assign-gingerly 0.0.74 → 0.0.76

package/handlers/manageTemplateList.ts

@@ -28,10 +28,10 @@
 import type { AssignFromHandler } from '../assignFromAsync.js';
 import type { ManageTemplateListResolvedParams } from '../types/assign-gingerly/types.js';
 import { findMarkers, createMarkers, getNodesBetweenMarkers, MARKER_START_PREFIX, MARKER_END } from '../markerUtils.js';
-import { resolveValue } from '../resolveValues.js';
+import { resolveValue } from '../resolve/resolveValues.js';
 import { assignFrom } from '../assignFrom.js';
-import { processInferredAssignments } from '../inferredAssignments.js';
-import type { AssignPermissions } from '../types/assign-gingerly/types.js';
+import { processInferredAssignments } from '../inferredAssignments.js';
+import type { PermissionProcessor } from '../types/assign-gingerly/types.js';
 
 /**
  * Reserved keys in fromEachItem config — not treated as shorthand patterns.
@@ -75,7 +75,7 @@ export class ManageTemplateListHandler implements AssignFromHandler {
         this.config = config;
     }
 
-    async assign(lhsTarget: any, resolvedParams: ManageTemplateListResolvedParams, options?: any, permissions?: AssignPermissions): Promise<void> {
+    async assign(lhsTarget: any, resolvedParams: ManageTemplateListResolvedParams, options?: any, permissionProcessor?: PermissionProcessor): Promise<void> {
         //return;
         const {
             forEach: items,
@@ -184,7 +184,7 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                     const len = Math.min(elements.length, configs.length);
                     for (let j = 0; j < len; j++) {
                         const cfg = configs[j];
-                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissions);
+                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissionProcessor);
                     }
                 } else {
                     const rootEl = existingNodes.find(n => n instanceof Element) as Element | undefined;
@@ -192,13 +192,13 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                         if (processInferred) {
                             processInferred(rootEl, item, inferredConfig === true ? { byItemprop: true } : inferredConfig);
                         } else {
-                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissions);
+                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissionProcessor);
                         }
                         if (hostToClone && options?.from) {
-                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissions);
+                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissionProcessor);
                         }
                         if (targetToClone) {
-                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissions);
+                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissionProcessor);
                         }
                     }
                 }
@@ -229,7 +229,7 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                     const len = Math.min(elements.length, configs.length);
                     for (let j = 0; j < len; j++) {
                         const cfg = configs[j];
-                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissions);
+                        assignFrom(elements[j], cfg.toClone ?? {}, { from: item, ...cfg.withOptions }, permissionProcessor);
                     }
                 } else {
                     const rootEl = clonedNodes.find(n => n instanceof Element) as Element | undefined;
@@ -240,14 +240,14 @@ export class ManageTemplateListHandler implements AssignFromHandler {
                         if (processInferred) {
                             processInferred(rootEl, item, inferredConfig === true ? { byItemprop: true } : inferredConfig);
                         } else {
-                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissions);
+                            assignFrom(rootEl, toClone, { from: item, ...withOptions }, permissionProcessor);
                         }
 
                         if (hostToClone && options?.from) {
-                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissions);
+                            assignFrom(rootEl, hostToClone, { from: options.from, ...hostWithOptions }, permissionProcessor);
                         }
                         if (targetToClone) {
-                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissions);
+                            assignFrom(rootEl, targetToClone, { from: lhsTarget, ...targetWithOptions }, permissionProcessor);
                         }
                     }
                 }

package/handlers/rangeSelector.ts

@@ -23,7 +23,7 @@
 
 import type { AssignFromHandler } from '../assignFromAsync.js';
 import assignGingerly from '../assignGingerly.js';
-import type { AssignPermissions } from '../types/assign-gingerly/types.js';
+import type { PermissionProcessor } from '../types/assign-gingerly/types.js';
 
 /**
  * Operator keys recognized in case objects.
@@ -73,7 +73,7 @@ export class RangeSelectorHandler implements AssignFromHandler {
         this.config = config;
     }
 
