@blamejs/pki 0.5.14 → 0.5.16

package/lib/guard-identifier.js

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (c) blamejs contributors
 "use strict";
-var util = require("util");
+var intrinsic = require("./guard-intrinsic");
+var util = { types: intrinsic.types };
 //
 // @internal -- no operator-facing namespace. The documented surface is the
 // consumers whose identifier-string integrity composes this guard (pki.oid
@@ -22,6 +23,63 @@ var util = require("util");
 // silent false-reject). Every string-form identifier check routes through here so
 // the string and DER forms cannot diverge.
 
+// Everything this module reads from the runtime, taken at load. `util.types` above is the slot
+// predicate set, which answers whether a value is a Proxy -- the question that decides whether an
+// options bag can be asked honestly what it holds at all.
+//
+// The array test decides whether a value is walked as a list, so one answering `false` makes the
+// index scan report nothing and every index rule keyed on that scan applies to nothing, which is
+// how an accessor under index 0 reaches a copy loop the refusal should have turned the call away
+// for. The reflective operations are this module's honesty walk itself: `getOwnPropertyDescriptor`
+// learns whether a field is an accessor, `getPrototypeOf` and `ownKeys` walk a chain, and a
+// replacement for either lets an options bag report one shape while answering as another. The array
+// and collection operations run on lists and sets this module owns, where `Array.prototype` and
+// `Set.prototype` are what a caller can still reach: a `forEach` replaced with a no-op makes the
+// name scan report nothing over perfectly real keys, and a `has` answering `true` ends a chain walk
+// at the first prototype. See guard-intrinsic for the whole captured set.
+var _isArray = intrinsic.isArray;
+var _create = intrinsic.create;
+var _getPrototypeOf = intrinsic.getPrototypeOf;
+var _setPrototypeOf = intrinsic.setPrototypeOf;
+var _getOwnPropertyDescriptor = intrinsic.getOwnPropertyDescriptor;
+var _getOwnPropertyNames = intrinsic.getOwnPropertyNames;
+var _defineProperty = intrinsic.defineProperty;
+var _ownKeys = intrinsic.ownKeys;
+var _isView = intrinsic.isView;
+var _isInteger = intrinsic.isInteger;
+var _stringify = intrinsic.stringify;
+var _forEach = intrinsic.forEach;
+var _map = intrinsic.map;
+var _filter = intrinsic.filter;
+var _every = intrinsic.every;
+var _some = intrinsic.some;
+var _indexOf = intrinsic.indexOf;
+var _sort = intrinsic.sort;
+var _setAdd = intrinsic.setAdd;
+var _setHas = intrinsic.setHas;
+var _mapGet = intrinsic.mapGet;
+var _mapSet = intrinsic.mapSet;
+var _mapHas = intrinsic.mapHas;
+var _Set = intrinsic.Set;
+var _Map = intrinsic.Map;
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _strSplit = intrinsic.uncurry(String.prototype.split);
+// This module's whole job is deciding whether a caller's name is in a known set, and that decision
+// is one `hasOwnProperty` call. Reading it and its `call` off their prototypes leaves the answer
+// with whoever replaced either, which classifies an unknown option as an allowed one.
+var _hasOwn = intrinsic.hasOwn;
+// The index test below IS `String(Number(k)) === k`, and the readable-index scan orders and bounds
+// its results with the same two conversions. Both are writable properties of globalThis: one
+// replacement decides which own names this module reports as elements, in what order, and where the
+// scan stops -- which is what every consumer's density and accessor refusal is built on.
+var _String = intrinsic.String;
+var _Number = intrinsic.Number;
+var _BigInt = intrinsic.BigInt;
+var _Object = intrinsic.Object;
+var _BufferProto = intrinsic.BufferProto;
+// Appended by index rather than through `push`, so the growth reads no prototype method at all.
