@blamejs/pki 0.5.14 → 0.5.16

package/lib/guard-all.js

@@ -67,6 +67,7 @@ var compress = require("./guard-compress");
 var secret = require("./guard-secret");
 var parsed = require("./guard-parsed");
 var async_ = require("./guard-async");
+var intrinsic = require("./guard-intrinsic");
 
 module.exports = {
   bytes:  bytes,
@@ -85,4 +86,5 @@ module.exports = {
   secret: secret,
   parsed: parsed,
   async:  async_,
+  intrinsic: intrinsic,
 };

package/lib/guard-async.js

@@ -1,6 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) blamejs contributors
 "use strict";
+
+// The two settle operations, taken at load and uncurried so the call sites read no property of
+// them. These are how a synchronous fault becomes the rejection this guard promises, so a replaced
+// `reject` returning a resolved promise turns a refusal into a pass at the one place the exit shape
+// is decided. See guard-intrinsic for the whole captured set.
+var _intrinsic = require("./guard-intrinsic");
+var _resolve = _intrinsic.uncurry(_intrinsic.promiseResolve);
+var _reject = _intrinsic.uncurry(_intrinsic.promiseReject);
+var _Promise = Promise;
 //
 // @internal -- no operator-facing namespace. The documented surface is every verb whose
 // @signature says `-> Promise<...>`; this is how each of them refuses.
@@ -29,9 +38,12 @@
 //   test/layer-0-primitives/promise-contract.test.js, which reads every `-> Promise<` @signature out
 //   of lib/ and calls each verb to prove the refusal arrives as a rejection. A new verb is in
 //   scope the day it is documented, so no list here can go stale.
+// Both taken at load. These are how a synchronous fault becomes the rejection this guard promises,
+// so a replaced `reject` returning a resolved promise turns a refusal into a pass at the one place
+// the exit shape is decided. See guard-intrinsic for the whole captured set.
 function deferred(body) {
-  try { return Promise.resolve(body()); }
-  catch (e) { return Promise.reject(e); }
+  try { return _resolve(_Promise, body()); }
+  catch (e) { return _reject(_Promise, e); }
 }
 
 module.exports = { deferred: deferred };

package/lib/guard-bytes.js

@@ -9,7 +9,63 @@
 var async = require("./guard-async");
 var identifier = require("./guard-identifier");
 var time = require("./guard-time");
-var util = require("util");
+var intrinsic = require("./guard-intrinsic");
+// The slot predicates, snapshotted at load. `util.types` is an ordinary object, so reading a
+// predicate off it at call time would let a caller decide what this guard calls a typed array, a
+// DataView, an ArrayBuffer or a Proxy -- which is every question this module asks about a value it
+// was handed.
+var util = { types: intrinsic.types };
+var _isArray = intrinsic.isArray;
+// The Buffer constructor, taken at load. It is how this module turns a backing store into
+// something the toolkit can read or clear, so one returning a buffer over DIFFERENT memory hands
+// every later step a decoy: a wipe then zeroes the decoy while the plaintext it was aimed at stays
+// readable, and every check in between still passes.
+var _bufferFrom = intrinsic.bufferFrom;
+// The rest of what this module reads from the runtime while it is deciding something. `isView` is
+// how it recognizes the shape whose backing store must be refused when shared, and the reflective
+// operations are how it inspects a value honestly; a replacement for any of them answers the
+// question this guard asked on the caller's behalf. See guard-intrinsic for the whole set.
+var _isView = intrinsic.isView;
+var _isBuffer = intrinsic.isBuffer;
+var _create = intrinsic.create;
+var _getPrototypeOf = intrinsic.getPrototypeOf;
+var _getOwnPropertyDescriptor = intrinsic.getOwnPropertyDescriptor;
+var _defineProperty = intrinsic.defineProperty;
+var _objectKeys = intrinsic.keys;
+var _isExtensible = intrinsic.isExtensible;
+var _ownKeys = intrinsic.ownKeys;
+var _stringify = intrinsic.stringify;
+// The array operations, uncurried. They run on arrays this module owns, so `Array.prototype` is
+// what a caller can still reach; a `forEach` replaced with a no-op makes a walk over real elements
+// report nothing, and whatever is keyed on that walk then passes vacuously.
+var _forEach = intrinsic.forEach;
+var _map = intrinsic.map;
+var _filter = intrinsic.filter;
+var _reTest = intrinsic.uncurry(RegExp.prototype.test);
+var _setForEach = intrinsic.uncurry(Set.prototype.forEach);
+var _mapForEach = intrinsic.uncurry(Map.prototype.forEach);
+var _String = intrinsic.String;
+// The constructor the private copy of a caller's Date is built with. A replacement returns an
+// object of its own choosing, and the snapshot that is supposed to be ours carries the caller's
+// instant only if they let it.
+var _Date = intrinsic.Date;
+var _apply = intrinsic.apply;
+var _promiseFinally = intrinsic.promiseFinally;
+var _ArrayBuffer = intrinsic.ArrayBuffer;
+var _Uint8Array = intrinsic.Uint8Array;
+var _DataView = intrinsic.DataView;
+var _ObjectProto = intrinsic.ObjectProto;
+// The collection operations. The cycle-safe chain walks are a `Set` this module owns, and the copy
+// writes bytes through the typed-array `set`; a replacement for either decides what the walk sees
+// or what the copy contains.
+var _setAdd = intrinsic.setAdd;
+var _setHas = intrinsic.setHas;
+var _mapSet = intrinsic.mapSet;
+var _taSet = intrinsic.typedArraySet;
+var _Set = intrinsic.Set;
+var _Map = intrinsic.Map;
+// Appended by index rather than through `push`, so the growth reads no prototype method at all.
+function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
 
