@shirudo/ddd-kit 3.0.0-rc.11 → 3.0.0-rc.13

package/dist/chunks/read-stream-pages.js

@@ -1,1254 +1,7 @@
-import { C as InvalidEventStreamPageError, Y as assertNoHostileOwnProtoKey } from "./kit-errors.js";
-import { err, ok } from "@shirudo/result";
+import { C as InvalidEventStreamPageError, Y as assertNoOwnProtoKey } from "./kit-errors.js";
+import { _ as isIntrinsicConstructorPrototype, c as applyCooperativeBrand, f as builtInTagWithoutInvokingAccessors, h as hasIntrinsicPrototypeChain, l as hasCooperativeBrand, n as deepFreeze, p as builtInTypeName, s as isMutatorShadow } from "./value-object.js";
 
-//#region src/internal/structural/is-built-in.ts
-/**
-* Set of `Object.prototype.toString.call(x)` tags that the library treats
-* as built-in atomic types. Members of this set are compared/cloned by
-* reference (or with type-specific logic) rather than walked structurally.
-*
-* Detection is tag-based, since `Object.prototype.toString` gives the same
-* answer across realms (an iframe's `Date` has the same tag as the main
-* window's `Date`), and then brand-verified via internal-slot probes,
-* because `Symbol.toStringTag` lets any plain object claim a built-in tag.
-* The previous strategy also checked `globalThis[name] === constructor`
-* and a `proto !== Object.prototype` heuristic; both broke for cross-realm
-* objects and the latter additionally misclassified ordinary user classes
-* as built-ins.
-*/
-const BUILT_IN_TAGS = /* @__PURE__ */ new Set([
-	"[object Date]",
-	"[object RegExp]",
-	"[object Map]",
-	"[object Set]",
-	"[object WeakMap]",
-	"[object WeakSet]",
-	"[object Promise]",
-	"[object Error]",
-	"[object Boolean]",
-	"[object Number]",
-	"[object String]",
-	"[object BigInt]",
-	"[object ArrayBuffer]",
-	"[object SharedArrayBuffer]",
-	"[object DataView]"
-]);
-function intrinsicGetter(proto, prop) {
-	const get = Object.getOwnPropertyDescriptor(proto, prop)?.get;
-	if (!get) throw new Error(`missing intrinsic getter for ${prop}`);
-	return get;
-}
-const dateGetTime = Date.prototype.getTime;
-const mapSizeGet = intrinsicGetter(Map.prototype, "size");
-const setSizeGet = intrinsicGetter(Set.prototype, "size");
-const weakMapHas = WeakMap.prototype.has;
-const weakSetHas = WeakSet.prototype.has;
-const dataViewByteLengthGet = intrinsicGetter(DataView.prototype, "byteLength");
-const arrayBufferByteLengthGet = intrinsicGetter(ArrayBuffer.prototype, "byteLength");
-const sharedArrayBufferByteLengthGet = typeof SharedArrayBuffer === "undefined" ? void 0 : intrinsicGetter(SharedArrayBuffer.prototype, "byteLength");
-const regExpSourceGet = intrinsicGetter(RegExp.prototype, "source");
-const booleanValueOf = Boolean.prototype.valueOf;
-const numberValueOf = Number.prototype.valueOf;
-const stringValueOf = String.prototype.valueOf;
-const bigIntValueOf = BigInt.prototype.valueOf;
-const functionToString = Function.prototype.toString;
-const PROBE_KEY = {};
-const intrinsicConstructorSources = new Map([
-	"Object",
-	"Array",
-	"Date",
-	"RegExp",
-	"Map",
-	"Set",
-	"WeakMap",
-	"WeakSet",
-	"Promise",
-	"Error",
-	"EvalError",
-	"RangeError",
-	"ReferenceError",
-	"SyntaxError",
-	"TypeError",
-	"URIError",
-	"AggregateError",
-	"Boolean",
-	"Number",
-	"String",
-	"BigInt",
-	"ArrayBuffer",
-	"SharedArrayBuffer",
-	"DataView",
-	"Int8Array",
-	"Uint8Array",
-	"Uint8ClampedArray",
-	"Int16Array",
-	"Uint16Array",
-	"Int32Array",
-	"Uint32Array",
-	"Float32Array",
-	"Float64Array",
-	"BigInt64Array",
-	"BigUint64Array"
-].flatMap((name) => {
-	const intrinsic = Object.getOwnPropertyDescriptor(globalThis, name)?.value;
-	return typeof intrinsic === "function" ? [[name, /* @__PURE__ */ new Set([functionToString.call(intrinsic), `function ${name}() { [native code] }`])]] : [];
-}));
-const intrinsicConstructorSourceSet = new Set([...intrinsicConstructorSources.values()].flatMap((sources) => [...sources]));
-const ERROR_INTRINSIC_NAMES = [
-	"Error",
-	"EvalError",
-	"RangeError",
-	"ReferenceError",
-	"SyntaxError",
-	"TypeError",
-	"URIError",
-	"AggregateError"
-];
-function isIntrinsicConstructorPrototype(prototype, expectedName) {
-	const constructorDescriptor = Object.getOwnPropertyDescriptor(prototype, "constructor");
-	const candidateConstructor = constructorDescriptor?.value;
-	if (constructorDescriptor === void 0 || !("value" in constructorDescriptor) || typeof candidateConstructor !== "function") return false;
-	let candidateSource;
-	try {
-		candidateSource = functionToString.call(candidateConstructor);
-	} catch {
-		return false;
-	}
-	const expectedSources = expectedName === void 0 ? void 0 : intrinsicConstructorSources.get(expectedName);
-	if (expectedSources !== void 0 && !expectedSources.has(candidateSource) || expectedSources === void 0 && !intrinsicConstructorSourceSet.has(candidateSource)) return false;
-	const nameDescriptor = Object.getOwnPropertyDescriptor(candidateConstructor, "name");
-	const candidateName = nameDescriptor !== void 0 && "value" in nameDescriptor && typeof nameDescriptor.value === "string" ? nameDescriptor.value : void 0;
-	const intrinsicName = expectedName ?? candidateName;
-	const intrinsicSources = intrinsicName === void 0 ? void 0 : intrinsicConstructorSources.get(intrinsicName);
-	return candidateName === intrinsicName && intrinsicSources !== void 0 && intrinsicSources.has(candidateSource) && Object.getOwnPropertyDescriptor(candidateConstructor, "prototype")?.value === prototype;
-}
-/**
-* Accepts an intrinsic prototype, optionally behind transparent
-* `Symbol.toStringTag` override layers. A user-defined subclass has its own
-* non-native constructor and is therefore rejected before reaching the
-* intrinsic prototype.
-*/
-function hasIntrinsicPrototypeChain(value, expectedName) {
-	const visited = /* @__PURE__ */ new WeakSet();
-	let prototype = Object.getPrototypeOf(value);
-	while (prototype !== null && !visited.has(prototype)) {
-		visited.add(prototype);
-		if (Object.hasOwn(prototype, "constructor")) return isIntrinsicConstructorPrototype(prototype, expectedName);
-		const ownKeys = Reflect.ownKeys(prototype);
-		if (ownKeys.length !== 1 || ownKeys[0] !== Symbol.toStringTag) return false;
-		prototype = Object.getPrototypeOf(prototype);
-	}
-	return false;
-}
-/**
-* Tags that `deepEqual` compares BY REFERENCE (its unhandled-built-in
-* fallback) and that `deepOmit` must therefore ALIAS rather than clone:
-* a clone would break `deepEqualExcept(x, x)` reflexivity. Single source
-* of truth so the two modules cannot drift: if `deepEqual` ever learns a
-* by-value comparison for one of these, remove it here and add a clone
-* case in `deepOmit`'s `cloneBuiltIn` in the same change.
-*/
-const REFERENCE_COMPARED_TAGS = /* @__PURE__ */ new Set([
-	"[object Error]",
-	"[object ArrayBuffer]",
-	"[object SharedArrayBuffer]",
-	"[object Promise]",
-	"[object WeakMap]",
-	"[object WeakSet]"
-]);
-/**
-* Intrinsic tags of OPAQUE exotics: objects whose internal state no
-* structural walk can observe (boxed Symbols, generator objects,
-* WeakRefs, FinalizationRegistry handles). `deepEqual` compares them by
-* identity and `deepOmit` passes them through by reference; treating
-* them as (empty) plain objects would make ALL such exotics equal to
-* each other. Deliberately a curated INTRINSIC list, not "every unknown
-* tag": a user class exposing its own `Symbol.toStringTag` (e.g.
-* "Money") keeps structural comparison, and a plain object spoofing one
-* of these intrinsic tags gets the identity semantics of the thing it
-* claims to be.
-*/
-const OPAQUE_EXOTIC_TAGS = /* @__PURE__ */ new Set([
-	"[object Symbol]",
-	"[object Generator]",
-	"[object AsyncGenerator]",
-	"[object WeakRef]",
-	"[object FinalizationRegistry]"
-]);
-/** True when `tag` names an opaque intrinsic; see {@link OPAQUE_EXOTIC_TAGS}. */
-function isOpaqueExoticTag(tag) {
-	return OPAQUE_EXOTIC_TAGS.has(tag);
-}
-function findPropertyDescriptor(value, key) {
-	const visited = /* @__PURE__ */ new WeakSet();
-	let current = value;
-	while (current !== null && !visited.has(current)) {
-		visited.add(current);
-		const descriptor = Object.getOwnPropertyDescriptor(current, key);
-		if (descriptor !== void 0) return descriptor;
-		current = Object.getPrototypeOf(current);
-	}
-}
-function builtInTagWithoutInvokingAccessors(value) {
-	if (ArrayBuffer.isView(value)) return hasBrand(value, "[object DataView]") ? "[object DataView]" : "[object TypedArray]";
-	const descriptor = findPropertyDescriptor(value, Symbol.toStringTag);
-	if (descriptor !== void 0 && !("value" in descriptor)) return builtInTagFromBrand(value);
-	const tag = Object.prototype.toString.call(value);
-	if (BUILT_IN_TAGS.has(tag) && hasBrand(value, tag)) return tag;
-	return descriptor === void 0 ? void 0 : builtInTagFromBrand(value);
-}
-function builtInTagFromBrand(value) {
-	if (hasBrand(value, "[object Date]")) return "[object Date]";
-	if (hasBrand(value, "[object RegExp]")) return "[object RegExp]";
-	if (hasBrand(value, "[object Map]")) return "[object Map]";
-	if (hasBrand(value, "[object Set]")) return "[object Set]";
-	if (hasBrand(value, "[object WeakMap]")) return "[object WeakMap]";
-	if (hasBrand(value, "[object WeakSet]")) return "[object WeakSet]";
-	if (hasBrand(value, "[object DataView]")) return "[object DataView]";
-	if (hasBrand(value, "[object ArrayBuffer]")) return "[object ArrayBuffer]";
-	if (hasBrand(value, "[object SharedArrayBuffer]")) return "[object SharedArrayBuffer]";
-	if (hasBrand(value, "[object Boolean]")) return "[object Boolean]";
-	if (hasBrand(value, "[object Number]")) return "[object Number]";
-	if (hasBrand(value, "[object String]")) return "[object String]";
-	if (hasBrand(value, "[object BigInt]")) return "[object BigInt]";
-	if (hasNativePrototype(value, "Promise")) return "[object Promise]";
-	if (hasNativePrototype(value, "Error")) return "[object Error]";
-}
-function hasNativePrototype(value, expectedName) {
-	const visited = /* @__PURE__ */ new WeakSet();
-	let prototype = Object.getPrototypeOf(value);
-	while (prototype !== null && !visited.has(prototype)) {
-		visited.add(prototype);
-		if (isIntrinsicConstructorPrototype(prototype, expectedName)) return true;
-		prototype = Object.getPrototypeOf(prototype);
-	}
-	return false;
-}
-/**
-* Verifies that `obj` genuinely is the type its tag claims, via an
-* internal-slot probe. Promise and Error have no side-effect-free standard
-* probe, so their visible tags remain conservative; masked instances are
-* identified separately through their native prototype chain.
