@shirudo/ddd-kit 2.0.0 → 3.0.0-rc.10

package/dist/chunks/ports.js

@@ -0,0 +1,1815 @@
+import { J as assertNoHostileOwnProtoKey } from "./kit-errors.js";
+import { err, ok } from "@shirudo/result";
+
+//#region src/internal/structural/is-built-in.ts
+/**
+* Set of `Object.prototype.toString.call(x)` tags that the library treats
+* as built-in atomic types. Members of this set are compared/cloned by
+* reference (or with type-specific logic) rather than walked structurally.
+*
+* Detection is tag-based, since `Object.prototype.toString` gives the same
+* answer across realms (an iframe's `Date` has the same tag as the main
+* window's `Date`), and then brand-verified via internal-slot probes,
+* because `Symbol.toStringTag` lets any plain object claim a built-in tag.
+* The previous strategy also checked `globalThis[name] === constructor`
+* and a `proto !== Object.prototype` heuristic; both broke for cross-realm
+* objects and the latter additionally misclassified ordinary user classes
+* as built-ins.
+*/
+const BUILT_IN_TAGS = /* @__PURE__ */ new Set([
+	"[object Date]",
+	"[object RegExp]",
+	"[object Map]",
+	"[object Set]",
+	"[object WeakMap]",
+	"[object WeakSet]",
+	"[object Promise]",
+	"[object Error]",
+	"[object Boolean]",
+	"[object Number]",
+	"[object String]",
+	"[object BigInt]",
+	"[object ArrayBuffer]",
+	"[object SharedArrayBuffer]",
+	"[object DataView]"
+]);
+function intrinsicGetter(proto, prop) {
+	const get = Object.getOwnPropertyDescriptor(proto, prop)?.get;
+	if (!get) throw new Error(`missing intrinsic getter for ${prop}`);
+	return get;
+}
+const dateGetTime = Date.prototype.getTime;
+const mapSizeGet = intrinsicGetter(Map.prototype, "size");
+const setSizeGet = intrinsicGetter(Set.prototype, "size");
+const weakMapHas = WeakMap.prototype.has;
+const weakSetHas = WeakSet.prototype.has;
+const dataViewByteLengthGet = intrinsicGetter(DataView.prototype, "byteLength");
+const arrayBufferByteLengthGet = intrinsicGetter(ArrayBuffer.prototype, "byteLength");
+const sharedArrayBufferByteLengthGet = typeof SharedArrayBuffer === "undefined" ? void 0 : intrinsicGetter(SharedArrayBuffer.prototype, "byteLength");
+const regExpSourceGet = intrinsicGetter(RegExp.prototype, "source");
+const booleanValueOf = Boolean.prototype.valueOf;
+const numberValueOf = Number.prototype.valueOf;
+const stringValueOf = String.prototype.valueOf;
+const bigIntValueOf = BigInt.prototype.valueOf;
+const functionToString = Function.prototype.toString;
+const PROBE_KEY = {};
+const intrinsicConstructorSources = new Map([
+	"Object",
+	"Array",
+	"Date",
+	"RegExp",
+	"Map",
+	"Set",
+	"WeakMap",
+	"WeakSet",
+	"Promise",
+	"Error",
+	"EvalError",
+	"RangeError",
+	"ReferenceError",
+	"SyntaxError",
+	"TypeError",
+	"URIError",
+	"AggregateError",
+	"Boolean",
+	"Number",
+	"String",
+	"BigInt",
+	"ArrayBuffer",
+	"SharedArrayBuffer",
+	"DataView",
+	"Int8Array",
+	"Uint8Array",
+	"Uint8ClampedArray",
+	"Int16Array",
+	"Uint16Array",
+	"Int32Array",
+	"Uint32Array",
+	"Float32Array",
+	"Float64Array",
+	"BigInt64Array",
+	"BigUint64Array"
+].flatMap((name) => {
+	const intrinsic = Object.getOwnPropertyDescriptor(globalThis, name)?.value;
+	return typeof intrinsic === "function" ? [[name, functionToString.call(intrinsic)]] : [];
+}));
+const intrinsicConstructorSourceSet = new Set(intrinsicConstructorSources.values());
+const ERROR_INTRINSIC_NAMES = [
+	"Error",
+	"EvalError",
+	"RangeError",
+	"ReferenceError",
+	"SyntaxError",
+	"TypeError",
+	"URIError",
+	"AggregateError"
+];
+function isIntrinsicConstructorPrototype(prototype, expectedName) {
+	const constructorDescriptor = Object.getOwnPropertyDescriptor(prototype, "constructor");
+	const candidateConstructor = constructorDescriptor?.value;
+	if (constructorDescriptor === void 0 || !("value" in constructorDescriptor) || typeof candidateConstructor !== "function") return false;
+	let candidateSource;
+	try {
+		candidateSource = functionToString.call(candidateConstructor);
+	} catch {
+		return false;
+	}
+	const expectedSource = expectedName === void 0 ? void 0 : intrinsicConstructorSources.get(expectedName);
+	if (expectedSource !== void 0 && candidateSource !== expectedSource || expectedSource === void 0 && !intrinsicConstructorSourceSet.has(candidateSource)) return false;
+	const nameDescriptor = Object.getOwnPropertyDescriptor(candidateConstructor, "name");
+	const candidateName = nameDescriptor !== void 0 && "value" in nameDescriptor && typeof nameDescriptor.value === "string" ? nameDescriptor.value : void 0;
+	const intrinsicName = expectedName ?? candidateName;
+	const intrinsicSource = intrinsicName === void 0 ? void 0 : intrinsicConstructorSources.get(intrinsicName);
+	return candidateName === intrinsicName && intrinsicSource !== void 0 && candidateSource === intrinsicSource && Object.getOwnPropertyDescriptor(candidateConstructor, "prototype")?.value === prototype;
+}
+/**
+* Accepts an intrinsic prototype, optionally behind transparent
+* `Symbol.toStringTag` override layers. A user-defined subclass has its own
+* non-native constructor and is therefore rejected before reaching the
+* intrinsic prototype.
+*/
+function hasIntrinsicPrototypeChain(value, expectedName) {
+	const visited = /* @__PURE__ */ new WeakSet();
+	let prototype = Object.getPrototypeOf(value);
+	while (prototype !== null && !visited.has(prototype)) {
+		visited.add(prototype);
+		if (Object.hasOwn(prototype, "constructor")) return isIntrinsicConstructorPrototype(prototype, expectedName);
+		const ownKeys = Reflect.ownKeys(prototype);
+		if (ownKeys.length !== 1 || ownKeys[0] !== Symbol.toStringTag) return false;
+		prototype = Object.getPrototypeOf(prototype);
+	}
+	return false;
+}
+/**
+* Tags that `deepEqual` compares BY REFERENCE (its unhandled-built-in
+* fallback) and that `deepOmit` must therefore ALIAS rather than clone:
+* a clone would break `deepEqualExcept(x, x)` reflexivity. Single source
+* of truth so the two modules cannot drift: if `deepEqual` ever learns a
+* by-value comparison for one of these, remove it here and add a clone
+* case in `deepOmit`'s `cloneBuiltIn` in the same change.
+*/
+const REFERENCE_COMPARED_TAGS = /* @__PURE__ */ new Set([
+	"[object Error]",
+	"[object ArrayBuffer]",
+	"[object SharedArrayBuffer]",
+	"[object Promise]",
+	"[object WeakMap]",
+	"[object WeakSet]"
+]);
+/**
+* Intrinsic tags of OPAQUE exotics: objects whose internal state no
+* structural walk can observe (boxed Symbols, generator objects,
+* WeakRefs, FinalizationRegistry handles). `deepEqual` compares them by
+* identity and `deepOmit` passes them through by reference; treating
+* them as (empty) plain objects would make ALL such exotics equal to
+* each other. Deliberately a curated INTRINSIC list, not "every unknown
+* tag": a user class exposing its own `Symbol.toStringTag` (e.g.
+* "Money") keeps structural comparison, and a plain object spoofing one
+* of these intrinsic tags gets the identity semantics of the thing it
+* claims to be.
+*/
+const OPAQUE_EXOTIC_TAGS = /* @__PURE__ */ new Set([
+	"[object Symbol]",
+	"[object Generator]",
+	"[object AsyncGenerator]",
+	"[object WeakRef]",
+	"[object FinalizationRegistry]"
+]);
+/** True when `tag` names an opaque intrinsic; see {@link OPAQUE_EXOTIC_TAGS}. */
+function isOpaqueExoticTag(tag) {
+	return OPAQUE_EXOTIC_TAGS.has(tag);
+}
+function findPropertyDescriptor(value, key) {
+	const visited = /* @__PURE__ */ new WeakSet();
+	let current = value;
+	while (current !== null && !visited.has(current)) {
+		visited.add(current);
+		const descriptor = Object.getOwnPropertyDescriptor(current, key);
+		if (descriptor !== void 0) return descriptor;
+		current = Object.getPrototypeOf(current);
+	}
+}
+function builtInTagWithoutInvokingAccessors(value) {
+	if (ArrayBuffer.isView(value)) return hasBrand(value, "[object DataView]") ? "[object DataView]" : "[object TypedArray]";
+	const descriptor = findPropertyDescriptor(value, Symbol.toStringTag);
+	if (descriptor !== void 0 && !("value" in descriptor)) return builtInTagFromBrand(value);
+	const tag = Object.prototype.toString.call(value);
+	if (BUILT_IN_TAGS.has(tag) && hasBrand(value, tag)) return tag;
+	return descriptor === void 0 ? void 0 : builtInTagFromBrand(value);
+}
+function builtInTagFromBrand(value) {
+	if (hasBrand(value, "[object Date]")) return "[object Date]";
+	if (hasBrand(value, "[object RegExp]")) return "[object RegExp]";
+	if (hasBrand(value, "[object Map]")) return "[object Map]";
+	if (hasBrand(value, "[object Set]")) return "[object Set]";
+	if (hasBrand(value, "[object WeakMap]")) return "[object WeakMap]";
+	if (hasBrand(value, "[object WeakSet]")) return "[object WeakSet]";
+	if (hasBrand(value, "[object DataView]")) return "[object DataView]";
+	if (hasBrand(value, "[object ArrayBuffer]")) return "[object ArrayBuffer]";
+	if (hasBrand(value, "[object SharedArrayBuffer]")) return "[object SharedArrayBuffer]";
+	if (hasBrand(value, "[object Boolean]")) return "[object Boolean]";
+	if (hasBrand(value, "[object Number]")) return "[object Number]";
+	if (hasBrand(value, "[object String]")) return "[object String]";
+	if (hasBrand(value, "[object BigInt]")) return "[object BigInt]";
+	if (hasNativePrototype(value, "Promise")) return "[object Promise]";
+	if (hasNativePrototype(value, "Error")) return "[object Error]";
+}
+function hasNativePrototype(value, expectedName) {
+	const visited = /* @__PURE__ */ new WeakSet();
+	let prototype = Object.getPrototypeOf(value);
+	while (prototype !== null && !visited.has(prototype)) {
+		visited.add(prototype);
+		if (isIntrinsicConstructorPrototype(prototype, expectedName)) return true;
+		prototype = Object.getPrototypeOf(prototype);
+	}
+	return false;
+}
+/**
+* Verifies that `obj` genuinely is the type its tag claims, via an
+* internal-slot probe. Promise and Error have no side-effect-free standard
+* probe, so their visible tags remain conservative; masked instances are
+* identified separately through their native prototype chain.