-    async assign(lhsTarget: any, resolvedParams: any, _options?: any, permissions?: AssignPermissions): Promise<void> {
+    async assign(lhsTarget: any, resolvedParams: any, _options?: any, permissionProcessor?: PermissionProcessor): Promise<void> {
         const { value, when } = resolvedParams;
 
         if (!Array.isArray(when)) return;
@@ -82,7 +82,7 @@ export class RangeSelectorHandler implements AssignFromHandler {
         for (const caseObj of when) {
             if (caseMatches(value, caseObj)) {
                 if (caseObj.merge && typeof caseObj.merge === 'object') {
-                    assignGingerly(lhsTarget, caseObj.merge, undefined, permissions);
+                    assignGingerly(lhsTarget, caseObj.merge, undefined, permissionProcessor);
                 }
                 return; // First match wins
             }

package/index.js

@@ -5,15 +5,14 @@ export { waitForEvent } from './waitForEvent.js';
 export { ParserRegistry, globalParserRegistry } from './parserRegistry.js';
 export { parseWithAttrs } from './parseWithAttrs.js';
 export { buildCSSQuery } from './buildCSSQuery.js';
-export { resolveTemplate } from './resolveTemplate.js';
+export { resolveTemplate } from './resolve/resolveTemplate.js';
 export { getHost } from './getHost.js';
-export { resolveValues, resolveValue } from './resolveValues.js';
+export { resolveValues, resolveValue } from './resolve/resolveValues.js';
 export { assignFromAsync } from './assignFromAsync.js';
 export { assignFrom } from './assignFrom.js';
 export { assignFeatures, FeaturesRegistry, captureFeatureInitVals, PropertyBag, suggestFeatureInfo, getFeatureInfoSuggestions } from './assignFeatures.js';
 export { installForwarding } from './DX/installForwarding.js';
 export { defineWithFeatures } from './defineWithFeatures.js';
-export { resolveAndAssignFeatures } from './resolveAndAssignFeatures.js';
 export { nudge } from './handlers/nudge.js';
 export { arr } from './handlers/arr.js';
 import './object-extension.js';

package/index.ts

@@ -5,15 +5,14 @@ export {waitForEvent} from './waitForEvent.js';
 export {ParserRegistry, globalParserRegistry} from './parserRegistry.js';
 export {parseWithAttrs} from './parseWithAttrs.js';
 export {buildCSSQuery} from './buildCSSQuery.js';
-export {resolveTemplate} from './resolveTemplate.js';
+export {resolveTemplate} from './resolve/resolveTemplate.js';
 export {getHost} from './getHost.js';
-export {resolveValues, resolveValue} from './resolveValues.js';
+export {resolveValues, resolveValue} from './resolve/resolveValues.js';
 export {assignFromAsync} from './assignFromAsync.js';
 export {assignFrom} from './assignFrom.js';
 export {assignFeatures, FeaturesRegistry, captureFeatureInitVals, PropertyBag, suggestFeatureInfo, getFeatureInfoSuggestions} from './assignFeatures.js';
 export {installForwarding} from './DX/installForwarding.js';
 export {defineWithFeatures} from './defineWithFeatures.js';
-export {resolveAndAssignFeatures} from './resolveAndAssignFeatures.js';
 export {nudge} from './handlers/nudge.js';
 export {arr} from './handlers/arr.js';
 export {} from './handlers/manageTemplateList.js';

package/inferencer/types/assign-gingerly/types.d.ts

@@ -424,6 +424,11 @@ export interface GetValuesOptions extends IAssignGingerlyOptions {
    */
   root?: any;
 
+  /**
+   * Optional permission processor for guarding method calls during RHS resolution.
+   */
+  permissionProcessor?: PermissionProcessor;
+
   /**
    * Synchronous protocol handlers for resolving protocol-prefixed values.
    * Each handler receives the key portion and MUST return synchronously.
@@ -449,6 +454,11 @@ export interface ResolveValuesOptions extends IAssignGingerlyOptions {
    */
   root?: any;
 
