assign-gingerly 0.0.71 → 0.0.73

package/assignGingerly.ts

@@ -2,7 +2,9 @@
 
 import { EnhancementConfig } from "./types/assign-gingerly/types";
 import type { AssignFromOptions, FeatureConfigsMap, IAssignGingerlyOptions } from "./types/assign-gingerly/types";
-import type { AssignPermissions } from "./isAllowedImportPath.js";
+import type { AssignPermissions } from './types/assign-gingerly/types.js';
+import { buildRestrictedPropSet, checkRestrictedProp, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
+import type { RestrictedPropSettingsMap } from './assignPermissions/restrictedProps.js';
 import { normalizeAliasOptions } from './getValues.js';
 
 /**
@@ -248,12 +250,30 @@ function isIncCommand(key: string): boolean {
 /**
  * Helper function to parse an += command and extract the path
  */
-function parseIncCommand(key: string): string | null {
-  if (!isIncCommand(key)) {
-    return null;
-  }
-  return key.substring(0, key.length - 3); // Remove ' +=' suffix
-}
+function parseIncCommand(key: string): string | null {
+  if (!isIncCommand(key)) {
+    return null;
+  }
+  return key.substring(0, key.length - 3); // Remove ' +=' suffix
+}
+
+/**
+ * Apply the scalar and array semantics of the += command.
+ */
+function addValue(lhs: any, rhs: any): any {
+  if (Array.isArray(lhs)) {
+    return Array.isArray(rhs) ? [...lhs, ...rhs] : [...lhs, rhs];
+  }
+  if (typeof lhs === 'number' && typeof rhs === 'string') {
+    const parsed = Number(rhs);
+    return Number.isNaN(parsed) ? lhs + rhs : lhs + parsed;
+  }
+  if (typeof lhs === 'string' && typeof rhs === 'number') {
+    const parsed = Number(lhs);
+    return Number.isNaN(parsed) ? lhs + rhs : (parsed + rhs).toString();
+  }
+  return lhs + rhs;
+}
 
 /**
  * Helper function to check if a key represents a =! command
@@ -435,7 +455,7 @@ export function evaluatePathWithMethods(
   pathParts: string[],
   value: any,
   withMethods: Set<string>
-): { target: any; lastKey: string; isMethod: boolean } {
+): { target: any; lastKey: string; isMethod: boolean; isZeroArg: boolean } {
   let current = target;
   let i = 0;
   
@@ -444,12 +464,18 @@ export function evaluatePathWithMethods(
     const part = pathParts[i];
     const nextPart = pathParts[i + 1];
     
-    if (withMethods.has(part)) {
-      const method = current[part];
+    // A trailing | marks a zero-argument method call: 'deref|' calls deref()
+    // without consuming the next segment. Only applies to names in withMethods.
+    const isZeroArgMethod = part.endsWith('|') && withMethods.has(part.slice(0, -1));
+    const nextIsMethod = withMethods.has(nextPart)
+      || (nextPart.endsWith('|') && withMethods.has(nextPart.slice(0, -1)));
+    
+    if (withMethods.has(part) || isZeroArgMethod) {
+      const methodName = isZeroArgMethod ? part.slice(0, -1) : part;
+      const method = current[methodName];
       if (typeof method === 'function') {
-        // Check if next part is also a method
-        if (withMethods.has(nextPart)) {
-          // Both are methods - call first with no args
+        if (isZeroArgMethod || nextIsMethod) {
+          // Zero-arg call - next part is either a method or explicitly not an argument
           current = method.call(current);
         } else {
           // Only current is method - call with next part as string arg
@@ -458,10 +484,10 @@ export function evaluatePathWithMethods(
         }
       } else {
         // Not a function - just access property (create if needed)
-        if (!(part in current) || typeof current[part] !== 'object' || current[part] === null) {
-          current[part] = {};
+        if (!(methodName in current) || typeof current[methodName] !== 'object' || current[methodName] === null) {
+          current[methodName] = {};
         }
-        current = current[part];
+        current = current[methodName];
       }
     } else {
       // Not a method - normal property access (create if needed)
@@ -474,11 +500,16 @@ export function evaluatePathWithMethods(
     i++;
   }
   