+*/
+function hasBrand(obj, tag) {
+	try {
+		switch (tag) {
+			case "[object Date]":
+				dateGetTime.call(obj);
+				return true;
+			case "[object RegExp]":
+				regExpSourceGet.call(obj);
+				return true;
+			case "[object Map]":
+				mapSizeGet.call(obj);
+				return true;
+			case "[object Set]":
+				setSizeGet.call(obj);
+				return true;
+			case "[object WeakMap]":
+				weakMapHas.call(obj, PROBE_KEY);
+				return true;
+			case "[object WeakSet]":
+				weakSetHas.call(obj, PROBE_KEY);
+				return true;
+			case "[object DataView]":
+				dataViewByteLengthGet.call(obj);
+				return true;
+			case "[object ArrayBuffer]":
+				arrayBufferByteLengthGet.call(obj);
+				return true;
+			case "[object SharedArrayBuffer]":
+				if (!sharedArrayBufferByteLengthGet) return false;
+				sharedArrayBufferByteLengthGet.call(obj);
+				return true;
+			case "[object Boolean]":
+				booleanValueOf.call(obj);
+				return true;
+			case "[object Number]":
+				numberValueOf.call(obj);
+				return true;
+			case "[object String]":
+				stringValueOf.call(obj);
+				return true;
+			case "[object BigInt]":
+				bigIntValueOf.call(obj);
+				return true;
+			case "[object Promise]": return hasNativePrototype(obj, "Promise");
+			case "[object Error]": return ERROR_INTRINSIC_NAMES.some((name) => hasNativePrototype(obj, name));
+			default: return false;
+		}
+	} catch {
+		return false;
+	}
+}
+/**
+* Returns `true` when `obj` is a built-in JavaScript type that should be
+* treated atomically (compared/cloned as a unit, not walked structurally).
+* Cross-realm safe, and brand-verified: a plain object spoofing a built-in
+* tag via `Symbol.toStringTag` returns `false` and is walked structurally
+* like any other plain object instead of crashing type-specific code.
+*
+* @param obj - The object to classify
+* @param tag - The result of `Object.prototype.toString.call(obj)`, passed
+*              in so callers that already computed it don't pay twice
+*/
+function isBuiltInObject(obj, tag) {
+	if (ArrayBuffer.isView(obj)) return true;
+	if (tag.endsWith("Array]")) return false;
+	return BUILT_IN_TAGS.has(tag) && hasBrand(obj, tag);
+}
+/**
+* Brand-verified `WeakMap` check that holds across realms. `instanceof
+* WeakMap` binds to the constructor of one realm, so a WeakMap from a `vm`
+* context or an iframe reads as a foreign value. The internal-slot probe
+* answers the same in every realm, and a plain object cannot spoof it
+* through `Symbol.toStringTag`.
+*/
+function isWeakMap(value) {
+	return typeof value === "object" && value !== null && hasBrand(value, "[object WeakMap]");
+}
+
+//#endregion
+//#region src/internal/structural/deep-equal.ts
+const objProto = Object.prototype;
+const objToString = objProto.toString;
+const objHasOwn = objProto.hasOwnProperty;
+/**
+* SameValueZero: `===` plus NaN-equals-NaN (and `+0 === -0`, unlike
+* `Object.is`). The numeric semantics `deepEqual` documents for primitives,
+* applied consistently inside TypedArrays, Dates and Number wrappers.
+*/
+function sameValueZero(a, b) {
+	return a === b || Number.isNaN(a) && Number.isNaN(b);
+}
+/**
+* Performs a deep equality check between two values.
+*
+* This function compares values recursively, handling:
+* - Primitives (with special handling for NaN)
+* - Arrays (nested arrays supported)
+* - Objects (plain objects and class instances)
+* - TypedArrays (Uint8Array, Int32Array, etc.)
+* - DataView
+* - Maps and Sets
+* - Dates and RegExp
+* - Wrapper objects (Boolean, Number, String)
+* - Circular references (detected and handled)
+*
+* @param a - The first value to compare
+* @param b - The second value to compare
+* @returns `true` if the values are deeply equal, `false` otherwise
+*
+* @example
+* ```ts
+* deepEqual([1, 2, 3], [1, 2, 3]); // true
+* deepEqual({ a: 1, b: [2, 3] }, { a: 1, b: [2, 3] }); // true
+* deepEqual(NaN, NaN); // true
+* deepEqual([1, 2], [1, 2, 3]); // false
+* ```
+*/
+function deepEqual(a, b) {
+	return deepEqualInner(a, b, /* @__PURE__ */ new WeakMap());
+}
+/**
+* Internal recursive function for deep equality comparison.
+*
+* @internal
+*/
+function deepEqualInner(a, b, visited) {
+	if (a === b) return true;
+	const typeA = typeof a;
+	const typeB = typeof b;
+	if (typeA !== "object" || a === null || typeB !== "object" || b === null) {
+		if (typeA === "number" && typeB === "number") return Number.isNaN(a) && Number.isNaN(b);
+		return false;
+	}
+	const objA = a;
+	const objB = b;
+	let cachedBs = visited.get(objA);
+	if (cachedBs?.has(objB)) return true;
+	if (!cachedBs) {
+		cachedBs = /* @__PURE__ */ new WeakSet();
+		visited.set(objA, cachedBs);
+	}
+	cachedBs.add(objB);
+	if (ArrayBuffer.isView(objA) || ArrayBuffer.isView(objB)) {
+		if (!ArrayBuffer.isView(objA) || !ArrayBuffer.isView(objB)) return false;
+		const tagA = objToString.call(objA);
+		if (tagA !== objToString.call(objB)) return false;
+		if (tagA === "[object DataView]") {
+			const viewA = objA;
+			const viewB = objB;
+			if (viewA.byteLength !== viewB.byteLength) return false;
+			const len = viewA.byteLength;
+			for (let i = 0; i < len; i++) if (viewA.getUint8(i) !== viewB.getUint8(i)) return false;
+			return true;
+		}
+		const arrA = objA;
+		const arrB = objB;
+		const len = arrA.length;
+		if (len !== arrB.length) return false;
+		for (let i = 0; i < len; i++) if (!sameValueZero(arrA[i], arrB[i])) return false;
+		return true;
+	}
+	if (Array.isArray(objA) || Array.isArray(objB)) {
+		if (!Array.isArray(objA) || !Array.isArray(objB)) return false;
+		if (objA.length !== objB.length) return false;
+		const keysA = Reflect.ownKeys(objA).filter((key) => key !== "length");
+		const keysB = Reflect.ownKeys(objB).filter((key) => key !== "length");
+		if (keysA.length !== keysB.length) return false;
+		const arrA = objA;
+		const arrB = objB;
+		for (const key of keysA) {
+			if (!objHasOwn.call(objB, key)) return false;
+			if (!deepEqualInner(arrA[key], arrB[key], visited)) return false;
+		}
+		return true;
+	}
+	const tagA = objToString.call(objA);
+	const tagB = objToString.call(objB);
+	if (tagA !== tagB) return false;
+	const builtInA = isBuiltInObject(objA, tagA);
+	if (builtInA !== isBuiltInObject(objB, tagB)) return false;
+	if (!builtInA) {
+		if (isOpaqueExoticTag(tagA)) return objA === objB;
+		return comparePlainObjects(objA, objB, visited);
+	}
+	switch (tagA) {
+		case "[object Map]": {
+			const mapA = objA;
+			const mapB = objB;
+			if (mapA.size !== mapB.size) return false;
+			for (const [key, valA] of mapA) {
+				if (!mapB.has(key)) return false;
+				if (!deepEqualInner(valA, mapB.get(key), visited)) return false;
+			}
+			return true;
+		}
+		case "[object Set]": {
+			const setA = objA;
+			const setB = objB;
+			if (setA.size !== setB.size) return false;
+			for (const value of setA) if (!setB.has(value)) return false;
+			return true;
+		}
+		case "[object Date]": return sameValueZero(objA.getTime(), objB.getTime());
+		case "[object RegExp]": {
+			const regA = objA;
+			const regB = objB;
+			return regA.source === regB.source && regA.flags === regB.flags;
+		}
+		case "[object Boolean]":
+		case "[object Number]":
+		case "[object String]":
+		case "[object BigInt]": return sameValueZero(objA.valueOf(), objB.valueOf());
+		default: return objA === objB;
+	}
+}
+/**
+* Plain / custom objects: compare own enumerable string keys + own symbol
+* keys and their values. Used both as the final fallback and for objects
+* whose built-in-looking tag failed brand verification.
