@shirudo/ddd-kit 3.0.0-rc.4 → 3.0.0-rc.6

package/dist/chunks/ports.js

@@ -1,8 +1,652 @@
-import { L as assertNoHostileOwnProtoKey } from "./errors.js";
-import { c as isIntrinsicConstructorPrototype, i as builtInTagWithoutInvokingAccessors, l as mutableBuiltInTagWithoutInvokingAccessors, o as hasIntrinsicPrototypeChain, r as deepEqual, t as deepEqualExcept } from "./deep-equal-except.js";
+import { J as assertNoHostileOwnProtoKey } from "./kit-errors.js";
 import { err, ok } from "@shirudo/result";
 
-//#region src/value-object/value-object.ts
+//#region src/internal/structural/is-built-in.ts
+/**
+* Set of `Object.prototype.toString.call(x)` tags that the library treats
+* as built-in atomic types. Members of this set are compared/cloned by
+* reference (or with type-specific logic) rather than walked structurally.
+*
+* Detection is tag-based, since `Object.prototype.toString` gives the same
+* answer across realms (an iframe's `Date` has the same tag as the main
+* window's `Date`), and then brand-verified via internal-slot probes,
+* because `Symbol.toStringTag` lets any plain object claim a built-in tag.
+* The previous strategy also checked `globalThis[name] === constructor`
+* and a `proto !== Object.prototype` heuristic; both broke for cross-realm
+* objects and the latter additionally misclassified ordinary user classes
+* as built-ins.
+*/
+const BUILT_IN_TAGS = /* @__PURE__ */ new Set([
+	"[object Date]",
+	"[object RegExp]",
+	"[object Map]",
+	"[object Set]",
+	"[object WeakMap]",
+	"[object WeakSet]",
+	"[object Promise]",
+	"[object Error]",
+	"[object Boolean]",
+	"[object Number]",
+	"[object String]",
+	"[object BigInt]",
+	"[object ArrayBuffer]",
+	"[object SharedArrayBuffer]",
+	"[object DataView]"
+]);
+function intrinsicGetter(proto, prop) {
+	const get = Object.getOwnPropertyDescriptor(proto, prop)?.get;
+	if (!get) throw new Error(`missing intrinsic getter for ${prop}`);
+	return get;
+}
+const dateGetTime = Date.prototype.getTime;
+const mapSizeGet = intrinsicGetter(Map.prototype, "size");
+const setSizeGet = intrinsicGetter(Set.prototype, "size");
+const weakMapHas = WeakMap.prototype.has;
+const weakSetHas = WeakSet.prototype.has;
+const dataViewByteLengthGet = intrinsicGetter(DataView.prototype, "byteLength");
+const arrayBufferByteLengthGet = intrinsicGetter(ArrayBuffer.prototype, "byteLength");
+const sharedArrayBufferByteLengthGet = typeof SharedArrayBuffer === "undefined" ? void 0 : intrinsicGetter(SharedArrayBuffer.prototype, "byteLength");
+const regExpSourceGet = intrinsicGetter(RegExp.prototype, "source");
+const booleanValueOf = Boolean.prototype.valueOf;
+const numberValueOf = Number.prototype.valueOf;
+const stringValueOf = String.prototype.valueOf;
+const bigIntValueOf = BigInt.prototype.valueOf;
+const functionToString = Function.prototype.toString;
+const PROBE_KEY = {};
+const intrinsicConstructorSources = new Map([
+	"Object",
+	"Array",
+	"Date",
+	"RegExp",
+	"Map",
+	"Set",
+	"WeakMap",
+	"WeakSet",
+	"Promise",
+	"Error",
+	"EvalError",
+	"RangeError",
+	"ReferenceError",
+	"SyntaxError",
+	"TypeError",
+	"URIError",
+	"AggregateError",
+	"Boolean",
+	"Number",
+	"String",
+	"BigInt",
+	"ArrayBuffer",
+	"SharedArrayBuffer",
+	"DataView",
+	"Int8Array",
+	"Uint8Array",
+	"Uint8ClampedArray",
+	"Int16Array",
+	"Uint16Array",
+	"Int32Array",
+	"Uint32Array",
+	"Float32Array",
+	"Float64Array",
+	"BigInt64Array",
+	"BigUint64Array"
+].flatMap((name) => {
+	const intrinsic = Object.getOwnPropertyDescriptor(globalThis, name)?.value;
+	return typeof intrinsic === "function" ? [[name, functionToString.call(intrinsic)]] : [];
+}));
+const intrinsicConstructorSourceSet = new Set(intrinsicConstructorSources.values());
+const ERROR_INTRINSIC_NAMES = [
+	"Error",
+	"EvalError",
+	"RangeError",
+	"ReferenceError",
+	"SyntaxError",
+	"TypeError",
+	"URIError",
+	"AggregateError"
+];
+function isIntrinsicConstructorPrototype(prototype, expectedName) {
+	const constructorDescriptor = Object.getOwnPropertyDescriptor(prototype, "constructor");
+	const candidateConstructor = constructorDescriptor?.value;
+	if (constructorDescriptor === void 0 || !("value" in constructorDescriptor) || typeof candidateConstructor !== "function") return false;
+	let candidateSource;
+	try {
+		candidateSource = functionToString.call(candidateConstructor);
+	} catch {
+		return false;
+	}
+	const expectedSource = expectedName === void 0 ? void 0 : intrinsicConstructorSources.get(expectedName);
+	if (expectedSource !== void 0 && candidateSource !== expectedSource || expectedSource === void 0 && !intrinsicConstructorSourceSet.has(candidateSource)) return false;
+	const nameDescriptor = Object.getOwnPropertyDescriptor(candidateConstructor, "name");
+	const candidateName = nameDescriptor !== void 0 && "value" in nameDescriptor && typeof nameDescriptor.value === "string" ? nameDescriptor.value : void 0;
+	const intrinsicName = expectedName ?? candidateName;
+	const intrinsicSource = intrinsicName === void 0 ? void 0 : intrinsicConstructorSources.get(intrinsicName);
+	return candidateName === intrinsicName && intrinsicSource !== void 0 && candidateSource === intrinsicSource && Object.getOwnPropertyDescriptor(candidateConstructor, "prototype")?.value === prototype;
+}
+/**
+* Accepts an intrinsic prototype, optionally behind transparent
+* `Symbol.toStringTag` override layers. A user-defined subclass has its own
+* non-native constructor and is therefore rejected before reaching the
+* intrinsic prototype.
+*/
+function hasIntrinsicPrototypeChain(value, expectedName) {
+	const visited = /* @__PURE__ */ new WeakSet();
+	let prototype = Object.getPrototypeOf(value);
+	while (prototype !== null && !visited.has(prototype)) {
+		visited.add(prototype);
+		if (Object.hasOwn(prototype, "constructor")) return isIntrinsicConstructorPrototype(prototype, expectedName);
+		const ownKeys = Reflect.ownKeys(prototype);
+		if (ownKeys.length !== 1 || ownKeys[0] !== Symbol.toStringTag) return false;
+		prototype = Object.getPrototypeOf(prototype);
+	}
+	return false;
+}
+/**
+* Tags that `deepEqual` compares BY REFERENCE (its unhandled-built-in
+* fallback) and that `deepOmit` must therefore ALIAS rather than clone:
+* a clone would break `deepEqualExcept(x, x)` reflexivity. Single source
+* of truth so the two modules cannot drift: if `deepEqual` ever learns a
+* by-value comparison for one of these, remove it here and add a clone
+* case in `deepOmit`'s `cloneBuiltIn` in the same change.
