@shirudo/ddd-kit 3.0.0-rc.3 → 3.0.0-rc.5

package/dist/chunks/snapshot-store.d.ts

@@ -1,64 +1,194 @@
-import { o as DomainError } from "./errors.js";
+import { l as DomainError } from "./kit-errors.js";
 import { Result } from "@shirudo/result";
-
-//#region src/core/id.d.ts
+//#region src/internal/json-value.d.ts
+/** A primitive value represented without loss by JSON. */
+type JsonPrimitive = boolean | null | number | string;
+/** A recursively JSON-safe value. Runtime validation rejects lossy shapes. */
+type JsonValue = JsonPrimitive | ReadonlyArray<JsonValue> | {
+  readonly [key: string]: JsonValue;
+};
+/** A JSON-safe object. */
+type JsonObject = {
+  readonly [key: string]: JsonValue;
+};
+//#endregion
+//#region src/application/cqrs/command/command.d.ts
 /**
- * Branded string ID. `Tag` carries the aggregate / entity name so two ids
- * with different tags are not assignable to each other even though both
- * are strings at runtime.
+ * Marker interface for Commands.
+ * Commands represent write operations that change system state.
+ * They should be immutable and contain all data needed to perform the operation.
+ *
+ * This interface can be used as a type marker even when using external frameworks
+ * (e.g., RabbitMQ, AWS SQS) to ensure type safety across different bus implementations.
  *
  * @example
- * ```ts
- * type UserId = Id<"UserId">;
- * type OrderId = Id<"OrderId">;
+ * ```typescript
+ * type CreateOrderCommand = Command & {
+ *   type: "CreateOrder";
+ *   customerId: string;
+ *   items: OrderItem[];
+ * };
+ * ```
  *
- * const u = "user-1" as UserId;
- * const o: OrderId = u; // ❌ compile error
+ * @example Using with external frameworks (RabbitMQ, etc.)
+ * ```typescript
+ * // Define command using Command marker
+ * type CreateOrderCommand = Command & {
+ *   type: "CreateOrder";
+ *   customerId: string;
+ * };
+ *
+ * // Handler can be typed with CommandHandler even for external frameworks
+ * const handler: CommandHandler<CreateOrderCommand, OrderId> = async (cmd) => {
+ *   // ... handler logic
+ *   return ok(orderId);
+ * };
+ *
+ * // The consumer owns this runtime decoder. It checks byte and collection
+ * // ceilings, parses to unknown, allow-lists fields, and constructs domain types.
+ * declare function decodeCreateOrderCommand(
+ *   body: Uint8Array,
+ *   principal: AuthenticatedPrincipal,
+ * ): Result<CreateOrderCommand, InvalidCommand>;
+ * declare function decodeMessageId(
+ *   value: unknown,
+ * ): Result<string, InvalidTransportMetadata>;
+ * declare function createOrderDeliveryKey(messageId: string): string;
+ *
+ * // This application service invokes the handler through withIdempotentCommit.
+ * // createOrderDeliveryKey scopes the message id by consumer. The service
+ * // fingerprints the complete CreateOrder intention and commits that claim,
+ * // the aggregate write, outbox entries, and outcome together.
+ * declare function executeIdempotentCreateOrder(
+ *   deliveryKey: string,
+ *   command: CreateOrderCommand,
+ * ): Promise<Result<OrderId, string>>;
+ *
+ * // Register with RabbitMQ or another external bus.
+ * rabbitMQChannel.consume("order.commands", async (message) => {
+ *   const messageId = decodeMessageId(message.properties.messageId);
+ *   if (messageId.isErr()) {
+ *     rabbitMQChannel.reject(message, false); // missing identity: dead-letter
+ *     return;
+ *   }
+ *   const deliveryKey = createOrderDeliveryKey(messageId.value);
+ *   const principal = authenticateProducer(message.properties.headers);
+ *   const decoded = decodeCreateOrderCommand(message.content, principal);
+ *   if (decoded.isErr()) {
+ *     rabbitMQChannel.reject(message, false); // invalid input: dead-letter, do not retry
+ *     return;
+ *   }
+ *   const outcome = await executeIdempotentCreateOrder(
+ *     deliveryKey,
+ *     decoded.value,
+ *   );
+ *   await recordCommandOutcome(deliveryKey, outcome);
+ *   rabbitMQChannel.ack(message);
+ * });
  * ```
  */
-type Id<Tag extends string> = string & {
-  readonly __brand: Tag;
-};
+interface Command {
+  readonly type: string;
+}
 /**
- * Produces fresh ids of a single, fixed tag. The tag is bound at the
- * generator type: `IdGenerator<"UserId">.next()` returns `Id<"UserId">`
- * with no caller-side generic to abuse.
+ * Versioned Published Language for a command that crosses a process or
+ * Bounded-Context boundary. Unlike a local {@link Command}, its payload is
+ * JSON-safe data rather than a domain object graph. Map value objects to their
+ * wire DTOs at this boundary; for example, use `MoneyDto` instead of `Money`.
+ */
+interface PublishedCommand<TType extends string = string, TPayload extends JsonValue = JsonValue> extends Command {
+  readonly type: TType;
+  readonly version: number;
+  readonly payload: TPayload;
+}
+/**
+ * Handler for executing commands.
+ * Commands return Result for explicit error handling.
+ * Commands may modify system state. When a caller can retry or a broker can
+ * redeliver, the application service must enforce idempotency; this handler
+ * type alone does not provide it.
  *
- * **Your factory must produce unique ids under concurrent calls.**
- * The kit makes no attempt to dedupe or detect collisions: a collision
- * silently overwrites earlier rows (under unique-key constraints) or
- * silently aliases two different entities (without them). Safe choices:
- * `crypto.randomUUID()` (UUIDv4, the default for events), ULID, UUIDv7,
- * KSUID: all collision-resistant by design. Unsafe choices: `Date.now()`
- * alone (duplicates within the same millisecond), a process-local
- * counter without persistence (resets to 1 on restart, collides with
- * prior runs), a sequential id derived from non-atomic state.
+ * This type can be used to mark handlers even when using external frameworks
+ * (e.g., RabbitMQ, AWS SQS, Kafka) to ensure type safety and consistency.
+ *
+ * @template C - The command type (must extend Command)
+ * @template R - The result type
+ * @template E - The error channel type. Defaults to `string`; widen it (e.g.
+ *   to a `DomainError` union) to carry typed failures through the bus.
  *
  * @example
- * ```ts
- * import { ulid } from "ulid";
+ * ```typescript
+ * const handler: CommandHandler<CreateOrderCommand, OrderId> = async (cmd) => {
+ *   const order = Order.create(cmd.customerId, cmd.items);
+ *   repository.add(order);
+ *   return ok(order.id);
+ * };
+ * ```
  *
- * const userIds: IdGenerator<"UserId"> = { next: () => ulid() as Id<"UserId"> };
- * const id = userIds.next(); // Id<"UserId">
+ * @example Using with external frameworks
+ * ```typescript
+ * // Handler typed with CommandHandler for type safety
+ * const createOrderHandler: CommandHandler<CreateOrderCommand, OrderId> = async (cmd) => {
+ *   // ... handler logic
+ *   return ok(orderId);
+ * };
+ *
+ * // The broker adapter validates before calling the application handler.
+ * rabbitMQChannel.consume("commands", async (msg) => {
+ *   const messageId = decodeMessageId(msg.properties.messageId);
+ *   if (messageId.isErr()) {
+ *     rabbitMQChannel.reject(msg, false);
+ *     return;
+ *   }
+ *   const deliveryKey = createOrderDeliveryKey(messageId.value);
+ *   const principal = authenticateProducer(msg.properties.headers);
+ *   const decoded = decodeCreateOrderCommand(msg.content, principal);
+ *   if (decoded.isErr()) {
+ *     rabbitMQChannel.reject(msg, false); // malformed or over limit
+ *     return;
+ *   }
+ *   // executeIdempotentCreateOrder invokes createOrderHandler through the same
+ *   // atomic withIdempotentCommit boundary described in the first example.
+ *   const outcome = await executeIdempotentCreateOrder(
+ *     deliveryKey,
+ *     decoded.value,
+ *   );
+ *   await recordCommandOutcome(deliveryKey, outcome);
+ *   rabbitMQChannel.ack(msg);
+ * });
  * ```
+ */
+type CommandHandler<C extends Command, R, E = string> = (cmd: C) => Promise<Result<R, E>>;
+//#endregion
+//#region src/domain/aggregate/aggregate-address.d.ts
+/**
+ * Stable value address of one aggregate instance.
  *
- * The previous shape (`IdGenerator { next<T extends string>(): Id<T> }`)
- * let callers pick `T` themselves: `gen.next<"AnyTag">()` typechecked
- * even when the generator produced different-tag ids, silently defeating
- * the brand.
+ * Aggregate ids are type-scoped, so the raw id alone is not globally unique:
+ * `SalesOrder 1` and `FulfillmentOrder 1` are different aggregates. Event
+ * streams, snapshots, committed-event sources, and projection checkpoints
+ * therefore carry both fields instead of defining boundary-specific variants.
+ *
+ * `aggregateType` is a stable technical stream category. Renaming it changes
+ * persistence keys and orphans checkpoints unless the stored addresses are
+ * migrated. When bounded contexts share infrastructure and reuse a domain
+ * name, qualify it at the source (`sales.order`, `fulfillment.order`). The kit
+ * deliberately adds no separate `boundedContext` field: qualification remains
+ * the consumer's naming decision.
  */
-interface IdGenerator<Tag extends string> {
-  next: () => Id<Tag>;
+interface AggregateAddress<TAggregateId extends string = string> {
+  readonly aggregateType: string;
+  readonly aggregateId: TAggregateId;
 }
 //#endregion
-//#region src/aggregate/clock.d.ts
+//#region src/domain/event/clock.d.ts
 /**
  * Clock function producing a valid `Date` for the current instant.
  * Event-clock reads throw `TypeError` when the result is invalid.
  */
 type ClockFactory = () => Date;
 //#endregion
-//#region src/aggregate/domain-event.d.ts
+//#region src/domain/event/domain-event.d.ts
 /**
  * Factory function producing a fresh, unique event identifier for each call.
  *
@@ -170,9 +300,11 @@ interface DomainEvent<T extends string, P = void> {
    * Use 1 for the initial schema version.
    *
    * This is the event PAYLOAD schema version, not a persisted aggregate
-   * position. Commit positions live on `CommittedDomainEvent`.
+   * position. Commit positions live on `CommittedDomainEvent`. It is
+   * also not `AggregateSnapshot.schemaVersion`: that field versions the
+   * stored snapshot state shape. The two evolve independently.
    */
-  readonly version: number;
+  readonly schemaVersion: number;
   /**
    * Optional metadata for traceability, correlation, and auditing.
    * Includes correlationId, conversationId, causationId, userId, source, and
@@ -200,7 +332,7 @@ interface UncommittedDomainEvent<T extends string, P = void> {
   readonly aggregateId?: string;
   readonly aggregateType?: string;
   readonly payload: P;
-  readonly version: number;
+  readonly schemaVersion: number;
 }
 /** Upper-bound alias for any uncommitted domain-event shape. */
 type AnyUncommittedDomainEvent = UncommittedDomainEvent<string, unknown>;
@@ -212,7 +344,7 @@ type PendingDomainEvent<TEvent extends AnyDomainEvent> = TEvent | UncommittedDom
 interface CreateUncommittedDomainEventOptions {
   readonly aggregateId?: string;
   readonly aggregateType?: string;
-  readonly version?: number;
+  readonly schemaVersion?: number;
 }
 /**
  * Shared option bag for the `createDomainEvent*` factories.
@@ -239,7 +371,7 @@ interface CreateDomainEventOptions {
   /**
    * Override for the default schema version (1).
    */
-  version?: number;
+  schemaVersion?: number;
   /**
    * Event metadata: correlation, causation, user, source, custom fields.
    */
@@ -258,7 +390,7 @@ interface DomainEventStamp {
 interface CreateDomainEventFromFactsOptions extends DomainEventStamp {
   readonly aggregateId?: string;
   readonly aggregateType?: string;
-  readonly version?: number;
+  readonly schemaVersion?: number;
 }
 /** Overrides accepted when an application-shell factory creates a stamp. */
 interface CreateDomainEventStampOptions {
@@ -272,6 +404,15 @@ interface DomainEventFactoryOptions {
   readonly eventIdFactory?: EventIdFactory;
   /** Event-recording clock. Defaults to `() => new Date()`. */
   readonly clock?: ClockFactory;
+  /**
+   * Origin stamped on every event this factory mints, unless the call site
+   * names one itself.
+   *
+   * A plain value, not a factory like the two above. Those produce a new
+   * value for each event. An origin identifies the system that mints them
+   * and does not change between two of them.
+   */
+  readonly source?: string;
 }
 /**
  * Instance-bound event constructor. Each factory permanently captures its
@@ -293,27 +434,6 @@ interface DomainEventFactory {
    */
   readonly now: () => Date;
 }
-/**
- * Creates an immutable, instance-bound domain-event factory.
- *
- * The supplied functions are read once and captured by value. The returned
- * object is frozen, so another request, test, or library cannot replace its
- * policy. Its {@link DomainEventFactory.createStamp} method is the
- * application-shell bridge that records an accepted aggregate decision.
- * Passing the factory through `AggregateConfig`
- * enables the explicitly named convenience methods, whose defaults read time
- * and randomness.
- *
- * @example
- * ```ts
- * const domainEvents = createDomainEventFactory({
- *   eventIdFactory: () => uuidv7(),
- *   clock: () => new Date(),
- * });
- * order.confirm();
- * recordPendingEvents(order, domainEvents);
- * ```
- */
 declare function createDomainEventFactory(options?: DomainEventFactoryOptions): DomainEventFactory;
 /**
  * Immutable UUID-v4/platform-clock factory used by the top-level
@@ -354,7 +474,7 @@ declare function createDomainEventFromFacts<T extends string, P>(type: T, payloa
  * const newEvent = createDomainEvent(
  *   "OrderShipped",
  *   { orderId: "123" },
- *   { metadata: copyMetadata(previousEvent, { causationId: previousEvent.type }) }
+ *   { metadata: copyMetadata(previousEvent, { causationId: previousEvent.eventId }) }
  * );
  * ```
  */
@@ -374,809 +494,502 @@ declare function copyMetadata(sourceEvent: AnyDomainEvent, additionalMetadata?:
  */
 declare function mergeMetadata(...metadataObjects: Array<EventMetadata | undefined>): EventMetadata;
 //#endregion
-//#region src/aggregate/aggregate.d.ts
-type Version = number & {
-  readonly __v: true;
-};
+//#region src/messaging/committed-event.d.ts
 /**
- * Snapshot of an aggregate state at a specific point in time.
- * Used for optimizing event replay by starting from a snapshot
- * instead of replaying all events from the beginning.
- *
- * @template TState - The type of the aggregate state
+ * Gap-proof position finalized by the event source at the persistence
+ * boundary. It is deliberately separate from `DomainEvent`: these values
+ * describe a stored commit, not the business fact itself.
  */
-interface AggregateSnapshot<TState> {
-  /**
-   * The state of the aggregate at the time of the snapshot.
-   */
-  readonly state: TState;
-  /**
-   * The version of the aggregate when the snapshot was taken.
-   */
-  readonly version: Version;
-  /**
-   * Timestamp when the snapshot was created.
-   */
-  readonly snapshotAt: Date;
+interface CommitPosition {
+  /** Aggregate OCC version reached by this eventful commit. */
+  readonly aggregateVersion: number;
+  /** Zero-based event index inside this aggregate commit. */
+  readonly commitSequence: number;
+  /** Total number of events emitted by this aggregate commit. */
+  readonly commitSize: number;
   /**
-   * Schema version of the stored `state` shape, declared by its adapter-owned
-   * `SnapshotModel` and stamped by `captureAggregateSnapshot`. Distinct from
-   * {@link version}, which counts mutations: this field says "which
-   * shape does the stored state have", so a restore can detect a
-   * snapshot written against an older DTO shape and migrate or
-   * discard it instead of crashing later. Optional: absent on snapshots
-   * written by older kit versions, which restore treats as schema `1`.