+function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
+
 // The dotted-decimal grammar, walked instead of matched. `(0|[1-9]\d*)(\.(0|[1-9]\d*))+`
 // nests a quantified group inside a quantified group with an alternation in each,
 // which is the shape whose cost on a rejecting string is a property of the pattern
@@ -34,14 +92,14 @@ function _isDottedDecimal(str) {
   if (str.length === 0) return false;
   var arcs = 0, digits = 0, leadingZero = false;
   for (var i = 0; i < str.length; i++) {
-    var c = str.charCodeAt(i);
+    var c = _charCodeAt(str, i);
     if (c === 0x2e) {                                   // "."
       if (digits === 0 || leadingZero) return false;    // empty arc, or "01"
       arcs++; digits = 0; leadingZero = false;
       continue;
     }
     if (c < 0x30 || c > 0x39) return false;             // not a digit
-    if (digits === 1 && str.charCodeAt(i - 1) === 0x30) leadingZero = true;
+    if (digits === 1 && _charCodeAt(str, i - 1) === 0x30) leadingZero = true;
     digits++;
   }
   if (digits === 0 || leadingZero) return false;        // trailing "." or a final "01"
@@ -72,9 +130,15 @@ function assertCanonicalOid(str, E, code, label, boundsCode) {
   }
   if (boundsCode === null) return str;
   var bcode = boundsCode === undefined ? code : boundsCode;
-  var parts = str.split(".");
-  var root = BigInt(parts[0]);
-  var second = BigInt(parts[1]);
+  // The arc bound below is a bound on THESE parts, so the split that produces them settles it. One
+  // returning different pieces has the check read a first and second arc the identifier does not
+  // carry, and an out-of-range OID passes a range test performed on other numbers.
+  var parts = _strSplit(str, ".");
+  // Captured: these two arcs are what the bound below is a bound ON, and `BigInt` is a writable
+  // property of globalThis, so a replacement returns whatever it likes for the arcs and the range
+  // test is then performed on numbers the identifier does not carry.
+  var root = _BigInt(parts[0]);
+  var second = _BigInt(parts[1]);
   if (root > 2n) throw E(bcode, who + " root arc must be 0, 1, or 2 (X.660)");
   if (root < 2n && second > 39n) throw E(bcode, who + " second arc must be 0..39 under roots 0 and 1 (X.660)");
   return str;
@@ -111,14 +175,14 @@ function assertCanonicalOid(str, E, code, label, boundsCode) {
 // @guard-shape Object\.keys\(\w+(?:\.\w+)*\)\.forEach\(function \((\w+)\) \{\s*if \(![\w.]+\[\1\]\) (?:\{\s*)?throw
 function assertKnownKeys(obj, known, E, code, message) {
   _refuseUnenumerable(obj, E, code, "the options");
-  var describe = typeof message === "function" ? message : function (k) { return message + JSON.stringify(k); };
-  _readableNames(obj).forEach(function (k) {
-    if (Object.prototype.hasOwnProperty.call(known, k)) return;
+  var describe = typeof message === "function" ? message : function (k) { return message + _stringify(k); };
+  _forEach(_readableNames(obj), function (k) {
+    if (_hasOwn(known, k)) return;
     // A Symbol reaches the message as its description, before either form of `message` sees it.
     // JSON.stringify returns undefined for one, so a caller's own builder (which stringifies the
     // key itself) would name the refused option "undefined" and leave nothing to search for.
     // Normalizing here rather than in the default builder keeps both forms reading the same.
-    throw E(code, describe(typeof k === "symbol" ? String(k) : k));
+    throw E(code, describe(typeof k === "symbol" ? _String(k) : k));
   });
 }
 
@@ -138,10 +202,10 @@ function assertKnownKeys(obj, known, E, code, message) {
 // The residual is a planted function REPLACING one of these twelve. No verb reads `opts.toString`
 // as an option, so that smuggles nothing; it breaks the runtime at large, not this check.
