@scenarist/core 0.1.2 → 0.1.3

package/dist/adapters/in-memory-registry.d.ts

@@ -1,5 +1,5 @@
-import type { ScenarioRegistry } from '../ports/index.js';
-import type { ScenaristScenario } from '../types/index.js';
+import type { ScenarioRegistry } from "../ports/index.js";
+import type { ScenaristScenario } from "../types/index.js";
 /**
  * In-memory implementation of ScenarioRegistry using a Map.
  * Suitable for single-process testing and development.

package/dist/adapters/in-memory-sequence-tracker.d.ts

@@ -1,4 +1,4 @@
-import type { SequenceTracker, SequencePosition } from '../ports/driven/sequence-tracker.js';
+import type { SequenceTracker, SequencePosition } from "../ports/driven/sequence-tracker.js";
 /**
  * In-memory implementation of SequenceTracker.
  *
@@ -17,7 +17,7 @@ export declare class InMemorySequenceTracker implements SequenceTracker {
      */
     private getKey;
     getPosition(testId: string, scenarioId: string, mockIndex: number): SequencePosition;
-    advance(testId: string, scenarioId: string, mockIndex: number, totalResponses: number, repeatMode: 'last' | 'cycle' | 'none'): void;
+    advance(testId: string, scenarioId: string, mockIndex: number, totalResponses: number, repeatMode: "last" | "cycle" | "none"): void;
     reset(testId: string): void;
 }
 /**

package/dist/adapters/in-memory-sequence-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"in-memory-sequence-tracker.d.ts","sourceRoot":"","sources":["../../src/adapters/in-memory-sequence-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EACjB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;;IAM1D;;;OAGG;IACH,OAAO,CAAC,MAAM;IAId,WAAW,CACT,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,gBAAgB;IAYnB,OAAO,CACL,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GACpC,IAAI;IA0CP,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAM5B;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,QAAO,eAEhD,CAAC"}
+{"version":3,"file":"in-memory-sequence-tracker.d.ts","sourceRoot":"","sources":["../../src/adapters/in-memory-sequence-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EACjB,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;;IAM1D;;;OAGG;IACH,OAAO,CAAC,MAAM;IAQd,WAAW,CACT,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,gBAAgB;IAYnB,OAAO,CACL,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GACpC,IAAI;IA0CP,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAM5B;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,QAAO,eAEhD,CAAC"}

package/dist/adapters/in-memory-sequence-tracker.js

@@ -35,21 +35,21 @@ export class InMemorySequenceTracker {
         // Handle different repeat modes
         if (nextPosition >= totalResponses) {
             switch (repeatMode) {
-                case 'last':
+                case "last":
                     // Stay at last position (don't increment beyond last)
                     this.positions.set(key, {
                         position: totalResponses - 1,
                         exhausted: false,
                     });
                     break;
-                case 'cycle':
+                case "cycle":
                     // Wrap back to first position
                     this.positions.set(key, {
                         position: 0,
                         exhausted: false,
                     });
                     break;
-                case 'none':
+                case "none":
                     // Mark as exhausted
                     this.positions.set(key, {
                         position: totalResponses,
@@ -69,8 +69,8 @@ export class InMemorySequenceTracker {
     reset(testId) {
         const prefix = `${testId}:`;
         Array.from(this.positions.keys())
-            .filter(key => key.startsWith(prefix))
-            .forEach(key => this.positions.delete(key));
+            .filter((key) => key.startsWith(prefix))
+            .forEach((key) => this.positions.delete(key));
     }
 }
 /**

package/dist/adapters/in-memory-state-manager.d.ts

@@ -1,4 +1,4 @@
-import type { StateManager } from '../ports/driven/state-manager.js';
+import type { StateManager } from "../ports/driven/state-manager.js";
 /**
  * In-memory implementation of StateManager port.
  * Fast, single-process state storage for stateful mocks.