+   * Aggregate version of the immediately preceding EVENTFUL commit for this
+   * qualified aggregate source, or `null` when this is its first eventful
+   * commit. State-only persistence is intentionally absent from this chain.
+   *
+   * The outbox/event-store adapter owns this value. It must read and advance
+   * the source head atomically with inserting the committed event envelope;
+   * application orchestration cannot derive it from the Unit of Work's OCC
+   * receipt because state-only commits are intentionally absent here.
    */
-  readonly schemaVersion?: number;
+  readonly previousEventfulAggregateVersion: number | null;
 }
 /**
- * Public contract every Aggregate Root satisfies. Implemented by
- * `BaseAggregate` and inherited by both `AggregateRoot` and
- * `EventSourcedAggregate`. Repository ports use this interface as their
- * aggregate type rather than depending on concrete base classes, so persistence
- * orchestration does not take a compile-time
- * dependency on the aggregate hierarchy.
- *
- * Full per-member documentation lives on the concrete `BaseAggregate`
- * class; the interface is intentionally terse to avoid drift. Persistence
- * facts are readable, but acknowledgement and pending-event disposal are not
- * part of this surface. `withCommit` and `UnitOfWork` hold that authority.
- *
- * @template TId    - The aggregate root identifier (branded via `Id<Tag>`)
- * @template TEvent - The domain-event union, defaults to `never`
+ * Commit information known by the application transaction before the outbox
+ * source has linked this eventful commit to its predecessor.
  */
-interface IAggregateRoot<TId extends Id<string>, TEvent extends AnyDomainEvent = never> {
-  readonly id: TId;
-  readonly version: Version;
-  readonly pendingEvents: ReadonlyArray<PendingDomainEvent<TEvent>>;
-}
+type EventCommitCandidatePosition = Omit<CommitPosition, "previousEventfulAggregateVersion">;
 /**
- * Public contract for Event-Sourced Aggregate Roots. Extends
- * `IAggregateRoot` with the replay-from-history boundary.
- *
- * @template TId    - The aggregate root identifier
- * @template TEvent - The union type of all domain events
+ * A bare domain event prepared for the transactional outbox. The outbox source
+ * owns the predecessor link and turns this candidate into a
+ * {@link CommittedDomainEvent} when it persists the record.
  */
-interface IEventSourcedAggregate<TId extends Id<string>, TEvent extends AnyDomainEvent> extends IAggregateRoot<TId, TEvent> {
-  /**
-   * Reconstitutes the aggregate from an event history. Returns
-   * `Result` because event-stream corruption is an expected
-   * recoverable failure at the infrastructure boundary.
-   */
-  loadFromHistory(history: ReadonlyArray<TEvent>): Result<void, DomainError>;
+interface EventCommitCandidate<Evt extends AnyDomainEvent> {
+  readonly event: Evt;
+  readonly source: AggregateAddress;
+  readonly position: EventCommitCandidatePosition;
 }
 /**
- * Checks if two aggregates are at the same version (same ID and version).
- * Useful for optimistic concurrency control checks.
- *
- * Note: Two aggregates with the same ID ARE the same aggregate (identity).
- * This function checks if they are at the same version: i.e., no concurrent modification.
- *
- * @example
- * ```typescript
- * const before = await repository.findById(id);
- * // ... some operations ...
- * const after = await repository.findById(id);
- *
- * if (!sameVersion(before, after)) {
- *   throw new Error("Aggregate was modified by another process");
- * }
- * ```
+ * A domain event enriched after persistence has established its source and
+ * commit position. Outboxes and projectors consume this envelope; in-process
+ * domain handlers continue to consume the bare {@link DomainEvent} value.
  */
-declare function sameVersion<TId extends Id<string>>(a: {
-  id: TId;
-  version: Version;
-}, b: {
-  id: TId;
-  version: Version;
-}): boolean;
+interface CommittedDomainEvent<Evt extends AnyDomainEvent> {
+  readonly event: Evt;
+  readonly source: AggregateAddress;
+  readonly position: CommitPosition;
+}
 //#endregion
-//#region src/aggregate/aggregate-address.d.ts
-/**
- * Stable value address of one aggregate instance.
- *
- * Aggregate ids are type-scoped, so the raw id alone is not globally unique:
- * `SalesOrder 1` and `FulfillmentOrder 1` are different aggregates. Event
- * streams, snapshots, committed-event sources, and projection checkpoints
- * therefore carry both fields instead of defining boundary-specific variants.
- *
- * `aggregateType` is a stable technical stream category. Renaming it changes
- * persistence keys and orphans checkpoints unless the stored addresses are
- * migrated. When bounded contexts share infrastructure and reuse a domain
- * name, qualify it at the source (`sales.order`, `fulfillment.order`). The kit
- * deliberately adds no separate `boundedContext` field: qualification remains
- * the consumer's naming decision.
- */
-interface AggregateAddress<TAggregateId extends string = string> {
-  readonly aggregateType: string;
-  readonly aggregateId: TAggregateId;
+//#region src/internal/async/execution.d.ts
+/** Cancellation and deadline controls for one bounded shell operation. */
+interface ExecutionContext {
+  /** Cooperative cancellation for the in-flight operation. */
+  readonly signal: AbortSignal;
+  /** Absolute Unix epoch millisecond at which the shell stops waiting. */
+  readonly deadlineAt: number;
 }
 //#endregion
-//#region src/entity/entity.d.ts
-/** A pure invariant check that throws when a candidate state is invalid. */
-type StateValidator<TState> = (state: TState) => void;
+//#region src/messaging/outbox/ports.d.ts
 /**
- * Construction options shared by `Entity` and (via `AggregateConfig`) the
- * aggregate base classes.
+ * One pending event in the outbox plus the opaque id the implementation
+ * needs to ack it via `markDispatched`. The library does not prescribe
+ * what `dispatchId` looks like: an implementation can reuse the event's
+ * own `eventId`, generate its own UUID, use the row's auto-increment
+ * primary key, or whatever the storage layer prefers.
  */
-interface EntityConfig<TState = unknown> {
+interface OutboxRecord<Evt extends AnyDomainEvent> extends CommittedDomainEvent<Evt> {
+  dispatchId: string;
   /**
-   * Pure state-invariant validator captured by the entity instance. It runs
-   * against the exact frozen state stored during construction and every
-   * {@link Entity.setState} call. Throw to reject the candidate state.
-   *
-   * Passing validation as data avoids virtual dispatch from the base
-   * constructor: the function cannot observe partly initialised subclass
-   * fields through `this`. Close over immutable policy supplied to the
-   * concrete constructor when validation needs instance-specific inputs.
+   * Failed delivery attempts so far. Populated by implementations that
+   * track dispatch failures (see {@link DispatchTrackingOutbox});
+   * plain `Outbox` implementations may omit it.
    */
-  readonly validateState?: StateValidator<TState>;
+  attempts?: number;
+}
+/** A record that exhausted its delivery attempts; see {@link DispatchTrackingOutbox.deadLetters}. */
+interface DeadLetterRecord<Evt extends AnyDomainEvent> extends CommittedDomainEvent<Evt> {
+  dispatchId: string;
+  /** Failed delivery attempts when the record was dead-lettered. */
+  attempts: number;
+  /** Human-readable rendering of the last delivery error, if recorded. */
+  lastError?: string;
+}
+/**
+ * Write half of the transactional outbox: the only outbox capability the
+ * write side (`withCommit`, `UnitOfWork`) depends on. Persisting the
+ * events atomically with the aggregate state is the kit's guarantee;
+ * DELIVERY is a separate, replaceable concern.
+ *
+ * Implement ONLY this interface to plug in an external delivery
+ * solution: `add()` writes into that solution's outbox storage inside
+ * the ambient transaction, and its own listener (polling or
+ * WAL/CDC-based, such as a Debezium-style connector, a delivery
+ * library, or a broker-native outbox) owns delivery entirely. The
+ * kit-side poll surface ({@link Outbox}) is then never involved. See
+ * the outbox guide, "External dispatchers".
+ */
+interface OutboxWriter<Evt extends AnyDomainEvent> {
   /**
-   * Opt-in: freeze the WHOLE state graph (via `deepFreeze`) instead of
-   * the default shallow freeze. This protects against nested aliases
-   * retained by constructor callers and against accidental in-place
-   * writes inside the entity; live state itself is never public.
+   * Finalizes and persists event commit candidates. Called from inside
+   * `withCommit`'s transactional callback, atomically with the aggregate
+   * write.
+   *
+   * For every qualified aggregate source, the adapter must serialize source
+   * advancement, read its last eventful aggregate version, write that value as
+   * `previousEventfulAggregateVersion` on every event in the candidate's
+   * commit, and advance the source head to `aggregateVersion` in the SAME
+   * transaction. A state-only aggregate commit does not call `add()` and must
+   * therefore not advance this event-source head.
    *
-   * Defaults to `false` (the documented shallow contract): deep freezing
-   * costs a full state-graph walk on every state write, which is why it
-   * is not the default on hot paths.
+   * A qualified source position `(aggregateType, aggregateId,
+   * aggregateVersion, commitSequence)` MUST identify one immutable event. All
+   * candidates for the same aggregate commit MUST also agree on `commitSize`.
+   * Enforce both constraints before advancing the source head; a conflicting
+   * retry must reject without replacing the stored event or changing the head.
    *
-   * **Only for plain-data states.** The deep freeze walks the entire
-   * graph: a class-based child entity inside the state would be frozen
-   * too, and its own mutation methods would start throwing. States
-   * carrying class-based children must keep the default shallow freeze.
-   * Note that the ownership transfer widens accordingly: nested objects
-   * passed into the constructor or `setState` are frozen IN PLACE (the
-   * shallow copy protects only the top-level input object).
-   */
-  deepFreezeState?: boolean;
+   * **Idempotency:** implementations should dedupe on
+   * `candidate.event.eventId`. `withCommit` itself does not retry, but the
+   * surrounding use case (a queue consumer, an HTTP retry, a transactional
+   * outbox-dispatcher loop) may legitimately invoke the same write more than
+   * once. A unique-key constraint on `(eventId)` in the outbox table is the
+   * standard implementation; the source-head update and dedupe decision must
+   * share the transaction. Idempotency applies only to an exact candidate
+   * retry: the same event ID, qualified source, aggregate version, commit
+   * sequence, and commit size. Reusing an `eventId` for another source or
+   * position is a caller bug: adapters that retain the conflicting record
+   * should reject it rather than replace or silently reinterpret it as a retry.
+   */
+  add: (events: ReadonlyArray<EventCommitCandidate<Evt>>) => Promise<void>;
 }
 /**
- * Functional definition of an Entity via its capability: an object is
- * identifiable if it has an `id`.
+ * Transactional outbox port: the bridge between the write-side
+ * transaction and the (out-of-band) event dispatcher.
  *
- * `TId` is constrained to `Id<string>` so the brand discipline that
- * `Id<Tag>` enforces is preserved end-to-end: an `Identifiable<UserId>`
- * cannot accidentally be paired with an `Identifiable<OrderId>` or with
- * a plain `string`.
- */
-type Identifiable<TId extends Id<string>> = {
-  readonly id: TId;
-};
-/**
- * Interface for Entities with state.
+ * Lifecycle:
+ *  1. `add()` inside the write transaction (`withCommit` calls this) so
+ *     events persist atomically with the aggregate state
+ *     ({@link OutboxWriter}, the only part the write side needs).
+ *  2. An outbox dispatcher (the kit's `OutboxDispatcher` or your own)
+ *     polls `getPending()` and forwards the events to subscribers /
+ *     external brokers.
+ *  3. After successful dispatch, the dispatcher calls `markDispatched()`
+ *     with the records' `dispatchId`s so they don't come back next poll.
  *
- * In Domain-Driven Design, Entities have:
- * - Identity (id): Distinguishes one entity from another
- * - State: The attributes/properties of the entity
+ * `markDispatched` is required to be idempotent: calling it with an id
+ * that's already marked is a no-op, not an error. This lets the
+ * dispatcher safely retry on partial-failure.
  *
- * Unlike Value Objects (which are immutable and compared by value),
- * Entities are compared by identity and can have mutable state.
+ * **Competing dispatcher instances** are an adapter contract, not a
+ * dispatcher feature: a transactional implementation that should
+ * support several concurrent pollers must make `getPending` claim the
+ * returned records (`FOR UPDATE SKIP LOCKED` or equivalent). Without
+ * claiming, run one logical dispatcher per outbox.
  *
- * @template TId - The type of the entity identifier
+ * The bundled dispatcher supplies an {@link ExecutionContext} to every poll-side
+ * operation. Production adapters MUST pass its signal to native I/O or enforce
+ * a native timeout no later than `deadlineAt`; the shell can bound its wait but
+ * cannot terminate a promise that ignores cancellation. A timed-out write has
+ * an unknown outcome. Acknowledgements must remain idempotent when they complete
+ * late; a late failure update may count its original delivery attempt and must
+ * still no-op after the record was dispatched.
  */
-interface IEntity<TId extends Id<string>> extends Identifiable<TId> {
+interface Outbox<Evt extends AnyDomainEvent> extends OutboxWriter<Evt> {
   /**
-   * Unique identifier of the entity.
+   * Returns up to `limit` outbox records that have not yet been
+   * dispatched, **in the order `add()` persisted them** (commit order).
+   * The ordering is part of the port contract: `withCommit` promises
+   * subscribers per-aggregate causal order, and a sequential dispatcher
+   * can only honor that promise when this read is ordered. SQL-backed
+   * implementations need a monotonic position column (an auto-increment
+   * primary key works) and an `ORDER BY` on it; a bare `SELECT` returns
+   * rows in storage order, not insertion order. The dispatcher polls
+   * this on a schedule. When `limit` is omitted, the implementation
+   * decides on a default page size. The bundled dispatcher always supplies
+   * `context`; it is optional only so existing adapters remain assignable.
    */
-  readonly id: TId;
+  getPending: (limit?: number, context?: ExecutionContext) => Promise<ReadonlyArray<OutboxRecord<Evt>>>;
+  /**
+   * Marks the given dispatch records as delivered so subsequent
+   * `getPending` calls don't return them. Must be idempotent on
+   * already-marked ids, including a late completion after the caller's
+   * storage deadline. The bundled dispatcher always supplies `context`.
+   */
+  markDispatched: (dispatchIds: ReadonlyArray<string>, context?: ExecutionContext) => Promise<void>;
 }
 /**
- * Abstract base class for Entities with state.
- *
- * Provides:
- * - Identity management (id)
- * - State management
- * - Instance-bound pure state validation
- * - Protected state access for domain behavior
- *
- * This is the foundation for all Entities in DDD:
- * - Child Entities within aggregates can extend this
- * - Aggregate Roots extend this and add version + events
- *
- * @template TState - The type of the entity state
- * @template TId - The type of the entity identifier
- *
- * @example
- * ```typescript
- * // Child Entity within an aggregate
- * const validateOrderItemState = (state: OrderItemState): void => {
- *   if (state.quantity < 1) throw new Error("quantity must be positive");
- * };
- *
- * class OrderItem extends Entity<OrderItemState, ItemId> {
- *   constructor(id: ItemId, initialState: OrderItemState) {
- *     super(id, initialState, { validateState: validateOrderItemState });
- *   }
+ * Optional extension of {@link Outbox} for dispatchers that track
+ * delivery failures. Without failure tracking, a poison message (an
+ * event whose delivery always throws) is redelivered forever: it comes
+ * back from every `getPending` poll, blocks per-aggregate ordering
+ * behind it, and burns the dispatcher's cycles. This extension gives
+ * the dispatcher a bounded-retry story: report each failed delivery via
+ * {@link markFailed}; the implementation moves records past its
+ * attempt ceiling to a dead-letter set that `getPending` no longer
+ * returns, and {@link deadLetters} exposes them for alerting, manual
+ * inspection, and redelivery (deliver by hand, then ack via
+ * `markDispatched`, which also clears dead-lettered records).