-*/
-function hasBrand(obj, tag) {
-	try {
-		switch (tag) {
-			case "[object Date]":
-				dateGetTime.call(obj);
-				return true;
-			case "[object RegExp]":
-				regExpSourceGet.call(obj);
-				return true;
-			case "[object Map]":
-				mapSizeGet.call(obj);
-				return true;
-			case "[object Set]":
-				setSizeGet.call(obj);
-				return true;
-			case "[object WeakMap]":
-				weakMapHas.call(obj, PROBE_KEY);
-				return true;
-			case "[object WeakSet]":
-				weakSetHas.call(obj, PROBE_KEY);
-				return true;
-			case "[object DataView]":
-				dataViewByteLengthGet.call(obj);
-				return true;
-			case "[object ArrayBuffer]":
-				arrayBufferByteLengthGet.call(obj);
-				return true;
-			case "[object SharedArrayBuffer]":
-				if (!sharedArrayBufferByteLengthGet) return false;
-				sharedArrayBufferByteLengthGet.call(obj);
-				return true;
-			case "[object Boolean]":
-				booleanValueOf.call(obj);
-				return true;
-			case "[object Number]":
-				numberValueOf.call(obj);
-				return true;
-			case "[object String]":
-				stringValueOf.call(obj);
-				return true;
-			case "[object BigInt]":
-				bigIntValueOf.call(obj);
-				return true;
-			case "[object Promise]": return hasNativePrototype(obj, "Promise");
-			case "[object Error]": return ERROR_INTRINSIC_NAMES.some((name) => hasNativePrototype(obj, name));
-			default: return false;
-		}
-	} catch {
-		return false;
-	}
-}
-/**
-* Returns `true` when `obj` is a built-in JavaScript type that should be
-* treated atomically (compared/cloned as a unit, not walked structurally).
-* Cross-realm safe, and brand-verified: a plain object spoofing a built-in
-* tag via `Symbol.toStringTag` returns `false` and is walked structurally
-* like any other plain object instead of crashing type-specific code.
-*
-* @param obj - The object to classify
-* @param tag - The result of `Object.prototype.toString.call(obj)`, passed
-*              in so callers that already computed it don't pay twice
-*/
-function isBuiltInObject(obj, tag) {
-	if (ArrayBuffer.isView(obj)) return true;
-	if (tag.endsWith("Array]")) return false;
-	return BUILT_IN_TAGS.has(tag) && hasBrand(obj, tag);
-}
-/**
-* Brand-verified `WeakMap` check that holds across realms. `instanceof
-* WeakMap` binds to the constructor of one realm, so a WeakMap from a `vm`
-* context or an iframe reads as a foreign value. The internal-slot probe
-* answers the same in every realm, and a plain object cannot spoof it
-* through `Symbol.toStringTag`.
-*/
-function isWeakMap(value) {
-	return typeof value === "object" && value !== null && hasBrand(value, "[object WeakMap]");
-}
-
-//#endregion
-//#region src/internal/structural/deep-equal.ts
-const objProto = Object.prototype;
-const objToString = objProto.toString;
-const objHasOwn = objProto.hasOwnProperty;
-/**
-* SameValueZero: `===` plus NaN-equals-NaN (and `+0 === -0`, unlike
-* `Object.is`). The numeric semantics `deepEqual` documents for primitives,
-* applied consistently inside TypedArrays, Dates and Number wrappers.
-*/
-function sameValueZero(a, b) {
-	return a === b || Number.isNaN(a) && Number.isNaN(b);
-}
-/**
-* Performs a deep equality check between two values.
-*
-* This function compares values recursively, handling:
-* - Primitives (with special handling for NaN)
-* - Arrays (nested arrays supported)
-* - Objects (plain objects and class instances)
-* - TypedArrays (Uint8Array, Int32Array, etc.)
-* - DataView
-* - Maps and Sets
-* - Dates and RegExp
-* - Wrapper objects (Boolean, Number, String)
-* - Circular references (detected and handled)
-*
-* @param a - The first value to compare
-* @param b - The second value to compare
-* @returns `true` if the values are deeply equal, `false` otherwise
-*
-* @example
-* ```ts
-* deepEqual([1, 2, 3], [1, 2, 3]); // true
-* deepEqual({ a: 1, b: [2, 3] }, { a: 1, b: [2, 3] }); // true
-* deepEqual(NaN, NaN); // true
-* deepEqual([1, 2], [1, 2, 3]); // false
-* ```
-*/
-function deepEqual(a, b) {
-	return deepEqualInner(a, b, /* @__PURE__ */ new WeakMap());
-}
-/**
-* Internal recursive function for deep equality comparison.
-*
-* @internal
-*/
-function deepEqualInner(a, b, visited) {
-	if (a === b) return true;
-	const typeA = typeof a;
-	const typeB = typeof b;
-	if (typeA !== "object" || a === null || typeB !== "object" || b === null) {
-		if (typeA === "number" && typeB === "number") return Number.isNaN(a) && Number.isNaN(b);
-		return false;
-	}
-	const objA = a;
-	const objB = b;
-	let cachedBs = visited.get(objA);
-	if (cachedBs?.has(objB)) return true;
-	if (!cachedBs) {
-		cachedBs = /* @__PURE__ */ new WeakSet();
-		visited.set(objA, cachedBs);
-	}
-	cachedBs.add(objB);
-	if (ArrayBuffer.isView(objA) || ArrayBuffer.isView(objB)) {
-		if (!ArrayBuffer.isView(objA) || !ArrayBuffer.isView(objB)) return false;
-		const tagA = objToString.call(objA);
-		if (tagA !== objToString.call(objB)) return false;
-		if (tagA === "[object DataView]") {
-			const viewA = objA;
-			const viewB = objB;
-			if (viewA.byteLength !== viewB.byteLength) return false;
-			const len = viewA.byteLength;
-			for (let i = 0; i < len; i++) if (viewA.getUint8(i) !== viewB.getUint8(i)) return false;
-			return true;
-		}
-		const arrA = objA;
-		const arrB = objB;
-		const len = arrA.length;
-		if (len !== arrB.length) return false;
-		for (let i = 0; i < len; i++) if (!sameValueZero(arrA[i], arrB[i])) return false;
-		return true;
-	}
-	if (Array.isArray(objA) || Array.isArray(objB)) {
-		if (!Array.isArray(objA) || !Array.isArray(objB)) return false;
-		if (objA.length !== objB.length) return false;
-		const keysA = Reflect.ownKeys(objA).filter((key) => key !== "length");
-		const keysB = Reflect.ownKeys(objB).filter((key) => key !== "length");
-		if (keysA.length !== keysB.length) return false;
-		const arrA = objA;
-		const arrB = objB;
-		for (const key of keysA) {
-			if (!objHasOwn.call(objB, key)) return false;
-			if (!deepEqualInner(arrA[key], arrB[key], visited)) return false;
-		}
-		return true;
-	}
-	const tagA = objToString.call(objA);
-	const tagB = objToString.call(objB);
-	if (tagA !== tagB) return false;
-	const builtInA = isBuiltInObject(objA, tagA);
-	if (builtInA !== isBuiltInObject(objB, tagB)) return false;
-	if (!builtInA) {
-		if (isOpaqueExoticTag(tagA)) return objA === objB;
-		return comparePlainObjects(objA, objB, visited);
-	}
-	switch (tagA) {
-		case "[object Map]": {
-			const mapA = objA;
-			const mapB = objB;
-			if (mapA.size !== mapB.size) return false;
-			for (const [key, valA] of mapA) {
-				if (!mapB.has(key)) return false;
-				if (!deepEqualInner(valA, mapB.get(key), visited)) return false;
-			}
-			return true;
-		}
-		case "[object Set]": {
-			const setA = objA;
-			const setB = objB;
-			if (setA.size !== setB.size) return false;
-			for (const value of setA) if (!setB.has(value)) return false;
-			return true;
-		}
-		case "[object Date]": return sameValueZero(objA.getTime(), objB.getTime());
-		case "[object RegExp]": {
-			const regA = objA;
-			const regB = objB;
-			return regA.source === regB.source && regA.flags === regB.flags;
-		}
-		case "[object Boolean]":
-		case "[object Number]":
-		case "[object String]":
-		case "[object BigInt]": return sameValueZero(objA.valueOf(), objB.valueOf());
-		default: return objA === objB;
-	}
-}
-/**
-* Plain / custom objects: compare own enumerable string keys + own symbol
-* keys and their values. Used both as the final fallback and for objects
-* whose built-in-looking tag failed brand verification.
-*/
-function comparePlainObjects(objA, objB, visited) {
-	const recA = objA;
-	const recB = objB;
-	const stringKeysA = Object.getOwnPropertyNames(objA);
-	const stringKeysB = Object.getOwnPropertyNames(objB);
-	if (stringKeysA.length !== stringKeysB.length) return false;
-	const symbolKeysA = Object.getOwnPropertySymbols(objA);
-	const symbolKeysB = Object.getOwnPropertySymbols(objB);
-	if (symbolKeysA.length !== symbolKeysB.length) return false;
-	const symbolKeysBSet = new Set(symbolKeysB);
-	for (const key of stringKeysA) if (!objHasOwn.call(objB, key)) return false;
-	for (const key of symbolKeysA) if (!symbolKeysBSet.has(key)) return false;
-	for (const key of stringKeysA) if (!deepEqualInner(recA[key], recB[key], visited)) return false;
-	for (const key of symbolKeysA) if (!deepEqualInner(recA[key], recB[key], visited)) return false;
-	return true;
-}
-
-//#endregion
-//#region src/internal/structural/deep-omit.ts
-/**
-* Creates a deep copy of `value` with certain keys removed according to the
-* provided rules.
-*
-* Walks the object tree and skips keys that match `ignoreKeys` /
-* `ignoreKeyPredicate`. Built-in atomic types that `deepEqual` compares by
-* value (Date, RegExp, Map, Set, TypedArrays, DataView) are cloned by type
-* rather than walked, since their internal structure has no key filtering to
-* apply. Types that `deepEqual` compares by reference (Error, ArrayBuffer,
-* SharedArrayBuffer, Promise, WeakMap, WeakSet) are passed through by
-* reference, so `deepEqualExcept(x, x)` stays reflexive. Cycles are
-* preserved: a cycle `a → a` clones to `a' → a'`. Arrays retain sparse
-* holes and all non-ignored own properties, including symbol keys.
-*
-* **Shared references.** Without `ignoreKeyPredicate`, an object reached
-* via several paths dedupes to a single clone. With a predicate, each
-* path gets its own clone, because the predicate may decide differently per
-* path, so memoising the first path's result would be wrong. This is
-* inherently exponential for diamond-shaped sharing (a node reachable
-* via 2^n paths is cloned 2^n times); the walk aborts with a descriptive
-* error after {@link PATH_SENSITIVE_VISIT_BUDGET} node visits instead of
-* hanging the process.
-*
-* **Prototype-pollution safety.** `__proto__` and `constructor` keys
-* encountered as *own* properties of the input (typical of `JSON.parse`
-* output) are copied as inert data properties via `Object.defineProperty`
-* so the clone graph cannot bleed into `Object.prototype`.
