Expand description
We can enforce the invariants (see MapArray) in too many places
(both MapValue, MapRef and MapArray).
So we define the types and constructors in a separated mod
to prevent direct construction.
We only check the invariants in the constructors.
After they are constructed, we assume the invariants holds.