also the "just" part of "just created yourself" can be dropped if you're willing to have it throw if the object has a .then property that the user put on it, which I think is a perfectly fine restriction; I updated my snippet to do that. as long as you know the object is one you created, even if you've since handed it out to a user (as in the Animation CVE in the repo) then you can rely on it not being a proxy and so the hasOwn check not triggering user code

function safePromiseCapability() {
  let { promise, resolve, reject } = Promise.withResolvers();
  function safeResolve(val) {
    if (Object.hasOwn(val, 'then')) throw new TypeError('you are not supposed to use this with thenables');
    Object.defineProperty(val, 'then', { configurable: true, value: void 0 });
    resolve(val);
    delete val.then;
  }
  return { promise, safeResolve, reject };
}

let evilProto = { get then() { throw 'boom'; } };

let { promise, safeResolve } = safePromiseCapability();
safeResolve({ __proto__: evilProto, key: 'value' });
console.log((await promise).key); // no boom

turns out we already have the "safe promise resolve" capability with no changes to the language