  *
- *   updateQuantity(quantity: number): void {
- *     // setState runs validateState and re-freezes; a direct
- *     // `this._state = ...` assignment would skip both.
- *     this.setState({ ...this.state, quantity });
- *   }
- * }
- * ```
+ * See the outbox guide's dispatcher recipe for the retry-then-dead-letter
+ * loop this port shape supports.
  */
-declare abstract class Entity<TState, TId extends Id<string>> implements IEntity<TId> {
-  readonly id: TId;
+interface DispatchTrackingOutbox<Evt extends AnyDomainEvent> extends Outbox<Evt> {
   /**
-   * Returns the live state to subclass domain behavior.
-   *
-   * This accessor is deliberately protected: returning the generic
-   * `TState` publicly would expose the aggregate's live object graph and
-   * let nested mutation bypass behavior, validation, versioning, and
-   * dirty tracking. Concrete entities should expose business-meaningful queries or
-   * detached immutable DTOs. Snapshot projection belongs to an adapter-owned
-   * `SnapshotModel`; persistence code captures an aggregate with
-   * `captureAggregateSnapshot(model, aggregate, snapshotAt)` rather than
-   * asking the entity to create its own persistence memento.
-   */
-  protected get state(): TState;
-  /**
-   * The state is `protected` so that only the subclass can modify it.
-   * Ordinary entity behavior must use {@link setState}; direct assignment
-   * skips instance-bound validation. Kit event-sourcing internals use direct
-   * assignment deliberately because historical evolution must not run
-   * today's decision validator.
-   */
-  protected _state: TState;
-  private readonly _deepFreezeState;
-  private readonly validateState;
-  /**
-   * **State ownership.** Plain-object and array states are shallow-copied
-   * before the freeze, so the caller's own object stays mutable. A CLASS
-   * INSTANCE passed as state is an ownership transfer: it is frozen
-   * in place (a copy would strip its prototype). Do not keep mutating
-   * the instance after handing it to the entity. The same contract
-   * applies to {@link setState}. With
-   * {@link EntityConfig.deepFreezeState} enabled, the ownership transfer
-   * widens to the whole graph: NESTED objects are frozen in place too.
-   *
-   * @throws HostileStateKeyError when a plain-object, null-prototype,
-   * or array state carries an own `"__proto__"` data key; validate and
-   * strip untrusted input at the boundary.
-   */
-  protected constructor(id: TId, initialState: TState, config?: EntityConfig<TState>);
-  /**
-   * Freezes a state value according to this entity's configured freeze
-   * mode: the default shallow freeze, or `deepFreeze` when
-   * {@link EntityConfig.deepFreezeState} was enabled at construction.
-   * Infrastructure-style subclass code that deliberately assigns
-   * `this._state` directly must freeze through this method, not
-   * `freezeShallow`, or the opt-in silently degrades to shallow for that
-   * path. Ordinary domain behavior should use {@link setState} instead.
-   */
-  protected freezeState(value: TState): TState;
-  /**
-   * Sets the state of the entity.
-   * This is a convenience method for state mutations.
-   * Automatically validates `newState` with the instance-bound
-   * {@link EntityConfig.validateState} function.
-   *
-   * Plain-object and array states are shallow-copied before the freeze
-   * (the caller's object stays mutable); a class-instance state is an
-   * ownership transfer and is frozen in place; see the constructor.
-   *
-   * @param newState - The new state
-   * @throws HostileStateKeyError when the state carries an own
-   * `"__proto__"` data key; the previous state is kept.
+   * Records one failed delivery attempt for the given record:
+   * increments its attempt count (surfaced as
+   * {@link OutboxRecord.attempts}) and, once the implementation's
+   * ceiling is reached, moves the record to the dead-letter set.
+   * A no-op for unknown or already-dispatched ids (a late failure
+   * report after a successful retry must not resurrect the record).
+   * Returns the exact dead-letter record only on the call that performs
+   * that transition; retries below the ceiling and no-ops return
+   * `undefined`. This lets productive pollers emit an immediate signal
+   * without scanning the durable dead-letter set after every failure. A late
+   * completion may count that original delivery attempt; it must still no-op if
+   * the record was dispatched in the meantime. The bundled dispatcher never
+   * reissues the same store call and always supplies `context`.
+   */
+  markFailed: (dispatchId: string, error?: unknown, context?: ExecutionContext) => Promise<DeadLetterRecord<Evt> | undefined>;
+  /**
+   * Records that exhausted their delivery attempts. They no longer
+   * come back from `getPending`; wire this to durable alerting and
+   * reconciliation so poison messages surface even if the poller stops
+   * between this store transition and its immediate observer callback.
    */
-  protected setState(newState: TState): void;
+  deadLetters: () => Promise<ReadonlyArray<DeadLetterRecord<Evt>>>;
 }
+//#endregion
+//#region src/application/cqrs/command/command-outbox.d.ts
 /**
- * Shallow-freezes `value` when it's a non-null object or array, so that
- * direct property writes throw in strict mode. Returns the value as-is for
- * primitives. Used internally by `Entity` (via `freezeState`, which picks
- * shallow or deep per the `deepFreezeState` config) to prevent outside
- * mutation of state read through the `state` getter without paying the
- * cost of a deep clone on every read.
- *
- * Subclass code that assigns `this._state` directly should freeze through
- * the protected `freezeState(value)` method rather than calling this
- * helper, so the configured freeze mode is honored. The export remains
- * for consumers using it as a standalone utility.
+ * Business relationships and technical trace context selected explicitly for
+ * an outgoing command. Correlation/conversation explain the business flow;
+ * W3C Trace Context connects technical spans.
  */
-declare function freezeShallow<T>(value: T): T;
+interface CommandMessageRelationships {
+  /** Groups messages that belong to one operation or trace. */
+  readonly correlationId?: string;
+  /** Groups every message in one long-running business interaction. */
+  readonly conversationId?: string;
+  /** W3C Trace Context parent for technical distributed tracing. */
+  readonly traceparent?: string;
+  /** Optional vendor trace state associated with `traceparent`. */
+  readonly tracestate?: string;
+}
 /**
- * Checks if two entities have the same ID.
- * Works with any object that has an 'id' property.
- *
- * @param a - First entity
- * @param b - Second entity
- * @returns true if both entities have the same ID, false otherwise
- *
- * @example
- * ```typescript
- * const item1: OrderItem = { id: itemId1, productId: "prod-1", quantity: 2 };
- * const item2: OrderItem = { id: itemId2, productId: "prod-2", quantity: 1 };
+ * Application-owned Published Language produced from one private domain or
+ * process event. `destination` names one receiver contract; it is deliberately
+ * required because a command is an instruction, not a broadcast fact.
  *
- * sameEntity(item1, item2); // false
- * sameEntity(item1, item1); // true
- * ```
+ * The command carries a stable schema `version` and JSON-safe `payload`.
+ * Domain value objects are translated to wire DTOs by the mapper before this
+ * boundary.
  */
-declare function sameEntity<TId extends Id<string>>(a: Identifiable<TId>, b: Identifiable<TId>): boolean;
+interface CommandMessageContent<C extends PublishedCommand> extends CommandMessageRelationships {
+  readonly destination: string;
+  readonly command: C;
+}
 /**
- * Finds an entity by ID in a collection.
- * Returns undefined if not found.
- *
- * @param entities - Array of entities to search
- * @param id - The ID to search for
- * @returns The entity if found, undefined otherwise
- *
- * @example
- * ```typescript
- * const items: OrderItem[] = [
- *   { id: itemId1, productId: "prod-1", quantity: 2 },
- *   { id: itemId2, productId: "prod-2", quantity: 1 }
- * ];
+ * Immutable, JSON-safe command envelope stored for later at-least-once
+ * delivery.
  *
- * const item = findEntityById(items, itemId1);
- * // item is { id: itemId1, productId: "prod-1", quantity: 2 }
- * ```
+ * `causationId` always identifies the private event whose accepted decision
+ * requested this command. The mapper cannot replace it with a weaker
+ * correlation. Consumer-produced events should in turn use `messageId` as
+ * their causation id.
  */
-declare function findEntityById<TId extends Id<string>, T extends Identifiable<TId>>(entities: ReadonlyArray<T>, id: TId): T | undefined;
+interface DurableCommandMessage<C extends PublishedCommand> extends CommandMessageContent<C> {
+  readonly messageId: string;
+  readonly recordedAt: string;
+  readonly causationId: string;
+}
 /**
- * Checks if an entity with the given ID exists in the collection.
- *
- * @param entities - Array of entities to search
- * @param id - The ID to check for
- * @returns true if an entity with the ID exists, false otherwise
- *
- * @example
- * ```typescript
- * const items: OrderItem[] = [
- *   { id: itemId1, productId: "prod-1", quantity: 2 }
- * ];
- *
- * hasEntityId(items, itemId1); // true
- * hasEntityId(items, itemId2); // false
- * ```
+ * Receipt for the private event that requested one command batch. It retains
+ * commit identity and ordering without putting the private event or its
+ * payload into the command outbox.
  */
-declare function hasEntityId<TId extends Id<string>, T extends Identifiable<TId>>(entities: ReadonlyArray<T>, id: TId): boolean;
+interface CommandCommitOriginCandidate {
+  readonly eventId: string;
+  readonly source: AggregateAddress;
+  readonly position: EventCommitCandidatePosition;
+}
 /**
- * Removes an entity with the given ID from the collection. Returns the
- * ORIGINAL array when the id is absent (structural sharing for the
- * reference-based dirty tracking; see `updateEntityById`), otherwise a
- * new array without the entity.
- *
- * @param entities - Array of entities
- * @param id - The ID of the entity to remove
- * @returns A new array without the entity with the given ID
+ * One private process-event commit and the exact commands it requested.
+ * `messages` may be empty: the receipt still advances the originating source
+ * and makes an exact retry distinguishable from a missing commit.
+ */
+interface CommandOutboxCommitCandidate<C extends PublishedCommand> {
+  readonly origin: CommandCommitOriginCandidate;
+  readonly messages: ReadonlyArray<DurableCommandMessage<C>>;
+}
+/**
+ * Write port for a dedicated transactional command outbox.
  *
- * @example
- * ```typescript
- * const items: OrderItem[] = [
- *   { id: itemId1, productId: "prod-1", quantity: 2 },
- *   { id: itemId2, productId: "prod-2", quantity: 1 }
- * ];
+ * The adapter is bound to the same ambient transaction as the aggregate or
+ * event-stream repository. It must persist the complete input atomically,
+ * retain input order, deduplicate exact retries by `origin.eventId`, and reject
+ * a reused origin id whose source, position, or messages differ. It also owns
+ * the durable source cursor represented by `origin.position`; an empty command
+ * batch still advances that cursor.
  *
- * const updated = removeEntityById(items, itemId1);
- * // updated is [{ id: itemId2, productId: "prod-2", quantity: 1 }]
- * ```
+ * Delivery is out of band and at least once. A consumer therefore uses
+ * `message.messageId` as its idempotency key and acknowledges only after the
+ * command result has been stored.
  */
-declare function removeEntityById<TId extends Id<string>, T extends Identifiable<TId>>(entities: ReadonlyArray<T>, id: TId): ReadonlyArray<T>;
+interface CommandOutboxWriter<C extends PublishedCommand> {
+  add(commits: ReadonlyArray<CommandOutboxCommitCandidate<C>>): Promise<void>;
+}
+/** Maps one private accepted event to zero or more addressed commands. */
+type CommandOutboxMapper<Evt extends AnyDomainEvent, C extends PublishedCommand> = (event: Evt) => ReadonlyArray<CommandMessageContent<C>>;
 /**
- * Updates an entity with the given ID in the collection.
- * Returns a new array with the updated entity.
- * Structural sharing for adapter-owned persistence projections: returns
- * the ORIGINAL array when nothing changed (no match, or the element kept
- * its reference), so a partial-write adapter can skip the untouched
- * collection; a new array only when an
- * element reference actually changed. The result is `ReadonlyArray<T>`:
- * it may BE the (possibly frozen) input; spread it if you need a mutable
- * copy.
- *
- * @param entities - Array of entities
- * @param id - The ID of the entity to update
- * @param updater - Function that takes the entity and returns the updated entity
- * @returns A new array with the updated entity
+ * Adapts a dedicated command outbox to the event-candidate write port consumed
+ * by `withCommit`.
+ *
+ * Mapping happens inside the transaction, before the command outbox write.
+ * The private event is used only at this boundary and is reduced to an origin
+ * receipt. The helper never publishes it or copies its payload implicitly; the
+ * application mapper selects and translates the data that belongs in the
+ * versioned Published Language. The route rejects values JSON would lose or
+ * change before it calls the adapter.
+ * Every command gets a stable id derived from the event id and its zero-based
+ * order, so an exact transaction retry produces the same rows.
  *
- * @example
- * ```typescript
- * const items: OrderItem[] = [
- *   { id: itemId1, productId: "prod-1", quantity: 2 }
- * ];
- *
- * const updated = updateEntityById(items, itemId1, (item) => ({
- *   ...item,
- *   quantity: item.quantity + 1
- * }));
- * // updated is [{ id: itemId1, productId: "prod-1", quantity: 3 }]
- * ```
+ * Omit `withCommit`'s in-process `bus` for private process events. Participants
+ * consume the durable command messages from their explicitly named
+ * destinations, while event-stream replay only rebuilds process state.
  */
-declare function updateEntityById<TId extends Id<string>, T extends Identifiable<TId>>(entities: ReadonlyArray<T>, id: TId, updater: (entity: T) => T): ReadonlyArray<T>;
+declare function routeEventsToCommandOutbox<C extends PublishedCommand, Evt extends AnyDomainEvent = AnyDomainEvent>(outbox: CommandOutboxWriter<C>, mapper: CommandOutboxMapper<Evt, C>): OutboxWriter<Evt>;
+//#endregion
+//#region src/domain/identity/id.d.ts
 /**
- * Replaces an entity with the given ID in the collection.
- * Returns a new array with the replaced entity.
- * Structural sharing for adapter-owned persistence projections: returns
- * the ORIGINAL array when nothing changed (no match, or the element kept
- * its reference), so a partial-write adapter can skip the untouched
- * collection; a new array only when an
- * element reference actually changed. The result is `ReadonlyArray<T>`:
- * it may BE the (possibly frozen) input; spread it if you need a mutable
- * copy.
- *
- * @param entities - Array of entities
- * @param id - The ID of the entity to replace
- * @param replacement - The replacement entity
- * @returns A new array with the replaced entity
+ * Branded string ID. `Tag` carries the aggregate / entity name so two ids
+ * with different tags are not assignable to each other even though both
+ * are strings at runtime.
  *
  * @example
- * ```typescript
- * const items: OrderItem[] = [
- *   { id: itemId1, productId: "prod-1", quantity: 2 }
- * ];
- *
- * const updated = replaceEntityById(items, itemId1, {
- *   id: itemId1,
- *   productId: "prod-1",
- *   quantity: 5
- * });
+ * ```ts
+ * type UserId = Id<"UserId">;
+ * type OrderId = Id<"OrderId">;
+ *
+ * const u = "user-1" as UserId;
+ * const o: OrderId = u; // ❌ compile error
  * ```
  */
-declare function replaceEntityById<TId extends Id<string>, T extends Identifiable<TId>>(entities: ReadonlyArray<T>, id: TId, replacement: T): ReadonlyArray<T>;
+type Id<Tag extends string> = string & {
+  readonly __brand: Tag;
+};
 /**
- * Extracts all IDs from a collection of entities.