-*
-* **Class instances.** When the input is a class instance, the clone is
-* built via `Object.create(proto)` so the prototype is preserved, but the
-* constructor is NOT re-invoked, so class invariants enforced by the
-* constructor are not re-checked. `deepOmit` is therefore best used for
-* comparison/serialisation (`voEqualsExcept`, `deepEqualExcept`), not as
-* a general-purpose clone for behaviour-carrying objects.
-*
-* @param value - The value to create a deep copy from
-* @param options - Options specifying which keys to ignore
-* @returns A deep copy of `value` with specified keys removed
-*/
-function deepOmit(value, options) {
-	const visited = /* @__PURE__ */ new WeakMap();
-	return omitInternal(value, options, options.ignoreKeys ? new Set(options.ignoreKeys) : void 0, [], visited, options.ignoreKeyPredicate ? { visits: 0 } : void 0);
-}
-/**
-* Maximum object-node visits for a single path-sensitive `deepOmit` walk.
-* Per-path cloning expands exponentially on diamond-shaped sharing; past
-* this bound the walk throws instead of hanging the process. One million
-* visits covers any realistically tree-shaped input.
-*/
-const PATH_SENSITIVE_VISIT_BUDGET = 1e6;
-function omitInternal(value, options, ignoreKeys, path, visited, budget) {
-	if (value === null) return value;
-	if (typeof value !== "object") return value;
-	const obj = value;
-	if (visited.has(obj)) return visited.get(obj);
-	if (budget && ++budget.visits > PATH_SENSITIVE_VISIT_BUDGET) throw new Error(`deepOmit: exceeded ${PATH_SENSITIVE_VISIT_BUDGET} node visits. With ignoreKeyPredicate, objects reached via shared references are cloned once per path (the predicate may decide differently per path), which expands exponentially on diamond-shaped sharing. Restructure the input to a tree, or use ignoreKeys for path-independent filtering.`);
-	if (Array.isArray(obj)) {
-		const arr = obj;
-		const clone = new Array(arr.length);
-		const lengthDescriptor = Object.getOwnPropertyDescriptor(arr, "length");
-		visited.set(obj, clone);
-		for (const key of Reflect.ownKeys(arr)) {
-			if (key === "length") continue;
-			const segment = arrayPathSegment(key);
-			if (typeof segment !== "number" && shouldIgnoreKey(key, path, ignoreKeys, options)) continue;
-			const descriptor = Object.getOwnPropertyDescriptor(arr, key);
-			if (descriptor === void 0) continue;
-			path.push(segment);
-			if ("value" in descriptor) descriptor.value = omitInternal(descriptor.value, options, ignoreKeys, path, visited, budget);
-			Object.defineProperty(clone, key, descriptor);
-			path.pop();
-		}
-		if (lengthDescriptor !== void 0) Object.defineProperty(clone, "length", lengthDescriptor);
-		if (budget) visited.delete(obj);
-		return clone;
-	}
-	const tag = Object.prototype.toString.call(obj);
-	if (isBuiltInObject(obj, tag)) {
-		const builtInClone = cloneBuiltIn(obj, tag);
-		visited.set(obj, builtInClone);
-		return builtInClone;
-	}
-	if (isOpaqueExoticTag(tag)) {
-		visited.set(obj, obj);
-		return obj;
-	}
-	const clone = Object.create(Object.getPrototypeOf(obj));
-	visited.set(obj, clone);
-	const stringKeys = Object.getOwnPropertyNames(obj);
-	const symbolKeys = Object.getOwnPropertySymbols(obj);
-	for (const key of [...stringKeys, ...symbolKeys]) {
-		if (shouldIgnoreKey(key, path, ignoreKeys, options)) continue;
-		path.push(key);
-		assignOwn(clone, key, omitInternal(obj[key], options, ignoreKeys, path, visited, budget), Object.getOwnPropertyDescriptor(obj, key)?.enumerable ?? true);
-		path.pop();
-	}
-	if (budget) visited.delete(obj);
-	return clone;
-}
-function arrayPathSegment(key) {
-	if (typeof key === "symbol") return key;
-	const index = Number(key);
-	return Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key ? index : key;
-}
-/**
-* Assigns `value` as an OWN data property on `target` without going through
-* any inherited setter; critically, it never invokes the `__proto__` setter
-* even when `key === "__proto__"`. Required to defeat prototype-pollution
-* payloads that ship `__proto__` as a parsed-JSON own key.
-*/
-function assignOwn(target, key, value, enumerable = true) {
-	Object.defineProperty(target, key, {
-		value,
-		writable: true,
-		enumerable,
-		configurable: true
-	});
-}
-/**
-* Clones a built-in atomic type by case. Falls back to `structuredClone`
-* for anything not explicitly enumerated (e.g. DataView, TypedArrays,
-* Boolean/Number/String wrappers, all of which `deepEqual` compares by
-* value). Types that `deepEqual` compares BY REFERENCE (the shared
-* {@link REFERENCE_COMPARED_TAGS} set) are passed through by reference
-* instead; cloning them would make `deepEqualExcept(x, x)` false.
-* Promise/WeakMap/WeakSet additionally cannot be cloned at all
-* (`structuredClone` rejects them).
-*/
-function cloneBuiltIn(obj, tag) {
-	if (REFERENCE_COMPARED_TAGS.has(tag)) return obj;
-	switch (tag) {
-		case "[object Date]": return new Date(obj.getTime());
-		case "[object RegExp]": {
-			const re = obj;
-			const copy = new RegExp(re.source, re.flags);
-			copy.lastIndex = re.lastIndex;
-			return copy;
-		}
-		case "[object Map]": return new Map(obj);
-		case "[object Set]": return new Set(obj);
-		default: return structuredClone(obj);
-	}
-}
-function shouldIgnoreKey(key, path, ignoreKeys, options) {
-	if (ignoreKeys?.has(key)) return true;
-	if (options.ignoreKeyPredicate?.(key, path.slice())) return true;
-	return false;
-}
-
-//#endregion
-//#region src/internal/structural/deep-equal-except.ts
-/**
-* Performs a deep equality comparison between two values after omitting specified keys.
-*
-* This function first removes the specified keys from both values using `deepOmit`,
-* then performs a deep equality check using `deepEqual`.
-*
-* @param a - The first value to compare
-* @param b - The second value to compare
-* @param options - Options specifying which keys to omit before comparison
-* @returns `true` if the values are deeply equal after omitting specified keys, `false` otherwise
-*
-* @example
-* ```ts
-* const obj1 = { id: 1, name: "Alice", updatedAt: "2024-01-01" };
-* const obj2 = { id: 2, name: "Alice", updatedAt: "2024-01-02" };
-*
-* deepEqualExcept(obj1, obj2, { ignoreKeys: ["id", "updatedAt"] }); // true
-* ```
-*/
-function deepEqualExcept(a, b, options) {
-	const prunedA = deepOmit(a, options);
-	const prunedB = deepOmit(b, options);
-	return deepEqual(prunedA, prunedB);
-}
-
-//#endregion
-//#region src/domain/value-object/value-object.ts
-/**
-* `Object.freeze` does not protect internal slots: a frozen Date still
-* accepts `setTime`, a frozen Map still accepts `set`. To make the
-* "deeply immutable" guarantee real, the mutator methods are shadowed
-* with own throwing functions BEFORE the freeze. The shadows are
-* non-enumerable, so they are invisible to `Object.keys`/spread (deep
-* equality is unaffected) and `structuredClone` drops them (a `vo()`
-* round-trip never sees them).
-*/
-const DATE_MUTATORS = [
-	"setTime",
-	"setMilliseconds",
-	"setUTCMilliseconds",
-	"setSeconds",
-	"setUTCSeconds",
-	"setMinutes",
-	"setUTCMinutes",
-	"setHours",
-	"setUTCHours",
-	"setDate",
-	"setUTCDate",
-	"setMonth",
-	"setUTCMonth",
-	"setFullYear",
-	"setUTCFullYear",
-	"setYear"
-];
-const mutationThrowers = /* @__PURE__ */ new Map();
-const mapEntries$1 = Map.prototype.entries;
-const setValues$1 = Set.prototype.values;
-function mutationThrower(typeName, method) {
-	const key = `${typeName}.${method}`;
-	let thrower = mutationThrowers.get(key);
-	if (!thrower) {
-		thrower = function throwFrozenMutation() {
-			throw new TypeError(`Cannot call ${method}() on a ${typeName} inside a deeply frozen value`);
-		};
-		mutationThrowers.set(key, thrower);
-	}
-	return thrower;
-}
-const shadowDescriptor = {
-	value: void 0,
-	writable: false,
-	enumerable: false,
-	configurable: false
-};
-/** Returns whether the shadows were installed. */
-function shadowMutators(obj, typeName, methods) {
-	if (!Object.isExtensible(obj)) return false;
-	for (const method of methods) {
-		shadowDescriptor.value = mutationThrower(typeName, method);
-		Object.defineProperty(obj, method, shadowDescriptor);
-	}
-	return true;
-}
-const VALUE_OBJECT_CLASS = Symbol.for("@shirudo/ddd-kit/value-object-class/v1");
-function recordValueObjectClass(instance, valueObjectClass) {
-	Object.defineProperty(instance, VALUE_OBJECT_CLASS, {
-		value: valueObjectClass,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-}
-function isValueObjectInstance(value) {
-	if (value === null || typeof value !== "object") return false;
-	const record = Reflect.getOwnPropertyDescriptor(value, VALUE_OBJECT_CLASS);
-	if (record === void 0 || typeof record.value !== "function" || record.enumerable !== false || record.writable !== false || record.configurable !== false) return false;
-	const props = Reflect.getOwnPropertyDescriptor(value, "props");
-	return props !== void 0 && isSealedProps(props.value);
-}
-function isSealedProps(props) {
-	if (typeof props !== "object" || props === null) return false;
-	return Object.isFrozen(props) || builtInTagWithoutInvokingAccessors(props) === "[object RegExp]";
-}
-function looksLikeValueObject(instance) {
-	if (Object.hasOwn(instance, VALUE_OBJECT_CLASS)) return true;
-	const props = Reflect.getOwnPropertyDescriptor(instance, "props");
-	return props !== void 0 && isSealedProps(props.value);
-}
-function openValueObjectKeys(instance) {
-	return Reflect.ownKeys(instance).filter((key) => key !== "props" && key !== VALUE_OBJECT_CLASS);
-}
-function rejectValueObjectAsInput(input, entry) {
-	if (isValueObjectInstance(input)) throw new TypeError(`${entry} does not accept a value object as its input: nest the value object under a key, or pass its props`);
-}
-/**
-* Deep freezes an object and all its nested properties recursively, then
-* returns it. Iterates both string-keyed and symbol-keyed own properties
-* so the freeze symmetry matches `deepEqual` (which also considers symbol
-* keys). Handles circular references by tracking visited objects.
-*
-* Note: `deepFreeze` mutates its argument in place; it sets `[[Frozen]]`
-* on the object you pass in. Callers that need to avoid touching the
-* input (e.g. `vo()`) should deep-clone first.
-*
-* Date/Map/Set keep internal-slot mutability under `Object.freeze`
-* (`setTime`, `set`, `add`, … still work on frozen instances), so their
-* mutator methods are shadowed with throwing own properties and Map/Set
-* contents are frozen recursively. The shadows are non-enumerable:
-* invisible to `Object.keys`, spread, `deepEqual`, and `structuredClone`.