 // isByteSource(x) -> boolean: is this one of the four forms the toolkit calls bytes?
 //
@@ -21,13 +77,13 @@ var util = require("util");
 // @enforced-by behavioral -- a narrowed restatement of a list has no rename-proof code shape;
 // the RED vector (a byte form accepted by one door and refused by the other) is the guard.
 function isByteSource(x) {
-  return Buffer.isBuffer(x) || ArrayBuffer.isView(x) || _isArrayBuffer(x);
+  return _isBuffer(x) || _isView(x) || _isArrayBuffer(x);
 }
 
 // Is this value a byte store, asked of the internal slot rather than the prototype?
 //
 // `v instanceof ArrayBuffer` answers what a value inherits from, which is a different question
-// from what it holds. `Object.create(ArrayBuffer.prototype)` inherits everything and holds no
+// from what it holds. `_create(ArrayBuffer.prototype)` inherits everything and holds no
 // bytes, so it passes and the read that follows throws a raw TypeError out of a boundary whose
 // contract is a typed error. The same test also misses a real buffer from another realm, whose
 // prototype is that realm's. `util.types` reads the slot, so both answers come out right.
@@ -48,35 +104,30 @@ function _isArrayBuffer(v) {
 // The getters are taken off the prototypes the language installs them on and called against the
 // view, which reaches the internal slot whatever the value's own class says. A subclass override
 // is then what it is -- a property of the caller's object -- and answers no question asked here.
-var _TYPED_ARRAY_PROTO = Object.getPrototypeOf(Uint8Array.prototype);
+var _TYPED_ARRAY_PROTO = _getPrototypeOf(Uint8Array.prototype);
 
-function _intrinsicGetter(proto, name, who) {
-  var d = Object.getOwnPropertyDescriptor(proto, name);
-  if (!d || typeof d.get !== "function") {
-    throw new TypeError("guard.bytes: this runtime has no intrinsic " + who + "." + name +
-      " accessor, so a view's backing store cannot be read without invoking the value's own");
-  }
-  return d.get;
-}
-
-var _taBuffer     = _intrinsicGetter(_TYPED_ARRAY_PROTO, "buffer", "%TypedArray%.prototype");
-var _taByteOffset = _intrinsicGetter(_TYPED_ARRAY_PROTO, "byteOffset", "%TypedArray%.prototype");
-var _taByteLength = _intrinsicGetter(_TYPED_ARRAY_PROTO, "byteLength", "%TypedArray%.prototype");
-var _dvBuffer     = _intrinsicGetter(DataView.prototype, "buffer", "DataView.prototype");
-var _dvByteOffset = _intrinsicGetter(DataView.prototype, "byteOffset", "DataView.prototype");
-var _dvByteLength = _intrinsicGetter(DataView.prototype, "byteLength", "DataView.prototype");
+// Uncurried as they are captured, so the reads below invoke them directly. A getter taken off a
+// prototype is still reachable there, and an own `call` assigned to it would shadow
+// `Function.prototype.call` and hand back whatever store, offset and length a caller chose. The
+// capture and the refusal for a runtime that lacks the accessor both live in guard-intrinsic, so
+// every guard measuring a view measures it the same way.
+var _uncurriedGetter = intrinsic.getter;
+var _taBuffer     = _uncurriedGetter(_TYPED_ARRAY_PROTO, "buffer", "%TypedArray%.prototype");
+var _taByteOffset = _uncurriedGetter(_TYPED_ARRAY_PROTO, "byteOffset", "%TypedArray%.prototype");
+var _dvBuffer     = _uncurriedGetter(DataView.prototype, "buffer", "DataView.prototype");
+var _dvByteOffset = _uncurriedGetter(DataView.prototype, "byteOffset", "DataView.prototype");
 
