@stackline/deepmerge 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes are documented here. This project follows Semantic
 Versioning.
 
+## [1.0.1] - 2026-08-21
+
+### Added
+
+- Executable adoption examples for hostile configuration input, custom array
+  strategies, cycles, and shared references.
+- Direct-install and npm-alias migration guide.
+- Reproducible benchmark methodology and public Stackline catalog link.
+- First-party documentation analytics that never records playground input.
+- Trusted-publishing workflow for provenance-enabled future releases.
+
+### Changed
+
+- Package tarballs now include the public guides and executable examples.
+- CI resolves release tarballs dynamically instead of hardcoding a version.
+
+No runtime API or declaration behavior changed in this release.
+
 ## [1.0.0] - 2026-08-16
 
 ### Added
@@ -21,3 +39,4 @@ Versioning.
 - Public documentation, security policy, CI matrix, and live playground.
 
 [1.0.0]: https://github.com/alexandroit/stackline-deepmerge/releases/tag/v1.0.0
+[1.0.1]: https://github.com/alexandroit/stackline-deepmerge/compare/v1.0.0...v1.0.1

package/README.md

@@ -246,7 +246,7 @@ The release matrix tests TypeScript `3.9`, `4.7`, `4.9`, `5.9`, `6.0`, and
 Use the ESM build with a bundler, or load the small browser global directly:
 
 ```html
-<script src="https://unpkg.com/@stackline/deepmerge@1.0.0/dist/index.min.js"></script>
+<script src="https://unpkg.com/@stackline/deepmerge@1/dist/index.min.js"></script>
 <script>
   const merged = StacklineDeepmerge(
     { theme: { contrast: 'normal' } },
@@ -289,6 +289,17 @@ npm run benchmark
 Use benchmark results as regression signals, not universal claims. Runtime,
 CPU, input shape, and custom callbacks materially affect throughput.
 
+## Adoption resources
+
+- [Direct install and drop-in alias guide](docs/ADOPTION.md)
+- [Reproducible benchmark methodology](docs/BENCHMARKS.md)
+- [Executable examples](examples)
+- [Stackline open-source catalog](https://alexandro.net/docs/open-source/)
+
+The examples are included in the npm tarball and run against the package's
+public exports. They cover hostile configuration input, custom array strategy,
+cycles, and shared references.
+
 ## Trust and maintenance
 
 - No runtime dependencies.

package/dist/index.cjs

@@ -1,4 +1,4 @@
-/*! @stackline/deepmerge v1.0.0 | MIT */
+/*! @stackline/deepmerge v1.0.1 | MIT */
 var StacklineDeepmergeModule = (() => {
   var __defProp = Object.defineProperty;
   var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

package/dist/index.js

@@ -1,4 +1,4 @@
-/*! @stackline/deepmerge v1.0.0 | MIT */
+/*! @stackline/deepmerge v1.0.1 | MIT */
 
 // src/index.js
 var objectToString = Object.prototype.toString;

package/dist/index.min.js

@@ -1,4 +1,4 @@
-/*! @stackline/deepmerge v1.0.0 | MIT */
+/*! @stackline/deepmerge v1.0.1 | MIT */
