fix: strengthen isOutputPathObject type guard validation

The type guard now properly validates:
- base must be a non-empty string (rejects null, numbers, empty string)
- browser, if present, must be a string (rejects null, numbers)
- value must be an object (rejects arrays)

Previously { base: null } or { base: 123 } would pass validation
and crash at runtime with path.join() TypeError.

Author: JohannesHoppe

src/deploy/actions.spec.ts

@@ -132,6 +132,50 @@ describe('Deploy Angular apps', () => {
       ).rejects.toThrow(expectedErrorMessage);
     });
 
+    it('throws if outputPath object has null base', async () => {
+      context.getTargetOptions = (_: Target) =>
+        Promise.resolve({
+          outputPath: { base: null }
+        } as JsonObject);
+
+      await expect(
+        deploy(mockEngine, context, BUILD_TARGET, { noBuild: false })
+      ).rejects.toThrow(/Unsupported outputPath configuration/);
+    });
+
+    it('throws if outputPath object has empty string base', async () => {
+      context.getTargetOptions = (_: Target) =>
+        Promise.resolve({
+          outputPath: { base: '' }
+        } as JsonObject);
+
+      await expect(
+        deploy(mockEngine, context, BUILD_TARGET, { noBuild: false })
+      ).rejects.toThrow(/Unsupported outputPath configuration/);
+    });
+
+    it('throws if outputPath object has numeric base', async () => {
+      context.getTargetOptions = (_: Target) =>
+        Promise.resolve({
+          outputPath: { base: 123 }
+        } as JsonObject);
+
+      await expect(
+        deploy(mockEngine, context, BUILD_TARGET, { noBuild: false })
+      ).rejects.toThrow(/Unsupported outputPath configuration/);
+    });
+
+    it('throws if outputPath object has null browser', async () => {
+      context.getTargetOptions = (_: Target) =>
+        Promise.resolve({
+          outputPath: { base: 'dist/app', browser: null }
+        } as JsonObject);
+
+      await expect(
+        deploy(mockEngine, context, BUILD_TARGET, { noBuild: false })
+      ).rejects.toThrow(/Unsupported outputPath configuration/);
+    });
+
     it('uses correct dir when outputPath is object with base and browser (OP1)', async () => {
       let capturedDir: string | null = null;
 

src/interfaces.ts

@@ -11,10 +11,31 @@ export interface AngularOutputPathObject {
 export type AngularOutputPath = string | AngularOutputPathObject;
 
 /**
- * Type guard to check if outputPath is an object with base/browser properties
+ * Type guard to check if outputPath is a valid object with base/browser properties.
+ *
+ * Validates:
+ * - value is an object (not null, not array)
+ * - base property exists and is a non-empty string
+ * - browser property, if present, is a string (can be empty for Angular 19+ SPA mode)
  */
 export function isOutputPathObject(value: unknown): value is AngularOutputPathObject {
-  return !!value && typeof value === 'object' && 'base' in value;
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return false;
+  }
+
+  const obj = value as Record<string, unknown>;
+
+  // base must be a non-empty string
+  if (typeof obj.base !== 'string' || obj.base === '') {
+    return false;
+  }
+
+  // browser, if present, must be a string (empty string is valid for SPA mode)
+  if ('browser' in obj && typeof obj.browser !== 'string') {
+    return false;
+  }
+
+  return true;
 }
 
 /**