+ * Produces fresh ids of a single, fixed tag. The tag is bound at the
+ * generator type: `IdGenerator<"UserId">.next()` returns `Id<"UserId">`
+ * with no caller-side generic to abuse.
  *
- * @param entities - Array of entities
- * @returns Array of entity IDs
+ * **Your factory must produce unique ids under concurrent calls.**
+ * The kit makes no attempt to dedupe or detect collisions: a collision
+ * silently overwrites earlier rows (under unique-key constraints) or
+ * silently aliases two different entities (without them). Safe choices:
+ * `crypto.randomUUID()` (UUIDv4, the default for events), ULID, UUIDv7,
+ * KSUID: all collision-resistant by design. Unsafe choices: `Date.now()`
+ * alone (duplicates within the same millisecond), a process-local
+ * counter without persistence (resets to 1 on restart, collides with
+ * prior runs), a sequential id derived from non-atomic state.
  *
  * @example
- * ```typescript
- * const items: OrderItem[] = [
- *   { id: itemId1, productId: "prod-1", quantity: 2 },
- *   { id: itemId2, productId: "prod-2", quantity: 1 }
- * ];
+ * ```ts
+ * import { ulid } from "ulid";
  *
- * const ids = entityIds(items);
- * // ids is [itemId1, itemId2]
+ * const userIds: IdGenerator<"UserId"> = { next: () => ulid() as Id<"UserId"> };
+ * const id = userIds.next(); // Id<"UserId">
  * ```
+ *
+ * The previous shape (`IdGenerator { next<T extends string>(): Id<T> }`)
+ * let callers pick `T` themselves: `gen.next<"AnyTag">()` typechecked
+ * even when the generator produced different-tag ids, silently defeating
+ * the brand.
  */
-declare function entityIds<TId extends Id<string>, T extends Identifiable<TId>>(entities: ReadonlyArray<T>): TId[];
+interface IdGenerator<Tag extends string> {
+  next: () => Id<Tag>;
+}
 //#endregion
-//#region src/aggregate/base-aggregate.d.ts
-/** Construction options shared by state-stored and event-sourced aggregates. */
-type AggregateConfig<TState = unknown> = EntityConfig<TState>;
+//#region src/domain/aggregate/aggregate.d.ts
+type Version = number & {
+  readonly __v: true;
+};
+/**
+ * Brands a stored number as an aggregate {@link Version}. A version is a
+ * safe integer of at least zero. Use it in repository adapters instead of
+ * a cast, so a corrupt row value fails here with {@link InvalidVersionError}
+ * and never reaches the optimistic-concurrency cursor.
+ */
+declare function toVersion(value: number): Version;
 /**
- * Shared base for both `AggregateRoot` (state-stored) and
- * `EventSourcedAggregate`. Carries the lifecycle machinery that's
- * identical across the two flavours: current version, pending-event
- * tracking, the kit-internal post-commit acknowledgement capability,
- * the `markRestored` post-load marker, and the `createEvent` helper
- * that auto-injects `aggregateId` + `aggregateType` on every event the
- * aggregate emits. The application shell records the pending decisions
- * with `recordPendingEvents` before persistence.
- *
- * Consumers do NOT extend this class directly; extend
- * `AggregateRoot` for state-stored aggregates or
- * `EventSourcedAggregate` for event-sourced ones. The split between
- * those two reflects the canonical Vernon §8 (state-stored) /
- * Vernon §11 + Greg Young (event-sourced) distinction in how state
- * is represented; the lifecycle machinery is the same for both.
+ * Snapshot of an aggregate state at a specific point in time.
+ * Used for optimizing event replay by starting from a snapshot
+ * instead of replaying all events from the beginning.
  *
  * @template TState - The type of the aggregate state
- * @template TId    - The aggregate root identifier
- * @template TEvent - The domain-event union. Defaults to `never` so
- *   aggregates without a declared event type cannot emit events
- *   (emitting any event becomes a compile error).
  */
-declare abstract class BaseAggregate<TState, TId extends Id<string>, TEvent extends AnyDomainEvent = never> extends Entity<TState, TId> implements IAggregateRoot<TId, TEvent> {
-  /**
-   * The aggregate's domain type as a string, used to populate
-   * `aggregateType` on events created via {@link createEvent}.
-   *
-   * Subclasses MUST declare this as a string literal:
-   *
-   * ```ts
-   * class Order extends AggregateRoot<OrderState, OrderId, OrderEvent> {
-   *   protected readonly aggregateType = "Order";
-   * }
-   * ```
-   *
-   * The string is *the* identifier downstream consumers (outbox
-   * dispatchers, projection handlers, audit logs) use to route by
-   * aggregate kind. Use the same canonical name across your system;
-   * matching the class name is the obvious choice, but the value
-   * comes from this explicit declaration, not `constructor.name`
-   * (which is fragile under minification, bundler transforms, and
-   * subclass renaming).
-   */
-  protected abstract readonly aggregateType: string;
-  private _version;
-  /**
-   * Version the persistence layer last confirmed for this instance:
-   * `undefined` until the aggregate is reconstituted (`markRestored`) or a
-   * commit is acknowledged. Kit-internal via the lifecycle capability; it
-   * grounds the `withCommit` unique-cursor guard so an eventful commit that
-   * did not advance beyond the persisted row is rejected deterministically.
-   */
-  private _persistedVersion;
-  private _pendingEvents;
-  protected constructor(id: TId, initialState: TState, config?: AggregateConfig<TState>);
-  private acknowledgePendingEvents;
-  /**
-   * Post-commit cleanup for the deleted disposition. The row is gone, so
-   * there is no persisted version to advance: stamping the marker from the
-   * live instance would make a later legitimate re-enrollment of this
-   * instance trip the unique-cursor guard for a row that does not exist.
-   */
-  private discardPendingEventsAfterDeletion;
-  private stripAcknowledgedPrefix;
-  get version(): Version;
-  /**
-   * Read-only list of domain events recorded on this aggregate that
-   * have not yet been flushed to the outbox / persistence layer.
-   */
-  get pendingEvents(): ReadonlyArray<PendingDomainEvent<TEvent>>;
-  /**
-   * Count-only accessor for internal aggregate paths: the public
-   * {@link pendingEvents} getter allocates and freezes
-   * a defensive copy per read, which a length check does not need.
-   */
-  protected get pendingEventCount(): number;
-  protected setVersion(version: Version): void;
-  /**
-   * Manually bumps the aggregate version. Used by state-stored
-   * aggregates' `setState()` / `commit()` paths and by the
-   * event-sourced replay path after each applied event.
-   */
-  protected bumpVersion(): void;
-  /**
-   * **Lifecycle marker, Post-Load.** Syncs both `_version` and
-   * the current version to the stored version. Used by
-   * `reconstitute(...)` factories to assemble an in-memory aggregate
-   * from a persisted row.
-   *
-   * The Factory-vs-Reconstitution distinction (Vernon §11) is honoured
-   * structurally: reconstitution stays inside the aggregate factory while
-   * post-commit acknowledgement belongs to application commit orchestration.
-   *
-   * If you override this, call `super.markRestored(version)` so the current
-   * domain version remains aligned with the reconstituted facts.
-   *
-   * @param version - The version the row currently holds in the DB
-   *
-   * @example
-   * ```ts
-   * static reconstitute(id: OrderId, state: OrderState, version: Version): Order {
-   *   const order = new Order(id, state);
-   *   order.markRestored(version);
-   *   return order;
-   * }
-   * ```
-   */
-  protected markRestored(version: Version): void;
-  /**
-   * Appends a domain event to the pending list. Prefer the higher-level
-   * `AggregateRoot.commit()` (state-stored) or `EventSourcedAggregate.apply()`
-   * (event-sourced) call sites, both of which wrap `addDomainEvent` in the
-   * canonical record-AFTER-mutation order (Vernon §8). Calling
-   * `addDomainEvent` directly is appropriate only after a version-advancing
-   * state mutation, or while constructing a never-persisted aggregate.
-   * An event-only commit on an already-persisted aggregate has no unique
-   * cursor and `withCommit` rejects it; use `commit(currentState, event)`.
-   */
-  protected addDomainEvent(event: PendingDomainEvent<TEvent>): void;
+interface AggregateSnapshot<TState> {
   /**
-   * Immutability gate for every recording path: only events minted by
-   * the kit's constructors (`createDomainEvent`,
-   * `createDomainEventFromFacts`, `createEvent`) pass,
-   * checked against the constructor's internal, unforgeable mint
-   * marker. Minted implies deeply frozen with defensively copied
-   * payload and metadata, a guarantee no frozen-ness probe can
-   * establish (a shallow-frozen literal with mutable nested data
-   * would fool it). O(1): one WeakSet lookup.
+   * The state of the aggregate at the time of the snapshot.
    */
-  protected assertMintedEvent(event: PendingDomainEvent<TEvent>): void;
+  readonly state: TState;
   /**
-   * Creates the immutable business fact accepted by this aggregate without
-   * reading a clock, generating an id, or attaching tracing metadata.
-   *
-   * The application shell records pending events after the domain operation
-   * and before persistence. Payload schema version stays here, next to the
-   * concrete event producer, rather than in shell-owned recording data.
+   * The version of the aggregate when the snapshot was taken.
    */
-  protected createEvent<E extends TEvent>(type: E["type"], payload: E["payload"], options?: Omit<CreateUncommittedDomainEventOptions, "aggregateId" | "aggregateType">): UncommittedDomainEventOf<E>;
-}
-//#endregion
-//#region src/aggregate/aggregate-root.d.ts
-/**
- * OO-first Aggregate Root for state-stored domain models.
- *
- * The aggregate owns identity, valid domain state, behavior, its current
- * domain version, and pending domain events. It deliberately does not own a
- * database baseline or dirty-key bookkeeping. A repository adapter defines
- * its persistence projection through `PersistenceModel`; the Unit of Work
- * retains that opaque baseline and derives the adapter's change set at flush.
- */
-declare abstract class AggregateRoot<TState, TId extends Id<string>, TEvent extends AnyDomainEvent = never> extends BaseAggregate<TState, TId, TEvent> {
+  readonly version: Version;
   /**
-   * Changes state and records the resulting facts in record-after-mutation
-   * order. Validation and event mint checks run before the transition becomes
-   * observable, so a rejected decision records nothing.
+   * Timestamp when the snapshot was created.
    */
-  protected commit(newState: TState, events?: PendingDomainEvent<TEvent> | readonly PendingDomainEvent<TEvent>[]): void;
-  /** Every normal domain-state transition advances the OCC version. */
-  protected setState(newState: TState): void;
+  readonly snapshotAt: Date;
   /**
-   * Replaces loss-tolerant derived state without advancing the domain version.
-   *
-   * This is intentionally loud: concurrent writers may overwrite such a
-   * change. Keep business facts on the normal `setState`/`commit` path.
+   * Schema version of the stored `state` shape, declared and stamped by
+   * the persistence adapter that captures the snapshot. Distinct from
+   * {@link version}, which counts mutations: this field says "which
+   * shape does the stored state have", so a restore can detect a
+   * snapshot written against an older DTO shape and migrate or
+   * discard it instead of crashing later. Optional: a snapshot without
+   * this field restores as schema `1`. Distinct also from
+   * `DomainEvent.schemaVersion`, which versions one event payload shape.
+   * A payload change and a snapshot state change bump their own field.
    */
-  protected setStateWithoutVersionBump(newState: TState): void;
+  readonly schemaVersion?: number;
 }
-//#endregion
-//#region src/events/json-value.d.ts
-/** A primitive value represented without loss by JSON. */
-type JsonPrimitive = boolean | null | number | string;
-/** A recursively JSON-safe value. Runtime validation rejects lossy shapes. */
-type JsonValue = JsonPrimitive | ReadonlyArray<JsonValue> | {
-  readonly [key: string]: JsonValue;
-};
-/** A JSON-safe object. */
-type JsonObject = {
-  readonly [key: string]: JsonValue;
-};
-//#endregion
-//#region src/app/command.d.ts
 /**
- * Marker interface for Commands.
- * Commands represent write operations that change system state.
- * They should be immutable and contain all data needed to perform the operation.
- *
- * This interface can be used as a type marker even when using external frameworks
- * (e.g., RabbitMQ, AWS SQS) to ensure type safety across different bus implementations.
- *
- * @example
- * ```typescript
- * type CreateOrderCommand = Command & {
- *   type: "CreateOrder";
- *   customerId: string;
- *   items: OrderItem[];
- * };
- * ```
- *
- * @example Using with external frameworks (RabbitMQ, etc.)
- * ```typescript
- * // Define command using Command marker
- * type CreateOrderCommand = Command & {
- *   type: "CreateOrder";
- *   customerId: string;
- * };
- *
- * // Handler can be typed with CommandHandler even for external frameworks
- * const handler: CommandHandler<CreateOrderCommand, OrderId> = async (cmd) => {
- *   // ... handler logic
- *   return ok(orderId);
- * };
- *
- * // The consumer owns this runtime decoder. It checks byte and collection
- * // ceilings, parses to unknown, allow-lists fields, and constructs domain types.
- * declare function decodeCreateOrderCommand(
- *   body: Uint8Array,
- *   principal: AuthenticatedPrincipal,
- * ): Result<CreateOrderCommand, InvalidCommand>;
- * declare function decodeMessageId(
- *   value: unknown,
- * ): Result<string, InvalidTransportMetadata>;
- * declare function createOrderDeliveryKey(messageId: string): string;
+ * Public contract every Aggregate Root satisfies. Implemented by
+ * `BaseAggregate` and inherited by both `StateStoredAggregate` and
+ * `EventSourcedAggregate`. Repository ports use this interface as their
+ * aggregate type rather than depending on concrete base classes, so persistence
+ * orchestration does not take a compile-time
+ * dependency on the aggregate hierarchy.
  *
- * // This application service invokes the handler through withIdempotentCommit.
- * // createOrderDeliveryKey scopes the message id by consumer. The service
- * // fingerprints the complete CreateOrder intention and commits that claim,
- * // the aggregate write, outbox entries, and outcome together.
- * declare function executeIdempotentCreateOrder(
- *   deliveryKey: string,
- *   command: CreateOrderCommand,
- * ): Promise<Result<OrderId, string>>;
+ * Full per-member documentation lives on the concrete `BaseAggregate`
+ * class; the interface is intentionally terse to avoid drift. Persistence
+ * facts are readable, but acknowledgement and pending-event disposal are not
+ * part of this surface. The application shell holds that authority.
  *
- * // Register with RabbitMQ or another external bus.
- * rabbitMQChannel.consume("order.commands", async (message) => {
- *   const messageId = decodeMessageId(message.properties.messageId);
- *   if (messageId.isErr()) {
- *     rabbitMQChannel.reject(message, false); // missing identity: dead-letter
- *     return;
- *   }
- *   const deliveryKey = createOrderDeliveryKey(messageId.value);
- *   const principal = authenticateProducer(message.properties.headers);
- *   const decoded = decodeCreateOrderCommand(message.content, principal);
- *   if (decoded.isErr()) {
- *     rabbitMQChannel.reject(message, false); // invalid input: dead-letter, do not retry
- *     return;
- *   }
- *   const outcome = await executeIdempotentCreateOrder(
- *     deliveryKey,
- *     decoded.value,
- *   );
- *   await recordCommandOutcome(deliveryKey, outcome);
- *   rabbitMQChannel.ack(message);
- * });
- * ```
- */
-interface Command {
-  readonly type: string;
-}
-/**
- * Versioned Published Language for a command that crosses a process or
- * Bounded-Context boundary. Unlike a local {@link Command}, its payload is
- * JSON-safe data rather than a domain object graph. Map value objects to their
- * wire DTOs at this boundary; for example, use `MoneyDto` instead of `Money`.