 var _PRISTINE_OBJECT_PROTO = (function () {
-  var s = Object.create(null);
-  ["constructor", "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable", "toLocaleString",
+  var s = _create(null);
+  _forEach(["constructor", "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable", "toLocaleString",
     "toString", "valueOf", "__defineGetter__", "__defineSetter__", "__lookupGetter__",
-    "__lookupSetter__", "__proto__"].forEach(function (k) { s[k] = 1; });
+    "__lookupSetter__", "__proto__"], function (k) { s[k] = 1; });
   return s;
 })();
 
@@ -182,9 +246,9 @@ function _requireFactory(E) {
 function _refuseUnenumerable(v, E, code, label) {
   _requireFactory(E);
   if (v === null || typeof v !== "object") return;
-  var visited = new Set();
-  for (var o = v; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
-    visited.add(o);
+  var visited = new _Set();
+  for (var o = v; o && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
     if (!util.types.isProxy(o)) continue;
     throw E(code, label + (o === v ? " is" : " inherits from") + " a Proxy, whose reported keys " +
       "need not match what it answers, so an option it holds cannot be found; pass a plain object");
@@ -204,10 +268,10 @@ function _refuseUnenumerable(v, E, code, label) {
 // The walk stops at an object already seen, since a prototype chain is finite only while it is
 // acyclic and a Proxy can make it otherwise. See the note on _readableNames.
 function _isMethodOf(from, k, fn) {
-  var visited = new Set();
-  for (var o = from; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
-    visited.add(o);
-    var d = Object.getOwnPropertyDescriptor(o, k);
+  var visited = new _Set();
+  for (var o = from; o && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
+    var d = _getOwnPropertyDescriptor(o, k);
     if (!d) continue;
     return !d.get && !d.set && d.value === fn;
   }
@@ -216,8 +280,8 @@ function _isMethodOf(from, k, fn) {
 
 // Every name that can supply a value to a later `obj.foo`. `Object.keys` reports a subset of
 // those: own enumerable names only. Four ordinary object shapes answer the lookup while showing
-// that enumeration nothing. A value on the prototype (`Object.create({ password: "pw" })`). A
-// non-enumerable own value (`Object.defineProperty(o, "password", { enumerable: false })`). A
+// that enumeration nothing. A value on the prototype (`_create({ password: "pw" })`). A
+// non-enumerable own value (`_defineProperty(o, "password", { enumerable: false })`). A
 // class getter, which class syntax also defines non-enumerable. And a polluted
 // `Object.prototype`. On each of them `pki.key.export` accepts the bag, ignores the password it
 // can read, and returns the private key in the clear, which is the case the refusal exists to
@@ -264,8 +328,8 @@ function _isMethodOf(from, k, fn) {
 // reaches neither the check nor the verb. A leading zero is excluded by the same comparison,
 // since "01" is a named property too.
 function _isArrayIndex(k) {
-  var n = Number(k);
-  return Number.isInteger(n) && n >= 0 && n < 4294967295 && String(n) === k;
+  var n = _Number(k);
+  return _isInteger(n) && n >= 0 && n < 4294967295 && _String(n) === k;
 }
 
 // Is this value one whose own `length` and indices are structure rather than supplied names?
@@ -280,7 +344,7 @@ function _isArrayIndex(k) {
 // properties that stay set and answer on a later read. Counting it as indexed drops both from the
 // names reported and from the copy the verb is handed.
 function _isIndexedKind(v) {
-  return Array.isArray(v) || (ArrayBuffer.isView(v) && !util.types.isDataView(v));
+  return _isArray(v) || (_isView(v) && !util.types.isDataView(v));
 }
 
 // The names the built-in collection kinds define on their prototypes, written out rather than
@@ -288,7 +352,7 @@ function _isIndexedKind(v) {
 // what belongs on it asks the polluted object to vouch for itself.
 //
 // One set covering every kind, because a LEVEL is what gets read and a level's kind cannot be
-// established without asking a prototype who it is. `Object.create(Map.prototype)` holds no map
+// established without asking a prototype who it is. `_create(Map.prototype)` holds no map
 // and inherits `size`; a foreign array's prototype is not this realm's. Both are answered by
 // asking whether the NAME is one a kind defines, which no realm and no lookalike changes.
 //
@@ -336,12 +400,12 @@ var _SHARED_MEMBERS = _SHARED_PROTO_MEMBERS;
 // an array, `buffer` is a byte view's member and not an array's, so that getter is the caller's
 // option and gets reported.
 //
-// A value with no collection slot answers with nothing. `Object.create(Map.prototype)` holds no
+// A value with no collection slot answers with nothing. `_create(Map.prototype)` holds no
 // map and still inherits `size`, and that is settled by the level test in the walk, which reads
 // the members off the prototype the name was found on.
 // The prototypes this realm installs a kind's members on. A level that IS one carries the
 // language's members whatever the value in front of it turns out to be, which is how
-// `Object.create(Map.prototype)` keeps `size` while holding no map.
