@shirudo/ddd-kit 3.0.0-rc.12 → 3.0.0-rc.14

package/dist/chunks/read-stream-pages.js

@@ -1,1278 +1,7 @@
-import { C as InvalidEventStreamPageError, Y as assertNoHostileOwnProtoKey } from "./kit-errors.js";
-import { err, ok } from "@shirudo/result";
+import { C as InvalidEventStreamPageError, Y as assertNoOwnProtoKey } from "./kit-errors.js";
+import { _ as isIntrinsicConstructorPrototype, c as applyCooperativeBrand, f as builtInTagWithoutInvokingAccessors, h as hasIntrinsicPrototypeChain, l as hasCooperativeBrand, n as deepFreeze, p as builtInTypeName, s as isMutatorShadow } from "./value-object.js";
 
-//#region src/internal/structural/is-built-in.ts
-/**
-* Set of `Object.prototype.toString.call(x)` tags that the library treats
-* as built-in atomic types. Members of this set are compared/cloned by
-* reference (or with type-specific logic) rather than walked structurally.
-*
-* Detection is tag-based, since `Object.prototype.toString` gives the same
-* answer across realms (an iframe's `Date` has the same tag as the main
-* window's `Date`), and then brand-verified via internal-slot probes,
-* because `Symbol.toStringTag` lets any plain object claim a built-in tag.
-* The previous strategy also checked `globalThis[name] === constructor`
-* and a `proto !== Object.prototype` heuristic; both broke for cross-realm
-* objects and the latter additionally misclassified ordinary user classes
-* as built-ins.
-*/
-const BUILT_IN_TAGS = /* @__PURE__ */ new Set([
-	"[object Date]",
-	"[object RegExp]",
-	"[object Map]",
-	"[object Set]",
-	"[object WeakMap]",
-	"[object WeakSet]",
-	"[object Promise]",
-	"[object Error]",
-	"[object Boolean]",
-	"[object Number]",
-	"[object String]",
-	"[object BigInt]",
-	"[object ArrayBuffer]",
-	"[object SharedArrayBuffer]",
-	"[object DataView]"
-]);
-function intrinsicGetter(proto, prop) {
-	const get = Object.getOwnPropertyDescriptor(proto, prop)?.get;
-	if (!get) throw new Error(`missing intrinsic getter for ${prop}`);
-	return get;
-}
-const dateGetTime = Date.prototype.getTime;
-const mapSizeGet = intrinsicGetter(Map.prototype, "size");
-const setSizeGet = intrinsicGetter(Set.prototype, "size");
-const weakMapHas = WeakMap.prototype.has;
-const weakSetHas = WeakSet.prototype.has;
-const dataViewByteLengthGet = intrinsicGetter(DataView.prototype, "byteLength");
-const arrayBufferByteLengthGet = intrinsicGetter(ArrayBuffer.prototype, "byteLength");
-const sharedArrayBufferByteLengthGet = typeof SharedArrayBuffer === "undefined" ? void 0 : intrinsicGetter(SharedArrayBuffer.prototype, "byteLength");
-const regExpSourceGet = intrinsicGetter(RegExp.prototype, "source");
-const booleanValueOf = Boolean.prototype.valueOf;
-const numberValueOf = Number.prototype.valueOf;
-const stringValueOf$1 = String.prototype.valueOf;
-const bigIntValueOf = BigInt.prototype.valueOf;
-const functionToString = Function.prototype.toString;
-const PROBE_KEY = {};
-const intrinsicConstructorSources = new Map([
-	"Object",
-	"Array",
-	"Date",
-	"RegExp",
-	"Map",
-	"Set",
-	"WeakMap",
-	"WeakSet",
-	"Promise",
-	"Error",
-	"EvalError",
-	"RangeError",
-	"ReferenceError",
-	"SyntaxError",
-	"TypeError",
-	"URIError",
-	"AggregateError",
-	"Boolean",
-	"Number",
-	"String",
-	"BigInt",
-	"ArrayBuffer",
-	"SharedArrayBuffer",
-	"DataView",
-	"Int8Array",
-	"Uint8Array",
-	"Uint8ClampedArray",
-	"Int16Array",
-	"Uint16Array",
-	"Int32Array",
-	"Uint32Array",
-	"Float32Array",
-	"Float64Array",
-	"BigInt64Array",
-	"BigUint64Array"
-].flatMap((name) => {
-	const intrinsic = Object.getOwnPropertyDescriptor(globalThis, name)?.value;
-	return typeof intrinsic === "function" ? [[name, /* @__PURE__ */ new Set([functionToString.call(intrinsic), `function ${name}() { [native code] }`])]] : [];
-}));
-const intrinsicConstructorSourceSet = new Set([...intrinsicConstructorSources.values()].flatMap((sources) => [...sources]));
-const ERROR_INTRINSIC_NAMES = [
-	"Error",
-	"EvalError",
-	"RangeError",
-	"ReferenceError",
-	"SyntaxError",
-	"TypeError",
-	"URIError",
-	"AggregateError"
-];
-function isIntrinsicConstructorPrototype(prototype, expectedName) {
-	const constructorDescriptor = Object.getOwnPropertyDescriptor(prototype, "constructor");
-	const candidateConstructor = constructorDescriptor?.value;
-	if (constructorDescriptor === void 0 || !("value" in constructorDescriptor) || typeof candidateConstructor !== "function") return false;
-	let candidateSource;
-	try {
-		candidateSource = functionToString.call(candidateConstructor);
-	} catch {
-		return false;
-	}
-	const expectedSources = expectedName === void 0 ? void 0 : intrinsicConstructorSources.get(expectedName);
-	if (expectedSources !== void 0 && !expectedSources.has(candidateSource) || expectedSources === void 0 && !intrinsicConstructorSourceSet.has(candidateSource)) return false;
-	const nameDescriptor = Object.getOwnPropertyDescriptor(candidateConstructor, "name");
-	const candidateName = nameDescriptor !== void 0 && "value" in nameDescriptor && typeof nameDescriptor.value === "string" ? nameDescriptor.value : void 0;
-	const intrinsicName = expectedName ?? candidateName;
-	const intrinsicSources = intrinsicName === void 0 ? void 0 : intrinsicConstructorSources.get(intrinsicName);
-	return candidateName === intrinsicName && intrinsicSources !== void 0 && intrinsicSources.has(candidateSource) && Object.getOwnPropertyDescriptor(candidateConstructor, "prototype")?.value === prototype;
-}
-/**
-* Accepts an intrinsic prototype, optionally behind transparent
-* `Symbol.toStringTag` override layers. A user-defined subclass has its own
-* non-native constructor and is therefore rejected before reaching the
-* intrinsic prototype.
-*/
-function hasIntrinsicPrototypeChain(value, expectedName) {
-	const visited = /* @__PURE__ */ new WeakSet();
-	let prototype = Object.getPrototypeOf(value);
-	while (prototype !== null && !visited.has(prototype)) {
-		visited.add(prototype);
-		if (Object.hasOwn(prototype, "constructor")) return isIntrinsicConstructorPrototype(prototype, expectedName);
-		const ownKeys = Reflect.ownKeys(prototype);
-		if (ownKeys.length !== 1 || ownKeys[0] !== Symbol.toStringTag) return false;
-		prototype = Object.getPrototypeOf(prototype);
-	}
-	return false;
-}
-/**
-* Tags that `deepEqual` compares BY REFERENCE (its unhandled-built-in
-* fallback) and that `deepOmit` must therefore ALIAS rather than clone:
-* a clone would break `deepEqualExcept(x, x)` reflexivity. Single source
-* of truth so the two modules cannot drift: if `deepEqual` ever learns a
-* by-value comparison for one of these, remove it here and add a clone
-* case in `deepOmit`'s `cloneBuiltIn` in the same change.
-*/
-const REFERENCE_COMPARED_TAGS = /* @__PURE__ */ new Set([
-	"[object Error]",
-	"[object ArrayBuffer]",
-	"[object SharedArrayBuffer]",
-	"[object Promise]",
-	"[object WeakMap]",
-	"[object WeakSet]"
-]);
-/**
-* Intrinsic tags of OPAQUE exotics: objects whose internal state no
-* structural walk can observe (boxed Symbols, generator objects,
-* WeakRefs, FinalizationRegistry handles). `deepEqual` compares them by
-* identity and `deepOmit` passes them through by reference; treating
-* them as (empty) plain objects would make ALL such exotics equal to
-* each other. Deliberately a curated INTRINSIC list, not "every unknown
-* tag": a user class exposing its own `Symbol.toStringTag` (e.g.
-* "Money") keeps structural comparison, and a plain object spoofing one
-* of these intrinsic tags gets the identity semantics of the thing it
-* claims to be.
-*/
-const OPAQUE_EXOTIC_TAGS = /* @__PURE__ */ new Set([
-	"[object Symbol]",
-	"[object Generator]",
-	"[object AsyncGenerator]",
-	"[object WeakRef]",
-	"[object FinalizationRegistry]"
-]);
-/** True when `tag` names an opaque intrinsic; see {@link OPAQUE_EXOTIC_TAGS}. */
-function isOpaqueExoticTag(tag) {
-	return OPAQUE_EXOTIC_TAGS.has(tag);
-}
-function findPropertyDescriptor(value, key) {
-	const visited = /* @__PURE__ */ new WeakSet();
-	let current = value;
-	while (current !== null && !visited.has(current)) {
-		visited.add(current);
-		const descriptor = Object.getOwnPropertyDescriptor(current, key);
-		if (descriptor !== void 0) return descriptor;
-		current = Object.getPrototypeOf(current);
-	}
-}
-function builtInTagWithoutInvokingAccessors(value) {
-	if (ArrayBuffer.isView(value)) return hasBrand(value, "[object DataView]") ? "[object DataView]" : "[object TypedArray]";
-	const descriptor = findPropertyDescriptor(value, Symbol.toStringTag);
-	if (descriptor !== void 0 && !("value" in descriptor)) return builtInTagFromBrand(value);
-	const tag = Object.prototype.toString.call(value);
-	if (BUILT_IN_TAGS.has(tag) && hasBrand(value, tag)) return tag;
-	return descriptor === void 0 ? void 0 : builtInTagFromBrand(value);
-}
-/** The type name in a tag: `"Map"` for `"[object Map]"`. */
-function builtInTypeName(tag) {
-	return tag.slice(8, -1);
-}
-function builtInTagFromBrand(value) {
-	if (hasBrand(value, "[object Date]")) return "[object Date]";
-	if (hasBrand(value, "[object RegExp]")) return "[object RegExp]";
-	if (hasBrand(value, "[object Map]")) return "[object Map]";
-	if (hasBrand(value, "[object Set]")) return "[object Set]";
-	if (hasBrand(value, "[object WeakMap]")) return "[object WeakMap]";
-	if (hasBrand(value, "[object WeakSet]")) return "[object WeakSet]";
-	if (hasBrand(value, "[object DataView]")) return "[object DataView]";
-	if (hasBrand(value, "[object ArrayBuffer]")) return "[object ArrayBuffer]";
-	if (hasBrand(value, "[object SharedArrayBuffer]")) return "[object SharedArrayBuffer]";
-	if (hasBrand(value, "[object Boolean]")) return "[object Boolean]";
-	if (hasBrand(value, "[object Number]")) return "[object Number]";
-	if (hasBrand(value, "[object String]")) return "[object String]";
-	if (hasBrand(value, "[object BigInt]")) return "[object BigInt]";
-	if (hasNativePrototype(value, "Promise")) return "[object Promise]";
-	if (hasNativePrototype(value, "Error")) return "[object Error]";
-}
-function hasNativePrototype(value, expectedName) {
-	const visited = /* @__PURE__ */ new WeakSet();
-	let prototype = Object.getPrototypeOf(value);
-	while (prototype !== null && !visited.has(prototype)) {
-		visited.add(prototype);
-		if (isIntrinsicConstructorPrototype(prototype, expectedName)) return true;
-		prototype = Object.getPrototypeOf(prototype);
-	}
-	return false;
-}
-/**
-* Verifies that `obj` genuinely is the type its tag claims, via an
-* internal-slot probe. Promise and Error have no side-effect-free standard
-* probe, so their visible tags remain conservative; masked instances are
-* identified separately through their native prototype chain.
