Excellent domain name!

I love that you’re thinking about how to secure sensitive parts of JS applications, however I wonder what threat this is guarding against. Can you give an example? Surely if an attacker can modify the source to call the sensitive functions, then they could modify the allow list

Now that is ancient js style

I think similar, and arguably more fine-grained, things can be done with Typescript, traditional OOP (interfaces, and maybe the Facade pattern), and perhaps dependency injection.