@suveren/gateway 0.29.0 → 0.29.1

package/dist/ui/index.html

@@ -14,7 +14,7 @@
     <meta name="apple-mobile-web-app-title" content="Suveren" />
     <meta name="theme-color" content="#111111" />
     <title>Suveren</title>
-    <script type="module" crossorigin src="/assets/index-C3vTF2Ye.js"></script>
+    <script type="module" crossorigin src="/assets/index-wtX8LuiU.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DUIlMVlP.css">
   </head>
   <body>

package/node_modules/sanitize-html/index.js

@@ -1,7 +1,6 @@
 const htmlparser = require('htmlparser2');
 const escapeStringRegexp = require('escape-string-regexp');
 const { isPlainObject } = require('is-plain-object');
-const deepmerge = require('deepmerge');
 const parseSrcset = require('parse-srcset');
 const { parse: postcssParse } = require('postcss');
 const { naughtyHref: launderNaughtyHref } = require('launder');
@@ -53,6 +52,29 @@ function has(obj, key) {
   return ({}).hasOwnProperty.call(obj, key);
 }
 
+// Combine the tag-specific and wildcard lists of allowed classes
+function mergeClasses(specific, wildcard) {
+  if (!Array.isArray(specific) || !Array.isArray(wildcard)) {
+    return wildcard;
+  }
+  return specific.concat(wildcard);
+}
+
+// Combine the tag-specific and wildcard allowed styles, concatenating the
+// lists of regular expressions for properties that appear in both. The result
+// has no prototype, so a property named `__proto__` is just another property
+function mergeStyles(specific, wildcard) {
+  const merged = Object.create(null);
+  for (const rules of [ specific, wildcard ]) {
+    for (const prop of Object.keys(rules)) {
+      merged[prop] = has(merged, prop)
+        ? merged[prop].concat(rules[prop])
+        : rules[prop];
+    }
+  }
+  return merged;
+}
+
 // Returns those elements of `a` for which `cb(a)` returns truthy
 function filter(a, cb) {
   const n = [];
@@ -103,14 +125,23 @@ module.exports = sanitizeHtml;
 // attribute name state with an empty attribute name buffer.
 const VALID_HTML_ATTRIBUTE_NAME = /^[^\0\t\n\f\r /<=>]+$/;
 
-// Ignore the _recursing flag; it's there for recursive
-// invocation as a guard against this exploit:
-// https://github.com/fb55/htmlparser2/issues/105
+// How many discarded <iframe> elements can be nested while their fallback
+// markup is still re-sanitized as HTML (see the `ontext` handler). Deeper
+// fallback is escaped as text, so that crafted input cannot recurse without
+// bound or re-parse the remainder of the input once per iframe
+// (GHSA-c9rx-x947-fp3h).
+const MAX_IFRAME_FALLBACK_DEPTH = 8;
 
-function sanitizeHtml(html, options, _recursing) {
+// `_fallback` is internal: it is set when re-sanitizing the fallback markup
+// of a discarded <iframe>, to carry the current nesting depth into the
+// recursive call.
+
+function sanitizeHtml(html, options, _fallback) {
   if (html == null) {
     return '';
   }
+  const baseDepth = (_fallback && _fallback.depth) || 0;
+  const iframeFallbackDepth = (_fallback && _fallback.iframeFallbackDepth) || 0;
   if (typeof html === 'number') {
     html = html.toString();
   }
@@ -542,7 +573,7 @@ function sanitizeHtml(html, options, _recursing) {
               if (allowedSpecificClasses && allowedWildcardClasses) {
                 value = filterClasses(
                   value,
-                  deepmerge(allowedSpecificClasses, allowedWildcardClasses),
+                  mergeClasses(allowedSpecificClasses, allowedWildcardClasses),
                   allowedClassesGlobs
                 );
               } else {
@@ -682,11 +713,17 @@ function sanitizeHtml(html, options, _recursing) {
         // (including after an unclosed <iframe>) arrives as a single text node.
         // When the iframe is discarded, re-sanitize that fallback markup as HTML
         // instead of escaping it as plain text (issue #5550).
+        // The nested call continues from the current depth so that
+        // `nestingLimit` applies to the whole output.
         tag === 'iframe' &&
         !tagAllowed(tag) &&
-        options.disallowedTagsMode === 'discard'
+        options.disallowedTagsMode === 'discard' &&
+        iframeFallbackDepth < MAX_IFRAME_FALLBACK_DEPTH
       ) {
-        result += sanitizeHtml(text, options);
+        result += sanitizeHtml(text, options, {
+          depth,
+          iframeFallbackDepth: iframeFallbackDepth + 1
+        });
       } else if (!addedText) {
         const escaped = escapeHtml(text, false);
         if (options.textFilter) {
@@ -819,7 +856,7 @@ function sanitizeHtml(html, options, _recursing) {
 