-*/
-function hasBrand(obj, tag) {
-	try {
-		switch (tag) {
-			case "[object Date]":
-				dateGetTime.call(obj);
-				return true;
-			case "[object RegExp]":
-				regExpSourceGet.call(obj);
-				return true;
-			case "[object Map]":
-				mapSizeGet.call(obj);
-				return true;
-			case "[object Set]":
-				setSizeGet.call(obj);
-				return true;
-			case "[object WeakMap]":
-				weakMapHas.call(obj, PROBE_KEY);
-				return true;
-			case "[object WeakSet]":
-				weakSetHas.call(obj, PROBE_KEY);
-				return true;
-			case "[object DataView]":
-				dataViewByteLengthGet.call(obj);
-				return true;
-			case "[object ArrayBuffer]":
-				arrayBufferByteLengthGet.call(obj);
-				return true;
-			case "[object SharedArrayBuffer]":
-				if (!sharedArrayBufferByteLengthGet) return false;
-				sharedArrayBufferByteLengthGet.call(obj);
-				return true;
-			case "[object Boolean]":
-				booleanValueOf.call(obj);
-				return true;
-			case "[object Number]":
-				numberValueOf.call(obj);
-				return true;
-			case "[object String]":
-				stringValueOf$1.call(obj);
-				return true;
-			case "[object BigInt]":
-				bigIntValueOf.call(obj);
-				return true;
-			case "[object Promise]": return hasNativePrototype(obj, "Promise");
-			case "[object Error]": return ERROR_INTRINSIC_NAMES.some((name) => hasNativePrototype(obj, name));
-			default: return false;
-		}
-	} catch {
-		return false;
-	}
-}
-/**
-* Returns `true` when `obj` is a built-in JavaScript type that should be
-* treated atomically (compared/cloned as a unit, not walked structurally).
-* Cross-realm safe, and brand-verified: a plain object spoofing a built-in
-* tag via `Symbol.toStringTag` returns `false` and is walked structurally
-* like any other plain object instead of crashing type-specific code.
-*
-* @param obj - The object to classify
-* @param tag - The result of `Object.prototype.toString.call(obj)`, passed
-*              in so callers that already computed it don't pay twice
-*/
-function isBuiltInObject(obj, tag) {
-	if (ArrayBuffer.isView(obj)) return true;
-	if (tag.endsWith("Array]")) return false;
-	return BUILT_IN_TAGS.has(tag) && hasBrand(obj, tag);
-}
-/**
-* Brand-verified `WeakMap` check that holds across realms. `instanceof
-* WeakMap` binds to the constructor of one realm, so a WeakMap from a `vm`
-* context or an iframe reads as a foreign value. The internal-slot probe
-* answers the same in every realm, and a plain object cannot spoof it
-* through `Symbol.toStringTag`.
-*/
-function isWeakMap(value) {
-	return typeof value === "object" && value !== null && hasBrand(value, "[object WeakMap]");
-}
-
-//#endregion
-//#region src/internal/structural/deep-equal.ts
-const objProto = Object.prototype;
-const objToString = objProto.toString;
-const objHasOwn = objProto.hasOwnProperty;
-/**
-* SameValueZero: `===` plus NaN-equals-NaN (and `+0 === -0`, unlike
-* `Object.is`). The numeric semantics `deepEqual` documents for primitives,
-* applied consistently inside TypedArrays, Dates and Number wrappers.
-*/
-function sameValueZero(a, b) {
-	return a === b || Number.isNaN(a) && Number.isNaN(b);
-}
-/**
-* Performs a deep equality check between two values.
-*
-* This function compares values recursively, handling:
-* - Primitives (with special handling for NaN)
-* - Arrays (nested arrays supported)
-* - Objects (plain objects and class instances)
-* - TypedArrays (Uint8Array, Int32Array, etc.)
-* - DataView
-* - Maps and Sets
-* - Dates and RegExp
-* - Wrapper objects (Boolean, Number, String)
-* - Circular references (detected and handled)
-*
-* @param a - The first value to compare
-* @param b - The second value to compare
-* @returns `true` if the values are deeply equal, `false` otherwise
-*
-* @example
-* ```ts
-* deepEqual([1, 2, 3], [1, 2, 3]); // true
-* deepEqual({ a: 1, b: [2, 3] }, { a: 1, b: [2, 3] }); // true
-* deepEqual(NaN, NaN); // true
-* deepEqual([1, 2], [1, 2, 3]); // false
-* ```
-*/
-function deepEqual(a, b) {
-	return deepEqualInner(a, b, /* @__PURE__ */ new WeakMap());
-}
-/**
-* Internal recursive function for deep equality comparison.
-*
-* @internal
-*/
-function deepEqualInner(a, b, visited) {
-	if (a === b) return true;
-	const typeA = typeof a;
-	const typeB = typeof b;
-	if (typeA !== "object" || a === null || typeB !== "object" || b === null) {
-		if (typeA === "number" && typeB === "number") return Number.isNaN(a) && Number.isNaN(b);
-		return false;
-	}
-	const objA = a;
-	const objB = b;
-	let cachedBs = visited.get(objA);
-	if (cachedBs?.has(objB)) return true;
-	if (!cachedBs) {
-		cachedBs = /* @__PURE__ */ new WeakSet();
-		visited.set(objA, cachedBs);
-	}
-	cachedBs.add(objB);
-	if (ArrayBuffer.isView(objA) || ArrayBuffer.isView(objB)) {
-		if (!ArrayBuffer.isView(objA) || !ArrayBuffer.isView(objB)) return false;
-		const tagA = objToString.call(objA);
-		if (tagA !== objToString.call(objB)) return false;
-		if (tagA === "[object DataView]") {
-			const viewA = objA;
-			const viewB = objB;
-			if (viewA.byteLength !== viewB.byteLength) return false;
-			const len = viewA.byteLength;
-			for (let i = 0; i < len; i++) if (viewA.getUint8(i) !== viewB.getUint8(i)) return false;
-			return true;
-		}
-		const arrA = objA;
-		const arrB = objB;
-		const len = arrA.length;
-		if (len !== arrB.length) return false;
-		for (let i = 0; i < len; i++) if (!sameValueZero(arrA[i], arrB[i])) return false;
-		return true;
-	}
-	if (Array.isArray(objA) || Array.isArray(objB)) {
-		if (!Array.isArray(objA) || !Array.isArray(objB)) return false;
-		if (objA.length !== objB.length) return false;
-		const keysA = Reflect.ownKeys(objA).filter((key) => key !== "length");
-		const keysB = Reflect.ownKeys(objB).filter((key) => key !== "length");
-		if (keysA.length !== keysB.length) return false;
-		const arrA = objA;
-		const arrB = objB;
-		for (const key of keysA) {
-			if (!objHasOwn.call(objB, key)) return false;
-			if (!deepEqualInner(arrA[key], arrB[key], visited)) return false;
-		}
-		return true;
-	}
-	const tagA = objToString.call(objA);
-	const tagB = objToString.call(objB);
-	if (tagA !== tagB) return false;
-	const builtInA = isBuiltInObject(objA, tagA);
-	if (builtInA !== isBuiltInObject(objB, tagB)) return false;
-	if (!builtInA) {
-		if (isOpaqueExoticTag(tagA)) return objA === objB;
-		return comparePlainObjects(objA, objB, visited);
-	}
-	switch (tagA) {
-		case "[object Map]": {
-			const mapA = objA;
-			const mapB = objB;
-			if (mapA.size !== mapB.size) return false;
-			for (const [key, valA] of mapA) {
-				if (!mapB.has(key)) return false;
-				if (!deepEqualInner(valA, mapB.get(key), visited)) return false;
-			}
-			return true;
-		}
-		case "[object Set]": {
-			const setA = objA;
-			const setB = objB;
-			if (setA.size !== setB.size) return false;
-			for (const value of setA) if (!setB.has(value)) return false;
-			return true;
-		}
-		case "[object Date]": return sameValueZero(objA.getTime(), objB.getTime());
-		case "[object RegExp]": {
-			const regA = objA;
-			const regB = objB;
-			return regA.source === regB.source && regA.flags === regB.flags;
-		}
-		case "[object Boolean]":
-		case "[object Number]":
-		case "[object String]":
-		case "[object BigInt]": return sameValueZero(objA.valueOf(), objB.valueOf());
-		default: return objA === objB;
-	}
-}
-/**
-* Plain / custom objects: compare own enumerable string keys + own symbol
-* keys and their values. Used both as the final fallback and for objects
-* whose built-in-looking tag failed brand verification.
-*/
-function comparePlainObjects(objA, objB, visited) {
-	const recA = objA;
-	const recB = objB;
-	const stringKeysA = Object.getOwnPropertyNames(objA);
-	const stringKeysB = Object.getOwnPropertyNames(objB);
-	if (stringKeysA.length !== stringKeysB.length) return false;
-	const symbolKeysA = Object.getOwnPropertySymbols(objA);
-	const symbolKeysB = Object.getOwnPropertySymbols(objB);
-	if (symbolKeysA.length !== symbolKeysB.length) return false;
-	const symbolKeysBSet = new Set(symbolKeysB);
-	for (const key of stringKeysA) if (!objHasOwn.call(objB, key)) return false;
-	for (const key of symbolKeysA) if (!symbolKeysBSet.has(key)) return false;
-	for (const key of stringKeysA) if (!deepEqualInner(recA[key], recB[key], visited)) return false;
-	for (const key of symbolKeysA) if (!deepEqualInner(recA[key], recB[key], visited)) return false;
-	return true;
-}
-
-//#endregion
-//#region src/internal/structural/deep-omit.ts
-/**
-* Creates a deep copy of `value` with certain keys removed according to the
-* provided rules.
