assign-gingerly 0.0.75 → 0.0.76

package/assignGingerly.ts

@@ -2,10 +2,8 @@
 
 import { EnhancementConfig } from "./types/assign-gingerly/types";
 import type { AssignFromOptions, FeatureConfigsMap, IAssignGingerlyOptions } from "./types/assign-gingerly/types";
-import type { AssignPermissions } from './types/assign-gingerly/types.js';
-import { buildRestrictedPropSet, checkRestrictedProp, redirectRestrictedProp } from './assignPermissions/restrictedProps.js';
-import type { RestrictedPropSettingsMap } from './assignPermissions/restrictedProps.js';
-import { normalizeAliasOptions } from './getValues.js';
+import type { PermissionProcessor } from './types/assign-gingerly/types.js';
+import { normalizeAliasOptions } from './resolve/getValues.js';
 
 /**
  * Constructor signature for ItemScope Manager classes
@@ -250,30 +248,30 @@ function isIncCommand(key: string): boolean {
 /**
  * Helper function to parse an += command and extract the path
  */
-function parseIncCommand(key: string): string | null {
-  if (!isIncCommand(key)) {
-    return null;
-  }
-  return key.substring(0, key.length - 3); // Remove ' +=' suffix
-}
-
-/**
- * Apply the scalar and array semantics of the += command.
- */
-function addValue(lhs: any, rhs: any): any {
-  if (Array.isArray(lhs)) {
-    return Array.isArray(rhs) ? [...lhs, ...rhs] : [...lhs, rhs];
-  }
-  if (typeof lhs === 'number' && typeof rhs === 'string') {
-    const parsed = Number(rhs);
-    return Number.isNaN(parsed) ? lhs + rhs : lhs + parsed;
-  }
-  if (typeof lhs === 'string' && typeof rhs === 'number') {
-    const parsed = Number(lhs);
-    return Number.isNaN(parsed) ? lhs + rhs : (parsed + rhs).toString();
-  }
-  return lhs + rhs;
-}
+function parseIncCommand(key: string): string | null {
+  if (!isIncCommand(key)) {
+    return null;
+  }
+  return key.substring(0, key.length - 3); // Remove ' +=' suffix
+}
+
+/**
+ * Apply the scalar and array semantics of the += command.
+ */
+function addValue(lhs: any, rhs: any): any {
+  if (Array.isArray(lhs)) {
+    return Array.isArray(rhs) ? [...lhs, ...rhs] : [...lhs, rhs];
+  }
+  if (typeof lhs === 'number' && typeof rhs === 'string') {
+    const parsed = Number(rhs);
+    return Number.isNaN(parsed) ? lhs + rhs : lhs + parsed;
+  }
+  if (typeof lhs === 'string' && typeof rhs === 'number') {
+    const parsed = Number(lhs);
+    return Number.isNaN(parsed) ? lhs + rhs : (parsed + rhs).toString();
+  }
+  return lhs + rhs;
+}
 
 /**
  * Helper function to check if a key represents a =! command
@@ -444,6 +442,19 @@ export function isClassInstance(value: any): boolean {
   return proto !== Object.prototype && proto !== null;
 }
 
+/**
+ * Check whether a method name is listed in withMethods and is not restricted
+ * by the permission processor. Restricted methods are treated as non-method
+ * property names so they fall through to normal access.
+ */
+export function isAllowedMethod(
+  methodName: string,
+  withMethods: Set<string>,
+  permissionProcessor?: PermissionProcessor
+): boolean {
+  return withMethods.has(methodName) && !permissionProcessor?.checkRestrictedMethod(methodName);
+}
+
 /**
  * Helper function to evaluate a nested path with method calls
  * Handles chained method calls where path segments can be methods
@@ -454,7 +465,8 @@ export function evaluatePathWithMethods(
   target: any,
   pathParts: string[],
   value: any,
-  withMethods: Set<string>
+  withMethods: Set<string>,
+  permissionProcessor?: PermissionProcessor
 ): { target: any; lastKey: string; isMethod: boolean; isZeroArg: boolean } {
   let current = target;
   let i = 0;
@@ -466,11 +478,11 @@ export function evaluatePathWithMethods(
     