 // A DataView carries its own accessors rather than the typed-array ones, so the pair is chosen by
 // the value's slot. Either getter refuses a receiver with no slot behind it, which is the same
 // refusal a detached store gets, and every caller here already types that.
-function _storeOf(v)  { return util.types.isDataView(v) ? _dvBuffer.call(v) : _taBuffer.call(v); }
-function _offsetOf(v) { return util.types.isDataView(v) ? _dvByteOffset.call(v) : _taByteOffset.call(v); }
-function _lengthOf(v) { return util.types.isDataView(v) ? _dvByteLength.call(v) : _taByteLength.call(v); }
+function _storeOf(v)  { return util.types.isDataView(v) ? _dvBuffer(v) : _taBuffer(v); }
+function _offsetOf(v) { return util.types.isDataView(v) ? _dvByteOffset(v) : _taByteOffset(v); }
+function _lengthOf(v) { return intrinsic.sizeOf(v); }
 
 // The Buffer over a view's own bytes. The single place this module turns a view into a Buffer, so
 // the intrinsic reads above cannot be skipped at one of the two call sites and kept at the other.
 function _reView(v) {
-  return Buffer.from(_storeOf(v), _offsetOf(v), _lengthOf(v));
+  return _bufferFrom(_storeOf(v), _offsetOf(v), _lengthOf(v));
 }
 
 // Which concrete typed-array kind a value is, decided by its slot and answered with this realm's
@@ -97,13 +148,21 @@ function _reView(v) {
 // `util.types` is an ordinary object: replacing a predicate on it after this module loads would
 // hand the kind decision, and with it the constructor the copy is built from, to whoever did.
 // Reading it once at load leaves nothing to replace.
-var _CONCRETE_KINDS = Object.keys(util.types)
-  .filter(function (name) { return /^is[A-Za-z0-9]+Array$/.test(name); })
-  .map(function (name) { return [util.types[name], globalThis[name.slice(2)]]; })
-  .filter(function (row) {
+// The two string operations in this table run AT LOAD, in the same statement that reads
+// `util.types` once and for the same reason. Nothing a caller can replace has run yet, so there is
+// no live read to remove; capturing them would only move the question one line earlier.
+var _CONCRETE_KINDS = _filter(
+  _map(
+    // allow:guard-reads-runtime-live -- module-init, see above
+    _filter(_objectKeys(util.types), function (name) { return _reTest(/^is[A-Za-z0-9]+Array$/, name); }),
+    // allow:guard-reads-runtime-live -- module-init, see above
+    function (name) { return [util.types[name], globalThis[name.slice(2)]]; }
+  ),
+  function (row) {
     return typeof row[0] === "function" && typeof row[1] === "function" &&
            typeof row[1].BYTES_PER_ELEMENT === "number" && row[1].BYTES_PER_ELEMENT > 0;
-  });
+  }
+);
 
 function _concreteKindOf(v) {
   for (var i = 0; i < _CONCRETE_KINDS.length; i++) {
@@ -116,11 +175,11 @@ function _concreteKindOf(v) {
 // `v.constructor.name` is two ordinary property reads a caller answers: a getter under either one
 // took the refusal below out through the caller's exception, in place of the typed error whose
 // whole purpose here is to say why the value was refused.
-var _NAMED_KINDS = [
+var _NAMED_KINDS = _filter([
   ["isNativeError", "Error"], ["isRegExp", "RegExp"], ["isPromise", "Promise"],
   ["isWeakMap", "WeakMap"], ["isWeakSet", "WeakSet"], ["isMap", "Map"], ["isSet", "Set"],
   ["isDate", "Date"], ["isProxy", "Proxy"]
-].filter(function (row) { return typeof util.types[row[0]] === "function"; });
+], function (row) { return typeof util.types[row[0]] === "function"; });
 
 function _kindName(v) {
   for (var i = 0; i < _NAMED_KINDS.length; i++) {
@@ -129,7 +188,7 @@ function _kindName(v) {
   return typeof v === "function" ? "function" : "value";
 }
 
-function _article(name) { return /^[AEIOU]/i.test(name) ? "an" : "a"; }
+function _article(name) { return _reTest(/^[AEIOU]/i, name) ? "an" : "a"; }
 