-  const lastKey = pathParts[pathParts.length - 1];
+  // Strip a trailing | from the last segment only when it names a listed method;
+  // otherwise it is a literal property name (e.g. an exotic key ending in |).
+  const rawLastKey = pathParts[pathParts.length - 1];
+  const isZeroArg = rawLastKey.endsWith('|') && withMethods.has(rawLastKey.slice(0, -1));
+  const lastKey = isZeroArg ? rawLastKey.slice(0, -1) : rawLastKey;
   return {
     target: current,
     lastKey,
-    isMethod: withMethods.has(lastKey)
+    isMethod: withMethods.has(lastKey),
+    isZeroArg
   };
 }
 
@@ -536,7 +567,9 @@ function applyToEach(
   value: any,
   withMethods: Set<string>,
   aliasMap: Map<string, string>,
-  options?: IAssignGingerlyOptions
+  options?: IAssignGingerlyOptions,
+  permissions?: AssignPermissions,
+  restrictedPropSet?: RestrictedPropSettingsMap
 ): void {
   // Convert to array for iteration
   const items = Array.isArray(iterable) ? iterable : Array.from(iterable);
@@ -560,13 +593,22 @@ function applyToEach(
       // Navigate to the nested iterable
       let current = item;
       for (const part of pathToForEach) {
-        if (withMethods.has(part)) {
-          const method = current[part];
+        // A trailing | marks a zero-argument method call (only for names in withMethods)
+        const isZeroArgMethod = part.endsWith('|') && withMethods.has(part.slice(0, -1));
+        if (withMethods.has(part) || isZeroArgMethod) {
+          const methodName = isZeroArgMethod ? part.slice(0, -1) : part;
+          const method = current[methodName];
           if (typeof method === 'function') {
+            if (isZeroArgMethod) {
+              current = method.call(current);
+              continue;
+            }
             // For methods in the middle, we need to check the next part
             const nextIndex = pathToForEach.indexOf(part) + 1;
             const nextPart = pathToForEach[nextIndex];
-            if (nextPart && withMethods.has(nextPart)) {
+            const nextIsMethod = nextPart && (withMethods.has(nextPart)
+              || (nextPart.endsWith('|') && withMethods.has(nextPart.slice(0, -1))));
+            if (nextIsMethod) {
               current = method.call(current);
             } else if (nextPart) {
               current = method.call(current, nextPart);
@@ -576,7 +618,7 @@ function applyToEach(
               current = method.call(current);
             }
           } else {
-            current = current[part];
+            current = current[methodName];
           }
         } else {
           current = current[part];
@@ -585,7 +627,7 @@ function applyToEach(
       
       // Recursively apply to the nested iterable
       if (isIterable(current)) {
-        applyToEach(current, pathAfterForEach, value, withMethods, aliasMap, options);
+        applyToEach(current, pathAfterForEach, value, withMethods, aliasMap, options, permissions, restrictedPropSet);
       }
     } else {
       // No nested @each, evaluate the remaining path normally
@@ -595,7 +637,10 @@ function applyToEach(
         // Last segment is a method - call it
         const method = result.target[result.lastKey];
         if (typeof method === 'function') {
-          if (Array.isArray(value)) {
+          if (result.isZeroArg) {
+            // Trailing | marker - call with no arguments, ignoring the value
+            method.call(result.target);
+          } else if (Array.isArray(value)) {
             method.apply(result.target, value);
           } else {
             method.call(result.target, value);
@@ -606,13 +651,15 @@ function applyToEach(
         const lastKey = result.lastKey;
         const parent = result.target;
         
-        if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+        if (redirectRestrictedProp(restrictedPropSet, parent, lastKey, value)) {
+          // skip
+        } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
           if (lastKey in parent && isReadonlyProperty(parent, lastKey)) {
             const currentValue = parent[lastKey];
             if (typeof currentValue !== 'object' || currentValue === null) {
               throw new Error(`Cannot merge object into readonly primitive property '${String(lastKey)}'`);
             }
-            assignGingerly(currentValue, value, options);
+            assignGingerly(currentValue, value, options, permissions);
           } else {
             parent[lastKey] = value;
           }
@@ -663,6 +710,9 @@ export function assignGingerly(
 
   const { aliasMap, withMethods: withMethodsSet } = normalizeAliasOptions(options);
 
+  // Normalize restrictedPropSettings once per top-level call
+  const restrictedPropSet = buildRestrictedPropSet(permissions);
+
   // Convert withAsyncMethods array to Set for O(1) lookup
   const withAsyncMethodsSet = options?.withAsyncMethods
     ? options.withAsyncMethods instanceof Set
@@ -761,55 +811,49 @@ export function assignGingerly(
           }
 