   function initializeState() {
     result = '';
-    depth = 0;
+    depth = baseDepth;
     stack = [];
     skipMap = {};
     transformMap = {};
@@ -1053,7 +1090,7 @@ function sanitizeHtml(html, options, _recursing) {
 
     // Merge global and tag-specific styles into new AST.
     if (allowedStyles[astRules.selector] && allowedStyles['*']) {
-      selectedRule = deepmerge(
+      selectedRule = mergeStyles(
         allowedStyles[astRules.selector],
         allowedStyles['*']
       );

package/node_modules/sanitize-html/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sanitize-html",
-  "version": "2.18.0",
+  "version": "2.18.1",
   "description": "Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis",
   "sideEffects": false,
   "main": "index.js",
@@ -29,7 +29,6 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "deepmerge": "^4.3.1",
     "escape-string-regexp": "^4.0.0",
     "htmlparser2": "^12.0.0",
     "is-plain-object": "^5.1.0",
@@ -40,7 +39,7 @@
   "devDependencies": {
     "eslint": "^9.39.5",
     "eslint-config-apostrophe": "^6.1.0",
-    "mocha": "^11.8.0",
+    "mocha": "^12.0.3",
     "sinon": "^9.2.4"
   },
   "apostropheTestConfig": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",

package/node_modules/deepmerge/.editorconfig

@@ -1,7 +0,0 @@
-root = true
-
-[*]
-indent_style = tab
-end_of_line = lf
-trim_trailing_whitespace = true
-insert_final_newline = true

package/node_modules/deepmerge/.eslintcache

@@ -1 +0,0 @@
-[{"/Users/joshduff/code/deepmerge/test/custom-is-mergeable-object.js":"1"},{"size":1990,"mtime":1679007485753,"results":"2","hashOfConfig":"3"},{"filePath":"4","messages":"5","suppressedMessages":"6","errorCount":0,"fatalErrorCount":0,"warningCount":0,"fixableErrorCount":0,"fixableWarningCount":0},"ktjd5k","/Users/joshduff/code/deepmerge/test/custom-is-mergeable-object.js",[],[]]

