[efegokdemir]

Summary

Add bounded, fixed-seed property tests for security-sensitive input handling. Production code is unchanged.

Motivation

Exercise malformed inputs and deterministic matching boundaries through the existing test suite.

Changes

Add properties for webhook grouping and ordering, redaction, and GraphQL formatting invariance. Pin fast-check@4.10.2 as a development dependency and update the lockfile. The existing test workflow discovers the new tests.

Tests performed

• npm test -- --test-reporter=dot passed on Node 22.23.4 and 24.22.1 (122 tests).
• On Node 24.22.1, npm run lint, npm run coverage, npm audit --audit-level=high, npm run package:smoke, npm run action:check and npm pack --dry-run passed.

Compatibility

Tested locally on Node 22 and 24. No runtime behaviour or package version changed.

Security and privacy

Generated values are synthetic; redaction and offline review remain covered. No credentials, merchant or customer data, private source, production secrets, telemetry, Shopify network calls, or unsafe shell interpolation were added.

Shopify source/evidence

N/A. These test changes do not alter Shopify-specific behaviour.

Release impact

No consumer-facing change or npm release is required.

Checklist

• The change is focused and the docs/examples match the implementation.
• Relevant regression tests and checks are recorded above.
• Generated distributions are up to date where required.
• No sensitive or third-party material was added without permission/licence review.