assign-gingerly 0.0.72 → 0.0.73

package/assignFrom.ts

@@ -13,7 +13,7 @@ import { getValues, getValue } from './getValues.js';
 import assignGingerly from './assignGingerly.js';
 import { resolveIdVariable, parseIdRef } from './resolveIdRef.js';
 import { processInferredAssignments } from './inferredAssignments.js';
-import type { AssignPermissions } from './isAllowedImportPath.js';
+import type { AssignPermissions } from './types/assign-gingerly/types.js';
 import type { AssignFromOptions, AssignFromHandler, AssignFromHandlerConstructor } from './types/assign-gingerly/types.js';
 
 // Re-export types for consumers

package/assignFromAsync.ts

@@ -22,7 +22,7 @@
 import { resolveValues } from './resolveValues.js';
 import {IAssignGingerlyOptions} from './types/assign-gingerly/types.js';
 import assignGingerly from './assignGingerly.js';
-import type { AssignPermissions } from './isAllowedImportPath.js';
+import type { AssignPermissions } from './types/assign-gingerly/types.js';
 import type { AssignFromHandler, AssignFromHandlerConstructor } from './types/assign-gingerly/types.js';
 import {
   expandSubstitutions, categorizeKeys, handleSpreads, isHandlerCommand

package/assignGingerly.js

@@ -1,4 +1,4 @@
-import { buildRestrictedPropSet, checkRestrictedProp, redirectRestrictedProp } from './isAllowedImportPath.js';
+import { buildRestrictedPropSet, checkRestrictedProp, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
 import { normalizeAliasOptions } from './getValues.js';
 /**
  * GUID for global instance map storage to ensure uniqueness across package versions

package/assignGingerly.ts

@@ -2,8 +2,9 @@
 
 import { EnhancementConfig } from "./types/assign-gingerly/types";
 import type { AssignFromOptions, FeatureConfigsMap, IAssignGingerlyOptions } from "./types/assign-gingerly/types";
-import type { AssignPermissions, RestrictedPropSettingsMap } from "./isAllowedImportPath.js";
-import { buildRestrictedPropSet, checkRestrictedProp, redirectRestrictedProp } from './isAllowedImportPath.js';
+import type { AssignPermissions } from './types/assign-gingerly/types.js';
+import { buildRestrictedPropSet, checkRestrictedProp, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
+import type { RestrictedPropSettingsMap } from './assignPermissions/restrictedProps.js';
 import { normalizeAliasOptions } from './getValues.js';
 
 /**

package/assignPermissions/isAllowedImportPath.js

@@ -0,0 +1,41 @@
+/**
+ * Check whether an import specifier resolves to the current origin or is
+ * covered by an import-map entry.
+ */
+export function isAllowedImportPath(value) {
+    if (typeof document === 'undefined' || typeof location === 'undefined')
+        return false;
+    if (!value || !(value.startsWith('./') || value.startsWith('../') || value.startsWith('/'))) {
+        return isImportMapSpecifier(value);
+    }
+    try {
+        return new URL(value, document.baseURI).origin === location.origin;
+    }
+    catch {
+        return false;
+    }
+}
+function isImportMapSpecifier(value) {
+    const importMaps = document.querySelectorAll('script[type="importmap"]');
+    for (const importMap of importMaps) {
+        try {
+            const parsed = JSON.parse(importMap.textContent ?? '');
+            if (!isImportMap(parsed))
+                continue;
+            for (const key of Object.keys(parsed.imports)) {
+                if (key.endsWith('/') ? value.startsWith(key) : value === key)
+                    return true;
+            }
+        }
+        catch {
+            // Ignore malformed import maps and continue searching.
+        }
+    }
+    return false;
+}
+function isImportMap(value) {
+    if (!value || typeof value !== 'object' || !('imports' in value))
+        return false;
+    const { imports } = value;
+    return !!imports && typeof imports === 'object' && !Array.isArray(imports);
+}