+ * @template TId    - The aggregate root identifier (branded via `Id<Tag>`)
+ * @template TEvent - The domain-event union, defaults to `never`
  */
-interface PublishedCommand<TType extends string = string, TPayload extends JsonValue = JsonValue> extends Command {
-  readonly type: TType;
-  readonly version: number;
-  readonly payload: TPayload;
+interface Aggregate<TId extends Id<string>, TEvent extends AnyDomainEvent = never> {
+  readonly id: TId;
+  readonly version: Version;
+  readonly pendingEvents: ReadonlyArray<PendingDomainEvent<TEvent>>;
 }
 /**
- * Handler for executing commands.
- * Commands return Result for explicit error handling.
- * Commands may modify system state. When a caller can retry or a broker can
- * redeliver, the application service must enforce idempotency; this handler
- * type alone does not provide it.
- *
- * This type can be used to mark handlers even when using external frameworks
- * (e.g., RabbitMQ, AWS SQS, Kafka) to ensure type safety and consistency.
- *
- * @template C - The command type (must extend Command)
- * @template R - The result type
- * @template E - The error channel type. Defaults to `string`; widen it (e.g.
- *   to a `DomainError` union) to carry typed failures through the bus.
- *
- * @example
- * ```typescript
- * const handler: CommandHandler<CreateOrderCommand, OrderId> = async (cmd) => {
- *   const order = Order.create(cmd.customerId, cmd.items);
- *   repository.add(order);
- *   return ok(order.id);
- * };
- * ```
- *
- * @example Using with external frameworks
- * ```typescript
- * // Handler typed with CommandHandler for type safety
- * const createOrderHandler: CommandHandler<CreateOrderCommand, OrderId> = async (cmd) => {
- *   // ... handler logic
- *   return ok(orderId);
- * };
+ * Public contract for Event-Sourced Aggregate Roots. Extends
+ * `Aggregate` with the replay-from-history boundary.
  *
- * // The broker adapter validates before calling the application handler.
- * rabbitMQChannel.consume("commands", async (msg) => {
- *   const messageId = decodeMessageId(msg.properties.messageId);
- *   if (messageId.isErr()) {
- *     rabbitMQChannel.reject(msg, false);
- *     return;
- *   }
- *   const deliveryKey = createOrderDeliveryKey(messageId.value);
- *   const principal = authenticateProducer(msg.properties.headers);
- *   const decoded = decodeCreateOrderCommand(msg.content, principal);
- *   if (decoded.isErr()) {
- *     rabbitMQChannel.reject(msg, false); // malformed or over limit
- *     return;
- *   }
- *   // executeIdempotentCreateOrder invokes createOrderHandler through the same
- *   // atomic withIdempotentCommit boundary described in the first example.
- *   const outcome = await executeIdempotentCreateOrder(
- *     deliveryKey,
- *     decoded.value,
- *   );
- *   await recordCommandOutcome(deliveryKey, outcome);
- *   rabbitMQChannel.ack(msg);
- * });
+ * @template TId    - The aggregate root identifier
+ * @template TEvent - The union type of all domain events
+ */
+interface ReplayableAggregate<TId extends Id<string>, TEvent extends AnyDomainEvent> extends Aggregate<TId, TEvent> {
+  /**
+   * Reconstitutes the aggregate from an event history. Returns
+   * `Result` because event-stream corruption is an expected
+   * recoverable failure at the infrastructure boundary: a `DomainError`
+   * thrown by a fold arrives as `Err`. Every other failure propagates
+   * after the all-or-nothing rollback.
+   *
+   * @throws ForeignEventError when a history event names another aggregate
+   * @throws UnreplayableAggregateError when the target carries pending
+   *   decisions, or a fold records one
+   * @throws MissingFoldError when no fold is declared for an event type
+   * @throws FoldReturnedNoStateError when a fold returns `undefined`
+   * @throws HostileStateKeyError when the folded state carries an own
+   *   `__proto__` key
+   */
+  replayHistory(history: ReadonlyArray<TEvent>): Result<void, DomainError>;
+}
+/**
+ * Checks if two aggregates are at the same version (same ID and version).
+ * Useful for optimistic concurrency control checks.
+ *
+ * Note: Two aggregates with the same ID ARE the same aggregate (identity).
+ * This function checks if they are at the same version: i.e., no concurrent modification.
+ *
+ * @example
+ * ```typescript
+ * const before = await repository.findById(id);
+ * // ... some operations ...
+ * const after = await repository.findById(id);
+ *
+ * if (!sameVersion(before, after)) {
+ *   throw new Error("Aggregate was modified by another process");
+ * }
  * ```
  */
-type CommandHandler<C extends Command, R, E = string> = (cmd: C) => Promise<Result<R, E>>;
-//#endregion
-//#region src/utils/execution.d.ts
-/** Cancellation and deadline controls for one bounded shell operation. */
-interface ExecutionContext {
-  /** Cooperative cancellation for the in-flight operation. */
-  readonly signal: AbortSignal;
-  /** Absolute Unix epoch millisecond at which the shell stops waiting. */
-  readonly deadlineAt: number;
-}
+declare function sameVersion<TId extends Id<string>>(a: {
+  id: TId;
+  version: Version;
+}, b: {
+  id: TId;
+  version: Version;
+}): boolean;
 //#endregion
-//#region src/events/ports.d.ts
+//#region src/messaging/event-bus/ports.d.ts
 /**
  * Event handler function type for subscribing to domain events. The execution
  * context carries the publication's cooperative cancellation and deadline;
@@ -1190,7 +1003,14 @@ type EventHandler<Evt> = (event: Evt, context: ExecutionContext) => Promise<void
 interface PublishOptions {
   /** Owner/request cancellation propagated to every event handler. */
   readonly signal?: AbortSignal;
-  /** Maximum time to await the complete publication. Default `30000`ms. */
+  /**
+   * Maximum time to await the complete publication. Default `30000`ms.
+   *
+   * This bounds the WAIT, not the handler. JavaScript cannot terminate a
+   * running promise, so a handler that ignores `context.signal` keeps
+   * running after `publish` rejects, and its side effects still land.
+   * Pass `context.signal` into every I/O call a handler makes.
+   */
   readonly timeoutMs?: number;
 }
 /**
@@ -1222,25 +1042,36 @@ interface EventBus<Evt extends AnyDomainEvent> {
    *
    * **Ordering & parallelism contract:**
    *
-   *  1. **Events run in input order.** `publish([a, b, c])` dispatches `a`,
-   *     awaits all of its handlers, then dispatches `b`, and so on. The
-   *     library never reorders or parallelises across events.
-   *  2. **Handlers within a single event run in parallel.** All handlers
-   *     subscribed to `event.type` are awaited via `Promise.allSettled`:
-   *     none of them sees the others' errors and none is skipped if a
-   *     peer fails.
-   *  3. **Errors are collected and thrown AFTER everything dispatches.**
-   *     If one handler throws, remaining handlers for that event still
-   *     run, and remaining events in the batch still publish. Once
-   *     `publish` reaches the end of the batch it throws: the single
-   *     error directly if there was one, or an `AggregateError`
-   *     ("Multiple event handlers failed") containing every captured
-   *     error otherwise. Callers that need fail-fast semantics should
-   *     publish events one at a time and not rely on batch atomicity.
+   *  1. **Events run in input order.** `publish([a, b, c])` dispatches `a`
+   *     and awaits every handler of `a`. Then it dispatches `b`, and so
+   *     on. The bus never changes that order. It never dispatches two
+   *     events at the same time.
+   *  2. **The handlers of one event run in parallel.** The bus awaits
+   *     every handler of `event.type` through `Promise.allSettled`. One
+   *     handler never sees the error of another handler. The bus skips no
+   *     handler when a peer fails. The bus applies no limit here: twenty
+   *     handlers that each open a connection open twenty connections.
+   *     Backpressure belongs to the client that the handler calls.
+   *  3. **The bus collects the errors and throws them after the batch.**
+   *     If one handler throws, the other handlers of that event still
+   *     run, and the remaining events still publish. At the end of the
+   *     batch `publish` throws. One failure throws that error directly.
+   *     Two or more failures throw an `AggregateError` with the message
+   *     "Multiple event handlers failed", which carries every collected
+   *     error. For fail-fast behavior, publish one event for each call.
+   *     A batch is not atomic.
+   *
+   * The contract is intentionally simple and in-process. For delivery
+   * across processes, for example through RabbitMQ or Kafka, use the
+   * `Outbox` port and a dedicated dispatcher.
+   *
+   * **Delivery guarantee.** The port does not promise persistence, retry, or
+   * a dead-letter path. Each implementation states its own guarantee. Work
+   * that must survive a crash belongs behind the `Outbox` port.
    *
-   * The contract is intentionally simple and in-process. For
-   * cross-process delivery (RabbitMQ, Kafka, etc.), use the `Outbox`
-   * port and a dedicated dispatcher.
+   * **Handlers must tolerate a second run.** The port never redelivers. A
+   * caller that retries does redeliver, and the handlers of the first
+   * attempt can still run. Make a handler idempotent, or do not retry.
    *
    * @param events - Array of events to publish
    * @param options - Owner cancellation and publication timeout
@@ -1267,6 +1098,38 @@ interface EventBus<Evt extends AnyDomainEvent> {
   subscribe: <K extends Evt["type"]>(eventType: K, handler: EventHandler<Extract<Evt, {
     type: K;
   }>>) => () => void;
+  /**
+   * Subscribes one handler to a set of event types.
+   *
+   * The returned function releases every subscription it made, so a
+   * consumer that reacts to several types keeps one release instead of
+   * one for each type. Losing one of several releases is how a partial
+   * leak starts.
+   *
+   * A type that appears twice subscribes once: the argument is a set of
+   * types, and delivering the same event twice to one handler would be a
+   * surprise, not a feature. An empty set subscribes nothing and returns
+   * a release that does nothing.
+   *
+   * @param eventTypes - The event types to subscribe to
+   * @param handler - Called with every event of those types, narrowed to
+   * their union
+   * @returns A function that releases all of them, and does nothing when
+   * called again
+   *
+   * @example
+   * ```typescript
+   * const release = bus.subscribeMany(
+   *   ["OrderCreated", "OrderShipped"],
+   *   async (event) => {
+   *     await touchReadModel(event.payload.orderId);
+   *   },
+   * );
+   * ```
+   */
+  subscribeMany: <K extends Evt["type"]>(eventTypes: readonly K[], handler: EventHandler<Extract<Evt, {
+    type: K;
+  }>>) => () => void;
   /**
    * Subscribes a handler to EVERY event type: the subscription for
    * cross-cutting consumers (audit log, metrics, dev logging,
@@ -1295,359 +1158,71 @@ interface EventBus<Evt extends AnyDomainEvent> {
    */
   subscribeAll: (handler: EventHandler<Evt>) => () => void;
   /**
-   * Subscribes to the next occurrence of an event type.
-   * Returns a Promise that resolves with the event data.
-   * Automatically unsubscribes after the first event.
-   *
-   * @param eventType - The event type to wait for
-   * @returns A Promise that resolves with the event
+   * Releases every subscription and settles every waiter.
    *
-   * @example
-   * ```typescript
-   * const event = await bus.once("OrderCreated");
-   * console.log("Order created:", event.payload.orderId);
-   * ```
-   */
-  once: <K extends Evt["type"]>(eventType: K, options?: OnceOptions) => Promise<Extract<Evt, {
-    type: K;
-  }>>;
-}
-/**
- * Options for `EventBus.once()`. Both fields are optional; without them
- * `once()` waits forever (the historical behaviour).
- */
-interface OnceOptions {
-  /**
-   * Aborts the wait. When `signal` fires, `once()` rejects with
-   * `signal.reason` (or a generic abort error if none was supplied) and
-   * the internal subscription is removed.
-   */
-  signal?: AbortSignal;
-  /**
-   * Rejects with a timeout error after this many milliseconds if no event
-   * has arrived. The internal subscription and timer are cleaned up
-   * regardless of which path settles the promise.
-   */
-  timeoutMs?: number;
-}
-/**
- * Gap-proof position finalized by the event source at the persistence
- * boundary. It is deliberately separate from `DomainEvent`: these values
- * describe a stored commit, not the business fact itself.
- */
-interface CommitPosition {
-  /** Aggregate OCC version reached by this eventful commit. */
-  readonly aggregateVersion: number;
-  /** Zero-based event index inside this aggregate commit. */
-  readonly commitSequence: number;
-  /** Total number of events emitted by this aggregate commit. */
-  readonly commitSize: number;
-  /**
-   * Aggregate version of the immediately preceding EVENTFUL commit for this
-   * qualified aggregate source, or `null` when this is its first eventful
-   * commit. State-only persistence is intentionally absent from this chain.
+   * A bus that outlives its scope keeps its handlers alive with it. A
+   * worker that shuts down, a test that tears down, and a request scope
+   * that ends all need one call that leaves the bus holding nothing.
    *
-   * The outbox/event-store adapter owns this value. It must read and advance
-   * the source head atomically with inserting the committed event envelope;
-   * application orchestration cannot derive it from the Unit of Work's OCC
-   * receipt because state-only commits are intentionally absent here.
-   */
-  readonly previousEventfulAggregateVersion: number | null;
-}
-/**
- * Commit information known by the application transaction before the outbox
- * source has linked this eventful commit to its predecessor.
- */
-type EventCommitCandidatePosition = Omit<CommitPosition, "previousEventfulAggregateVersion">;
-/**
- * A bare domain event prepared for the transactional outbox. The outbox source
- * owns the predecessor link and turns this candidate into a
- * {@link CommittedDomainEvent} when it persists the record.
- */
-interface EventCommitCandidate<Evt extends AnyDomainEvent> {
-  readonly event: Evt;
-  readonly source: AggregateAddress;
-  readonly position: EventCommitCandidatePosition;
-}
-/**
- * A domain event enriched after persistence has established its source and
- * commit position. Outboxes and projectors consume this envelope; in-process
- * domain handlers continue to consume the bare {@link DomainEvent} value.
- */
-interface CommittedDomainEvent<Evt extends AnyDomainEvent> {
-  readonly event: Evt;
-  readonly source: AggregateAddress;
-  readonly position: CommitPosition;
-}
-/**
- * One pending event in the outbox plus the opaque id the implementation
- * needs to ack it via `markDispatched`. The library does not prescribe
- * what `dispatchId` looks like: an implementation can reuse the event's
- * own `eventId`, generate its own UUID, use the row's auto-increment
- * primary key, or whatever the storage layer prefers.
- */
-interface OutboxRecord<Evt extends AnyDomainEvent> extends CommittedDomainEvent<Evt> {
-  dispatchId: string;
-  /**
-   * Failed delivery attempts so far. Populated by implementations that
-   * track dispatch failures (see {@link DispatchTrackingOutbox});
-   * plain `Outbox` implementations may omit it.
-   */
-  attempts?: number;
-}
-/** A record that exhausted its delivery attempts; see {@link DispatchTrackingOutbox.deadLetters}. */
-interface DeadLetterRecord<Evt extends AnyDomainEvent> extends CommittedDomainEvent<Evt> {
-  dispatchId: string;
-  /** Failed delivery attempts when the record was dead-lettered. */
-  attempts: number;
-  /** Human-readable rendering of the last delivery error, if recorded. */
-  lastError?: string;
-}
-/**
- * Write half of the transactional outbox: the only outbox capability the
- * write side (`withCommit`, `UnitOfWork`) depends on. Persisting the
- * events atomically with the aggregate state is the kit's guarantee;
- * DELIVERY is a separate, replaceable concern.
