isPotentiallyTrustworthyOrigin = (urlString) => {
  let url;

  // try ... catch doubles as an opaque origin check
  try {
    url = new URL(urlString);
  } catch (e) {
    if (e instanceof TypeError && e.code === 'ERR_INVALID_URL') {
      return false;
    } else throw e;
  }

  const scheme = url.protocol.replace(':', '').toLowerCase();
  const hostname = hostNoBrackets(
    url.hostname
  ).replace(/\.+$/, '');

  if (
    scheme === 'https' ||
    scheme === 'wss' ||
    scheme === 'file' // https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-origin
  ) {
    return true;
  }

  // If it's already an IP literal, check if it's a loopback address
  if (net.isIP(hostname)) {
    return isIpLoopback(hostname);
  }

  // RFC 6761 states that localhost names will always resolve
  // to the respective IP loopback address:
  // https://datatracker.ietf.org/doc/html/rfc6761#section-6.3
  return isLocalHostname(hostname);
}
Determines if a URL string represents a potentially trustworthy origin.

A URL is considered potentially trustworthy if it:
- Uses HTTPS, WSS or file schemes
- Points to a loopback address (IPv4 127.0.0.0/8 or IPv6 ::1)
- Uses localhost or *.localhost hostnames

@param {string} urlString - The URL to check
@returns {boolean}
@see {@link https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-origin W3C Spec}