           //TODO:  this logic seems to occur twice at least.  Maybe make it a method?
-          // Event handler: Element LHS + object RHS with 'on' property
+          if (checkRestrictedProp(restrictedPropSet, lhsKey)) {
+            continue;
+          }
+
+          // Event handler: Element LHS + object RHS with 'on' property
           if (lhsValue instanceof Element && value && typeof value === 'object' && !Array.isArray(value) && 'on' in value) {
             const capturedLhs = lhsValue;
             const capturedValue = value;
             const capturedTarget = target;
-            const capturedOptions = options as AssignFromOptions | undefined;
-            import('./handlers/addEventListener.js').then(({ attachEventListener }) => {
-              attachEventListener(capturedLhs, capturedValue, capturedTarget, capturedOptions?.from ?? capturedTarget, capturedOptions ?? {});
+            const capturedOptions = options as AssignFromOptions | undefined;
+            import('./handlers/addEventListener.js').then(({ attachEventListener }) => {
+              attachEventListener(capturedLhs, capturedValue, capturedTarget, capturedOptions?.from ?? capturedTarget, capturedOptions ?? {}, permissions);
             });
             continue;
           }
 
-          if (!(lhsKey in lhsParent)) {
-            lhsParent[lhsKey] = value;
-          } else if (Array.isArray(lhsValue)) {
-            lhsParent[lhsKey] = Array.isArray(value)
-              ? [...lhsValue, ...value]
-              : [...lhsValue, value];
-          } else if (typeof lhsValue === 'number' && typeof value === 'string') {
-            const parsed = Number(value);
-            lhsParent[lhsKey] = isNaN(parsed) ? lhsValue + value : lhsValue + parsed;
-          } else {
-            lhsParent[lhsKey] += value;
+          if (!(lhsKey in lhsParent)) {
+            lhsParent[lhsKey] = value;
+          } else {
+            lhsParent[lhsKey] = addValue(lhsValue, value);
           }
         } else {
-          // Plain key - direct operation on target
-          // Event handler: Element LHS + object RHS with 'on' property
+          // Plain key - direct operation on target
+          if (checkRestrictedProp(restrictedPropSet, path)) {
+            continue;
+          }
+
+          // Event handler: Element LHS + object RHS with 'on' property
           if (target[path] instanceof Element && value && typeof value === 'object' && !Array.isArray(value) && 'on' in value) {
             const capturedLhs = target[path];
             const capturedValue = value;
             const capturedTarget = target;
-            const capturedOptions = options as AssignFromOptions | undefined;
-            import('./handlers/addEventListener.js').then(({ attachEventListener }) => {
-              attachEventListener(capturedLhs, capturedValue, capturedTarget, capturedOptions?.from ?? capturedTarget, capturedOptions ?? {});
+            const capturedOptions = options as AssignFromOptions | undefined;
+            import('./handlers/addEventListener.js').then(({ attachEventListener }) => {
+              attachEventListener(capturedLhs, capturedValue, capturedTarget, capturedOptions?.from ?? capturedTarget, capturedOptions ?? {}, permissions);
             });
             continue;
           }
 
-          if (!(path in target)) {
-            target[path] = value;
-          } else if (Array.isArray(target[path])) {
-            target[path] = Array.isArray(value)
-              ? [...target[path], ...value]
-              : [...target[path], value];
-          } else if (typeof target[path] === 'number' && typeof value === 'string') {
-            const parsed = Number(value);
-            target[path] = isNaN(parsed) ? target[path] + value : target[path] + parsed;
-          } else {
-            target[path] += value;
+          if (!(path in target)) {
+            target[path] = value;
+          } else {
+            target[path] = addValue(target[path], value);
           }
         }
       }
@@ -864,8 +908,10 @@ export function assignGingerly(
           }
         }
         
-        // Apply negation to LHS
-        lhsParent[lhsLastKey] = !valueToNegate;
+        // Apply negation to LHS — check restriction first
+        if (!checkRestrictedProp(restrictedPropSet, lhsLastKey)) {
+          lhsParent[lhsLastKey] = !valueToNegate;
+        }
       }
       continue;
     }
@@ -915,11 +961,16 @@ export function assignGingerly(
     }
 