-*
-* The shadowing is deny-by-enumeration: only the mutators known at
-* release time are blocked. If the runtime grows a NEW mutator (e.g. the
-* stage-3 `Map.prototype.getOrInsert` upsert proposal), it is not blocked
-* until the list is updated. Treat the mutator blocking as a guard rail,
-* not a security boundary.
-*
-* Two kinds of built-in pass through unfrozen. ArrayBuffer views
-* (TypedArrays, DataView): the spec forbids freezing a view with elements,
-* and a freeze cannot protect the underlying buffer, so their contents stay
-* mutable. RegExp: pattern and flags live in immutable internal slots, and
-* the only own data property, `lastIndex`, is scan state that every global
-* or sticky match writes. A frozen RegExp protects nothing and throws on
-* the first such match, so the RegExp keeps matching instead. A view or a
-* RegExp passes through whole: an expando property on it stays open, and
-* the walk does not enter its subtree.
-*/
-const DEEP_FROZEN = /* @__PURE__ */ new WeakSet();
-const KIT_SHADOWED = /* @__PURE__ */ new WeakSet();
-function deepFreeze(obj) {
-	const walk = {
-		cyclic: false,
-		sealed: [],
-		done: /* @__PURE__ */ new Map(),
-		inProgress: /* @__PURE__ */ new Set()
-	};
-	freezeDeep(obj, walk);
-	if (!walk.cyclic) for (const object of walk.sealed) DEEP_FROZEN.add(object);
-	return obj;
-}
-/** Freezes `obj` and its subtree; returns whether the subtree is sealed. */
-function freezeDeep(obj, walk) {
-	if (obj === null || typeof obj !== "object") return true;
-	if (DEEP_FROZEN.has(obj)) return true;
-	if (ArrayBuffer.isView(obj)) return true;
-	const finished = walk.done.get(obj);
-	if (finished !== void 0) return finished;
-	if (walk.inProgress.has(obj)) {
-		walk.cyclic = true;
-		return true;
-	}
-	const builtInTag = builtInTagWithoutInvokingAccessors(obj);
-	if (builtInTag === "[object RegExp]") return true;
-	walk.inProgress.add(obj);
-	let sealed = true;
-	if (builtInTag === "[object Date]" || builtInTag === "[object Map]" || builtInTag === "[object Set]") {
-		let shadowed = KIT_SHADOWED.has(obj);
-		if (builtInTag === "[object Date]") shadowed = shadowMutators(obj, "Date", DATE_MUTATORS) || shadowed;
-		else if (builtInTag === "[object Map]") {
-			for (const [key, value] of obj) {
-				if (!freezeDeep(key, walk)) sealed = false;
-				if (!freezeDeep(value, walk)) sealed = false;
-			}
-			shadowed = shadowMutators(obj, "Map", [
-				"set",
-				"delete",
-				"clear"
-			]) || shadowed;
-		} else if (builtInTag === "[object Set]") {
-			for (const member of obj) if (!freezeDeep(member, walk)) sealed = false;
-			shadowed = shadowMutators(obj, "Set", [
-				"add",
-				"delete",
-				"clear"
-			]) || shadowed;
-		}
-		if (shadowed) KIT_SHADOWED.add(obj);
-		else sealed = false;
-	}
-	const keys = Reflect.ownKeys(obj);
-	for (const key of keys) {
-		const value = obj[key];
-		if (value !== null && typeof value === "object") {
-			if (!freezeDeep(value, walk)) sealed = false;
-		}
-	}
-	Object.freeze(obj);
-	walk.inProgress.delete(obj);
-	walk.done.set(obj, sealed);
-	if (sealed) walk.sealed.push(obj);
-	return sealed;
-}
-/**
-* Deep clone used by `vo()` and the `ValueObject` constructor.
-*
-* Plain objects, arrays, and Map values are walked manually so
-* that symbol-keyed properties survive (which `structuredClone` silently
-* drops; they would otherwise be invisible to `voEquals`, whose
-* `deepEqual` DOES consider symbol keys) and shared references / cycles
-* keep their identity across Map boundaries. Function values throw,
-* preserving `vo()`'s documented data-not-behaviour gate. Built-ins without
-* immutable value semantics throw a descriptive `TypeError`. A kit
-* `ValueObject` instance is admitted by reference (see
-* `VALUE_OBJECT_CLASS`). Every other custom class instance and every
-* subclass of a built-in is rejected because cloning it without invoking
-* its constructor can silently lose private or non-enumerable state. Map
-* keys and Set members must be primitive because their equality is
-* identity-based and object identity cannot survive defensive cloning.
-* Accessor properties are rejected without invoking them. Admitted atomic
-* built-ins (Date, RegExp and primitive wrappers) delegate to
-* `structuredClone`, brand-verified so a `Symbol.toStringTag` spoofer is
-* walked as the plain object it is. `__proto__` own keys are copied as
-* inert data properties.
-*/
-function cloneForVo(value, visited) {
-	if (typeof value === "function") throw new TypeError("vo() does not accept function values: Value Objects are data, not behaviour");
-	if (value === null || typeof value !== "object") return value;
-	const obj = value;
-	if (ArrayBuffer.isView(obj)) throwUnsupportedValueSemantics(builtInTagWithoutInvokingAccessors(obj) ?? "[object ArrayBuffer view]");
-	if (visited.has(obj)) return visited.get(obj);
-	if (Array.isArray(obj)) {
-		if (!hasIntrinsicPrototypeChain(obj, "Array")) throwUnsupportedClassInstance(obj);
-		const clone = new Array(obj.length);
-		visited.set(obj, clone);
-		for (const key of Reflect.ownKeys(obj)) {
-			if (key === "length") continue;
-			const descriptor = Object.getOwnPropertyDescriptor(obj, key);
-			if (descriptor === void 0) continue;
-			if (!("value" in descriptor)) throwUnsupportedAccessorProperty();
-			if (typeof key === "string" && !descriptor.enumerable) continue;
-			descriptor.value = cloneForVo(descriptor.value, visited);
-			Object.defineProperty(clone, key, descriptor);
-		}
-		return clone;
-	}
-	const tag = builtInTagWithoutInvokingAccessors(obj);
-	if (tag !== void 0) {
-		if (!hasIntrinsicPrototypeChain(obj)) throwUnsupportedClassInstance(obj);
-		if (tag === "[object Map]") {
-			const clone = /* @__PURE__ */ new Map();
-			visited.set(obj, clone);
-			for (const [key, entry] of mapEntries$1.call(obj)) {
-				if (!isPrimitiveValue(key)) throw new TypeError("vo() Map keys must be primitive values to preserve value equality");
-				clone.set(key, cloneForVo(entry, visited));
-			}
-			return clone;
-		}
-		if (tag === "[object Set]") {
-			const clone = /* @__PURE__ */ new Set();
-			visited.set(obj, clone);
-			for (const member of setValues$1.call(obj)) {
-				if (!isPrimitiveValue(member)) throw new TypeError("vo() Set members must be primitive values to preserve value equality");
-				clone.add(member);
-			}
-			return clone;
-		}
-		if (tag === "[object Promise]" || tag === "[object WeakMap]" || tag === "[object WeakSet]") throw new TypeError(`vo() cannot clone a ${tag.slice(8, -1)}: Value Objects are plain data`);
-		if (tag === "[object Error]" || tag === "[object ArrayBuffer]" || tag === "[object SharedArrayBuffer]") throwUnsupportedValueSemantics(tag);
-		if (tag === "[object RegExp]") {
-			const regExp = obj;
-			if (regExp.global || regExp.sticky) throw new TypeError("vo() cannot accept a global or sticky RegExp: its lastIndex is mutable scan state, not an immutable value");
-		}
-		const builtInClone = structuredClone(obj);
-		visited.set(obj, builtInClone);
-		return builtInClone;
-	}
-	const prototype = Object.getPrototypeOf(obj);
-	if (prototype !== null && (!isIntrinsicConstructorPrototype(prototype, "Object") || Object.getPrototypeOf(prototype) !== null)) {
-		if (isValueObjectInstance(obj)) {
-			const openKeys = openValueObjectKeys(obj);
-			if (openKeys.length > 0) throwOpenValueObjectFields(openKeys);
-			return obj;
-		}
-		throwUnsupportedClassInstance(obj);
-	}
-	const clone = Object.create(prototype === null ? null : Object.prototype);
-	visited.set(obj, clone);
-	for (const key of Reflect.ownKeys(obj)) {
-		const descriptor = Object.getOwnPropertyDescriptor(obj, key);
-		if (descriptor === void 0) continue;
-		if (!("value" in descriptor)) throwUnsupportedAccessorProperty();
-		if (typeof key === "string" && !descriptor.enumerable) continue;
-		Object.defineProperty(clone, key, {
-			value: cloneForVo(descriptor.value, visited),
-			writable: true,
-			enumerable: descriptor.enumerable,
-			configurable: true
-		});
-	}
-	return clone;
-}
-function throwUnsupportedClassInstance(instance) {
-	const valueObjectHint = looksLikeValueObject(instance) ? ". A value object is recognized only when a copy of this kit version built it and its props are frozen" : "";
-	throw new TypeError(`vo() cannot clone custom class instances: Value Objects are plain data${valueObjectHint}`);
-}
-function throwOpenValueObjectFields(keys) {
-	throw new TypeError(`vo() cannot nest a value object with own fields outside props (${keys.map(String).join(", ")}): keep the state of a value object in props`);
-}
-function throwUnsupportedAccessorProperty() {
-	throw new TypeError("vo() cannot clone accessor properties: Value Objects are plain data");
-}
-function throwUnsupportedValueSemantics(tag) {
-	const name = tag.startsWith("[object ") ? tag.slice(8, -1) : tag;
-	throw new TypeError(`vo() cannot accept ${name} values: Value Objects require immutable value semantics`);
-}
-function isPrimitiveValue(value) {
-	return value === null || typeof value !== "object" && typeof value !== "function";
-}
-/**
-* Creates a deeply immutable value object from the given data.
-*
-* The input is first deep-cloned, then the clone is frozen, so calling
-* `vo(input)` never freezes the caller's own object graph as a
-* side-effect. Mutating the input afterwards does not bleed into the VO.
-* Symbol-keyed properties are preserved (matching `voEquals`). A kit
-* `ValueObject` instance nested in the input is kept by reference and
-* frozen in place; it must keep all of its state in `props`. A value
-* object as the input itself is rejected.
-* Function values and every other custom class instance are rejected
-* (Value Objects are plain data, not behaviour-bearing object graphs). Inputs must be trusted and
-* Proxy-free: ECMAScript provides no portable way to identify a transparent
-* Proxy without potentially executing its traps, so `vo()` is not a sandbox
-* for hostile in-process objects. Built-ins that cannot provide immutable,
-* value-based semantics are rejected instead of weakening the VO contract.
-*
-* @example
-* ```typescript
-* const nested = { lat: 52.5, lng: 13.4 };
-* const address = vo({ street: "Main St", coordinates: nested });
-* address.coordinates.lat = 99; // ❌ Cannot assign to read-only property
-* nested.lat = 0;               // ✅ caller's input still mutable
-* ```
-*/
-function vo(t) {
-	rejectValueObjectAsInput(t, "vo()");
-	return deepFreeze(cloneForVo(t, /* @__PURE__ */ new WeakMap()));
-}
-/**
-* Compares two value objects for equality based on their values.