package/node_modules/deepmerge/changelog.md

@@ -1,167 +0,0 @@
-# [4.3.1](https://github.com/TehShrike/deepmerge/releases/tag/v4.3.1)
-
-- Fix type definition for arrayMerge options.  [#239](https://github.com/TehShrike/deepmerge/pull/239)
-
-# [4.3.0](https://github.com/TehShrike/deepmerge/releases/tag/v4.3.0)
-
-- Avoid thrown errors if the target doesn't have `propertyIsEnumerable`.  [#252](https://github.com/TehShrike/deepmerge/pull/252)
-
-# [4.2.2](https://github.com/TehShrike/deepmerge/releases/tag/v4.2.2)
-
-- `isMergeableObject` is now only called if there are two values that could be merged.  [a34dd4d2](https://github.com/TehShrike/deepmerge/commit/a34dd4d25bf5e250653540a2022bc832c7b00a19)
-
-# [4.2.1](https://github.com/TehShrike/deepmerge/releases/tag/v4.2.1)
-
-- Fix: falsey values can now be merged.  [#170](https://github.com/TehShrike/deepmerge/issues/170)
-
-# [4.2.0](https://github.com/TehShrike/deepmerge/releases/tag/v4.2.0)
-
-- Properties are now only overwritten if they exist on the target object and are enumerable.  [#164](https://github.com/TehShrike/deepmerge/pull/164)
-
-Technically this could probably be a patch release since "which properties get overwritten" wasn't documented and accidentally overwriting a built-in function or some function up the property chain would almost certainly be undesirable, but it feels like a gray area, so here we are with a feature version bump.
-
-# [4.1.2](https://github.com/TehShrike/deepmerge/releases/tag/v4.1.2)
-
-- Rolled back #167 since `Object.assign` breaks ES5 support.  [55067352](https://github.com/TehShrike/deepmerge/commit/55067352a92c65a6c44a5165f3387720aae1e192)
-
-# [4.1.1](https://github.com/TehShrike/deepmerge/releases/tag/v4.1.1)
-
-- The `options` argument is no longer mutated [#167](https://github.com/TehShrike/deepmerge/pull/167)
-
-# [4.1.0](https://github.com/TehShrike/deepmerge/releases/tag/v4.1.0)
-
-- `cloneUnlessOtherwiseSpecified` is now exposed to the `arrayMerge` function [#165](https://github.com/TehShrike/deepmerge/pull/165)
-
-# [4.0.0](https://github.com/TehShrike/deepmerge/releases/tag/v4.0.0)
-
-- The `main` entry point in `package.json` is now a CommonJS module instead of a UMD module [#155](https://github.com/TehShrike/deepmerge/pull/155)
-
-# [3.3.0](https://github.com/TehShrike/deepmerge/releases/tag/v3.3.0)
-
-- Enumerable Symbol properties are now copied [#151](https://github.com/TehShrike/deepmerge/pull/151)
-
-# [3.2.1](https://github.com/TehShrike/deepmerge/releases/tag/v3.2.1)
-
-- bumping dev dependency versions to try to shut up bogus security warnings from Github/npm [#149](https://github.com/TehShrike/deepmerge/pull/149)
-
-# [3.2.0](https://github.com/TehShrike/deepmerge/releases/tag/v3.2.0)
-
-- feature: added the [`customMerge`](https://github.com/TehShrike/deepmerge#custommerge) option [#133](https://github.com/TehShrike/deepmerge/pull/133)
-
-# [3.1.0](https://github.com/TehShrike/deepmerge/releases/tag/v3.1.0)
-
-- typescript typing: make the `all` function generic [#129](https://github.com/TehShrike/deepmerge/pull/129)
-
-# [3.0.0](https://github.com/TehShrike/deepmerge/releases/tag/v3.0.0)
-
-- drop ES module build [#123](https://github.com/TehShrike/deepmerge/issues/123)
-
-# [2.2.1](https://github.com/TehShrike/deepmerge/releases/tag/v2.2.1)
-