+*/
+const REFERENCE_COMPARED_TAGS = /* @__PURE__ */ new Set([
+	"[object Error]",
+	"[object ArrayBuffer]",
+	"[object SharedArrayBuffer]",
+	"[object Promise]",
+	"[object WeakMap]",
+	"[object WeakSet]"
+]);
+/**
+* Intrinsic tags of OPAQUE exotics: objects whose internal state no
+* structural walk can observe (boxed Symbols, generator objects,
+* WeakRefs, FinalizationRegistry handles). `deepEqual` compares them by
+* identity and `deepOmit` passes them through by reference; treating
+* them as (empty) plain objects would make ALL such exotics equal to
+* each other. Deliberately a curated INTRINSIC list, not "every unknown
+* tag": a user class exposing its own `Symbol.toStringTag` (e.g.
+* "Money") keeps structural comparison, and a plain object spoofing one
+* of these intrinsic tags gets the identity semantics of the thing it
+* claims to be.
+*/
+const OPAQUE_EXOTIC_TAGS = /* @__PURE__ */ new Set([
+	"[object Symbol]",
+	"[object Generator]",
+	"[object AsyncGenerator]",
+	"[object WeakRef]",
+	"[object FinalizationRegistry]"
+]);
+/** True when `tag` names an opaque intrinsic; see {@link OPAQUE_EXOTIC_TAGS}. */
+function isOpaqueExoticTag(tag) {
+	return OPAQUE_EXOTIC_TAGS.has(tag);
+}
+function findPropertyDescriptor(value, key) {
+	const visited = /* @__PURE__ */ new WeakSet();
+	let current = value;
+	while (current !== null && !visited.has(current)) {
+		visited.add(current);
+		const descriptor = Object.getOwnPropertyDescriptor(current, key);
+		if (descriptor !== void 0) return descriptor;
+		current = Object.getPrototypeOf(current);
+	}
+}
+function builtInTagWithoutInvokingAccessors(value) {
+	if (ArrayBuffer.isView(value)) return hasBrand(value, "[object DataView]") ? "[object DataView]" : "[object TypedArray]";
+	const descriptor = findPropertyDescriptor(value, Symbol.toStringTag);
+	if (descriptor !== void 0 && !("value" in descriptor)) return builtInTagFromBrand(value);
+	const tag = Object.prototype.toString.call(value);
+	if (BUILT_IN_TAGS.has(tag) && hasBrand(value, tag)) return tag;
+	return descriptor === void 0 ? void 0 : builtInTagFromBrand(value);
+}
+function builtInTagFromBrand(value) {
+	if (hasBrand(value, "[object Date]")) return "[object Date]";
+	if (hasBrand(value, "[object RegExp]")) return "[object RegExp]";
+	if (hasBrand(value, "[object Map]")) return "[object Map]";
+	if (hasBrand(value, "[object Set]")) return "[object Set]";
+	if (hasBrand(value, "[object WeakMap]")) return "[object WeakMap]";
+	if (hasBrand(value, "[object WeakSet]")) return "[object WeakSet]";
+	if (hasBrand(value, "[object DataView]")) return "[object DataView]";
+	if (hasBrand(value, "[object ArrayBuffer]")) return "[object ArrayBuffer]";
+	if (hasBrand(value, "[object SharedArrayBuffer]")) return "[object SharedArrayBuffer]";
+	if (hasBrand(value, "[object Boolean]")) return "[object Boolean]";
+	if (hasBrand(value, "[object Number]")) return "[object Number]";
+	if (hasBrand(value, "[object String]")) return "[object String]";
+	if (hasBrand(value, "[object BigInt]")) return "[object BigInt]";
+	if (hasNativePrototype(value, "Promise")) return "[object Promise]";
+	if (hasNativePrototype(value, "Error")) return "[object Error]";
+}
+function hasNativePrototype(value, expectedName) {
+	const visited = /* @__PURE__ */ new WeakSet();
+	let prototype = Object.getPrototypeOf(value);
+	while (prototype !== null && !visited.has(prototype)) {
+		visited.add(prototype);
+		if (isIntrinsicConstructorPrototype(prototype, expectedName)) return true;
+		prototype = Object.getPrototypeOf(prototype);
+	}
+	return false;
+}
+/**
+* Verifies that `obj` genuinely is the type its tag claims, via an
+* internal-slot probe. Promise and Error have no side-effect-free standard
+* probe, so their visible tags remain conservative; masked instances are
+* identified separately through their native prototype chain.
+*/
+function hasBrand(obj, tag) {
+	try {
+		switch (tag) {
+			case "[object Date]":
+				dateGetTime.call(obj);
+				return true;
+			case "[object RegExp]":
+				regExpSourceGet.call(obj);
+				return true;
+			case "[object Map]":
+				mapSizeGet.call(obj);
+				return true;
+			case "[object Set]":
+				setSizeGet.call(obj);
+				return true;
+			case "[object WeakMap]":
+				weakMapHas.call(obj, PROBE_KEY);
+				return true;
+			case "[object WeakSet]":
+				weakSetHas.call(obj, PROBE_KEY);
+				return true;
+			case "[object DataView]":
+				dataViewByteLengthGet.call(obj);
+				return true;
+			case "[object ArrayBuffer]":
+				arrayBufferByteLengthGet.call(obj);
+				return true;
+			case "[object SharedArrayBuffer]":
+				if (!sharedArrayBufferByteLengthGet) return false;
+				sharedArrayBufferByteLengthGet.call(obj);
+				return true;
+			case "[object Boolean]":
+				booleanValueOf.call(obj);
+				return true;
+			case "[object Number]":
+				numberValueOf.call(obj);
+				return true;
+			case "[object String]":
+				stringValueOf.call(obj);
+				return true;
+			case "[object BigInt]":
+				bigIntValueOf.call(obj);
+				return true;
+			case "[object Promise]": return hasNativePrototype(obj, "Promise");
+			case "[object Error]": return ERROR_INTRINSIC_NAMES.some((name) => hasNativePrototype(obj, name));
+			default: return false;
+		}
+	} catch {
+		return false;
+	}
+}
+/**
+* Returns `true` when `obj` is a built-in JavaScript type that should be
+* treated atomically (compared/cloned as a unit, not walked structurally).
+* Cross-realm safe, and brand-verified: a plain object spoofing a built-in
+* tag via `Symbol.toStringTag` returns `false` and is walked structurally
+* like any other plain object instead of crashing type-specific code.
+*
+* @param obj - The object to classify
+* @param tag - The result of `Object.prototype.toString.call(obj)`, passed
+*              in so callers that already computed it don't pay twice
+*/
+function isBuiltInObject(obj, tag) {
+	if (ArrayBuffer.isView(obj)) return true;
+	if (tag.endsWith("Array]")) return false;
+	return BUILT_IN_TAGS.has(tag) && hasBrand(obj, tag);
+}
+/**
+* Brand-verified `WeakMap` check that holds across realms. `instanceof
+* WeakMap` binds to the constructor of one realm, so a WeakMap from a `vm`
+* context or an iframe reads as a foreign value. The internal-slot probe
+* answers the same in every realm, and a plain object cannot spoof it
+* through `Symbol.toStringTag`.
+*/
+function isWeakMap(value) {
+	return typeof value === "object" && value !== null && hasBrand(value, "[object WeakMap]");
+}
+
+//#endregion
+//#region src/internal/structural/deep-equal.ts
+const objProto = Object.prototype;
+const objToString = objProto.toString;
+const objHasOwn = objProto.hasOwnProperty;
+/**
+* SameValueZero: `===` plus NaN-equals-NaN (and `+0 === -0`, unlike
+* `Object.is`). The numeric semantics `deepEqual` documents for primitives,
+* applied consistently inside TypedArrays, Dates and Number wrappers.
+*/
+function sameValueZero(a, b) {
+	return a === b || Number.isNaN(a) && Number.isNaN(b);
+}
+/**
+* Performs a deep equality check between two values.
+*
+* This function compares values recursively, handling:
+* - Primitives (with special handling for NaN)
+* - Arrays (nested arrays supported)
+* - Objects (plain objects and class instances)
+* - TypedArrays (Uint8Array, Int32Array, etc.)
