  * A NON-transactional store (the in-memory reference on its own, a separate
  * durable store) cannot see commits or rollbacks. Every fresh claim
- * therefore returns a store-minted token and bounded lease. The wrapper
+ * therefore returns a store-issued token and bounded lease. The wrapper
  * renews it while the transaction runs; `complete`, `renew`, `confirm`,
  * `abandon`, and `reconcile` compare the token so a stale owner cannot
  * mutate a successor claim. An expired PENDING claim may be replaced. An
@@ -2035,12 +2070,12 @@ interface WithIdempotentCommitDeps<Evt extends AnyDomainEvent, TCtx> extends Wit
  *  2. A fresh claim carries an opaque ownership token. For a leased store the
  *     wrapper renews it at `renewAfterMs` until the transaction callback is
  *     ready to commit. A renewal failure rejects before commit and releases
- *     the claim. `fn(ctx, enrollment, execution)` receives the same token so a
+ *     the claim. `fn(ctx, registration, execution)` receives the same token so a
  *     source-side marker can make later reconciliation conclusive.
  *  3. `store.complete(ctx, claim, fn's result)` stages or completes the outcome
- *     in the same transaction as aggregate writes and outbox. The enrollment
+ *     in the same transaction as aggregate writes and outbox. The registration
  *     capability is sealed and its token array copied before `complete` can
- *     yield, so leaked callback state cannot change the harvest receipt.
+ *     yield, so leaked callback state cannot change the collection receipt.
  *  4. After commit, `store.confirm(claim)` finalizes a leased store's staged
  *     outcome; it is a no-op for transactional stores. A failure cannot reject
  *     an already committed write, so it is sent to `onIdempotencyError` and the
@@ -2063,7 +2098,7 @@ interface WithIdempotentCommitDeps<Evt extends AnyDomainEvent, TCtx> extends Wit
  * production default. Leases make the non-transactional family recoverable;
  * they do not manufacture an atomic exactly-once boundary across two stores.
  */
-declare function withIdempotentCommit<Evt extends AnyDomainEvent, R, TCtx>(deps: WithIdempotentCommitDeps<Evt, TCtx>, request: IdempotentCommitRequest, fn: (ctx: TCtx, enrollment: CommitEnrollment<Evt>, execution: IdempotentExecution) => Promise<WithCommitWorkResult<Evt, R>>): Promise<IdempotentCommitResult<R>>;
+declare function withIdempotentCommit<Evt extends AnyDomainEvent, R, TCtx>(deps: WithIdempotentCommitDeps<Evt, TCtx>, request: IdempotentCommitRequest, fn: (ctx: TCtx, registration: CommitRegistration<Evt>, execution: IdempotentExecution) => Promise<WithCommitWorkResult<Evt, R>>): Promise<IdempotentCommitResult<R>>;
 //#endregion
 //#region src/application/projections/ports.d.ts
 /**
@@ -2248,7 +2283,7 @@ type AggregateClass<TAgg> = Function & {
  * `AggregatePersistence` implementations: two `findById(id)` calls in the same
  * unit of work MUST return the same instance, because commit-token
  * write registration dedupes by JavaScript object identity. Two instances for
- * one logical aggregate can otherwise produce two tokens, two harvests,
+ * one logical aggregate can otherwise produce two tokens, two collections,
  * and two post-commit lifecycle calls.
  *
  * Storage is two-level (per-type stores created lazily), so
@@ -2309,7 +2344,7 @@ declare class IdentityMap {
    * - Registering a DIFFERENT instance for an occupied type+id throws:
    *   that is precisely the identity-map violation this class exists
    *   to prevent (the repository hydrated twice instead of checking
-   *   {@link get} first), and letting it pass would double-harvest
+   *   {@link get} first), and letting it pass would double-collect
    *   events downstream.
    * - Registering a type+id that was {@link delete}d in this unit of
    *   work throws `AggregateDeletedError`: deletion is final within
@@ -2322,7 +2357,7 @@ declare class IdentityMap {
    * Registered instances that have recorded MORE pending events than they
    * carried when first registered (loaded). Used by the unit of work's
    * end-of-run guard: an aggregate that gained events after load but was
-   * never enrolled would silently drop them. A read-only load, or a
+   * never registered would silently drop them. A read-only load, or a
    * reconstitution that already carried events, shows no increase and is
    * not reported.
    */
@@ -2354,16 +2389,16 @@ declare class IdentityMap {
 /** Whether a baseline represents an existing row or a pending insert. */
 type PersistenceLifecycle = "loaded" | "new";
 /**
- * Adapter-owned projection and change derivation for one aggregate type.
