index.cjs

function deep () {
  if (arguments.length === 2) return get.apply(null, arguments);
  return set.apply(null, arguments);
}

function get (obj, path) {
  var keys = Array.isArray(path) ? path : path.split('.');
  for (var i = 0; i < keys.length; i++) {
    var key = keys[i];
    if (!obj || !Object.hasOwn(obj, key) || isUnsafeKey(key)) {
      obj = undefined;
      break;
    }
    obj = obj[key];
  }
  return obj;
}

function set (obj, path, value, strict = !deep.p) {
  var keys = Array.isArray(path) ? path : path.split('.');
  for (var i = 0; i < keys.length - 1; i++) {
    var key = keys[i];
    if (isUnsafeKey(key)) return;
    if (!Object.hasOwn(obj, key) && !strict) obj[key] = {};
    obj = obj[key];
  }
  obj[keys[i]] = value;
  return value;
}

function isUnsafeKey (key) {
  return (Array.isArray(key) && key[0] === '__proto__')
    || key === '__proto__'
    || key === 'constructor'
    || key === 'prototype';
}

module.exports = deep;
exports.set = set;
exports.get = get;