-- bug: typescript export type was wrong [#121](https://github.com/TehShrike/deepmerge/pull/121)
-
-# [2.2.0](https://github.com/TehShrike/deepmerge/releases/tag/v2.2.0)
-
-- feature: added TypeScript typings [#119](https://github.com/TehShrike/deepmerge/pull/119)
-
-# [2.1.1](https://github.com/TehShrike/deepmerge/releases/tag/v2.1.1)
-
-- documentation: Rename "methods" to "api", note ESM syntax [#103](https://github.com/TehShrike/deepmerge/pull/103)
-- documentation: Fix grammar [#107](https://github.com/TehShrike/deepmerge/pull/107)
-- documentation: Restructure headers for clarity + some wording tweaks [108](https://github.com/TehShrike/deepmerge/pull/108) + [109](https://github.com/TehShrike/deepmerge/pull/109)
-
-
-# [2.1.0](https://github.com/TehShrike/deepmerge/releases/tag/v2.1.0)
-
-- feature: Support a custom `isMergeableObject` function [#96](https://github.com/TehShrike/deepmerge/pull/96)
-- documentation: note a Webpack bug that some users might need to work around [#100](https://github.com/TehShrike/deepmerge/pull/100)
-
-# [2.0.1](https://github.com/TehShrike/deepmerge/releases/tag/v2.0.1)
-
-- documentation: fix the old array merge algorithm in the readme.  [#84](https://github.com/TehShrike/deepmerge/pull/84)
-
-# [2.0.0](https://github.com/TehShrike/deepmerge/releases/tag/v2.0.0)
-
-- breaking: the array merge algorithm has changed from a complicated thing to `target.concat(source).map(element => cloneUnlessOtherwiseSpecified(element, optionsArgument))`
-- breaking: The `clone` option now defaults to `true`
-- feature: `merge.all` now accepts an array of any size, even 0 or 1 elements
-
-See [pull request 77](https://github.com/TehShrike/deepmerge/pull/77).
-
-# [1.5.2](https://github.com/TehShrike/deepmerge/releases/tag/v1.5.2)
-
-- fix: no longer attempts to merge React elements [#76](https://github.com/TehShrike/deepmerge/issues/76)
-
-# [1.5.1](https://github.com/TehShrike/deepmerge/releases/tag/v1.5.1)
-
-- bower support: officially dropping bower support.  If you use bower, please depend on the [unpkg distribution](https://unpkg.com/deepmerge/dist/umd.js).  See [#63](https://github.com/TehShrike/deepmerge/issues/63)
-
-# [1.5.0](https://github.com/TehShrike/deepmerge/releases/tag/v1.5.0)
-
-- bug fix: merging objects into arrays was allowed, and doesn't make any sense. [#65](https://github.com/TehShrike/deepmerge/issues/65) published as a feature release instead of a patch because it is a decent behavior change.
-
-# [1.4.4](https://github.com/TehShrike/deepmerge/releases/tag/v1.4.4)
-
-- bower support: updated `main` in bower.json
-
-# [1.4.3](https://github.com/TehShrike/deepmerge/releases/tag/v1.4.3)
-
-- bower support: inline is-mergeable-object in a new CommonJS build, so that people using both bower and CommonJS can bundle the library [0b34e6](https://github.com/TehShrike/deepmerge/commit/0b34e6e95f989f2fc8091d25f0d291c08f3d2d24)
-
-# [1.4.2](https://github.com/TehShrike/deepmerge/releases/tag/v1.4.2)
-
-- performance: bump is-mergeable-object dependency version for a slight performance improvement [5906c7](https://github.com/TehShrike/deepmerge/commit/5906c765d691d48e83d76efbb0d4b9ca150dc12c)
-
-# [1.4.1](https://github.com/TehShrike/deepmerge/releases/tag/v1.4.1)
-
-- documentation: fix unpkg link [acc45b](https://github.com/TehShrike/deepmerge/commit/acc45be85519c1df906a72ecb24764b622d18d47)