package/dist/adapters/in-memory-state-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"in-memory-state-manager.d.ts","sourceRoot":"","sources":["../../src/adapters/in-memory-state-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE;;;;;;GAMG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IAEtE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAUzC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAyBtD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI/C,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI3B,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,cAAc;CAmBvB;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAO,YAE7C,CAAC"}
+{"version":3,"file":"in-memory-state-manager.d.ts","sourceRoot":"","sources":["../../src/adapters/in-memory-state-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAMrE;;;;;;GAMG;AACH,qBAAa,oBAAqB,YAAW,YAAY;IACvD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IAEtE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO;IAUzC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAyBtD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI/C,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI3B,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,cAAc;IAwCtB,OAAO,CAAC,cAAc;CA4BvB;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAO,YAE7C,CAAC"}

package/dist/adapters/in-memory-state-manager.js

@@ -1,3 +1,5 @@
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+const isDangerousKey = (key) => DANGEROUS_KEYS.has(key);
 /**
  * In-memory implementation of StateManager port.
  * Fast, single-process state storage for stateful mocks.
@@ -12,20 +14,20 @@ export class InMemoryStateManager {
         if (!testState) {
             return undefined;
         }
-        const path = key.split('.');
+        const path = key.split(".");
         return this.getNestedValue(testState, path);
     }
     set(testId, key, value) {
         const testState = this.getOrCreateTestState(testId);
         // Guard: Normal set (no array syntax)
-        if (!key.endsWith('[]')) {
-            const path = key.split('.');
+        if (!key.endsWith("[]")) {
+            const path = key.split(".");
             this.setNestedValue(testState, path, value);
             return;
         }
         // Array append syntax
         const actualKey = key.slice(0, -2);
-        const path = actualKey.split('.');
+        const path = actualKey.split(".");
         const currentValue = this.get(testId, actualKey);
         // Guard: If current value is already an array, append immutably
         if (Array.isArray(currentValue)) {
@@ -52,32 +54,50 @@ export class InMemoryStateManager {
     setNestedValue(obj, path, value) {
         const key = path[0];
         // Guard: Prevent prototype pollution attacks
-        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+        if (isDangerousKey(key)) {
             return;
         }
         if (path.length === 1) {
-            obj[key] = value;
+            Object.defineProperty(obj, key, {
+                value,
+                writable: true,
+                enumerable: true,
+                configurable: true,
+            });
             return;
         }
-        if (typeof obj[key] !== 'object' || obj[key] === null || Array.isArray(obj[key])) {
-            obj[key] = {};
+        const existingValue = Object.hasOwn(obj, key) ? obj[key] : undefined;
+        if (typeof existingValue !== "object" ||
+            existingValue === null ||
+            Array.isArray(existingValue)) {
+            Object.defineProperty(obj, key, {
+                value: {},
+                writable: true,
+                enumerable: true,
+                configurable: true,
+            });
         }
-        this.setNestedValue(obj[key], path.slice(1), value);
+        const nested = obj[key];
+        this.setNestedValue(nested, path.slice(1), value);
     }
     getNestedValue(obj, path) {
         const key = path[0];
         // Guard: Prevent prototype pollution attacks
-        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+        if (isDangerousKey(key)) {
+            return undefined;
+        }
+        // Guard: Only access own properties, not inherited ones
+        if (!Object.hasOwn(obj, key)) {
             return undefined;
         }
+        const value = obj[key];
         if (path.length === 1) {
-            return obj[key];
+            return value;
         }
-        const nested = obj[key];
-        if (typeof nested !== 'object' || nested === null || Array.isArray(nested)) {
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
             return undefined;
         }
-        return this.getNestedValue(nested, path.slice(1));
+        return this.getNestedValue(value, path.slice(1));
     }
 }
 /**

package/dist/adapters/in-memory-store.d.ts

@@ -1,5 +1,5 @@
-import type { ScenarioStore } from '../ports/index.js';
-import type { ActiveScenario } from '../types/index.js';
+import type { ScenarioStore } from "../ports/index.js";
+import type { ActiveScenario } from "../types/index.js";
 /**
  * In-memory implementation of ScenarioStore using a Map.
  * Suitable for single-process testing.

package/dist/adapters/index.d.ts

@@ -1,5 +1,5 @@
-export { InMemoryScenarioRegistry } from './in-memory-registry.js';
-export { InMemoryScenarioStore } from './in-memory-store.js';
-export { InMemorySequenceTracker, createInMemorySequenceTracker } from './in-memory-sequence-tracker.js';
-export { InMemoryStateManager, createInMemoryStateManager } from './in-memory-state-manager.js';
+export { InMemoryScenarioRegistry } from "./in-memory-registry.js";
+export { InMemoryScenarioStore } from "./in-memory-store.js";
+export { InMemorySequenceTracker, createInMemorySequenceTracker, } from "./in-memory-sequence-tracker.js";
+export { InMemoryStateManager, createInMemoryStateManager, } from "./in-memory-state-manager.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AACzG,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC"}