-* Uses deep equality comparison that handles:
-* - Nested objects and arrays
-* - Primitives (including NaN)
-* - Dates, Maps, Sets, RegExp
-* - Symbol keys
-* - Circular references
-*
-* @param a - First value object
-* @param b - Second value object
-* @returns true if both objects have the same values, false otherwise
-*
-* @example
-* ```typescript
-* const money1 = vo({ amount: 100, currency: "USD" });
-* const money2 = vo({ amount: 100, currency: "USD" });
-* voEquals(money1, money2); // true
-*
-* const address1 = vo({
-*   street: "Main St",
-*   coordinates: { lat: 52.5, lng: 13.4 }
-* });
-* const address2 = vo({
-*   street: "Main St",
-*   coordinates: { lat: 52.5, lng: 13.4 }
-* });
-* voEquals(address1, address2); // true
-* ```
-*/
-function voEquals(a, b) {
-	return deepEqual(a, b);
-}
-/**
-* Compares two value objects for equality while ignoring specified keys.
-* Useful for comparing value objects that contain metadata or optional fields
-* that should not affect equality comparison.
-*
-* The walk enters a nested `ValueObject` instance like any other object,
-* so inside it the path continues with `props`; `ignoreKeys: ["props"]`
-* empties every nested value object. The key under which the kit records
-* the class of the instance is never ignored.
-*
-* @param a - First value object
-* @param b - Second value object
-* @param options - Options specifying which keys to ignore during comparison
-* @returns true if both objects have the same values (after ignoring specified keys), false otherwise
-*
-* @example
-* ```typescript
-* // Value object with metadata
-* const address1 = vo({
-*   street: "Main St",
-*   city: "Berlin",
-*   metadata: { createdAt: "2024-01-01", updatedAt: "2024-01-02" }
-* });
-*
-* const address2 = vo({
-*   street: "Main St",
-*   city: "Berlin",
-*   metadata: { createdAt: "2024-01-01", updatedAt: "2024-01-03" }
-* });
-*
-* // Compare ignoring metadata timestamps
-* voEqualsExcept(address1, address2, {
-*   ignoreKeys: ["updatedAt"],
-*   ignoreKeyPredicate: (key, path) => path.includes("metadata")
-* }); // true
-*
-* // Compare ignoring all metadata
-* voEqualsExcept(address1, address2, {
-*   ignoreKeyPredicate: (key, path) => path.includes("metadata")
-* }); // true
-* ```
-*/
-function voEqualsExcept(a, b, options) {
-	return deepEqualExcept(a, b, keepValueObjectClass(options));
-}
-function keepValueObjectClass(options) {
-	const { ignoreKeys, ignoreKeyPredicate } = options;
-	return {
-		...options,
-		ignoreKeys: ignoreKeys?.filter((key) => key !== VALUE_OBJECT_CLASS),
-		ignoreKeyPredicate: ignoreKeyPredicate && ((key, path) => key !== VALUE_OBJECT_CLASS && ignoreKeyPredicate(key, path))
-	};
-}
-/**
-* Creates a value object with optional validation.
-* Returns a Result type instead of throwing an error.
-*
-* Note: the Result covers VALIDATION failures only. Non-data values and
-* built-ins without immutable value semantics still throw a
-* `TypeError` from `vo()`; they cannot occur in parsed JSON and signal
-* a programming error, not a validation failure.
-*
-* @param t - The data to convert into a value object
-* @param validate - Validation function that returns true if valid
-* @param errorMessage - Optional custom error message if validation fails
-* @returns Result containing the value object if valid, or an error message if validation fails
-*
-* @example
-* ```typescript
-* const result = voWithValidation(
-*   { amount: 100, currency: "USD" },
-*   (m) => m.amount >= 0 && m.currency.length === 3,
-*   "Invalid money: amount must be non-negative and currency must be 3 characters"
-* );
-*
-* if (result.ok) {
-*   console.log(result.value); // Use the value object
-* } else {
-*   console.error(result.error); // Handle validation error
-* }
-* ```
-*/
-function voWithValidation(t, validate, errorMessage) {
-	if (!validate(t)) return err(errorMessage ?? `Validation failed for value object: ${describeValue(t)}`);
-	return ok(vo(t));
-}
-/**
-* Best-effort rendering of a value for the default validation-failure
-* message. `JSON.stringify` throws for cyclic and BigInt-bearing values, and
-* the error path of a Result-returning function must never throw itself.
-*/
-function describeValue(value) {
-	try {
-		const json = JSON.stringify(value);
-		if (json !== void 0) return json;
-	} catch {}
-	return String(value);
-}
-/**
-* Abstract base class for creating Value Objects.
-* Value Objects are immutable and defined by their properties. A value
-* object can hold other value objects in its props. Every instance
-* records its class under an own symbol key, so `equals` compares a
-* nested value object by class and props and does not call its `equals`
-* method.
-*
-* @template T - The shape of the value object's properties
-*/
-var ValueObject = class {
-	props;
-	/**
-	* Creates a new ValueObject.
-	* The plain-data properties are deep-cloned and then deeply
-	* frozen, so the caller's own object graph is never frozen or mutated,
-	* and later mutation of the input does not bleed into the value object.
-	*
-	* @param props - The properties of the value object
-	* @example
-	* ```ts
-	* class Money extends ValueObject<{ amount: number; currency: string }> {
-	*   constructor(props: { amount: number; currency: string }) {
-	*     super(props);
-	*   }
-	*
-	*   protected validate(props: { amount: number; currency: string }): void {
-	*     if (props.amount < 0) throw new Error("Amount cannot be negative");
-	*   }
-	* }
-	* ```
-	*/
-	constructor(props) {
-		rejectValueObjectAsInput(props, "new ValueObject()");
-		this.validate(props);
-		this.props = deepFreeze(cloneForVo(props, /* @__PURE__ */ new WeakMap()));
-		recordValueObjectClass(this, this.constructor);
-	}
-	/**
-	* Optional validation hook that can be overridden by subclasses.
-	* Should throw an error if validation fails.
-	*
-	* @param props - The properties to validate
-	* @throws Error if validation fails
-	*/
-	validate(props) {}
-	/**
-	* Checks if this value object is equal to another.
-	* Uses deep equality comparison on the properties and checks for constructor equality.
-	*
-	* @param other - The other value object to compare
-	* @returns true if the properties are deeply equal and constructors match
-	*/
-	equals(other) {
-		if (other === null || other === void 0) return false;
-		if (this.constructor !== other.constructor) return false;
-		return deepEqual(this.props, other.props);
-	}
-	/**
-	* Creates a clone of the value object with optional property overrides.
-	*
-	* @param props - Optional properties to override
-	* @returns A new instance of the value object
-	*/
-	clone(props) {
-		const Constructor = this.constructor;
-		const merged = {
-			...this.props,
-			...props || {}
-		};
-		for (const key of Reflect.ownKeys(this.props)) {
-			const descriptor = Object.getOwnPropertyDescriptor(this.props, key);
-			if (descriptor === void 0 || descriptor.enumerable) continue;
-			if (props && Object.hasOwn(props, key)) continue;
-			Object.defineProperty(merged, key, {
-				value: this.props[key],
-				writable: true,
-				enumerable: false,
-				configurable: true
-			});
-		}
-		return new Constructor(merged);
-	}
-	/**
-	* Serializes the value object to its raw properties for JSON operations.
-	*
-	* @returns The raw properties object
-	*/
-	toJSON() {
-		return this.props;
-	}
-};
-
-//#endregion
-//#region src/internal/cooperative-brand.ts
-/**
-* A cooperative brand marks an object that a kit constructor produced, so
-* a second loaded copy of the kit (duplicate npm dependency, dual CJS/ESM
-* load, plugin bundle) recognizes it. A module-private WeakSet cannot do
-* that: it is bound to one loaded copy. The brand is a `Symbol.for` key
-* with the value `true`. The property is non-enumerable, so it never
-* leaks into spreads, JSON, or equality, and non-writable and
-* non-configurable, so nothing edits it after the stamp.
-*
-* The probe reads the brand as an OWN property with exactly these
-* attributes and requires the carrier to be frozen. An object that
-* inherits a branded object through its prototype can carry mutable own
-* overrides; a branded object that is still open can change after the
-* stamp. Neither is what the constructor produced. Every stamp site
-* therefore freezes the carrier right after {@link stampCooperativeBrand}.
-*
-* The brand is forgeable BY DESIGN. It catches accidental hand-rolled
-* literals; it is not a security boundary against code in the same
-* process that fakes it on purpose.
-*
-* Internal utility (not exported from the package barrels).
-*/
-function stampCooperativeBrand(target, brand) {
-	Object.defineProperty(target, brand, {
-		value: true,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-}
-/**
-* Whether `value` carries `brand` as an own, non-enumerable, non-writable,
-* non-configurable `true` and is frozen. A Proxy trap that throws reads
-* as unbranded.
-*/
-function hasCooperativeBrand(value, brand) {
-	if (value === null || typeof value !== "object" && typeof value !== "function") return false;
-	try {
-		const marker = Reflect.getOwnPropertyDescriptor(value, brand);
-		return marker?.value === true && marker.enumerable === false && marker.writable === false && marker.configurable === false && Object.isFrozen(value);
-	} catch {
-		return false;
-	}
-}
-
-//#endregion
-//#region src/internal/structural/detach-state.ts
+//#region src/internal/structural/copy-plain-state.ts
 /**
 * Returns a copy of `state` that shares no object with the original.
 * Throws a `TypeError` that names the path when the graph carries a value
@@ -1257,9 +10,11 @@ function hasCooperativeBrand(value, brand) {
 * symbol-keyed, non-enumerable, or accessor property and an expando on a
 * built-in are dropped. A function or a symbol value throws a raw
 * `DataCloneError`. An Error, a Promise, a WeakMap, or a WeakSet cannot be
-* detached at all. A SharedArrayBuffer and a view over one keep sharing
+* copied at all. A SharedArrayBuffer and a view over one keep sharing
 * their memory. A Proxy fails in the walk or in the clone; a failure in
-* the clone is rethrown as a `TypeError` with the cause.
+* the clone is rethrown as a `TypeError` with the cause. An error that a
+* Proxy trap throws in the walk passes unchanged, so a coded error of the
+* caller keeps its code.
 *
 * The walk reads the graph through property descriptors and walks a Map
 * or a Set with the built-in iteration, so no accessor and no own iterator
@@ -1267,70 +22,52 @@ function hasCooperativeBrand(value, brand) {
 * change the graph, and an accessor that a trap adds runs during the
 * clone. A second walk checks the clone, so a value that a trap swapped in
 * and the content of a built-in whose prototype was replaced are rejected
-* too. The walks also count the data properties of records and arrays. A
-* copy with another count throws, because a built-in whose prototype was
-* replaced loses its own properties in the copy. `subject` names the state
-* in the messages.
+* too. A trap that changes the graph after the first walk can still hide a
+* value that the copy drops: the walks catch accidents, not a hostile
+* Proxy. The second walk also follows the steps of the first walk: the kind
+* of each object and the key of each data property, in walk order. A copy
+* that differs throws, because a built-in whose prototype was replaced is
+* a built-in again in the copy and loses its own properties. `subject`
+* names the state in the messages.
 *
 * Plain objects (from any realm), arrays, Dates, Maps, Sets, bigints, and
 * typed arrays pass. A RegExp passes: pattern and flags survive the clone,
 * and `lastIndex` restores as 0. The scan state of a global or sticky
-* pattern is not domain data. A non-enumerable property on a built-in
-* passes: it is the built-in's own machinery (`lastIndex`), not data. A
-* non-enumerable symbol key passes anywhere: it is metadata by convention.