-*
-* Walks the object tree and skips keys that match `ignoreKeys` /
-* `ignoreKeyPredicate`. Built-in atomic types that `deepEqual` compares by
-* value (Date, RegExp, Map, Set, TypedArrays, DataView) are cloned by type
-* rather than walked, since their internal structure has no key filtering to
-* apply. Types that `deepEqual` compares by reference (Error, ArrayBuffer,
-* SharedArrayBuffer, Promise, WeakMap, WeakSet) are passed through by
-* reference, so `deepEqualExcept(x, x)` stays reflexive. Cycles are
-* preserved: a cycle `a → a` clones to `a' → a'`. Arrays retain sparse
-* holes and all non-ignored own properties, including symbol keys.
-*
-* **Shared references.** Without `ignoreKeyPredicate`, an object reached
-* via several paths dedupes to a single clone. With a predicate, each
-* path gets its own clone, because the predicate may decide differently per
-* path, so memoising the first path's result would be wrong. This is
-* inherently exponential for diamond-shaped sharing (a node reachable
-* via 2^n paths is cloned 2^n times); the walk aborts with a descriptive
-* error after {@link PATH_SENSITIVE_VISIT_BUDGET} node visits instead of
-* hanging the process.
-*
-* **Prototype-pollution safety.** `__proto__` and `constructor` keys
-* encountered as *own* properties of the input (typical of `JSON.parse`
-* output) are copied as inert data properties via `Object.defineProperty`
-* so the clone graph cannot bleed into `Object.prototype`.
-*
-* **Class instances.** When the input is a class instance, the clone is
-* built via `Object.create(proto)` so the prototype is preserved, but the
-* constructor is NOT re-invoked, so class invariants enforced by the
-* constructor are not re-checked. `deepOmit` is therefore best used for
-* comparison/serialisation (`voEqualsExcept`, `deepEqualExcept`), not as
-* a general-purpose clone for behaviour-carrying objects.
-*
-* @param value - The value to create a deep copy from
-* @param options - Options specifying which keys to ignore
-* @returns A deep copy of `value` with specified keys removed
-*/
-function deepOmit(value, options) {
-	const visited = /* @__PURE__ */ new WeakMap();
-	return omitInternal(value, options, options.ignoreKeys ? new Set(options.ignoreKeys) : void 0, [], visited, options.ignoreKeyPredicate ? { visits: 0 } : void 0);
-}
-/**
-* Maximum object-node visits for a single path-sensitive `deepOmit` walk.
-* Per-path cloning expands exponentially on diamond-shaped sharing; past
-* this bound the walk throws instead of hanging the process. One million
-* visits covers any realistically tree-shaped input.
-*/
-const PATH_SENSITIVE_VISIT_BUDGET = 1e6;
-function omitInternal(value, options, ignoreKeys, path, visited, budget) {
-	if (value === null) return value;
-	if (typeof value !== "object") return value;
-	const obj = value;
-	if (visited.has(obj)) return visited.get(obj);
-	if (budget && ++budget.visits > PATH_SENSITIVE_VISIT_BUDGET) throw new Error(`deepOmit: exceeded ${PATH_SENSITIVE_VISIT_BUDGET} node visits. With ignoreKeyPredicate, objects reached via shared references are cloned once per path (the predicate may decide differently per path), which expands exponentially on diamond-shaped sharing. Restructure the input to a tree, or use ignoreKeys for path-independent filtering.`);
-	if (Array.isArray(obj)) {
-		const arr = obj;
-		const clone = new Array(arr.length);
-		const lengthDescriptor = Object.getOwnPropertyDescriptor(arr, "length");
-		visited.set(obj, clone);
-		for (const key of Reflect.ownKeys(arr)) {
-			if (key === "length") continue;
-			const segment = arrayPathSegment(key);
-			if (typeof segment !== "number" && shouldIgnoreKey(key, path, ignoreKeys, options)) continue;
-			const descriptor = Object.getOwnPropertyDescriptor(arr, key);
-			if (descriptor === void 0) continue;
-			path.push(segment);
-			if ("value" in descriptor) descriptor.value = omitInternal(descriptor.value, options, ignoreKeys, path, visited, budget);
-			Object.defineProperty(clone, key, descriptor);
-			path.pop();
-		}
-		if (lengthDescriptor !== void 0) Object.defineProperty(clone, "length", lengthDescriptor);
-		if (budget) visited.delete(obj);
-		return clone;
-	}
-	const tag = Object.prototype.toString.call(obj);
-	if (isBuiltInObject(obj, tag)) {
-		const builtInClone = cloneBuiltIn(obj, tag);
-		visited.set(obj, builtInClone);
-		return builtInClone;
-	}
-	if (isOpaqueExoticTag(tag)) {
-		visited.set(obj, obj);
-		return obj;
-	}
-	const clone = Object.create(Object.getPrototypeOf(obj));
-	visited.set(obj, clone);
-	const stringKeys = Object.getOwnPropertyNames(obj);
-	const symbolKeys = Object.getOwnPropertySymbols(obj);
-	for (const key of [...stringKeys, ...symbolKeys]) {
-		if (shouldIgnoreKey(key, path, ignoreKeys, options)) continue;
-		path.push(key);
-		assignOwn(clone, key, omitInternal(obj[key], options, ignoreKeys, path, visited, budget), Object.getOwnPropertyDescriptor(obj, key)?.enumerable ?? true);
-		path.pop();
-	}
-	if (budget) visited.delete(obj);
-	return clone;
-}
-function arrayPathSegment(key) {
-	if (typeof key === "symbol") return key;
-	const index = Number(key);
-	return Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key ? index : key;
-}
-/**
-* Assigns `value` as an OWN data property on `target` without going through
-* any inherited setter; critically, it never invokes the `__proto__` setter
-* even when `key === "__proto__"`. Required to defeat prototype-pollution
-* payloads that ship `__proto__` as a parsed-JSON own key.
-*/
-function assignOwn(target, key, value, enumerable = true) {
-	Object.defineProperty(target, key, {
-		value,
-		writable: true,
-		enumerable,
-		configurable: true
-	});
-}
-/**
-* Clones a built-in atomic type by case. Falls back to `structuredClone`
-* for anything not explicitly enumerated (e.g. DataView, TypedArrays,
-* Boolean/Number/String wrappers, all of which `deepEqual` compares by
-* value). Types that `deepEqual` compares BY REFERENCE (the shared
-* {@link REFERENCE_COMPARED_TAGS} set) are passed through by reference
-* instead; cloning them would make `deepEqualExcept(x, x)` false.
-* Promise/WeakMap/WeakSet additionally cannot be cloned at all
-* (`structuredClone` rejects them).
-*/
-function cloneBuiltIn(obj, tag) {
-	if (REFERENCE_COMPARED_TAGS.has(tag)) return obj;
-	switch (tag) {
-		case "[object Date]": return new Date(obj.getTime());
-		case "[object RegExp]": {
-			const re = obj;
-			const copy = new RegExp(re.source, re.flags);
-			copy.lastIndex = re.lastIndex;
-			return copy;
-		}
-		case "[object Map]": return new Map(obj);
-		case "[object Set]": return new Set(obj);
-		default: return structuredClone(obj);
-	}
-}
-function shouldIgnoreKey(key, path, ignoreKeys, options) {
-	if (ignoreKeys?.has(key)) return true;
-	if (options.ignoreKeyPredicate?.(key, path.slice())) return true;
-	return false;
-}
-
-//#endregion
-//#region src/internal/structural/deep-equal-except.ts
-/**
-* Performs a deep equality comparison between two values after omitting specified keys.
-*
-* This function first removes the specified keys from both values using `deepOmit`,
-* then performs a deep equality check using `deepEqual`.
-*
-* @param a - The first value to compare
-* @param b - The second value to compare
-* @param options - Options specifying which keys to omit before comparison
-* @returns `true` if the values are deeply equal after omitting specified keys, `false` otherwise
-*
-* @example
-* ```ts
-* const obj1 = { id: 1, name: "Alice", updatedAt: "2024-01-01" };
-* const obj2 = { id: 2, name: "Alice", updatedAt: "2024-01-02" };
-*
-* deepEqualExcept(obj1, obj2, { ignoreKeys: ["id", "updatedAt"] }); // true
-* ```
-*/
-function deepEqualExcept(a, b, options) {
-	const prunedA = deepOmit(a, options);
-	const prunedB = deepOmit(b, options);
-	return deepEqual(prunedA, prunedB);
-}
-
-//#endregion
-//#region src/internal/cooperative-brand.ts
-/**
-* A cooperative brand marks an object that a kit constructor produced, so
-* a second loaded copy of the kit (duplicate npm dependency, dual CJS/ESM
-* load, plugin bundle) recognizes it. A module-private WeakSet cannot do
-* that: it is bound to one loaded copy. The brand is a `Symbol.for` key
-* with the value `true`. The property is non-enumerable, so it never
-* leaks into spreads, JSON, or equality, and non-writable and
-* non-configurable, so nothing edits it after the stamp.
-*
-* The probe reads the brand as an OWN property with exactly these
-* attributes and requires the carrier to be frozen. An object that
-* inherits a branded object through its prototype can carry mutable own
-* overrides; a branded object that is still open can change after the
-* stamp. Neither is what the constructor produced. Every stamp site
-* therefore freezes the carrier right after {@link stampCooperativeBrand}.
-*
-* The brand is forgeable BY DESIGN. It catches accidental hand-rolled
-* literals; it is not a security boundary against code in the same
-* process that fakes it on purpose.
-*
-* Internal utility (not exported from the package barrels).
-*/
-function stampCooperativeBrand(target, brand) {
-	Object.defineProperty(target, brand, {
-		value: true,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-}
-/**
-* Whether `value` carries `brand` as an own, non-enumerable, non-writable,
-* non-configurable `true` and is frozen. A Proxy trap that throws reads
-* as unbranded.