package/assignPermissions/isAllowedImportPath.ts

@@ -0,0 +1,38 @@
+/**
+ * Check whether an import specifier resolves to the current origin or is
+ * covered by an import-map entry.
+ */
+export function isAllowedImportPath(value: string): boolean {
+    if (typeof document === 'undefined' || typeof location === 'undefined') return false;
+    if (!value || !(value.startsWith('./') || value.startsWith('../') || value.startsWith('/'))) {
+        return isImportMapSpecifier(value);
+    }
+
+    try {
+        return new URL(value, document.baseURI).origin === location.origin;
+    } catch {
+        return false;
+    }
+}
+
+function isImportMapSpecifier(value: string): boolean {
+    const importMaps = document.querySelectorAll('script[type="importmap"]');
+    for (const importMap of importMaps) {
+        try {
+            const parsed = JSON.parse(importMap.textContent ?? '');
+            if (!isImportMap(parsed)) continue;
+            for (const key of Object.keys(parsed.imports)) {
+                if (key.endsWith('/') ? value.startsWith(key) : value === key) return true;
+            }
+        } catch {
+            // Ignore malformed import maps and continue searching.
+        }
+    }
+    return false;
+}
+
+function isImportMap(value: unknown): value is { imports: Record<string, unknown> } {
+    if (!value || typeof value !== 'object' || !('imports' in value)) return false;
+    const { imports } = value;
+    return !!imports && typeof imports === 'object' && !Array.isArray(imports);
+}

package/assignPermissions/restrictedProps.js

@@ -0,0 +1,43 @@
+const warnedOnce = new Set();
+function warnRestricted(key) {
+    if (!warnedOnce.has(key)) {
+        warnedOnce.add(key);
+        console.warn(`assignGingerly: property '${key}' is in restrictedPropSettings — assignment skipped.`);
+    }
+}
+export function buildRestrictedPropSet(permissions) {
+    const settings = permissions?.restrictedPropSettings;
+    if (!settings || settings.length === 0)
+        return undefined;
+    const restrictedPropSet = new Map();
+    for (const setting of settings) {
+        const prop = typeof setting === 'string' ? setting : setting.prop;
+        if (restrictedPropSet.has(prop)) {
+            throw new Error(`assignGingerly: duplicate restrictedPropSettings entry for '${prop}'.`);
+        }
+        restrictedPropSet.set(prop, typeof setting === 'string' ? undefined : setting);
+    }
+    return restrictedPropSet;
+}
+export function checkRestrictedProp(restrictedPropSet, key) {
+    if (!restrictedPropSet || !restrictedPropSet.has(key))
+        return false;
+    warnRestricted(key);
+    return true;
+}
+export function redirectRestrictedProp(restrictedPropSet, target, key, value) {
+    if (!restrictedPropSet || !restrictedPropSet.has(key))
+        return false;
+    const setting = restrictedPropSet.get(key);
+    if (!setting?.useMethod) {
+        warnRestricted(key);
+        return true;
+    }
+    const method = target?.[setting.useMethod];
+    if (typeof method !== 'function') {
+        warnRestricted(key);
+        return true;
+    }
+    method.call(target, value);
+    return true;
+}