 var StacklineDeepmergeModule=(()=>{var h=Object.defineProperty;var C=Object.getOwnPropertyDescriptor;var W=Object.getOwnPropertyNames;var L=Object.prototype.hasOwnProperty;var N=(e,n)=>{for(var r in n)h(e,r,{get:n[r],enumerable:!0})},V=(e,n,r,o)=>{if(n&&typeof n=="object"||typeof n=="function")for(let t of W(n))!L.call(e,t)&&t!==r&&h(e,t,{get:()=>n[t],enumerable:!(o=C(n,t))||o.enumerable});return e};var z=e=>V(h({},"__esModule",{value:!0}),e);var ne={};N(ne,{DeepMergeLimitError:()=>p,UnsafeKeyError:()=>a,all:()=>P,deepmerge:()=>y,default:()=>ee,isMergeableObject:()=>M});var G=Object.prototype.toString,F=Object.prototype.hasOwnProperty,k=Object.prototype.propertyIsEnumerable,J=new Set(["__proto__","prototype","constructor"]),Y=typeof Symbol=="function"&&typeof Symbol.for=="function"?Symbol.for("react.element"):60103,a=class extends TypeError{constructor(n,r){let o=$(r.concat(n));super(`Refusing to merge unsafe key ${String(n)} at ${o}`),this.name="UnsafeKeyError",this.code="ERR_DEEPMERGE_UNSAFE_KEY",this.key=n,this.path=o}},p=class extends RangeError{constructor(n,r,o){let t=$(o);super(`Deep merge ${n} limit of ${r} exceeded at ${t}`),this.name="DeepMergeLimitError",this.code="ERR_DEEPMERGE_LIMIT",this.kind=n,this.limit=r,this.path=t}};function M(e){if(!e||typeof e!="object")return!1;let n=G.call(e);return n==="[object Date]"||n==="[object RegExp]"?!1:e.$$typeof!==Y}function $(e){if(e.length===0)return"<root>";let n="<root>";for(let r of e)typeof r=="number"?n+=`[${r}]`:typeof r=="symbol"?n+=`[${String(r)}]`:/^[A-Za-z_$][\w$]*$/.test(r)?n+=`.${r}`:n+=`[${JSON.stringify(r)}]`;return n}function A(e,n,r){return e.concat(n).map(o=>r.cloneUnlessOtherwiseSpecified(o,r))}function O(e,n,r){let o=e===void 0?n:e;if(o===1/0)return o;if(!Number.isSafeInteger(o)||o<0)throw new TypeError(`${r} must be a non-negative safe integer or Infinity`);return o}function I(e){if(e!==void 0&&(e===null||typeof e!="object"))throw new TypeError("options must be an object when provided");let n=e||{},r=n.onUnsafeKey===void 0?"skip":n.onUnsafeKey;if(r!=="skip"&&r!=="throw")throw new TypeError("onUnsafeKey must be either 'skip' or 'throw'");let o={cloneMemo:new WeakMap,pairMemo:new WeakMap,keyCount:0,callbackDepth:0,options:null},t={...n,arrayMerge:n.arrayMerge===void 0?A:n.arrayMerge,isMergeableObject:n.isMergeableObject===void 0?M:n.isMergeableObject,maxDepth:O(n.maxDepth,1e3,"maxDepth"),maxKeys:O(n.maxKeys,1e5,"maxKeys"),onUnsafeKey:r};if(typeof t.arrayMerge!="function")throw new TypeError("arrayMerge must be a function");if(typeof t.isMergeableObject!="function")throw new TypeError("isMergeableObject must be a function");if(t.customMerge!==void 0&&typeof t.customMerge!="function")throw new TypeError("customMerge must be a function");return t.cloneUnlessOtherwiseSpecified=(f,i)=>{if(i&&i!==t){let u=I(i);return l(f,u,0,[])}return l(f,o,o.callbackDepth+1,[])},o.options=t,o}function m(e){return e!==null&&(typeof e=="object"||typeof e=="function")}function U(e,n,r){if(!m(n)||!m(r))return;let o=e.pairMemo.get(n);return o&&o.get(r)}function T(e,n,r,o){if(!m(n)||!m(r))return;let t=e.pairMemo.get(n);t||(t=new WeakMap,e.pairMemo.set(n,t)),t.set(r,o)}function g(e,n,r){m(n)&&e.cloneMemo.set(n,r)}function Z(e,n,r){if(n>e.options.maxDepth)throw new p("depth",e.options.maxDepth,r)}function q(e,n,r){if(e.keyCount+=n,e.keyCount>e.options.maxKeys)throw new p("key",e.options.maxKeys,r)}function x(e){let n=Object.keys(e);return typeof Object.getOwnPropertySymbols!