-*/
-function hasCooperativeBrand(value, brand) {
-	if (value === null || typeof value !== "object" && typeof value !== "function") return false;
-	try {
-		const marker = Reflect.getOwnPropertyDescriptor(value, brand);
-		return marker?.value === true && marker.enumerable === false && marker.writable === false && marker.configurable === false && Object.isFrozen(value);
-	} catch {
-		return false;
-	}
-}
-
-//#endregion
-//#region src/internal/structural/shadowed-mutators.ts
-/**
-* `Object.freeze` does not protect internal slots: a frozen Date still
-* accepts `setTime`, a frozen Map still accepts `set`. A deep freeze
-* therefore shadows these mutators with own throwing functions. The
-* shadows are non-enumerable, so they are invisible to `Object.keys` and
-* spread, and `structuredClone` drops them. A walk that checks a copy
-* accepts them as machinery, not data.
-*/
-const mutatorsByTag = /* @__PURE__ */ new Map([
-	["[object Date]", [
-		"setTime",
-		"setMilliseconds",
-		"setUTCMilliseconds",
-		"setSeconds",
-		"setUTCSeconds",
-		"setMinutes",
-		"setUTCMinutes",
-		"setHours",
-		"setUTCHours",
-		"setDate",
-		"setUTCDate",
-		"setMonth",
-		"setUTCMonth",
-		"setFullYear",
-		"setUTCFullYear",
-		"setYear"
-	]],
-	["[object Map]", [
-		"set",
-		"delete",
-		"clear"
-	]],
-	["[object Set]", [
-		"add",
-		"delete",
-		"clear"
-	]]
-]);
-const mutatorShadowBrand = Symbol.for("@shirudo/ddd-kit/mutator-shadow/v1");
-const shadows = /* @__PURE__ */ new Map();
-function shadowOf(typeName, method) {
-	const key = `${typeName}.${method}`;
-	let shadow = shadows.get(key);
-	if (shadow === void 0) {
-		shadow = function throwFrozenMutation() {
-			throw new TypeError(`Cannot call ${method}() on a ${typeName} inside a deeply frozen value`);
-		};
-		stampCooperativeBrand(shadow, mutatorShadowBrand);
-		Object.freeze(shadow);
-		shadows.set(key, shadow);
-	}
-	return shadow;
-}
-const shadowDescriptor = {
-	value: void 0,
-	writable: false,
-	enumerable: false,
-	configurable: false
-};
-/**
-* Installs the mutator shadows on a Date, a Map, or a Set whose tag is
-* `tag`. Returns whether it installed them: a built-in of another kind has
-* no mutator shadows, and a non-extensible one cannot take them.
-*/
-function installMutatorShadows(object, tag) {
-	const mutators = mutatorsByTag.get(tag);
-	if (mutators === void 0 || !Object.isExtensible(object)) return false;
-	const typeName = builtInTypeName(tag);
-	for (const method of mutators) {
-		shadowDescriptor.value = shadowOf(typeName, method);
-		Object.defineProperty(object, method, shadowDescriptor);
-	}
-	return true;
-}
-/**
-* Whether the own property `key` of a built-in whose tag is `tag` is a
-* mutator shadow: a locked, non-enumerable function with the cooperative
-* brand of a shadow, under a mutator key of that built-in. The brand
-* catches accidents, not a forgery.
-*/
-function isMutatorShadow(tag, key, descriptor) {
-	const shadow = descriptor.value;
-	return (mutatorsByTag.get(tag)?.includes(key) ?? false) && typeof shadow === "function" && descriptor.enumerable === false && descriptor.writable === false && descriptor.configurable === false && hasCooperativeBrand(shadow, mutatorShadowBrand);
-}
-
-//#endregion
-//#region src/domain/value-object/value-object.ts
-const mapEntries$1 = Map.prototype.entries;
-const setValues$1 = Set.prototype.values;
-const VALUE_OBJECT_CLASS = Symbol.for("@shirudo/ddd-kit/value-object-class/v1");
-function recordValueObjectClass(instance, valueObjectClass) {
-	Object.defineProperty(instance, VALUE_OBJECT_CLASS, {
-		value: valueObjectClass,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-}
-function isValueObjectInstance(value) {
-	if (value === null || typeof value !== "object") return false;
-	const record = Reflect.getOwnPropertyDescriptor(value, VALUE_OBJECT_CLASS);
-	if (record === void 0 || typeof record.value !== "function" || record.enumerable !== false || record.writable !== false || record.configurable !== false) return false;
-	const props = Reflect.getOwnPropertyDescriptor(value, "props");
-	return props !== void 0 && isSealedProps(props.value);
-}
-function isSealedProps(props) {
-	if (typeof props !== "object" || props === null) return false;
-	return Object.isFrozen(props) || builtInTagWithoutInvokingAccessors(props) === "[object RegExp]";
-}
-function looksLikeValueObject(instance) {
-	if (Object.hasOwn(instance, VALUE_OBJECT_CLASS)) return true;
-	const props = Reflect.getOwnPropertyDescriptor(instance, "props");
-	return props !== void 0 && isSealedProps(props.value);
-}
-function openValueObjectKeys(instance) {
-	return Reflect.ownKeys(instance).filter((key) => key !== "props" && key !== VALUE_OBJECT_CLASS);
-}
-function rejectValueObjectAsInput(input, entry) {
-	if (isValueObjectInstance(input)) throw new TypeError(`${entry} does not accept a value object as its input: nest the value object under a key, or pass its props`);
-}
-/**
-* Deep freezes an object and all its nested properties recursively, then
-* returns it. Iterates both string-keyed and symbol-keyed own properties
-* so the freeze symmetry matches `deepEqual` (which also considers symbol
-* keys). Handles circular references by tracking visited objects.
-*
-* Note: `deepFreeze` mutates its argument in place; it sets `[[Frozen]]`
-* on the object you pass in. Callers that need to avoid touching the
-* input (e.g. `vo()`) should deep-clone first.
-*
-* Date/Map/Set keep internal-slot mutability under `Object.freeze`
-* (`setTime`, `set`, `add`, … still work on frozen instances), so their
-* mutator methods are shadowed with throwing own properties and Map/Set
-* contents are frozen recursively. The shadows are non-enumerable:
-* invisible to `Object.keys`, spread, `deepEqual`, and `structuredClone`.
-*
-* The shadowing is deny-by-enumeration: only the mutators known at
-* release time are blocked. If the runtime grows a NEW mutator (e.g. the
-* stage-3 `Map.prototype.getOrInsert` upsert proposal), it is not blocked
-* until the list is updated. Treat the mutator blocking as a guard rail,
-* not a security boundary.
-*
-* Two kinds of built-in pass through unfrozen. ArrayBuffer views
-* (TypedArrays, DataView): the spec forbids freezing a view with elements,
-* and a freeze cannot protect the underlying buffer, so their contents stay
-* mutable. RegExp: pattern and flags live in immutable internal slots, and
-* the only own data property, `lastIndex`, is scan state that every global
-* or sticky match writes. A frozen RegExp protects nothing and throws on
-* the first such match, so the RegExp keeps matching instead. A view or a
-* RegExp passes through whole: an expando property on it stays open, and
-* the walk does not enter its subtree.
-*/
-const DEEP_FROZEN = /* @__PURE__ */ new WeakSet();
-const KIT_SHADOWED = /* @__PURE__ */ new WeakSet();
-function deepFreeze(obj) {
-	const walk = {
-		cyclic: false,
-		sealed: [],
-		done: /* @__PURE__ */ new Map(),
-		inProgress: /* @__PURE__ */ new Set()
-	};
-	freezeDeep(obj, walk);
-	if (!walk.cyclic) for (const object of walk.sealed) DEEP_FROZEN.add(object);
-	return obj;
-}
-/** Freezes `obj` and its subtree; returns whether the subtree is sealed. */
-function freezeDeep(obj, walk) {
-	if (obj === null || typeof obj !== "object") return true;
-	if (DEEP_FROZEN.has(obj)) return true;
-	if (ArrayBuffer.isView(obj)) return true;
-	const finished = walk.done.get(obj);
-	if (finished !== void 0) return finished;
-	if (walk.inProgress.has(obj)) {
-		walk.cyclic = true;
-		return true;
-	}
-	const builtInTag = builtInTagWithoutInvokingAccessors(obj);
-	if (builtInTag === "[object RegExp]") return true;
-	walk.inProgress.add(obj);
-	let sealed = true;
-	if (builtInTag === "[object Date]" || builtInTag === "[object Map]" || builtInTag === "[object Set]") {
-		if (builtInTag === "[object Map]") for (const [key, value] of obj) {
-			if (!freezeDeep(key, walk)) sealed = false;
-			if (!freezeDeep(value, walk)) sealed = false;
-		}
-		else if (builtInTag === "[object Set]") {
-			for (const member of obj) if (!freezeDeep(member, walk)) sealed = false;
-		}
-		if (installMutatorShadows(obj, builtInTag) || KIT_SHADOWED.has(obj)) KIT_SHADOWED.add(obj);
-		else sealed = false;
-	}
-	const keys = Reflect.ownKeys(obj);
-	for (const key of keys) {
-		const value = obj[key];
-		if (value !== null && typeof value === "object") {
-			if (!freezeDeep(value, walk)) sealed = false;
-		}
-	}
-	Object.freeze(obj);
-	walk.inProgress.delete(obj);
-	walk.done.set(obj, sealed);
-	if (sealed) walk.sealed.push(obj);
-	return sealed;
-}
-/**
-* Deep clone used by `vo()` and the `ValueObject` constructor.
-*
-* Plain objects, arrays, and Map values are walked manually so
-* that symbol-keyed properties survive (which `structuredClone` silently
-* drops; they would otherwise be invisible to `voEquals`, whose
-* `deepEqual` DOES consider symbol keys) and shared references / cycles
-* keep their identity across Map boundaries. Function values throw,
-* preserving `vo()`'s documented data-not-behaviour gate. Built-ins without
-* immutable value semantics throw a descriptive `TypeError`. A kit
-* `ValueObject` instance is admitted by reference (see
-* `VALUE_OBJECT_CLASS`). Every other custom class instance and every
-* subclass of a built-in is rejected because cloning it without invoking
-* its constructor can silently lose private or non-enumerable state. Map
-* keys and Set members must be primitive because their equality is
-* identity-based and object identity cannot survive defensive cloning.
-* Accessor properties are rejected without invoking them. Admitted atomic
-* built-ins (Date, RegExp and primitive wrappers) delegate to
-* `structuredClone`, brand-verified so a `Symbol.toStringTag` spoofer is
-* walked as the plain object it is. `__proto__` own keys are copied as
-* inert data properties.
