What of a recovered package (fresh from its sources, or read back from the cache, both of which an attacker
may have shaped) flowR is willing to use: package and bindable names only, a version that is one, bounded
sizes, and no properties beyond the ones the recovery itself states. Names in shielded are dropped from the
exports: a package nobody vetted must not take over a call flowR knows to be security relevant, like system,
which would hide that call from every analysis looking for it. undefined for something that is no package.
What of a recovered package (fresh from its sources, or read back from the cache, both of which an attacker may have shaped) flowR is willing to use: package and bindable names only, a version that is one, bounded sizes, and no properties beyond the ones the recovery itself states. Names in
shieldedare dropped from the exports: a package nobody vetted must not take over a call flowR knows to be security relevant, likesystem, which would hide that call from every analysis looking for it.undefinedfor something that is no package.