- *
- * Implement ONLY this interface to plug in an external delivery
- * solution: `add()` writes into that solution's outbox storage inside
- * the ambient transaction, and its own listener (polling or
- * WAL/CDC-based, such as a Debezium-style connector, a delivery
- * library, or a broker-native outbox) owns delivery entirely. The
- * kit-side poll surface ({@link Outbox}) is then never involved. See
- * the outbox guide, "External dispatchers".
- */
-interface OutboxWriter<Evt extends AnyDomainEvent> {
-  /**
-   * Finalizes and persists event commit candidates. Called from inside
-   * `withCommit`'s transactional callback, atomically with the aggregate
-   * write.
+   * After this call, `publish`, `subscribe`, `subscribeAll` and `once`
+   * throw. Use after close is a programming bug, and a silent no-op would
+   * look like a delivery that did not happen. A pending `once()` rejects
+   * rather than waiting forever, which is the only waiter the port can
+   * settle: a handler is a callback and learns that no event follows by
+   * not being called again.
    *
-   * For every qualified aggregate source, the adapter must serialize source
-   * advancement, read its last eventful aggregate version, write that value as
-   * `previousEventfulAggregateVersion` on every event in the candidate's
-   * commit, and advance the source head to `aggregateVersion` in the SAME
-   * transaction. A state-only aggregate commit does not call `add()` and must
-   * therefore not advance this event-source head.
+   * Calling it again does nothing.
    *
-   * A qualified source position `(aggregateType, aggregateId,
-   * aggregateVersion, commitSequence)` MUST identify one immutable event. All
-   * candidates for the same aggregate commit MUST also agree on `commitSize`.
-   * Enforce both constraints before advancing the source head; a conflicting
-   * retry must reject without replacing the stored event or changing the head.
+   * A plain method, not `Symbol.dispose`. A port that declared the symbol
+   * would need `esnext.disposable` in the `lib` of every consumer, only to
+   * typecheck the types of this kit, and that requirement cannot be
+   * declined. Group your own releases instead, as the common mistakes
+   * guide shows.
    *
-   * **Idempotency:** implementations should dedupe on
-   * `candidate.event.eventId`. `withCommit` itself does not retry, but the
-   * surrounding use case (a queue consumer, an HTTP retry, a transactional
-   * outbox-dispatcher loop) may legitimately invoke the same write more than
-   * once. A unique-key constraint on `(eventId)` in the outbox table is the
-   * standard implementation; the source-head update and dedupe decision must
-   * share the transaction. Idempotency applies only to an exact candidate
-   * retry: the same event ID, qualified source, aggregate version, commit
-   * sequence, and commit size. Reusing an `eventId` for another source or
-   * position is a caller bug: adapters that retain the conflicting record
-   * should reject it rather than replace or silently reinterpret it as a retry.
-   */
-  add: (events: ReadonlyArray<EventCommitCandidate<Evt>>) => Promise<void>;
-}
-/**
- * Transactional outbox port: the bridge between the write-side
- * transaction and the (out-of-band) event dispatcher.
- *
- * Lifecycle:
- *  1. `add()` inside the write transaction (`withCommit` calls this) so
- *     events persist atomically with the aggregate state
- *     ({@link OutboxWriter}, the only part the write side needs).
- *  2. An outbox dispatcher (the kit's `OutboxDispatcher` or your own)
- *     polls `getPending()` and forwards the events to subscribers /
- *     external brokers.
- *  3. After successful dispatch, the dispatcher calls `markDispatched()`
- *     with the records' `dispatchId`s so they don't come back next poll.
- *
- * `markDispatched` is required to be idempotent: calling it with an id
- * that's already marked is a no-op, not an error. This lets the
- * dispatcher safely retry on partial-failure.
- *
- * **Competing dispatcher instances** are an adapter contract, not a
- * dispatcher feature: a transactional implementation that should
- * support several concurrent pollers must make `getPending` claim the
- * returned records (`FOR UPDATE SKIP LOCKED` or equivalent). Without
- * claiming, run one logical dispatcher per outbox.
- *
- * The bundled dispatcher supplies an {@link ExecutionContext} to every poll-side
- * operation. Production adapters MUST pass its signal to native I/O or enforce
- * a native timeout no later than `deadlineAt`; the shell can bound its wait but
- * cannot terminate a promise that ignores cancellation. A timed-out write has
- * an unknown outcome. Acknowledgements must remain idempotent when they complete
- * late; a late failure update may count its original delivery attempt and must
- * still no-op after the record was dispatched.
- */
-interface Outbox<Evt extends AnyDomainEvent> extends OutboxWriter<Evt> {
-  /**
-   * Returns up to `limit` outbox records that have not yet been
-   * dispatched, **in the order `add()` persisted them** (commit order).
-   * The ordering is part of the port contract: `withCommit` promises
-   * subscribers per-aggregate causal order, and a sequential dispatcher
-   * can only honor that promise when this read is ordered. SQL-backed
-   * implementations need a monotonic position column (an auto-increment
-   * primary key works) and an `ORDER BY` on it; a bare `SELECT` returns
-   * rows in storage order, not insertion order. The dispatcher polls
-   * this on a schedule. When `limit` is omitted, the implementation
-   * decides on a default page size. The bundled dispatcher always supplies
-   * `context`; it is optional only so existing adapters remain assignable.
+   * This releases the subscriptions. It does not stop a handler that is
+   * already running, because JavaScript cannot terminate a running
+   * promise. Pass `context.signal` into every call a handler makes, and a
+   * publication in flight ends with the handler that honours it.
    */
-  getPending: (limit?: number, context?: ExecutionContext) => Promise<ReadonlyArray<OutboxRecord<Evt>>>;
+  close: () => void;
   /**
-   * Marks the given dispatch records as delivered so subsequent
-   * `getPending` calls don't return them. Must be idempotent on
-   * already-marked ids, including a late completion after the caller's
-   * storage deadline. The bundled dispatcher always supplies `context`.
+   * Subscribes to the next occurrence of an event type.
+   * Returns a Promise that resolves with the event data.
+   * Automatically unsubscribes after the first event.
+   *
+   * @param eventType - The event type to wait for
+   * @returns A Promise that resolves with the event
+   *
+   * @example
+   * ```typescript
+   * const event = await bus.once("OrderCreated");
+   * console.log("Order created:", event.payload.orderId);
+   * ```
    */
-  markDispatched: (dispatchIds: ReadonlyArray<string>, context?: ExecutionContext) => Promise<void>;
+  once: <K extends Evt["type"]>(eventType: K, options?: OnceOptions) => Promise<Extract<Evt, {
+    type: K;
+  }>>;
 }
 /**
- * Optional extension of {@link Outbox} for dispatchers that track
- * delivery failures. Without failure tracking, a poison message (an
- * event whose delivery always throws) is redelivered forever: it comes
- * back from every `getPending` poll, blocks per-aggregate ordering
- * behind it, and burns the dispatcher's cycles. This extension gives
- * the dispatcher a bounded-retry story: report each failed delivery via
- * {@link markFailed}; the implementation moves records past its
- * attempt ceiling to a dead-letter set that `getPending` no longer
- * returns, and {@link deadLetters} exposes them for alerting, manual
- * inspection, and redelivery (deliver by hand, then ack via
- * `markDispatched`, which also clears dead-lettered records).
- *
- * See the outbox guide's dispatcher recipe for the retry-then-dead-letter
- * loop this port shape supports.
+ * Options for `EventBus.once()`. Both fields are optional; without them
+ * `once()` waits forever.
  */
-interface DispatchTrackingOutbox<Evt extends AnyDomainEvent> extends Outbox<Evt> {
+interface OnceOptions {
   /**
-   * Records one failed delivery attempt for the given record:
-   * increments its attempt count (surfaced as
-   * {@link OutboxRecord.attempts}) and, once the implementation's
-   * ceiling is reached, moves the record to the dead-letter set.
-   * A no-op for unknown or already-dispatched ids (a late failure
-   * report after a successful retry must not resurrect the record).
-   * Returns the exact dead-letter record only on the call that performs
-   * that transition; retries below the ceiling and no-ops return
-   * `undefined`. This lets productive pollers emit an immediate signal
-   * without scanning the durable dead-letter set after every failure. A late
-   * completion may count that original delivery attempt; it must still no-op if
-   * the record was dispatched in the meantime. The bundled dispatcher never
-   * reissues the same store call and always supplies `context`.
+   * Aborts the wait. When `signal` fires, `once()` rejects with
+   * `signal.reason` (or a generic abort error if none was supplied) and
+   * the internal subscription is removed.
    */
-  markFailed: (dispatchId: string, error?: unknown, context?: ExecutionContext) => Promise<DeadLetterRecord<Evt> | undefined>;
+  signal?: AbortSignal;
   /**
-   * Records that exhausted their delivery attempts. They no longer
-   * come back from `getPending`; wire this to durable alerting and
-   * reconciliation so poison messages surface even if the poller stops
-   * between this store transition and its immediate observer callback.
+   * Rejects with a timeout error after this many milliseconds if no event
+   * has arrived. The internal subscription and timer are cleaned up
+   * regardless of which path settles the promise.
    */
-  deadLetters: () => Promise<ReadonlyArray<DeadLetterRecord<Evt>>>;
-}
-//#endregion
-//#region src/app/command-outbox.d.ts
-/**
- * Business relationships and technical trace context selected explicitly for
- * an outgoing command. Correlation/conversation explain the business flow;
- * W3C Trace Context connects technical spans.
- */
-interface CommandMessageRelationships {
-  /** Groups messages that belong to one operation or trace. */
-  readonly correlationId?: string;
-  /** Groups every message in one long-running business interaction. */
-  readonly conversationId?: string;
-  /** W3C Trace Context parent for technical distributed tracing. */
-  readonly traceparent?: string;
-  /** Optional vendor trace state associated with `traceparent`. */
-  readonly tracestate?: string;
-}
-/**
- * Application-owned Published Language produced from one private domain or
- * process event. `destination` names one receiver contract; it is deliberately
- * required because a command is an instruction, not a broadcast fact.
- *
- * The command carries a stable schema `version` and JSON-safe `payload`.
- * Domain value objects are translated to wire DTOs by the mapper before this
- * boundary.
- */
-interface CommandMessageContent<C extends PublishedCommand> extends CommandMessageRelationships {
-  readonly destination: string;
-  readonly command: C;
-}
-/**
- * Immutable, JSON-safe command envelope stored for later at-least-once
- * delivery.
- *
- * `causationId` always identifies the private event whose accepted decision
- * requested this command. The mapper cannot replace it with a weaker
- * correlation. Consumer-produced events should in turn use `messageId` as
- * their causation id.
- */
-interface DurableCommandMessage<C extends PublishedCommand> extends CommandMessageContent<C> {
-  readonly messageId: string;
-  readonly recordedAt: string;
-  readonly causationId: string;
-}
-/**
- * Receipt for the private event that requested one command batch. It retains
- * commit identity and ordering without putting the private event or its
- * payload into the command outbox.
- */
-interface CommandCommitOriginCandidate {
-  readonly eventId: string;
-  readonly source: AggregateAddress;
-  readonly position: EventCommitCandidatePosition;
-}
-/**
- * One private process-event commit and the exact commands it requested.
- * `messages` may be empty: the receipt still advances the originating source
- * and makes an exact retry distinguishable from a missing commit.
- */
-interface CommandOutboxCommitCandidate<C extends PublishedCommand> {
-  readonly origin: CommandCommitOriginCandidate;
-  readonly messages: ReadonlyArray<DurableCommandMessage<C>>;
-}
-/**
- * Write port for a dedicated transactional command outbox.
- *
- * The adapter is bound to the same ambient transaction as the aggregate or
- * event-stream repository. It must persist the complete input atomically,
- * retain input order, deduplicate exact retries by `origin.eventId`, and reject
- * a reused origin id whose source, position, or messages differ. It also owns
- * the durable source cursor represented by `origin.position`; an empty command
- * batch still advances that cursor.
- *
- * Delivery is out of band and at least once. A consumer therefore uses
- * `message.messageId` as its idempotency key and acknowledges only after the
- * command result has been stored.
- */
-interface CommandOutboxWriter<C extends PublishedCommand> {
-  add(commits: ReadonlyArray<CommandOutboxCommitCandidate<C>>): Promise<void>;
+  timeoutMs?: number;
 }
-/** Maps one private accepted event to zero or more addressed commands. */
-type CommandOutboxMapper<Evt extends AnyDomainEvent, C extends PublishedCommand> = (event: Evt) => ReadonlyArray<CommandMessageContent<C>>;
-/**
- * Adapts a dedicated command outbox to the event-candidate write port consumed
- * by `withCommit`.
- *
- * Mapping happens inside the transaction, before the command outbox write.
- * The private event is used only at this boundary and is reduced to an origin
- * receipt. The helper never publishes it or copies its payload implicitly; the
- * application mapper selects and translates the data that belongs in the
- * versioned Published Language. The route rejects values JSON would lose or
- * change before it calls the adapter.
- * Every command gets a stable id derived from the event id and its zero-based
- * order, so an exact transaction retry produces the same rows.
- *
- * Omit `withCommit`'s in-process `bus` for private process events. Participants
- * consume the durable command messages from their explicitly named
- * destinations, while event-stream replay only rebuilds process state.
- */
-declare function routeEventsToCommandOutbox<C extends PublishedCommand, Evt extends AnyDomainEvent = AnyDomainEvent>(outbox: CommandOutboxWriter<C>, mapper: CommandOutboxMapper<Evt, C>): OutboxWriter<Evt>;
 //#endregion
-//#region src/repo/scope.d.ts
+//#region src/persistence/repository/scope.d.ts
 /** Options passed to {@link TransactionScope.transactional}. */
 interface TransactionalOptions {
   /**
@@ -1720,7 +1295,7 @@ interface TransactionScope<TCtx> {
   transactional<T>(fn: (ctx: TCtx) => Promise<T>, options?: TransactionalOptions): Promise<T>;
 }
 //#endregion
-//#region src/app/handler.d.ts
+//#region src/application/cqrs/handler.d.ts
 /** Dependencies for {@link withCommit}. */
 interface WithCommitDeps<Evt extends AnyDomainEvent, TCtx> {
   /**
@@ -1752,7 +1327,7 @@ interface WithCommitDeps<Evt extends AnyDomainEvent, TCtx> {
    * committed write into an apparent failure. The execution context carries
    * owner cancellation and the configured post-commit deadline.
    */
-  onPersisted?: (aggregate: IAggregateRoot<Id<string>, Evt>, version: Version, context: ExecutionContext) => void | Promise<void>;
+  onPersisted?: (aggregate: Aggregate<Id<string>, Evt>, version: Version, context: ExecutionContext) => void | Promise<void>;
   /**
    * Observer for post-commit persistence failures: either the internal
    * acknowledgement/disposal step or the application-shell `onPersisted`
@@ -1764,7 +1339,7 @@ interface WithCommitDeps<Evt extends AnyDomainEvent, TCtx> {
    * post-commit invariant holds, and the loop continues the remaining
    * post-commit work.
    */
-  onPersistError?: (error: unknown, aggregate: IAggregateRoot<Id<string>, Evt>) => void;
+  onPersistError?: (error: unknown, aggregate: Aggregate<Id<string>, Evt>) => void;
   /**
    * Total time allotted to the complete post-commit application phase:
    * every application observer followed by in-process bus publication shares
@@ -1801,18 +1376,18 @@ interface AggregateCommitToken<Evt extends AnyDomainEvent = AnyDomainEvent> {
  * repository write, and return every resulting token in `commits`. Omitting
  * any token rejects the transaction: an enrolled write may not commit without
  * its event harvest and post-commit acknowledgement. Enrollable instances
- * must extend `AggregateRoot` or `EventSourcedAggregate`; structural
- * `IAggregateRoot` lookalikes have no internal lifecycle capability and fail
+ * must extend `StateStoredAggregate` or `EventSourcedAggregate`; structural
+ * `Aggregate` lookalikes have no internal lifecycle capability and fail
  * before commit.