 // outputView(input, ErrorClass, code, label) -> a Buffer aliasing a caller's view, for WRITING.
 //
@@ -145,7 +204,7 @@ function _article(name) { return /^[AEIOU]/i.test(name) ? "an" : "a"; }
 // @enforced-by behavioral -- an input door reaching for this instead of `view` has no rename-proof
 // code shape; the RED vectors (a shared view filled here, and a detached one refused) are the guard.
 function outputView(input, ErrorClass, code, label) {
-  if (!util.types.isUint8Array(input) && !ArrayBuffer.isView(input)) {
+  if (!util.types.isUint8Array(input) && !_isView(input)) {
     throw _raise(ErrorClass, code, label + ": expected a Buffer / TypedArray to write into");
   }
   try {
@@ -159,7 +218,7 @@ function outputView(input, ErrorClass, code, label) {
 //
 // For the boundaries that size a value rather than read it: a response-body cap, an emptiness
 // test. `length` is an accessor on the shared typed-array prototype AND shadowable by an own
-// property on any instance, so `Object.defineProperty(buf, "length", { get: () => 0 })` answers
+// property on any instance, so `_defineProperty(buf, "length", { get: () => 0 })` answers
 // for a Buffer holding megabytes. A cap measured that way is a cap its caller sets.
 // @enforced-by behavioral -- `x.length` is the ordinary spelling wherever the value is this
 // toolkit's own, so the misuse has no rename-proof code shape; the RED vector (a planted `length`
@@ -178,7 +237,7 @@ function lengthOf(view) {
 // container" about a container that plainly holds bytes reads as the toolkit being wrong.
 function _refuseShared(v, ErrorClass, code, label) {
   if (util.types.isSharedArrayBuffer(v) ||
-      (ArrayBuffer.isView(v) && util.types.isSharedArrayBuffer(_storeOf(v)))) {
+      (_isView(v) && util.types.isSharedArrayBuffer(_storeOf(v)))) {
     throw _raise(ErrorClass, code, label + ": shared memory cannot be used here, because another " +
       "thread can rewrite it after it has been checked; pass a Buffer or a Uint8Array over " +
       "memory this process owns");
@@ -192,7 +251,7 @@ function _refuseShared(v, ErrorClass, code, label) {
 //
 // Defends the detached-buffer fail-OPEN: a transferred / structuredClone'd
 // Buffer or view has a detached backing ArrayBuffer and reads as ZERO-LENGTH.
-// An identity fast-path (`Buffer.isBuffer(x) return x`) that skips the re-view
+// An identity fast-path (`_isBuffer(x) return x`) that skips the re-view
 // hands the caller an empty buffer, so a downstream digest / signature / parse
 // silently processes EMPTY input instead of failing (CWE-20 improper input
 // validation feeding a CWE-347-style verification-of-nothing). Always re-viewing
@@ -218,8 +277,24 @@ function _refuseShared(v, ErrorClass, code, label) {
 // would otherwise have to hand-roll the re-view to reach this guard at all, which is precisely what
 // the re-inline detector forbids, so accept either: a class (its prototype is an Error) is
 // constructed, anything else is called.
+// Whether E's instances would be Errors, decided by walking the prototype chain with the captured
+// `getPrototypeOf` rather than by `instanceof`, which asks `Error[Symbol.hasInstance]` at call time.
+// The walk carries the same visited set _protoChainIsCyclic uses, because a Proxy can report a
+// cyclic chain and an unbounded walk would hang here rather than at the boundary that refuses one.
+var _ErrorProto = Error.prototype;
+function _isErrorClass(E) {
+  if (typeof E !== "function") return false;
+  var seen = new _Set();
+  for (var p = E.prototype; p !== null && typeof p === "object"; p = _getPrototypeOf(p)) {
+    if (p === _ErrorProto) return true;
+    if (_setHas(seen, p)) return false;
+    _setAdd(seen, p);
+  }
+  return false;
+}
+
 function _raise(E, code, message, cause) {
-  return (E.prototype instanceof Error) ? new E(code, message, cause) : E(code, message, cause);
+  return _isErrorClass(E) ? new E(code, message, cause) : E(code, message, cause);
 }
 
 // view(input, ErrorClass, code, label) -> Buffer view | throws ErrorClass(code, msg, cause)
@@ -228,7 +303,7 @@ function _raise(E, code, message, cause) {
 // threaded as the cause).
 // The kind is read from the slot. A prototype test turns away a real Uint8Array built in another
 // realm, whose prototype is that realm's, and tells the caller their bytes are not bytes. It
-// admits the mirror shape, `Object.create(Uint8Array.prototype)`, which holds none; that one comes
+// admits the mirror shape, `_create(Uint8Array.prototype)`, which holds none; that one comes
 // back as this guard's own code either way, since the read below is wrapped, so reading the slot
 // only moves the refusal to the door from the failing read.
 // @enforced-by guard-shape-reinlined
@@ -261,9 +336,9 @@ function view(input, ErrorClass, code, label) {
 function source(input, ErrorClass, code, label) {
   _refuseShared(input, ErrorClass, code, label);
   var isAb = _isArrayBuffer(input);
-  if (isAb || ArrayBuffer.isView(input)) {
+  if (isAb || _isView(input)) {
     try {
-      return isAb ? Buffer.from(input) : _reView(input);
+      return isAb ? _bufferFrom(input) : _reView(input);
     } catch (e) {
       throw _raise(ErrorClass, code, label + ": input is not a usable byte source (detached backing buffer?)", e);
     }
@@ -292,7 +367,7 @@ function source(input, ErrorClass, code, label) {
 //   that mutates the caller's buffer between parse and verify and asserts the
 //   verdict still describes the bytes that were verified.
 function snapshot(input, ErrorClass, code, label) {
-  return Buffer.from(view(input, ErrorClass, code, label));
+  return _bufferFrom(view(input, ErrorClass, code, label));
 }
 
