assign-gingerly 0.0.71 → 0.0.73

package/handlers/manageTemplateList.ts

@@ -30,7 +30,8 @@ import type { ManageTemplateListResolvedParams } from '../types/assign-gingerly/
 import { findMarkers, createMarkers, getNodesBetweenMarkers, MARKER_START_PREFIX, MARKER_END } from '../markerUtils.js';
 import { resolveValue } from '../resolveValues.js';
 import { assignFrom } from '../assignFrom.js';
-import { processInferredAssignments } from '../inferredAssignments.js';
+import { processInferredAssignments } from '../inferredAssignments.js';
+import type { AssignPermissions } from '../types/assign-gingerly/types.js';
 
 /**
  * Reserved keys in fromEachItem config — not treated as shorthand patterns.
@@ -74,7 +75,7 @@ export class ManageTemplateListHandler implements AssignFromHandler {
         this.config = config;
     }
 
-    async assign(lhsTarget: any, resolvedParams: ManageTemplateListResolvedParams, options?: any): Promise<void> {
+    async assign(lhsTarget: any, resolvedParams: ManageTemplateListResolvedParams, options?: any, permissions?: AssignPermissions): Promise<void> {
         //return;
         const {
             forEach: items,
@@ -183,7 +184,7 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                     const len = Math.min(elements.length, configs.length);
                     for (let j = 0; j < len; j++) {
                         const cfg = configs[j];
-                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions });
+                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissions);
                     }
                 } else {
                     const rootEl = existingNodes.find(n => n instanceof Element) as Element | undefined;
@@ -191,13 +192,13 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                         if (processInferred) {
                             processInferred(rootEl, item, inferredConfig === true ? { byItemprop: true } : inferredConfig);
                         } else {
-                            assignFrom(rootEl, toClone, { from: item, ...withOptions });
+                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissions);
                         }
                         if (hostToClone && options?.from) {
-                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions });
+                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissions);
                         }
                         if (targetToClone) {
-                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions });
+                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissions);
                         }
                     }
                 }
@@ -228,7 +229,7 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                     const len = Math.min(elements.length, configs.length);
                     for (let j = 0; j < len; j++) {
                         const cfg = configs[j];
-                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions });
+                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissions);
                     }
                 } else {
                     const rootEl = clonedNodes.find(n => n instanceof Element) as Element | undefined;
@@ -239,14 +240,14 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                         if (processInferred) {
                             processInferred(rootEl, item, inferredConfig === true ? { byItemprop: true } : inferredConfig);
                         } else {
-                            assignFrom(rootEl, toClone, { from: item, ...withOptions });
+                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissions);
                         }
 
                         if (hostToClone && options?.from) {
-                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions });
+                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissions);
                         }
                         if (targetToClone) {
-                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions });
+                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissions);
                         }
                     }
                 }

package/handlers/rangeSelector.ts

@@ -22,7 +22,8 @@
  */
 
 import type { AssignFromHandler } from '../assignFromAsync.js';
-import assignGingerly from '../assignGingerly.js';
+import assignGingerly from '../assignGingerly.js';
+import type { AssignPermissions } from '../types/assign-gingerly/types.js';
 
 /**
  * Operator keys recognized in case objects.
@@ -72,7 +73,7 @@ export class RangeSelectorHandler implements AssignFromHandler {
         this.config = config;
     }
 
-    async assign(lhsTarget: any, resolvedParams: any): Promise<void> {
+    async assign(lhsTarget: any, resolvedParams: any, _options?: any, permissions?: AssignPermissions): Promise<void> {
         const { value, when } = resolvedParams;
 
         if (!Array.isArray(when)) return;
@@ -81,7 +82,7 @@ export class RangeSelectorHandler implements AssignFromHandler {
         for (const caseObj of when) {
             if (caseMatches(value, caseObj)) {
                 if (caseObj.merge && typeof caseObj.merge === 'object') {
-                    assignGingerly(lhsTarget, caseObj.merge);
+                    assignGingerly(lhsTarget, caseObj.merge, undefined, permissions);
                 }
                 return; // First match wins
             }

package/inferencer/types/assign-gingerly/types.d.ts

@@ -1,3 +1,5 @@
+import {ParserOptions} from '../nested-regex-groups/types.js';
+
 export type EnhKey = string | symbol;
 