package/assignPermissions/restrictedProps.ts

@@ -0,0 +1,53 @@
+import type { AssignPermissions, RestrictedPropSetting } from '../types/assign-gingerly/types.js';
+
+export type RestrictedPropSettingsMap = Map<string, RestrictedPropSetting | undefined>;
+
+const warnedOnce = new Set<string>();
+
+function warnRestricted(key: string): void {
+    if (!warnedOnce.has(key)) {
+        warnedOnce.add(key);
+        console.warn(`assignGingerly: property '${key}' is in restrictedPropSettings — assignment skipped.`);
+    }
+}
+
+export function buildRestrictedPropSet(permissions: AssignPermissions | undefined): RestrictedPropSettingsMap | undefined {
+    const settings = permissions?.restrictedPropSettings;
+    if (!settings || settings.length === 0) return undefined;
+    const restrictedPropSet: RestrictedPropSettingsMap = new Map();
+    for (const setting of settings) {
+        const prop = typeof setting === 'string' ? setting : setting.prop;
+        if (restrictedPropSet.has(prop)) {
+            throw new Error(`assignGingerly: duplicate restrictedPropSettings entry for '${prop}'.`);
+        }
+        restrictedPropSet.set(prop, typeof setting === 'string' ? undefined : setting);
+    }
+    return restrictedPropSet;
+}
+
+export function checkRestrictedProp(restrictedPropSet: RestrictedPropSettingsMap | undefined, key: string): boolean {
+    if (!restrictedPropSet || !restrictedPropSet.has(key)) return false;
+    warnRestricted(key);
+    return true;
+}
+
+export function redirectRestrictedProp(
+    restrictedPropSet: RestrictedPropSettingsMap | undefined,
+    target: any,
+    key: string,
+    value: any
+): boolean {
+    if (!restrictedPropSet || !restrictedPropSet.has(key)) return false;
+    const setting = restrictedPropSet.get(key);
+    if (!setting?.useMethod) {
+        warnRestricted(key);
+        return true;
+    }
+    const method = target?.[setting.useMethod];
+    if (typeof method !== 'function') {
+        warnRestricted(key);
+        return true;
+    }
+    method.call(target, value);
+    return true;
+}

package/assignTentatively.js

@@ -1,4 +1,4 @@
-import { buildRestrictedPropSet, checkRestrictedProp } from './isAllowedImportPath.js';
+import { buildRestrictedPropSet, checkRestrictedProp } from './assignPermissions/restrictedProps.js';
 /**
  * Helper function to check if a string key represents an += command
  */

package/assignTentatively.ts

@@ -2,8 +2,8 @@
  * assignTentatively — reversible assignment with change tracking.
  */
 import type { IAssignTentativelyOptions } from './types/assign-gingerly/types.js';
-import type { AssignPermissions } from './isAllowedImportPath.js';
-import { buildRestrictedPropSet, checkRestrictedProp } from './isAllowedImportPath.js';
+import type { AssignPermissions } from './types/assign-gingerly/types.js';
+import { buildRestrictedPropSet, checkRestrictedProp } from './assignPermissions/restrictedProps.js';
 export type { IAssignTentativelyOptions };
 
 /**

package/eachTime.js

@@ -3,7 +3,7 @@
  * This module is dynamically loaded only when @eachTime is encountered
  * Provides event-driven iteration over elements as they mount
  */
-import { redirectRestrictedProp } from './isAllowedImportPath.js';
+import { redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
 /**
  * Check if a value is an EventTarget
  */

package/eachTime.ts

@@ -5,8 +5,9 @@
  */
 
 import type { IAssignGingerlyOptions } from './types/assign-gingerly/types.js';
-import type { AssignPermissions, RestrictedPropSettingsMap } from './isAllowedImportPath.js';
-import { redirectRestrictedProp } from './isAllowedImportPath.js';
+import type { AssignPermissions } from './types/assign-gingerly/types.js';
+import { redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
+import type { RestrictedPropSettingsMap } from './assignPermissions/restrictedProps.js';
 
 /**
  * Check if a value is an EventTarget

package/enhanceAll.js

@@ -15,7 +15,7 @@
  *     { emc: 'be-observant/emc.json', matching: '[itemprop]' },
  * ]);
  */
-import { isAllowedImportPath } from './isAllowedImportPath.js';
+import { isAllowedImportPath } from './assignPermissions/isAllowedImportPath.js';
 /**
  * Apply enhancements in bulk to matching elements within a target.
  *
@@ -37,7 +37,7 @@ export async function enhanceAll(target, configs, permissions) {
         // Validate EMC path unless cross-domain imports are explicitly permitted
         if (!permissions?.crossDomainImports && !isAllowedImportPath(config.emc)) {
             throw new Error(`enhanceAll: EMC path "${config.emc}" is a cross-domain URL. ` +
-                `Only relative, absolute, or bare specifier paths are allowed by default. ` +
+                `Only same-origin paths or import-map-covered specifiers are allowed by default. ` +
                 `Pass { crossDomainImports: true } in permissions to override.`);
         }
         // 1. Import the EMC JSON

package/enhanceAll.ts

@@ -16,8 +16,8 @@
  * ]);
  */
 
-import { isAllowedImportPath } from './isAllowedImportPath.js';
-import type { AssignPermissions } from './isAllowedImportPath.js';
+import { isAllowedImportPath } from './assignPermissions/isAllowedImportPath.js';
+import type { AssignPermissions } from './types/assign-gingerly/types.js';
 
