Class SecurityApi

Throw SecurityError unless some frame on the current call stack is test code — a .test.{ts,js} spec or a __tests__/ fixture. Call from the top of every _*ForTest / _*ForTesting method to guarantee production code can't reach the seam.

op is the seam name; included in the error message so the offender sees exactly which seam was misused.

Apply the standard Api-class decoration imperatively — used by Api files that can't take a @CallSecurity class decorator because they have static #private identifiers (TS18036). Stamps the class-default policy as Public (only when no policy is already registered, so we don't trample a per-method or class-form decorator that ran first) and wraps every own static method so static Api calls push frames.

Returns the set of

Register the security gate as a ProxyApi interceptor. Called automatically by the static initializer at module-load time; idempotent — safe for tests that reset ProxyApi to call again.

Returns true if the method is marked unshadowable — either method-form on it directly, or class-form on the host's class or any ancestor. Read at attach time by ShadowApi.

Resolve the entry policy for a method on instance. Walks the prototype chain looking for the closest method-form @CallSecurity, then falls back to class-form default along the chain, then to Public.

Resolution order:

1. Method-form

Resolve @ShadowSecurity for host[methodName]. Walks the host's prototype chain; closest spec wins. Returns null when nothing is stamped — ShadowApi treats absent specs as Public.

Resolve the entry policy for a static method on cls. Walks up the class itself (not the prototype chain — statics aren't inherited the same way). Returns Public if no policy was registered.

Mint a fresh, URL-safe, collision-resistant identifier — the project-wide id source. Server code calls this instead of importing nanoid directly, so id generation routes through one Api seam (the client mints its own ids browser-side). Despite the name it returns a nanoid (21 chars by default), not an RFC-4122 UUID.