     // A trailing | marks a zero-argument method call: 'deref|' calls deref()
     // without consuming the next segment. Only applies to names in withMethods.
-    const isZeroArgMethod = part.endsWith('|') && withMethods.has(part.slice(0, -1));
+    const isZeroArgMethod = part.endsWith('|') && isAllowedMethod(part.slice(0, -1), withMethods, permissionProcessor);
     const nextIsMethod = withMethods.has(nextPart)
       || (nextPart.endsWith('|') && withMethods.has(nextPart.slice(0, -1)));
     
-    if (withMethods.has(part) || isZeroArgMethod) {
+    if (isAllowedMethod(part, withMethods, permissionProcessor) || isZeroArgMethod) {
       const methodName = isZeroArgMethod ? part.slice(0, -1) : part;
       const method = current[methodName];
       if (typeof method === 'function') {
@@ -503,12 +515,12 @@ export function evaluatePathWithMethods(
   // Strip a trailing | from the last segment only when it names a listed method;
   // otherwise it is a literal property name (e.g. an exotic key ending in |).
   const rawLastKey = pathParts[pathParts.length - 1];
-  const isZeroArg = rawLastKey.endsWith('|') && withMethods.has(rawLastKey.slice(0, -1));
+  const isZeroArg = rawLastKey.endsWith('|') && isAllowedMethod(rawLastKey.slice(0, -1), withMethods, permissionProcessor);
   const lastKey = isZeroArg ? rawLastKey.slice(0, -1) : rawLastKey;
   return {
     target: current,
     lastKey,
-    isMethod: withMethods.has(lastKey),
+    isMethod: isAllowedMethod(lastKey, withMethods, permissionProcessor),
     isZeroArg
   };
 }
@@ -568,8 +580,7 @@ function applyToEach(
   withMethods: Set<string>,
   aliasMap: Map<string, string>,
   options?: IAssignGingerlyOptions,
-  permissions?: AssignPermissions,
-  restrictedPropSet?: RestrictedPropSettingsMap
+  permissionProcessor?: PermissionProcessor
 ): void {
   // Convert to array for iteration
   const items = Array.isArray(iterable) ? iterable : Array.from(iterable);
@@ -594,8 +605,8 @@ function applyToEach(
       let current = item;
       for (const part of pathToForEach) {
         // A trailing | marks a zero-argument method call (only for names in withMethods)
-        const isZeroArgMethod = part.endsWith('|') && withMethods.has(part.slice(0, -1));
-        if (withMethods.has(part) || isZeroArgMethod) {
+        const isZeroArgMethod = part.endsWith('|') && isAllowedMethod(part.slice(0, -1), withMethods, permissionProcessor);
+        if (isAllowedMethod(part, withMethods, permissionProcessor) || isZeroArgMethod) {
           const methodName = isZeroArgMethod ? part.slice(0, -1) : part;
           const method = current[methodName];
           if (typeof method === 'function') {
@@ -627,11 +638,11 @@ function applyToEach(
       
       // Recursively apply to the nested iterable
       if (isIterable(current)) {
-        applyToEach(current, pathAfterForEach, value, withMethods, aliasMap, options, permissions, restrictedPropSet);
+        applyToEach(current, pathAfterForEach, value, withMethods, aliasMap, options, permissionProcessor);
       }
     } else {
       // No nested @each, evaluate the remaining path normally
-      const result = evaluatePathWithMethods(item, remainingPath, value, withMethods);
+      const result = evaluatePathWithMethods(item, remainingPath, value, withMethods, permissionProcessor);
       
       if (result.isMethod) {
         // Last segment is a method - call it
@@ -651,7 +662,7 @@ function applyToEach(
         const lastKey = result.lastKey;
         const parent = result.target;
         