-*/
-function cloneForVo(value, visited) {
-	if (typeof value === "function") throw new TypeError("vo() does not accept function values: Value Objects are data, not behaviour");
-	if (value === null || typeof value !== "object") return value;
-	const obj = value;
-	if (ArrayBuffer.isView(obj)) throwUnsupportedValueSemantics(builtInTagWithoutInvokingAccessors(obj) ?? "[object ArrayBuffer view]");
-	if (visited.has(obj)) return visited.get(obj);
-	if (Array.isArray(obj)) {
-		if (!hasIntrinsicPrototypeChain(obj, "Array")) throwUnsupportedClassInstance(obj);
-		const clone = new Array(obj.length);
-		visited.set(obj, clone);
-		for (const key of Reflect.ownKeys(obj)) {
-			if (key === "length") continue;
-			const descriptor = Object.getOwnPropertyDescriptor(obj, key);
-			if (descriptor === void 0) continue;
-			if (!("value" in descriptor)) throwUnsupportedAccessorProperty();
-			if (typeof key === "string" && !descriptor.enumerable) continue;
-			descriptor.value = cloneForVo(descriptor.value, visited);
-			Object.defineProperty(clone, key, descriptor);
-		}
-		return clone;
-	}
-	const tag = builtInTagWithoutInvokingAccessors(obj);
-	if (tag !== void 0) {
-		if (!hasIntrinsicPrototypeChain(obj)) throwUnsupportedClassInstance(obj);
-		if (tag === "[object Map]") {
-			const clone = /* @__PURE__ */ new Map();
-			visited.set(obj, clone);
-			for (const [key, entry] of mapEntries$1.call(obj)) {
-				if (!isPrimitiveValue(key)) throw new TypeError("vo() Map keys must be primitive values to preserve value equality");
-				clone.set(key, cloneForVo(entry, visited));
-			}
-			return clone;
-		}
-		if (tag === "[object Set]") {
-			const clone = /* @__PURE__ */ new Set();
-			visited.set(obj, clone);
-			for (const member of setValues$1.call(obj)) {
-				if (!isPrimitiveValue(member)) throw new TypeError("vo() Set members must be primitive values to preserve value equality");
-				clone.add(member);
-			}
-			return clone;
-		}
-		if (tag === "[object Promise]" || tag === "[object WeakMap]" || tag === "[object WeakSet]") throw new TypeError(`vo() cannot clone a ${tag.slice(8, -1)}: Value Objects are plain data`);
-		if (tag === "[object Error]" || tag === "[object ArrayBuffer]" || tag === "[object SharedArrayBuffer]") throwUnsupportedValueSemantics(tag);
-		if (tag === "[object RegExp]") {
-			const regExp = obj;
-			if (regExp.global || regExp.sticky) throw new TypeError("vo() cannot accept a global or sticky RegExp: its lastIndex is mutable scan state, not an immutable value");
-		}
-		const builtInClone = structuredClone(obj);
-		visited.set(obj, builtInClone);
-		return builtInClone;
-	}
-	const prototype = Object.getPrototypeOf(obj);
-	if (prototype !== null && (!isIntrinsicConstructorPrototype(prototype, "Object") || Object.getPrototypeOf(prototype) !== null)) {
-		if (isValueObjectInstance(obj)) {
-			const openKeys = openValueObjectKeys(obj);
-			if (openKeys.length > 0) throwOpenValueObjectFields(openKeys);
-			return obj;
-		}
-		throwUnsupportedClassInstance(obj);
-	}
-	const clone = Object.create(prototype === null ? null : Object.prototype);
-	visited.set(obj, clone);
-	for (const key of Reflect.ownKeys(obj)) {
-		const descriptor = Object.getOwnPropertyDescriptor(obj, key);
-		if (descriptor === void 0) continue;
-		if (!("value" in descriptor)) throwUnsupportedAccessorProperty();
-		if (typeof key === "string" && !descriptor.enumerable) continue;
-		Object.defineProperty(clone, key, {
-			value: cloneForVo(descriptor.value, visited),
-			writable: true,
-			enumerable: descriptor.enumerable,
-			configurable: true
-		});
-	}
-	return clone;
-}
-function throwUnsupportedClassInstance(instance) {
-	const valueObjectHint = looksLikeValueObject(instance) ? ". A value object is recognized only when a copy of this kit version built it and its props are frozen" : "";
-	throw new TypeError(`vo() cannot clone custom class instances: Value Objects are plain data${valueObjectHint}`);
-}
-function throwOpenValueObjectFields(keys) {
-	throw new TypeError(`vo() cannot nest a value object with own fields outside props (${keys.map(String).join(", ")}): keep the state of a value object in props`);
-}
-function throwUnsupportedAccessorProperty() {
-	throw new TypeError("vo() cannot clone accessor properties: Value Objects are plain data");
-}
-function throwUnsupportedValueSemantics(tag) {
-	const name = tag.startsWith("[object ") ? tag.slice(8, -1) : tag;
-	throw new TypeError(`vo() cannot accept ${name} values: Value Objects require immutable value semantics`);
-}
-function isPrimitiveValue(value) {
-	return value === null || typeof value !== "object" && typeof value !== "function";
-}
-/**
-* Creates a deeply immutable value object from the given data.
-*
-* The input is first deep-cloned, then the clone is frozen, so calling
-* `vo(input)` never freezes the caller's own object graph as a
-* side-effect. Mutating the input afterwards does not bleed into the VO.
-* Symbol-keyed properties are preserved (matching `voEquals`). A kit
-* `ValueObject` instance nested in the input is kept by reference and
-* frozen in place; it must keep all of its state in `props`. A value
-* object as the input itself is rejected.
-* Function values and every other custom class instance are rejected
-* (Value Objects are plain data, not behaviour-bearing object graphs). Inputs must be trusted and
-* Proxy-free: ECMAScript provides no portable way to identify a transparent
-* Proxy without potentially executing its traps, so `vo()` is not a sandbox
-* for hostile in-process objects. Built-ins that cannot provide immutable,
-* value-based semantics are rejected instead of weakening the VO contract.
-*
-* @example
-* ```typescript
-* const nested = { lat: 52.5, lng: 13.4 };
-* const address = vo({ street: "Main St", coordinates: nested });
-* address.coordinates.lat = 99; // ❌ Cannot assign to read-only property
-* nested.lat = 0;               // ✅ caller's input still mutable
-* ```
-*/
-function vo(t) {
-	rejectValueObjectAsInput(t, "vo()");
-	return deepFreeze(cloneForVo(t, /* @__PURE__ */ new WeakMap()));
-}
-/**
-* Compares two value objects for equality based on their values.
-* Uses deep equality comparison that handles:
-* - Nested objects and arrays
-* - Primitives (including NaN)
-* - Dates, Maps, Sets, RegExp
-* - Symbol keys
-* - Circular references
-*
-* @param a - First value object
-* @param b - Second value object
-* @returns true if both objects have the same values, false otherwise
-*
-* @example
-* ```typescript
-* const money1 = vo({ amount: 100, currency: "USD" });
-* const money2 = vo({ amount: 100, currency: "USD" });
-* voEquals(money1, money2); // true
-*
-* const address1 = vo({
-*   street: "Main St",
-*   coordinates: { lat: 52.5, lng: 13.4 }
-* });
-* const address2 = vo({
-*   street: "Main St",
-*   coordinates: { lat: 52.5, lng: 13.4 }
-* });
-* voEquals(address1, address2); // true
-* ```
-*/
-function voEquals(a, b) {
-	return deepEqual(a, b);
-}
-/**
-* Compares two value objects for equality while ignoring specified keys.
-* Useful for comparing value objects that contain metadata or optional fields
-* that should not affect equality comparison.
-*
-* The walk enters a nested `ValueObject` instance like any other object,
-* so inside it the path continues with `props`; `ignoreKeys: ["props"]`
-* empties every nested value object. The key under which the kit records
-* the class of the instance is never ignored.
-*
-* @param a - First value object
-* @param b - Second value object
-* @param options - Options specifying which keys to ignore during comparison
-* @returns true if both objects have the same values (after ignoring specified keys), false otherwise
-*
-* @example
-* ```typescript
-* // Value object with metadata
-* const address1 = vo({
-*   street: "Main St",
-*   city: "Berlin",
-*   metadata: { createdAt: "2024-01-01", updatedAt: "2024-01-02" }
-* });
-*
-* const address2 = vo({
-*   street: "Main St",
-*   city: "Berlin",
-*   metadata: { createdAt: "2024-01-01", updatedAt: "2024-01-03" }
-* });
-*
-* // Compare ignoring metadata timestamps
-* voEqualsExcept(address1, address2, {
-*   ignoreKeys: ["updatedAt"],
-*   ignoreKeyPredicate: (key, path) => path.includes("metadata")
-* }); // true
-*
-* // Compare ignoring all metadata
-* voEqualsExcept(address1, address2, {
-*   ignoreKeyPredicate: (key, path) => path.includes("metadata")
-* }); // true
-* ```
-*/
-function voEqualsExcept(a, b, options) {
-	return deepEqualExcept(a, b, keepValueObjectClass(options));
-}
-function keepValueObjectClass(options) {
-	const { ignoreKeys, ignoreKeyPredicate } = options;
-	return {
-		...options,
-		ignoreKeys: ignoreKeys?.filter((key) => key !== VALUE_OBJECT_CLASS),
-		ignoreKeyPredicate: ignoreKeyPredicate && ((key, path) => key !== VALUE_OBJECT_CLASS && ignoreKeyPredicate(key, path))
-	};
-}
-/**
-* Creates a value object with optional validation.
-* Returns a Result type instead of throwing an error.
-*
-* Note: the Result covers VALIDATION failures only. Non-data values and
-* built-ins without immutable value semantics still throw a
-* `TypeError` from `vo()`; they cannot occur in parsed JSON and signal
-* a programming error, not a validation failure.
-*
-* @param t - The data to convert into a value object
-* @param validate - Validation function that returns true if valid
-* @param errorMessage - Optional custom error message if validation fails
-* @returns Result containing the value object if valid, or an error message if validation fails
-*
-* @example
-* ```typescript
-* const result = voWithValidation(
-*   { amount: 100, currency: "USD" },
-*   (m) => m.amount >= 0 && m.currency.length === 3,
-*   "Invalid money: amount must be non-negative and currency must be 3 characters"
-* );
-*
-* if (result.ok) {
-*   console.log(result.value); // Use the value object
-* } else {
-*   console.error(result.error); // Handle validation error
-* }
-* ```
-*/
-function voWithValidation(t, validate, errorMessage) {
-	if (!validate(t)) return err(errorMessage ?? `Validation failed for value object: ${describeValue(t)}`);
-	return ok(vo(t));
-}
-/**
-* Best-effort rendering of a value for the default validation-failure
-* message. `JSON.stringify` throws for cyclic and BigInt-bearing values, and
-* the error path of a Result-returning function must never throw itself.
-*/
-function describeValue(value) {
-	try {
-		const json = JSON.stringify(value);
-		if (json !== void 0) return json;
-	} catch {}
-	return String(value);
-}
-/**
-* Abstract base class for creating Value Objects.