+*/
+function comparePlainObjects(objA, objB, visited) {
+	const recA = objA;
+	const recB = objB;
+	const stringKeysA = Object.getOwnPropertyNames(objA);
+	const stringKeysB = Object.getOwnPropertyNames(objB);
+	if (stringKeysA.length !== stringKeysB.length) return false;
+	const symbolKeysA = Object.getOwnPropertySymbols(objA);
+	const symbolKeysB = Object.getOwnPropertySymbols(objB);
+	if (symbolKeysA.length !== symbolKeysB.length) return false;
+	const symbolKeysBSet = new Set(symbolKeysB);
+	for (const key of stringKeysA) if (!objHasOwn.call(objB, key)) return false;
+	for (const key of symbolKeysA) if (!symbolKeysBSet.has(key)) return false;
+	for (const key of stringKeysA) if (!deepEqualInner(recA[key], recB[key], visited)) return false;
+	for (const key of symbolKeysA) if (!deepEqualInner(recA[key], recB[key], visited)) return false;
+	return true;
+}
+
+//#endregion
+//#region src/internal/structural/deep-omit.ts
+/**
+* Creates a deep copy of `value` with certain keys removed according to the
+* provided rules.
+*
+* Walks the object tree and skips keys that match `ignoreKeys` /
+* `ignoreKeyPredicate`. Built-in atomic types that `deepEqual` compares by
+* value (Date, RegExp, Map, Set, TypedArrays, DataView) are cloned by type
+* rather than walked, since their internal structure has no key filtering to
+* apply. Types that `deepEqual` compares by reference (Error, ArrayBuffer,
+* SharedArrayBuffer, Promise, WeakMap, WeakSet) are passed through by
+* reference, so `deepEqualExcept(x, x)` stays reflexive. Cycles are
+* preserved: a cycle `a → a` clones to `a' → a'`. Arrays retain sparse
+* holes and all non-ignored own properties, including symbol keys.
+*
+* **Shared references.** Without `ignoreKeyPredicate`, an object reached
+* via several paths dedupes to a single clone. With a predicate, each
+* path gets its own clone, because the predicate may decide differently per
+* path, so memoising the first path's result would be wrong. This is
+* inherently exponential for diamond-shaped sharing (a node reachable
+* via 2^n paths is cloned 2^n times); the walk aborts with a descriptive
+* error after {@link PATH_SENSITIVE_VISIT_BUDGET} node visits instead of
+* hanging the process.
+*
+* **Prototype-pollution safety.** `__proto__` and `constructor` keys
+* encountered as *own* properties of the input (typical of `JSON.parse`
+* output) are copied as inert data properties via `Object.defineProperty`
+* so the clone graph cannot bleed into `Object.prototype`.
+*
+* **Class instances.** When the input is a class instance, the clone is
+* built via `Object.create(proto)` so the prototype is preserved, but the
+* constructor is NOT re-invoked, so class invariants enforced by the
+* constructor are not re-checked. `deepOmit` is therefore best used for
+* comparison/serialisation (`voEqualsExcept`, `deepEqualExcept`), not as
+* a general-purpose clone for behaviour-carrying objects.
+*
+* @param value - The value to create a deep copy from
+* @param options - Options specifying which keys to ignore
+* @returns A deep copy of `value` with specified keys removed
+*/
+function deepOmit(value, options) {
+	const visited = /* @__PURE__ */ new WeakMap();
+	return omitInternal(value, options, options.ignoreKeys ? new Set(options.ignoreKeys) : void 0, [], visited, options.ignoreKeyPredicate ? { visits: 0 } : void 0);
+}
+/**
+* Maximum object-node visits for a single path-sensitive `deepOmit` walk.
+* Per-path cloning expands exponentially on diamond-shaped sharing; past
+* this bound the walk throws instead of hanging the process. One million
+* visits covers any realistically tree-shaped input.
+*/
+const PATH_SENSITIVE_VISIT_BUDGET = 1e6;
+function omitInternal(value, options, ignoreKeys, path, visited, budget) {
+	if (value === null) return value;
+	if (typeof value !== "object") return value;
+	const obj = value;
+	if (visited.has(obj)) return visited.get(obj);
+	if (budget && ++budget.visits > PATH_SENSITIVE_VISIT_BUDGET) throw new Error(`deepOmit: exceeded ${PATH_SENSITIVE_VISIT_BUDGET} node visits. With ignoreKeyPredicate, objects reached via shared references are cloned once per path (the predicate may decide differently per path), which expands exponentially on diamond-shaped sharing. Restructure the input to a tree, or use ignoreKeys for path-independent filtering.`);
+	if (Array.isArray(obj)) {
+		const arr = obj;
+		const clone = new Array(arr.length);
+		const lengthDescriptor = Object.getOwnPropertyDescriptor(arr, "length");
+		visited.set(obj, clone);
+		for (const key of Reflect.ownKeys(arr)) {
+			if (key === "length") continue;
+			const segment = arrayPathSegment(key);
+			if (typeof segment !== "number" && shouldIgnoreKey(key, path, ignoreKeys, options)) continue;
+			const descriptor = Object.getOwnPropertyDescriptor(arr, key);
+			if (descriptor === void 0) continue;
+			path.push(segment);
+			if ("value" in descriptor) descriptor.value = omitInternal(descriptor.value, options, ignoreKeys, path, visited, budget);
+			Object.defineProperty(clone, key, descriptor);
+			path.pop();
+		}
+		if (lengthDescriptor !== void 0) Object.defineProperty(clone, "length", lengthDescriptor);
+		if (budget) visited.delete(obj);
+		return clone;
+	}
+	const tag = Object.prototype.toString.call(obj);
+	if (isBuiltInObject(obj, tag)) {
+		const builtInClone = cloneBuiltIn(obj, tag);
+		visited.set(obj, builtInClone);
+		return builtInClone;
+	}
+	if (isOpaqueExoticTag(tag)) {
+		visited.set(obj, obj);
+		return obj;
+	}
+	const clone = Object.create(Object.getPrototypeOf(obj));
+	visited.set(obj, clone);
+	const stringKeys = Object.getOwnPropertyNames(obj);
+	const symbolKeys = Object.getOwnPropertySymbols(obj);
+	for (const key of [...stringKeys, ...symbolKeys]) {
+		if (shouldIgnoreKey(key, path, ignoreKeys, options)) continue;
+		path.push(key);
+		assignOwn(clone, key, omitInternal(obj[key], options, ignoreKeys, path, visited, budget), Object.getOwnPropertyDescriptor(obj, key)?.enumerable ?? true);
+		path.pop();
+	}
+	if (budget) visited.delete(obj);
+	return clone;
+}
+function arrayPathSegment(key) {
+	if (typeof key === "symbol") return key;
+	const index = Number(key);
+	return Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key ? index : key;
+}
+/**
+* Assigns `value` as an OWN data property on `target` without going through
+* any inherited setter; critically, it never invokes the `__proto__` setter
+* even when `key === "__proto__"`. Required to defeat prototype-pollution
+* payloads that ship `__proto__` as a parsed-JSON own key.
+*/
+function assignOwn(target, key, value, enumerable = true) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable,
+		configurable: true
+	});
+}
+/**
+* Clones a built-in atomic type by case. Falls back to `structuredClone`
+* for anything not explicitly enumerated (e.g. DataView, TypedArrays,
+* Boolean/Number/String wrappers, all of which `deepEqual` compares by
+* value). Types that `deepEqual` compares BY REFERENCE (the shared
+* {@link REFERENCE_COMPARED_TAGS} set) are passed through by reference
+* instead; cloning them would make `deepEqualExcept(x, x)` false.
+* Promise/WeakMap/WeakSet additionally cannot be cloned at all
+* (`structuredClone` rejects them).
+*/
+function cloneBuiltIn(obj, tag) {
+	if (REFERENCE_COMPARED_TAGS.has(tag)) return obj;
+	switch (tag) {
+		case "[object Date]": return new Date(obj.getTime());
+		case "[object RegExp]": {
+			const re = obj;
+			const copy = new RegExp(re.source, re.flags);
+			copy.lastIndex = re.lastIndex;
+			return copy;
+		}
+		case "[object Map]": return new Map(obj);
+		case "[object Set]": return new Set(obj);
+		default: return structuredClone(obj);
+	}
+}
+function shouldIgnoreKey(key, path, ignoreKeys, options) {
+	if (ignoreKeys?.has(key)) return true;
+	if (options.ignoreKeyPredicate?.(key, path.slice())) return true;
+	return false;
+}
+
+//#endregion
+//#region src/internal/structural/deep-equal-except.ts
+/**
+* Performs a deep equality comparison between two values after omitting specified keys.
+*
+* This function first removes the specified keys from both values using `deepOmit`,
+* then performs a deep equality check using `deepEqual`.
+*
+* @param a - The first value to compare
+* @param b - The second value to compare
+* @param options - Options specifying which keys to omit before comparison
+* @returns `true` if the values are deeply equal after omitting specified keys, `false` otherwise
+*
+* @example
+* ```ts
+* const obj1 = { id: 1, name: "Alice", updatedAt: "2024-01-01" };
+* const obj2 = { id: 2, name: "Alice", updatedAt: "2024-01-02" };
+*
+* deepEqualExcept(obj1, obj2, { ignoreKeys: ["id", "updatedAt"] }); // true
+* ```
+*/
+function deepEqualExcept(a, b, options) {
+	const prunedA = deepOmit(a, options);
+	const prunedB = deepOmit(b, options);
+	return deepEqual(prunedA, prunedB);
+}
+
+//#endregion
+//#region src/domain/value-object/value-object.ts
+/**
+* `Object.freeze` does not protect internal slots: a frozen Date still
+* accepts `setTime`, a frozen Map still accepts `set`. To make the
+* "deeply immutable" guarantee real, the mutator methods are shadowed
+* with own throwing functions BEFORE the freeze. The shadows are
+* non-enumerable, so they are invisible to `Object.keys`/spread (deep
+* equality is unaffected) and `structuredClone` drops them (a `vo()`
+* round-trip never sees them).