+ * Adapter-owned capture and change derivation for one aggregate type.
  *
  * The domain model does not implement this contract. A repository adapter
- * chooses what it persists, how that projection is captured at load, and
+ * chooses what it persists, how it captures the aggregate at load, and
  * whether a change set is a partial diff or a full replacement.
  */
 interface PersistenceModel<TAggregate, TBaseline, TChangeSet> {
   /**
-   * Captures the adapter's persistence projection at the current moment.
-   * Return a detached value or an immutable value object: the Unit of Work
+   * Captures the aggregate for the adapter at the current moment.
+   * Return a copied value or an immutable value object: the Unit of Work
    * retains it as a baseline and cannot make an arbitrary adapter type safe.
    *
    * Capture must be deterministic for an unchanged aggregate: the Unit of
@@ -2382,7 +2417,7 @@ interface PersistenceModel<TAggregate, TBaseline, TChangeSet> {
    */
   capture(aggregate: TAggregate): TBaseline;
   /**
-   * Adapter-owned equality for two captures of the persistence projection.
+   * Adapter-owned equality for two captures.
    * Optional: the default is the package's structural deep equality (Set
    * members and Map keys by reference). Supply it when the capture shape
    * needs domain-specific comparison, for example rebuilt value-object Set
@@ -2401,46 +2436,11 @@ interface PersistenceModel<TAggregate, TBaseline, TChangeSet> {
   /** Tells orchestration whether the derived state write is empty. */
   isEmpty(changes: TChangeSet): boolean;
 }
-declare const persistenceBaselineBrand: unique symbol;
-/**
- * Opaque, typed receipt for an adapter-owned persistence baseline.
- *
- * It intentionally exposes no data. The Unit of Work may retain the token and
- * ask the owning adapter capability to derive changes, but cannot branch on or
- * couple itself to the baseline's shape.
- */
-interface PersistenceBaseline<TAggregate, TChangeSet> {
-  readonly [persistenceBaselineBrand]: (aggregate: TAggregate) => TChangeSet;
-}
 /** A derived adapter change set plus its adapter-defined emptiness result. */
 interface PersistenceChanges<TChangeSet> {
   readonly value: TChangeSet;
   readonly empty: boolean;
 }
-/** Captures a baseline for an aggregate restored by a repository adapter. */
-declare function capturePersistenceBaseline<TAggregate, TBaseline, TChangeSet>(model: PersistenceModel<TAggregate, TBaseline, TChangeSet>, aggregate: TAggregate): PersistenceBaseline<TAggregate, TChangeSet>;
-/** Creates the explicit no-row baseline for a newly added aggregate. */
-declare function insertPersistenceBaseline<TAggregate, TBaseline, TChangeSet>(model: PersistenceModel<TAggregate, TBaseline, TChangeSet>): PersistenceBaseline<TAggregate, TChangeSet>;
-/**
- * Captures the aggregate's current adapter projection using the capability
- * carried by an existing baseline. Used to seal persistence-last registration.
- */
-declare function recapturePersistenceBaseline<TAggregate, TChangeSet>(baseline: PersistenceBaseline<TAggregate, TChangeSet>, aggregate: TAggregate): PersistenceBaseline<TAggregate, TChangeSet>;
-/**
- * Recaptures the adapter projection and reports whether it drifted from the
- * baseline's stored capture, using the model's `captureEquals` when supplied
- * and structural deep equality otherwise.
- *
- * This, not `changes()`/`isEmpty()`, is the mutation detector: the
- * `PersistenceModel` contract explicitly permits a full-replacement change
- * set whose `isEmpty` is never true, so a non-empty change set proves
- * nothing about mutation. Comparing capture to capture asks the honest
- * question independent of the model's diffing strategy. A `"new"` lifecycle
- * baseline has no stored capture and never reports drift.
- */
-declare function persistenceProjectionDrifted<TAggregate, TChangeSet>(baseline: PersistenceBaseline<TAggregate, TChangeSet>, aggregate: TAggregate): boolean;
-/** Derives a typed adapter change set without exposing the stored baseline. */
-declare function derivePersistenceChanges<TAggregate, TChangeSet>(baseline: PersistenceBaseline<TAggregate, TChangeSet>, aggregate: TAggregate): PersistenceChanges<TChangeSet>;
 //#endregion
 //#region src/application/unit-of-work/persistence-contract.d.ts
 /** The explicit persistence intent registered for one tracked aggregate. */
@@ -2454,7 +2454,7 @@ type UnitOfWorkIdentityMap = Pick<IdentityMap, "get" | "has" | "isDeleted">;
  * restored aggregate.
