Thanks for the link. "coerced from a string" is helpful. Firefox (devel browser of necessity due to certificate issues with the devel site at the moment) had docs that said "only a string was acceptable" and I was needing to alter the path based on a PHP config variable. Fortunately the relative path to DOCROOT was the same both places so that worked:
import foobar from '/js/json/foo.js'
I was afraid CORS would block, but it seems to be okay.