 /**
  * Configuration for a single enhancement to apply in bulk.
@@ -57,7 +57,7 @@ export async function enhanceAll(
         if (!permissions?.crossDomainImports && !isAllowedImportPath(config.emc)) {
             throw new Error(
                 `enhanceAll: EMC path "${config.emc}" is a cross-domain URL. ` +
-                `Only relative, absolute, or bare specifier paths are allowed by default. ` +
+                `Only same-origin paths or import-map-covered specifiers are allowed by default. ` +
                 `Pass { crossDomainImports: true } in permissions to override.`
             );
         }

package/handlers/addEventListener.ts

@@ -9,7 +9,7 @@
 
 import assignGingerly from '../assignGingerly.js';
 import type { AddEventListenerConfig, AssignDispatchVector } from '../types/assign-gingerly/types.js';
-import type { AssignPermissions } from '../isAllowedImportPath.js';
+import type { AssignPermissions } from '../types/assign-gingerly/types.js';
 
 /**
  * WeakMap for dedup: Element → Map<key, AbortController>

package/handlers/lazyLoad.ts

@@ -24,7 +24,7 @@ import type { LazyLoadResolvedParams, LazyLoadInstantiatedContext } from '../typ
 import { withTransition, ensureHideStyle, DEFAULT_HIDE_CLASS } from '../transitionHelper.js';
 import { findMarkers, createMarkers, getNodesBetweenMarkers, findMarkersSibling, createMarkersSibling, MARKER_START_PREFIX, MARKER_END } from '../markerUtils.js';
 import { assignFrom } from '../assignFrom.js';
-import type { AssignPermissions } from '../isAllowedImportPath.js';
+import type { AssignPermissions } from '../types/assign-gingerly/types.js';
 
 export type { LazyLoadResolvedParams, LazyLoadInstantiatedContext };
 

package/handlers/lazyLoadSwitch.ts

@@ -21,7 +21,7 @@
  */
 
 import { LazyLoadHandler } from './lazyLoad.js';
-import type { AssignPermissions } from '../isAllowedImportPath.js';
+import type { AssignPermissions } from '../types/assign-gingerly/types.js';
 import type { AssignFromHandler } from '../assignFromAsync.js';
 import type { LazyLoadSwitchResolvedParams } from '../types/assign-gingerly/types.js';
 

package/handlers/manageTemplateList.ts

@@ -31,7 +31,7 @@ import { findMarkers, createMarkers, getNodesBetweenMarkers, MARKER_START_PREFIX
 import { resolveValue } from '../resolveValues.js';
 import { assignFrom } from '../assignFrom.js';
 import { processInferredAssignments } from '../inferredAssignments.js';
-import type { AssignPermissions } from '../isAllowedImportPath.js';
+import type { AssignPermissions } from '../types/assign-gingerly/types.js';
 
 /**
  * Reserved keys in fromEachItem config — not treated as shorthand patterns.

package/handlers/rangeSelector.ts

@@ -23,7 +23,7 @@
 
 import type { AssignFromHandler } from '../assignFromAsync.js';
 import assignGingerly from '../assignGingerly.js';
-import type { AssignPermissions } from '../isAllowedImportPath.js';
+import type { AssignPermissions } from '../types/assign-gingerly/types.js';
 
 /**
  * Operator keys recognized in case objects.

package/inferencer/types/assign-gingerly/types.d.ts

@@ -1,3 +1,5 @@
+import {ParserOptions} from '../nested-regex-groups/types.js';
+
 export type EnhKey = string | symbol;
 