+*/
+const DATE_MUTATORS = [
+	"setTime",
+	"setMilliseconds",
+	"setUTCMilliseconds",
+	"setSeconds",
+	"setUTCSeconds",
+	"setMinutes",
+	"setUTCMinutes",
+	"setHours",
+	"setUTCHours",
+	"setDate",
+	"setUTCDate",
+	"setMonth",
+	"setUTCMonth",
+	"setFullYear",
+	"setUTCFullYear",
+	"setYear"
+];
+const mutationThrowers = /* @__PURE__ */ new Map();
+const mapEntries = Map.prototype.entries;
+const setValues = Set.prototype.values;
+function mutationThrower(typeName, method) {
+	const key = `${typeName}.${method}`;
+	let thrower = mutationThrowers.get(key);
+	if (!thrower) {
+		thrower = function throwFrozenMutation() {
+			throw new TypeError(`Cannot call ${method}() on a ${typeName} inside a deeply frozen value`);
+		};
+		mutationThrowers.set(key, thrower);
+	}
+	return thrower;
+}
+const shadowDescriptor = {
+	value: void 0,
+	writable: false,
+	enumerable: false,
+	configurable: false
+};
+/** Returns whether the shadows were installed. */
+function shadowMutators(obj, typeName, methods) {
+	if (!Object.isExtensible(obj)) return false;
+	for (const method of methods) {
+		shadowDescriptor.value = mutationThrower(typeName, method);
+		Object.defineProperty(obj, method, shadowDescriptor);
+	}
+	return true;
+}
+const VALUE_OBJECT_CLASS = Symbol.for("@shirudo/ddd-kit/value-object-class/v1");
+function recordValueObjectClass(instance, valueObjectClass) {
+	Object.defineProperty(instance, VALUE_OBJECT_CLASS, {
+		value: valueObjectClass,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+}
+function isValueObjectInstance(value) {
+	if (value === null || typeof value !== "object") return false;
+	const record = Reflect.getOwnPropertyDescriptor(value, VALUE_OBJECT_CLASS);
+	if (record === void 0 || typeof record.value !== "function" || record.enumerable !== false || record.writable !== false || record.configurable !== false) return false;
+	const props = Reflect.getOwnPropertyDescriptor(value, "props");
+	return props !== void 0 && isSealedProps(props.value);
+}
+function isSealedProps(props) {
+	if (typeof props !== "object" || props === null) return false;
+	return Object.isFrozen(props) || builtInTagWithoutInvokingAccessors(props) === "[object RegExp]";
+}
+function looksLikeValueObject(instance) {
+	if (Object.hasOwn(instance, VALUE_OBJECT_CLASS)) return true;
+	const props = Reflect.getOwnPropertyDescriptor(instance, "props");
+	return props !== void 0 && isSealedProps(props.value);
+}
+function openValueObjectKeys(instance) {
+	return Reflect.ownKeys(instance).filter((key) => key !== "props" && key !== VALUE_OBJECT_CLASS);
+}
+function rejectValueObjectAsInput(input, entry) {
+	if (isValueObjectInstance(input)) throw new TypeError(`${entry} does not accept a value object as its input: nest the value object under a key, or pass its props`);
+}
+/**
+* Deep freezes an object and all its nested properties recursively, then
+* returns it. Iterates both string-keyed and symbol-keyed own properties
+* so the freeze symmetry matches `deepEqual` (which also considers symbol
+* keys). Handles circular references by tracking visited objects.
+*
+* Note: `deepFreeze` mutates its argument in place; it sets `[[Frozen]]`
+* on the object you pass in. Callers that need to avoid touching the
+* input (e.g. `vo()`) should deep-clone first.
+*
+* Date/Map/Set keep internal-slot mutability under `Object.freeze`
+* (`setTime`, `set`, `add`, … still work on frozen instances), so their
+* mutator methods are shadowed with throwing own properties and Map/Set
+* contents are frozen recursively. The shadows are non-enumerable:
+* invisible to `Object.keys`, spread, `deepEqual`, and `structuredClone`.
+*
+* The shadowing is deny-by-enumeration: only the mutators known at
+* release time are blocked. If the runtime grows a NEW mutator (e.g. the
+* stage-3 `Map.prototype.getOrInsert` upsert proposal), it is not blocked
+* until the list is updated. Treat the mutator blocking as a guard rail,
+* not a security boundary.
+*
+* Two kinds of built-in pass through unfrozen. ArrayBuffer views
+* (TypedArrays, DataView): the spec forbids freezing a view with elements,
+* and a freeze cannot protect the underlying buffer, so their contents stay
+* mutable. RegExp: pattern and flags live in immutable internal slots, and
+* the only own data property, `lastIndex`, is scan state that every global
+* or sticky match writes. A frozen RegExp protects nothing and throws on
+* the first such match, so the RegExp keeps matching instead. A view or a
+* RegExp passes through whole: an expando property on it stays open, and
+* the walk does not enter its subtree.
+*/
+const DEEP_FROZEN = /* @__PURE__ */ new WeakSet();
+const KIT_SHADOWED = /* @__PURE__ */ new WeakSet();
+function deepFreeze(obj) {
+	const walk = {
+		cyclic: false,
+		sealed: [],
+		done: /* @__PURE__ */ new Map(),
+		inProgress: /* @__PURE__ */ new Set()
+	};
+	freezeDeep(obj, walk);
+	if (!walk.cyclic) for (const object of walk.sealed) DEEP_FROZEN.add(object);
+	return obj;
+}
+/** Freezes `obj` and its subtree; returns whether the subtree is sealed. */
+function freezeDeep(obj, walk) {
+	if (obj === null || typeof obj !== "object") return true;
+	if (DEEP_FROZEN.has(obj)) return true;
+	if (ArrayBuffer.isView(obj)) return true;
+	const finished = walk.done.get(obj);
+	if (finished !== void 0) return finished;
+	if (walk.inProgress.has(obj)) {
+		walk.cyclic = true;
+		return true;
+	}
+	const builtInTag = builtInTagWithoutInvokingAccessors(obj);
+	if (builtInTag === "[object RegExp]") return true;
+	walk.inProgress.add(obj);
+	let sealed = true;
+	if (builtInTag === "[object Date]" || builtInTag === "[object Map]" || builtInTag === "[object Set]") {
+		let shadowed = KIT_SHADOWED.has(obj);
+		if (builtInTag === "[object Date]") shadowed = shadowMutators(obj, "Date", DATE_MUTATORS) || shadowed;
+		else if (builtInTag === "[object Map]") {
+			for (const [key, value] of obj) {
+				if (!freezeDeep(key, walk)) sealed = false;
+				if (!freezeDeep(value, walk)) sealed = false;
+			}
+			shadowed = shadowMutators(obj, "Map", [
+				"set",
+				"delete",
+				"clear"
+			]) || shadowed;
+		} else if (builtInTag === "[object Set]") {
+			for (const member of obj) if (!freezeDeep(member, walk)) sealed = false;
+			shadowed = shadowMutators(obj, "Set", [
+				"add",
+				"delete",
+				"clear"
+			]) || shadowed;
+		}
+		if (shadowed) KIT_SHADOWED.add(obj);
+		else sealed = false;
+	}
+	const keys = Reflect.ownKeys(obj);
+	for (const key of keys) {
+		const value = obj[key];
+		if (value !== null && typeof value === "object") {
+			if (!freezeDeep(value, walk)) sealed = false;
+		}
+	}
+	Object.freeze(obj);
+	walk.inProgress.delete(obj);
+	walk.done.set(obj, sealed);
+	if (sealed) walk.sealed.push(obj);
+	return sealed;
+}
+/**
+* Deep clone used by `vo()` and the `ValueObject` constructor.
+*
+* Plain objects, arrays, and Map values are walked manually so
+* that symbol-keyed properties survive (which `structuredClone` silently
+* drops; they would otherwise be invisible to `voEquals`, whose
+* `deepEqual` DOES consider symbol keys) and shared references / cycles
+* keep their identity across Map boundaries. Function values throw,
+* preserving `vo()`'s documented data-not-behaviour gate. Built-ins without
+* immutable value semantics throw a descriptive `TypeError`. A kit
+* `ValueObject` instance is admitted by reference (see
+* `VALUE_OBJECT_CLASS`). Every other custom class instance and every
+* subclass of a built-in is rejected because cloning it without invoking
+* its constructor can silently lose private or non-enumerable state. Map
+* keys and Set members must be primitive because their equality is
+* identity-based and object identity cannot survive defensive cloning.
+* Accessor properties are rejected without invoking them. Admitted atomic
+* built-ins (Date, RegExp and primitive wrappers) delegate to
+* `structuredClone`, brand-verified so a `Symbol.toStringTag` spoofer is
+* walked as the plain object it is. `__proto__` own keys are copied as
+* inert data properties.