+  /**
+   * Optional permission processor for guarding method calls during RHS resolution.
+   */
+  permissionProcessor?: PermissionProcessor;
+
   /**
    * Protocol handlers for resolving protocol-prefixed values (e.g., 'globalThis://key').
    * Each handler receives the key portion and returns the resolved value (sync or async).
@@ -591,21 +601,6 @@ export interface SupportedFeatureConfig {
     callbackForwarding?: string[];
 }
 
-/**
- * Class-level configuration for the features system.
- * Declared as `static featuresConfig` on the class.
- */
-export interface FeaturesClassConfig {
-    /**
-     * Lifecycle method configuration.
-     * true = install 'whenFeatureReady' method.
-     * Object = custom method name.
-     */
-    lifecycleKeys?: true | {
-        whenFeatureReady?: string;
-    };
-}
-
 /**
  * Configuration for a feature passed to assignFeatures.
  */
@@ -710,7 +705,7 @@ export interface HandlerConfig {
  * Handlers are invoked when a LHS key ends with ' =>'.
  */
 export interface AssignFromHandler {
-    assign(lhsTarget: any, resolvedParams: Record<string, any>, options: any, permissions?: AssignPermissions): Promise<void> | void;
+    assign(lhsTarget: any, resolvedParams: Record<string, any>, options: any, permissionProcessor?: PermissionProcessor): Promise<void> | void;
 }
 
 /**
@@ -888,7 +883,7 @@ export interface LazyLoadInstantiatedContext {
 export declare class LazyLoadHandler implements AssignFromHandler {
     config: any;
     constructor(config: any);
-    assign(lhsTarget: any, resolvedParams: Record<string, any>, options?: any, permissions?: AssignPermissions): Promise<void>;
+    assign(lhsTarget: any, resolvedParams: Record<string, any>, options?: any, permissionProcessor?: PermissionProcessor): Promise<void>;
     protected onCloneInserted(nodes: Node[], lhsTarget: Element, resolvedParams: Record<string, any>): Promise<void>;
 }
 
@@ -946,11 +941,11 @@ export interface AddEventListenerConfig extends AssignDispatchVector  {
  * Phase II+: object form for a restricted property setting.
  */
 export interface RestrictedPropSetting {
-    prop: string;
-    useMethod?: string;          // Phase II: redirect to a safe method
-    attr?: string;               // Phase III: also watch setAttribute for this attr
-    allowFromSameHost?: boolean; // Phase III
-    allowCrossDomain?: boolean;  // Phase III
+    props: string | string[];
+    useMethod?: string;            // Phase II: redirect to a safe method
+    attr?: boolean | string | string[]; // Phase III: also watch setAttribute for these attrs
+    allowFromSameDomain?: boolean; // Phase III: allow same-origin URLs
+    allowCrossDomain?: boolean;    // Phase III: allow any URL
 }
 
 /**
@@ -973,7 +968,8 @@ export interface AssignPermissions {
      * Restricted property settings.
      * Phase I: string entries are property names that cannot be assigned.
      * Phase II: an object with useMethod redirects ordinary assignment to that
-     * method; command operations remain blocked. Phase III+ adds attr support.
+     * method; command operations remain blocked. Phase III+ adds props, attr,
+     * allowFromSameDomain, and allowCrossDomain support.
      *
      * NOTE: This is a property-assignment guard only. Method calls (setAttribute, etc.)
      * are not blocked — see Phase III+. Event listeners can still be registered, but
@@ -987,3 +983,21 @@ export interface AssignPermissions {
     /** Restricted method settings (Phase IV+) */
     restrictedMethodSettings?: Array<string | RestrictedMethodConfig>;
 }
+
+//#region Permissions
+export interface RestrictedPropSettingsMap {
+    props: Map<string, RestrictedPropSetting | undefined>;
+    attrs: Map<string, RestrictedPropSetting | undefined>;
+}
+
+export declare class PermissionProcessor {
+    constructor(permissions: AssignPermissions | undefined);
+    get crossDomainImports(): boolean;
+    get hasProps(): boolean;
+    get hasAttrs(): boolean;
+    checkRestrictedProp(key: string): boolean;
+    checkRestrictedMethod(methodName: string): boolean;
+    redirectRestrictedProp(target: any, key: string, value: any): boolean;
+    checkRestrictedAttributeCall(methodName: string, args: any[]): { blocked: boolean; attrName?: string };
+}
+//#endregion

