Place internals in `lib/private` so `lib/` just contains the exports

Also combine `guards.js` with `_helpers.js`, as a generic `util` module.