+// `_create(Map.prototype)` keeps `size` while holding no map.
 //
 // Typed arrays are recognized through the prototype they all share rather than by naming each
 // constructor, so a kind the list never mentioned is covered: `Float16Array` arrived on Node 24
@@ -350,14 +414,14 @@ var _SHARED_MEMBERS = _SHARED_PROTO_MEMBERS;
 // only its own: `size` on `Array.prototype` is nothing the language put there, so exempting it
 // because some other kind has a member by that name hands back the hole this walk exists to
 // close, for anyone who plants it in a shape that reads as built-in.
-var _TYPED_ARRAY_PROTO = Object.getPrototypeOf(Uint8Array.prototype);
+var _TYPED_ARRAY_PROTO = _getPrototypeOf(Uint8Array.prototype);
 var _INTRINSIC_HOLDERS = (function () {
-  var m = new Map([[_TYPED_ARRAY_PROTO, _TYPED_PROTO_MEMBERS]]);
-  function pair(ctor, members) { if (ctor && ctor.prototype) m.set(ctor.prototype, members); }
+  var m = new _Map([[_TYPED_ARRAY_PROTO, _TYPED_PROTO_MEMBERS]]);
+  function pair(ctor, members) { if (ctor && ctor.prototype) _mapSet(m, ctor.prototype, members); }
   pair(Array, _ARRAY_PROTO_MEMBERS);
   pair(RegExp, _REGEXP_PROTO_MEMBERS);
-  [Map, Set].forEach(function (c) { pair(c, _SIZED_PROTO_MEMBERS); });
-  [WeakMap, WeakSet].forEach(function (c) { pair(c, _WEAK_PROTO_MEMBERS); });
+  _forEach([Map, Set], function (c) { pair(c, _SIZED_PROTO_MEMBERS); });
+  _forEach([WeakMap, WeakSet], function (c) { pair(c, _WEAK_PROTO_MEMBERS); });
   pair(ArrayBuffer, _ARRAYBUFFER_PROTO_MEMBERS);
   pair(typeof SharedArrayBuffer === "function" ? SharedArrayBuffer : null, _SHARED_PROTO_MEMBERS);
   pair(DataView, _DATAVIEW_PROTO_MEMBERS);
@@ -371,13 +435,13 @@ var _INTRINSIC_HOLDERS = (function () {
   //
   // Reading a global can run a getter, and a deprecated one can throw; a fault here would break
   // this module's load over a name it does not need.
-  Object.getOwnPropertyNames(globalThis).forEach(function (n) {
+  _forEach(_getOwnPropertyNames(globalThis), function (n) {
     var C;
     try { C = globalThis[n]; }
     catch (_e) { /* allow:swallow-unverified this runs once at load over whatever globals the host defines, and no global in a supported runtime throws on read, so no test drives it; it is here so an embedder's throwing accessor cannot stop this module loading over a name it does not need */ return; }
     if (typeof C !== "function" || typeof C.BYTES_PER_ELEMENT !== "number") return;
-    if (!C.prototype || Object.getPrototypeOf(C.prototype) !== _TYPED_ARRAY_PROTO) return;
-    m.set(C.prototype, _CONCRETE_TYPED_MEMBERS);
+    if (!C.prototype || _getPrototypeOf(C.prototype) !== _TYPED_ARRAY_PROTO) return;
+    _mapSet(m, C.prototype, _CONCRETE_TYPED_MEMBERS);
   });
   return m;
 })();
@@ -387,7 +451,7 @@ var _INTRINSIC_HOLDERS = (function () {
 // the table above, the concrete typed-array ones included, so an object that merely sits over one
 // of them is a caller's and its names are theirs.
 function _holderMembers(o) {
-  return _INTRINSIC_HOLDERS.has(o) ? _INTRINSIC_HOLDERS.get(o) : null;
+  return _mapHas(_INTRINSIC_HOLDERS, o) ? _mapGet(_INTRINSIC_HOLDERS, o) : null;
 }
 
 // Is this one of Node's Buffers? A byte view whose chain reaches `Buffer.prototype`, asked by
@@ -400,10 +464,10 @@ function _holderMembers(o) {
 // carrying somebody else's exception. A prototype identity is not writable from outside.