package/inferencer/types/el-maker/types.d.ts

@@ -0,0 +1,33 @@
+import {RAConfig} from '../roundabout/types.js';
+import {FontFaceFeatureConfig} from '../font-face-feature/types.js';
+import {CustomData as TSCD} from '../truth-sourcer/types.js';
+import {CustomData as FUCD} from '../face-up/types.js';
+
+export interface ElMakerConfig<AllProps = any, TActions = AllProps> {
+    assignFeatures: {
+        roundabout?: {
+            spawn?: string,
+            customData: {
+                raConfig: RAConfig<AllProps, TActions, TActions>
+            }
+        },
+        fontMgr?: {
+            spawn?: string,
+            customData: {
+                fontFaceFeatureConfig: FontFaceFeatureConfig
+            }
+        },
+        templateMaker?: {
+            spawn?: string,
+            customData?: any
+        },
+        faceUp?: {
+            spawn?: string,
+            customData?: FUCD
+        },
+        truthSourcer?: {
+            spawn?: string,
+            customData?: TSCD
+        }
+    }
+} 

package/inferencer/types/scratch-box/types.d.ts

@@ -0,0 +1,3 @@
+export interface EndUserProps {
+    value: boolean,
+}

package/inferencer/types/truth-sourcer/types.d.ts

@@ -42,3 +42,7 @@ export interface AllProps extends TruthSourcerProps {
 
 export type AP = AllProps;
 export type PAP = Partial<AP>;
+
+export interface CustomData {
+    observedAttributes: string[];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "assign-gingerly",
-  "version": "0.0.74",
+  "version": "0.0.76",
   "description": "This package provides a utility function for carefully merging one object into another.",
   "homepage": "https://github.com/bahrus/assign-gingerly#readme",
   "bugs": {
@@ -21,6 +21,8 @@
     "assignPermissions/**",
     "handlers/**",
     "inferencer/**",
+    "resolve/**",
+    "utils/**",
     "README.md",
     "LICENSE",
     "types/assign-gingerly/types.d.ts"
@@ -38,8 +40,13 @@
       "default": "./assignTentatively.js",
       "types": "./assignTentatively.ts"
     },
-    "./waitForEvent.js": {
-      "default": "./waitForEvent.js"
+    "./buildCSSQuery.js": {
+      "default": "./buildCSSQuery.js",
+      "types": "./buildCSSQuery.ts"
+    },
+    "./object-extension.js": {
+      "default": "./object-extension.js",
+      "types": "./object-extension.ts"
     },
     "./parserRegistry.js": {
       "default": "./parserRegistry.js"
@@ -48,29 +55,25 @@
       "default": "./parseWithAttrs.js",
       "types": "./parseWithAttrs.ts"
     },
-    "./buildCSSQuery.js": {
-      "default": "./buildCSSQuery.js",
-      "types": "./buildCSSQuery.ts"
-    },
-    "./resolveTemplate.js": {
-      "default": "./resolveTemplate.js",
-      "types": "./resolveTemplate.ts"
+    "./resolve/resolveTemplate.js": {
+      "default": "./resolve/resolveTemplate.js",
+      "types": "./resolve/resolveTemplate.ts"
     },
     "./getHost.js": {
       "default": "./getHost.js",
       "types": "./getHost.ts"
     },
-    "./resolveValues.js": {
-      "default": "./resolveValues.js",
-      "types": "./resolveValues.ts"
+    "./resolve/resolveValues.js": {
+      "default": "./resolve/resolveValues.js",
+      "types": "./resolve/resolveValues.ts"
     },
-    "./getValues.js": {
-      "default": "./getValues.js",
-      "types": "./getValues.ts"
+    "./resolve/getValues.js": {
+      "default": "./resolve/getValues.js",
+      "types": "./resolve/getValues.ts"
     },
-    "./resolveIdRef.js": {
-      "default": "./resolveIdRef.js",
-      "types": "./resolveIdRef.ts"
+    "./resolve/resolveIdRef.js": {
+      "default": "./resolve/resolveIdRef.js",
+      "types": "./resolve/resolveIdRef.ts"
     },
     "./transitionHelper.js": {
       "default": "./transitionHelper.js",
@@ -84,10 +87,6 @@
       "default": "./defineWithFeatures.js",
       "types": "./defineWithFeatures.ts"
     },
-    "./resolveAndAssignFeatures.js": {
-      "default": "./resolveAndAssignFeatures.js",
-      "types": "./resolveAndAssignFeatures.ts"
-    },
     "./handlers/addEventListener.js": {
       "default": "./handlers/addEventListener.js",
       "types": "./handlers/addEventListener.ts"
@@ -199,6 +198,9 @@
     "./evaluatePathWithAsyncMethods.js": {
       "default": "./evaluatePathWithAsyncMethods.js",
       "types": "./evaluatePathWithAsyncMethods.ts"
+    },
+    "./waitForEvent.js": {
+      "default": "./waitForEvent.js"
     }
   },
   "main": "index.js",