 // snapshotSource(input, ErrorClass, code, label) -> private Buffer copy | throws
@@ -304,7 +379,7 @@ function snapshot(input, ErrorClass, code, label) {
 // @enforced-by behavioral -- a copy has no rename-proof shape to detect; the guard
 //   is the RED vector that mutates the caller's backing buffer across the await.
 function snapshotSource(input, ErrorClass, code, label) {
-  return Buffer.from(source(input, ErrorClass, code, label));
+  return _bufferFrom(source(input, ErrorClass, code, label));
 }
 
 // snapshotDeep(value, ErrorClass, code, label) -> a private copy of every byte leaf | throws
@@ -369,8 +444,8 @@ function snapshotDeep(value, ErrorClass, code, label, opts) {
 // `Symbol.toStringTag` is on every surface: it is the language's own name for what a value is, a
 // key handle carries it as a non-enumerable own property, and it answers no named option.
 function _surface(names) {
-  var t = Object.create(null);
-  names.forEach(function (n) { t[n] = 1; });
+  var t = _create(null);
+  _forEach(names, function (n) { t[n] = 1; });
   t[Symbol.toStringTag] = 1;
   return t;
 }
@@ -399,20 +474,26 @@ var _THENABLE_SURFACE = _surface(["then", "catch", "finally"]);
 // object literal is never opaque whatever it looks like: it is data this module can read and copy,
 // and isCryptoKeyLike is structural by design so a literal can wear the key shape.
 function _opaqueSurface(v, ErrorClass, code, label) {
-  var proto = Object.getPrototypeOf(v);
-  if (proto === Object.prototype || proto === null) return null;
-  if (util.types.isWeakMap(v) || util.types.isWeakSet(v)) return {};   // deliberately not enumerable
-  if (v instanceof Error) return _ERROR_SURFACE;
+  var proto = _getPrototypeOf(v);
+  if (proto === _ObjectProto || proto === null) return null;
+  // Deliberately empty, and null-prototype so it stays empty: this surface is the allowed-field set
+  // for a value with no enumerable contents, and on a `{}` a planted `Object.prototype[name]` reads
+  // back as an allowed field, so a mutable one the caller added would pass the refusal.
+  if (util.types.isWeakMap(v) || util.types.isWeakSet(v)) return _create(null);
+  // The slot, not the prototype. This picks which surface an opaque object is copied through, and
+  // `instanceof` asks `Error[Symbol.hasInstance]`, which a caller can answer. It also admits a real
+  // Error from another realm, whose prototype is that realm's and which the prototype test refuses.
+  if (util.types.isNativeError(v)) return _ERROR_SURFACE;
   if (util.types.isRegExp(v)) return _REGEXP_SURFACE;
   // A node:crypto KeyObject, read off its internal slot. `pki.hpke` documents one as a key input
   // and `pki.ct` names it too, and a copy of a key handle is not a key: its material lives behind
   // the slot, so what the copy holds is the shape of a key and none of the key. Recognized here so
   // it reaches the verb as itself, which is the same treatment a WebCrypto CryptoKey gets.
   // `util.types.isKeyObject` reads the slot, so it answers for a handle from any realm and says no
-  // to `Object.create(KeyObject.prototype)`.
+  // to `_create(KeyObject.prototype)`.
   if (util.types.isKeyObject(v)) return _CRYPTO_KEY_SURFACE;
   // Asking whether it is key-shaped reads its properties, and a value wearing a key's prototype
-  // without a key behind it answers with a getter that throws: `Object.create(KeyObject.prototype)`
+  // without a key behind it answers with a getter that throws: `_create(KeyObject.prototype)`
   // raises a raw TypeError from inside `type`. Typed here, like the `then` read below, so a
   // question this module asked on its own behalf cannot escape as somebody else's error.
   var keyLike;
@@ -451,17 +532,17 @@ function _opaqueSurface(v, ErrorClass, code, label) {
 // call and change what an inherited name answers. That is true of every value passed by reference,
 // and a platform object's prototype is the platform's.
 function _canChangeAfterTheCheck(v, name) {
-  var visited = new Set();
-  for (var o = v; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
-    visited.add(o);
-    var d = Object.getOwnPropertyDescriptor(o, name);
+  var visited = new _Set();
+  for (var o = v; o && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
+    var d = _getOwnPropertyDescriptor(o, name);
     if (!d) continue;
     if (d.get || d.set || d.writable || d.configurable) return true;
     // Settled where it sits. Reached through the chain it is settled only while nothing can be put
     // in front of it: an extensible receiver takes an own property of the same name at any time,
     // and the read then answers with that one. Own on the value itself, or a value nothing can be
     // added to, is the case where what was read is what stays.
-    return o !== v && Object.isExtensible(v);
+    return o !== v && _isExtensible(v);
   }
   return false;
 }
@@ -541,13 +622,18 @@ function _opaqueFieldOutsideSurface(v, surface, ErrorClass, code, label, depth)
 // field takes, so the copy preserves the type and the validator still sees what it was given.
 function _copyBytesSameKind(v, ErrorClass, code, label, collect) {
   var src = source(v, ErrorClass, code, label);   // re-views; a detached backing store is refused
-  var owned = new ArrayBuffer(src.length);
-  new Uint8Array(owned).set(src);
+  // Sized once, from the slot. `src.length` is a replaceable accessor, and it decides three things
+  // here at once: how large the private store is, how much of it the returned view covers, and how
+  // much of it goes on the wipe list. A number smaller than the truth puts a short Buffer on that
+  // list, so `release` clears the front of a copy that still holds the rest of the secret.
+  var srcLen = _lengthOf(src);
+  var owned = new _ArrayBuffer(srcLen);
+  _taSet(new _Uint8Array(owned), src);
   // What `release` clears: a Buffer over the whole private store, whatever kind is handed back.
-  if (collect) collect.push(Buffer.from(owned, 0, src.length));
-  if (Buffer.isBuffer(v)) return Buffer.from(owned, 0, src.length);
+  if (collect) _append(collect, _bufferFrom(owned, 0, srcLen));
+  if (_isBuffer(v)) return _bufferFrom(owned, 0, srcLen);
   if (_isArrayBuffer(v)) return owned;
-  if (util.types.isDataView(v)) return new DataView(owned);
+  if (util.types.isDataView(v)) return new _DataView(owned);
   // The kind comes from the value's slot, never from `v.constructor` or `v.BYTES_PER_ELEMENT`.
   // Both are ordinary properties a subclass answers: a `constructor` that threw took this module
   // out through the caller's own exception, and a `BYTES_PER_ELEMENT` that lied built the copy
@@ -558,7 +644,7 @@ function _copyBytesSameKind(v, ErrorClass, code, label, collect) {
       (util.types.isTypedArray(v) ? "typed array of a kind this runtime added" : "byte view") +
       " cannot be copied while keeping its kind; pass a Buffer or a Uint8Array");
   }
-  return new Ctor(owned, 0, src.length / Ctor.BYTES_PER_ELEMENT);
+  return new Ctor(owned, 0, srcLen / Ctor.BYTES_PER_ELEMENT);
 }
 