+* - DataView
+* - Maps and Sets
+* - Dates and RegExp
+* - Wrapper objects (Boolean, Number, String)
+* - Circular references (detected and handled)
+*
+* @param a - The first value to compare
+* @param b - The second value to compare
+* @returns `true` if the values are deeply equal, `false` otherwise
+*
+* @example
+* ```ts
+* deepEqual([1, 2, 3], [1, 2, 3]); // true
+* deepEqual({ a: 1, b: [2, 3] }, { a: 1, b: [2, 3] }); // true
+* deepEqual(NaN, NaN); // true
+* deepEqual([1, 2], [1, 2, 3]); // false
+* ```
+*/
+function deepEqual(a, b) {
+	return deepEqualInner(a, b, /* @__PURE__ */ new WeakMap());
+}
+/**
+* Internal recursive function for deep equality comparison.
+*
+* @internal
+*/
+function deepEqualInner(a, b, visited) {
+	if (a === b) return true;
+	const typeA = typeof a;
+	const typeB = typeof b;
+	if (typeA !== "object" || a === null || typeB !== "object" || b === null) {
+		if (typeA === "number" && typeB === "number") return Number.isNaN(a) && Number.isNaN(b);
+		return false;
+	}
+	const objA = a;
+	const objB = b;
+	let cachedBs = visited.get(objA);
+	if (cachedBs?.has(objB)) return true;
+	if (!cachedBs) {
+		cachedBs = /* @__PURE__ */ new WeakSet();
+		visited.set(objA, cachedBs);
+	}
+	cachedBs.add(objB);
+	if (ArrayBuffer.isView(objA) || ArrayBuffer.isView(objB)) {
+		if (!ArrayBuffer.isView(objA) || !ArrayBuffer.isView(objB)) return false;
+		const tagA = objToString.call(objA);
+		if (tagA !== objToString.call(objB)) return false;
+		if (tagA === "[object DataView]") {
+			const viewA = objA;
+			const viewB = objB;
+			if (viewA.byteLength !== viewB.byteLength) return false;
+			const len = viewA.byteLength;
+			for (let i = 0; i < len; i++) if (viewA.getUint8(i) !== viewB.getUint8(i)) return false;
+			return true;
+		}
+		const arrA = objA;
+		const arrB = objB;
+		const len = arrA.length;
+		if (len !== arrB.length) return false;
+		for (let i = 0; i < len; i++) if (!sameValueZero(arrA[i], arrB[i])) return false;
+		return true;
+	}
+	if (Array.isArray(objA) || Array.isArray(objB)) {
+		if (!Array.isArray(objA) || !Array.isArray(objB)) return false;
+		if (objA.length !== objB.length) return false;
+		const keysA = Reflect.ownKeys(objA).filter((key) => key !== "length");
+		const keysB = Reflect.ownKeys(objB).filter((key) => key !== "length");
+		if (keysA.length !== keysB.length) return false;
+		const arrA = objA;
+		const arrB = objB;
+		for (const key of keysA) {
+			if (!objHasOwn.call(objB, key)) return false;
+			if (!deepEqualInner(arrA[key], arrB[key], visited)) return false;
+		}
+		return true;
+	}
+	const tagA = objToString.call(objA);
+	const tagB = objToString.call(objB);
+	if (tagA !== tagB) return false;
+	const builtInA = isBuiltInObject(objA, tagA);
+	if (builtInA !== isBuiltInObject(objB, tagB)) return false;
+	if (!builtInA) {
+		if (isOpaqueExoticTag(tagA)) return objA === objB;
+		return comparePlainObjects(objA, objB, visited);
+	}
+	switch (tagA) {
+		case "[object Map]": {
+			const mapA = objA;
+			const mapB = objB;
+			if (mapA.size !== mapB.size) return false;
+			for (const [key, valA] of mapA) {
+				if (!mapB.has(key)) return false;
+				if (!deepEqualInner(valA, mapB.get(key), visited)) return false;
+			}
+			return true;
+		}
+		case "[object Set]": {
+			const setA = objA;
+			const setB = objB;
+			if (setA.size !== setB.size) return false;
+			for (const value of setA) if (!setB.has(value)) return false;
+			return true;
+		}
+		case "[object Date]": return sameValueZero(objA.getTime(), objB.getTime());
+		case "[object RegExp]": {
+			const regA = objA;
+			const regB = objB;
+			return regA.source === regB.source && regA.flags === regB.flags;
+		}
+		case "[object Boolean]":
+		case "[object Number]":
+		case "[object String]":
+		case "[object BigInt]": return sameValueZero(objA.valueOf(), objB.valueOf());
+		default: return objA === objB;
+	}
+}
+/**
+* Plain / custom objects: compare own enumerable string keys + own symbol
+* keys and their values. Used both as the final fallback and for objects
+* whose built-in-looking tag failed brand verification.
+*/
+function comparePlainObjects(objA, objB, visited) {
+	const recA = objA;
+	const recB = objB;
+	const stringKeysA = Object.getOwnPropertyNames(objA);
+	const stringKeysB = Object.getOwnPropertyNames(objB);
+	if (stringKeysA.length !== stringKeysB.length) return false;
+	const symbolKeysA = Object.getOwnPropertySymbols(objA);
+	const symbolKeysB = Object.getOwnPropertySymbols(objB);
+	if (symbolKeysA.length !== symbolKeysB.length) return false;
+	const symbolKeysBSet = new Set(symbolKeysB);
+	for (const key of stringKeysA) if (!objHasOwn.call(objB, key)) return false;
+	for (const key of symbolKeysA) if (!symbolKeysBSet.has(key)) return false;
+	for (const key of stringKeysA) if (!deepEqualInner(recA[key], recB[key], visited)) return false;
+	for (const key of symbolKeysA) if (!deepEqualInner(recA[key], recB[key], visited)) return false;
+	return true;
+}
+
+//#endregion
+//#region src/internal/structural/deep-omit.ts
+/**
+* Creates a deep copy of `value` with certain keys removed according to the
+* provided rules.
+*
+* Walks the object tree and skips keys that match `ignoreKeys` /
+* `ignoreKeyPredicate`. Built-in atomic types that `deepEqual` compares by
+* value (Date, RegExp, Map, Set, TypedArrays, DataView) are cloned by type
+* rather than walked, since their internal structure has no key filtering to
+* apply. Types that `deepEqual` compares by reference (Error, ArrayBuffer,
+* SharedArrayBuffer, Promise, WeakMap, WeakSet) are passed through by
+* reference, so `deepEqualExcept(x, x)` stays reflexive. Cycles are
+* preserved: a cycle `a → a` clones to `a' → a'`. Arrays retain sparse
+* holes and all non-ignored own properties, including symbol keys.
+*
+* **Shared references.** Without `ignoreKeyPredicate`, an object reached
+* via several paths dedupes to a single clone. With a predicate, each
+* path gets its own clone, because the predicate may decide differently per
+* path, so memoising the first path's result would be wrong. This is
+* inherently exponential for diamond-shaped sharing (a node reachable
+* via 2^n paths is cloned 2^n times); the walk aborts with a descriptive
+* error after {@link PATH_SENSITIVE_VISIT_BUDGET} node visits instead of
+* hanging the process.
+*
+* **Prototype-pollution safety.** `__proto__` and `constructor` keys
+* encountered as *own* properties of the input (typical of `JSON.parse`
+* output) are copied as inert data properties via `Object.defineProperty`
+* so the clone graph cannot bleed into `Object.prototype`.
+*
+* **Class instances.** When the input is a class instance, the clone is
+* built via `Object.create(proto)` so the prototype is preserved, but the
+* constructor is NOT re-invoked, so class invariants enforced by the
+* constructor are not re-checked. `deepOmit` is therefore best used for
+* comparison/serialisation (`voEqualsExcept`, `deepEqualExcept`), not as
+* a general-purpose clone for behaviour-carrying objects.