-        if (redirectRestrictedProp(restrictedPropSet, parent, lastKey, value)) {
+        if (permissionProcessor?.redirectRestrictedProp(parent, lastKey, value)) {
           // skip
         } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
           if (lastKey in parent && isReadonlyProperty(parent, lastKey)) {
@@ -659,7 +670,7 @@ function applyToEach(
             if (typeof currentValue !== 'object' || currentValue === null) {
               throw new Error(`Cannot merge object into readonly primitive property '${String(lastKey)}'`);
             }
-            assignGingerly(currentValue, value, options, permissions);
+            assignGingerly(currentValue, value, options, permissionProcessor);
           } else {
             parent[lastKey] = value;
           }
@@ -702,7 +713,7 @@ export function assignGingerly(
   target: any,
   source: Record<string | symbol, any>,
   options?: IAssignGingerlyOptions,
-  permissions?: AssignPermissions
+  permissionProcessor?: PermissionProcessor
 ): any {
   if (!target || typeof target !== 'object') {
     return target;
@@ -710,9 +721,6 @@ export function assignGingerly(
 
   const { aliasMap, withMethods: withMethodsSet } = normalizeAliasOptions(options);
 
-  // Normalize restrictedPropSettings once per top-level call
-  const restrictedPropSet = buildRestrictedPropSet(permissions);
-
   // Convert withAsyncMethods array to Set for O(1) lookup
   const withAsyncMethodsSet = options?.withAsyncMethods
     ? options.withAsyncMethods instanceof Set
@@ -800,7 +808,7 @@ export function assignGingerly(
           let lhsParent: any;
           let lhsKey: string;
           if (withMethodsSet) {
-            const result = evaluatePathWithMethods(target, pathParts, value, withMethodsSet);
+            const result = evaluatePathWithMethods(target, pathParts, value, withMethodsSet, permissionProcessor);
             lhsParent = result.target;
             lhsKey = result.lastKey;
             lhsValue = lhsParent[lhsKey];
@@ -811,49 +819,49 @@ export function assignGingerly(
           }
 
           //TODO:  this logic seems to occur twice at least.  Maybe make it a method?
-          if (checkRestrictedProp(restrictedPropSet, lhsKey)) {
-            continue;
-          }
-
-          // Event handler: Element LHS + object RHS with 'on' property
+          if (permissionProcessor?.checkRestrictedProp(lhsKey)) {
+            continue;
+          }
+
+          // Event handler: Element LHS + object RHS with 'on' property
           if (lhsValue instanceof Element && value && typeof value === 'object' && !Array.isArray(value) && 'on' in value) {
             const capturedLhs = lhsValue;
             const capturedValue = value;
             const capturedTarget = target;
-            const capturedOptions = options as AssignFromOptions | undefined;
-            import('./handlers/addEventListener.js').then(({ attachEventListener }) => {
-              attachEventListener(capturedLhs, capturedValue, capturedTarget, capturedOptions?.from ?? capturedTarget, capturedOptions ?? {}, permissions);
+            const capturedOptions = options as AssignFromOptions | undefined;
+            import('./handlers/addEventListener.js').then(({ attachEventListener }) => {
+              attachEventListener(capturedLhs, capturedValue, capturedTarget, capturedOptions?.from ?? capturedTarget, capturedOptions ?? {}, permissionProcessor);
             });
             continue;
           }
 
-          if (!(lhsKey in lhsParent)) {
-            lhsParent[lhsKey] = value;
-          } else {
-            lhsParent[lhsKey] = addValue(lhsValue, value);
+          if (!(lhsKey in lhsParent)) {
+            lhsParent[lhsKey] = value;
+          } else {
+            lhsParent[lhsKey] = addValue(lhsValue, value);
           }
         } else {
-          // Plain key - direct operation on target
-          if (checkRestrictedProp(restrictedPropSet, path)) {
-            continue;
-          }
-
-          // Event handler: Element LHS + object RHS with 'on' property
+          // Plain key - direct operation on target
+          if (permissionProcessor?.checkRestrictedProp(path)) {
+            continue;
+          }
+
+          // Event handler: Element LHS + object RHS with 'on' property
           if (target[path] instanceof Element && value && typeof value === 'object' && !Array.isArray(value) && 'on' in value) {
             const capturedLhs = target[path];
             const capturedValue = value;
             const capturedTarget = target;
-            const capturedOptions = options as AssignFromOptions | undefined;
-            import('./handlers/addEventListener.js').then(({ attachEventListener }) => {
-              attachEventListener(capturedLhs, capturedValue, capturedTarget, capturedOptions?.from ?? capturedTarget, capturedOptions ?? {}, permissions);
+            const capturedOptions = options as AssignFromOptions | undefined;
+            import('./handlers/addEventListener.js').then(({ attachEventListener }) => {
+              attachEventListener(capturedLhs, capturedValue, capturedTarget, capturedOptions?.from ?? capturedTarget, capturedOptions ?? {}, permissionProcessor);
             });
             continue;
           }
 