+* pattern is not domain data. On a built-in, the mutator shadows of a deep
+* freeze, the `lastIndex` of a RegExp, and the `length` of a boxed String
+* pass: they are machinery, not data. Every other non-enumerable property
+* throws. A non-enumerable symbol key passes anywhere: it is metadata by
+* convention.
 *
-* The concrete entity uses it for a detached read DTO of a plain-data
+* The concrete entity uses it for the plain state of a plain-data
 * state. The snapshot model uses it for the captured DTO and the restored
 * state. A state that carries a class-based child is mapped to plain data
 * first, in the entity or in the model.
 */
-function detachState(state, subject = "detachState: state") {
-	return detach(state, subject, "clone");
+function copyPlainState(state, subject = "copyPlainState: state") {
+	return copyState(state, subject, "clone");
 }
 /**
-* {@link detachState} that also rejects what `deepFreeze` cannot make
+* {@link copyPlainState} that also rejects what `deepFreeze` cannot make
 * immutable: binary data (a typed array, a DataView, an ArrayBuffer, or a
 * SharedArrayBuffer) and a RegExp. The walk rejects such a value at its
 * tag, before it reads the indices of a typed array. Kit modules only.
 */
-function detachFreezableState(state, subject) {
-	return detach(state, subject, "freeze");
+function copyFreezableState(state, subject) {
+	return copyState(state, subject, "freeze");
 }
-/**
-* Throws the `TypeError` of {@link detachFreezableState} and copies
-* nothing. A caller that has a clone already checks it with this, so the
-* rule is the same. Kit modules only.
-*/
-function assertFreezableState(state, subject) {
-	assertDetachable(state, "", {
-		seen: /* @__PURE__ */ new WeakSet(),
-		subject,
-		rule: "freeze",
-		dataProperties: 0
-	});
-}
-function detach(state, subject, rule) {
-	const original = {
-		seen: /* @__PURE__ */ new WeakSet(),
-		subject,
-		rule,
-		dataProperties: 0
-	};
-	assertDetachable(state, "", original);
+function copyState(state, subject, rule) {
+	const recording = new StepRecording();
+	assertCopyable(state, "", newWalk(subject, rule, recording));
 	let copy;
 	try {
 		copy = structuredClone(state);
 	} catch (cause) {
-		throw new TypeError(`${subject} holds a Proxy or a host object that cannot be cloned; map it to plain data`, { cause });
+		throw new TypeError(`${subject} holds a Proxy or a host object that cannot be cloned, or a view over a detached or shrunk buffer; the cause names the value; map it to plain data`, { cause });
 	}
-	const copied = {
-		seen: /* @__PURE__ */ new WeakSet(),
-		subject,
-		rule,
-		dataProperties: 0
-	};
-	assertDetachable(copy, "", copied);
-	if (copied.dataProperties !== original.dataProperties) throw new TypeError(`${subject} changed in the copy: the state has ${original.dataProperties} data properties and the copy has ${copied.dataProperties}; a built-in whose prototype was replaced loses its own properties in the copy, and a Proxy trap can change the graph; map it to plain data`);
+	const comparison = new StepComparison(recording, subject);
+	assertCopyable(copy, "", newWalk(subject, rule, comparison));
+	comparison.assertComplete();
 	return copy;
 }
 const INDEX_KEY = /^(0|[1-9]\d*)$/;
@@ -1341,9 +78,77 @@ const BINARY_DATA_TAGS = /* @__PURE__ */ new Set([
 	"[object SharedArrayBuffer]"
 ]);
 const REGEXP_TAG = "[object RegExp]";
+const STRING_TAG = "[object String]";
 const mapEntries = Map.prototype.entries;
 const setValues = Set.prototype.values;
-function assertDetachable(value, path, walk) {
+const RECORD_STEP = Symbol("record");
+const ARRAY_STEP = Symbol("array");
+const builtInSteps = /* @__PURE__ */ new Map();
+function builtInStep(tag) {
+	let kind = builtInSteps.get(tag);
+	if (kind === void 0) {
+		kind = Symbol(tag);
+		builtInSteps.set(tag, kind);
+	}
+	return kind;
+}
+/**
+* The steps of the walk over the original, in walk order.
+*/
+var StepRecording = class {
+	steps = [];
+	take(next) {
+		this.steps.push(next);
+	}
+};
+/**
+* The walk over the copy compares each of its steps with the step of the
+* walk over the original at the same position. Structured clone keeps the
+* order of the keys, of Map entries, and of Set members, and it keeps
+* shared references, so the walk over an unchanged copy takes the same
+* steps. A step that differs, or a step that is missing, means that the
+* copy changed.
+*/
+var StepComparison = class {
+	recording;
+	subject;
+	#position = 0;
+	constructor(recording, subject) {
+		this.recording = recording;
+		this.subject = subject;
+	}
+	take(next, path) {
+		const expected = this.recording.steps[this.#position];
+		if (expected !== next) throwChangedInCopy(this.subject, path, expected, next);
+		this.#position += 1;
+	}
+	assertComplete() {
+		if (this.#position < this.recording.steps.length) throwChangedInCopy(this.subject, "", this.recording.steps[this.#position], void 0);
+	}
+};
+function newWalk(subject, rule, trace) {
+	return {
+		seen: /* @__PURE__ */ new WeakSet(),
+		subject,
+		rule,
+		trace
+	};
+}
+function step(walk, next, path) {
+	walk.trace.take(next, path);
+}
+function throwChangedInCopy(subject, path, expected, found) {
+	throw new TypeError(`${subject}${path} changed in the copy: the state has ${describeStep(expected)} there, and the copy has ${describeStep(found)}; a built-in whose prototype was replaced is a built-in again in the copy and loses its own properties, and a Proxy trap can change the graph; map it to plain data`);
+}
+function describeStep(step) {
+	if (step === void 0) return "nothing";
+	if (typeof step === "string") return `the key "${step}"`;
+	if (step === RECORD_STEP) return "a record";
+	if (step === ARRAY_STEP) return "an array";
+	const name = builtInTypeName(step.description);
+	return /^[AEIOU]/.test(name) ? `an ${name}` : `a ${name}`;
+}
+function assertCopyable(value, path, walk) {
 	if (typeof value === "function") throw new TypeError(`${walk.subject}${path} is a function; map it to plain data`);
 	if (typeof value === "symbol") throw new TypeError(`${walk.subject}${path} is a symbol; map it to plain data`);
 	if (value === null || typeof value !== "object") return;
@@ -1352,45 +157,52 @@ function assertDetachable(value, path, walk) {
 	walk.seen.add(object);
 	if (Array.isArray(object)) {
 		if (!hasIntrinsicPrototypeChain(object, "Array")) throwClassInstance(object, path, walk.subject);
-		assertOwnPropertiesDetachable(object, path, walk, "array");
+		step(walk, ARRAY_STEP, path);
+		assertOwnPropertiesCopyable(object, path, walk, "array");
 		return;
 	}
 	const tag = builtInTagWithoutInvokingAccessors(object);
 	if (tag !== void 0) {
 		if (walk.rule === "freeze") assertFreezable(tag, path, walk.subject);
 		if (!hasIntrinsicPrototypeChain(object)) throwClassInstance(object, path, walk.subject);
+		step(walk, builtInStep(tag), path);
 		if (tag === "[object Map]") {
 			let index = 0;
 			for (const [key, entry] of mapEntries.call(object)) {
-				assertDetachable(key, `${path}<map key #${index}>`, walk);
-				assertDetachable(entry, `${path}<map value #${index}>`, walk);
+				assertCopyable(key, `${path}<map key #${index}>`, walk);
+				assertCopyable(entry, `${path}<map value #${index}>`, walk);
 				index++;
 			}
 		} else if (tag === "[object Set]") {
 			let index = 0;
 			for (const member of setValues.call(object)) {
-				assertDetachable(member, `${path}<set member #${index}>`, walk);
+				assertCopyable(member, `${path}<set member #${index}>`, walk);
 				index++;
 			}
-		} else if (tag === "[object Promise]" || tag === "[object WeakMap]" || tag === "[object WeakSet]") throw new TypeError(`${walk.subject}${path} is a ${tag.slice(8, -1)} and cannot be detached`);
+		} else if (tag === "[object Promise]" || tag === "[object WeakMap]" || tag === "[object WeakSet]") throw new TypeError(`${walk.subject}${path} is a ${builtInTypeName(tag)} and cannot be copied`);
 		else if (tag === "[object Error]") throw new TypeError(`${walk.subject}${path} is an Error; map it to plain data`);
 		else if (sharesMemory(object, tag)) throw new TypeError(`${walk.subject}${path} is backed by a SharedArrayBuffer and the copy would share its memory; map it to plain data`);
-		assertOwnPropertiesDetachable(object, path, walk, "built-in");
+		assertOwnPropertiesCopyable(object, path, walk, tag);
 		return;
 	}
 	const prototype = Object.getPrototypeOf(object);
 	if (!(prototype === null || isIntrinsicConstructorPrototype(prototype, "Object") && Object.getPrototypeOf(prototype) === null)) throwClassInstance(object, path, walk.subject);
-	assertOwnPropertiesDetachable(object, path, walk, "record");
+	step(walk, RECORD_STEP, path);
+	assertOwnPropertiesCopyable(object, path, walk, "record");
 }
 /**
 * Audits the own properties the clone would copy or drop. The clone keeps
 * the enumerable own keys of a record and of an array, expandos included,
-* and drops every own key of another built-in. `length` on an array and
-* the non-enumerable keys of a built-in (`lastIndex`) are its own
-* machinery, not data. Index keys of a typed array or a boxed String are
-* its content and pass as such.
+* and drops every own key of another built-in. `length` on an array is
+* its own machinery, not data, and so are the keys that
+* {@link isBuiltInMachinery} names. The index keys of a built-in below its
+* content length are its content and pass as such. Another index key of a
+* built-in is an expando. `owner` is the kind of `object`: an array, a
+* record, or the tag of a built-in.
 */
-function assertOwnPropertiesDetachable(object, path, walk, kind) {
+function assertOwnPropertiesCopyable(object, path, walk, owner) {
+	const tag = owner === "array" || owner === "record" ? void 0 : owner;
+	const contentLength = tag === void 0 ? 0 : contentLengthOf(object, tag);
 	for (const key of Reflect.ownKeys(object)) {
 		const descriptor = Object.getOwnPropertyDescriptor(object, key);
 		if (descriptor === void 0) continue;
@@ -1398,20 +210,41 @@ function assertOwnPropertiesDetachable(object, path, walk, kind) {
 			if (!descriptor.enumerable) continue;
 			throw new TypeError(`${walk.subject}${path} has a symbol-keyed property; map it to plain data`);
 		}
-		if (kind === "array" && key === "length") continue;
+		if (owner === "array" && key === "length") continue;
 		const isIndex = INDEX_KEY.test(key);
+		const memberPath = isIndex ? `${path}[${key}]` : `${path}.${key}`;
 		if (!descriptor.enumerable) {
-			if (kind === "built-in") continue;
-			throw new TypeError(`${walk.subject}${path}.${key} is not enumerable and the clone would drop it; map it to plain data`);
+			if (tag !== void 0 && isBuiltInMachinery(tag, key, descriptor)) continue;
+			throw new TypeError(`${walk.subject}${memberPath} is not enumerable and the clone would drop it; map it to plain data`);
 		}
-		if (kind === "built-in" && isIndex) continue;
-		const memberPath = isIndex ? `${path}[${key}]` : `${path}.${key}`;
+		if (tag !== void 0 && isIndex && Number(key) < contentLength) continue;
 		if (!("value" in descriptor)) throw new TypeError(`${walk.subject}${memberPath} is an accessor property; map it to plain data`);
-		if (kind === "built-in") throw new TypeError(`${walk.subject}${memberPath} is an expando on a ${constructorName(Object.getPrototypeOf(object)) ?? "built-in"} and the clone would drop it; map it to plain data`);
-		walk.dataProperties += 1;
-		assertDetachable(descriptor.value, memberPath, walk);
+		if (tag !== void 0) throw new TypeError(`${walk.subject}${memberPath} is an expando on a ${constructorName(Object.getPrototypeOf(object)) ?? "built-in"} and the clone would drop it; map it to plain data`);
+		step(walk, key, memberPath);
+		assertCopyable(descriptor.value, memberPath, walk);
 	}
 }
+/**
+* Whether an own non-enumerable property of a built-in is machinery, not
+* data: a function that shadows a mutator of a frozen Date, Map, or Set,
+* the scan position of a RegExp, or the length of a boxed String. The
+* clone drops the shadow and rebuilds the other two from the internal
+* slots.