     // Handle Y= merge commands (recursive assignGingerly into sub-object)
-    if (isMergeCommand(key)) {
-      const path = parseMergeCommand(key);
-      if (path) {
-        // Navigate to the target sub-object
-        let mergeTarget: any;
+    if (isMergeCommand(key)) {
+      const path = parseMergeCommand(key);
+      if (path) {
+        const pathParts = isNestedPath(path) ? parsePath(path) : [path];
+        const lastKey = pathParts[pathParts.length - 1];
+        if (checkRestrictedProp(restrictedPropSet, lastKey)) {
+          continue;
+        }
+        // Navigate to the target sub-object
+        let mergeTarget: any;
         if (isNestedPath(path)) {
           if (withMethodsSet) {
             const result = evaluatePathWithMethods(target, parsePath(path), value, withMethodsSet);
@@ -970,9 +1021,11 @@ export function assignGingerly(
                 pathParts,
                 forEachIndex,
                 value,
-                withMethodsSet,
-                aliasMap,
-                options
+                withMethodsSet,
+                aliasMap,
+                options,
+                permissions,
+                restrictedPropSet
               );
             } catch (error) {
               console.error('Error in @eachTime:', error);
@@ -1002,7 +1055,7 @@ export function assignGingerly(
         
         // Apply to each item in the iterable
         if (isIterable(current)) {
-          applyToEach(current, pathAfterForEach, value, withMethodsSet || new Set(), aliasMap, options);
+          applyToEach(current, pathAfterForEach, value, withMethodsSet || new Set(), aliasMap, options, permissions, restrictedPropSet);
         }
         // If not iterable, let JavaScript throw error naturally when trying to iterate
         
@@ -1011,13 +1064,15 @@ export function assignGingerly(
       
       // No @each in path - handle normally
       // Check if we need to handle async methods (fire-and-forget)
-      if (withAsyncMethodsSet && pathParts.some(p => withAsyncMethodsSet.has(p))) {
+      if (withAsyncMethodsSet && pathParts.some(p => withAsyncMethodsSet.has(p) || (p.endsWith('|') && withAsyncMethodsSet.has(p.slice(0, -1))))) {
         // Fire-and-forget: dynamically import the async evaluator and run the chain
         const capturedTarget = target;
         const capturedPathParts = pathParts;
         const capturedValue = value;
-        const capturedWithMethodsSet = withMethodsSet || new Set<string>();
-        const capturedOptions = options;
+        const capturedWithMethodsSet = withMethodsSet || new Set<string>();
+        const capturedOptions = options;
+        const capturedPermissions = permissions;
+        const capturedRestrictedPropSet = restrictedPropSet;
         (async () => {
           const { evaluatePathWithAsyncMethods } = await import('./evaluatePathWithAsyncMethods.js');
           const result = await evaluatePathWithAsyncMethods(
@@ -1029,7 +1084,10 @@ export function assignGingerly(
             // Last segment is a method — call it
             const method = result.target[result.lastKey];
             if (typeof method === 'function') {
-              const returnVal = Array.isArray(capturedValue)
+              // Trailing | marker - call with no arguments, ignoring the value
+              const returnVal = result.isZeroArg
+                ? method.call(result.target)
+                : Array.isArray(capturedValue)
                 ? method.apply(result.target, capturedValue)
                 : method.call(result.target, capturedValue);
               // If it's an async method, await it (for side effects)
@@ -1038,14 +1096,16 @@ export function assignGingerly(
           } else {
             // Not a method — assign the value
             const lastKey = result.lastKey;
-            const parent = result.target;
-            if (typeof capturedValue === 'object' && capturedValue !== null && !Array.isArray(capturedValue)) {
+            const parent = result.target;
+            if (redirectRestrictedProp(capturedRestrictedPropSet, parent, lastKey, capturedValue)) {
+              // skip
+            } else if (typeof capturedValue === 'object' && capturedValue !== null && !Array.isArray(capturedValue)) {
               if (lastKey in parent && isReadonlyProperty(parent, lastKey)) {
                 const currentValue = parent[lastKey];
                 if (typeof currentValue !== 'object' || currentValue === null) {
                   throw new Error(`Cannot merge object into readonly primitive property '${String(lastKey)}'`);
                 }
-                assignGingerly(currentValue, capturedValue, capturedOptions);
+                assignGingerly(currentValue, capturedValue, capturedOptions, capturedPermissions);
               } else {
                 parent[lastKey] = capturedValue;
               }
@@ -1065,7 +1125,10 @@ export function assignGingerly(
           // Last segment is a method - call it
           const method = result.target[result.lastKey];
           if (typeof method === 'function') {
-            if (Array.isArray(value)) {
+            if (result.isZeroArg) {
+              // Trailing | marker - call with no arguments, ignoring the value
+              method.call(result.target);
+            } else if (Array.isArray(value)) {
               method.apply(result.target, value);
             } else {
               method.call(result.target, value);
@@ -1079,19 +1142,19 @@ export function assignGingerly(
         const lastKey = result.lastKey;
         const parent = result.target;
         