="function"?n:n.concat(Object.getOwnPropertySymbols(Object(e)).filter(r=>k.call(e,r)))}function B(e){return typeof e=="string"&&J.has(e)}function D(e,n,r){if(!B(e))return!1;if(n.options.onUnsafeKey==="throw")throw new a(e,r);return!0}function _(e,n){try{return n in e}catch(r){return!1}}function H(e,n){return _(e,n)&&!(F.call(e,n)&&k.call(e,n))}function K(e,n,r){Object.defineProperty(e,n,{configurable:!0,enumerable:!0,value:r,writable:!0})}function l(e,n,r,o){if(n.options.clone===!1||!n.options.isMergeableObject(e))return e;let t=n.cloneMemo.get(e);return t!==void 0?t:w(Array.isArray(e)?[]:{},e,n,r,o)}function Q(e,n,r,o,t){if(r.options.arrayMerge!==A){let s=r.callbackDepth;r.callbackDepth=o;try{return r.options.arrayMerge(e,n,r.options)}finally{r.callbackDepth=s}}let f=U(r,e,n);if(f!==void 0)return f;let i=[];T(r,e,n,i),g(r,e,i),g(r,n,i);let u=e.concat(n);i.length=u.length;for(let s=0;s<u.length;s+=1)s in u&&(i[s]=l(u[s],r,o+1,t.concat(s)));return i}function X(e,n){if(!n.options.customMerge)return;let r=n.options.customMerge(e,n.options);return typeof r=="function"?r:void 0}function v(e,n,r,o,t){let f=U(r,e,n);if(f!==void 0)return f;let i={};T(r,e,n,i),g(r,e,i),g(r,n,i);let u=r.options.isMergeableObject(e)?x(e):[],s=x(n);q(r,u.length+s.length,t);let E=[],j=new Set;for(let c of s)D(c,r,t)||H(e,c)||(E.push(c),j.add(c));for(let c of u)D(c,r,t)||j.has(c)||K(i,c,l(e[c],r,o+1,t.concat(c)));for(let c of E){let b=n[c],d;if(_(e,c)&&r.options.isMergeableObject(b)){let S=X(c,r);if(S){let R=r.callbackDepth;r.callbackDepth=o;try{d=S(e[c],b,r.options)}finally{r.callbackDepth=R}}else d=w(e[c],b,r,o+1,t.concat(c))}else d=l(b,r,o+1,t.concat(c));K(i,c,d)}return i}function w(e,n,r,o,t){Z(r,o,t);let f=Array.isArray(n),i=Array.isArray(e);return f!==i?l(n,r,o+1,t):f?Q(e,n,r,o,t):v(e,n,r,o,t)}function y(e,n,r){return w(e,n,I(r),0,[])}function P(e,n){if(!Array.isArray(e))throw new Error("first argument should be an array");return e.reduce((r,o)=>y(r,o,n),{})}y.all=P;y.isMergeableObject=M;y.UnsafeKeyError=a;y.DeepMergeLimitError=p;y.deepmerge=y;var ee=y;return z(ne);})();
 (typeof globalThis !== 'undefined' ? globalThis : window).StacklineDeepmerge = StacklineDeepmergeModule.default;
 //# sourceMappingURL=index.min.js.map

package/docs/ADOPTION.md

@@ -0,0 +1,48 @@
+# Adoption Guide
+
+## Choose the direct install when
+
+- the application is new;
+- imports can use the Stackline package name;
+- explicit ownership of the hardened behavior is desirable.
+
+```bash
+npm install @stackline/deepmerge
+```
+
+```js
+import merge from '@stackline/deepmerge';
+```
+
+## Choose the npm alias when
+
+- an application already imports `deepmerge`;
+- a framework or internal package expects the existing package name;
+- the migration should avoid source changes.