  */
 interface CommitEnrollment<Evt extends AnyDomainEvent> {
-  enrollSaved(aggregate: IAggregateRoot<Id<string>, Evt>, options?: CommitEnrollmentOptions): AggregateCommitToken<Evt>;
+  enrollSaved(aggregate: Aggregate<Id<string>, Evt>, options?: CommitEnrollmentOptions): AggregateCommitToken<Evt>;
   /**
    * Enroll an aggregate whose row is deleted by the current transaction.
    * Its events are harvested and discarded after commit, but the saved-only
    * application `onPersisted` observer is not called.
    */
-  enrollDeleted(aggregate: IAggregateRoot<Id<string>, Evt>, options?: CommitEnrollmentOptions): AggregateCommitToken<Evt>;
+  enrollDeleted(aggregate: Aggregate<Id<string>, Evt>, options?: CommitEnrollmentOptions): AggregateCommitToken<Evt>;
 }
 /** OCC baseline associated with one exact commit enrollment. */
 interface CommitEnrollmentOptions {
@@ -1924,34 +1499,189 @@ interface WithCommitWorkResult<Evt extends AnyDomainEvent, R> {
  * adapter persistence projection and rejects later mutation before flush. For
  * direct `withCommit` use, make domain decisions first, write, and enroll last.
  *
- * **Duplicate enrollment is idempotent by reference.** Enrolling the same
- * instance repeatedly returns the same token, and a repeated token in
- * `commits` is harvested once. A repeat call that omits `expectedVersion`
- * makes no OCC assertion; only a supplied value that contradicts the
- * enrollment-time baseline rejects. Each event lands in the outbox exactly once
- * and post-commit acknowledgement runs exactly once. Two
- * *different* instances with the same logical id cannot be detected
- * at this layer; that is a Repository contract violation (failure to
- * maintain Fowler's Identity Map per Unit of Work). See
- * `docs/guide/repository.md` → "Identity Map: one instance per
- * aggregate per Unit of Work" for the requirement on repository
- * implementations that makes this dedupe sound.
+ * **Duplicate enrollment is idempotent by reference.** Enrolling the same
+ * instance repeatedly returns the same token, and a repeated token in
+ * `commits` is harvested once. A repeat call that omits `expectedVersion`
+ * makes no OCC assertion; only a supplied value that contradicts the
+ * enrollment-time baseline rejects. Each event lands in the outbox exactly once
+ * and post-commit acknowledgement runs exactly once. Two
+ * *different* instances with the same logical id cannot be detected
+ * at this layer; that is a Repository contract violation (failure to
+ * maintain Fowler's Identity Map per Unit of Work). See
+ * `docs/guide/repository.md` → "Identity Map: one instance per
+ * aggregate per Unit of Work" for the requirement on repository
+ * implementations that makes this dedupe sound.
+ *
+ * @example Tx-bound repos (Drizzle, Prisma, Mongo, …)
+ * ```typescript
+ * const result = await withCommit({ outbox, bus, scope }, async (tx, enrollment) => {
+ *   const orderRepository = makeOrderRepository(tx); // your factory binds tx to the repo
+ *   const order = await orderRepository.getById(orderId);
+ *   order.confirm();
+ *   await persistOrder(tx, order);                 // low-level adapter write
+ *   const commit = enrollment.enrollSaved(order);   // attest the repository write
+ *   return { result: order.id, commits: [commit] };
+ * });
+ * ```
+ */
+declare function withCommit<Evt extends AnyDomainEvent, R, TCtx>(deps: WithCommitDeps<Evt, TCtx>, fn: (ctx: TCtx, enrollment: CommitEnrollment<Evt>) => Promise<WithCommitWorkResult<Evt, R>>): Promise<R>;
+//#endregion
+//#region src/application/deadlines/deadline-store.d.ts
+/**
+ * One deadline due for delivery, as returned by
+ * {@link DeadlineStore.due}. `deliveryId` identifies this scheduled
+ * INCARNATION of the deadline, not the `(scope, key)` address: a
+ * reschedule replaces the incarnation, and acknowledging a stale
+ * incarnation must never consume the new one (see
+ * {@link DeadlineStore.markDelivered}).
+ */
+interface DueDeadline<TPayload = unknown> {
+  /** Opaque per-incarnation id used for `markDelivered`/`markFailed`. */
+  readonly deliveryId: string;
+  /** The namespace half of the address, e.g. a process or policy name. */
+  readonly scope: string;
+  /** The instance half of the address, e.g. a saga or reservation id. */
+  readonly key: string;
+  /** When the deadline was due. */
+  readonly dueAt: Date;
+  /** The payload handed back as the input; plain data only. */
+  readonly payload: TPayload;
+  /** Failed delivery attempts so far (see `markFailed`). */
+  readonly attempts: number;
+}
+/** A deadline that exhausted its delivery attempts; see {@link DeadlineStore.deadLetters}. */
+interface DeadLetterDeadline<TPayload = unknown> extends DueDeadline<TPayload> {
+  /** Human-readable rendering of the last delivery error, if recorded. */
+  readonly lastError?: string;
+}
+/**
+ * Driven port for durable deadlines: timeout-as-input. A process that
+ * waits ("if PaymentReceived has not arrived in 30 minutes,
+ * compensate"; "release the reservation hold after 15 minutes";
+ * "expire the offer at month's end") schedules a deadline, and a poll
+ * loop later DELIVERS it as an input to whatever owns the decision, a
+ * saga aggregate, a use case, a policy. The store never executes
+ * consumer code; firing a deadline means handing back a record.
+ *
+ * Deliberately general-purpose and deliberately small. This is not a
+ * scheduler framework and not a cron abstraction: there is no
+ * recurrence, no execution engine, and the poll loop belongs to the
+ * consumer (the outbox guide's `drainOnce` pattern fits; the deadlines
+ * guide shows the wiring).
+ *
+ * Addressing is the `(scope, key)` pair, so one table serves every
+ * waiting process in an application: `scope` names the policy
+ * ("checkout-saga", "reservation-hold"), `key` the instance. There is
+ * at most ONE pending deadline per address; `schedule` on an existing
+ * address replaces it (that IS the reschedule operation), and each
+ * scheduling gets a fresh `deliveryId`, so acknowledgements of a
+ * replaced incarnation cannot consume its successor.
+ *
+ * Two sides, two transactional postures, the same split as the outbox:
+ *
+ * - **`schedule` and `cancel` are write-side calls** and must join the
+ *   ambient write transaction (use a tx-bound store instance inside
+ *   `withCommit`'s callback, exactly like an outbox adapter). This is
+ *   a correctness rule, not a preference: state that says "waiting for
+ *   payment" committed without its deadline is a process that never
+ *   wakes up, and a deadline scheduled for a rolled-back state change
+ *   is a ghost input.
+ * - **`due`, `markDelivered`, `markFailed`, and `deadLetters` are the
+ *   poll surface** and run out of band, in the consumer's loop.
+ *
+ * Delivery is at-least-once: a crash between processing and
+ * `markDelivered` redelivers, so consumers make deadline handling
+ * idempotent (the idempotency store with the `deliveryId` as key is
+ * the ready-made answer). Deadlines have no cross-key ordering
+ * obligations, so unlike the outbox a poison deadline blocks only
+ * itself; bounded retries still matter, which is why failure tracking
+ * is part of the port rather than an extension: report failed
+ * deliveries via `markFailed`, and the store dead-letters a deadline
+ * past its attempt ceiling.
+ *
+ * Run one logical poller per store unless your adapter's `due` claims
+ * records for competing pollers; the same rule as the outbox
+ * dispatcher.
+ *
+ * The bundled processor supplies an `ExecutionContext` to every poll-side
+ * operation. Production adapters MUST pass its signal to native I/O or enforce
+ * a native timeout no later than `deadlineAt`; the shell can bound its wait but
+ * cannot terminate a promise that ignores cancellation. A timed-out write has
+ * an unknown outcome. Acknowledgements must remain idempotent when they complete
+ * late; a late failure update may count its original delivery attempt and must
+ * still no-op after the incarnation was delivered or replaced.
  *
- * @example Tx-bound repos (Drizzle, Prisma, Mongo, …)
- * ```typescript
- * const result = await withCommit({ outbox, bus, scope }, async (tx, enrollment) => {
- *   const orderRepository = makeOrderRepository(tx); // your factory binds tx to the repo
- *   const order = await orderRepository.getById(orderId);
- *   order.confirm();
- *   await persistOrder(tx, order);                 // low-level adapter write
- *   const commit = enrollment.enrollSaved(order);   // attest the repository write
- *   return { result: order.id, commits: [commit] };
- * });
- * ```
+ * Verify an adapter with `createDeadlineStoreContractTests` from
+ * `@shirudo/ddd-kit/testing`; `InMemoryDeadlineStore` is the
+ * reference.
+ *
+ * @template TPayload - The payload shape carried from `schedule` to
+ * delivery; plain, serializable data (the same discipline as event
+ * payloads and snapshots)
  */
-declare function withCommit<Evt extends AnyDomainEvent, R, TCtx>(deps: WithCommitDeps<Evt, TCtx>, fn: (ctx: TCtx, enrollment: CommitEnrollment<Evt>) => Promise<WithCommitWorkResult<Evt, R>>): Promise<R>;
+interface DeadlineStore<TPayload = unknown> {
+  /**
+   * Schedules (or reschedules) the deadline at `(scope, key)`: at most
+   * one pending deadline exists per address, and scheduling an
+   * occupied address replaces its due time, payload, attempt count,
+   * and incarnation. Called inside the write transaction.
+   */
+  schedule(deadline: {
+    scope: string;
+    key: string;
+    dueAt: Date;
+    payload: TPayload;
+  }): Promise<void>;
+  /**
+   * Removes the pending deadline at `(scope, key)`; a no-op when none
+   * exists (the awaited input arrived in time and the wait is over).
+   * Called inside the write transaction.
+   */
+  cancel(scope: string, key: string): Promise<void>;
+  /**
+   * Up to `limit` deadlines with `dueAt <= now` that are neither
+   * delivered nor dead-lettered, ordered by `dueAt` (earliest first;
+   * ties in scheduling order). A `limit` of `0` is legal and yields an
+   * empty page (poll loops computing a remaining capacity may pass
+   * it). `now` is a parameter on purpose: the poll loop owns the
+   * clock, which keeps adapters deterministic and tests free of real
+   * time. The bundled processor always supplies `context`; it is optional only
+   * so existing adapters remain assignable.
+   */
+  due(now: Date, limit: number, context?: ExecutionContext): Promise<ReadonlyArray<DueDeadline<TPayload>>>;
+  /**
+   * Acknowledges delivered incarnations so they stop coming back.
+   * Idempotent on already-acknowledged and unknown ids, and a no-op
+   * for ids of REPLACED incarnations (a late ack after a reschedule
+   * must not consume the successor). Also clears a dead-lettered
+   * incarnation (manual redelivery, then ack). It remains idempotent if the
+   * operation completes after the caller timed out. The bundled processor
+   * always supplies `context`.
+   */
+  markDelivered(deliveryIds: ReadonlyArray<string>, context?: ExecutionContext): Promise<void>;
+  /**
+   * Records one failed delivery attempt for the incarnation:
+   * increments its `attempts` and, once the store's ceiling is
+   * reached, moves it to the dead-letter set that `due` no longer
+   * returns. A no-op for unknown, delivered, or replaced ids.
+   * Returns the exact dead-letter record only on the call that performs
+   * that transition; retries below the ceiling and no-ops return
+   * `undefined`. A late completion may count that original delivery attempt; it
+   * must still no-op if the incarnation was delivered or replaced in the
+   * meantime. The bundled processor never reissues the same store call and
+   * always supplies `context`.
+   */
+  markFailed(deliveryId: string, error?: unknown, context?: ExecutionContext): Promise<DeadLetterDeadline<TPayload> | undefined>;
+  /**
+   * Deadlines that exhausted their delivery attempts. Wire this to durable
+   * alerting and reconciliation: a growing set means processes that stopped
+   * waking up, and the poller can stop between the store transition and its
+   * immediate observer callback.
+   */
+  deadLetters(): Promise<ReadonlyArray<DeadLetterDeadline<TPayload>>>;
+}
 //#endregion
-//#region src/app/idempotency.d.ts
+//#region src/application/idempotency/idempotency.d.ts
 /**
  * Result of `IdempotencyStore.claim()`: this execution owns the key and must
  * run the command (`claimed`), a previous execution completed and its outcome
@@ -2219,162 +1949,7 @@ interface WithIdempotentCommitDeps<Evt extends AnyDomainEvent, TCtx> extends Wit
  */
 declare function withIdempotentCommit<Evt extends AnyDomainEvent, R, TCtx>(deps: WithIdempotentCommitDeps<Evt, TCtx>, request: IdempotentCommitRequest, fn: (ctx: TCtx, enrollment: CommitEnrollment<Evt>, execution: IdempotentExecution) => Promise<WithCommitWorkResult<Evt, R>>): Promise<IdempotentCommitResult<R>>;
 //#endregion
-//#region src/deadlines/deadline-store.d.ts
-/**
- * One deadline due for delivery, as returned by
- * {@link DeadlineStore.due}. `deliveryId` identifies this scheduled
- * INCARNATION of the deadline, not the `(scope, key)` address: a
- * reschedule replaces the incarnation, and acknowledging a stale
- * incarnation must never consume the new one (see
- * {@link DeadlineStore.markDelivered}).
- */
-interface DueDeadline<TPayload = unknown> {
-  /** Opaque per-incarnation id used for `markDelivered`/`markFailed`. */
-  readonly deliveryId: string;
-  /** The namespace half of the address, e.g. a process or policy name. */
-  readonly scope: string;
-  /** The instance half of the address, e.g. a saga or reservation id. */
-  readonly key: string;
-  /** When the deadline was due. */
-  readonly dueAt: Date;
-  /** The payload handed back as the input; plain data only. */
-  readonly payload: TPayload;
-  /** Failed delivery attempts so far (see `markFailed`). */
-  readonly attempts: number;
-}
-/** A deadline that exhausted its delivery attempts; see {@link DeadlineStore.deadLetters}. */
-interface DeadLetterDeadline<TPayload = unknown> extends DueDeadline<TPayload> {
-  /** Human-readable rendering of the last delivery error, if recorded. */
-  readonly lastError?: string;
-}
-/**
- * Driven port for durable deadlines: timeout-as-input. A process that
- * waits ("if PaymentReceived has not arrived in 30 minutes,
- * compensate"; "release the reservation hold after 15 minutes";
- * "expire the offer at month's end") schedules a deadline, and a poll
- * loop later DELIVERS it as an input to whatever owns the decision, a
- * saga aggregate, a use case, a policy. The store never executes
- * consumer code; firing a deadline means handing back a record.
- *
- * Deliberately general-purpose and deliberately small. This is not a
- * scheduler framework and not a cron abstraction: there is no
- * recurrence, no execution engine, and the poll loop belongs to the
- * consumer (the outbox guide's `drainOnce` pattern fits; the deadlines
- * guide shows the wiring).
- *
- * Addressing is the `(scope, key)` pair, so one table serves every
- * waiting process in an application: `scope` names the policy
- * ("checkout-saga", "reservation-hold"), `key` the instance. There is
- * at most ONE pending deadline per address; `schedule` on an existing
- * address replaces it (that IS the reschedule operation), and each
- * scheduling gets a fresh `deliveryId`, so acknowledgements of a
- * replaced incarnation cannot consume its successor.