+*
+* @param value - The value to create a deep copy from
+* @param options - Options specifying which keys to ignore
+* @returns A deep copy of `value` with specified keys removed
+*/
+function deepOmit(value, options) {
+	const visited = /* @__PURE__ */ new WeakMap();
+	return omitInternal(value, options, options.ignoreKeys ? new Set(options.ignoreKeys) : void 0, [], visited, options.ignoreKeyPredicate ? { visits: 0 } : void 0);
+}
+/**
+* Maximum object-node visits for a single path-sensitive `deepOmit` walk.
+* Per-path cloning expands exponentially on diamond-shaped sharing; past
+* this bound the walk throws instead of hanging the process. One million
+* visits covers any realistically tree-shaped input.
+*/
+const PATH_SENSITIVE_VISIT_BUDGET = 1e6;
+function omitInternal(value, options, ignoreKeys, path, visited, budget) {
+	if (value === null) return value;
+	if (typeof value !== "object") return value;
+	const obj = value;
+	if (visited.has(obj)) return visited.get(obj);
+	if (budget && ++budget.visits > PATH_SENSITIVE_VISIT_BUDGET) throw new Error(`deepOmit: exceeded ${PATH_SENSITIVE_VISIT_BUDGET} node visits. With ignoreKeyPredicate, objects reached via shared references are cloned once per path (the predicate may decide differently per path), which expands exponentially on diamond-shaped sharing. Restructure the input to a tree, or use ignoreKeys for path-independent filtering.`);
+	if (Array.isArray(obj)) {
+		const arr = obj;
+		const clone = new Array(arr.length);
+		const lengthDescriptor = Object.getOwnPropertyDescriptor(arr, "length");
+		visited.set(obj, clone);
+		for (const key of Reflect.ownKeys(arr)) {
+			if (key === "length") continue;
+			const segment = arrayPathSegment(key);
+			if (typeof segment !== "number" && shouldIgnoreKey(key, path, ignoreKeys, options)) continue;
+			const descriptor = Object.getOwnPropertyDescriptor(arr, key);
+			if (descriptor === void 0) continue;
+			path.push(segment);
+			if ("value" in descriptor) descriptor.value = omitInternal(descriptor.value, options, ignoreKeys, path, visited, budget);
+			Object.defineProperty(clone, key, descriptor);
+			path.pop();
+		}
+		if (lengthDescriptor !== void 0) Object.defineProperty(clone, "length", lengthDescriptor);
+		if (budget) visited.delete(obj);
+		return clone;
+	}
+	const tag = Object.prototype.toString.call(obj);
+	if (isBuiltInObject(obj, tag)) {
+		const builtInClone = cloneBuiltIn(obj, tag);
+		visited.set(obj, builtInClone);
+		return builtInClone;
+	}
+	if (isOpaqueExoticTag(tag)) {
+		visited.set(obj, obj);
+		return obj;
+	}
+	const clone = Object.create(Object.getPrototypeOf(obj));
+	visited.set(obj, clone);
+	const stringKeys = Object.getOwnPropertyNames(obj);
+	const symbolKeys = Object.getOwnPropertySymbols(obj);
+	for (const key of [...stringKeys, ...symbolKeys]) {
+		if (shouldIgnoreKey(key, path, ignoreKeys, options)) continue;
+		path.push(key);
+		assignOwn(clone, key, omitInternal(obj[key], options, ignoreKeys, path, visited, budget), Object.getOwnPropertyDescriptor(obj, key)?.enumerable ?? true);
+		path.pop();
+	}
+	if (budget) visited.delete(obj);
+	return clone;
+}
+function arrayPathSegment(key) {
+	if (typeof key === "symbol") return key;
+	const index = Number(key);
+	return Number.isInteger(index) && index >= 0 && index < 4294967295 && String(index) === key ? index : key;
+}
+/**
+* Assigns `value` as an OWN data property on `target` without going through
+* any inherited setter; critically, it never invokes the `__proto__` setter
+* even when `key === "__proto__"`. Required to defeat prototype-pollution
+* payloads that ship `__proto__` as a parsed-JSON own key.
+*/
+function assignOwn(target, key, value, enumerable = true) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable,
+		configurable: true
+	});
+}
+/**
+* Clones a built-in atomic type by case. Falls back to `structuredClone`
+* for anything not explicitly enumerated (e.g. DataView, TypedArrays,
+* Boolean/Number/String wrappers, all of which `deepEqual` compares by
+* value). Types that `deepEqual` compares BY REFERENCE (the shared
+* {@link REFERENCE_COMPARED_TAGS} set) are passed through by reference
+* instead; cloning them would make `deepEqualExcept(x, x)` false.
+* Promise/WeakMap/WeakSet additionally cannot be cloned at all
+* (`structuredClone` rejects them).
+*/
+function cloneBuiltIn(obj, tag) {
+	if (REFERENCE_COMPARED_TAGS.has(tag)) return obj;
+	switch (tag) {
+		case "[object Date]": return new Date(obj.getTime());
+		case "[object RegExp]": {
+			const re = obj;
+			const copy = new RegExp(re.source, re.flags);
+			copy.lastIndex = re.lastIndex;
+			return copy;
+		}
+		case "[object Map]": return new Map(obj);
+		case "[object Set]": return new Set(obj);
+		default: return structuredClone(obj);
+	}
+}
+function shouldIgnoreKey(key, path, ignoreKeys, options) {
+	if (ignoreKeys?.has(key)) return true;
+	if (options.ignoreKeyPredicate?.(key, path.slice())) return true;
+	return false;
+}
+
+//#endregion
+//#region src/internal/structural/deep-equal-except.ts
+/**
+* Performs a deep equality comparison between two values after omitting specified keys.
+*
+* This function first removes the specified keys from both values using `deepOmit`,
+* then performs a deep equality check using `deepEqual`.
+*
+* @param a - The first value to compare
+* @param b - The second value to compare
+* @param options - Options specifying which keys to omit before comparison
+* @returns `true` if the values are deeply equal after omitting specified keys, `false` otherwise
+*
+* @example
+* ```ts
+* const obj1 = { id: 1, name: "Alice", updatedAt: "2024-01-01" };
+* const obj2 = { id: 2, name: "Alice", updatedAt: "2024-01-02" };
+*
+* deepEqualExcept(obj1, obj2, { ignoreKeys: ["id", "updatedAt"] }); // true
+* ```
+*/
+function deepEqualExcept(a, b, options) {
+	const prunedA = deepOmit(a, options);
+	const prunedB = deepOmit(b, options);
+	return deepEqual(prunedA, prunedB);
+}
+
+//#endregion
+//#region src/domain/value-object/value-object.ts
 /**
 * `Object.freeze` does not protect internal slots: a frozen Date still
 * accepts `setTime`, a frozen Map still accepts `set`. To make the
@@ -50,12 +694,45 @@ const shadowDescriptor = {
 	enumerable: false,
 	configurable: false
 };
+/** Returns whether the shadows were installed. */
 function shadowMutators(obj, typeName, methods) {
-	if (!Object.isExtensible(obj)) return;
+	if (!Object.isExtensible(obj)) return false;
 	for (const method of methods) {
 		shadowDescriptor.value = mutationThrower(typeName, method);
 		Object.defineProperty(obj, method, shadowDescriptor);
 	}
+	return true;
+}
+const VALUE_OBJECT_CLASS = Symbol.for("@shirudo/ddd-kit/value-object-class/v1");
+function recordValueObjectClass(instance, valueObjectClass) {
+	Object.defineProperty(instance, VALUE_OBJECT_CLASS, {
+		value: valueObjectClass,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+}
+function isValueObjectInstance(value) {
+	if (value === null || typeof value !== "object") return false;
+	const record = Reflect.getOwnPropertyDescriptor(value, VALUE_OBJECT_CLASS);
+	if (record === void 0 || typeof record.value !== "function" || record.enumerable !== false || record.writable !== false || record.configurable !== false) return false;
+	const props = Reflect.getOwnPropertyDescriptor(value, "props");
+	return props !== void 0 && isSealedProps(props.value);
+}
+function isSealedProps(props) {
+	if (typeof props !== "object" || props === null) return false;
+	return Object.isFrozen(props) || builtInTagWithoutInvokingAccessors(props) === "[object RegExp]";
+}
+function looksLikeValueObject(instance) {
+	if (Object.hasOwn(instance, VALUE_OBJECT_CLASS)) return true;
+	const props = Reflect.getOwnPropertyDescriptor(instance, "props");
+	return props !== void 0 && isSealedProps(props.value);
+}
+function openValueObjectKeys(instance) {
+	return Reflect.ownKeys(instance).filter((key) => key !== "props" && key !== VALUE_OBJECT_CLASS);
+}
+function rejectValueObjectAsInput(input, entry) {
+	if (isValueObjectInstance(input)) throw new TypeError(`${entry} does not accept a value object as its input: nest the value object under a key, or pass its props`);
 }
 /**
 * Deep freezes an object and all its nested properties recursively, then
@@ -79,43 +756,80 @@ function shadowMutators(obj, typeName, methods) {
 * until the list is updated. Treat the mutator blocking as a guard rail,
 * not a security boundary.