-          if (!(path in target)) {
-            target[path] = value;
-          } else {
-            target[path] = addValue(target[path], value);
+          if (!(path in target)) {
+            target[path] = value;
+          } else {
+            target[path] = addValue(target[path], value);
           }
         }
       }
@@ -909,7 +917,7 @@ export function assignGingerly(
         }
         
         // Apply negation to LHS — check restriction first
-        if (!checkRestrictedProp(restrictedPropSet, lhsLastKey)) {
+        if (!permissionProcessor?.checkRestrictedProp(lhsLastKey)) {
           lhsParent[lhsLastKey] = !valueToNegate;
         }
       }
@@ -961,19 +969,19 @@ export function assignGingerly(
     }
 
     // Handle Y= merge commands (recursive assignGingerly into sub-object)
-    if (isMergeCommand(key)) {
-      const path = parseMergeCommand(key);
-      if (path) {
-        const pathParts = isNestedPath(path) ? parsePath(path) : [path];
-        const lastKey = pathParts[pathParts.length - 1];
-        if (checkRestrictedProp(restrictedPropSet, lastKey)) {
-          continue;
-        }
-        // Navigate to the target sub-object
-        let mergeTarget: any;
+    if (isMergeCommand(key)) {
+      const path = parseMergeCommand(key);
+      if (path) {
+        const pathParts = isNestedPath(path) ? parsePath(path) : [path];
+        const lastKey = pathParts[pathParts.length - 1];
+        if (permissionProcessor?.checkRestrictedProp(lastKey)) {
+          continue;
+        }
+        // Navigate to the target sub-object
+        let mergeTarget: any;
         if (isNestedPath(path)) {
           if (withMethodsSet) {
-            const result = evaluatePathWithMethods(target, parsePath(path), value, withMethodsSet);
+            const result = evaluatePathWithMethods(target, parsePath(path), value, withMethodsSet, permissionProcessor);
             mergeTarget = result.target[result.lastKey];
           } else {
             const pathParts = parsePath(path);
@@ -993,7 +1001,7 @@ export function assignGingerly(
         
         // Recursively merge if target is a valid object
         if (mergeTarget && typeof mergeTarget === 'object') {
-          assignGingerly(mergeTarget, value, options, permissions);
+          assignGingerly(mergeTarget, value, options, permissionProcessor);
         }
       }
       continue;
@@ -1021,11 +1029,10 @@ export function assignGingerly(
                 pathParts,
                 forEachIndex,
                 value,
-                withMethodsSet,
-                aliasMap,
-                options,
-                permissions,
-                restrictedPropSet
+                withMethodsSet,
+                aliasMap,
+                options,
+                permissionProcessor
               );
             } catch (error) {
               console.error('Error in @eachTime:', error);
@@ -1042,7 +1049,7 @@ export function assignGingerly(
         let current = target;
         if (pathToForEach.length > 0) {
           if (withMethodsSet) {
-            const result = evaluatePathWithMethods(target, pathToForEach, value, withMethodsSet);
+            const result = evaluatePathWithMethods(target, pathToForEach, value, withMethodsSet, permissionProcessor);
             // The result.target is the current position after evaluating the path
             // This is already the iterable we want
             current = result.target;
@@ -1055,7 +1062,7 @@ export function assignGingerly(
         
         // Apply to each item in the iterable
         if (isIterable(current)) {
-          applyToEach(current, pathAfterForEach, value, withMethodsSet || new Set(), aliasMap, options, permissions, restrictedPropSet);
+          applyToEach(current, pathAfterForEach, value, withMethodsSet || new Set(), aliasMap, options, permissionProcessor);
         }
         // If not iterable, let JavaScript throw error naturally when trying to iterate
         