 // type NoUnderscore<T extends string> = T extends `_${string}` ? never : T;
@@ -196,7 +198,7 @@ export interface AttrConfig<T = unknown, TParserConfig = unknown> {
    * For named parsers like 'parse-pattern-statements', this is forwarded
    * as the options argument to the underlying parse function.
    */
-  parserOptions?: any;
+  parserOptions?: ParserOptions;
 }
 
 export type AttrPatterns<T = any> = {
@@ -252,6 +254,12 @@ export interface IAssignGingerlyOptions {
   bypassChecks?: boolean;
   /**
    * Method names to call during path evaluation (e.g., for `?.method()` calls)
+   *
+   * Append `|` to a path segment (e.g., `?.deref|?.classList?.add`) to call a
+   * listed method with zero arguments instead of consuming the next path segment
+   * as its argument. On the last segment, `|` calls the method with no arguments
+   * and ignores the value. The `|` suffix only applies to names listed here —
+   * for any other segment it is treated as part of a literal property name.
    */
   withMethods?: string[] | Set<string>;
   /**
@@ -343,7 +351,7 @@ export interface AssignFromOptions {
   /** Protocol handlers (sync or async) */
   protocols?: Record<string, (key: string) => any | Promise<any>>;
 
-  /** Method names to call during path evaluation */
+  /** Method names to call during path evaluation (append `|` to a path segment for a zero-argument call) */
   withMethods?: string[] | Set<string>;
 
   /** Alias mappings for path segments */
@@ -701,7 +709,7 @@ export interface HandlerConfig {
  * Handlers are invoked when a LHS key ends with ' =>'.
  */
 export interface AssignFromHandler {
-    assign(lhsTarget: any, resolvedParams: Record<string, any>, options: any): Promise<void> | void;
+    assign(lhsTarget: any, resolvedParams: Record<string, any>, options: any, permissions?: AssignPermissions): Promise<void> | void;
 }
 
 /**
@@ -879,7 +887,7 @@ export interface LazyLoadInstantiatedContext {
 export declare class LazyLoadHandler implements AssignFromHandler {
     config: any;
     constructor(config: any);
-    assign(lhsTarget: any, resolvedParams: Record<string, any>, options?: any): Promise<void>;
+    assign(lhsTarget: any, resolvedParams: Record<string, any>, options?: any, permissions?: AssignPermissions): Promise<void>;
     protected onCloneInserted(nodes: Node[], lhsTarget: Element, resolvedParams: Record<string, any>): Promise<void>;
 }
 
@@ -927,3 +935,54 @@ export interface AddEventListenerConfig extends AssignDispatchVector  {
    
 }
 //#endregion
+
+
+// =============================================================================
+// Permissions
+// =============================================================================
+
+/**
+ * Phase II+: object form for a restricted property setting.
+ */
+export interface RestrictedPropSetting {
+    prop: string;
+    useMethod?: string;          // Phase II: redirect to a safe method
+    attr?: string;               // Phase III: also watch setAttribute for this attr
+    allowFromSameHost?: boolean; // Phase III
+    allowCrossDomain?: boolean;  // Phase III
+}
+
+/**
+ * Phase IV+: object form for a restricted method setting.
+ */
+export interface RestrictedMethodConfig {
+    method: string;
+    addArgs?: string[];          // Phase V: append sanitizer args
+}
+
+/**
+ * Permissions interface for controlling security-sensitive operations.
+ * Only trusted script can set these — never parsed from HTML attributes.
+ */
+export interface AssignPermissions {
+    /** Allow imports from cross-domain URLs (default: false) */
+    crossDomainImports?: boolean;
+
+    /**
+     * Restricted property settings.
+     * Phase I: string entries are property names that cannot be assigned.
+     * Phase II: an object with useMethod redirects ordinary assignment to that
+     * method; command operations remain blocked. Phase III+ adds attr support.
+     *
+     * NOTE: This is a property-assignment guard only. Method calls (setAttribute, etc.)
+     * are not blocked — see Phase III+. Event listeners can still be registered, but
+     * assignments performed by their vectors inherit these permissions.
+     */
+    restrictedPropSettings?: Array<string | RestrictedPropSetting>;
+
+    /** Sanitizer options (Phase III+) */
+    sanitizerOptions?: Record<string, any>;
+
+    /** Restricted method settings (Phase IV+) */
+    restrictedMethodSettings?: Array<string | RestrictedMethodConfig>;
+}