 *
-* Limitation: ArrayBuffer views (TypedArrays, DataView) are passed through
-* unfrozen, because the spec forbids freezing a view with elements, and
-* freezing cannot protect the underlying buffer. Their contents remain mutable.
-*/
-function deepFreeze(obj, visited = /* @__PURE__ */ new WeakSet()) {
-	if (obj === null || typeof obj !== "object") return obj;
-	if (ArrayBuffer.isView(obj)) return obj;
-	if (visited.has(obj)) return obj;
-	visited.add(obj);
-	const mutableBuiltInTag = mutableBuiltInTagWithoutInvokingAccessors(obj);
-	if (mutableBuiltInTag !== void 0) {
-		if (mutableBuiltInTag === "[object Date]") shadowMutators(obj, "Date", DATE_MUTATORS);
-		else if (mutableBuiltInTag === "[object Map]") {
+* Two kinds of built-in pass through unfrozen. ArrayBuffer views
+* (TypedArrays, DataView): the spec forbids freezing a view with elements,
+* and a freeze cannot protect the underlying buffer, so their contents stay
+* mutable. RegExp: pattern and flags live in immutable internal slots, and
+* the only own data property, `lastIndex`, is scan state that every global
+* or sticky match writes. A frozen RegExp protects nothing and throws on
+* the first such match, so the RegExp keeps matching instead. A view or a
+* RegExp passes through whole: an expando property on it stays open, and
+* the walk does not enter its subtree.
+*/
+const DEEP_FROZEN = /* @__PURE__ */ new WeakSet();
+const KIT_SHADOWED = /* @__PURE__ */ new WeakSet();
+function deepFreeze(obj) {
+	const walk = {
+		cyclic: false,
+		sealed: [],
+		done: /* @__PURE__ */ new Map(),
+		inProgress: /* @__PURE__ */ new Set()
+	};
+	freezeDeep(obj, walk);
+	if (!walk.cyclic) for (const object of walk.sealed) DEEP_FROZEN.add(object);
+	return obj;
+}
+/** Freezes `obj` and its subtree; returns whether the subtree is sealed. */
+function freezeDeep(obj, walk) {
+	if (obj === null || typeof obj !== "object") return true;
+	if (DEEP_FROZEN.has(obj)) return true;
+	if (ArrayBuffer.isView(obj)) return true;
+	const finished = walk.done.get(obj);
+	if (finished !== void 0) return finished;
+	if (walk.inProgress.has(obj)) {
+		walk.cyclic = true;
+		return true;
+	}
+	const builtInTag = builtInTagWithoutInvokingAccessors(obj);
+	if (builtInTag === "[object RegExp]") return true;
+	walk.inProgress.add(obj);
+	let sealed = true;
+	if (builtInTag === "[object Date]" || builtInTag === "[object Map]" || builtInTag === "[object Set]") {
+		let shadowed = KIT_SHADOWED.has(obj);
+		if (builtInTag === "[object Date]") shadowed = shadowMutators(obj, "Date", DATE_MUTATORS) || shadowed;
+		else if (builtInTag === "[object Map]") {
 			for (const [key, value] of obj) {
-				deepFreeze(key, visited);
-				deepFreeze(value, visited);
+				if (!freezeDeep(key, walk)) sealed = false;
+				if (!freezeDeep(value, walk)) sealed = false;
 			}
-			shadowMutators(obj, "Map", [
+			shadowed = shadowMutators(obj, "Map", [
 				"set",
 				"delete",
 				"clear"
-			]);
-		} else if (mutableBuiltInTag === "[object Set]") {
-			for (const member of obj) deepFreeze(member, visited);
-			shadowMutators(obj, "Set", [
+			]) || shadowed;
+		} else if (builtInTag === "[object Set]") {
+			for (const member of obj) if (!freezeDeep(member, walk)) sealed = false;
+			shadowed = shadowMutators(obj, "Set", [
 				"add",
 				"delete",
 				"clear"
-			]);
+			]) || shadowed;
 		}
+		if (shadowed) KIT_SHADOWED.add(obj);
+		else sealed = false;
 	}
 	const keys = Reflect.ownKeys(obj);
 	for (const key of keys) {
 		const value = obj[key];
-		if (value !== null && typeof value === "object") deepFreeze(value, visited);
+		if (value !== null && typeof value === "object") {
+			if (!freezeDeep(value, walk)) sealed = false;
+		}
 	}
-	return Object.freeze(obj);
+	Object.freeze(obj);
+	walk.inProgress.delete(obj);
+	walk.done.set(obj, sealed);
+	if (sealed) walk.sealed.push(obj);
+	return sealed;
 }
 /**
 * Deep clone used by `vo()` and the `ValueObject` constructor.
@@ -126,11 +840,12 @@ function deepFreeze(obj, visited = /* @__PURE__ */ new WeakSet()) {
 * `deepEqual` DOES consider symbol keys) and shared references / cycles
 * keep their identity across Map boundaries. Function values throw,
 * preserving `vo()`'s documented data-not-behaviour gate. Built-ins without
-* immutable value semantics throw a descriptive `TypeError`. Custom class
-* instances and subclasses of built-ins are rejected because cloning them
-* without invoking their
-* constructor can silently lose private or non-enumerable state. Map keys
-* and Set members must be primitive because their equality is
+* immutable value semantics throw a descriptive `TypeError`. A kit
+* `ValueObject` instance is admitted by reference (see
+* `VALUE_OBJECT_CLASS`). Every other custom class instance and every
+* subclass of a built-in is rejected because cloning it without invoking
+* its constructor can silently lose private or non-enumerable state. Map
+* keys and Set members must be primitive because their equality is
 * identity-based and object identity cannot survive defensive cloning.