@@ -1069,15 +1076,15 @@ export function assignGingerly(
         const capturedTarget = target;
         const capturedPathParts = pathParts;
         const capturedValue = value;
-        const capturedWithMethodsSet = withMethodsSet || new Set<string>();
-        const capturedOptions = options;
-        const capturedPermissions = permissions;
-        const capturedRestrictedPropSet = restrictedPropSet;
+        const capturedWithMethodsSet = withMethodsSet || new Set<string>();
+        const capturedOptions = options;
+        const capturedPermissionProcessor = permissionProcessor;
         (async () => {
           const { evaluatePathWithAsyncMethods } = await import('./evaluatePathWithAsyncMethods.js');
           const result = await evaluatePathWithAsyncMethods(
             capturedTarget, capturedPathParts, capturedValue,
-            capturedWithMethodsSet, withAsyncMethodsSet
+            capturedWithMethodsSet, withAsyncMethodsSet,
+            capturedPermissionProcessor
           );
 
           if (result.isMethod || result.isAsyncMethod) {
@@ -1096,16 +1103,16 @@ export function assignGingerly(
           } else {
             // Not a method — assign the value
             const lastKey = result.lastKey;
-            const parent = result.target;
-            if (redirectRestrictedProp(capturedRestrictedPropSet, parent, lastKey, capturedValue)) {
-              // skip
-            } else if (typeof capturedValue === 'object' && capturedValue !== null && !Array.isArray(capturedValue)) {
+            const parent = result.target;
+            if (capturedPermissionProcessor?.redirectRestrictedProp(parent, lastKey, capturedValue)) {
+              // skip
+            } else if (typeof capturedValue === 'object' && capturedValue !== null && !Array.isArray(capturedValue)) {
               if (lastKey in parent && isReadonlyProperty(parent, lastKey)) {
                 const currentValue = parent[lastKey];
                 if (typeof currentValue !== 'object' || currentValue === null) {
                   throw new Error(`Cannot merge object into readonly primitive property '${String(lastKey)}'`);
                 }
-                assignGingerly(currentValue, capturedValue, capturedOptions, capturedPermissions);
+                assignGingerly(currentValue, capturedValue, capturedOptions, capturedPermissionProcessor);
               } else {
                 parent[lastKey] = capturedValue;
               }
@@ -1119,7 +1126,7 @@ export function assignGingerly(
 
       // Check if we need to handle methods
       if (withMethodsSet) {
-        const result = evaluatePathWithMethods(target, pathParts, value, withMethodsSet);
+        const result = evaluatePathWithMethods(target, pathParts, value, withMethodsSet, permissionProcessor);
         
         if (result.isMethod) {
           // Last segment is a method - call it
@@ -1142,19 +1149,19 @@ export function assignGingerly(
         const lastKey = result.lastKey;
         const parent = result.target;
         
-        if (redirectRestrictedProp(restrictedPropSet, parent, lastKey, value)) {
-          // skip
-        // Check for static assignTo protocol
-        } else if (lastKey in parent && tryAssignTo(parent[lastKey], value, parent, lastKey)) {
-          continue;
-        } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+        if (permissionProcessor?.redirectRestrictedProp(parent, lastKey, value)) {
+          // skip
+        // Check for static assignTo protocol
+        } else if (lastKey in parent && tryAssignTo(parent[lastKey], value, parent, lastKey)) {
+          continue;
+        } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
           // Check if property exists and is readonly
           if (lastKey in parent && isReadonlyProperty(parent, lastKey)) {
             const currentValue = parent[lastKey];
             if (typeof currentValue !== 'object' || currentValue === null) {
               throw new Error(`Cannot merge object into readonly primitive property '${String(lastKey)}'`);
             }
-            assignGingerly(currentValue, value, options, permissions);
+            assignGingerly(currentValue, value, options, permissionProcessor);
           } else {
             // Property is writable - replace it
             parent[lastKey] = value;
@@ -1167,12 +1174,12 @@ export function assignGingerly(
         const lastKey = pathParts[pathParts.length - 1];
         const parent = ensureNestedPath(target, pathParts);
 