 function _isNodeBuffer(v) {
   if (!util.types.isUint8Array(v)) return false;
-  var visited = new Set();
-  for (var o = v; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
-    visited.add(o);
-    if (o === Buffer.prototype) return true;
+  var visited = new _Set();
+  for (var o = v; o && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
+    if (o === _BufferProto) return true;
   }
   return false;
 }
@@ -413,10 +477,10 @@ function _kindMembers(v) {
   // prototype in the chain supplies is handled by the level test at the walk; a name that only
   // looks like a member, on a class of the caller's, is the option they wrote.
   if (v === null || v === undefined) return [];
-  if (Array.isArray(v)) return _ARRAY_MEMBERS;
+  if (_isArray(v)) return _ARRAY_MEMBERS;
   if (_isNodeBuffer(v)) return _BUFFER_KIND_MEMBERS;
   if (util.types.isDataView(v)) return _DATAVIEW_MEMBERS;
-  if (ArrayBuffer.isView(v)) return _VIEW_MEMBERS;
+  if (_isView(v)) return _VIEW_MEMBERS;
   if (util.types.isArrayBuffer(v)) return _ARRAYBUFFER_MEMBERS;
   if (util.types.isSharedArrayBuffer(v)) return _SHARED_MEMBERS;
   if (util.types.isRegExp(v)) return _REGEXP_MEMBERS;
@@ -456,25 +520,28 @@ function _looksIntrinsic(d) {
 // is on Node 24 and was not among the constructors named here, and the moment a typed array of an
 // unlisted kind arrived its `BYTES_PER_ELEMENT` read as an option its caller never wrote.
 function _shadowsAnother(v, k, holder) {
-  var visited = new Set();
+  var visited = new _Set();
   var past = false;
-  for (var o = v; o !== null && o !== undefined && !visited.has(o); o = Object.getPrototypeOf(o)) {
-    visited.add(o);
+  for (var o = v; o !== null && o !== undefined && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
     if (o === holder) { past = true; continue; }
-    if (past && Object.getOwnPropertyDescriptor(o, k)) return true;
+    if (past && _getOwnPropertyDescriptor(o, k)) return true;
   }
   return false;
 }
 
 function _readableNames(obj) {
-  var seen = Object.create(null);
+  var seen = _create(null);
   var out = [];
   // A primitive supplies no option names, and `Reflect.ownKeys` refuses one outright. The walk
   // starts above it rather than on it, so a caller who hands a number or a string where an
   // options bag belongs gets their own verb's refusal for the wrong type from the door that
   // checks types, instead of a raw TypeError from in here about a reflection method they never
   // called. `null` and `undefined` have no chain at all and stop immediately.
-  var o = (obj === null || obj === undefined) ? null : Object(obj);
+  // Boxed through the captured `Object`. This decides which names the scan below then examines, so
+  // a replacement wraps a primitive as an object of its own choosing and the guard reads a name set
+  // and a prototype chain the caller supplied rather than the value's.
+  var o = (obj === null || obj === undefined) ? null : _Object(obj);
   // Whether the value's own `length` and indices are structure. That is true of an array and a
   // byte view and of nothing else: a Map, a Set and an ArrayBuffer have no own `length`, so
   // skipping the name there would discard one the caller had put on themselves.
@@ -491,17 +558,17 @@ function _readableNames(obj) {
   // walk therefore stops at an object it has already visited. A second lap over the same objects
   // yields no name the first did not, so the reported names stay complete. Without the test a
   // caller's argument hangs the verb before a single option has been read.
-  var visited = new Set();
-  while (o && !visited.has(o)) {
-    visited.add(o);
+  var visited = new _Set();
+  while (o && !_setHas(visited, o)) {
+    _setAdd(visited, o);
     var inherited = (o !== obj);
-    var above = Object.getPrototypeOf(o);
+    var above = _getPrototypeOf(o);
     // The root of the chain is the last level before null, which is what `Object.prototype` is.
     // Its position holds in every realm. A value built in a `vm` context or a worker thread
     // carries that realm's root above it, so an identity test against the local object misses it
     // and the foreign `__proto__` accessor reads as a name the caller supplied.