package/inferencer/types/nested-regex-groups/types.d.ts

@@ -91,6 +91,18 @@ export interface ParserOptions {
    * as statement delimiters during splitting.
    */
   ignorePeriodInsideBraces?: boolean;
+
+  /**
+   * When true, normalizes whitespace in the input string before parsing.
+   * This replaces multiple whitespace characters with a single space and trims the string.
+   * Default is false.
+   * 
+   * @example
+   * // Input: "  First.   Second.  "
+   * // With normalizeWhitespace: true -> "First. Second."
+   * // With normalizeWhitespace: false -> "  First.   Second.  "
+   */
+  normalizeWhitespace?: boolean;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "assign-gingerly",
-  "version": "0.0.71",
+  "version": "0.0.73",
   "description": "This package provides a utility function for carefully merging one object into another.",
   "homepage": "https://github.com/bahrus/assign-gingerly#readme",
   "bugs": {
@@ -18,6 +18,7 @@
     "*.js",
     "*.ts",
     "DX/**",
+    "assignPermissions/**",
     "handlers/**",
     "inferencer/**",
     "README.md",
@@ -143,9 +144,9 @@
       "default": "./enhanceAll.js",
       "types": "./enhanceAll.ts"
     },
-    "./isAllowedImportPath.js": {
-      "default": "./isAllowedImportPath.js",
-      "types": "./isAllowedImportPath.ts"
+    "./assignPermissions/isAllowedImportPath.js": {
+      "default": "./assignPermissions/isAllowedImportPath.js",
+      "types": "./assignPermissions/isAllowedImportPath.ts"
     },
     "./markerUtils.js": {
       "default": "./markerUtils.js",
@@ -203,7 +204,7 @@
     "chrome": "npx playwright cr http://localhost:8000"
   },
   "devDependencies": {
-    "@playwright/test": "1.62.0",
+    "@playwright/test": "1.62.1",
     "spa-ssi": "0.0.27"
   }
 }

package/processHandlerCommands.js

@@ -6,7 +6,8 @@
 import { resolveValues } from './resolveValues.js';
 import { getValues } from './getValues.js';
 import { evaluatePathWithMethods } from './assignGingerly.js';
-import { isAllowedImportPath } from './isAllowedImportPath.js';
+import { isAllowedImportPath } from './assignPermissions/isAllowedImportPath.js';
+import { buildRestrictedPropSet, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
 /**
  * Map of built-in handler names to their module paths.
  * These are auto-loaded on demand — no explicit import required.
@@ -80,7 +81,7 @@ async function resolveFromHandlers(name, handlers, permissions) {
         // Import path string — validate and dynamically import
         if (!permissions?.crossDomainImports && !isAllowedImportPath(entry)) {
             throw new Error(`assignFrom: handler "${name}" has an invalid import path "${entry}". ` +
-                `Only relative, absolute, or bare specifier paths are allowed (no cross-domain URLs). ` +
+                `Only same-origin paths or import-map-covered specifiers are allowed. ` +
                 `Pass { crossDomainImports: true } in permissions to override.`);
         }
         const module = await import(entry);
@@ -102,6 +103,7 @@ async function resolveFromHandlers(name, handlers, permissions) {
  * @param handlerRegistry - The registry of handler classes
  */
 export async function processHandlerCommands(target, handlerKeys, pattern, options, permissions) {
+    const restrictedPropSet = buildRestrictedPropSet(permissions);
     for (const key of handlerKeys) {
         const lhsPath = key.substring(0, key.length - 3); // Remove ' =>'
         const rhs = pattern[key];
@@ -211,11 +213,12 @@ export async function processHandlerCommands(target, handlerKeys, pattern, optio
             // Instantiate and invoke the handler
             const handler = new HandlerClass(config);
             //return; //1.5ms
-            const result = await handler.assign(lhsTarget, resolvedParams, options);
+            const result = await handler.assign(lhsTarget, resolvedParams, options, permissions);
             //return; //1.5ms
             // Return-value protocol: if handler returns a non-undefined value,
             // assign it back to the LHS path
-            if (result !== undefined && lhsParent != null && lhsKey != null) {
+            if (result !== undefined && lhsParent != null && lhsKey != null
+                && !redirectRestrictedProp(restrictedPropSet, lhsParent, lhsKey, result)) {
                 lhsParent[lhsKey] = result;
             }
         }