+*/
+function cloneForVo(value, visited) {
+	if (typeof value === "function") throw new TypeError("vo() does not accept function values: Value Objects are data, not behaviour");
+	if (value === null || typeof value !== "object") return value;
+	const obj = value;
+	if (ArrayBuffer.isView(obj)) throwUnsupportedValueSemantics(builtInTagWithoutInvokingAccessors(obj) ?? "[object ArrayBuffer view]");
+	if (visited.has(obj)) return visited.get(obj);
+	if (Array.isArray(obj)) {
+		if (!hasIntrinsicPrototypeChain(obj, "Array")) throwUnsupportedClassInstance(obj);
+		const clone = new Array(obj.length);
+		visited.set(obj, clone);
+		for (const key of Reflect.ownKeys(obj)) {
+			if (key === "length") continue;
+			const descriptor = Object.getOwnPropertyDescriptor(obj, key);
+			if (descriptor === void 0) continue;
+			if (!("value" in descriptor)) throwUnsupportedAccessorProperty();
+			if (typeof key === "string" && !descriptor.enumerable) continue;
+			descriptor.value = cloneForVo(descriptor.value, visited);
+			Object.defineProperty(clone, key, descriptor);
+		}
+		return clone;
+	}
+	const tag = builtInTagWithoutInvokingAccessors(obj);
+	if (tag !== void 0) {
+		if (!hasIntrinsicPrototypeChain(obj)) throwUnsupportedClassInstance(obj);
+		if (tag === "[object Map]") {
+			const clone = /* @__PURE__ */ new Map();
+			visited.set(obj, clone);
+			for (const [key, entry] of mapEntries.call(obj)) {
+				if (!isPrimitiveValue(key)) throw new TypeError("vo() Map keys must be primitive values to preserve value equality");
+				clone.set(key, cloneForVo(entry, visited));
+			}
+			return clone;
+		}
+		if (tag === "[object Set]") {
+			const clone = /* @__PURE__ */ new Set();
+			visited.set(obj, clone);
+			for (const member of setValues.call(obj)) {
+				if (!isPrimitiveValue(member)) throw new TypeError("vo() Set members must be primitive values to preserve value equality");
+				clone.add(member);
+			}
+			return clone;
+		}
+		if (tag === "[object Promise]" || tag === "[object WeakMap]" || tag === "[object WeakSet]") throw new TypeError(`vo() cannot clone a ${tag.slice(8, -1)}: Value Objects are plain data`);
+		if (tag === "[object Error]" || tag === "[object ArrayBuffer]" || tag === "[object SharedArrayBuffer]") throwUnsupportedValueSemantics(tag);
+		if (tag === "[object RegExp]") {
+			const regExp = obj;
+			if (regExp.global || regExp.sticky) throw new TypeError("vo() cannot accept a global or sticky RegExp: its lastIndex is mutable scan state, not an immutable value");
+		}
+		const builtInClone = structuredClone(obj);
+		visited.set(obj, builtInClone);
+		return builtInClone;
+	}
+	const prototype = Object.getPrototypeOf(obj);
+	if (prototype !== null && (!isIntrinsicConstructorPrototype(prototype, "Object") || Object.getPrototypeOf(prototype) !== null)) {
+		if (isValueObjectInstance(obj)) {
+			const openKeys = openValueObjectKeys(obj);
+			if (openKeys.length > 0) throwOpenValueObjectFields(openKeys);
+			return obj;
+		}
+		throwUnsupportedClassInstance(obj);
+	}
+	const clone = Object.create(prototype === null ? null : Object.prototype);
+	visited.set(obj, clone);
+	for (const key of Reflect.ownKeys(obj)) {
+		const descriptor = Object.getOwnPropertyDescriptor(obj, key);
+		if (descriptor === void 0) continue;
+		if (!("value" in descriptor)) throwUnsupportedAccessorProperty();
+		if (typeof key === "string" && !descriptor.enumerable) continue;
+		Object.defineProperty(clone, key, {
+			value: cloneForVo(descriptor.value, visited),
+			writable: true,
+			enumerable: descriptor.enumerable,
+			configurable: true
+		});
+	}
+	return clone;
+}
+function throwUnsupportedClassInstance(instance) {
+	const valueObjectHint = looksLikeValueObject(instance) ? ". A value object is recognized only when a copy of this kit version built it and its props are frozen" : "";
+	throw new TypeError(`vo() cannot clone custom class instances: Value Objects are plain data${valueObjectHint}`);
+}
+function throwOpenValueObjectFields(keys) {
+	throw new TypeError(`vo() cannot nest a value object with own fields outside props (${keys.map(String).join(", ")}): keep the state of a value object in props`);
+}
+function throwUnsupportedAccessorProperty() {
+	throw new TypeError("vo() cannot clone accessor properties: Value Objects are plain data");
+}
+function throwUnsupportedValueSemantics(tag) {
+	const name = tag.startsWith("[object ") ? tag.slice(8, -1) : tag;
+	throw new TypeError(`vo() cannot accept ${name} values: Value Objects require immutable value semantics`);
+}
+function isPrimitiveValue(value) {
+	return value === null || typeof value !== "object" && typeof value !== "function";
+}
+/**
+* Creates a deeply immutable value object from the given data.
+*
+* The input is first deep-cloned, then the clone is frozen, so calling
+* `vo(input)` never freezes the caller's own object graph as a
+* side-effect. Mutating the input afterwards does not bleed into the VO.
+* Symbol-keyed properties are preserved (matching `voEquals`). A kit
+* `ValueObject` instance nested in the input is kept by reference and
+* frozen in place; it must keep all of its state in `props`. A value
+* object as the input itself is rejected.
+* Function values and every other custom class instance are rejected
+* (Value Objects are plain data, not behaviour-bearing object graphs). Inputs must be trusted and
+* Proxy-free: ECMAScript provides no portable way to identify a transparent
+* Proxy without potentially executing its traps, so `vo()` is not a sandbox
+* for hostile in-process objects. Built-ins that cannot provide immutable,
+* value-based semantics are rejected instead of weakening the VO contract.
+*
+* @example
+* ```typescript
+* const nested = { lat: 52.5, lng: 13.4 };
+* const address = vo({ street: "Main St", coordinates: nested });
+* address.coordinates.lat = 99; // ❌ Cannot assign to read-only property
+* nested.lat = 0;               // ✅ caller's input still mutable
+* ```
+*/
+function vo(t) {
+	rejectValueObjectAsInput(t, "vo()");
+	return deepFreeze(cloneForVo(t, /* @__PURE__ */ new WeakMap()));
+}
+/**
+* Compares two value objects for equality based on their values.
+* Uses deep equality comparison that handles:
+* - Nested objects and arrays
+* - Primitives (including NaN)
+* - Dates, Maps, Sets, RegExp
+* - Symbol keys
+* - Circular references
+*
+* @param a - First value object
+* @param b - Second value object
+* @returns true if both objects have the same values, false otherwise
+*
+* @example
+* ```typescript
+* const money1 = vo({ amount: 100, currency: "USD" });
+* const money2 = vo({ amount: 100, currency: "USD" });
+* voEquals(money1, money2); // true
+*
+* const address1 = vo({
+*   street: "Main St",
+*   coordinates: { lat: 52.5, lng: 13.4 }
+* });
+* const address2 = vo({
+*   street: "Main St",
+*   coordinates: { lat: 52.5, lng: 13.4 }
+* });
+* voEquals(address1, address2); // true
+* ```
+*/
+function voEquals(a, b) {
+	return deepEqual(a, b);
+}
+/**
+* Compares two value objects for equality while ignoring specified keys.
+* Useful for comparing value objects that contain metadata or optional fields
+* that should not affect equality comparison.
+*
+* The walk enters a nested `ValueObject` instance like any other object,
+* so inside it the path continues with `props`; `ignoreKeys: ["props"]`
+* empties every nested value object. The key under which the kit records
+* the class of the instance is never ignored.
+*
+* @param a - First value object
+* @param b - Second value object
+* @param options - Options specifying which keys to ignore during comparison
+* @returns true if both objects have the same values (after ignoring specified keys), false otherwise
+*
+* @example
+* ```typescript
+* // Value object with metadata
+* const address1 = vo({
+*   street: "Main St",
+*   city: "Berlin",
+*   metadata: { createdAt: "2024-01-01", updatedAt: "2024-01-02" }
+* });
+*
+* const address2 = vo({
+*   street: "Main St",
+*   city: "Berlin",
+*   metadata: { createdAt: "2024-01-01", updatedAt: "2024-01-03" }
+* });
+*
+* // Compare ignoring metadata timestamps
+* voEqualsExcept(address1, address2, {
+*   ignoreKeys: ["updatedAt"],
+*   ignoreKeyPredicate: (key, path) => path.includes("metadata")
+* }); // true
+*
+* // Compare ignoring all metadata
+* voEqualsExcept(address1, address2, {
+*   ignoreKeyPredicate: (key, path) => path.includes("metadata")
+* }); // true
+* ```
+*/
+function voEqualsExcept(a, b, options) {
+	return deepEqualExcept(a, b, keepValueObjectClass(options));
+}
+function keepValueObjectClass(options) {
+	const { ignoreKeys, ignoreKeyPredicate } = options;
+	return {
+		...options,
+		ignoreKeys: ignoreKeys?.filter((key) => key !== VALUE_OBJECT_CLASS),
+		ignoreKeyPredicate: ignoreKeyPredicate && ((key, path) => key !== VALUE_OBJECT_CLASS && ignoreKeyPredicate(key, path))
+	};
+}
+/**
+* Creates a value object with optional validation.
+* Returns a Result type instead of throwing an error.
+*
+* Note: the Result covers VALIDATION failures only. Non-data values and
+* built-ins without immutable value semantics still throw a
+* `TypeError` from `vo()`; they cannot occur in parsed JSON and signal
+* a programming error, not a validation failure.
+*
+* @param t - The data to convert into a value object
+* @param validate - Validation function that returns true if valid
+* @param errorMessage - Optional custom error message if validation fails
+* @returns Result containing the value object if valid, or an error message if validation fails
+*
+* @example
+* ```typescript
+* const result = voWithValidation(
+*   { amount: 100, currency: "USD" },
+*   (m) => m.amount >= 0 && m.currency.length === 3,
+*   "Invalid money: amount must be non-negative and currency must be 3 characters"
+* );
+*
+* if (result.ok) {
+*   console.log(result.value); // Use the value object
+* } else {
+*   console.error(result.error); // Handle validation error
+* }
+* ```
+*/
+function voWithValidation(t, validate, errorMessage) {
+	if (!validate(t)) return err(errorMessage ?? `Validation failed for value object: ${describeValue(t)}`);
+	return ok(vo(t));
+}
+/**
+* Best-effort rendering of a value for the default validation-failure
+* message. `JSON.stringify` throws for cyclic and BigInt-bearing values, and
+* the error path of a Result-returning function must never throw itself.
+*/
+function describeValue(value) {
+	try {
+		const json = JSON.stringify(value);
+		if (json !== void 0) return json;
+	} catch {}
+	return String(value);
+}
+/**
+* Abstract base class for creating Value Objects.
+* Value Objects are immutable and defined by their properties. A value
+* object can hold other value objects in its props. Every instance
+* records its class under an own symbol key, so `equals` compares a
+* nested value object by class and props and does not call its `equals`
+* method.
+*
+* @template T - The shape of the value object's properties
+*/
+var ValueObject = class {
+	props;
+	/**
+	* Creates a new ValueObject.
+	* The plain-data properties are deep-cloned and then deeply
+	* frozen, so the caller's own object graph is never frozen or mutated,
+	* and later mutation of the input does not bleed into the value object.