-
-# [1.4.0](https://github.com/TehShrike/deepmerge/releases/tag/v1.4.0)
-
-- api: instead of only exporting a UMD module, expose a UMD module with `pkg.main`, a CJS module with `pkg.browser`, and an ES module with `pkg.module` [#62](https://github.com/TehShrike/deepmerge/pull/62)
-
-# [1.3.2](https://github.com/TehShrike/deepmerge/releases/tag/v1.3.2)
-
-- documentation: note the minified/gzipped file sizes [56](https://github.com/TehShrike/deepmerge/pull/56)
-- documentation: make data structures more readable in merge example: pull request [57](https://github.com/TehShrike/deepmerge/pull/57)
-
-# [1.3.1](https://github.com/TehShrike/deepmerge/releases/tag/v1.3.1)
-
-- documentation: clarify and test some array merging documentation: pull request [51](https://github.com/TehShrike/deepmerge/pull/51)
-
-# [1.3.0](https://github.com/TehShrike/deepmerge/releases/tag/v1.3.0)
-
-- feature: `merge.all`, a merge function that merges any number of objects: pull request [50](https://github.com/TehShrike/deepmerge/pull/50)
-
-# [1.2.0](https://github.com/TehShrike/deepmerge/releases/tag/v1.2.0)
-
-- fix: an error that would be thrown when an array would be merged onto a truthy non-array value: pull request [46](https://github.com/TehShrike/deepmerge/pull/46)
-- feature: the ability to clone: Issue [28](https://github.com/TehShrike/deepmerge/issues/28), pull requests [44](https://github.com/TehShrike/deepmerge/pull/44) and [48](https://github.com/TehShrike/deepmerge/pull/48)
-- maintenance: added tests + travis to `.npmignore`: pull request [47](https://github.com/TehShrike/deepmerge/pull/47)
-
-# [1.1.1](https://github.com/TehShrike/deepmerge/releases/tag/v1.1.1)
-
-- fix an issue where an error was thrown when merging an array onto a non-array: [Pull request 46](https://github.com/TehShrike/deepmerge/pull/46)
-
-# [1.1.0](https://github.com/TehShrike/deepmerge/releases/tag/v1.1.0)
-
-- allow consumers to specify their own array merging algorithm: [Pull request 37](https://github.com/TehShrike/deepmerge/pull/37)
-
-# [1.0.3](https://github.com/TehShrike/deepmerge/releases/tag/v1.0.3)
-
-- adding bower.json back: [Issue 38](https://github.com/TehShrike/deepmerge/pull/38)
-- updating keywords and Github links in package.json [bc3898e](https://github.com/TehShrike/deepmerge/commit/bc3898e587a56f74591328f40f656b0152c1d5eb)
-
-# [1.0.2](https://github.com/TehShrike/deepmerge/releases/tag/v1.0.2)
-
-- Updating the readme: dropping bower, testing that the example works: [7102fc](https://github.com/TehShrike/deepmerge/commit/7102fcc4ddec11e2d33205866f9f18df14e5aeb5)
-
-# [1.0.1](https://github.com/TehShrike/deepmerge/releases/tag/v1.0.1)
-
-- `null`, dates, and regular expressions are now properly merged in arrays: [Issue 18](https://github.com/TehShrike/deepmerge/pull/18), plus commit: [ef1c6b](https://github.com/TehShrike/deepmerge/commit/ef1c6bac8350ba12a24966f0bc7da02560827586)
-
-# 1.0.0
-
-- Should only be a patch change, because this module is READY. [Issue 15](https://github.com/TehShrike/deepmerge/issues/15)
-- Regular expressions are now treated like primitive values when merging: [Issue 30](https://github.com/TehShrike/deepmerge/pull/30)
-- Dates are now treated like primitives when merging: [Issue 31](https://github.com/TehShrike/deepmerge/issues/31)