package/processHandlerCommands.ts

@@ -7,8 +7,9 @@
 import { resolveValues } from './resolveValues.js';
 import { getValues } from './getValues.js';
 import { evaluatePathWithMethods } from './assignGingerly.js';
-import { isAllowedImportPath } from './isAllowedImportPath.js';
-import type { AssignPermissions } from './isAllowedImportPath.js';
+import { isAllowedImportPath } from './assignPermissions/isAllowedImportPath.js';
+import { buildRestrictedPropSet, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
+import type { AssignPermissions } from './types/assign-gingerly/types.js';
 import type { AssignFromOptions, AssignFromHandlerConstructor } from './assignFromAsync.js';
 
 /**
@@ -93,7 +94,7 @@ async function resolveFromHandlers(
         if (!permissions?.crossDomainImports && !isAllowedImportPath(entry)) {
             throw new Error(
                 `assignFrom: handler "${name}" has an invalid import path "${entry}". ` +
-                `Only relative, absolute, or bare specifier paths are allowed (no cross-domain URLs). ` +
+                `Only same-origin paths or import-map-covered specifiers are allowed. ` +
                 `Pass { crossDomainImports: true } in permissions to override.`
             );
         }
@@ -125,8 +126,9 @@ export async function processHandlerCommands(
     pattern: Record<string, any>,
     options: AssignFromOptions,
     permissions?: AssignPermissions
-): Promise<void> {
-    
+): Promise<void> {
+    const restrictedPropSet = buildRestrictedPropSet(permissions);
+
     for (const key of handlerKeys) {
         const lhsPath = key.substring(0, key.length - 3); // Remove ' =>'
         const rhs = pattern[key];
@@ -238,12 +240,13 @@ export async function processHandlerCommands(
             // Instantiate and invoke the handler
             const handler = new HandlerClass(config);
             //return; //1.5ms
-            const result = await handler.assign(lhsTarget, resolvedParams, options);
+            const result = await handler.assign(lhsTarget, resolvedParams, options, permissions);
             //return; //1.5ms
-            // Return-value protocol: if handler returns a non-undefined value,
-            // assign it back to the LHS path
-            if (result !== undefined && lhsParent != null && lhsKey != null) {
-                lhsParent[lhsKey] = result;
+            // Return-value protocol: if handler returns a non-undefined value,
+            // assign it back to the LHS path
+            if (result !== undefined && lhsParent != null && lhsKey != null
+                && !redirectRestrictedProp(restrictedPropSet, lhsParent, lhsKey, result)) {
+                lhsParent[lhsKey] = result;
             }
         }
     }

package/types/assign-gingerly/types.d.ts

@@ -1,3 +1,5 @@
+import {ParserOptions} from '../nested-regex-groups/types.js';
+
 export type EnhKey = string | symbol;
 