  * Write methods exposed to application code are replaced by Unit-of-Work-owned
  * `add`, `update`, and `remove` registrations, so an adapter implementation of
- * those methods cannot perform durable I/O early or skip event harvesting.
+ * those methods cannot perform durable I/O early or skip event collection.
  *
  * Contract for repository implementations:
  * - `findById(id)` checks `identityMap.get` BEFORE hydrating, treats
@@ -2717,6 +2717,10 @@ interface EventStore<Evt extends AnyDomainEvent> extends EventStreamReader<Evt>
    *     proves the duplicate/gap rejection. The repository then calls
    *     `replayHistory`, whose replay guard rejects any event carrying an
    *     aggregate type or id that contradicts this stream key.
+   *  7. **Stamped events only:** reject an event without an `eventId` with
+   *     a `TypeError`, before any write. A direct `withCommit` callback can
+   *     append before its registration stamps the events; this check makes
+   *     that mistake fail instead of storing ids that the outbox never sees.
    *
    * An empty `events` array is a no-op; implementations resolve without
    * touching the store (an ES repository skips `append` for aggregates
@@ -2840,7 +2844,7 @@ declare function reconstituteAggregateFromStreamPages<TAggregate extends Replaya
  * `createSnapshotStoreContractTests` from `@shirudo/ddd-kit/testing`):
  * the snapshot round-trips verbatim (`state` as plain data,
  * `version`, `snapshotAt` with millisecond fidelity, `schemaVersion`
- * including its absence), loads return detached copies (never live
+ * including its absence), loads return copies (never live
  * internal state), and keys are isolated per aggregate type AND id
  * (one table may serve every aggregate type).
  *
@@ -2875,5 +2879,5 @@ interface SnapshotStore<TState = unknown> {
   delete(identity: AggregateIdentity): Promise<void>;
 }
 //#endregion
-export { EventHandler as $, Command as $t, IdempotencyClaimHandle as A, CreateDomainEventFromFactsOptions as At, withIdempotentCommit as B, PendingDomainEvent as Bt, IdentityMap as C, ExecutionContext as Ct, ProjectionPosition as D, EventCommitCandidatePosition as Dt, ProjectionCheckpointStore as E, EventCommitCandidate as Et, IdempotencyStore as F, DomainEventFactory as Ft, CommitEnrollment as G, createDomainEventFactory as Gt, DeadlineStore as H, UncommittedDomainEventOf as Ht, IdempotentCommitRequest as I, DomainEventFactoryOptions as It, WithCommitWorkResult as J, defaultDomainEventFactory as Jt, CommitEnrollmentOptions as K, createDomainEventFromFacts as Kt, IdempotentCommitResult as L, DomainEventStamp as Lt, IdempotencyOperationErrorContext as M, CreateDomainEventStampOptions as Mt, IdempotencyReconciliation as N, CreateUncommittedDomainEventOptions as Nt, isPositionAfter as O, AnyDomainEvent as Ot, IdempotencyReconciliationDecision as P, DomainEvent as Pt, EventBus as Q, AggregateIdentity as Qt, IdempotentExecution as R, EventIdFactory as Rt, AggregateClass as S, OutboxWriter as St, ProjectionCheckpoint as T, CommittedDomainEvent as Tt, DueDeadline as U, copyMetadata as Ut, DeadLetterDeadline as V, UncommittedDomainEvent as Vt, AggregateCommitToken as W, createDomainEvent as Wt, TransactionScope as X, recordDomainEvent as Xt, withCommit as Y, mergeMetadata as Yt, TransactionalOptions as Z, ClockFactory as Zt, capturePersistenceBaseline as _, routeEventsToCommandOutbox as _t, EventStoreAppendOptions as a, Version as at, persistenceProjectionDrifted as b, Outbox as bt, StreamReadResult as c, Id as ct, RepositoryTracking as d, CommandMessageContent as dt, CommandHandler as en, OnceOptions as et, UnitOfWorkIdentityMap as f, CommandMessageRelationships as ft, PersistenceModel as g, DurableCommandMessage as gt, PersistenceLifecycle as h, CommandOutboxWriter as ht, EventStore as