Address the latest Copilot review on PR #8644: the shallow-clone via
{...inputConfig} silently changes behaviour for non-plain inputs that
were never expected — strings spread to per-character objects, null /
undefined spread to {}, neither hashing the same as before.
In-tree call sites all pass plain objects (or class instances without
toJSON, which behave identically under JSON.stringify), so nothing is
broken today; this is purely defence against future drift:
- Tighten the parameter type from `any` to `Record<string, any>` so a
TypeScript caller passing a string or null fails at compile time.
- Add a runtime assert for the same cases (and arrays, which spread
weirdly even though the type would allow them).
- Tests cover string/null/undefined/number/array rejection plus a new
test that confirms the input object is not mutated by the call (the
pre-refactor implementation mutated in place; my refactor explicitly
shallow-clones to avoid that).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
86f909ea3e