-        // Check for static assignTo protocol
-        if (lastKey in parent && tryAssignTo(parent[lastKey], value, parent, lastKey)) {
-          continue;
-        }
-
-        if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+        if (redirectRestrictedProp(restrictedPropSet, parent, lastKey, value)) {
+          // skip
+        // Check for static assignTo protocol
+        } else if (lastKey in parent && tryAssignTo(parent[lastKey], value, parent, lastKey)) {
+          continue;
+        } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
           // Check if property exists and is readonly
           if (lastKey in parent && isReadonlyProperty(parent, lastKey)) {
             const currentValue = parent[lastKey];
             if (typeof currentValue !== 'object' || currentValue === null) {
               throw new Error(`Cannot merge object into readonly primitive property '${String(lastKey)}'`);
             }
-            assignGingerly(currentValue, value, options);
+            assignGingerly(currentValue, value, options, permissions);
           } else {
             // Property is writable - replace it
             parent[lastKey] = value;
@@ -1104,12 +1167,12 @@ export function assignGingerly(
         const lastKey = pathParts[pathParts.length - 1];
         const parent = ensureNestedPath(target, pathParts);
 
-        // Check for static assignTo protocol
-        if (lastKey in parent && tryAssignTo(parent[lastKey], value, parent, lastKey)) {
-          continue;
-        }
-
-        if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+        if (redirectRestrictedProp(restrictedPropSet, parent, lastKey, value)) {
+          // skip
+        // Check for static assignTo protocol
+        } else if (lastKey in parent && tryAssignTo(parent[lastKey], value, parent, lastKey)) {
+          continue;
+        } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
           // Check if property exists and is readonly
           if (lastKey in parent && isReadonlyProperty(parent, lastKey)) {
             // Property is readonly - check if current value is an object
@@ -1118,7 +1181,7 @@ export function assignGingerly(
               throw new Error(`Cannot merge object into readonly primitive property '${String(lastKey)}'`);
             }
             // Recursively apply assignGingerly to the readonly object
-            assignGingerly(currentValue, value, options);
+            assignGingerly(currentValue, value, options, permissions);
           } else {
             // Property is writable - replace it
             parent[lastKey] = value;
@@ -1130,11 +1193,16 @@ export function assignGingerly(
     } else {
       // Non-nested path
       
-      // Check if this is a method call
-      if (withMethodsSet && withMethodsSet.has(key)) {
-        const method = target[key];
+      // Check if this is a method call (a trailing | marks a zero-argument call)
+      const isZeroArgKey = key.endsWith('|') && withMethodsSet !== undefined && withMethodsSet.has(key.slice(0, -1));
+      if (withMethodsSet && (withMethodsSet.has(key) || isZeroArgKey)) {
+        const methodName = isZeroArgKey ? key.slice(0, -1) : key;
+        const method = target[methodName];
         if (typeof method === 'function') {
-          if (Array.isArray(value)) {
+          if (isZeroArgKey) {
+            // Trailing | marker - call with no arguments, ignoring the value
+            method.call(target);
+          } else if (Array.isArray(value)) {
             method.apply(target, value);
           } else {
             method.call(target, value);
@@ -1144,13 +1212,12 @@ export function assignGingerly(
         continue;
       }
       
-      // Normal assignment
-      // Check for static assignTo protocol
-      if (key in target && tryAssignTo(target[key], value, target, key)) {
-        continue;
-      }
-
-      if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      if (redirectRestrictedProp(restrictedPropSet, target, key, value)) {
+        // skip
+      // Check for static assignTo protocol
+      } else if (key in target && tryAssignTo(target[key], value, target, key)) {
+        continue;
+      } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
         // Check if property exists and is readonly
         if (key in target && isReadonlyProperty(target, key)) {
           // Property is readonly - check if current value is an object
@@ -1159,7 +1226,7 @@ export function assignGingerly(
             throw new Error(`Cannot merge object into readonly primitive property '${String(key)}'`);
           }
           // Recursively apply assignGingerly to the readonly object
-          assignGingerly(currentValue, value, options);
+          assignGingerly(currentValue, value, options, permissions);
         } else {
           // Property is writable - replace it
           target[key] = value;