 // type NoUnderscore<T extends string> = T extends `_${string}` ? never : T;
@@ -196,7 +198,7 @@ export interface AttrConfig<T = unknown, TParserConfig = unknown> {
    * For named parsers like 'parse-pattern-statements', this is forwarded
    * as the options argument to the underlying parse function.
    */
-  parserOptions?: any;
+  parserOptions?: ParserOptions;
 }
 
 export type AttrPatterns<T = any> = {
@@ -252,6 +254,12 @@ export interface IAssignGingerlyOptions {
   bypassChecks?: boolean;
   /**
    * Method names to call during path evaluation (e.g., for `?.method()` calls)
+   *
+   * Append `|` to a path segment (e.g., `?.deref|?.classList?.add`) to call a
+   * listed method with zero arguments instead of consuming the next path segment
+   * as its argument. On the last segment, `|` calls the method with no arguments
+   * and ignores the value. The `|` suffix only applies to names listed here —
+   * for any other segment it is treated as part of a literal property name.
    */
   withMethods?: string[] | Set<string>;
   /**
@@ -343,7 +351,7 @@ export interface AssignFromOptions {
   /** Protocol handlers (sync or async) */
   protocols?: Record<string, (key: string) => any | Promise<any>>;
 
-  /** Method names to call during path evaluation */
+  /** Method names to call during path evaluation (append `|` to a path segment for a zero-argument call) */
   withMethods?: string[] | Set<string>;
 
   /** Alias mappings for path segments */
@@ -701,7 +709,7 @@ export interface HandlerConfig {
  * Handlers are invoked when a LHS key ends with ' =>'.
  */
 export interface AssignFromHandler {
-    assign(lhsTarget: any, resolvedParams: Record<string, any>, options: any): Promise<void> | void;
+    assign(lhsTarget: any, resolvedParams: Record<string, any>, options: any, permissions?: AssignPermissions): Promise<void> | void;
 }
 
 /**
@@ -879,7 +887,7 @@ export interface LazyLoadInstantiatedContext {
 export declare class LazyLoadHandler implements AssignFromHandler {
     config: any;
     constructor(config: any);
-    assign(lhsTarget: any, resolvedParams: Record<string, any>, options?: any): Promise<void>;
+    assign(lhsTarget: any, resolvedParams: Record<string, any>, options?: any, permissions?: AssignPermissions): Promise<void>;
     protected onCloneInserted(nodes: Node[], lhsTarget: Element, resolvedParams: Record<string, any>): Promise<void>;
 }
 
@@ -927,3 +935,54 @@ export interface AddEventListenerConfig extends AssignDispatchVector  {
    
 }
 //#endregion
+
+
+// =============================================================================
+// Permissions
+// =============================================================================
+
+/**
+ * Phase II+: object form for a restricted property setting.
+ */
+export interface RestrictedPropSetting {
+    prop: string;
+    useMethod?: string;          // Phase II: redirect to a safe method
+    attr?: string;               // Phase III: also watch setAttribute for this attr
+    allowFromSameHost?: boolean; // Phase III
+    allowCrossDomain?: boolean;  // Phase III
+}
+
+/**
+ * Phase IV+: object form for a restricted method setting.
+ */
+export interface RestrictedMethodConfig {
+    method: string;
+    addArgs?: string[];          // Phase V: append sanitizer args
+}
+
+/**
+ * Permissions interface for controlling security-sensitive operations.
+ * Only trusted script can set these — never parsed from HTML attributes.
+ */
+export interface AssignPermissions {
+    /** Allow imports from cross-domain URLs (default: false) */
+    crossDomainImports?: boolean;
+
+    /**
+     * Restricted property settings.
+     * Phase I: string entries are property names that cannot be assigned.
+     * Phase II: an object with useMethod redirects ordinary assignment to that
+     * method; command operations remain blocked. Phase III+ adds attr support.
+     *
+     * NOTE: This is a property-assignment guard only. Method calls (setAttribute, etc.)
+     * are not blocked — see Phase III+. Event listeners can still be registered, but
+     * assignments performed by their vectors inherit these permissions.
+     */
+    restrictedPropSettings?: Array<string | RestrictedPropSetting>;
+
+    /** Sanitizer options (Phase III+) */
+    sanitizerOptions?: Record<string, any>;
+
+    /** Restricted method settings (Phase IV+) */
+    restrictedMethodSettings?: Array<string | RestrictedMethodConfig>;
+}