+
+```bash
+npm uninstall deepmerge
+npm install deepmerge@npm:@stackline/deepmerge
+```
+
+Existing imports remain unchanged:
+
+```js
+import merge from 'deepmerge';
+```
+
+Commit the changed lockfile and run the application's complete test suite. The
+alias changes package resolution, so source imports do not need to change.
+
+## Security boundary
+
+Use `onUnsafeKey: 'throw'` when an unsafe key should reject an entire request.
+The default `skip` mode ignores `__proto__`, `prototype`, and `constructor` at
+every traversed level. Depth and key budgets remain enabled in both modes.
+
+## Compatibility review
+
+Before migration, review custom `arrayMerge`, `customMerge`, and
+`isMergeableObject` callbacks. The package preserves the documented v4 call
+shape, while cycles, unsafe keys, invalid options, and traversal limits are
+intentionally hardened.

package/docs/ARCHITECTURE.md

@@ -0,0 +1,60 @@
+# Architecture
+
+## Scope
+
+The runtime has one responsibility: merge two JavaScript values without
+mutating either input while enforcing a small set of security invariants.
+
+## Merge state
+
+Each top-level merge creates isolated state containing:
+
+- normalized options;
+- a target/source pair memo for recursive merges;
+- a clone memo for repeated source references;
+- the cumulative enumerable-key count;
+- callback depth for compatibility hooks.
+
+No state is shared between calls.
+
+## Traversal
+
+`mergeInternal` dispatches by array shape:
+
+- array plus array uses the configured array strategy;
+- mismatched array/object shape clones the source;
+- object plus object copies target-only keys and then merges source keys.
+
+Accepted values are written with `Object.defineProperty` as own enumerable data
+properties. This avoids invoking legacy object prototype setters during writes.
+
+## Security invariants
+
+Before reading an enumerable property value, traversal checks:
+
+1. the key is not `__proto__`, `prototype`, or `constructor`;
+2. the target does not expose that property only through an inherited or
+   non-enumerable slot;
+3. configured depth and key budgets have not been exceeded.
+
+Both source and target keys pass the dangerous-key filter. Rejected getters are
+never invoked.
+
+## Cycle handling
+
+Weak maps preserve cycles without retaining merged graphs after the operation.
+The pair memo identifies a repeated target/source recursion. The clone memo
+preserves repeated references when a source value is cloned into the result.
+
+## Distribution
+
+One source module produces:
+
+- `dist/index.js`: ESM;
+- `dist/index.cjs`: callable CommonJS;
+- `dist/index.min.js`: browser global;
+- resolver-specific `.d.ts`, `.d.cts`, and `.d.mts` declarations;
+- source maps for each JavaScript build.
+
+The CommonJS footer assigns the function itself to `module.exports`, preserving
+legacy `require('deepmerge')({...})` usage.

package/docs/BENCHMARKS.md

@@ -0,0 +1,25 @@
+# Benchmark Methodology
+
+The checked-in benchmark compares `@stackline/deepmerge` with
+`deepmerge@4.3.1` in the same Node.js process and with the same nested
+configuration objects.
+
+```bash
+npm ci
+npm run benchmark
+```
+
+Set `BENCHMARK_ITERATIONS` to control the sample size:
+
+```bash
+BENCHMARK_ITERATIONS=500000 npm run benchmark
+```
+
+The benchmark warms both implementations before measurement and reports
+operations per second. It is a regression tool, not a universal performance
+claim. CPU, Node.js version, object shape, callbacks, cycle tracking, and
+security limits materially affect results.
+
+Compatibility and security take priority over winning a synthetic throughput
+number. Report the complete command, Node.js version, CPU, and raw output when
+sharing results.