package/assignPermissions/isAllowedImportPath.js

@@ -0,0 +1,41 @@
+/**
+ * Check whether an import specifier resolves to the current origin or is
+ * covered by an import-map entry.
+ */
+export function isAllowedImportPath(value) {
+    if (typeof document === 'undefined' || typeof location === 'undefined')
+        return false;
+    if (!value || !(value.startsWith('./') || value.startsWith('../') || value.startsWith('/'))) {
+        return isImportMapSpecifier(value);
+    }
+    try {
+        return new URL(value, document.baseURI).origin === location.origin;
+    }
+    catch {
+        return false;
+    }
+}
+function isImportMapSpecifier(value) {
+    const importMaps = document.querySelectorAll('script[type="importmap"]');
+    for (const importMap of importMaps) {
+        try {
+            const parsed = JSON.parse(importMap.textContent ?? '');
+            if (!isImportMap(parsed))
+                continue;
+            for (const key of Object.keys(parsed.imports)) {
+                if (key.endsWith('/') ? value.startsWith(key) : value === key)
+                    return true;
+            }
+        }
+        catch {
+            // Ignore malformed import maps and continue searching.
+        }
+    }
+    return false;
+}
+function isImportMap(value) {
+    if (!value || typeof value !== 'object' || !('imports' in value))
+        return false;
+    const { imports } = value;
+    return !!imports && typeof imports === 'object' && !Array.isArray(imports);
+}

package/assignPermissions/isAllowedImportPath.ts

@@ -0,0 +1,38 @@
+/**
+ * Check whether an import specifier resolves to the current origin or is
+ * covered by an import-map entry.
+ */
+export function isAllowedImportPath(value: string): boolean {
+    if (typeof document === 'undefined' || typeof location === 'undefined') return false;
+    if (!value || !(value.startsWith('./') || value.startsWith('../') || value.startsWith('/'))) {
+        return isImportMapSpecifier(value);
+    }
+
+    try {
+        return new URL(value, document.baseURI).origin === location.origin;
+    } catch {
+        return false;
+    }
+}
+
+function isImportMapSpecifier(value: string): boolean {
+    const importMaps = document.querySelectorAll('script[type="importmap"]');
+    for (const importMap of importMaps) {
+        try {
+            const parsed = JSON.parse(importMap.textContent ?? '');
+            if (!isImportMap(parsed)) continue;
+            for (const key of Object.keys(parsed.imports)) {
+                if (key.endsWith('/') ? value.startsWith(key) : value === key) return true;
+            }
+        } catch {
+            // Ignore malformed import maps and continue searching.
+        }
+    }
+    return false;
+}
+
+function isImportMap(value: unknown): value is { imports: Record<string, unknown> } {
+    if (!value || typeof value !== 'object' || !('imports' in value)) return false;
+    const { imports } = value;
+    return !!imports && typeof imports === 'object' && !Array.isArray(imports);
+}

package/assignPermissions/restrictedProps.js

@@ -0,0 +1,43 @@
+const warnedOnce = new Set();
+function warnRestricted(key) {
+    if (!warnedOnce.has(key)) {
+        warnedOnce.add(key);
+        console.warn(`assignGingerly: property '${key}' is in restrictedPropSettings — assignment skipped.`);
+    }
+}
+export function buildRestrictedPropSet(permissions) {
+    const settings = permissions?.restrictedPropSettings;
+    if (!settings || settings.length === 0)
+        return undefined;
+    const restrictedPropSet = new Map();
+    for (const setting of settings) {
+        const prop = typeof setting === 'string' ? setting : setting.prop;
+        if (restrictedPropSet.has(prop)) {
+            throw new Error(`assignGingerly: duplicate restrictedPropSettings entry for '${prop}'.`);
+        }
+        restrictedPropSet.set(prop, typeof setting === 'string' ? undefined : setting);
+    }
+    return restrictedPropSet;
+}
+export function checkRestrictedProp(restrictedPropSet, key) {
+    if (!restrictedPropSet || !restrictedPropSet.has(key))
+        return false;
+    warnRestricted(key);
+    return true;
+}
+export function redirectRestrictedProp(restrictedPropSet, target, key, value) {
+    if (!restrictedPropSet || !restrictedPropSet.has(key))
+        return false;
+    const setting = restrictedPropSet.get(key);
+    if (!setting?.useMethod) {
+        warnRestricted(key);
+        return true;
+    }
+    const method = target?.[setting.useMethod];
+    if (typeof method !== 'function') {
+        warnRestricted(key);
+        return true;
+    }
+    method.call(target, value);
+    return true;
+}