 // type NoUnderscore<T extends string> = T extends `_${string}` ? never : T;
@@ -196,7 +198,7 @@ export interface AttrConfig<T = unknown, TParserConfig = unknown> {
    * For named parsers like 'parse-pattern-statements', this is forwarded
    * as the options argument to the underlying parse function.
    */
-  parserOptions?: any;
+  parserOptions?: ParserOptions;
 }
 
 export type AttrPatterns<T = any> = {

package/inferencer/types/nested-regex-groups/types.d.ts

@@ -91,6 +91,18 @@ export interface ParserOptions {
    * as statement delimiters during splitting.
    */
   ignorePeriodInsideBraces?: boolean;
+
+  /**
+   * When true, normalizes whitespace in the input string before parsing.
+   * This replaces multiple whitespace characters with a single space and trims the string.
+   * Default is false.
+   * 
+   * @example
+   * // Input: "  First.   Second.  "
+   * // With normalizeWhitespace: true -> "First. Second."
+   * // With normalizeWhitespace: false -> "  First.   Second.  "
+   */
+  normalizeWhitespace?: boolean;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "assign-gingerly",
-  "version": "0.0.72",
+  "version": "0.0.73",
   "description": "This package provides a utility function for carefully merging one object into another.",
   "homepage": "https://github.com/bahrus/assign-gingerly#readme",
   "bugs": {
@@ -18,6 +18,7 @@
     "*.js",
     "*.ts",
     "DX/**",
+    "assignPermissions/**",
     "handlers/**",
     "inferencer/**",
     "README.md",
@@ -143,9 +144,9 @@
       "default": "./enhanceAll.js",
       "types": "./enhanceAll.ts"
     },
-    "./isAllowedImportPath.js": {
-      "default": "./isAllowedImportPath.js",
-      "types": "./isAllowedImportPath.ts"
+    "./assignPermissions/isAllowedImportPath.js": {
+      "default": "./assignPermissions/isAllowedImportPath.js",
+      "types": "./assignPermissions/isAllowedImportPath.ts"
     },
     "./markerUtils.js": {
       "default": "./markerUtils.js",

package/processHandlerCommands.js

@@ -6,7 +6,8 @@
 import { resolveValues } from './resolveValues.js';
 import { getValues } from './getValues.js';
 import { evaluatePathWithMethods } from './assignGingerly.js';
-import { buildRestrictedPropSet, isAllowedImportPath, redirectRestrictedProp } from './isAllowedImportPath.js';
+import { isAllowedImportPath } from './assignPermissions/isAllowedImportPath.js';
+import { buildRestrictedPropSet, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
 /**
  * Map of built-in handler names to their module paths.
  * These are auto-loaded on demand — no explicit import required.
@@ -80,7 +81,7 @@ async function resolveFromHandlers(name, handlers, permissions) {
         // Import path string — validate and dynamically import
         if (!permissions?.crossDomainImports && !isAllowedImportPath(entry)) {
             throw new Error(`assignFrom: handler "${name}" has an invalid import path "${entry}". ` +
-                `Only relative, absolute, or bare specifier paths are allowed (no cross-domain URLs). ` +
+                `Only same-origin paths or import-map-covered specifiers are allowed. ` +
                 `Pass { crossDomainImports: true } in permissions to override.`);
         }
         const module = await import(entry);

package/processHandlerCommands.ts

@@ -7,8 +7,9 @@
 import { resolveValues } from './resolveValues.js';
 import { getValues } from './getValues.js';
 import { evaluatePathWithMethods } from './assignGingerly.js';
-import { buildRestrictedPropSet, isAllowedImportPath, redirectRestrictedProp } from './isAllowedImportPath.js';
-import type { AssignPermissions } from './isAllowedImportPath.js';
+import { isAllowedImportPath } from './assignPermissions/isAllowedImportPath.js';
+import { buildRestrictedPropSet, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
+import type { AssignPermissions } from './types/assign-gingerly/types.js';
 import type { AssignFromOptions, AssignFromHandlerConstructor } from './assignFromAsync.js';
 