+*/
+function isBuiltInMachinery(tag, key, descriptor) {
+	return isMutatorShadow(tag, key, descriptor) || tag === REGEXP_TAG && key === "lastIndex" || tag === STRING_TAG && key === "length";
+}
+/**
+* The number of index keys that hold the content of a built-in: the
+* elements of a typed array and the characters of a boxed String.
+*/
+function contentLengthOf(object, tag) {
+	if (tag === "[object TypedArray]") return typedArrayLength.call(object);
+	if (tag === STRING_TAG) return stringValueOf.call(object).length;
+	return 0;
+}
+const typedArrayLength = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), "length")?.get;
+const stringValueOf = String.prototype.valueOf;
 const typedArrayBuffer = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), "buffer")?.get;
 const dataViewBuffer = Object.getOwnPropertyDescriptor(DataView.prototype, "buffer")?.get;
 function sharesMemory(object, tag) {
@@ -1506,7 +339,7 @@ const defaultEventIdFactory = () => crypto.randomUUID();
 *   clock: () => new Date(),
 * });
 * order.confirm();
-* recordPendingEvents(order, domainEvents);
+* stampPendingEvents(order, domainEvents);
 * ```
 */
 function createDomainEventFactory(options = {}) {
@@ -1517,7 +350,7 @@ function buildDomainEventFactory(options, createOperation) {
 	const eventIdFactory = options.eventIdFactory ?? defaultEventIdFactory;
 	const clock = options.clock ?? defaultClockFactory;
 	const { source } = options;
-	const create = ((type, payload, createOptions) => mintDomainEvent(type, payload, createOptions, eventIdFactory, clock, createOperation, source));
+	const create = ((type, payload, createOptions) => buildDomainEvent(type, payload, createOptions, eventIdFactory, clock, createOperation, source));
 	const createStamp = (stampOptions = {}) => {
 		const explicitOccurredAt = stampOptions.occurredAt === void 0 ? void 0 : copyValidEventDate(stampOptions.occurredAt);
 		if (stampOptions.eventId !== void 0) assertNonBlankEventField(stampOptions.eventId, "eventId", "EVENT_ID_INVALID");
@@ -1544,91 +377,46 @@ function buildDomainEventFactory(options, createOperation) {
 * with {@link createDomainEventFactory} for custom policy.
 */
 const defaultDomainEventFactory = buildDomainEventFactory({}, "createDomainEvent");
-/**
-* Creates a domain event with default values.
-* Sets occurredAt to current date and schemaVersion to 1 if not provided.
-*
-* **Input ownership.** The event is deeply frozen, and `payload` and
-* `metadata` are deep-cloned first, so the caller's own objects are never
-* frozen in place and later mutation of them does not bleed into the
-* event (same contract as `vo()`). The clone follows the plain-data event
-* contract via `structuredClone`: functions, Promise, and WeakMap/WeakSet
-* values throw a `TypeError`; symbol-keyed properties are not carried
-* over. The clone is then checked with the rule of the in-memory event
-* store: an `Error`, a host object such as a `File`, a binary buffer, and
-* shared memory throw a `TypeError`. A class instance or an accessor becomes
-* plain data in the clone.
-*
-* **For aggregate-internal events, prefer `this.createEvent(...)` on
-* `StateStoredAggregate` / `EventSourcedAggregate`.** That helper auto-injects
-* `aggregateId` (from `this.id`) and `aggregateType` (from the
-* aggregate's declared `aggregateType` property), which downstream
-* consumers (outbox dispatchers, projection handlers, audit logs)
-* route by. The commit boundary validates that both fields are present
-* and throws if they are missing, so a direct `createDomainEvent(...)`
-* call inside an aggregate that forgets the options is caught at
-* runtime. Record pending decisions in the application
-* shell before repository persistence or outbox harvest.
-*
-* Use `createDomainEvent(...)` directly for events that don't belong to
-* an aggregate: system events, integration events, configuration events,
-* test fixtures. For those, set `aggregateId` / `aggregateType` in
-* `options` if downstream consumers expect routing metadata.
-*
-* @param type - The event type
-* @param payload - The event payload
-* @param options - Optional event configuration (including `aggregateId`
-*   and `aggregateType` for routing)
-* @returns A domain event
-*
-* @example
-* ```typescript
-* const event = createDomainEvent("OrderCreated", { orderId: "123" });
-* ```
-*/
-const RECORDED_EVENTS = /* @__PURE__ */ new WeakSet();
-const UNCOMMITTED_EVENTS = /* @__PURE__ */ new WeakSet();
+const STAMPED_EVENTS = /* @__PURE__ */ new WeakSet();
+const UNSTAMPED_EVENTS = /* @__PURE__ */ new WeakSet();
 const FACTORY_OWNED_EVENT_STAMPS = /* @__PURE__ */ new WeakSet();
-const RECORDED_BRAND = Symbol.for("@shirudo/ddd-kit.mintedEvent");
-const UNCOMMITTED_BRAND = Symbol.for("@shirudo/ddd-kit.uncommittedEvent");
-function stampRecordedBrand(event) {
-	stampCooperativeBrand(event, RECORDED_BRAND);
+const STAMPED_BRAND = Symbol.for("@shirudo/ddd-kit.mintedEvent");
+const UNSTAMPED_BRAND = Symbol.for("@shirudo/ddd-kit.uncommittedEvent");
+function brandStampedEvent(event) {
+	applyCooperativeBrand(event, STAMPED_BRAND);
 }
-function stampUncommittedBrand(event) {
-	stampCooperativeBrand(event, UNCOMMITTED_BRAND);
+function brandUnstampedEvent(event) {
+	applyCooperativeBrand(event, UNSTAMPED_BRAND);
 }
 function isFactoryOwnedDomainEventStamp(stamp) {
 	return FACTORY_OWNED_EVENT_STAMPS.has(stamp);
 }
 /**
-* Whether `event` is a recorded domain event: it came out of
-* {@link createDomainEvent}, {@link createDomainEventFromFacts}, or
-* {@link recordDomainEvent}, so it is deeply frozen with defensively copied
-* payload and metadata. An uncommitted decision carries the other brand; see
-* {@link isUncommittedDomainEvent}. Two tiers: events of THIS
+* Whether `event` is a stamped domain event: it came out of
+* {@link createDomainEvent}, {@link createStampedDomainEvent}, or
+* {@link stampDomainEvent}, so it is deeply frozen with defensively copied
+* payload and metadata. An unstamped decision carries the other brand; see
+* {@link isUnstampedDomainEvent}. Two tiers: events of THIS
 * loaded copy of the kit are verified through the module-private
-* WeakSet; events minted by ANOTHER copy (duplicate dependency, dual
+* WeakSet; events built by ANOTHER copy (duplicate dependency, dual
 * CJS/ESM load) are recognized through a cooperative `Symbol.for`
 * brand that code in the same process can fake. The gate catches
 * accidents, not adversaries. Module-internal export for the aggregate
 * recording paths; not part of the package entries.
 */
-function isRecordedDomainEvent(event) {
-	return RECORDED_EVENTS.has(event) || hasCooperativeBrand(event, RECORDED_BRAND);
-}
-/** Whether a value was created by {@link createUncommittedDomainEvent}. */
-function isUncommittedDomainEvent(event) {
-	return UNCOMMITTED_EVENTS.has(event) || hasCooperativeBrand(event, UNCOMMITTED_BRAND);
+function isStampedDomainEvent(event) {
+	return STAMPED_EVENTS.has(event) || hasCooperativeBrand(event, STAMPED_BRAND);
 }
-function createUncommittedDomainEvent(type, payload, options) {
-	return mintUncommittedDomainEvent(type, payload, options, "createUncommittedDomainEvent");
+/** Whether a value is a kit-built unstamped event. */
+function isUnstampedDomainEvent(event) {
+	return UNSTAMPED_EVENTS.has(event) || hasCooperativeBrand(event, UNSTAMPED_BRAND);
 }
 /**
-* {@link createUncommittedDomainEvent} whose errors name `operation`, the
+* {@link createUnstampedDomainEvent} whose errors name `operation`, the
 * function that the caller called. Module-internal export; not part of the
 * package entries.
 */
-function mintUncommittedDomainEvent(type, payload, options, operation) {
+function buildUnstampedDomainEvent(type, payload, options, operation) {
 	assertProducerOwnedEventFields(type, options);
 	const event = {
 		type,
@@ -1637,41 +425,41 @@ function mintUncommittedDomainEvent(type, payload, options, operation) {
 		payload: cloneOwnedEventData(payload, "payload", operation),
 		schemaVersion: options?.schemaVersion ?? 1
 	};
-	stampUncommittedBrand(event);
-	const uncommitted = deepFreeze(event);
-	UNCOMMITTED_EVENTS.add(uncommitted);
-	return uncommitted;
-}
-/** Brands and freezes a kit-derived copy of an uncommitted event. */
-function adoptUncommittedDomainEvent(copy) {
-	stampUncommittedBrand(copy);
+	brandUnstampedEvent(event);
+	const unstamped = deepFreeze(event);
+	UNSTAMPED_EVENTS.add(unstamped);
+	return unstamped;
+}
+/** Brands and freezes a kit-derived copy of an unstamped event. */
+function adoptUnstampedDomainEvent(copy) {
+	brandUnstampedEvent(copy);
 	Object.freeze(copy);
-	UNCOMMITTED_EVENTS.add(copy);
+	UNSTAMPED_EVENTS.add(copy);
 	return copy;
 }
 /**
-* Attaches shell-owned recording data to an accepted aggregate decision.
+* Attaches shell-owned stamp data to an accepted aggregate decision.
 *
 * The decision supplies the domain type, payload, source aggregate
 * identity, and payload schema version. The stamp supplies only event
-* identity, recording time, and trace metadata.
+* identity, stamp time, and trace metadata.