package/isAllowedImportPath.js

@@ -1,42 +0,0 @@
-/**
- * isAllowedImportPath.ts — Security utility for validating import paths.
- *
- * Checks that a path is local (relative, absolute, or bare specifier) and
- * not a cross-domain URL. Used to prevent untrusted HTML attributes from
- * triggering imports to arbitrary external domains.
- *
- * @example
- * import { isAllowedImportPath } from 'assign-gingerly/isAllowedImportPath.js';
- *
- * isAllowedImportPath('./local.js');           // true
- * isAllowedImportPath('../parent/file.js');    // true
- * isAllowedImportPath('/absolute/path.js');    // true
- * isAllowedImportPath('bare-specifier/mod.js'); // true
- * isAllowedImportPath('https://evil.com/x.js'); // false
- * isAllowedImportPath('//cdn.example.com/x.js'); // false
- */
-/**
- * Check if an import path is allowed (non-cross-domain).
- *
- * Allowed:
- * - Relative paths: ./foo.js, ../bar.js
- * - Absolute paths: /path/to/file.js
- * - Bare specifiers: package-name/file.js, @scope/package/file.js
- *
- * Blocked:
- * - Protocol URLs: https://..., http://..., data:..., etc.
- * - Protocol-relative: //cdn.example.com/...
- *
- * @param path - The import path to validate
- * @returns true if the path is local/safe, false if cross-domain
- */
-export function isAllowedImportPath(path) {
-    if (path.startsWith('./') || path.startsWith('../') || path.startsWith('/')) {
-        return true;
-    }
-    if (path.includes('://') || path.startsWith('//')) {
-        return false;
-    }
-    // Bare specifier (no protocol, no //) — allowed
-    return true;
-}

package/isAllowedImportPath.ts

@@ -1,53 +0,0 @@
-/**
- * isAllowedImportPath.ts — Security utility for validating import paths.
- * 
- * Checks that a path is local (relative, absolute, or bare specifier) and
- * not a cross-domain URL. Used to prevent untrusted HTML attributes from
- * triggering imports to arbitrary external domains.
- * 
- * @example
- * import { isAllowedImportPath } from 'assign-gingerly/isAllowedImportPath.js';
- * 
- * isAllowedImportPath('./local.js');           // true
- * isAllowedImportPath('../parent/file.js');    // true
- * isAllowedImportPath('/absolute/path.js');    // true
- * isAllowedImportPath('bare-specifier/mod.js'); // true
- * isAllowedImportPath('https://evil.com/x.js'); // false
- * isAllowedImportPath('//cdn.example.com/x.js'); // false
- */
-
-/**
- * Permissions interface for controlling security-sensitive operations.
- * Passed as the last parameter to assignGingerly, assignFrom, and enhanceAll.
- * Only trusted script can set these — they are never parsed from HTML attributes.
- */
-export interface AssignPermissions {
-    /** Allow imports from cross-domain URLs (default: false) */
-    crossDomainImports?: boolean;
-}
-
-/**
- * Check if an import path is allowed (non-cross-domain).
- * 
- * Allowed:
- * - Relative paths: ./foo.js, ../bar.js
- * - Absolute paths: /path/to/file.js
- * - Bare specifiers: package-name/file.js, @scope/package/file.js
- * 
- * Blocked:
- * - Protocol URLs: https://..., http://..., data:..., etc.
- * - Protocol-relative: //cdn.example.com/...
- * 
- * @param path - The import path to validate
- * @returns true if the path is local/safe, false if cross-domain
- */
-export function isAllowedImportPath(path: string): boolean {
-    if (path.startsWith('./') || path.startsWith('../') || path.startsWith('/')) {
-        return true;
-    }
-    if (path.includes('://') || path.startsWith('//')) {
-        return false;
-    }
-    // Bare specifier (no protocol, no //) — allowed
-    return true;
-}