 /**
@@ -93,7 +94,7 @@ async function resolveFromHandlers(
         if (!permissions?.crossDomainImports && !isAllowedImportPath(entry)) {
             throw new Error(
                 `assignFrom: handler "${name}" has an invalid import path "${entry}". ` +
-                `Only relative, absolute, or bare specifier paths are allowed (no cross-domain URLs). ` +
+                `Only same-origin paths or import-map-covered specifiers are allowed. ` +
                 `Pass { crossDomainImports: true } in permissions to override.`
             );
         }

package/types/assign-gingerly/types.d.ts

@@ -1,3 +1,5 @@
+import {ParserOptions} from '../nested-regex-groups/types.js';
+
 export type EnhKey = string | symbol;
 
 // type NoUnderscore<T extends string> = T extends `_${string}` ? never : T;
@@ -196,7 +198,7 @@ export interface AttrConfig<T = unknown, TParserConfig = unknown> {
    * For named parsers like 'parse-pattern-statements', this is forwarded
    * as the options argument to the underlying parse function.
    */
-  parserOptions?: any;
+  parserOptions?: ParserOptions;
 }
 
 export type AttrPatterns<T = any> = {
@@ -706,8 +708,8 @@ export interface HandlerConfig {
  * Interface for assignFrom handler classes.
  * Handlers are invoked when a LHS key ends with ' =>'.
  */
-export interface AssignFromHandler {
-    assign(lhsTarget: any, resolvedParams: Record<string, any>, options: any, permissions?: AssignPermissions): Promise<void> | void;
+export interface AssignFromHandler {
+    assign(lhsTarget: any, resolvedParams: Record<string, any>, options: any, permissions?: AssignPermissions): Promise<void> | void;
 }
 
 /**
@@ -885,7 +887,7 @@ export interface LazyLoadInstantiatedContext {
 export declare class LazyLoadHandler implements AssignFromHandler {
     config: any;
     constructor(config: any);
-    assign(lhsTarget: any, resolvedParams: Record<string, any>, options?: any, permissions?: AssignPermissions): Promise<void>;
+    assign(lhsTarget: any, resolvedParams: Record<string, any>, options?: any, permissions?: AssignPermissions): Promise<void>;
     protected onCloneInserted(nodes: Node[], lhsTarget: Element, resolvedParams: Record<string, any>): Promise<void>;
 }
 
@@ -969,12 +971,12 @@ export interface AssignPermissions {
     /**
      * Restricted property settings.
      * Phase I: string entries are property names that cannot be assigned.
-     * Phase II: an object with useMethod redirects ordinary assignment to that
-     * method; command operations remain blocked. Phase III+ adds attr support.
+     * Phase II: an object with useMethod redirects ordinary assignment to that
+     * method; command operations remain blocked. Phase III+ adds attr support.
      *
-     * NOTE: This is a property-assignment guard only. Method calls (setAttribute, etc.)
-     * are not blocked — see Phase III+. Event listeners can still be registered, but
-     * assignments performed by their vectors inherit these permissions.
+     * NOTE: This is a property-assignment guard only. Method calls (setAttribute, etc.)
+     * are not blocked — see Phase III+. Event listeners can still be registered, but
+     * assignments performed by their vectors inherit these permissions.
      */
     restrictedPropSettings?: Array<string | RestrictedPropSetting>;
 