package/docs/COMPATIBILITY.md

@@ -0,0 +1,72 @@
+# Compatibility
+
+## Behavioral target
+
+The default contract follows documented `deepmerge@4.3.1` behavior:
+
+- inputs are not mutated;
+- plain and custom mergeable objects recurse;
+- arrays concatenate and clone by default;
+- source wins when array/object shapes differ;
+- `clone: false` preserves nested references;
+- custom array and property merge hooks receive compatible options;
+- Date, RegExp, and React element values are atomic by default;
+- own enumerable symbols are copied;
+- `all` merges an array of objects.
+
+The test suite includes documented scenarios and a deterministic corpus of
+5,000 JSON-compatible input pairs compared against `deepmerge@4.3.1`.
+
+## Intentional differences
+
+| Area | `@stackline/deepmerge` behavior |
+| :--- | :--- |
+| Dangerous keys | Always skipped or rejected at every depth |
+| Cycles | Preserved through weak-reference memoization |
+| Resource limits | Depth and key limits enabled by default |
+| Invalid options | Rejected early with controlled errors |
+| Package format | Native ESM, callable CJS, browser build, conditional types |
+| Runtime dependencies | None |
+
+## Module systems
+
+| Consumer | Supported form |
+| :--- | :--- |
+| ESM | Default and named exports |
+| CommonJS | Callable `module.exports` plus static helpers |
+| Bundlers | ESM `module` field and `browser` export condition |
+| Browser script | `globalThis.StacklineDeepmerge` |
+| npm alias | `deepmerge@npm:@stackline/deepmerge` |
+
+## TypeScript
+
+The release test matrix covers:
+
+- 3.9.10;
+- 4.7.4;
+- 4.9.5;
+- 5.9.3;
+- 6.0.3;
+- 7.0.2.
+
+Older resolvers use `dist/index.d.ts`. Modern ESM and CommonJS resolvers use
+`dist/index.d.mts` and `dist/index.d.cts` respectively.
+
+## Runtime
+
+The published JavaScript targets ES2018 and declares Node.js 14.17 or newer.
+The development toolchain requires a newer Node.js release; that does not alter
+the package's runtime floor.
+
+## Migration test
+
+Test the alias in the consuming project without source changes:
+
+```bash
+npm install deepmerge@npm:@stackline/deepmerge
+npm test
+```
+
+If a project relies on undocumented prototype keys, accessor descriptors, or a
+specific cycle failure, treat migration as a behavior change and report the use
+case before production rollout.

package/docs/MARKET_RESEARCH.md

@@ -0,0 +1,110 @@
+# Market Research
+
+Research date: 2026-08-15
+
+## Decision
+
+Build `@stackline/deepmerge`: a secure, zero-dependency, modern-package
+replacement for the established `deepmerge` API.
+
+The goal is not to predict one million monthly downloads. No package can
+guarantee adoption. The goal is to enter a proven, extremely high-volume
+category with a low-friction migration and clear unmet maintenance needs.
+
+## Demand snapshot
+
+The official npm downloads API reported the following for 2026-07-11 through
+2026-08-09:
+
+| Package | Downloads |
+| :--- | ---: |
+| `lodash.merge` | 493,506,292 |
+| `deepmerge` | 353,418,274 |
+| `deep-extend` | 180,360,708 |
+| `defu` | 143,244,968 |
+| `deepmerge-ts` | 64,560,064 |
+| `@fastify/deepmerge` | 13,948,869 |
+| `ts-deepmerge` | 13,902,566 |
+| `merge-deep` | 7,970,115 |
+
+Source: `https://api.npmjs.org/downloads/point/last-month/<package>`.
+
+These values are a dated market snapshot, not implementation constants or
+future promises.
+
+## Maintenance gap
+
+At the research snapshot:
+
+- npm reported `deepmerge@4.3.1`, modified 2023-03-16;
+- the upstream GitHub repository was last pushed 2023-04-21;
+- the repository had 2,816 stars and 59 open issues;
+- open requests covered ESM packaging, default-import interop, TypeScript
+  inference, and cyclic objects.