package/node_modules/deepmerge/dist/cjs.js

@@ -1,133 +0,0 @@
-'use strict';
-
-var isMergeableObject = function isMergeableObject(value) {
-	return isNonNullObject(value)
-		&& !isSpecial(value)
-};
-
-function isNonNullObject(value) {
-	return !!value && typeof value === 'object'
-}
-
-function isSpecial(value) {
-	var stringValue = Object.prototype.toString.call(value);
-
-	return stringValue === '[object RegExp]'
-		|| stringValue === '[object Date]'
-		|| isReactElement(value)
-}
-
-// see https://github.com/facebook/react/blob/b5ac963fb791d1298e7f396236383bc955f916c1/src/isomorphic/classic/element/ReactElement.js#L21-L25
-var canUseSymbol = typeof Symbol === 'function' && Symbol.for;
-var REACT_ELEMENT_TYPE = canUseSymbol ? Symbol.for('react.element') : 0xeac7;
-
-function isReactElement(value) {
-	return value.$$typeof === REACT_ELEMENT_TYPE
-}
-
-function emptyTarget(val) {
-	return Array.isArray(val) ? [] : {}
-}
-
-function cloneUnlessOtherwiseSpecified(value, options) {
-	return (options.clone !== false && options.isMergeableObject(value))
-		? deepmerge(emptyTarget(value), value, options)
-		: value
-}
-
-function defaultArrayMerge(target, source, options) {
-	return target.concat(source).map(function(element) {
-		return cloneUnlessOtherwiseSpecified(element, options)
-	})
-}
-
-function getMergeFunction(key, options) {
-	if (!options.customMerge) {
-		return deepmerge
-	}
-	var customMerge = options.customMerge(key);
-	return typeof customMerge === 'function' ? customMerge : deepmerge
-}
-
-function getEnumerableOwnPropertySymbols(target) {
-	return Object.getOwnPropertySymbols
-		? Object.getOwnPropertySymbols(target).filter(function(symbol) {
-			return Object.propertyIsEnumerable.call(target, symbol)
-		})
-		: []
-}
-
-function getKeys(target) {
-	return Object.keys(target).concat(getEnumerableOwnPropertySymbols(target))
-}
-
-function propertyIsOnObject(object, property) {
-	try {
-		return property in object
-	} catch(_) {
-		return false
-	}
-}
-
-// Protects from prototype poisoning and unexpected merging up the prototype chain.
-function propertyIsUnsafe(target, key) {
-	return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
-		&& !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain,
-			&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
-}
-
-function mergeObject(target, source, options) {
-	var destination = {};
-	if (options.isMergeableObject(target)) {
-		getKeys(target).forEach(function(key) {
-			destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
-		});
-	}
-	getKeys(source).forEach(function(key) {
-		if (propertyIsUnsafe(target, key)) {
-			return
-		}
-
-		if (propertyIsOnObject(target, key) && options.isMergeableObject(source[key])) {
-			destination[key] = getMergeFunction(key, options)(target[key], source[key], options);
-		} else {
-			destination[key] = cloneUnlessOtherwiseSpecified(source[key], options);
-		}
-	});
-	return destination
-}
-
-function deepmerge(target, source, options) {
-	options = options || {};
-	options.arrayMerge = options.arrayMerge || defaultArrayMerge;
-	options.isMergeableObject = options.isMergeableObject || isMergeableObject;
-	// cloneUnlessOtherwiseSpecified is added to `options` so that custom arrayMerge()
-	// implementations can use it. The caller may not replace it.
-	options.cloneUnlessOtherwiseSpecified = cloneUnlessOtherwiseSpecified;
-
-	var sourceIsArray = Array.isArray(source);
-	var targetIsArray = Array.isArray(target);
-	var sourceAndTargetTypesMatch = sourceIsArray === targetIsArray;
-
-	if (!sourceAndTargetTypesMatch) {
-		return cloneUnlessOtherwiseSpecified(source, options)
-	} else if (sourceIsArray) {
-		return options.arrayMerge(target, source, options)
-	} else {
-		return mergeObject(target, source, options)
-	}
-}
-
-deepmerge.all = function deepmergeAll(array, options) {
-	if (!Array.isArray(array)) {
-		throw new Error('first argument should be an array')
-	}
-
-	return array.reduce(function(prev, next) {
-		return deepmerge(prev, next, options)
-	}, {})
-};
-
-var deepmerge_1 = deepmerge;
-
-module.exports = deepmerge_1;