package/isAllowedImportPath.js

@@ -1,104 +0,0 @@
-/**
- * isAllowedImportPath.ts — Security utility for validating import paths.
- *
- * Checks that a path is local (relative, absolute, or bare specifier) and
- * not a cross-domain URL. Used to prevent untrusted HTML attributes from
- * triggering imports to arbitrary external domains.
- *
- * @example
- * import { isAllowedImportPath } from 'assign-gingerly/isAllowedImportPath.js';
- *
- * isAllowedImportPath('./local.js');           // true
- * isAllowedImportPath('../parent/file.js');    // true
- * isAllowedImportPath('/absolute/path.js');    // true
- * isAllowedImportPath('bare-specifier/mod.js'); // true
- * isAllowedImportPath('https://evil.com/x.js'); // false
- * isAllowedImportPath('//cdn.example.com/x.js'); // false
- */
-/**
- * Module-level warn dedup — one warning per property key per process lifetime.
- */
-const warnedOnce = new Set();
-/**
- * Warn once per key that a restricted property assignment was skipped.
- */
-function warnRestricted(key) {
-    if (!warnedOnce.has(key)) {
-        warnedOnce.add(key);
-        console.warn(`assignGingerly: property '${key}' is in restrictedPropSettings — assignment skipped.`);
-    }
-}
-/**
- * Normalize the restrictedPropSettings from permissions into a fast-lookup Set.
- * Phase I: extracts string entries only (object entries are Phase II+).
- * Returns undefined when nothing is restricted (fast-bail in callers).
- */
-export function buildRestrictedPropSet(permissions) {
-    const settings = permissions?.restrictedPropSettings;
-    if (!settings || settings.length === 0)
-        return undefined;
-    const restrictedPropSet = new Map();
-    for (const setting of settings) {
-        const prop = typeof setting === 'string' ? setting : setting.prop;
-        if (restrictedPropSet.has(prop)) {
-            throw new Error(`assignGingerly: duplicate restrictedPropSettings entry for '${prop}'.`);
-        }
-        restrictedPropSet.set(prop, typeof setting === 'string' ? undefined : setting);
-    }
-    return restrictedPropSet;
-}
-/**
- * Check if a property key is restricted. If so, warn (once) and return true.
- * Call sites should `continue` or skip the assignment when this returns true.
- */
-export function checkRestrictedProp(restrictedPropSet, key) {
-    if (!restrictedPropSet || !restrictedPropSet.has(key))
-        return false;
-    warnRestricted(key);
-    return true;
-}
-/**
- * Redirect an ordinary assignment through its configured safe method.
- * Returns true when the property is restricted, whether redirected or skipped.
- */
-export function redirectRestrictedProp(restrictedPropSet, target, key, value) {
-    if (!restrictedPropSet || !restrictedPropSet.has(key))
-        return false;
-    const setting = restrictedPropSet.get(key);
-    if (!setting?.useMethod) {
-        warnRestricted(key);
-        return true;
-    }
-    const method = target?.[setting.useMethod];
-    if (typeof method !== 'function') {
-        warnRestricted(key);
-        return true;
-    }
-    method.call(target, value);
-    return true;
-}
-/**
- * Check if an import path is allowed (non-cross-domain).
- *
- * Allowed:
- * - Relative paths: ./foo.js, ../bar.js
- * - Absolute paths: /path/to/file.js
- * - Bare specifiers: package-name/file.js, @scope/package/file.js
- *
- * Blocked:
- * - Protocol URLs: https://..., http://..., data:..., etc.
- * - Protocol-relative: //cdn.example.com/...
- *
- * @param path - The import path to validate
- * @returns true if the path is local/safe, false if cross-domain
- */
-export function isAllowedImportPath(path) {
-    if (path.startsWith('./') || path.startsWith('../') || path.startsWith('/')) {
-        return true;
-    }
-    if (path.includes('://') || path.startsWith('//')) {
-        return false;
-    }
-    // Bare specifier (no protocol, no //) — allowed
-    return true;
-}