 // Is this value's prototype chain cyclic? A Proxy whose `getPrototypeOf` trap returns the proxy
@@ -572,10 +658,10 @@ function _copyBytesSameKind(v, ErrorClass, code, label, collect) {
 // Naming the shape is the fail-closed answer. An options bag cannot need a prototype chain that
 // loops, and copying one has no meaning to fall back to.
 function _protoChainIsCyclic(v) {
-  var visited = new Set();
-  for (var o = v; o; o = Object.getPrototypeOf(o)) {
-    if (visited.has(o)) return true;
-    visited.add(o);
+  var visited = new _Set();
+  for (var o = v; o; o = _getPrototypeOf(o)) {
+    if (_setHas(visited, o)) return true;
+    _setAdd(visited, o);
   }
   return false;
 }
@@ -584,9 +670,9 @@ function _protoChainIsCyclic(v) {
 // above a plain object decides what the copy takes while the original answers reads from its
 // `get` trap. Testing only the value handed in leaves that one line of indirection open.
 function _protoChainHasProxy(v) {
-  var visited = new Set();
-  for (var o = v; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
-    visited.add(o);
+  var visited = new _Set();
+  for (var o = v; o && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
     if (util.types.isProxy(o)) return true;
   }
   return false;
@@ -594,7 +680,7 @@ function _protoChainHasProxy(v) {
 