package/parseWithAttrs.js

@@ -1,5 +1,5 @@
 import { globalParserRegistry, getParserRegistry } from './parserRegistry.js';
-import { resolveTemplate } from './resolveTemplate.js';
+import { resolveTemplate } from './resolve/resolveTemplate.js';
 // Module-level cache for parsed attribute values
 // Structure: Map<configKey, Map<attrValue, parsedValue>>
 const parseCache = new Map();

package/parseWithAttrs.ts

@@ -1,6 +1,6 @@
 import { AttrPatterns, AttrConfig, ParserFunction, ParserContext, SpawnContext } from './types/assign-gingerly/types';
 import { globalParserRegistry, getParserRegistry } from './parserRegistry.js';
-import { resolveTemplate } from './resolveTemplate.js';
+import { resolveTemplate } from './resolve/resolveTemplate.js';
 
 // Module-level cache for parsed attribute values
 // Structure: Map<configKey, Map<attrValue, parsedValue>>

package/processHandlerCommands.js

@@ -3,11 +3,10 @@
  *
  * Dynamically imported only when ` =>` keys are detected in the pattern.
  */
-import { resolveValues } from './resolveValues.js';
-import { getValues } from './getValues.js';
+import { resolveValues } from './resolve/resolveValues.js';
+import { getValues } from './resolve/getValues.js';
 import { evaluatePathWithMethods } from './assignGingerly.js';
 import { findClassPrototypeInPath } from './utils/findClassPrototypeInPath.js';
-import { buildRestrictedPropSet, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
 /**
  * Map of built-in handler names to their module paths.
  * These are auto-loaded on demand — no explicit import required.
@@ -79,8 +78,7 @@ async function resolveFromHandlers(name, handlers) {
  * @param options - The assignFrom options
  * @param handlerRegistry - The registry of handler classes
  */
-export async function processHandlerCommands(target, handlerKeys, pattern, options, permissions) {
-    const restrictedPropSet = buildRestrictedPropSet(permissions);
+export async function processHandlerCommands(target, handlerKeys, pattern, options, permissionProcessor) {
     for (const key of handlerKeys) {
         const lhsPath = key.substring(0, key.length - 3); // Remove ' =>'
         const rhs = pattern[key];
@@ -190,12 +188,12 @@ export async function processHandlerCommands(target, handlerKeys, pattern, optio
             // Instantiate and invoke the handler
             const handler = new HandlerClass(config);
             //return; //1.5ms
-            const result = await handler.assign(lhsTarget, resolvedParams, options, permissions);
+            const result = await handler.assign(lhsTarget, resolvedParams, options, permissionProcessor);
             //return; //1.5ms
             // Return-value protocol: if handler returns a non-undefined value,
             // assign it back to the LHS path
             if (result !== undefined && lhsParent != null && lhsKey != null
-                && !redirectRestrictedProp(restrictedPropSet, lhsParent, lhsKey, result)) {
+                && !permissionProcessor?.redirectRestrictedProp(lhsParent, lhsKey, result)) {
                 lhsParent[lhsKey] = result;
             }
         }