 */
-function recordDomainEvent(event, stamp) {
-	if (!isUncommittedDomainEvent(event)) throw new TypeError("recordDomainEvent requires an event created by createUncommittedDomainEvent");
-	if (isFactoryOwnedDomainEventStamp(stamp)) return mintRecordedEvent(event, stamp.eventId, stamp.occurredAt, stamp.metadata);
+function stampDomainEvent(event, stamp) {
+	if (!isUnstampedDomainEvent(event)) throw new TypeError("stampDomainEvent requires an unstamped event from an aggregate's createEvent");
+	if (isFactoryOwnedDomainEventStamp(stamp)) return buildStampedEvent(event, stamp.eventId, stamp.occurredAt, stamp.metadata);
 	assertNonBlankEventField(stamp.eventId, "eventId", "EVENT_ID_INVALID");
 	const occurredAt = deepFreeze(copyValidEventDate(stamp.occurredAt));
-	const metadata = ownedEventMetadata(stamp.metadata, "recordDomainEvent");
-	return mintRecordedEvent(event, stamp.eventId, occurredAt, metadata === void 0 ? void 0 : deepFreeze(metadata));
+	const metadata = ownedEventMetadata(stamp.metadata, "stampDomainEvent");
+	return buildStampedEvent(event, stamp.eventId, occurredAt, metadata === void 0 ? void 0 : deepFreeze(metadata));
 }
 /**
-* Single mint tail for both stamp provenances. The stamp fields arrive
+* Single build tail for both stamp provenances. The stamp fields arrive
 * pre-validated, copied, and frozen (by `createStamp` for factory-owned
-* stamps, by `recordDomainEvent` for caller-built stamps); the uncommitted
+* stamps, by `stampDomainEvent` for caller-built stamps); the unstamped
 * event's payload is already defensively cloned and deeply frozen by its
 * constructor and is shared instead of paying a second deep copy per event.
 */
-function mintRecordedEvent(event, eventId, occurredAt, metadata) {
+function buildStampedEvent(event, eventId, occurredAt, metadata) {
 	assertProducerOwnedEventFields(event.type, event);
 	const recorded = {
 		eventId,
@@ -1683,42 +471,42 @@ function mintRecordedEvent(event, eventId, occurredAt, metadata) {
 		schemaVersion: event.schemaVersion,
 		metadata
 	};
-	stampRecordedBrand(recorded);
+	brandStampedEvent(recorded);
 	Object.freeze(recorded);
-	RECORDED_EVENTS.add(recorded);
+	STAMPED_EVENTS.add(recorded);
 	return recorded;
 }
 /**
-* Brands, freezes, and registers a kit-derived copy of a recorded event
+* Brands, freezes, and registers a kit-derived copy of a stamped event
 * (e.g. the copy `apply()` stamps with the aggregate identity) as recorded
 * itself.
 * The copy shares the already-frozen payload/metadata of its source,
-* so the mint guarantee carries over. Stamping the cooperative brand
+* so the kit-built guarantee carries over. Applying the cooperative brand
 * before freezing keeps the copy recognizable by another loaded kit
 * instance as well as by this instance's WeakSet. Module-internal
 * export; not part of the package entries.
 */
-function adoptRecordedDomainEvent(copy) {
-	stampRecordedBrand(copy);
+function adoptStampedDomainEvent(copy) {
+	brandStampedEvent(copy);
 	Object.freeze(copy);
-	RECORDED_EVENTS.add(copy);
+	STAMPED_EVENTS.add(copy);
 	return copy;
 }
 function createDomainEvent(type, payload, options) {
 	return defaultDomainEventFactory.create(type, payload, options);
 }
-function createDomainEventFromFacts(type, payload, options) {
+function createStampedDomainEvent(type, payload, options) {
 	if (options?.eventId === void 0) missingExplicitEventId();
 	if (options.occurredAt === void 0) missingExplicitOccurredAt();
-	return mintDomainEvent(type, payload, options, missingExplicitEventId, missingExplicitOccurredAt, "createDomainEventFromFacts");
+	return buildDomainEvent(type, payload, options, missingExplicitEventId, missingExplicitOccurredAt, "createStampedDomainEvent");
 }
 function missingExplicitEventId() {
-	throw new DomainEventValidationError("EVENT_ID_REQUIRED", "eventId", "createDomainEventFromFacts requires an explicit eventId");
+	throw new DomainEventValidationError("EVENT_ID_REQUIRED", "eventId", "createStampedDomainEvent requires an explicit eventId");
 }
 function missingExplicitOccurredAt() {
-	throw new DomainEventValidationError("EVENT_OCCURRED_AT_REQUIRED", "occurredAt", "createDomainEventFromFacts requires an explicit occurredAt");
+	throw new DomainEventValidationError("EVENT_OCCURRED_AT_REQUIRED", "occurredAt", "createStampedDomainEvent requires an explicit occurredAt");
 }
-function mintDomainEvent(type, payload, options, eventIdFactory, clock, operation, factorySource) {
+function buildDomainEvent(type, payload, options, eventIdFactory, clock, operation, factorySource) {
 	assertProducerOwnedEventFields(type, options);
 	const eventId = options?.eventId ?? eventIdFactory();
 	assertNonBlankEventField(eventId, "eventId", "EVENT_ID_INVALID");
@@ -1734,10 +522,10 @@ function mintDomainEvent(type, payload, options, eventIdFactory, clock, operatio
 		schemaVersion,
 		metadata: ownedEventMetadata(options?.metadata, operation, factorySource)
 	};
-	stampRecordedBrand(event);
-	const minted = deepFreeze(event);
-	RECORDED_EVENTS.add(minted);
-	return minted;
+	brandStampedEvent(event);
+	const built = deepFreeze(event);
+	STAMPED_EVENTS.add(built);
+	return built;
 }
 function assertProducerOwnedEventFields(type, options) {
 	assertNonBlankEventField(type, "type", "EVENT_TYPE_INVALID");
@@ -1758,11 +546,11 @@ function readEventClock(clock) {
 }
 /**
 * Copies the caller's metadata and checks the copy. Metadata is a plain
-* record or absent; a null from a JSON envelope would mint and then fail
+* record or absent; a null from a JSON envelope would build and then fail
 * every metadata read far from the producer. A factory origin fills
 * `source` only after the check, and a call site that names its own source
 * keeps it: an explicit fact about one event outranks the default of the
-* factory that mints it.
+* factory that builds it.
 */
 function ownedEventMetadata(metadata, operation, factorySource) {
 	if (metadata === void 0) return factorySource === void 0 ? void 0 : { source: factorySource };
@@ -1792,25 +580,12 @@ function isPlainRecordCopy(copy) {
 /**
 * Deep-clones caller-supplied event data (payload, metadata) before the
 * event is frozen, so a constructor never freezes or aliases the caller's
-* own object graph, and checks the clone with {@link assertFreezableState}.
-* A primitive needs no copy, but the check rejects a symbol. A class
-* instance or an accessor becomes plain data in the clone.
+* own object graph. {@link copyFreezableState} checks the data and the
+* clone; its JSDoc states the rule and its limits.
 */
 function cloneOwnedEventData(value, field, operation) {
-	if (typeof value === "function") throw new TypeError(`${operation}: ${field} must not be a function: domain events are plain data`);
-	if (value === null || typeof value !== "object") {
-		assertFreezableState(value, `${operation}: ${field}`);
-		return value;
-	}
-	let clone;
-	try {
-		clone = structuredClone(value);
-	} catch (cause) {
-		throw new TypeError(`${operation}: ${field} cannot be copied, because structuredClone failed (the cause names the value); domain events are plain data`, { cause });
-	}
-	assertNoHostileOwnProtoKey(clone, `Event ${field} of ${operation}`);
-	assertFreezableState(clone, `${operation}: ${field}`);
-	return clone;
+	if (value !== null && typeof value === "object") assertNoOwnProtoKey(value, `Event ${field} of ${operation}`);
+	return copyFreezableState(value, `${operation}: ${field}`);
 }
 /**
 * Copies metadata from a source event to a new event.
@@ -1826,8 +601,8 @@ function cloneOwnedEventData(value, field, operation) {
 * ```
 */
 function copyMetadata(sourceEvent, additionalMetadata) {
-	if (sourceEvent.metadata !== void 0) assertNoHostileOwnProtoKey(sourceEvent.metadata, "Event metadata");
-	if (additionalMetadata !== void 0) assertNoHostileOwnProtoKey(additionalMetadata, "Event metadata");
+	if (sourceEvent.metadata !== void 0) assertNoOwnProtoKey(sourceEvent.metadata, "Event metadata");
+	if (additionalMetadata !== void 0) assertNoOwnProtoKey(additionalMetadata, "Event metadata");
 	return {
 		...sourceEvent.metadata ?? {},
 		...additionalMetadata ?? {}
@@ -1850,7 +625,7 @@ function mergeMetadata(...metadataObjects) {
 	const merged = {};
 	for (const metadata of metadataObjects) {
 		if (!metadata) continue;
-		assertNoHostileOwnProtoKey(metadata, "Event metadata");
+		assertNoOwnProtoKey(metadata, "Event metadata");
 		for (const key of Reflect.ownKeys(metadata)) {
 			if (!Object.getOwnPropertyDescriptor(metadata, key)?.enumerable) continue;
 			Object.defineProperty(merged, key, {
@@ -1945,7 +720,7 @@ function assertNonNegativeSafeInteger(context, field, value) {
 /** Default bound for delivery and post-commit operations. */
 const DEFAULT_EXECUTION_TIMEOUT_MS = 3e4;
 /**
-* Owner signal of each child signal that {@link runBoundedExecution} minted.
+* Owner signal of each child signal that {@link runBoundedExecution} created.
 *
 * One bounded operation often wraps another, and every hop derives a fresh
 * signal. A consumer that follows a call chain by signal identity alone loses
@@ -2250,5 +1025,5 @@ function throwIfAborted(signal) {
 }
 
 //#endregion
-export { SnapshotTimeValidationError as A, voWithValidation as B, defaultDomainEventFactory as C, mintUncommittedDomainEvent as D, mergeMetadata as E, ValueObject as F, isBuiltInObject as G, deepOmit as H, deepFreeze as I, isIntrinsicConstructorPrototype as K, vo as L, detachState as M, hasCooperativeBrand as N, recordDomainEvent as O, stampCooperativeBrand as P, voEquals as R, createUncommittedDomainEvent as S, isUncommittedDomainEvent as T, deepEqual as U, deepEqualExcept as V, findPropertyDescriptor as W, adoptUncommittedDomainEvent as _, isDispatchTrackingOutbox as a, createDomainEventFactory as b, runBoundedExecution as c, assertPositiveInteger as d, assertPositiveSafeInteger as f, adoptRecordedDomainEvent as g, waitRejectingOnAbort as h, assertPageWithinWindow as i, detachFreezableState as j, DomainEventValidationError as k, MAX_TIMER_DELAY_MS as l, abortReason as m, readStreamPages as n, DEFAULT_EXECUTION_TIMEOUT_MS as o, assertTimerDelay as p, isWeakMap as q, assertPageNotEmpty as r, ownerSignalOf as s, pinTargetVersion as t, assertNonNegativeSafeInteger as u, copyMetadata as v, isRecordedDomainEvent as w, createDomainEventFromFacts as x, createDomainEvent as y, voEqualsExcept as z };
+export { copyFreezableState as A, defaultDomainEventFactory as C, stampDomainEvent as D, mergeMetadata as E, DomainEventValidationError as O, createStampedDomainEvent as S, isUnstampedDomainEvent as T, adoptUnstampedDomainEvent as _, isDispatchTrackingOutbox as a, createDomainEvent as b, runBoundedExecution as c, assertPositiveInteger as d, assertPositiveSafeInteger as f, adoptStampedDomainEvent as g, waitRejectingOnAbort as h, assertPageWithinWindow as i, copyPlainState as j, SnapshotTimeValidationError as k, MAX_TIMER_DELAY_MS as l, abortReason as m, readStreamPages as n, DEFAULT_EXECUTION_TIMEOUT_MS as o, assertTimerDelay as p, assertPageNotEmpty as r, ownerSignalOf as s, pinTargetVersion as t, assertNonNegativeSafeInteger as u, buildUnstampedDomainEvent as v, isStampedDomainEvent as w, createDomainEventFactory as x, copyMetadata as y };
 //# sourceMappingURL=read-stream-pages.js.map