- *
- * Two sides, two transactional postures, the same split as the outbox:
- *
- * - **`schedule` and `cancel` are write-side calls** and must join the
- *   ambient write transaction (use a tx-bound store instance inside
- *   `withCommit`'s callback, exactly like an outbox adapter). This is
- *   a correctness rule, not a preference: state that says "waiting for
- *   payment" committed without its deadline is a process that never
- *   wakes up, and a deadline scheduled for a rolled-back state change
- *   is a ghost input.
- * - **`due`, `markDelivered`, `markFailed`, and `deadLetters` are the
- *   poll surface** and run out of band, in the consumer's loop.
- *
- * Delivery is at-least-once: a crash between processing and
- * `markDelivered` redelivers, so consumers make deadline handling
- * idempotent (the idempotency store with the `deliveryId` as key is
- * the ready-made answer). Deadlines have no cross-key ordering
- * obligations, so unlike the outbox a poison deadline blocks only
- * itself; bounded retries still matter, which is why failure tracking
- * is part of the port rather than an extension: report failed
- * deliveries via `markFailed`, and the store dead-letters a deadline
- * past its attempt ceiling.
- *
- * Run one logical poller per store unless your adapter's `due` claims
- * records for competing pollers; the same rule as the outbox
- * dispatcher.
- *
- * The bundled processor supplies an `ExecutionContext` to every poll-side
- * operation. Production adapters MUST pass its signal to native I/O or enforce
- * a native timeout no later than `deadlineAt`; the shell can bound its wait but
- * cannot terminate a promise that ignores cancellation. A timed-out write has
- * an unknown outcome. Acknowledgements must remain idempotent when they complete
- * late; a late failure update may count its original delivery attempt and must
- * still no-op after the incarnation was delivered or replaced.
- *
- * Verify an adapter with `createDeadlineStoreContractTests` from
- * `@shirudo/ddd-kit/testing`; `InMemoryDeadlineStore` is the
- * reference.
- *
- * @template TPayload - The payload shape carried from `schedule` to
- * delivery; plain, serializable data (the same discipline as event
- * payloads and snapshots)
- */
-interface DeadlineStore<TPayload = unknown> {
-  /**
-   * Schedules (or reschedules) the deadline at `(scope, key)`: at most
-   * one pending deadline exists per address, and scheduling an
-   * occupied address replaces its due time, payload, attempt count,
-   * and incarnation. Called inside the write transaction.
-   */
-  schedule(deadline: {
-    scope: string;
-    key: string;
-    dueAt: Date;
-    payload: TPayload;
-  }): Promise<void>;
-  /**
-   * Removes the pending deadline at `(scope, key)`; a no-op when none
-   * exists (the awaited input arrived in time and the wait is over).
-   * Called inside the write transaction.
-   */
-  cancel(scope: string, key: string): Promise<void>;
-  /**
-   * Up to `limit` deadlines with `dueAt <= now` that are neither
-   * delivered nor dead-lettered, ordered by `dueAt` (earliest first;
-   * ties in scheduling order). A `limit` of `0` is legal and yields an
-   * empty page (poll loops computing a remaining capacity may pass
-   * it). `now` is a parameter on purpose: the poll loop owns the
-   * clock, which keeps adapters deterministic and tests free of real
-   * time. The bundled processor always supplies `context`; it is optional only
-   * so existing adapters remain assignable.
-   */
-  due(now: Date, limit: number, context?: ExecutionContext): Promise<ReadonlyArray<DueDeadline<TPayload>>>;
-  /**
-   * Acknowledges delivered incarnations so they stop coming back.
-   * Idempotent on already-acknowledged and unknown ids, and a no-op
-   * for ids of REPLACED incarnations (a late ack after a reschedule
-   * must not consume the successor). Also clears a dead-lettered
-   * incarnation (manual redelivery, then ack). It remains idempotent if the
-   * operation completes after the caller timed out. The bundled processor
-   * always supplies `context`.
-   */
-  markDelivered(deliveryIds: ReadonlyArray<string>, context?: ExecutionContext): Promise<void>;
-  /**
-   * Records one failed delivery attempt for the incarnation:
-   * increments its `attempts` and, once the store's ceiling is
-   * reached, moves it to the dead-letter set that `due` no longer
-   * returns. A no-op for unknown, delivered, or replaced ids.
-   * Returns the exact dead-letter record only on the call that performs
-   * that transition; retries below the ceiling and no-ops return
-   * `undefined`. A late completion may count that original delivery attempt; it
-   * must still no-op if the incarnation was delivered or replaced in the
-   * meantime. The bundled processor never reissues the same store call and
-   * always supplies `context`.
-   */
-  markFailed(deliveryId: string, error?: unknown, context?: ExecutionContext): Promise<DeadLetterDeadline<TPayload> | undefined>;
-  /**
-   * Deadlines that exhausted their delivery attempts. Wire this to durable
-   * alerting and reconciliation: a growing set means processes that stopped
-   * waking up, and the poller can stop between the store transition and its
-   * immediate observer callback.
-   */
-  deadLetters(): Promise<ReadonlyArray<DeadLetterDeadline<TPayload>>>;
-}
-//#endregion
-//#region src/projections/ports.d.ts
+//#region src/application/projections/ports.d.ts
 /**
  * A projection's gap-proof cursor into one aggregate's commit chain.
  * `aggregateVersion` plus `commitSequence` orders events; `commitSize`
@@ -2529,7 +2104,7 @@ interface Projection<Evt extends AnyDomainEvent, TCtx = unknown> {
   truncate?(ctx: TCtx): Promise<void>;
 }
 //#endregion
-//#region src/repo/event-store.d.ts
+//#region src/persistence/event-store/event-store.d.ts
 /** Options for {@link EventStore.append}. */
 interface EventStoreAppendOptions {
   /**
@@ -2554,8 +2129,9 @@ interface ReadStreamOptions {
    * Return only events AFTER this stream position (1-based event count),
    * the snapshot catch-up read: `readStream(stream, { fromVersion:
    * snapshot.version, limit: 256 })` yields the next page passed to
-   * `aggregate.loadFromHistory`. Defaults to `0` (the first
-   * stream page).
+   * `aggregate.replayHistory`; the caller checks that the aggregate
+   * ends at the pinned head ({@link ReplayHeadMismatchError}). Defaults
+   * to `0` (the first stream page).
    * Must be a non-negative safe integer when present.
    */
   readonly fromVersion?: number;
@@ -2617,29 +2193,40 @@ type StreamReadResult<Evt extends AnyDomainEvent> = {
  *   const cached = this.tracking.identityMap.get(Order, id);
  *   if (cached) return cached;
  *   const address = this.stream(id);
- *   const order = Order.reconstitute(id); // bare instance, no events
- *   let fromVersion = 0;
- *   let targetVersion: number | undefined;
- *   for (;;) {
+ *   const first = await this.eventStore.readStream(address, { limit: 256 });
+ *   if (!first.exists) return undefined;
+ *   const targetVersion = first.lastVersion; // pin the first observed head
+ *   const reconstituted = reconstituteAggregateFromHistory(
+ *     () => Order.reconstitute(id), // bare instance, no events
+ *     first.events,
+ *   );
+ *   if (reconstituted.isErr()) throw reconstituted.error; // corrupt stream
+ *   const order = reconstituted.value;
+ *   let fromVersion = first.events.length;
+ *   while (fromVersion < targetVersion) {
  *     const page = await this.eventStore.readStream(address, {
  *       fromVersion,
  *       toVersion: targetVersion,
  *       limit: 256,
  *     });
- *     if (!page.exists) return undefined;
- *     targetVersion ??= page.lastVersion; // pin the first observed head
- *     if (fromVersion === targetVersion) break;
- *     if (page.events.length === 0) {
+ *     if (!page.exists || page.events.length === 0) {
  *       throw new NonProgressingEventStreamPageError({
  *         ...address,
  *         fromVersion,
  *         targetVersion,
  *       });
  *     }
- *     const result = order.loadFromHistory(page.events);
- *     if (result.isErr()) throw result.error; // corrupt stream
+ *     const catchUp = order.replayHistory(page.events);
+ *     if (catchUp.isErr()) throw catchUp.error; // corrupt stream
  *     fromVersion += page.events.length;
  *   }
+ *   if (order.version !== targetVersion) {
+ *     throw new ReplayHeadMismatchError({
+ *       ...address,
+ *       targetVersion,
+ *       actualVersion: order.version,
+ *     });
+ *   }
  *   return this.tracking.trackLoaded(order);
  * }
  *
@@ -2696,7 +2283,7 @@ interface EventStore<Evt extends AnyDomainEvent> {
    *     append order and slicing; because the port cannot inject malformed
    *     physical rows, adapters add a store-specific corruption fixture that
    *     proves the duplicate/gap rejection. The repository then calls
-   *     `loadFromHistory`, whose replay guard rejects any event carrying an
+   *     `replayHistory`, whose replay guard rejects any event carrying an
    *     aggregate type or id that contradicts this stream key.
    *
    * An empty `events` array is a no-op; implementations resolve without
@@ -2742,12 +2329,12 @@ interface EventStore<Evt extends AnyDomainEvent> {
   readStream(stream: AggregateAddress, options: ReadStreamOptions): Promise<StreamReadResult<Evt>>;
 }
 //#endregion
-//#region src/repo/snapshot-store.d.ts
+//#region src/persistence/snapshot-store/snapshot-store.d.ts
 /**
  * Driven port for aggregate snapshot persistence: the storage half of
  * the snapshot-plus-recent-events load path for event-sourced aggregates.
  * `SnapshotModel` owns projection, migration, and reconstitution;
- * `EventStore.readStream` supplies the catch-up tail to `loadFromHistory`.
+ * `EventStore.readStream` supplies the catch-up tail to `replayHistory`.
  *
  * **A snapshot is derived data, never authority.** The stream remains
  * the source of truth; a snapshot only shortens replay. That shapes
@@ -2804,5 +2391,5 @@ interface SnapshotStore<TState = unknown> {
   delete(address: AggregateAddress): Promise<void>;
 }
 //#endregion
-export { OutboxWriter as $, ClockFactory as $t, WithCommitWorkResult as A, AnyDomainEvent as At, DurableCommandMessage as B, EventIdFactory as Bt, IdempotentExecution as C, updateEntityById as Ct, CommitEnrollment as D, IEventSourcedAggregate as Dt, AggregateCommitToken as E, IAggregateRoot as Et, CommandMessageContent as F, CreateUncommittedDomainEventOptions as Ft, DispatchTrackingOutbox as G, copyMetadata as Gt, CommitPosition as H, PendingDomainEvent as Ht, CommandMessageRelationships as I, DomainEvent as It, EventCommitCandidatePosition as J, createDomainEventFromFacts as Jt, EventBus as K, createDomainEvent as Kt, CommandOutboxCommitCandidate as L, DomainEventFactory as Lt, TransactionScope as M, CreateDomainEventFromFactsOptions as Mt, TransactionalOptions as N, CreateDomainEventOptions as Nt, CommitEnrollmentOptions as O, Version as Ot, CommandCommitOriginCandidate as P, CreateDomainEventStampOptions as Pt, OutboxRecord as Q, recordDomainEvent as Qt, CommandOutboxMapper as R, DomainEventFactoryOptions as Rt, IdempotentCommitResult as S, sameEntity as St, withIdempotentCommit as T, AggregateSnapshot as Tt, CommittedDomainEvent as U, UncommittedDomainEvent as Ut, routeEventsToCommandOutbox as V, EventMetadata as Vt, DeadLetterRecord as W, UncommittedDomainEventOf as Wt, OnceOptions as X, defaultDomainEventFactory as Xt, EventHandler as Y, createUncommittedDomainEvent as Yt, Outbox as Z, mergeMetadata as Zt, IdempotencyOperationErrorContext as _, findEntityById as _t, StreamReadResult as a, JsonObject as at, IdempotencyStore as b, removeEntityById as bt, ProjectionCheckpointStore as c, AggregateRoot as ct, DeadLetterDeadline as d, Entity as dt, Id as en, PublishOptions as et, DeadlineStore as f, EntityConfig as ft, IdempotencyLease as g, entityIds as gt, IdempotencyClaimHandle as h, StateValidator as ht, ReadStreamOptions as i, PublishedCommand as it, withCommit as j, AnyUncommittedDomainEvent as jt, WithCommitDeps as k, sameVersion as kt, ProjectionPosition as l, AggregateConfig as lt, IdempotencyClaim as m, Identifiable as mt, EventStore as n, Command as nt, Projection as o, JsonPrimitive as ot, DueDeadline as p, IEntity as pt, EventCommitCandidate as q, createDomainEventFactory as qt, EventStoreAppendOptions as r, CommandHandler as rt, ProjectionCheckpoint as s, JsonValue as st, SnapshotStore as t, IdGenerator as tn, ExecutionContext as tt, isPositionAfter as u, BaseAggregate as ut, IdempotencyReconciliation as v, freezeShallow as vt, WithIdempotentCommitDeps as w, AggregateAddress as wt, IdempotentCommitRequest as x, replaceEntityById as xt, IdempotencyReconciliationDecision as y, hasEntityId as yt, CommandOutboxWriter as z, DomainEventStamp as zt };
+export { routeEventsToCommandOutbox as $, WithCommitWorkResult as A, defaultDomainEventFactory as At, ReplayableAggregate as B, JsonValue as Bt, DeadLetterDeadline as C, UncommittedDomainEvent as Ct, CommitEnrollment as D, createDomainEventFactory as Dt, AggregateCommitToken as E, createDomainEvent as Et, EventHandler as F, Command as Ft, IdGenerator as G, sameVersion as H, OnceOptions as I, CommandHandler as It, CommandMessageRelationships as J, CommandCommitOriginCandidate as K, PublishOptions as L, PublishedCommand as Lt, TransactionScope as M, recordDomainEvent as Mt, TransactionalOptions as N, ClockFactory as Nt, CommitEnrollmentOptions as O, createDomainEventFromFacts as Ot, EventBus as P, AggregateAddress as Pt, DurableCommandMessage as Q, Aggregate as R, JsonObject as Rt, withIdempotentCommit as S, PendingDomainEvent as St, DueDeadline as T, copyMetadata as Tt, toVersion as U, Version as V, Id as W, CommandOutboxMapper as X, CommandOutboxCommitCandidate as Y, CommandOutboxWriter as Z, IdempotencyStore as _, DomainEventFactory as _t, StreamReadResult as a, ExecutionContext as at, IdempotentExecution as b, EventIdFactory as bt, ProjectionCheckpointStore as c, EventCommitCandidate as ct, IdempotencyClaim as d, AnyUncommittedDomainEvent as dt, DeadLetterRecord as et, IdempotencyClaimHandle as f, CreateDomainEventFromFactsOptions as ft, IdempotencyReconciliationDecision as g, DomainEvent as gt, IdempotencyReconciliation as h, CreateUncommittedDomainEventOptions as ht, ReadStreamOptions as i, OutboxWriter as it, withCommit as j, mergeMetadata as jt, WithCommitDeps as k, createUncommittedDomainEvent as kt, ProjectionPosition as l, EventCommitCandidatePosition as lt, IdempotencyOperationErrorContext as m, CreateDomainEventStampOptions as mt, EventStore as n, Outbox as nt, Projection as o, CommitPosition as ot, IdempotencyLease as p, CreateDomainEventOptions as pt, CommandMessageContent as q, EventStoreAppendOptions as r, OutboxRecord as rt, ProjectionCheckpoint as s, CommittedDomainEvent as st, SnapshotStore as t, DispatchTrackingOutbox as tt, isPositionAfter as u, AnyDomainEvent as ut, IdempotentCommitRequest as v, DomainEventFactoryOptions as vt, DeadlineStore as w, UncommittedDomainEventOf as wt, WithIdempotentCommitDeps as x, EventMetadata as xt, IdempotentCommitResult as y, DomainEventStamp as yt, AggregateSnapshot as z, JsonPrimitive as zt };
 //# sourceMappingURL=snapshot-store.d.ts.map