-        if (redirectRestrictedProp(restrictedPropSet, parent, lastKey, value)) {
-          // skip
-        // Check for static assignTo protocol
-        } else if (lastKey in parent && tryAssignTo(parent[lastKey], value, parent, lastKey)) {
-          continue;
-        } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+        if (permissionProcessor?.redirectRestrictedProp(parent, lastKey, value)) {
+          // skip
+        // Check for static assignTo protocol
+        } else if (lastKey in parent && tryAssignTo(parent[lastKey], value, parent, lastKey)) {
+          continue;
+        } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
           // Check if property exists and is readonly
           if (lastKey in parent && isReadonlyProperty(parent, lastKey)) {
             // Property is readonly - check if current value is an object
@@ -1181,7 +1188,7 @@ export function assignGingerly(
               throw new Error(`Cannot merge object into readonly primitive property '${String(lastKey)}'`);
             }
             // Recursively apply assignGingerly to the readonly object
-            assignGingerly(currentValue, value, options, permissions);
+            assignGingerly(currentValue, value, options, permissionProcessor);
           } else {
             // Property is writable - replace it
             parent[lastKey] = value;
@@ -1212,12 +1219,12 @@ export function assignGingerly(
         continue;
       }
       
-      if (redirectRestrictedProp(restrictedPropSet, target, key, value)) {
-        // skip
-      // Check for static assignTo protocol
-      } else if (key in target && tryAssignTo(target[key], value, target, key)) {
-        continue;
-      } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      if (permissionProcessor?.redirectRestrictedProp(target, key, value)) {
+        // skip
+      // Check for static assignTo protocol
+      } else if (key in target && tryAssignTo(target[key], value, target, key)) {
+        continue;
+      } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
         // Check if property exists and is readonly
         if (key in target && isReadonlyProperty(target, key)) {
           // Property is readonly - check if current value is an object
@@ -1226,7 +1233,7 @@ export function assignGingerly(
             throw new Error(`Cannot merge object into readonly primitive property '${String(key)}'`);
           }
           // Recursively apply assignGingerly to the readonly object
-          assignGingerly(currentValue, value, options, permissions);
+          assignGingerly(currentValue, value, options, permissionProcessor);
         } else {
           // Property is writable - replace it
           target[key] = value;
@@ -1370,7 +1377,7 @@ export function assignGingerly(
   // Fire-and-forget bulk enhancements (async, non-blocking)
   if (options?.enhance && options.enhance.length > 0 && typeof target === 'object' && target instanceof Element) {
     import('./enhanceAll.js').then(({ enhanceAll }) => {
-      enhanceAll(target, options!.enhance!, permissions);
+      enhanceAll(target, options!.enhance!, permissionProcessor);
     });
   }
 