package/processHandlerCommands.ts

@@ -4,12 +4,11 @@
  * Dynamically imported only when ` =>` keys are detected in the pattern.
  */
 
-import { resolveValues } from './resolveValues.js';
-import { getValues } from './getValues.js';
+import { resolveValues } from './resolve/resolveValues.js';
+import { getValues } from './resolve/getValues.js';
 import { evaluatePathWithMethods } from './assignGingerly.js';
-import { findClassPrototypeInPath } from './utils/findClassPrototypeInPath.js';
-import { buildRestrictedPropSet, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
-import type { AssignPermissions } from './types/assign-gingerly/types.js';
+import { findClassPrototypeInPath } from './utils/findClassPrototypeInPath.js';
+import type { PermissionProcessor } from './types/assign-gingerly/types.js';
 import type { AssignFromOptions, AssignFromHandlerConstructor } from './assignFromAsync.js';
 
 /**
@@ -98,10 +97,8 @@ export async function processHandlerCommands(
     handlerKeys: string[],
     pattern: Record<string, any>,
     options: AssignFromOptions,
-    permissions?: AssignPermissions
-): Promise<void> {
-    const restrictedPropSet = buildRestrictedPropSet(permissions);
-
+    permissionProcessor?: PermissionProcessor
+): Promise<void> {
     for (const key of handlerKeys) {
         const lhsPath = key.substring(0, key.length - 3); // Remove ' =>'
         const rhs = pattern[key];
@@ -213,13 +210,13 @@ export async function processHandlerCommands(
             // Instantiate and invoke the handler
             const handler = new HandlerClass(config);
             //return; //1.5ms
-            const result = await handler.assign(lhsTarget, resolvedParams, options, permissions);
+            const result = await handler.assign(lhsTarget, resolvedParams, options, permissionProcessor);
             //return; //1.5ms
-            // Return-value protocol: if handler returns a non-undefined value,
-            // assign it back to the LHS path
-            if (result !== undefined && lhsParent != null && lhsKey != null
-                && !redirectRestrictedProp(restrictedPropSet, lhsParent, lhsKey, result)) {
-                lhsParent[lhsKey] = result;
+            // Return-value protocol: if handler returns a non-undefined value,
+            // assign it back to the LHS path
+            if (result !== undefined && lhsParent != null && lhsKey != null
+                && !permissionProcessor?.redirectRestrictedProp(lhsParent, lhsKey, result)) {
+                lhsParent[lhsKey] = result;
             }
         }
     }