+
+Sources:
+
+- [deepmerge on npm](https://www.npmjs.com/package/deepmerge)
+- [deepmerge repository](https://github.com/TehShrike/deepmerge)
+- [ESM request 194](https://github.com/TehShrike/deepmerge/issues/194)
+- [Cycle request 207](https://github.com/TehShrike/deepmerge/issues/207)
+- [ESM request 250](https://github.com/TehShrike/deepmerge/issues/250)
+- [Default import issue 255](https://github.com/TehShrike/deepmerge/issues/255)
+- [Type inference issue 271](https://github.com/TehShrike/deepmerge/issues/271)
+
+## Security need
+
+Merge utilities repeatedly appear in prototype-pollution advisories because
+they recursively turn attacker-controlled property names into object writes.
+Modern exploit research also shows that read-side gadgets can make inherited
+pollution dangerous even when a specific merge implementation does not write
+directly to `Object.prototype`.
+
+References:
+
+- [GitHub Security Lab merge-deep advisory](https://securitylab.github.com/advisories/GHSL-2020-160-merge-deep/)
+- [GHSA-9wv6-86v2-598j](https://github.com/advisories/GHSA-9wv6-86v2-598j)
+- [GHSA-wf5p-g6vw-rhxx](https://github.com/advisories/GHSA-wf5p-g6vw-rhxx)
+
+## Product thesis
+
+Adoption depends on reducing migration cost:
+
+1. Preserve the callable default export and documented extension hooks.
+2. Support an npm alias so existing `import merge from 'deepmerge'` calls do
+   not change.
+3. Ship both modern and legacy module shapes with accurate types.
+4. Remove runtime supply-chain exposure by using zero dependencies.
+5. Make unsafe-key behavior and resource limits visible and testable.
+6. Provide a browser playground that demonstrates actual merge behavior.
+
+## Alternatives considered
+
+### General utility collection
+
+Rejected because it increases API surface and supply-chain responsibility
+without a sharper migration story.
+
+### Fork the existing implementation
+
+Rejected for this package. An independent implementation can adopt modern
+architecture and security invariants while behavioral differential tests
+protect compatibility.
+
+### Type-only deep merge
+
+Rejected because the largest need is runtime behavior at trust boundaries.
+
+### New incompatible API
+
+Rejected for 1.0. A new API would discard the strongest distribution path:
+drop-in migration from an established package.
+
+## Success measures
+
+- clean direct and alias installs;
+- no runtime dependencies;
+- no known package export or type-resolution defects;
+- compatibility reports from real consumers;
+- security reports handled through private disclosure;
+- sustained download growth without weakening the contract.

package/docs/RELEASING.md

@@ -0,0 +1,53 @@
+# Releasing
+
+Only maintainers with npm scope access can publish a release.
+
+## Required checks
+
+```bash
+npm ci
+npm test
+npm run test:attw
+npm run benchmark
+npm run audit:dependencies
+npm pack --dry-run
+```
+
+Run the full TypeScript matrix and clean-install smoke test. Verify GitHub CI is
+green on `main` before public npm publication.
+
+## Artifact rule
+
+Build one tarball and identify its SHA-512 digest. Publish that exact file to
+Verdaccio. The trusted GitHub workflow rebuilds from the reviewed commit,
+requires the expected digest as input, and refuses to publish to npm unless the
+bytes are identical.
+
+```bash
+version="$(node -p "require('./package.json').version")"
+mkdir -p "release/$version"
+npm pack --ignore-scripts --pack-destination "release/$version"
+(cd "release/$version" && sha512sum *.tgz > SHA512SUMS)
+```
+
+Do not rebuild between registries. After each publish, install from that
+registry in an empty project and test direct ESM, direct CommonJS, npm alias,
+and TypeScript resolution.
+
+## Release order
+
+1. Update version, changelog, docs, and project memory.
+2. Run all required checks.
+3. Commit and push `main`.
+4. Wait for GitHub checks.
+5. Create the final tarball and digest.
+6. Publish and smoke-test Verdaccio.