-* Value Objects are immutable and defined by their properties. A value
-* object can hold other value objects in its props. Every instance
-* records its class under an own symbol key, so `equals` compares a
-* nested value object by class and props and does not call its `equals`
-* method.
-*
-* @template T - The shape of the value object's properties
-*/
-var ValueObject = class {
-	props;
-	/**
-	* Creates a new ValueObject.
-	* The plain-data properties are deep-cloned and then deeply
-	* frozen, so the caller's own object graph is never frozen or mutated,
-	* and later mutation of the input does not bleed into the value object.
-	*
-	* @param props - The properties of the value object
-	* @example
-	* ```ts
-	* class Money extends ValueObject<{ amount: number; currency: string }> {
-	*   constructor(props: { amount: number; currency: string }) {
-	*     super(props);
-	*   }
-	*
-	*   protected validate(props: { amount: number; currency: string }): void {
-	*     if (props.amount < 0) throw new Error("Amount cannot be negative");
-	*   }
-	* }
-	* ```
-	*/
-	constructor(props) {
-		rejectValueObjectAsInput(props, "new ValueObject()");
-		this.validate(props);
-		this.props = deepFreeze(cloneForVo(props, /* @__PURE__ */ new WeakMap()));
-		recordValueObjectClass(this, this.constructor);
-	}
-	/**
-	* Optional validation hook that can be overridden by subclasses.
-	* Should throw an error if validation fails.
-	*
-	* @param props - The properties to validate
-	* @throws Error if validation fails
-	*/
-	validate(props) {}
-	/**
-	* Checks if this value object is equal to another.
-	* Uses deep equality comparison on the properties and checks for constructor equality.
-	*
-	* @param other - The other value object to compare
-	* @returns true if the properties are deeply equal and constructors match
-	*/
-	equals(other) {
-		if (other === null || other === void 0) return false;
-		if (this.constructor !== other.constructor) return false;
-		return deepEqual(this.props, other.props);
-	}
-	/**
-	* Creates a clone of the value object with optional property overrides.
-	*
-	* @param props - Optional properties to override
-	* @returns A new instance of the value object
-	*/
-	clone(props) {
-		const Constructor = this.constructor;
-		const merged = {
-			...this.props,
-			...props || {}
-		};
-		for (const key of Reflect.ownKeys(this.props)) {
-			const descriptor = Object.getOwnPropertyDescriptor(this.props, key);
-			if (descriptor === void 0 || descriptor.enumerable) continue;
-			if (props && Object.hasOwn(props, key)) continue;
-			Object.defineProperty(merged, key, {
-				value: this.props[key],
-				writable: true,
-				enumerable: false,
-				configurable: true
-			});
-		}
-		return new Constructor(merged);
-	}
-	/**
-	* Serializes the value object to its raw properties for JSON operations.
-	*
-	* @returns The raw properties object
-	*/
-	toJSON() {
-		return this.props;
-	}
-};
-
-//#endregion
-//#region src/internal/structural/detach-state.ts
+//#region src/internal/structural/copy-plain-state.ts
 /**
 * Returns a copy of `state` that shares no object with the original.
 * Throws a `TypeError` that names the path when the graph carries a value
@@ -1281,7 +10,7 @@ var ValueObject = class {
 * symbol-keyed, non-enumerable, or accessor property and an expando on a
 * built-in are dropped. A function or a symbol value throws a raw
 * `DataCloneError`. An Error, a Promise, a WeakMap, or a WeakSet cannot be
-* detached at all. A SharedArrayBuffer and a view over one keep sharing
+* copied at all. A SharedArrayBuffer and a view over one keep sharing
 * their memory. A Proxy fails in the walk or in the clone; a failure in
 * the clone is rethrown as a `TypeError` with the cause. An error that a
 * Proxy trap throws in the walk passes unchanged, so a coded error of the
@@ -1310,26 +39,26 @@ var ValueObject = class {
 * throws. A non-enumerable symbol key passes anywhere: it is metadata by
 * convention.
 *
-* The concrete entity uses it for a detached read DTO of a plain-data
+* The concrete entity uses it for the plain state of a plain-data
 * state. The snapshot model uses it for the captured DTO and the restored
 * state. A state that carries a class-based child is mapped to plain data
 * first, in the entity or in the model.
 */
-function detachState(state, subject = "detachState: state") {
-	return detach(state, subject, "clone");
+function copyPlainState(state, subject = "copyPlainState: state") {
+	return copyState(state, subject, "clone");
 }
 /**
-* {@link detachState} that also rejects what `deepFreeze` cannot make
+* {@link copyPlainState} that also rejects what `deepFreeze` cannot make
 * immutable: binary data (a typed array, a DataView, an ArrayBuffer, or a
 * SharedArrayBuffer) and a RegExp. The walk rejects such a value at its
 * tag, before it reads the indices of a typed array. Kit modules only.
 */
-function detachFreezableState(state, subject) {
-	return detach(state, subject, "freeze");
+function copyFreezableState(state, subject) {
+	return copyState(state, subject, "freeze");
 }
-function detach(state, subject, rule) {
+function copyState(state, subject, rule) {
 	const recording = new StepRecording();
-	assertDetachable(state, "", newWalk(subject, rule, recording));
+	assertCopyable(state, "", newWalk(subject, rule, recording));
 	let copy;
 	try {
 		copy = structuredClone(state);
@@ -1337,7 +66,7 @@ function detach(state, subject, rule) {
 		throw new TypeError(`${subject} holds a Proxy or a host object that cannot be cloned, or a view over a detached or shrunk buffer; the cause names the value; map it to plain data`, { cause });
 	}
 	const comparison = new StepComparison(recording, subject);
-	assertDetachable(copy, "", newWalk(subject, rule, comparison));
+	assertCopyable(copy, "", newWalk(subject, rule, comparison));
 	comparison.assertComplete();
 	return copy;
 }
@@ -1419,7 +148,7 @@ function describeStep(step) {
 	const name = builtInTypeName(step.description);
 	return /^[AEIOU]/.test(name) ? `an ${name}` : `a ${name}`;
 }
-function assertDetachable(value, path, walk) {
+function assertCopyable(value, path, walk) {
 	if (typeof value === "function") throw new TypeError(`${walk.subject}${path} is a function; map it to plain data`);
 	if (typeof value === "symbol") throw new TypeError(`${walk.subject}${path} is a symbol; map it to plain data`);
 	if (value === null || typeof value !== "object") return;
@@ -1429,7 +158,7 @@ function assertDetachable(value, path, walk) {
 	if (Array.isArray(object)) {
 		if (!hasIntrinsicPrototypeChain(object, "Array")) throwClassInstance(object, path, walk.subject);
 		step(walk, ARRAY_STEP, path);
-		assertOwnPropertiesDetachable(object, path, walk, "array");
+		assertOwnPropertiesCopyable(object, path, walk, "array");
 		return;
 	}
 	const tag = builtInTagWithoutInvokingAccessors(object);
@@ -1440,26 +169,26 @@ function assertDetachable(value, path, walk) {
 		if (tag === "[object Map]") {
 			let index = 0;
 			for (const [key, entry] of mapEntries.call(object)) {
-				assertDetachable(key, `${path}<map key #${index}>`, walk);
-				assertDetachable(entry, `${path}<map value #${index}>`, walk);
+				assertCopyable(key, `${path}<map key #${index}>`, walk);
+				assertCopyable(entry, `${path}<map value #${index}>`, walk);
 				index++;
 			}
 		} else if (tag === "[object Set]") {
 			let index = 0;
 			for (const member of setValues.call(object)) {
-				assertDetachable(member, `${path}<set member #${index}>`, walk);
+				assertCopyable(member, `${path}<set member #${index}>`, walk);
 				index++;
 			}
-		} else if (tag === "[object Promise]" || tag === "[object WeakMap]" || tag === "[object WeakSet]") throw new TypeError(`${walk.subject}${path} is a ${builtInTypeName(tag)} and cannot be detached`);
+		} else if (tag === "[object Promise]" || tag === "[object WeakMap]" || tag === "[object WeakSet]") throw new TypeError(`${walk.subject}${path} is a ${builtInTypeName(tag)} and cannot be copied`);
 		else if (tag === "[object Error]") throw new TypeError(`${walk.subject}${path} is an Error; map it to plain data`);
 		else if (sharesMemory(object, tag)) throw new TypeError(`${walk.subject}${path} is backed by a SharedArrayBuffer and the copy would share its memory; map it to plain data`);
-		assertOwnPropertiesDetachable(object, path, walk, tag);
+		assertOwnPropertiesCopyable(object, path, walk, tag);
 		return;
 	}
 	const prototype = Object.getPrototypeOf(object);
 	if (!(prototype === null || isIntrinsicConstructorPrototype(prototype, "Object") && Object.getPrototypeOf(prototype) === null)) throwClassInstance(object, path, walk.subject);
 	step(walk, RECORD_STEP, path);
-	assertOwnPropertiesDetachable(object, path, walk, "record");
+	assertOwnPropertiesCopyable(object, path, walk, "record");
 }
 /**
 * Audits the own properties the clone would copy or drop. The clone keeps
@@ -1471,7 +200,7 @@ function assertDetachable(value, path, walk) {
 * built-in is an expando. `owner` is the kind of `object`: an array, a
 * record, or the tag of a built-in.
 */
-function assertOwnPropertiesDetachable(object, path, walk, owner) {
+function assertOwnPropertiesCopyable(object, path, walk, owner) {
 	const tag = owner === "array" || owner === "record" ? void 0 : owner;
 	const contentLength = tag === void 0 ? 0 : contentLengthOf(object, tag);
 	for (const key of Reflect.ownKeys(object)) {
@@ -1492,7 +221,7 @@ function assertOwnPropertiesDetachable(object, path, walk, owner) {
 		if (!("value" in descriptor)) throw new TypeError(`${walk.subject}${memberPath} is an accessor property; map it to plain data`);
 		if (tag !== void 0) throw new TypeError(`${walk.subject}${memberPath} is an expando on a ${constructorName(Object.getPrototypeOf(object)) ?? "built-in"} and the clone would drop it; map it to plain data`);
 		step(walk, key, memberPath);
-		assertDetachable(descriptor.value, memberPath, walk);
+		assertCopyable(descriptor.value, memberPath, walk);
 	}
 }
 /**
@@ -1547,6 +276,55 @@ function constructorName(prototype) {
 	return typeof name === "string" && name !== "" ? name : void 0;
 }
 
+//#endregion
+//#region src/internal/uuid-v7.ts
+const COUNTER_LIMIT = 2 ** 42;
+let lastMilliseconds = Number.NEGATIVE_INFINITY;
+let counter = 0;
+/**
+* RFC 9562 UUID version 7: the Unix time in milliseconds in the first 48 bits,
+* then random bits from Web Crypto. A B-tree index on such ids stays
+* clustered.