 * Accessor properties are rejected without invoking them. Admitted atomic
 * built-ins (Date, RegExp and primitive wrappers) delegate to
@@ -145,7 +860,7 @@ function cloneForVo(value, visited) {
 	if (ArrayBuffer.isView(obj)) throwUnsupportedValueSemantics(builtInTagWithoutInvokingAccessors(obj) ?? "[object ArrayBuffer view]");
 	if (visited.has(obj)) return visited.get(obj);
 	if (Array.isArray(obj)) {
-		if (!hasIntrinsicPrototypeChain(obj, "Array")) throwUnsupportedClassInstance();
+		if (!hasIntrinsicPrototypeChain(obj, "Array")) throwUnsupportedClassInstance(obj);
 		const clone = new Array(obj.length);
 		visited.set(obj, clone);
 		for (const key of Reflect.ownKeys(obj)) {
@@ -161,7 +876,7 @@ function cloneForVo(value, visited) {
 	}
 	const tag = builtInTagWithoutInvokingAccessors(obj);
 	if (tag !== void 0) {
-		if (!hasIntrinsicPrototypeChain(obj)) throwUnsupportedClassInstance();
+		if (!hasIntrinsicPrototypeChain(obj)) throwUnsupportedClassInstance(obj);
 		if (tag === "[object Map]") {
 			const clone = /* @__PURE__ */ new Map();
 			visited.set(obj, clone);
@@ -191,7 +906,14 @@ function cloneForVo(value, visited) {
 		return builtInClone;
 	}
 	const prototype = Object.getPrototypeOf(obj);
-	if (prototype !== null && (!isIntrinsicConstructorPrototype(prototype, "Object") || Object.getPrototypeOf(prototype) !== null)) throwUnsupportedClassInstance();
+	if (prototype !== null && (!isIntrinsicConstructorPrototype(prototype, "Object") || Object.getPrototypeOf(prototype) !== null)) {
+		if (isValueObjectInstance(obj)) {
+			const openKeys = openValueObjectKeys(obj);
+			if (openKeys.length > 0) throwOpenValueObjectFields(openKeys);
+			return obj;
+		}
+		throwUnsupportedClassInstance(obj);
+	}
 	const clone = Object.create(prototype === null ? null : Object.prototype);
 	visited.set(obj, clone);
 	for (const key of Reflect.ownKeys(obj)) {
@@ -208,8 +930,12 @@ function cloneForVo(value, visited) {
 	}
 	return clone;
 }
-function throwUnsupportedClassInstance() {
-	throw new TypeError("vo() cannot clone custom class instances: Value Objects are plain data");
+function throwUnsupportedClassInstance(instance) {
+	const valueObjectHint = looksLikeValueObject(instance) ? ". A value object is recognized only when a copy of this kit version built it and its props are frozen" : "";
+	throw new TypeError(`vo() cannot clone custom class instances: Value Objects are plain data${valueObjectHint}`);
+}
+function throwOpenValueObjectFields(keys) {
+	throw new TypeError(`vo() cannot nest a value object with own fields outside props (${keys.map(String).join(", ")}): keep the state of a value object in props`);
 }
 function throwUnsupportedAccessorProperty() {
 	throw new TypeError("vo() cannot clone accessor properties: Value Objects are plain data");
@@ -227,9 +953,12 @@ function isPrimitiveValue(value) {
 * The input is first deep-cloned, then the clone is frozen, so calling
 * `vo(input)` never freezes the caller's own object graph as a
 * side-effect. Mutating the input afterwards does not bleed into the VO.
-* Symbol-keyed properties are preserved (matching `voEquals`); function
-* values and custom class instances are rejected (Value Objects are plain
-* data, not behaviour-bearing object graphs). Inputs must be trusted and
+* Symbol-keyed properties are preserved (matching `voEquals`). A kit
+* `ValueObject` instance nested in the input is kept by reference and
+* frozen in place; it must keep all of its state in `props`. A value
+* object as the input itself is rejected.
+* Function values and every other custom class instance are rejected
+* (Value Objects are plain data, not behaviour-bearing object graphs). Inputs must be trusted and
 * Proxy-free: ECMAScript provides no portable way to identify a transparent
 * Proxy without potentially executing its traps, so `vo()` is not a sandbox
 * for hostile in-process objects. Built-ins that cannot provide immutable,
@@ -244,6 +973,7 @@ function isPrimitiveValue(value) {
 * ```
 */
 function vo(t) {
+	rejectValueObjectAsInput(t, "vo()");
 	return deepFreeze(cloneForVo(t, /* @__PURE__ */ new WeakMap()));
 }
 /**
@@ -284,6 +1014,11 @@ function voEquals(a, b) {
 * Useful for comparing value objects that contain metadata or optional fields
 * that should not affect equality comparison.
 *
+* The walk enters a nested `ValueObject` instance like any other object,
+* so inside it the path continues with `props`; `ignoreKeys: ["props"]`
+* empties every nested value object. The key under which the kit records
+* the class of the instance is never ignored.
+*
 * @param a - First value object
 * @param b - Second value object
 * @param options - Options specifying which keys to ignore during comparison
@@ -317,7 +1052,15 @@ function voEquals(a, b) {
 * ```
 */
 function voEqualsExcept(a, b, options) {
-	return deepEqualExcept(a, b, options);
+	return deepEqualExcept(a, b, keepValueObjectClass(options));
+}
+function keepValueObjectClass(options) {
+	const { ignoreKeys, ignoreKeyPredicate } = options;
+	return {
+		...options,
+		ignoreKeys: ignoreKeys?.filter((key) => key !== VALUE_OBJECT_CLASS),
+		ignoreKeyPredicate: ignoreKeyPredicate && ((key, path) => key !== VALUE_OBJECT_CLASS && ignoreKeyPredicate(key, path))
+	};
 }
 /**
 * Creates a value object with optional validation.
@@ -366,7 +1109,11 @@ function describeValue(value) {
 }
 /**
 * Abstract base class for creating Value Objects.
-* Value Objects are immutable and defined by their properties.
+* Value Objects are immutable and defined by their properties. A value
+* object can hold other value objects in its props. Every instance
+* records its class under an own symbol key, so `equals` compares a
+* nested value object by class and props and does not call its `equals`
+* method.
 *
 * @template T - The shape of the value object's properties
 */
@@ -393,8 +1140,10 @@ var ValueObject = class {
 	* ```
 	*/
 	constructor(props) {
+		rejectValueObjectAsInput(props, "new ValueObject()");
 		this.validate(props);
 		this.props = deepFreeze(cloneForVo(props, /* @__PURE__ */ new WeakMap()));
+		recordValueObjectClass(this, this.constructor);
 	}
 	/**
 	* Optional validation hook that can be overridden by subclasses.
@@ -452,7 +1201,54 @@ var ValueObject = class {
 };
 
 //#endregion
-//#region src/aggregate/clock.ts
+//#region src/internal/cooperative-brand.ts
+/**
+* A cooperative brand marks an object that a kit constructor produced, so
+* a second loaded copy of the kit (duplicate npm dependency, dual CJS/ESM
+* load, plugin bundle) recognizes it. A module-private WeakSet cannot do
+* that: it is bound to one loaded copy. The brand is a `Symbol.for` key
+* with the value `true`. The property is non-enumerable, so it never
+* leaks into spreads, JSON, or equality, and non-writable and
+* non-configurable, so nothing edits it after the stamp.
+*
+* The probe reads the brand as an OWN property with exactly these
+* attributes and requires the carrier to be frozen. An object that
+* inherits a branded object through its prototype can carry mutable own
+* overrides; a branded object that is still open can change after the
+* stamp. Neither is what the constructor produced. Every stamp site
+* therefore freezes the carrier right after {@link stampCooperativeBrand}.
+*
+* The brand is forgeable BY DESIGN. It catches accidental hand-rolled
+* literals; it is not a security boundary against code in the same
+* process that fakes it on purpose.
+*
+* Internal utility (not exported from the package barrels).
+*/
+function stampCooperativeBrand(target, brand) {
+	Object.defineProperty(target, brand, {
+		value: true,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+}
+/**
+* Whether `value` carries `brand` as an own, non-enumerable, non-writable,
+* non-configurable `true` and is frozen. A Proxy trap that throws reads
+* as unbranded.
+*/
+function hasCooperativeBrand(value, brand) {
+	if (value === null || typeof value !== "object" && typeof value !== "function") return false;
+	try {
+		const marker = Reflect.getOwnPropertyDescriptor(value, brand);
+		return marker?.value === true && marker.enumerable === false && marker.writable === false && marker.configurable === false && Object.isFrozen(value);
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/domain/event/clock.ts
 /** Immutable library default captured by the default domain-event factory. */
 const defaultClockFactory = () => /* @__PURE__ */ new Date();
 /** Internal defensive event-clock read. */
@@ -464,7 +1260,7 @@ function readClock(factory) {
 }
 
 //#endregion
-//#region src/aggregate/domain-event-errors.ts
+//#region src/domain/event/domain-event-errors.ts
 /**
 * Stable contract error for malformed domain-event data.