package/isAllowedImportPath.ts

@@ -1,118 +0,0 @@
-/**
- * isAllowedImportPath.ts — Security utility for validating import paths.
- * 
- * Checks that a path is local (relative, absolute, or bare specifier) and
- * not a cross-domain URL. Used to prevent untrusted HTML attributes from
- * triggering imports to arbitrary external domains.
- * 
- * @example
- * import { isAllowedImportPath } from 'assign-gingerly/isAllowedImportPath.js';
- * 
- * isAllowedImportPath('./local.js');           // true
- * isAllowedImportPath('../parent/file.js');    // true
- * isAllowedImportPath('/absolute/path.js');    // true
- * isAllowedImportPath('bare-specifier/mod.js'); // true
- * isAllowedImportPath('https://evil.com/x.js'); // false
- * isAllowedImportPath('//cdn.example.com/x.js'); // false
- */
-
-// Re-export AssignPermissions from canonical location for backwards compatibility
-export type { AssignPermissions } from './types/assign-gingerly/types.js';
-import type { AssignPermissions, RestrictedPropSetting } from './types/assign-gingerly/types.js';
-
-export type RestrictedPropSettingsMap = Map<string, RestrictedPropSetting | undefined>;
-
-/**
- * Module-level warn dedup — one warning per property key per process lifetime.
- */
-const warnedOnce = new Set<string>();
-
-/**
- * Warn once per key that a restricted property assignment was skipped.
- */
-function warnRestricted(key: string): void {
-    if (!warnedOnce.has(key)) {
-        warnedOnce.add(key);
-        console.warn(`assignGingerly: property '${key}' is in restrictedPropSettings — assignment skipped.`);
-    }
-}
-
-/**
- * Normalize the restrictedPropSettings from permissions into a fast-lookup Set.
- * Phase I: extracts string entries only (object entries are Phase II+).
- * Returns undefined when nothing is restricted (fast-bail in callers).
- */
-export function buildRestrictedPropSet(permissions: AssignPermissions | undefined): RestrictedPropSettingsMap | undefined {
-    const settings = permissions?.restrictedPropSettings;
-    if (!settings || settings.length === 0) return undefined;
-    const restrictedPropSet: RestrictedPropSettingsMap = new Map();
-    for (const setting of settings) {
-        const prop = typeof setting === 'string' ? setting : setting.prop;
-        if (restrictedPropSet.has(prop)) {
-            throw new Error(`assignGingerly: duplicate restrictedPropSettings entry for '${prop}'.`);
-        }
-        restrictedPropSet.set(prop, typeof setting === 'string' ? undefined : setting);
-    }
-    return restrictedPropSet;
-}
-
-/**
- * Check if a property key is restricted. If so, warn (once) and return true.
- * Call sites should `continue` or skip the assignment when this returns true.
- */
-export function checkRestrictedProp(restrictedPropSet: RestrictedPropSettingsMap | undefined, key: string): boolean {
-    if (!restrictedPropSet || !restrictedPropSet.has(key)) return false;
-    warnRestricted(key);
-    return true;
-}
-
-/**
- * Redirect an ordinary assignment through its configured safe method.
- * Returns true when the property is restricted, whether redirected or skipped.
- */
-export function redirectRestrictedProp(
-    restrictedPropSet: RestrictedPropSettingsMap | undefined,
-    target: any,
-    key: string,
-    value: any
-): boolean {
-    if (!restrictedPropSet || !restrictedPropSet.has(key)) return false;
-    const setting = restrictedPropSet.get(key);
-    if (!setting?.useMethod) {
-        warnRestricted(key);
-        return true;
-    }
-    const method = target?.[setting.useMethod];
-    if (typeof method !== 'function') {
-        warnRestricted(key);
-        return true;
-    }
-    method.call(target, value);
-    return true;
-}
-
-/**
- * Check if an import path is allowed (non-cross-domain).
- * 
- * Allowed:
- * - Relative paths: ./foo.js, ../bar.js
- * - Absolute paths: /path/to/file.js
- * - Bare specifiers: package-name/file.js, @scope/package/file.js
- * 
- * Blocked:
- * - Protocol URLs: https://..., http://..., data:..., etc.
- * - Protocol-relative: //cdn.example.com/...
- * 
- * @param path - The import path to validate
- * @returns true if the path is local/safe, false if cross-domain
- */
-export function isAllowedImportPath(path: string): boolean {
-    if (path.startsWith('./') || path.startsWith('../') || path.startsWith('/')) {
-        return true;
-    }
-    if (path.includes('://') || path.startsWith('//')) {
-        return false;
-    }
-    // Bare specifier (no protocol, no //) — allowed
-    return true;
-}