     //
-    // The level has to be an inherited one. A caller's own `Object.create(null)` has no prototype
+    // The level has to be an inherited one. A caller's own `_create(null)` has no prototype
     // either, and treating the bag itself as a root skips the names they set on it.
     var atObjectProto = inherited && above === null;
     // A kind's own prototype gets no exemption as a level. Passing one over whole hides anything
@@ -513,7 +580,7 @@ function _readableNames(obj) {
     // Reflect.ownKeys, because Object.getOwnPropertyNames never returns a Symbol key and a
     // caller can write one. Such a name cannot answer `opts.password`, so it reaches no verb,
     // but it is still an option supplied and not read, which is the whole thing being refused.
-    Reflect.ownKeys(o).forEach(function (k) {
+    _forEach(_ownKeys(o), function (k) {
       if (seen[k]) return;
       // The indices of an array or a byte view are its structure, whichever level they are read
       // from. Both kinds answer an integer-keyed read from their elements before any prototype is
@@ -528,18 +595,18 @@ function _readableNames(obj) {
       // below, which exempts the accessor where the language installed it and reports an override.
       if (indexedSelf && k === "length" && !inherited) return;
       if (_isOwnStructuralName(obj, k)) return;
-      var d = Object.getOwnPropertyDescriptor(o, k);
+      var d = _getOwnPropertyDescriptor(o, k);
       // A name a built-in kind defines, on a level above the value and shaped the way the
       // language leaves it. Own is deliberately excluded: an own `detached` on a buffer shadows
       // the intrinsic getter, so `opts.detached` answers with what the caller wrote, and
       // pki.cms.sign reads an option under exactly that name.
       // A member of the value's own kind, or one sitting on a prototype the language installs
-      // members on. The second is what carries `Object.create(Map.prototype)`, which holds no map
+      // members on. The second is what carries `_create(Map.prototype)`, which holds no map
       // and inherits `size` all the same. Neither alone is enough: without the level test a class
       // of the caller's could name a getter after any kind's member and have it passed over.
       var here = _holderMembers(o);
       if (inherited && _looksIntrinsic(d) && !_shadowsAnother(obj, k, o) &&
-          (here === null ? members.indexOf(k) !== -1 : here.indexOf(k) !== -1)) return;
+          (here === null ? _indexOf(members, k) !== -1 : _indexOf(here, k) !== -1)) return;
       // Object.prototype is decided here and nowhere else. A member is one of the twelve the spec
       // names, still shaped like one: a data property holding a function, or the `__proto__`
       // accessor. Anything else on it was planted and is reported.
@@ -551,7 +618,7 @@ function _readableNames(obj) {
       if (atObjectProto) {
         if (_PRISTINE_OBJECT_PROTO[k] && _looksBuiltIn(d)) return;
         seen[k] = 1;
-        out.push(k);
+        _append(out, k);
         return;
       }
       // A method: a data property holding a function that is either inherited, where a class
@@ -563,7 +630,7 @@ function _readableNames(obj) {
       if (d && !d.get && !d.set && typeof d.value === "function" &&
           (inherited || _isMethodOf(above, k, d.value))) return;
       seen[k] = 1;
-      out.push(k);
+      _append(out, k);
     });
     o = above;
   }
@@ -592,7 +659,7 @@ function readableNames(obj, E, code, label) {
 // The name walk above drops every index of an indexed kind, since an index is structure rather
 // than a name a caller supplied. Something still has to answer which indices there ARE, and the
 // answer is not `Reflect.ownKeys`: an array consults its prototype chain for a hole, so
-// `Object.setPrototypeOf([,], {0: signer})` reads `[signer]` to a `for` loop, to `forEach`, and to
+// `_setPrototypeOf([,], {0: signer})` reads `[signer]` to a `for` loop, to `forEach`, and to
 // every consumer of the value, while its own keys report an empty array. A copy built from the own
 // keys alone holds a hole where the original answers, which is the same divergence between the
 // value checked and the value used that this family exists to close - here it silently shortens a
@@ -616,22 +683,22 @@ function readableNames(obj, E, code, label) {
 // (a length-one array holding its only element on its prototype, copied to a hole) is the guard.