 // Give the copy of a collection the same prototype the original carries.
 //
-// The object branch does this with `Object.create(Object.getPrototypeOf(v))`, so an instance of a
+// The object branch does this with `_create(_getPrototypeOf(v))`, so an instance of a
 // caller's class keeps its methods. A collection branch builds a plain `[]`, `Map` or `Set`, and
 // a subclass of one holds its additions on a prototype above that. Copying the chain down onto a
 // plain array turns `class Opts extends Array { describe() {} }` into an array with `describe` as
@@ -646,7 +732,7 @@ function _deep(v, ErrorClass, code, label, cap, depth, collect) {
     throw _raise(ErrorClass, code, label + ": its prototype chain is a cycle, so it cannot be " +
       "read or copied; pass a plain object");
   }
-  if (Buffer.isBuffer(v) || ArrayBuffer.isView(v) || _isArrayBuffer(v)) {
+  if (_isBuffer(v) || _isView(v) || _isArrayBuffer(v)) {
     var bytesCopy = _copyBytesSameKind(v, ErrorClass, code, label, collect);
     // A byte value can carry named properties too, and a verb reads an option by name whatever the
     // argument's type: `opts = new Uint8Array(0); opts.pem = true` is an options object as far as
@@ -678,11 +764,11 @@ function _deep(v, ErrorClass, code, label, cap, depth, collect) {
     // signing time was encoded. Normalizing the prototype does not reach an own shadow, so the
     // shadow is left behind here. The excluded set is read off `Date.prototype` rather than
     // written out, so it cannot fall behind the language.
-    var dateCopy = new Date(time.instantOf(v));
+    var dateCopy = new _Date(time.instantOf(v));
     _copyNamed(v, dateCopy, ErrorClass, code, label, cap, depth, collect, _DATE_BEHAVIOR);
     return _plainCopy(dateCopy);
   }
-  if (Array.isArray(v)) {
+  if (_isArray(v)) {
     var arr = [];
     // The indices a read on the array resolves, rather than a count from zero to `length`. An
     // array is sparse whenever a caller sets a high index or assigns `length`, and
@@ -705,7 +791,7 @@ function _deep(v, ErrorClass, code, label, cap, depth, collect) {
     // it pays, an element answering as a trusted signer to the check and as another afterwards.
     // The argument itself, not everything under it, matching the rule for names.
     if (depth === 0) identifier.refuseAccessorFields(v, indices, indexE, code, label);
-    indices.forEach(function (k) {
+    _forEach(indices, function (k) {
       // Reading an element can run a caller's accessor, the same as reading a named field: an
       // index can carry a getter too, and one that threw escaped as itself from a boundary whose
       // contract is a typed error. Typed here with the raw fault as its cause, as the named walk
@@ -735,15 +821,15 @@ function _deep(v, ErrorClass, code, label, cap, depth, collect) {
     var carried = _opaqueFieldOutsideSurface(v, surface, ErrorClass, code, label);
     if (carried === null) return v;
     throw _raise(ErrorClass, code, label + ": " + _article(_kindName(v)) + " " + _kindName(v) +
-      " carrying its own field " + JSON.stringify(String(carried)) + " cannot be used here -- its " +
+      " carrying its own field " + _stringify(_String(carried)) + " cannot be used here -- its " +
       "state cannot be copied, so that field would stay changeable after it was checked; pass the " +
       "fields as a plain object");
   }
   if (util.types.isMap(v)) {
-    return _plainCopy(_copyEntries(v, new Map(), ErrorClass, code, label, cap, depth, collect));
+    return _plainCopy(_copyEntries(v, new _Map(), ErrorClass, code, label, cap, depth, collect));
   }
   if (util.types.isSet(v)) {
-    return _plainCopy(_copyEntries(v, new Set(), ErrorClass, code, label, cap, depth, collect));
+    return _plainCopy(_copyEntries(v, new _Set(), ErrorClass, code, label, cap, depth, collect));
   }
   // A plain object, or a dictionary with no prototype at all -- never the caller's class.
   //
@@ -752,11 +838,11 @@ function _deep(v, ErrorClass, code, label, cap, depth, collect) {
   // begun. The names the copy reports do not depend on it, which the vectors measure rather than
   // assume, and no verb calls a method on an options bag.
   //
-  // Having NO prototype is different and is kept. `Object.create(null)` and what `JSON.parse`
+  // Having NO prototype is different and is kept. `_create(null)` and what `JSON.parse`
   // produces inherit nothing, and a copy that gained `Object.prototype` would inherit whatever a
   // runtime has planted there -- names the original never answered, reported against a caller who
   // never wrote them.
-  var out = Object.create(Object.getPrototypeOf(v) === null ? null : Object.prototype);
+  var out = _create(_getPrototypeOf(v) === null ? null : _ObjectProto);
   _copyNamed(v, out, ErrorClass, code, label, cap, depth, collect);
   return out;
 }
@@ -782,7 +868,7 @@ function _deep(v, ErrorClass, code, label, cap, depth, collect) {
 // One walk answers for both questions, because a second walk here drifts from it and the two then
 // disagree about one value. A walk that stops at whatever object is identical to `Object.prototype`
 // reads a foreign realm's root as caller data and copies `__proto__` down as a field. One that
-// reads every level outside a collection gives `Object.create(Array.prototype)` an own `length`
+// reads every level outside a collection gives `_create(Array.prototype)` an own `length`
 // and `Symbol.unscopables`. Either way the copy holds a different set than the check accepted, and
 // a bag that passes the check is refused once it has been copied.
 //
@@ -810,12 +896,14 @@ function _copyEntries(src, dst, ErrorClass, code, label, cap, depth, collect) {
   // The walk uses the intrinsic `forEach`, called against the collection. `forEach` is an ordinary
   // method on `Map.prototype` and `Set.prototype`, so an own one or a subclass's answers instead:
   // one that threw took this module out through the caller's own exception, and one that yielded
-  // different entries filled the copy with something other than what the collection holds.
-  var walk = util.types.isSet(src) ? Set.prototype.forEach : Map.prototype.forEach;
-  walk.call(src, function (value, key) {
+  // different entries filled the copy with something other than what the collection holds. Both are
+  // taken at load and invoked uncurried, so neither the method nor the `call` that reaches it is
+  // read off a prototype while a caller is in a position to have replaced it.
+  var walk = util.types.isSet(src) ? _setForEach : _mapForEach;
+  walk(src, function (value, key) {
     var copiedValue = _deep(value, ErrorClass, code, label, cap, depth + 1, collect);
-    if (util.types.isSet(dst)) dst.add(copiedValue);
-    else dst.set(_deep(key, ErrorClass, code, label, cap, depth + 1, collect), copiedValue);
+    if (util.types.isSet(dst)) _setAdd(dst, copiedValue);
+    else _mapSet(dst, _deep(key, ErrorClass, code, label, cap, depth + 1, collect), copiedValue);
   });
   _copyNamed(src, dst, ErrorClass, code, label, cap, depth, collect);
   return dst;
@@ -832,8 +920,8 @@ function _copyEntries(src, dst, ErrorClass, code, label, cap, depth, collect) {
 // The names `Date.prototype` supplies, read off the language rather than written out, so a method
 // the language gains later is behavior here on the day it lands.
 var _DATE_BEHAVIOR = (function () {
-  var t = Object.create(null);
-  Reflect.ownKeys(Date.prototype).forEach(function (n) { t[n] = 1; });
+  var t = _create(null);
+  _forEach(_ownKeys(Date.prototype), function (n) { t[n] = 1; });
   return t;
 })();
 
