[efegokdemir]

Summary

Add bounded, fixed-seed property tests for security-sensitive input handling. Production code is unchanged.

Motivation

Exercise malformed inputs and deterministic matching boundaries through the existing test suite.

Changes

Add properties for stable GraphQL fragment paths, fail-closed unresolved and cyclic fragments, and bounded, redacted Shopify TOML errors. Pin fast-check@4.10.2 as a development dependency and update the lockfile. The existing test workflow discovers the new tests.

Tests performed

• npm test -- --test-reporter=dot passed on Node 22.23.4 and 24.22.1 (105 tests).
• On Node 24.22.1, npm run lint, npm run coverage, npm audit --audit-level=high, npm run package:smoke, npm run action:check and npm pack --dry-run passed.

Compatibility

Tested locally on Node 22 and 24. No runtime behaviour or package version changed.

Security and privacy

Generated values are synthetic; no credentials, merchant or customer data, private source, production secrets, telemetry, Shopify network calls, or unsafe shell interpolation were added.

Shopify source/evidence

N/A. These test changes do not alter Shopify-specific behaviour.

Release impact

No consumer-facing change or npm release is required.

Checklist

• The change is focused and the docs/examples match the implementation.
• Relevant regression tests and checks are recorded above.
• Generated distributions are up to date where required.
• No sensitive or third-party material was added without permission/licence review.