+*
+* The ids of one process sort in creation order. Ids from several processes
+* interleave within one millisecond and depend on their clocks. Within one
+* millisecond of one process, a 42-bit counter increases by one per id: the
+* 12 bits of `rand_a` and the first 30 bits of `rand_b`. It starts at a random
+* value with its top bit clear, so it does not run out in practice, also not
+* on a runtime that stops the clock during a request. If it runs out, the time
+* field moves one millisecond ahead. A clock that goes back does not move the
+* time field back. This is method 1 of RFC 9562, section 6.2.
+*/
+function uuidV7() {
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	const view = new DataView(bytes.buffer);
+	const seed = (view.getUint16(0) & 511) * 2 ** 32 + view.getUint32(2);
+	const now = Date.now();
+	if (now > lastMilliseconds) {
+		lastMilliseconds = now;
+		counter = seed;
+	} else if (counter + 1 < COUNTER_LIMIT) counter += 1;
+	else {
+		lastMilliseconds += 1;
+		counter = seed;
+	}
+	let time = lastMilliseconds;
+	for (let index = 5; index >= 0; index -= 1) {
+		bytes[index] = time % 256;
+		time = Math.floor(time / 256);
+	}
+	const counterHigh = Math.floor(counter / 2 ** 24);
+	const counterLow = counter % 2 ** 24;
+	view.setUint16(6, 28672 | counterHigh >>> 6);
+	view.setUint8(8, 128 | counterHigh & 63);
+	view.setUint8(9, counterLow >>> 16);
+	view.setUint16(10, counterLow & 65535);
+	let hex = "";
+	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
 //#endregion
 //#region src/domain/event/clock.ts
 /** Immutable library default captured by the default domain-event factory. */
@@ -1591,14 +369,14 @@ var SnapshotTimeValidationError = class extends TypeError {
 
 //#endregion
 //#region src/domain/event/domain-event.ts
-const defaultEventIdFactory = () => crypto.randomUUID();
+const defaultEventIdFactory = uuidV7;
 /**
 * Creates an immutable, instance-bound domain-event factory.
 *
 * The supplied functions are read once and captured by value. The returned
 * object is frozen, so another request, test, or library cannot replace its
 * policy. Its {@link DomainEventFactory.createStamp} method is the
-* application-shell bridge that records an accepted aggregate decision.
+* application-shell bridge that stamps an accepted aggregate decision.
 * Passing the factory through `AggregateConfig`
 * enables the explicitly named convenience methods, whose defaults read time
 * and randomness.
@@ -1609,8 +387,7 @@ const defaultEventIdFactory = () => crypto.randomUUID();
 *   eventIdFactory: () => uuidv7(),
 *   clock: () => new Date(),
 * });
-* order.confirm();
-* recordPendingEvents(order, domainEvents);
+* const uow = new UnitOfWork({ ...deps, eventStampFactory: domainEvents });
 * ```
 */
 function createDomainEventFactory(options = {}) {
@@ -1621,7 +398,7 @@ function buildDomainEventFactory(options, createOperation) {
 	const eventIdFactory = options.eventIdFactory ?? defaultEventIdFactory;
 	const clock = options.clock ?? defaultClockFactory;
 	const { source } = options;
-	const create = ((type, payload, createOptions) => mintDomainEvent(type, payload, createOptions, eventIdFactory, clock, createOperation, source));
+	const create = ((type, payload, createOptions) => buildDomainEvent(type, payload, createOptions, eventIdFactory, clock, createOperation, source));
 	const createStamp = (stampOptions = {}) => {
 		const explicitOccurredAt = stampOptions.occurredAt === void 0 ? void 0 : copyValidEventDate(stampOptions.occurredAt);
 		if (stampOptions.eventId !== void 0) assertNonBlankEventField(stampOptions.eventId, "eventId", "EVENT_ID_INVALID");
@@ -1648,49 +425,46 @@ function buildDomainEventFactory(options, createOperation) {
 * with {@link createDomainEventFactory} for custom policy.
 */
 const defaultDomainEventFactory = buildDomainEventFactory({}, "createDomainEvent");
-const RECORDED_EVENTS = /* @__PURE__ */ new WeakSet();
-const UNCOMMITTED_EVENTS = /* @__PURE__ */ new WeakSet();
+const STAMPED_EVENTS = /* @__PURE__ */ new WeakSet();
+const UNSTAMPED_EVENTS = /* @__PURE__ */ new WeakSet();
 const FACTORY_OWNED_EVENT_STAMPS = /* @__PURE__ */ new WeakSet();
-const RECORDED_BRAND = Symbol.for("@shirudo/ddd-kit.mintedEvent");
-const UNCOMMITTED_BRAND = Symbol.for("@shirudo/ddd-kit.uncommittedEvent");
-function stampRecordedBrand(event) {
-	stampCooperativeBrand(event, RECORDED_BRAND);
+const STAMPED_BRAND = Symbol.for("@shirudo/ddd-kit.mintedEvent");
+const UNSTAMPED_BRAND = Symbol.for("@shirudo/ddd-kit.uncommittedEvent");
+function brandStampedEvent(event) {
+	applyCooperativeBrand(event, STAMPED_BRAND);
 }
-function stampUncommittedBrand(event) {
-	stampCooperativeBrand(event, UNCOMMITTED_BRAND);
+function brandUnstampedEvent(event) {
+	applyCooperativeBrand(event, UNSTAMPED_BRAND);
 }
 function isFactoryOwnedDomainEventStamp(stamp) {
 	return FACTORY_OWNED_EVENT_STAMPS.has(stamp);
 }
 /**
-* Whether `event` is a recorded domain event: it came out of
-* {@link createDomainEvent}, {@link createDomainEventFromFacts}, or
-* {@link recordDomainEvent}, so it is deeply frozen with defensively copied
-* payload and metadata. An uncommitted decision carries the other brand; see
-* {@link isUncommittedDomainEvent}. Two tiers: events of THIS
+* Whether `event` is a stamped domain event: it came out of
+* {@link createDomainEvent}, {@link createStampedDomainEvent}, or
+* {@link stampDomainEvent}, so it is deeply frozen with defensively copied
+* payload and metadata. An unstamped decision carries the other brand; see
+* {@link isUnstampedDomainEvent}. Two tiers: events of THIS
 * loaded copy of the kit are verified through the module-private
-* WeakSet; events minted by ANOTHER copy (duplicate dependency, dual
+* WeakSet; events built by ANOTHER copy (duplicate dependency, dual
 * CJS/ESM load) are recognized through a cooperative `Symbol.for`
 * brand that code in the same process can fake. The gate catches
 * accidents, not adversaries. Module-internal export for the aggregate
 * recording paths; not part of the package entries.
 */
-function isRecordedDomainEvent(event) {
-	return RECORDED_EVENTS.has(event) || hasCooperativeBrand(event, RECORDED_BRAND);
-}
-/** Whether a value was created by {@link createUncommittedDomainEvent}. */
-function isUncommittedDomainEvent(event) {
-	return UNCOMMITTED_EVENTS.has(event) || hasCooperativeBrand(event, UNCOMMITTED_BRAND);
+function isStampedDomainEvent(event) {
+	return STAMPED_EVENTS.has(event) || hasCooperativeBrand(event, STAMPED_BRAND);
 }
-function createUncommittedDomainEvent(type, payload, options) {
-	return mintUncommittedDomainEvent(type, payload, options, "createUncommittedDomainEvent");
+/** Whether a value is a kit-built unstamped event. */
+function isUnstampedDomainEvent(event) {
+	return UNSTAMPED_EVENTS.has(event) || hasCooperativeBrand(event, UNSTAMPED_BRAND);
 }
 /**
-* {@link createUncommittedDomainEvent} whose errors name `operation`, the
+* {@link createUnstampedDomainEvent} whose errors name `operation`, the
 * function that the caller called. Module-internal export; not part of the
 * package entries.
 */
-function mintUncommittedDomainEvent(type, payload, options, operation) {
+function buildUnstampedDomainEvent(type, payload, options, operation) {
 	assertProducerOwnedEventFields(type, options);
 	const event = {
 		type,
@@ -1699,41 +473,41 @@ function mintUncommittedDomainEvent(type, payload, options, operation) {
 		payload: cloneOwnedEventData(payload, "payload", operation),
 		schemaVersion: options?.schemaVersion ?? 1
 	};
-	stampUncommittedBrand(event);
-	const uncommitted = deepFreeze(event);
-	UNCOMMITTED_EVENTS.add(uncommitted);
-	return uncommitted;
-}
-/** Brands and freezes a kit-derived copy of an uncommitted event. */
-function adoptUncommittedDomainEvent(copy) {
-	stampUncommittedBrand(copy);
+	brandUnstampedEvent(event);
+	const unstamped = deepFreeze(event);
+	UNSTAMPED_EVENTS.add(unstamped);
+	return unstamped;
+}
+/** Brands and freezes a kit-derived copy of an unstamped event. */
+function adoptUnstampedDomainEvent(copy) {
+	brandUnstampedEvent(copy);
 	Object.freeze(copy);
-	UNCOMMITTED_EVENTS.add(copy);
+	UNSTAMPED_EVENTS.add(copy);
 	return copy;
 }
 /**
-* Attaches shell-owned recording data to an accepted aggregate decision.
+* Attaches shell-owned stamp data to an accepted aggregate decision.
 *
 * The decision supplies the domain type, payload, source aggregate
 * identity, and payload schema version. The stamp supplies only event
-* identity, recording time, and trace metadata.
+* identity, stamp time, and trace metadata.
 */
-function recordDomainEvent(event, stamp) {
-	if (!isUncommittedDomainEvent(event)) throw new TypeError("recordDomainEvent requires an event created by createUncommittedDomainEvent");
-	if (isFactoryOwnedDomainEventStamp(stamp)) return mintRecordedEvent(event, stamp.eventId, stamp.occurredAt, stamp.metadata);
+function stampDomainEvent(event, stamp) {
+	if (!isUnstampedDomainEvent(event)) throw new TypeError("stampDomainEvent requires an unstamped event from an aggregate's createEvent");
+	if (isFactoryOwnedDomainEventStamp(stamp)) return buildStampedEvent(event, stamp.eventId, stamp.occurredAt, stamp.metadata);
 	assertNonBlankEventField(stamp.eventId, "eventId", "EVENT_ID_INVALID");
 	const occurredAt = deepFreeze(copyValidEventDate(stamp.occurredAt));
-	const metadata = ownedEventMetadata(stamp.metadata, "recordDomainEvent");
-	return mintRecordedEvent(event, stamp.eventId, occurredAt, metadata === void 0 ? void 0 : deepFreeze(metadata));
+	const metadata = ownedEventMetadata(stamp.metadata, "stampDomainEvent");
+	return buildStampedEvent(event, stamp.eventId, occurredAt, metadata === void 0 ? void 0 : deepFreeze(metadata));
 }
 /**
-* Single mint tail for both stamp provenances. The stamp fields arrive
+* Single build tail for both stamp provenances. The stamp fields arrive
 * pre-validated, copied, and frozen (by `createStamp` for factory-owned
-* stamps, by `recordDomainEvent` for caller-built stamps); the uncommitted
+* stamps, by `stampDomainEvent` for caller-built stamps); the unstamped
 * event's payload is already defensively cloned and deeply frozen by its
 * constructor and is shared instead of paying a second deep copy per event.