package/{getValues.js → resolve/getValues.js}

@@ -48,6 +48,14 @@ export function normalizeAliasOptions(options) {
     }
     return { aliasMap, withMethods };
 }
+/**
+ * Check whether a method name is listed in withMethods and is not restricted
+ * by the permission processor. Restricted methods are treated as non-method
+ * property names so they fall through to normal access.
+ */
+function isAllowedMethod(methodName, withMethods, permissionProcessor) {
+    return !!withMethods && withMethods.has(methodName) && !permissionProcessor?.checkRestrictedMethod(methodName);
+}
 /**
  * Apply alias substitutions to a path string.
  * Replaces complete tokens between `?.` delimiters with their aliased values.
@@ -90,18 +98,18 @@ function parseCachedPath(path) {
  * Navigate a path against a source object, optionally calling methods.
  * Returns the resolved value at the end of the path.
  */
-function navigatePath(source, parts, withMethods) {
+function navigatePath(source, parts, withMethods, permissionProcessor) {
     let current = source;
     let i = 0;
     while (i < parts.length) {
         if (current == null)
             return current;
         const part = parts[i];
-        if (withMethods && withMethods.has(part)) {
+        if (isAllowedMethod(part, withMethods, permissionProcessor)) {
             const method = current[part];
             if (typeof method === 'function') {
                 const nextPart = parts[i + 1];
-                if (nextPart !== undefined && !(withMethods.has(nextPart))) {
+                if (nextPart !== undefined && !isAllowedMethod(nextPart, withMethods, permissionProcessor)) {
                     current = method.call(current, nextPart);
                     i += 2;
                 }
@@ -152,12 +160,13 @@ function getProtocolValue(value, protocols, options) {
  * Recurses into nested arrays and plain objects.
  */
 function getArray(arr, source, aliasMap, withMethods, protocols, options) {
+    const permissionProcessor = options?.permissionProcessor;
     const result = [];
     for (const item of arr) {
         if (typeof item === 'string' && item.startsWith('?.')) {
             const aliased = applyAliases(item, aliasMap);
             const parts = parseCachedPath(aliased);
-            result.push(parts.length === 0 ? source : navigatePath(source, parts, withMethods));
+            result.push(parts.length === 0 ? source : navigatePath(source, parts, withMethods, permissionProcessor));
         }
         else if (typeof item === 'string' && item.startsWith('$0')) {
             const rootRef = resolveRootReference(item, source, options?.root);
@@ -168,7 +177,7 @@ function getArray(arr, source, aliasMap, withMethods, protocols, options) {
                 const aliased = applyAliases(rootRef.path, aliasMap);
                 const normalizedPath = aliased.startsWith('?.') ? aliased : (aliased ? `?.${aliased}` : '?.');
                 const parts = parseCachedPath(normalizedPath);
-                result.push(parts.length === 0 ? rootRef.source : navigatePath(rootRef.source, parts, withMethods));
+                result.push(parts.length === 0 ? rootRef.source : navigatePath(rootRef.source, parts, withMethods, permissionProcessor));
             }
         }
         else if (typeof item === 'string' && protocols && hasProtocol(item)) {
@@ -207,12 +216,13 @@ function getArray(arr, source, aliasMap, withMethods, protocols, options) {
 export function getValues(pattern, source, options) {
     const { aliasMap, withMethods } = normalizeAliasOptions(options);
     const protocols = options?.protocols;
+    const permissionProcessor = options?.permissionProcessor;
     const result = {};
     for (const [key, value] of Object.entries(pattern)) {
         if (typeof value === 'string' && value.startsWith('?.')) {
             const aliased = applyAliases(value, aliasMap);
             const parts = parseCachedPath(aliased);
-            result[key] = parts.length === 0 ? source : navigatePath(source, parts, withMethods);
+            result[key] = parts.length === 0 ? source : navigatePath(source, parts, withMethods, permissionProcessor);
         }
         else if (typeof value === 'string' && value.startsWith('$0')) {
             const rootRef = resolveRootReference(value, source, options?.root);
@@ -223,7 +233,7 @@ export function getValues(pattern, source, options) {
                 const aliased = applyAliases(rootRef.path, aliasMap);
                 const normalizedPath = aliased.startsWith('?.') ? aliased : (aliased ? `?.${aliased}` : '?.');
                 const parts = parseCachedPath(normalizedPath);
-                result[key] = parts.length === 0 ? rootRef.source : navigatePath(rootRef.source, parts, withMethods);
+                result[key] = parts.length === 0 ? rootRef.source : navigatePath(rootRef.source, parts, withMethods, permissionProcessor);
             }
         }
         else if (typeof value === 'string' && protocols && hasProtocol(value)) {
@@ -274,5 +284,6 @@ export function getValue(path, source, options) {
     if (parts.length === 0)
         return source;
     const { withMethods } = normalizeAliasOptions(options);
-    return navigatePath(source, parts, withMethods);
+    const permissionProcessor = options?.permissionProcessor;
+    return navigatePath(source, parts, withMethods, permissionProcessor);
 }