package/node_modules/deepmerge/dist/umd.js

@@ -1,139 +0,0 @@
-(function (global, factory) {
-	typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
-	typeof define === 'function' && define.amd ? define(factory) :
-	(global = global || self, global.deepmerge = factory());
-}(this, function () { 'use strict';
-
-	var isMergeableObject = function isMergeableObject(value) {
-		return isNonNullObject(value)
-			&& !isSpecial(value)
-	};
-
-	function isNonNullObject(value) {
-		return !!value && typeof value === 'object'
-	}
-
-	function isSpecial(value) {
-		var stringValue = Object.prototype.toString.call(value);
-
-		return stringValue === '[object RegExp]'
-			|| stringValue === '[object Date]'
-			|| isReactElement(value)
-	}
-
-	// see https://github.com/facebook/react/blob/b5ac963fb791d1298e7f396236383bc955f916c1/src/isomorphic/classic/element/ReactElement.js#L21-L25
-	var canUseSymbol = typeof Symbol === 'function' && Symbol.for;
-	var REACT_ELEMENT_TYPE = canUseSymbol ? Symbol.for('react.element') : 0xeac7;
-
-	function isReactElement(value) {
-		return value.$$typeof === REACT_ELEMENT_TYPE
-	}
-
-	function emptyTarget(val) {
-		return Array.isArray(val) ? [] : {}
-	}
-
-	function cloneUnlessOtherwiseSpecified(value, options) {
-		return (options.clone !== false && options.isMergeableObject(value))
-			? deepmerge(emptyTarget(value), value, options)
-			: value
-	}
-
-	function defaultArrayMerge(target, source, options) {
-		return target.concat(source).map(function(element) {
-			return cloneUnlessOtherwiseSpecified(element, options)
-		})
-	}
-
-	function getMergeFunction(key, options) {
-		if (!options.customMerge) {
-			return deepmerge
-		}
-		var customMerge = options.customMerge(key);
-		return typeof customMerge === 'function' ? customMerge : deepmerge
-	}
-
-	function getEnumerableOwnPropertySymbols(target) {
-		return Object.getOwnPropertySymbols
-			? Object.getOwnPropertySymbols(target).filter(function(symbol) {
-				return Object.propertyIsEnumerable.call(target, symbol)
-			})
-			: []
-	}
-
-	function getKeys(target) {
-		return Object.keys(target).concat(getEnumerableOwnPropertySymbols(target))
-	}
-
-	function propertyIsOnObject(object, property) {
-		try {
-			return property in object
-		} catch(_) {
-			return false
-		}
-	}
-
-	// Protects from prototype poisoning and unexpected merging up the prototype chain.
-	function propertyIsUnsafe(target, key) {
-		return propertyIsOnObject(target, key) // Properties are safe to merge if they don't exist in the target yet,
-			&& !(Object.hasOwnProperty.call(target, key) // unsafe if they exist up the prototype chain,
-				&& Object.propertyIsEnumerable.call(target, key)) // and also unsafe if they're nonenumerable.
-	}
-
-	function mergeObject(target, source, options) {
-		var destination = {};
-		if (options.isMergeableObject(target)) {
-			getKeys(target).forEach(function(key) {
-				destination[key] = cloneUnlessOtherwiseSpecified(target[key], options);
-			});
-		}
-		getKeys(source).forEach(function(key) {
-			if (propertyIsUnsafe(target, key)) {
-				return
-			}
-
-			if (propertyIsOnObject(target, key) && options.isMergeableObject(source[key])) {
-				destination[key] = getMergeFunction(key, options)(target[key], source[key], options);
-			} else {
-				destination[key] = cloneUnlessOtherwiseSpecified(source[key], options);
-			}
-		});
-		return destination
-	}
-
-	function deepmerge(target, source, options) {
-		options = options || {};
-		options.arrayMerge = options.arrayMerge || defaultArrayMerge;
-		options.isMergeableObject = options.isMergeableObject || isMergeableObject;
-		// cloneUnlessOtherwiseSpecified is added to `options` so that custom arrayMerge()
-		// implementations can use it. The caller may not replace it.
-		options.cloneUnlessOtherwiseSpecified = cloneUnlessOtherwiseSpecified;
-
-		var sourceIsArray = Array.isArray(source);
-		var targetIsArray = Array.isArray(target);
-		var sourceAndTargetTypesMatch = sourceIsArray === targetIsArray;
-
-		if (!sourceAndTargetTypesMatch) {
-			return cloneUnlessOtherwiseSpecified(source, options)
-		} else if (sourceIsArray) {
-			return options.arrayMerge(target, source, options)
-		} else {
-			return mergeObject(target, source, options)
-		}
-	}
-
-	deepmerge.all = function deepmergeAll(array, options) {
-		if (!Array.isArray(array)) {
-			throw new Error('first argument should be an array')
-		}
-
-		return array.reduce(function(prev, next) {
-			return deepmerge(prev, next, options)
-		}, {})
-	};
-
-	var deepmerge_1 = deepmerge;
-
-	return deepmerge_1;
-
-}));

package/node_modules/deepmerge/index.d.ts

@@ -1,20 +0,0 @@
-declare function deepmerge<T>(x: Partial<T>, y: Partial<T>, options?: deepmerge.Options): T;
-declare function deepmerge<T1, T2>(x: Partial<T1>, y: Partial<T2>, options?: deepmerge.Options): T1 & T2;
-
-declare namespace deepmerge {
-	export interface Options {
-		arrayMerge?(target: any[], source: any[], options?: ArrayMergeOptions): any[];
-		clone?: boolean;
-		customMerge?: (key: string, options?: Options) => ((x: any, y: any) => any) | undefined;
-		isMergeableObject?(value: object): boolean;
-	}
-	export interface ArrayMergeOptions {
-		isMergeableObject(value: object): boolean;
-		cloneUnlessOtherwiseSpecified(value: object, options?: Options): object;
-	}
-
-	export function all (objects: object[], options?: Options): object;
-	export function all<T> (objects: Partial<T>[], options?: Options): T;
-}
-
-export = deepmerge;