 *
@@ -494,7 +1290,7 @@ var SnapshotTimeValidationError = class extends TypeError {
 };
 
 //#endregion
-//#region src/aggregate/domain-event.ts
+//#region src/domain/event/domain-event.ts
 const defaultEventIdFactory = () => crypto.randomUUID();
 /**
 * Creates an immutable, instance-bound domain-event factory.
@@ -517,20 +1313,39 @@ const defaultEventIdFactory = () => crypto.randomUUID();
 * recordPendingEvents(order, domainEvents);
 * ```
 */
+/**
+* Fills the origin of a factory into options that name none.
+*
+* A call site that states its own source keeps it: an explicit fact about one
+* event outranks the default of the factory that mints it.
+*/
+function withFactorySource(options, source) {
+	const given = options ?? {};
+	if (source === void 0 || given.metadata?.source !== void 0) return given;
+	return {
+		...given,
+		metadata: {
+			...given.metadata,
+			source
+		}
+	};
+}
 function createDomainEventFactory(options = {}) {
 	const eventIdFactory = options.eventIdFactory ?? defaultEventIdFactory;
 	const clock = options.clock ?? defaultClockFactory;
-	const create = ((type, payload, createOptions) => mintDomainEvent(type, payload, createOptions, eventIdFactory, clock));
+	const { source } = options;
+	const create = ((type, payload, createOptions) => mintDomainEvent(type, payload, withFactorySource(createOptions, source), eventIdFactory, clock));
 	const createStamp = (stampOptions = {}) => {
 		const explicitOccurredAt = stampOptions.occurredAt === void 0 ? void 0 : copyValidEventDate(stampOptions.occurredAt);
 		if (stampOptions.eventId !== void 0) assertNonBlankEventField(stampOptions.eventId, "eventId", "EVENT_ID_INVALID");
 		const eventId = stampOptions.eventId ?? eventIdFactory();
 		assertNonBlankEventField(eventId, "eventId", "EVENT_ID_INVALID");
-		const owned = deepFreeze({
+		const stamp = {
 			eventId,
 			occurredAt: explicitOccurredAt ?? readEventClock(clock),
-			metadata: guardedMetadataClone(stampOptions.metadata)
-		});
+			metadata: cloneOwnedEventData(withFactorySource(stampOptions, source).metadata, "metadata")
+		};
+		const owned = deepFreeze(stamp);
 		FACTORY_OWNED_EVENT_STAMPS.add(owned);
 		return owned;
 	};
@@ -548,7 +1363,7 @@ function createDomainEventFactory(options = {}) {
 const defaultDomainEventFactory = createDomainEventFactory();
 /**
 * Creates a domain event with default values.
-* Sets occurredAt to current date and version to 1 if not provided.
+* Sets occurredAt to current date and schemaVersion to 1 if not provided.
 *
 * **Input ownership.** The event is deeply frozen, and `payload` and
 * `metadata` are deep-cloned first, so the caller's own objects are never
@@ -559,14 +1374,14 @@ const defaultDomainEventFactory = createDomainEventFactory();
 * over.
 *
 * **For aggregate-internal events, prefer `this.createEvent(...)` on
-* `AggregateRoot` / `EventSourcedAggregate`.** That helper auto-injects
+* `StateStoredAggregate` / `EventSourcedAggregate`.** That helper auto-injects
 * `aggregateId` (from `this.id`) and `aggregateType` (from the
 * aggregate's declared `aggregateType` property), which downstream
 * consumers (outbox dispatchers, projection handlers, audit logs)
-* route by. The `withCommit` harvest boundary now validates both fields
-* are present and throws if they're missing, so a direct
-* `createDomainEvent(...)` call inside an aggregate that forgets the
-* options is caught at runtime. Record pending decisions in the application
+* route by. The commit boundary validates that both fields are present
+* and throws if they are missing, so a direct `createDomainEvent(...)`
+* call inside an aggregate that forgets the options is caught at
+* runtime. Record pending decisions in the application
 * shell before repository persistence or outbox harvest.
 *
 * Use `createDomainEvent(...)` directly for events that don't belong to
@@ -585,46 +1400,39 @@ const defaultDomainEventFactory = createDomainEventFactory();
 * const event = createDomainEvent("OrderCreated", { orderId: "123" });
 * ```
 */
-const MINTED_EVENTS = /* @__PURE__ */ new WeakSet();
+const RECORDED_EVENTS = /* @__PURE__ */ new WeakSet();
 const UNCOMMITTED_EVENTS = /* @__PURE__ */ new WeakSet();
 const FACTORY_OWNED_EVENT_STAMPS = /* @__PURE__ */ new WeakSet();
-const MINT_BRAND = Symbol.for("@shirudo/ddd-kit.mintedEvent");
+const RECORDED_BRAND = Symbol.for("@shirudo/ddd-kit.mintedEvent");
 const UNCOMMITTED_BRAND = Symbol.for("@shirudo/ddd-kit.uncommittedEvent");
-function stampMintBrand(event) {
-	Object.defineProperty(event, MINT_BRAND, {
-		value: true,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
+function stampRecordedBrand(event) {
+	stampCooperativeBrand(event, RECORDED_BRAND);
 }
 function stampUncommittedBrand(event) {
-	Object.defineProperty(event, UNCOMMITTED_BRAND, {
-		value: true,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
+	stampCooperativeBrand(event, UNCOMMITTED_BRAND);
 }
 function isFactoryOwnedDomainEventStamp(stamp) {
 	return FACTORY_OWNED_EVENT_STAMPS.has(stamp);
 }
 /**
-* Whether `event` came out of {@link createDomainEvent} (or a helper
-* built on it, such as the aggregate `createEvent` helper), i.e. is deeply frozen with
-* defensively copied payload and metadata. Two tiers: events of THIS
-* loaded copy of the kit are verified unforgeably via the module's
+* Whether `event` is a recorded domain event: it came out of
+* {@link createDomainEvent}, {@link createDomainEventFromFacts}, or
+* {@link recordDomainEvent}, so it is deeply frozen with defensively copied
+* payload and metadata. An uncommitted decision carries the other brand; see
+* {@link isUncommittedDomainEvent}. Two tiers: events of THIS
+* loaded copy of the kit are verified through the module-private
 * WeakSet; events minted by ANOTHER copy (duplicate dependency, dual
-* CJS/ESM load) are recognized cooperatively via a global-registry
-* brand. Module-internal export for the aggregate recording paths;
-* not part of the package entries.
+* CJS/ESM load) are recognized through a cooperative `Symbol.for`
+* brand that code in the same process can fake. The gate catches
+* accidents, not adversaries. Module-internal export for the aggregate
+* recording paths; not part of the package entries.
 */
-function isMintedEvent(event) {
-	return MINTED_EVENTS.has(event) || event[MINT_BRAND] === true;
+function isRecordedDomainEvent(event) {
+	return RECORDED_EVENTS.has(event) || hasCooperativeBrand(event, RECORDED_BRAND);
 }
 /** Whether a value was created by {@link createUncommittedDomainEvent}. */
 function isUncommittedDomainEvent(event) {
-	return UNCOMMITTED_EVENTS.has(event) || event[UNCOMMITTED_BRAND] === true;
+	return UNCOMMITTED_EVENTS.has(event) || hasCooperativeBrand(event, UNCOMMITTED_BRAND);
 }
 function createUncommittedDomainEvent(type, payload, options) {
 	assertProducerOwnedEventFields(type, options);
@@ -633,7 +1441,7 @@ function createUncommittedDomainEvent(type, payload, options) {
 		aggregateId: options?.aggregateId,
 		aggregateType: options?.aggregateType,
 		payload: cloneOwnedEventData(payload, "payload"),
-		version: options?.version ?? 1
+		schemaVersion: options?.schemaVersion ?? 1
 	};
 	stampUncommittedBrand(event);
 	const uncommitted = deepFreeze(event);
@@ -659,7 +1467,7 @@ function recordDomainEvent(event, stamp) {
 	if (isFactoryOwnedDomainEventStamp(stamp)) return mintRecordedEvent(event, stamp.eventId, stamp.occurredAt, stamp.metadata);
 	assertNonBlankEventField(stamp.eventId, "eventId", "EVENT_ID_INVALID");
 	const occurredAt = deepFreeze(copyValidEventDate(stamp.occurredAt));
-	const metadata = guardedMetadataClone(stamp.metadata);
+	const metadata = cloneOwnedEventData(stamp.metadata, "metadata");
 	return mintRecordedEvent(event, stamp.eventId, occurredAt, metadata === void 0 ? void 0 : deepFreeze(metadata));
 }
 /**
@@ -678,27 +1486,27 @@ function mintRecordedEvent(event, eventId, occurredAt, metadata) {
 		aggregateType: event.aggregateType,
 		payload: event.payload,
 		occurredAt,
-		version: event.version,
+		schemaVersion: event.schemaVersion,
 		metadata
 	};
-	stampMintBrand(recorded);
+	stampRecordedBrand(recorded);
 	Object.freeze(recorded);
-	MINTED_EVENTS.add(recorded);
+	RECORDED_EVENTS.add(recorded);
 	return recorded;
 }
 /**
-* Brands, freezes, and registers a kit-derived copy of a minted event
-* (e.g. the address-stamped copy `apply()` creates) as minted itself.