 function readableIndices(obj, E, code, label) {
   _refuseUnenumerable(obj, E, code, label);
-  if (!Array.isArray(obj)) return [];
-  var own = Object.getOwnPropertyDescriptor(obj, "length");
+  if (!_isArray(obj)) return [];
+  var own = _getOwnPropertyDescriptor(obj, "length");
   var limit = own ? own.value : 0;
-  var seen = Object.create(null);
+  var seen = _create(null);
   var out = [];
-  var visited = new Set();
-  for (var o = obj; o && !visited.has(o); o = Object.getPrototypeOf(o)) {
-    visited.add(o);
-    Reflect.ownKeys(o).forEach(function (k) {
+  var visited = new _Set();
+  for (var o = obj; o && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
+    _forEach(_ownKeys(o), function (k) {
       if (typeof k !== "string" || !_isArrayIndex(k) || seen[k]) return;
-      if (Number(k) >= limit) return;
+      if (_Number(k) >= limit) return;
       seen[k] = 1;
-      out.push(k);
+      _append(out, k);
     });
   }
-  return out.sort(function (a, b) { return Number(a) - Number(b); });
+  return _sort(out, function (a, b) { return _Number(a) - _Number(b); });
 }
 
 // The object kinds that are never an options bag, named so the refusal says which mistake was
@@ -679,7 +746,7 @@ function optionsObject(opts, E, code, label) {
   // polluted the caller is then refused for a name they never wrote. A caller who does pass `{}`
   // is a different case and keeps the refusal: `opts.password` answers on their object, so the
   // option is readable and unread, which is exactly what is being refused.
-  if (opts === null || opts === undefined) return Object.create(null);
+  if (opts === null || opts === undefined) return _create(null);
   // `typeof` asks the value nothing, so it is safe on any argument. Every question after it comes
   // once the value has been refused as a Proxy, because each one walks the prototype chain and so
   // runs a `getPrototypeOf` trap, which took this door out through the caller's own exception
@@ -729,10 +796,10 @@ function optionsObject(opts, E, code, label) {
 // The descriptor a name resolves to, from wherever on the chain it is found. Only the first
 // level carrying it matters, since that is the one a read reaches.
 function _descriptorHolder(v, k) {
-  var visited = new Set();
-  for (var o = v; o !== null && o !== undefined && !visited.has(o); o = Object.getPrototypeOf(o)) {
-    visited.add(o);
-    var d = Object.getOwnPropertyDescriptor(o, k);
+  var visited = new _Set();
+  for (var o = v; o !== null && o !== undefined && !_setHas(visited, o); o = _getPrototypeOf(o)) {
+    _setAdd(visited, o);
+    var d = _getOwnPropertyDescriptor(o, k);
     if (d) return d;
   }
   return null;
@@ -752,7 +819,7 @@ function refuseAccessorFields(obj, names, E, code, label) {
     var holder = _descriptorHolder(obj, names[i]);
     if (holder && (holder.get || holder.set)) {
       throw E(code, label + " supplies " +
-        JSON.stringify(typeof names[i] === "symbol" ? String(names[i]) : names[i]) +
+        _stringify(typeof names[i] === "symbol" ? _String(names[i]) : names[i]) +
         " through an accessor, whose value can differ between the check and the read; pass an " +
         "object whose fields are plain values");
     }
@@ -767,7 +834,7 @@ function _settle(opts, E, code, label) {
       try { void opts[names[i]]; }
       catch (_e) {
         throw E(code, label + ": reading " +
-          JSON.stringify(typeof names[i] === "symbol" ? String(names[i]) : names[i]) + " threw");
+          _stringify(typeof names[i] === "symbol" ? _String(names[i]) : names[i]) + " threw");
       }
     }
   }
@@ -776,7 +843,7 @@ function _settle(opts, E, code, label) {
   readAll(before);
   var after = _readableNames(opts);
   var same = after.length === before.length;
-  for (var j = 0; same && j < after.length; j++) same = before.indexOf(after[j]) !== -1;
+  for (var j = 0; same && j < after.length; j++) same = _indexOf(before, after[j]) !== -1;
   if (!same) {
     throw E(code, label + " changes which options it carries while they are read, so no set of " +
       "them can be checked; pass an object whose properties are plain values");