+	*
+	* @param props - The properties of the value object
+	* @example
+	* ```ts
+	* class Money extends ValueObject<{ amount: number; currency: string }> {
+	*   constructor(props: { amount: number; currency: string }) {
+	*     super(props);
+	*   }
+	*
+	*   protected validate(props: { amount: number; currency: string }): void {
+	*     if (props.amount < 0) throw new Error("Amount cannot be negative");
+	*   }
+	* }
+	* ```
+	*/
+	constructor(props) {
+		rejectValueObjectAsInput(props, "new ValueObject()");
+		this.validate(props);
+		this.props = deepFreeze(cloneForVo(props, /* @__PURE__ */ new WeakMap()));
+		recordValueObjectClass(this, this.constructor);
+	}
+	/**
+	* Optional validation hook that can be overridden by subclasses.
+	* Should throw an error if validation fails.
+	*
+	* @param props - The properties to validate
+	* @throws Error if validation fails
+	*/
+	validate(props) {}
+	/**
+	* Checks if this value object is equal to another.
+	* Uses deep equality comparison on the properties and checks for constructor equality.
+	*
+	* @param other - The other value object to compare
+	* @returns true if the properties are deeply equal and constructors match
+	*/
+	equals(other) {
+		if (other === null || other === void 0) return false;
+		if (this.constructor !== other.constructor) return false;
+		return deepEqual(this.props, other.props);
+	}
+	/**
+	* Creates a clone of the value object with optional property overrides.
+	*
+	* @param props - Optional properties to override
+	* @returns A new instance of the value object
+	*/
+	clone(props) {
+		const Constructor = this.constructor;
+		const merged = {
+			...this.props,
+			...props || {}
+		};
+		for (const key of Reflect.ownKeys(this.props)) {
+			const descriptor = Object.getOwnPropertyDescriptor(this.props, key);
+			if (descriptor === void 0 || descriptor.enumerable) continue;
+			if (props && Object.hasOwn(props, key)) continue;
+			Object.defineProperty(merged, key, {
+				value: this.props[key],
+				writable: true,
+				enumerable: false,
+				configurable: true
+			});
+		}
+		return new Constructor(merged);
+	}
+	/**
+	* Serializes the value object to its raw properties for JSON operations.
+	*
+	* @returns The raw properties object
+	*/
+	toJSON() {
+		return this.props;
+	}
+};
+
+//#endregion
+//#region src/internal/cooperative-brand.ts
+/**
+* A cooperative brand marks an object that a kit constructor produced, so
+* a second loaded copy of the kit (duplicate npm dependency, dual CJS/ESM
+* load, plugin bundle) recognizes it. A module-private WeakSet cannot do
+* that: it is bound to one loaded copy. The brand is a `Symbol.for` key
+* with the value `true`. The property is non-enumerable, so it never
+* leaks into spreads, JSON, or equality, and non-writable and
+* non-configurable, so nothing edits it after the stamp.
+*
+* The probe reads the brand as an OWN property with exactly these
+* attributes and requires the carrier to be frozen. An object that
+* inherits a branded object through its prototype can carry mutable own
+* overrides; a branded object that is still open can change after the
+* stamp. Neither is what the constructor produced. Every stamp site
+* therefore freezes the carrier right after {@link stampCooperativeBrand}.
+*
+* The brand is forgeable BY DESIGN. It catches accidental hand-rolled
+* literals; it is not a security boundary against code in the same
+* process that fakes it on purpose.
+*
+* Internal utility (not exported from the package barrels).
+*/
+function stampCooperativeBrand(target, brand) {
+	Object.defineProperty(target, brand, {
+		value: true,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+}
+/**
+* Whether `value` carries `brand` as an own, non-enumerable, non-writable,
+* non-configurable `true` and is frozen. A Proxy trap that throws reads
+* as unbranded.
+*/
+function hasCooperativeBrand(value, brand) {
+	if (value === null || typeof value !== "object" && typeof value !== "function") return false;
+	try {
+		const marker = Reflect.getOwnPropertyDescriptor(value, brand);
+		return marker?.value === true && marker.enumerable === false && marker.writable === false && marker.configurable === false && Object.isFrozen(value);
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/domain/event/clock.ts
+/** Immutable library default captured by the default domain-event factory. */
+const defaultClockFactory = () => /* @__PURE__ */ new Date();
+/** Internal defensive event-clock read. */
+function readClock(factory) {
+	const reading = factory();
+	const value = reading instanceof Date ? reading.getTime() : NaN;
+	if (!Number.isFinite(value)) throw new TypeError("domain-event clock must return a valid Date");
+	return new Date(value);
+}
+
+//#endregion
+//#region src/domain/event/domain-event-errors.ts
+/**
+* Stable contract error for malformed domain-event data.
+*
+* It remains a `TypeError` for JavaScript callers while exposing a code and
+* field that do not depend on the wording of the human-readable message.
+*/
+var DomainEventValidationError = class extends TypeError {
+	code;
+	field;
+	name;
+	constructor(code, field, message) {
+		super(message);
+		this.code = code;
+		this.field = field;
+		this.name = code;
+		Object.setPrototypeOf(this, new.target.prototype);
+	}
+};
+var SnapshotTimeValidationError = class extends TypeError {
+	name = "SNAPSHOT_TIME_INVALID";
+	code = "SNAPSHOT_TIME_INVALID";
+	field = "snapshotAt";
+	constructor() {
+		super("snapshotAt must be a valid Date");
+		Object.setPrototypeOf(this, new.target.prototype);
+	}
+};
+
+//#endregion
+//#region src/domain/event/domain-event.ts
+const defaultEventIdFactory = () => crypto.randomUUID();
+/**
+* Creates an immutable, instance-bound domain-event factory.
+*
+* The supplied functions are read once and captured by value. The returned
+* object is frozen, so another request, test, or library cannot replace its
+* policy. Its {@link DomainEventFactory.createStamp} method is the
+* application-shell bridge that records an accepted aggregate decision.
+* Passing the factory through `AggregateConfig`
+* enables the explicitly named convenience methods, whose defaults read time
+* and randomness.
+*
+* @example
+* ```ts
+* const domainEvents = createDomainEventFactory({
+*   eventIdFactory: () => uuidv7(),
+*   clock: () => new Date(),
+* });
+* order.confirm();
+* recordPendingEvents(order, domainEvents);
+* ```
+*/
+/**
+* Fills the origin of a factory into options that name none.
+*
+* A call site that states its own source keeps it: an explicit fact about one
+* event outranks the default of the factory that mints it.
+*/
+function withFactorySource(options, source) {
+	const given = options ?? {};
+	if (source === void 0 || given.metadata?.source !== void 0) return given;
+	return {
+		...given,
+		metadata: {
+			...given.metadata,
+			source
+		}
+	};
+}
+function createDomainEventFactory(options = {}) {
+	const eventIdFactory = options.eventIdFactory ?? defaultEventIdFactory;
+	const clock = options.clock ?? defaultClockFactory;
+	const { source } = options;
+	const create = ((type, payload, createOptions) => mintDomainEvent(type, payload, withFactorySource(createOptions, source), eventIdFactory, clock));
+	const createStamp = (stampOptions = {}) => {
+		const explicitOccurredAt = stampOptions.occurredAt === void 0 ? void 0 : copyValidEventDate(stampOptions.occurredAt);
+		if (stampOptions.eventId !== void 0) assertNonBlankEventField(stampOptions.eventId, "eventId", "EVENT_ID_INVALID");
+		const eventId = stampOptions.eventId ?? eventIdFactory();
+		assertNonBlankEventField(eventId, "eventId", "EVENT_ID_INVALID");
+		const stamp = {
+			eventId,
+			occurredAt: explicitOccurredAt ?? readEventClock(clock),
+			metadata: cloneOwnedEventData(withFactorySource(stampOptions, source).metadata, "metadata")
+		};
+		const owned = deepFreeze(stamp);
+		FACTORY_OWNED_EVENT_STAMPS.add(owned);
+		return owned;
+	};
+	return Object.freeze({
+		createStamp,
+		create,
+		now: () => readClock(clock)
+	});
+}
+/**
+* Immutable UUID-v4/platform-clock factory used by the top-level
+* {@link createDomainEvent}. It cannot be reconfigured; construct an instance
+* with {@link createDomainEventFactory} for custom policy.
+*/
+const defaultDomainEventFactory = createDomainEventFactory();
+/**
+* Creates a domain event with default values.
+* Sets occurredAt to current date and schemaVersion to 1 if not provided.
+*
+* **Input ownership.** The event is deeply frozen, and `payload` and
+* `metadata` are deep-cloned first, so the caller's own objects are never
+* frozen in place and later mutation of them does not bleed into the
+* event (same contract as `vo()`). The clone follows the plain-data event
+* contract via `structuredClone`: functions, Promise, and WeakMap/WeakSet
+* values throw a `TypeError`; symbol-keyed properties are not carried
+* over.
+*
+* **For aggregate-internal events, prefer `this.createEvent(...)` on
+* `StateStoredAggregate` / `EventSourcedAggregate`.** That helper auto-injects
+* `aggregateId` (from `this.id`) and `aggregateType` (from the
+* aggregate's declared `aggregateType` property), which downstream
+* consumers (outbox dispatchers, projection handlers, audit logs)
+* route by. The commit boundary validates that both fields are present
+* and throws if they are missing, so a direct `createDomainEvent(...)`
+* call inside an aggregate that forgets the options is caught at
+* runtime. Record pending decisions in the application
+* shell before repository persistence or outbox harvest.
+*
+* Use `createDomainEvent(...)` directly for events that don't belong to
+* an aggregate: system events, integration events, configuration events,
+* test fixtures. For those, set `aggregateId` / `aggregateType` in
+* `options` if downstream consumers expect routing metadata.