@@ -849,7 +937,7 @@ function _copyNamed(src, dst, ErrorClass, code, label, cap, depth, collect, beha
     // like any other: the fault gets this boundary's typed code with the raw error as its cause,
     // and never escapes as itself from inside a verb the caller called for something else.
     try { value = src[keys[k]]; }
-    catch (e) { throw _raise(ErrorClass, code, label + ": reading " + JSON.stringify(keys[k]) + " threw", e); }
+    catch (e) { throw _raise(ErrorClass, code, label + ": reading " + _stringify(keys[k]) + " threw", e); }
     // A name the destination's KIND already defines, holding a FUNCTION, is a shadow of that
     // kind's own method: copying it down would make the copy answer with the caller's code where
     // the original answered with the language's. The value decides, not the name -- a plain
@@ -860,7 +948,7 @@ function _copyNamed(src, dst, ErrorClass, code, label, cap, depth, collect, beha
     // still carried. Dropping it changed what the caller passed: an unknown spec
     // field whose value happened to be a function stopped reaching the verb's own key check, so a
     // typo that used to be refused was silently accepted.
-    Object.defineProperty(dst, keys[k], {
+    _defineProperty(dst, keys[k], {
       value: typeof value === "function" ? value
         : _deep(value, ErrorClass, code, label, cap, depth + 1, collect),
       writable: true, enumerable: _wasEnumerable(src, keys[k]), configurable: true,
@@ -871,8 +959,8 @@ function _copyNamed(src, dst, ErrorClass, code, label, cap, depth, collect, beha
 // Whether a name lookup on `v` would have found this property as an enumerable one, anywhere on
 // the chain -- so the copy's own keys enumerate the way the original's did.
 function _wasEnumerable(v, name) {
-  for (var o = v; o && o !== Object.prototype; o = Object.getPrototypeOf(o)) {
-    var d = Object.getOwnPropertyDescriptor(o, name);
+  for (var o = v; o && o !== _ObjectProto; o = _getPrototypeOf(o)) {
+    var d = _getOwnPropertyDescriptor(o, name);
     if (d) return !!d.enumerable;
   }
   return false;
@@ -908,7 +996,7 @@ function fixArguments(ErrorClass, code, args) {
   }
   try {
     for (var i = 0; i < args.length; i++) {
-      values.push(snapshotDeep(args[i][0], ErrorClass, code, args[i][1], { collect: copies }));
+      _append(values, snapshotDeep(args[i][0], ErrorClass, code, args[i][1], { collect: copies }));
     }
   } catch (e) {
     // The copying itself can fail partway (a detached leaf, a structure past the depth cap, a
@@ -936,10 +1024,12 @@ function fixArguments(ErrorClass, code, args) {
 //   including a fault raised by the copy itself) and the per-verb entry-value vectors.
 function fixedCall(ErrorClass, code, args, body) {
   var handle = null;
-  return async.deferred(function () {
+  // Both halves through captures. `body.apply` and `.finally` are prototype reads, and between them
+  // they decide whether the verb runs and whether the copies it was handed are ever cleared.
+  return _promiseFinally(async.deferred(function () {
     handle = fixArguments(ErrorClass, code, args);
-    return body.apply(null, handle.values);
-  }).finally(function () { if (handle) handle.release(); });
+    return _apply(body, null, handle.values);
+  }), function () { if (handle) handle.release(); });
 }
 
 module.exports = {