 */
-function mintRecordedEvent(event, eventId, occurredAt, metadata) {
+function buildStampedEvent(event, eventId, occurredAt, metadata) {
 	assertProducerOwnedEventFields(event.type, event);
 	const recorded = {
 		eventId,
@@ -1745,42 +519,42 @@ function mintRecordedEvent(event, eventId, occurredAt, metadata) {
 		schemaVersion: event.schemaVersion,
 		metadata
 	};
-	stampRecordedBrand(recorded);
+	brandStampedEvent(recorded);
 	Object.freeze(recorded);
-	RECORDED_EVENTS.add(recorded);
+	STAMPED_EVENTS.add(recorded);
 	return recorded;
 }
 /**
-* Brands, freezes, and registers a kit-derived copy of a recorded event
+* Brands, freezes, and registers a kit-derived copy of a stamped event
 * (e.g. the copy `apply()` stamps with the aggregate identity) as recorded
 * itself.
 * The copy shares the already-frozen payload/metadata of its source,
-* so the mint guarantee carries over. Stamping the cooperative brand
+* so the kit-built guarantee carries over. Applying the cooperative brand
 * before freezing keeps the copy recognizable by another loaded kit
 * instance as well as by this instance's WeakSet. Module-internal
 * export; not part of the package entries.
 */
-function adoptRecordedDomainEvent(copy) {
-	stampRecordedBrand(copy);
+function adoptStampedDomainEvent(copy) {
+	brandStampedEvent(copy);
 	Object.freeze(copy);
-	RECORDED_EVENTS.add(copy);
+	STAMPED_EVENTS.add(copy);
 	return copy;
 }
 function createDomainEvent(type, payload, options) {
 	return defaultDomainEventFactory.create(type, payload, options);
 }
-function createDomainEventFromFacts(type, payload, options) {
+function createStampedDomainEvent(type, payload, options) {
 	if (options?.eventId === void 0) missingExplicitEventId();
 	if (options.occurredAt === void 0) missingExplicitOccurredAt();
-	return mintDomainEvent(type, payload, options, missingExplicitEventId, missingExplicitOccurredAt, "createDomainEventFromFacts");
+	return buildDomainEvent(type, payload, options, missingExplicitEventId, missingExplicitOccurredAt, "createStampedDomainEvent");
 }
 function missingExplicitEventId() {
-	throw new DomainEventValidationError("EVENT_ID_REQUIRED", "eventId", "createDomainEventFromFacts requires an explicit eventId");
+	throw new DomainEventValidationError("EVENT_ID_REQUIRED", "eventId", "createStampedDomainEvent requires an explicit eventId");
 }
 function missingExplicitOccurredAt() {
-	throw new DomainEventValidationError("EVENT_OCCURRED_AT_REQUIRED", "occurredAt", "createDomainEventFromFacts requires an explicit occurredAt");
+	throw new DomainEventValidationError("EVENT_OCCURRED_AT_REQUIRED", "occurredAt", "createStampedDomainEvent requires an explicit occurredAt");
 }
-function mintDomainEvent(type, payload, options, eventIdFactory, clock, operation, factorySource) {
+function buildDomainEvent(type, payload, options, eventIdFactory, clock, operation, factorySource) {
 	assertProducerOwnedEventFields(type, options);
 	const eventId = options?.eventId ?? eventIdFactory();
 	assertNonBlankEventField(eventId, "eventId", "EVENT_ID_INVALID");
@@ -1796,10 +570,10 @@ function mintDomainEvent(type, payload, options, eventIdFactory, clock, operatio
 		schemaVersion,
 		metadata: ownedEventMetadata(options?.metadata, operation, factorySource)
 	};
-	stampRecordedBrand(event);
-	const minted = deepFreeze(event);
-	RECORDED_EVENTS.add(minted);
-	return minted;
+	brandStampedEvent(event);
+	const built = deepFreeze(event);
+	STAMPED_EVENTS.add(built);
+	return built;
 }
 function assertProducerOwnedEventFields(type, options) {
 	assertNonBlankEventField(type, "type", "EVENT_TYPE_INVALID");
@@ -1820,11 +594,11 @@ function readEventClock(clock) {
 }
 /**
 * Copies the caller's metadata and checks the copy. Metadata is a plain
-* record or absent; a null from a JSON envelope would mint and then fail
+* record or absent; a null from a JSON envelope would build and then fail
 * every metadata read far from the producer. A factory origin fills
 * `source` only after the check, and a call site that names its own source
 * keeps it: an explicit fact about one event outranks the default of the
-* factory that mints it.
+* factory that builds it.
 */
 function ownedEventMetadata(metadata, operation, factorySource) {
 	if (metadata === void 0) return factorySource === void 0 ? void 0 : { source: factorySource };
@@ -1854,12 +628,12 @@ function isPlainRecordCopy(copy) {
 /**
 * Deep-clones caller-supplied event data (payload, metadata) before the
 * event is frozen, so a constructor never freezes or aliases the caller's
-* own object graph. {@link detachFreezableState} checks the data and the
+* own object graph. {@link copyFreezableState} checks the data and the
 * clone; its JSDoc states the rule and its limits.
 */
 function cloneOwnedEventData(value, field, operation) {
-	if (value !== null && typeof value === "object") assertNoHostileOwnProtoKey(value, `Event ${field} of ${operation}`);
-	return detachFreezableState(value, `${operation}: ${field}`);
+	if (value !== null && typeof value === "object") assertNoOwnProtoKey(value, `Event ${field} of ${operation}`);
+	return copyFreezableState(value, `${operation}: ${field}`);
 }
 /**
 * Copies metadata from a source event to a new event.
@@ -1875,8 +649,8 @@ function cloneOwnedEventData(value, field, operation) {
 * ```
 */
 function copyMetadata(sourceEvent, additionalMetadata) {
-	if (sourceEvent.metadata !== void 0) assertNoHostileOwnProtoKey(sourceEvent.metadata, "Event metadata");
-	if (additionalMetadata !== void 0) assertNoHostileOwnProtoKey(additionalMetadata, "Event metadata");
+	if (sourceEvent.metadata !== void 0) assertNoOwnProtoKey(sourceEvent.metadata, "Event metadata");
+	if (additionalMetadata !== void 0) assertNoOwnProtoKey(additionalMetadata, "Event metadata");
 	return {
 		...sourceEvent.metadata ?? {},
 		...additionalMetadata ?? {}
@@ -1899,7 +673,7 @@ function mergeMetadata(...metadataObjects) {
 	const merged = {};
 	for (const metadata of metadataObjects) {
 		if (!metadata) continue;
-		assertNoHostileOwnProtoKey(metadata, "Event metadata");
+		assertNoOwnProtoKey(metadata, "Event metadata");
 		for (const key of Reflect.ownKeys(metadata)) {
 			if (!Object.getOwnPropertyDescriptor(metadata, key)?.enumerable) continue;
 			Object.defineProperty(merged, key, {
@@ -1994,7 +768,7 @@ function assertNonNegativeSafeInteger(context, field, value) {
 /** Default bound for delivery and post-commit operations. */
 const DEFAULT_EXECUTION_TIMEOUT_MS = 3e4;
 /**
-* Owner signal of each child signal that {@link runBoundedExecution} minted.
+* Owner signal of each child signal that {@link runBoundedExecution} created.
 *
 * One bounded operation often wraps another, and every hop derives a fresh
 * signal. A consumer that follows a call chain by signal identity alone loses
@@ -2299,5 +1073,5 @@ function throwIfAborted(signal) {
 }
 
 //#endregion
-export { SnapshotTimeValidationError as A, stampCooperativeBrand as B, defaultDomainEventFactory as C, mintUncommittedDomainEvent as D, mergeMetadata as E, vo as F, isBuiltInObject as G, deepOmit as H, voEquals as I, isIntrinsicConstructorPrototype as K, voEqualsExcept as L, detachState as M, ValueObject as N, recordDomainEvent as O, deepFreeze as P, voWithValidation as R, createUncommittedDomainEvent as S, isUncommittedDomainEvent as T, deepEqual as U, deepEqualExcept as V, findPropertyDescriptor as W, adoptUncommittedDomainEvent as _, isDispatchTrackingOutbox as a, createDomainEventFactory as b, runBoundedExecution as c, assertPositiveInteger as d, assertPositiveSafeInteger as f, adoptRecordedDomainEvent as g, waitRejectingOnAbort as h, assertPageWithinWindow as i, detachFreezableState as j, DomainEventValidationError as k, MAX_TIMER_DELAY_MS as l, abortReason as m, readStreamPages as n, DEFAULT_EXECUTION_TIMEOUT_MS as o, assertTimerDelay as p, isWeakMap as q, assertPageNotEmpty as r, ownerSignalOf as s, pinTargetVersion as t, assertNonNegativeSafeInteger as u, copyMetadata as v, isRecordedDomainEvent as w, createDomainEventFromFacts as x, createDomainEvent as y, hasCooperativeBrand as z };
+export { copyFreezableState as A, defaultDomainEventFactory as C, stampDomainEvent as D, mergeMetadata as E, DomainEventValidationError as O, createStampedDomainEvent as S, isUnstampedDomainEvent as T, adoptUnstampedDomainEvent as _, isDispatchTrackingOutbox as a, createDomainEvent as b, runBoundedExecution as c, assertPositiveInteger as d, assertPositiveSafeInteger as f, adoptStampedDomainEvent as g, waitRejectingOnAbort as h, assertPageWithinWindow as i, copyPlainState as j, SnapshotTimeValidationError as k, MAX_TIMER_DELAY_MS as l, abortReason as m, readStreamPages as n, DEFAULT_EXECUTION_TIMEOUT_MS as o, assertTimerDelay as p, assertPageNotEmpty as r, ownerSignalOf as s, pinTargetVersion as t, assertNonNegativeSafeInteger as u, buildUnstampedDomainEvent as v, isStampedDomainEvent as w, createDomainEventFactory as x, copyMetadata as y };
 //# sourceMappingURL=read-stream-pages.js.map