+*
+* @param type - The event type
+* @param payload - The event payload
+* @param options - Optional event configuration (including `aggregateId`
+*   and `aggregateType` for routing)
+* @returns A domain event
+*
+* @example
+* ```typescript
+* const event = createDomainEvent("OrderCreated", { orderId: "123" });
+* ```
+*/
+const RECORDED_EVENTS = /* @__PURE__ */ new WeakSet();
+const UNCOMMITTED_EVENTS = /* @__PURE__ */ new WeakSet();
+const FACTORY_OWNED_EVENT_STAMPS = /* @__PURE__ */ new WeakSet();
+const RECORDED_BRAND = Symbol.for("@shirudo/ddd-kit.mintedEvent");
+const UNCOMMITTED_BRAND = Symbol.for("@shirudo/ddd-kit.uncommittedEvent");
+function stampRecordedBrand(event) {
+	stampCooperativeBrand(event, RECORDED_BRAND);
+}
+function stampUncommittedBrand(event) {
+	stampCooperativeBrand(event, UNCOMMITTED_BRAND);
+}
+function isFactoryOwnedDomainEventStamp(stamp) {
+	return FACTORY_OWNED_EVENT_STAMPS.has(stamp);
+}
+/**
+* Whether `event` is a recorded domain event: it came out of
+* {@link createDomainEvent}, {@link createDomainEventFromFacts}, or
+* {@link recordDomainEvent}, so it is deeply frozen with defensively copied
+* payload and metadata. An uncommitted decision carries the other brand; see
+* {@link isUncommittedDomainEvent}. Two tiers: events of THIS
+* loaded copy of the kit are verified through the module-private
+* WeakSet; events minted by ANOTHER copy (duplicate dependency, dual
+* CJS/ESM load) are recognized through a cooperative `Symbol.for`
+* brand that code in the same process can fake. The gate catches
+* accidents, not adversaries. Module-internal export for the aggregate
+* recording paths; not part of the package entries.
+*/
+function isRecordedDomainEvent(event) {
+	return RECORDED_EVENTS.has(event) || hasCooperativeBrand(event, RECORDED_BRAND);
+}
+/** Whether a value was created by {@link createUncommittedDomainEvent}. */
+function isUncommittedDomainEvent(event) {
+	return UNCOMMITTED_EVENTS.has(event) || hasCooperativeBrand(event, UNCOMMITTED_BRAND);
+}
+function createUncommittedDomainEvent(type, payload, options) {
+	assertProducerOwnedEventFields(type, options);
+	const event = {
+		type,
+		aggregateId: options?.aggregateId,
+		aggregateType: options?.aggregateType,
+		payload: cloneOwnedEventData(payload, "payload"),
+		schemaVersion: options?.schemaVersion ?? 1
+	};
+	stampUncommittedBrand(event);
+	const uncommitted = deepFreeze(event);
+	UNCOMMITTED_EVENTS.add(uncommitted);
+	return uncommitted;
+}
+/** Brands and freezes a kit-derived copy of an uncommitted event. */
+function adoptUncommittedDomainEvent(copy) {
+	stampUncommittedBrand(copy);
+	Object.freeze(copy);
+	UNCOMMITTED_EVENTS.add(copy);
+	return copy;
+}
+/**
+* Attaches shell-owned recording data to an accepted aggregate decision.
+*
+* The decision supplies the domain type, payload, source address, and payload
+* schema version. The stamp supplies only event identity, recording time, and
+* trace metadata.
+*/
+function recordDomainEvent(event, stamp) {
+	if (!isUncommittedDomainEvent(event)) throw new TypeError("recordDomainEvent requires an event created by createUncommittedDomainEvent");
+	if (isFactoryOwnedDomainEventStamp(stamp)) return mintRecordedEvent(event, stamp.eventId, stamp.occurredAt, stamp.metadata);
+	assertNonBlankEventField(stamp.eventId, "eventId", "EVENT_ID_INVALID");
+	const occurredAt = deepFreeze(copyValidEventDate(stamp.occurredAt));
+	const metadata = cloneOwnedEventData(stamp.metadata, "metadata");
+	return mintRecordedEvent(event, stamp.eventId, occurredAt, metadata === void 0 ? void 0 : deepFreeze(metadata));
+}
+/**
+* Single mint tail for both stamp provenances. The stamp fields arrive
+* pre-validated, copied, and frozen (by `createStamp` for factory-owned
+* stamps, by `recordDomainEvent` for caller-built stamps); the uncommitted
+* event's payload is already defensively cloned and deeply frozen by its
+* constructor and is shared instead of paying a second deep copy per event.
+*/
+function mintRecordedEvent(event, eventId, occurredAt, metadata) {
+	assertProducerOwnedEventFields(event.type, event);
+	const recorded = {
+		eventId,
+		type: event.type,
+		aggregateId: event.aggregateId,
+		aggregateType: event.aggregateType,
+		payload: event.payload,
+		occurredAt,
+		schemaVersion: event.schemaVersion,
+		metadata
+	};
+	stampRecordedBrand(recorded);
+	Object.freeze(recorded);
+	RECORDED_EVENTS.add(recorded);
+	return recorded;
+}
+/**
+* Brands, freezes, and registers a kit-derived copy of a recorded event
+* (e.g. the address-stamped copy `apply()` creates) as recorded itself.
+* The copy shares the already-frozen payload/metadata of its source,
+* so the mint guarantee carries over. Stamping the cooperative brand
+* before freezing keeps the copy recognizable by another loaded kit
+* instance as well as by this instance's WeakSet. Module-internal
+* export; not part of the package entries.
+*/
+function adoptRecordedDomainEvent(copy) {
+	stampRecordedBrand(copy);
+	Object.freeze(copy);
+	RECORDED_EVENTS.add(copy);
+	return copy;
+}
+function createDomainEvent(type, payload, options) {
+	return defaultDomainEventFactory.create(type, payload, options);
+}
+function createDomainEventFromFacts(type, payload, options) {
+	if (options?.eventId === void 0) missingExplicitEventId();
+	if (options.occurredAt === void 0) missingExplicitOccurredAt();
+	return mintDomainEvent(type, payload, options, missingExplicitEventId, missingExplicitOccurredAt);
+}
+function missingExplicitEventId() {
+	throw new DomainEventValidationError("EVENT_ID_REQUIRED", "eventId", "createDomainEventFromFacts requires an explicit eventId");
+}
+function missingExplicitOccurredAt() {
+	throw new DomainEventValidationError("EVENT_OCCURRED_AT_REQUIRED", "occurredAt", "createDomainEventFromFacts requires an explicit occurredAt");
+}
+function mintDomainEvent(type, payload, options, eventIdFactory, clock) {
+	assertProducerOwnedEventFields(type, options);
+	const eventId = options?.eventId ?? eventIdFactory();
+	assertNonBlankEventField(eventId, "eventId", "EVENT_ID_INVALID");
+	const occurredAt = options?.occurredAt === void 0 ? readEventClock(clock) : copyValidEventDate(options.occurredAt);
+	const schemaVersion = options?.schemaVersion ?? 1;
+	const event = {
+		eventId,
+		type,
+		aggregateId: options?.aggregateId,
+		aggregateType: options?.aggregateType,
+		payload: cloneOwnedEventData(payload, "payload"),
+		occurredAt,
+		schemaVersion,
+		metadata: cloneOwnedEventData(options?.metadata, "metadata")
+	};
+	stampRecordedBrand(event);
+	const minted = deepFreeze(event);
+	RECORDED_EVENTS.add(minted);
+	return minted;
+}
+function assertProducerOwnedEventFields(type, options) {
+	assertNonBlankEventField(type, "type", "EVENT_TYPE_INVALID");
+	const schemaVersion = options?.schemaVersion ?? 1;
+	if (!Number.isSafeInteger(schemaVersion) || typeof schemaVersion !== "number" || schemaVersion < 1) throw new DomainEventValidationError("EVENT_SCHEMA_VERSION_INVALID", "schemaVersion", "domain-event schemaVersion must be a safe integer greater than or equal to 1");
+	if (options?.aggregateId !== void 0) assertNonBlankEventField(options.aggregateId, "aggregateId", "EVENT_ADDRESS_INVALID");
+	if (options?.aggregateType !== void 0) assertNonBlankEventField(options.aggregateType, "aggregateType", "EVENT_ADDRESS_INVALID");
+}
+function assertNonBlankEventField(value, field, code) {
+	if (typeof value !== "string" || value.trim().length === 0) throw new DomainEventValidationError(code, field, `domain-event ${field} must be a non-blank string`);
+}
+function copyValidEventDate(value) {
+	if (!(value instanceof Date) || !Number.isFinite(value.getTime())) throw new DomainEventValidationError("EVENT_OCCURRED_AT_INVALID", "occurredAt", "domain-event occurredAt must be a valid Date");
+	return new Date(value.getTime());
+}
+function readEventClock(clock) {
+	return copyValidEventDate(clock());
+}
+/**
+* Deep-clones caller-supplied event data (payload, metadata) before the
+* event is frozen, so `createDomainEvent` never freezes or aliases the
+* caller's own object graph. Primitives pass through unchanged.
+*
+* Uses `structuredClone`, which matches the documented plain-data event
+* contract: functions, Promise, and WeakMap/WeakSet values throw a
+* descriptive `TypeError` (they are not data); symbol-keyed properties
+* are not carried over; a class instance would silently lose its
+* prototype, which the plain-data contract already rules out.
+*/
+function cloneOwnedEventData(value, field) {
+	if (typeof value === "function") throw new TypeError(`createDomainEvent: ${field} must not be a function: domain events are plain data`);
+	if (value === null && field === "metadata") throw new TypeError("createDomainEvent: metadata must be an object or undefined; received null");
+	if (value === null || typeof value !== "object") return value;
+	assertNoHostileOwnProtoKey(value, field === "payload" ? "Event payload" : "Event metadata");
+	assertNoBinaryData(value, field);
+	try {
+		return structuredClone(value);
+	} catch (cause) {
+		throw new TypeError(`createDomainEvent: ${field} must be plain, structured-cloneable data (no functions, Promises, or WeakMap/WeakSet values): domain events are plain data`, { cause });
+	}
+}
+function isBinaryData(value) {
+	return ArrayBuffer.isView(value) || value instanceof ArrayBuffer || typeof SharedArrayBuffer !== "undefined" && value instanceof SharedArrayBuffer;
+}
+/**
+* Walks caller-supplied event data and rejects binary buffers anywhere
+* in the graph (TypedArray, DataView, ArrayBuffer, SharedArrayBuffer):
+* they are mutable by construction, so the deep-freeze that backs the
+* mint guarantee cannot cover them. Runs before the structured clone,
+* on the small plain-data graphs events are documented to carry.