+* Brands, freezes, and registers a kit-derived copy of a recorded event
+* (e.g. the address-stamped copy `apply()` creates) as recorded itself.
 * The copy shares the already-frozen payload/metadata of its source,
 * so the mint guarantee carries over. Stamping the cooperative brand
 * before freezing keeps the copy recognizable by another loaded kit
 * instance as well as by this instance's WeakSet. Module-internal
 * export; not part of the package entries.
 */
-function adoptMintedEvent(copy) {
-	stampMintBrand(copy);
+function adoptRecordedDomainEvent(copy) {
+	stampRecordedBrand(copy);
 	Object.freeze(copy);
-	MINTED_EVENTS.add(copy);
+	RECORDED_EVENTS.add(copy);
 	return copy;
 }
 function createDomainEvent(type, payload, options) {
@@ -720,7 +1528,7 @@ function mintDomainEvent(type, payload, options, eventIdFactory, clock) {
 	const eventId = options?.eventId ?? eventIdFactory();
 	assertNonBlankEventField(eventId, "eventId", "EVENT_ID_INVALID");
 	const occurredAt = options?.occurredAt === void 0 ? readEventClock(clock) : copyValidEventDate(options.occurredAt);
-	const version = options?.version ?? 1;
+	const schemaVersion = options?.schemaVersion ?? 1;
 	const event = {
 		eventId,
 		type,
@@ -728,18 +1536,18 @@ function mintDomainEvent(type, payload, options, eventIdFactory, clock) {
 		aggregateType: options?.aggregateType,
 		payload: cloneOwnedEventData(payload, "payload"),
 		occurredAt,
-		version,
-		metadata: guardedMetadataClone(options?.metadata)
+		schemaVersion,
+		metadata: cloneOwnedEventData(options?.metadata, "metadata")
 	};
-	stampMintBrand(event);
+	stampRecordedBrand(event);
 	const minted = deepFreeze(event);
-	MINTED_EVENTS.add(minted);
+	RECORDED_EVENTS.add(minted);
 	return minted;
 }
 function assertProducerOwnedEventFields(type, options) {
 	assertNonBlankEventField(type, "type", "EVENT_TYPE_INVALID");
-	const version = options?.version ?? 1;
-	if (!Number.isSafeInteger(version) || typeof version !== "number" || version < 1) throw new DomainEventValidationError("EVENT_SCHEMA_VERSION_INVALID", "version", "domain-event version must be a safe integer greater than or equal to 1");
+	const schemaVersion = options?.schemaVersion ?? 1;
+	if (!Number.isSafeInteger(schemaVersion) || typeof schemaVersion !== "number" || schemaVersion < 1) throw new DomainEventValidationError("EVENT_SCHEMA_VERSION_INVALID", "schemaVersion", "domain-event schemaVersion must be a safe integer greater than or equal to 1");
 	if (options?.aggregateId !== void 0) assertNonBlankEventField(options.aggregateId, "aggregateId", "EVENT_ADDRESS_INVALID");
 	if (options?.aggregateType !== void 0) assertNonBlankEventField(options.aggregateType, "aggregateType", "EVENT_ADDRESS_INVALID");
 }
@@ -766,7 +1574,9 @@ function readEventClock(clock) {
 */
 function cloneOwnedEventData(value, field) {
 	if (typeof value === "function") throw new TypeError(`createDomainEvent: ${field} must not be a function: domain events are plain data`);
+	if (value === null && field === "metadata") throw new TypeError("createDomainEvent: metadata must be an object or undefined; received null");
 	if (value === null || typeof value !== "object") return value;
+	assertNoHostileOwnProtoKey(value, field === "payload" ? "Event payload" : "Event metadata");
 	assertNoBinaryData(value, field);
 	try {
 		return structuredClone(value);
@@ -815,7 +1625,7 @@ function assertNoBinaryData(value, field, visited = /* @__PURE__ */ new WeakSet(
 * const newEvent = createDomainEvent(
 *   "OrderShipped",
 *   { orderId: "123" },
-*   { metadata: copyMetadata(previousEvent, { causationId: previousEvent.type }) }
+*   { metadata: copyMetadata(previousEvent, { causationId: previousEvent.eventId }) }
 * );
 * ```
 */
@@ -857,19 +1667,9 @@ function mergeMetadata(...metadataObjects) {
 	}
 	return merged;
 }
-/**
-* Clones event metadata with the loud `__proto__` rejection applied at
-* the SOURCE: structuredClone preserves an own `__proto__` data key, so
-* without this guard a hostile envelope would ride into the frozen
-* event and re-arm downstream.
-*/
-function guardedMetadataClone(metadata) {
-	if (metadata !== void 0) assertNoHostileOwnProtoKey(metadata, "Event metadata");
-	return cloneOwnedEventData(metadata, "metadata");
-}
 
 //#endregion
-//#region src/events/ports.ts
+//#region src/messaging/outbox/ports.ts
 /**
 * Discriminates a {@link DispatchTrackingOutbox} from a plain
 * {@link Outbox} at runtime. The single source of truth for the check;
@@ -887,5 +1687,5 @@ function isDispatchTrackingOutbox(outbox) {
 }
 
 //#endregion
-export { deepFreeze as _, createDomainEvent as a, voEqualsExcept as b, createUncommittedDomainEvent as c, isUncommittedDomainEvent as d, mergeMetadata as f, ValueObject as g, SnapshotTimeValidationError as h, copyMetadata as i, defaultDomainEventFactory as l, DomainEventValidationError as m, adoptMintedEvent as n, createDomainEventFactory as o, recordDomainEvent as p, adoptUncommittedDomainEvent as r, createDomainEventFromFacts as s, isDispatchTrackingOutbox as t, isMintedEvent as u, vo as v, voWithValidation as x, voEquals as y };
+export { isBuiltInObject as A, voWithValidation as C, builtInTagWithoutInvokingAccessors as D, deepEqual as E, isWeakMap as M, findPropertyDescriptor as O, voEqualsExcept as S, deepOmit as T, stampCooperativeBrand as _, createDomainEvent as a, vo as b, createUncommittedDomainEvent as c, isUncommittedDomainEvent as d, mergeMetadata as f, hasCooperativeBrand as g, SnapshotTimeValidationError as h, copyMetadata as i, isIntrinsicConstructorPrototype as j, hasIntrinsicPrototypeChain as k, defaultDomainEventFactory as l, DomainEventValidationError as m, adoptRecordedDomainEvent as n, createDomainEventFactory as o, recordDomainEvent as p, adoptUncommittedDomainEvent as r, createDomainEventFromFacts as s, isDispatchTrackingOutbox as t, isRecordedDomainEvent as u, ValueObject as v, deepEqualExcept as w, voEquals as x, deepFreeze as y };
 //# sourceMappingURL=ports.js.map