builder-util-runtime 9.7.0: deepAssign

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify builder-util-runtime.deepAssign in pkg:npm/builder-util-runtime@9.7.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/builder-util-runtime@9.7.0
Demonstrate these symbols/APIs:
  - builder-util-runtime.deepAssign

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:e1dab7242733325c524b46d81832b65f314bd53cfe5e036e27ffd37cf415f462","contract":["deepAssign modifies target object in place and returns the exact target reference","deepAssign deeply merges nested objects preserving existing target properties","deepAssign merges multiple source objects in left to right order","deepAssign overwrites primitives and null values from source objects","deepAssign merges and deduplicates array elements from source arrays","deepAssign ignores undefined source property values without overwriting target properties","deepAssign gracefully skips null and undefined source object arguments","deepAssign protects against prototype pollution keys including __proto__, constructor, and prototype","mergeConfigs helper deeply merges configuration objects"],"goal":"verify builder-util-runtime.deepAssign in pkg:npm/builder-util-runtime@9.7.0","kind":"HOW","packages":["pkg:npm/builder-util-runtime@9.7.0"],"schemaVersion":1,"symbols":["builder-util-runtime.deepAssign"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/builder-util-runtime@9.7.0"],"schemaVersion":1,"subject":"pkg:npm/builder-util-runtime@9.7.0","symbols":["builder-util-runtime.deepAssign"],"verifierAdapter":"node-typescript@1"}

{
  "name": "sample-builder-util-runtime-deep-assign",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-builder-util-runtime-deep-assign",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "builder-util-runtime": "9.7.0"
      }
    },
    "node_modules/builder-util-runtime": {
      "version": "9.7.0",
      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.7.0.tgz",
      "integrity": "sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==",
      "license": "MIT",
      "dependencies": {
        "debug": "^4.3.4",
        "sax": "^1.2.4"
      },
      "engines": {
        "node": ">=12.0.0"
      }
    },
    "node_modules/debug": {
      "version": "4.4.3",
      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
      "license": "MIT",
      "dependencies": {
        "ms": "^2.1.3"
      },
      "engines": {
        "node": ">=6.0"
      },
      "peerDependenciesMeta": {
        "supports-color": {
          "optional": true
        }
      }
    },
    "node_modules/ms": {
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
      "license": "MIT"
    },
    "node_modules/sax": {
      "version": "1.6.1",
      "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.1.tgz",
      "integrity": "sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==",
      "license": "BlueOak-1.0.0",
      "engines": {
        "node": ">=11.0.0"
      }
    }
  }
}

{
  "name": "sample-builder-util-runtime-deep-assign",
  "version": "1.0.0",
  "private": true,
  "description": "Clean-room verification of builder-util-runtime.deepAssign",
  "main": "src/index.js",
  "license": "MIT-0",
  "dependencies": {
    "builder-util-runtime": "9.7.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify builder-util-runtime.deepAssign in pkg:npm/builder-util-runtime@9.7.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/builder-util-runtime@9.7.0"
  ],
  "symbols": [
    "builder-util-runtime.deepAssign"
  ]
}

const { deepAssign } = require('builder-util-runtime');

/**
 * Deeply assigns properties from source objects into a target object.
 * @param {object} target - Target object to mutate.
 * @param {...object} sources - Source objects to merge from.
 * @returns {object} Mutated target object.
 */
function mergeConfigs(target, ...sources) {
  return deepAssign(target, ...sources);
}

module.exports = {
  deepAssign,
  mergeConfigs
};

import assert from 'node:assert';
import { createRequire } from 'node:module';

const require = createRequire(import.meta.url);
const { deepAssign, mergeConfigs } = require('../src/index.js');

// 1. Export type verification
assert.strictEqual(typeof deepAssign, 'function', 'deepAssign must be a function');
assert.strictEqual(typeof mergeConfigs, 'function', 'mergeConfigs must be a function');

// 2. Modifies target in place and returns the exact target reference
const target1 = { a: 1, b: { c: 2 } };
const source1 = { b: { d: 3 }, e: 4 };
const res1 = deepAssign(target1, source1);
assert.strictEqual(res1, target1, 'deepAssign must return the exact target object reference');
assert.deepStrictEqual(target1, {
  a: 1,
  b: { c: 2, d: 3 },
  e: 4
}, 'deepAssign must deeply merge nested objects');

// 3. Merges multiple source objects in left-to-right precedence
const target2 = { x: 1 };
const res2 = deepAssign(target2, { y: 2 }, { z: 3, x: 10 });
assert.deepStrictEqual(res2, { x: 10, y: 2, z: 3 });

// 4. Overwrites primitive values and null values
const target3 = { flag: true, val: 100, text: 'old', sub: { k: 1 } };
deepAssign(target3, { flag: false, val: null, text: 'new', sub: 'not-object' });
assert.deepStrictEqual(target3, {
  flag: false,
  val: null,
  text: 'new',
  sub: 'not-object'
});

// 5. Merges and deduplicates arrays
const target4 = { tags: ['alpha', 'beta'], list: [1, 2] };
deepAssign(target4, { tags: ['beta', 'gamma'], list: [2, 3, 4] });
assert.deepStrictEqual(target4.tags, ['alpha', 'beta', 'gamma']);
assert.deepStrictEqual(target4.list, [1, 2, 3, 4]);

// 6. Skips undefined property values without overwriting existing target property
const target5 = { existing: 'keep-me', num: 42 };
deepAssign(target5, { existing: undefined, num: 100 });
assert.strictEqual(target5.existing, 'keep-me');
assert.strictEqual(target5.num, 100);

// 7. Skips null and undefined source arguments gracefully
const target6 = { base: true };
const res6 = deepAssign(target6, null, undefined, { added: 1 });
assert.deepStrictEqual(res6, { base: true, added: 1 });

// 8. Protects against prototype pollution keys (__proto__, constructor, prototype)
const target7 = {};
const malicious = JSON.parse('{"__proto__": {"polluted": true}, "constructor": {"polluted": true}, "prototype": {"polluted": true}}');
deepAssign(target7, malicious);
assert.strictEqual(target7.polluted, undefined);
assert.strictEqual(({}).polluted, undefined);
assert.strictEqual(Object.prototype.polluted, undefined);

// 9. mergeConfigs helper wrapper verification
const configTarget = { env: 'prod', logging: { level: 'info' } };
const configOverride = { logging: { level: 'debug', format: 'json' } };
const mergedConfig = mergeConfigs(configTarget, configOverride);
assert.strictEqual(mergedConfig, configTarget);
assert.deepStrictEqual(mergedConfig, {
  env: 'prod',
  logging: { level: 'debug', format: 'json' }
});

console.log('Contract tests passed successfully.');