+*/
+function assertNoBinaryData(value, field, visited = /* @__PURE__ */ new WeakSet()) {
+	if (value === null || typeof value !== "object") return;
+	if (isBinaryData(value)) throw new TypeError(`createDomainEvent: ${field} must not contain binary buffers (TypedArray, DataView, ArrayBuffer, SharedArrayBuffer): they stay mutable under freezing and do not survive JSON. Encode binary as a string (base64/hex) or store it outside the event.`);
+	if (visited.has(value)) return;
+	visited.add(value);
+	if (value instanceof Map) {
+		for (const [k, v] of value) {
+			assertNoBinaryData(k, field, visited);
+			assertNoBinaryData(v, field, visited);
+		}
+		return;
+	}
+	if (value instanceof Set) {
+		for (const v of value) assertNoBinaryData(v, field, visited);
+		return;
+	}
+	if (Array.isArray(value)) {
+		for (const v of value) assertNoBinaryData(v, field, visited);
+		return;
+	}
+	for (const key of Object.keys(value)) assertNoBinaryData(value[key], field, visited);
+}
+/**
+* Copies metadata from a source event to a new event.
+* Useful for maintaining correlation chains in event-driven architectures.
+*
+* @example
+* ```typescript
+* const newEvent = createDomainEvent(
+*   "OrderShipped",
+*   { orderId: "123" },
+*   { metadata: copyMetadata(previousEvent, { causationId: previousEvent.eventId }) }
+* );
+* ```
+*/
+function copyMetadata(sourceEvent, additionalMetadata) {
+	if (sourceEvent.metadata !== void 0) assertNoHostileOwnProtoKey(sourceEvent.metadata, "Event metadata");
+	if (additionalMetadata !== void 0) assertNoHostileOwnProtoKey(additionalMetadata, "Event metadata");
+	return {
+		...sourceEvent.metadata ?? {},
+		...additionalMetadata ?? {}
+	};
+}
+/**
+* Merges multiple metadata objects into one.
+* Later metadata objects override earlier ones for the same keys.
+*
+* @example
+* ```typescript
+* const metadata = mergeMetadata(
+*   { correlationId: "corr-123" },
+*   { userId: "user-456" },
+*   { source: "order-service" }
+* );
+* ```
+*/
+function mergeMetadata(...metadataObjects) {
+	const merged = {};
+	for (const metadata of metadataObjects) {
+		if (!metadata) continue;
+		assertNoHostileOwnProtoKey(metadata, "Event metadata");
+		for (const key of Reflect.ownKeys(metadata)) {
+			if (!Object.getOwnPropertyDescriptor(metadata, key)?.enumerable) continue;
+			Object.defineProperty(merged, key, {
+				value: metadata[key],
+				writable: true,
+				enumerable: true,
+				configurable: true
+			});
+		}
+	}
+	return merged;
+}
+
+//#endregion
+//#region src/internal/async/abort.ts
+/**
+* The value to reject with when an `AbortSignal` has fired.
+*
+* Returns the signal's `reason` (a `DOMException` `AbortError` for
+* `controller.abort()`, `TimeoutError` for `AbortSignal.timeout`), falling
+* back to a plain `Error` with `fallbackMessage` when `reason` is nullish.
+* A spec-compliant signal always populates `reason` when aborted, so the
+* fallback only fires for a non-spec polyfill; without it, a bare
+* `throw undefined` would surface, breaking `instanceof Error` handling.
+*
+* Centralizes the `signal.reason ?? new Error(...)` idiom used at every
+* abort site (event bus, `withCommit`, `UnitOfWork.run`, the retrying
+* scope) so a single fix covers all of them.
+*/
+function abortReason(signal, fallbackMessage) {
+	return signal.reason ?? new Error(fallbackMessage);
+}
+
+//#endregion
+//#region src/internal/validate.ts
+/**
+* Shared construction-time guards for numeric options. `context` names
+* the throwing component so the error reads like the component's own
+* validation ("OutboxDispatcher: pollIntervalMs must be...").
+*/
+/** Guard for numeric options that must be a non-negative finite number. */
+function assertNonNegativeFinite(context, field, value) {
+	if (!Number.isFinite(value) || value < 0) throw new Error(`${context}: ${field} must be a non-negative finite number, got ${value}`);
+}
+/** Guard for count options that must be a whole number of at least 1. */
+function assertPositiveInteger(context, field, value) {
+	if (!Number.isInteger(value) || value < 1) throw new Error(`${context}: ${field} must be an integer >= 1, got ${value}`);
+}
+/** Guard for retained-record capacities that must fit exact JS integers. */
+function assertPositiveSafeInteger(context, field, value) {
+	if (!Number.isSafeInteger(value) || value < 1) throw new RangeError(`${context}: ${field} must be a positive safe integer, got ${value}`);
+}
+
+//#endregion
+//#region src/internal/async/execution.ts
+/** Default bound for delivery and post-commit operations. */
+const DEFAULT_EXECUTION_TIMEOUT_MS = 3e4;
+/**
+* Owner signal of each child signal that {@link runBoundedExecution} minted.
+*
+* One bounded operation often wraps another, and every hop derives a fresh
+* signal. A consumer that follows a call chain by signal identity alone loses
+* the link at the first hop. Key and value are both weak: a long chain of
+* nested operations must not hold its whole ancestry alive.
+*/
+const executionOwners = /* @__PURE__ */ new WeakMap();
+/**
+* The signal that a bounded execution derived this one from, or `undefined`
+* when the signal did not come from {@link runBoundedExecution} or had no
+* owner. Walk it to follow a chain across nested bounded executions.
+*/
+function ownerSignalOf(signal) {
+	return executionOwners.get(signal)?.deref();
+}
+/**
+* Runs one operation with a child signal that combines owner cancellation and a
+* shell-owned timeout. The returned promise settles on abort even when an
+* adapter ignores the signal; the adapter promise remains observed so a later
+* rejection cannot become an unhandled rejection.
+*
+* This bounds how long the shell waits; JavaScript cannot forcibly terminate
+* an arbitrary promise. An I/O adapter that must prevent zombie work and
+* overlapping retries has to pass `context.signal` to its native operation or
+* enforce a native timeout no later than `context.deadlineAt`.
+*/
+function runBoundedExecution(label, options, operation) {
+	if (options.deadlineAt === void 0) assertNonNegativeFinite(label, "timeoutMs", options.timeoutMs);
+	else assertNonNegativeFinite(label, "deadlineAt", options.deadlineAt);
+	const startedAt = Date.now();
+	const deadlineAt = options.deadlineAt ?? startedAt + options.timeoutMs;
+	const timeoutMs = Math.max(0, deadlineAt - startedAt);
+	const timeoutError = () => new DOMException(`${label} timed out after ${timeoutMs}ms`, "TimeoutError");
+	const controller = new AbortController();
+	const context = Object.freeze({
+		signal: controller.signal,
+		deadlineAt
+	});
+	const ownerSignal = options.signal;
+	if (ownerSignal !== void 0) executionOwners.set(controller.signal, new WeakRef(ownerSignal));
+	const abortFromOwner = () => {
+		controller.abort(ownerSignal === void 0 ? /* @__PURE__ */ new Error(`${label} aborted`) : abortReason(ownerSignal, `${label} aborted`));
+	};
+	if (ownerSignal?.aborted) abortFromOwner();
+	else ownerSignal?.addEventListener("abort", abortFromOwner, { once: true });
+	if (!controller.signal.aborted && options.deadlineAt !== void 0 && deadlineAt <= startedAt) controller.abort(timeoutError());
+	const timer = setTimeout(() => {
+		controller.abort(timeoutError());
+	}, timeoutMs);
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const finish = (complete) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			ownerSignal?.removeEventListener("abort", abortFromOwner);
+			controller.signal.removeEventListener("abort", onAbort);
+			complete();
+		};
+		const onAbort = () => {
+			queueMicrotask(() => finish(() => reject(abortReason(controller.signal, `${label} aborted`))));
+		};
+		if (controller.signal.aborted) {
+			onAbort();
+			return;
+		}
+		controller.signal.addEventListener("abort", onAbort, { once: true });
+		let outcome;
+		try {
+			outcome = Promise.resolve(operation(context));
+		} catch (error) {
+			finish(() => reject(error));
+			return;
+		}
+		outcome.then((value) => finish(() => resolve(value)), (error) => finish(() => reject(error)));
+	});
+}
+
+//#endregion
+//#region src/messaging/outbox/ports.ts
+/**
+* Discriminates a {@link DispatchTrackingOutbox} from a plain
+* {@link Outbox} at runtime. The single source of truth for the check;
+* the dispatcher and the contract suite both use it, so what counts as
+* a tracking outbox cannot drift between them. Both tracking methods
+* must be present: a plain adapter that happens to expose an unrelated
+* `markFailed` helper must not be mistaken for one that implements the
+* tracking protocol and then be fed `(dispatchId, error)` arguments it
+* never asked for. Internal plumbing, not exported from the package
+* entries.
+*/
+function isDispatchTrackingOutbox(outbox) {
+	const candidate = outbox;
+	return typeof candidate.markFailed === "function" && typeof candidate.deadLetters === "function";
+}
+
+//#endregion
+export { voWithValidation as A, hasCooperativeBrand as C, vo as D, deepFreeze as E, findPropertyDescriptor as F, hasIntrinsicPrototypeChain as I, isBuiltInObject as L, deepOmit as M, deepEqual as N, voEquals as O, builtInTagWithoutInvokingAccessors as P, isIntrinsicConstructorPrototype as R, SnapshotTimeValidationError as S, ValueObject as T, isRecordedDomainEvent as _, assertNonNegativeFinite as a, recordDomainEvent as b, abortReason as c, copyMetadata as d, createDomainEvent as f, defaultDomainEventFactory as g, createUncommittedDomainEvent as h, runBoundedExecution as i, deepEqualExcept as j, voEqualsExcept as k, adoptRecordedDomainEvent as l, createDomainEventFromFacts as m, DEFAULT_EXECUTION_TIMEOUT_MS as n, assertPositiveInteger as o, createDomainEventFactory as p, ownerSignalOf as r, assertPositiveSafeInteger as s, isDispatchTrackingOutbox as t, adoptUncommittedDomainEvent as u, isUncommittedDomainEvent as v, stampCooperativeBrand as w, DomainEventValidationError as x, mergeMetadata as y, isWeakMap as z };
+//# sourceMappingURL=ports.js.map