i, JsonValue as in, ReplayableAggregate as it, IdempotencyLease as j, CreateDomainEventOptions as jt, IdempotencyClaim as k, AnyUncommittedDomainEvent as kt, AggregatePersistenceWrite as l, IdGenerator as lt, PersistenceChanges as m, CommandOutboxMapper as mt, ReplayableStreamPages as n, JsonObject as nn, Aggregate as nt, EventStreamReader as o, sameVersion as ot, PersistenceBaseline as p, CommandOutboxCommitCandidate as pt, WithCommitDeps as q, createUncommittedDomainEvent as qt, reconstituteAggregateFromStreamPages as r, JsonPrimitive as rn, AggregateSnapshot as rt, ReadStreamOptions as s, toVersion as st, SnapshotStore as t, PublishedCommand as tn, PublishOptions as tt, AggregateWriteIntent as u, CommandCommitOriginCandidate as ut, derivePersistenceChanges as v, DeadLetterRecord as vt, Projection as w, CommitPosition as wt, recapturePersistenceBaseline as x, OutboxRecord as xt, insertPersistenceBaseline as y, DispatchTrackingOutbox as yt, WithIdempotentCommitDeps as z, EventMetadata as zt };
+export { PublishOptions as $, JsonPrimitive as $t, IdempotentCommitRequest as A, CreateStampedDomainEventOptions as At, CommitRegistrationOptions as B, UnstampedDomainEventOf as Bt, IdempotencyClaim as C, CommittedDomainEvent as Ct, IdempotencyReconciliation as D, AnyUnstampedDomainEvent as Dt, IdempotencyOperationErrorContext as E, AnyDomainEvent as Et, DeadLetterDeadline as F, DomainEventStamp as Ft, DomainEventStampProvider as G, defaultDomainEventFactory as Gt, WithCommitWorkResult as H, createDomainEvent as Ht, DeadlineStore as I, EventIdFactory as It, TransactionScope as J, AggregateIdentity as Jt, SharedDomainEventStampOptions as K, mergeMetadata as Kt, DueDeadline as L, EventMetadata as Lt, IdempotentExecution as M, DomainEvent as Mt, WithIdempotentCommitDeps as N, DomainEventFactory as Nt, IdempotencyReconciliationDecision as O, CreateDomainEventOptions as Ot, withIdempotentCommit as P, DomainEventFactoryOptions as Pt, OnceOptions as Q, JsonObject as Qt, AggregateCommitToken as R, PendingDomainEvent as Rt, isPositionAfter as S, CommitPosition as St, IdempotencyLease as T, EventCommitCandidatePosition as Tt, withCommit as U, createDomainEventFactory as Ut, WithCommitDeps as V, copyMetadata as Vt, DomainEventStampFactory as W, createStampedDomainEvent as Wt, EventBus as X, CommandHandler as Xt, TransactionalOptions as Y, Command as Yt, EventHandler as Z, PublishedCommand as Zt, IdentityMap as _, DispatchTrackingOutbox as _t, EventStoreAppendOptions as a, toVersion as at, ProjectionCheckpointStore as b, OutboxWriter as bt, StreamReadResult as c, CommandCommitOriginCandidate as ct, RepositoryTracking as d, CommandOutboxCommitCandidate as dt, JsonValue as en, Aggregate as et, UnitOfWorkIdentityMap as f, CommandOutboxMapper as ft, AggregateClass as g, DeadLetterRecord as gt, PersistenceModel as h, routeEventsToCommandOutbox as ht, EventStore as i, sameVersion as it, IdempotentCommitResult as j, CreateUnstampedDomainEventOptions as jt, IdempotencyStore as k, CreateDomainEventStampOptions as kt, AggregatePersistenceWrite as l, CommandMessageContent as lt, PersistenceLifecycle as m, DurableCommandMessage as mt, ReplayableStreamPages as n, ReplayableAggregate as nt, EventStreamReader as o, Id as ot, PersistenceChanges as p, CommandOutboxWriter as pt, stampPendingEvents as q, ClockFactory as qt, reconstituteAggregateFromStreamPages as r, Version as rt, ReadStreamOptions as s, IdGenerator as st, SnapshotStore as t, AggregateSnapshot as tt, AggregateWriteIntent as u, CommandMessageRelationships as ut, Projection as v, Outbox as vt, IdempotencyClaimHandle as w, EventCommitCandidate as wt, ProjectionPosition as x, ExecutionContext as xt, ProjectionCheckpoint as y, OutboxRecord as yt, CommitRegistration as z, UnstampedDomainEvent as zt };
 //# sourceMappingURL=snapshot-store.d.ts.map