package/assignPermissions/PermissionProcessor.js

@@ -0,0 +1,166 @@
+import { isAllowedUrl } from './isAllowedUrl.js';
+export class PermissionProcessor {
+    constructor(permissions) {
+        this.permissions = permissions;
+        const { props, attrs } = buildMaps(permissions);
+        this.props = props;
+        this.attrs = attrs;
+        this.methods = buildMethodSet(permissions);
+        this.warned = new Set();
+        this.warnedMethods = new Set();
+    }
+    get crossDomainImports() {
+        return !!this.permissions?.crossDomainImports;
+    }
+    get hasProps() {
+        return this.props.size > 0;
+    }
+    get hasAttrs() {
+        return this.attrs.size > 0;
+    }
+    checkRestrictedProp(key) {
+        if (!this.props.has(key))
+            return false;
+        this.warnRestricted(key);
+        return true;
+    }
+    checkRestrictedMethod(methodName) {
+        if (!this.methods.has(methodName))
+            return false;
+        this.warnRestrictedMethod(methodName);
+        return true;
+    }
+    redirectRestrictedProp(target, key, value) {
+        if (!this.props.has(key))
+            return false;
+        const setting = this.props.get(key);
+        const { allowCrossDomain, allowFromSameDomain } = setting || {};
+        if (allowCrossDomain) {
+            return this.applyAllowedSetting(setting, target, key, value);
+        }
+        if (allowFromSameDomain) {
+            if (isAllowedUrl(value)) {
+                return this.applyAllowedSetting(setting, target, key, value);
+            }
+            this.warnRestricted(key);
+            return true;
+        }
+        if (setting?.useMethod) {
+            const method = target?.[setting.useMethod];
+            if (typeof method === 'function') {
+                method.call(target, value);
+                return true;
+            }
+        }
+        this.warnRestricted(key);
+        return true;
+    }
+    checkRestrictedAttributeCall(methodName, args) {
+        if (methodName !== 'setAttribute' || args.length === 0 || this.attrs.size === 0) {
+            return { blocked: false };
+        }
+        const attrName = String(args[0]);
+        if (!this.attrs.has(attrName)) {
+            return { blocked: false };
+        }
+        const setting = this.attrs.get(attrName);
+        const value = args[1];
+        const { allowCrossDomain, allowFromSameDomain } = setting || {};
+        if (allowCrossDomain) {
+            return { blocked: false, attrName };
+        }
+        if (allowFromSameDomain) {
+            if (isAllowedUrl(value)) {
+                return { blocked: false, attrName };
+            }
+            this.warnRestricted(attrName);
+            return { blocked: true, attrName };
+        }
+        this.warnRestricted(attrName);
+        return { blocked: true, attrName };
+    }
+    applyAllowedSetting(setting, target, key, value) {
+        if (setting?.useMethod) {
+            const method = target?.[setting.useMethod];
+            if (typeof method === 'function') {
+                method.call(target, value);
+                return true;
+            }
+            this.warnRestricted(key);
+            return true;
+        }
+        return false;
+    }
+    warnRestricted(key) {
+        if (!this.warned.has(key)) {
+            this.warned.add(key);
+            console.warn(`assignGingerly: property '${key}' is in restrictedPropSettings — assignment skipped.`);
+        }
+    }
+    warnRestrictedMethod(methodName) {
+        if (!this.warnedMethods.has(methodName)) {
+            this.warnedMethods.add(methodName);
+            console.warn(`assignGingerly: method '${methodName}' is in restrictedMethodSettings — method call skipped.`);
+        }
+    }
+}
+function buildMaps(permissions) {
+    const settings = permissions?.restrictedPropSettings;
+    const props = new Map();
+    const attrs = new Map();
+    if (!settings || settings.length === 0) {
+        return { props, attrs };
+    }
+    for (const setting of settings) {
+        if (typeof setting === 'string') {
+            if (props.has(setting)) {
+                throw new Error(`assignGingerly: duplicate restrictedPropSettings entry for '${setting}'.`);
+            }
+            props.set(setting, undefined);
+            continue;
+        }
+        const propNames = normalizeStrings(setting.props);
+        if (propNames.length === 0) {
+            throw new Error('assignGingerly: restrictedPropSettings object entry must have a props value.');
+        }
+        for (const prop of propNames) {
+            if (props.has(prop)) {
+                throw new Error(`assignGingerly: duplicate restrictedPropSettings entry for '${prop}'.`);
+            }
+            props.set(prop, setting);
+        }
+        const attrNames = normalizeAttrNames(setting.attr, propNames);
+        for (const attr of attrNames) {
+            if (attrs.has(attr)) {
+                throw new Error(`assignGingerly: duplicate restrictedPropSettings attr entry for '${attr}'.`);
+            }
+            attrs.set(attr, setting);
+        }
+    }
+    return { props, attrs };
+}
+function normalizeStrings(value) {
+    if (value === undefined)
+        return [];
+    return Array.isArray(value) ? value : [value];
+}
+function normalizeAttrNames(attr, propNames) {
+    if (attr === undefined || attr === false)
+        return [];
+    if (attr === true)
+        return propNames;
+    return normalizeStrings(attr);
+}
+function buildMethodSet(permissions) {
+    const methodSettings = permissions?.restrictedMethodSettings;
+    const methods = new Set();
+    if (!methodSettings || methodSettings.length === 0) {
+        return methods;
+    }
+    for (const setting of methodSettings) {
+        if (typeof setting === 'string') {
+            methods.add(setting);
+        }
+    }
+    return methods;
+}