+7. Run `publish.yml` with the tarball's SHA-512 hex digest and watch it publish
+   the byte-identical artifact through npm trusted publishing.
+8. Download from public npm, compare SHA-512, and smoke-test.
+9. Push the signed or annotated version tag.
+10. Create the GitHub release.
+11. Deploy and verify public documentation.
+12. Record package metadata and validation evidence in project memory.
+
+Published npm versions are immutable. Never reuse a version number.

package/examples/array-strategy.mjs

@@ -0,0 +1,17 @@
+import assert from 'node:assert/strict';
+
+import merge from '@stackline/deepmerge';
+
+const overwriteArrays = (_target, source) => source;
+const config = merge(
+  { plugins: ['core'], server: { port: 3000 } },
+  { plugins: ['metrics'], server: { secure: true } },
+  { arrayMerge: overwriteArrays }
+);
+
+assert.deepEqual(config, {
+  plugins: ['metrics'],
+  server: { port: 3000, secure: true }
+});
+
+console.log(config);

package/examples/cyclic-graph.mjs

@@ -0,0 +1,14 @@
+import assert from 'node:assert/strict';
+
+import merge from '@stackline/deepmerge';
+
+const shared = { enabled: true };
+const source = { first: shared, second: shared };
+source.self = source;
+
+const result = merge({}, source);
+
+assert.equal(result.first, result.second);
+assert.equal(result.self, result);
+
+console.log({ cyclePreserved: true, sharedReferencePreserved: true });

package/examples/secure-config.mjs

@@ -0,0 +1,22 @@
+import assert from 'node:assert/strict';
+
+import merge from '@stackline/deepmerge';
+
+const defaults = {
+  cache: { enabled: true, ttl: 60 },
+  server: { host: '127.0.0.1', port: 3000 }
+};
+const environment = JSON.parse(`{
+  "server": { "port": 8080 },
+  "constructor": { "prototype": { "isAdmin": true } }
+}`);
+
+const config = merge(defaults, environment);
+
+assert.deepEqual(config, {
+  cache: { enabled: true, ttl: 60 },
+  server: { host: '127.0.0.1', port: 8080 }
+});
+assert.equal(Object.prototype.isAdmin, undefined);
+
+console.log(config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackline/deepmerge",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Secure, immutable, zero-dependency deep merge with a deepmerge-compatible API for ESM, CommonJS, TypeScript, and browsers",
   "keywords": [
     "deepmerge",
@@ -59,6 +59,8 @@
   },
   "files": [
     "dist",
+    "docs",
+    "examples",
     "CHANGELOG.md",
     "CONTRIBUTING.md",
     "LICENSE",
@@ -73,10 +75,11 @@
     "clean": "node scripts/clean.mjs",
     "build": "node scripts/build.mjs",
     "lint": "eslint . && node scripts/check-markdown.mjs",
-    "test": "npm run build && npm run lint && npm run test:coverage && npm run test:types && npm run test:package && npm run test:install && npm run test:docs",
+    "test": "npm run build && npm run lint && npm run test:coverage && npm run test:types && npm run test:examples && npm run test:package && npm run test:install && npm run test:docs",
     "test:unit": "node --test --test-reporter=spec test/*.test.mjs",
     "test:coverage": "c8 --all --src src --check-coverage --lines 100 --functions 100 --statements 100 --branches 95 node --test test/core.test.mjs test/cycles-limits.test.mjs test/security.test.mjs test/compatibility.test.mjs",
     "test:types": "node scripts/test-types.mjs",
+    "test:examples": "node examples/secure-config.mjs && node examples/array-strategy.mjs && node examples/cyclic-graph.mjs",
     "test:package": "node --test test/package.test.mjs && node scripts/check-dist.mjs && publint",
     "test:install": "node scripts/smoke-install.mjs",
     "test:docs": "npm run docs:build && node scripts/check-docs.mjs",