package/dist/adapters/index.js

@@ -1,4 +1,4 @@
-export { InMemoryScenarioRegistry } from './in-memory-registry.js';
-export { InMemoryScenarioStore } from './in-memory-store.js';
-export { InMemorySequenceTracker, createInMemorySequenceTracker } from './in-memory-sequence-tracker.js';
-export { InMemoryStateManager, createInMemoryStateManager } from './in-memory-state-manager.js';
+export { InMemoryScenarioRegistry } from "./in-memory-registry.js";
+export { InMemoryScenarioStore } from "./in-memory-store.js";
+export { InMemorySequenceTracker, createInMemorySequenceTracker, } from "./in-memory-sequence-tracker.js";
+export { InMemoryStateManager, createInMemoryStateManager, } from "./in-memory-state-manager.js";

package/dist/constants/headers.js

@@ -6,4 +6,4 @@
  *
  * This is a fixed constant - not configurable by users.
  */
-export const SCENARIST_TEST_ID_HEADER = 'x-scenarist-test-id';
+export const SCENARIST_TEST_ID_HEADER = "x-scenarist-test-id";

package/dist/constants/index.d.ts

@@ -1,2 +1,2 @@
-export { SCENARIST_TEST_ID_HEADER } from './headers.js';
+export { SCENARIST_TEST_ID_HEADER } from "./headers.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/constants/index.js

@@ -1 +1 @@
-export { SCENARIST_TEST_ID_HEADER } from './headers.js';
+export { SCENARIST_TEST_ID_HEADER } from "./headers.js";

package/dist/contracts/framework-adapter.d.ts

@@ -1,6 +1,8 @@
-import type { ScenaristScenario, ActiveScenario, ScenaristResult, ScenaristConfigInput, ScenaristConfig, ScenaristScenarios, ScenarioIds } from '../types/index.js';
-import type { ScenarioRegistry } from '../ports/driven/scenario-registry.js';
-import type { ScenarioStore } from '../ports/driven/scenario-store.js';
+import type { ScenaristScenario, ActiveScenario, ScenaristResult, ScenaristConfigInput, ScenaristConfig, ScenaristScenarios, ScenarioIds } from "../types/index.js";
+import type { ScenarioRegistry } from "../ports/driven/scenario-registry.js";
+import type { ScenarioStore } from "../ports/driven/scenario-store.js";
+import type { StateManager } from "../ports/driven/state-manager.js";
+import type { SequenceTracker } from "../ports/driven/sequence-tracker.js";
 /**
  * Base configuration options that all framework adapters must support.
  *
@@ -35,6 +37,18 @@ export type BaseAdapterOptions<T extends ScenaristScenarios = ScenaristScenarios
      * If not provided, InMemoryScenarioStore will be used.
      */
     readonly store?: ScenarioStore;
+    /**
+     * Custom state manager implementation.
+     *
+     * If not provided, an in-memory state manager will be used.
+     */
+    readonly stateManager?: StateManager;
+    /**
+     * Custom sequence tracker implementation.
+     *
+     * If not provided, an in-memory sequence tracker will be used.
+     */
+    readonly sequenceTracker?: SequenceTracker;
 };
 /**
  * The contract that all Scenarist adapters must satisfy.

package/dist/contracts/framework-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework-adapter.d.ts","sourceRoot":"","sources":["../../src/contracts/framework-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,kBAAkB,CAAC,CAAC,SAAS,kBAAkB,GAAG,kBAAkB,IAC9E,oBAAoB,CAAC,CAAC,CAAC,GAAG;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,CAC1B,WAAW,GAAG,OAAO,EACrB,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,IACxD;IACF;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAEjC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IAEjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,CACvB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,KAChC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,CAAC;IAE3E;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,KAChC,iBAAiB,GAAG,SAAS,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAE/D;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC,CAAC"}
+{"version":3,"file":"framework-adapter.d.ts","sourceRoot":"","sources":["../../src/contracts/framework-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,WAAW,EACZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,kBAAkB,CAC5B,CAAC,SAAS,kBAAkB,GAAG,kBAAkB,IAC/C,oBAAoB,CAAC,CAAC,CAAC,GAAG;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAE/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;CAC5C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,CAC1B,WAAW,GAAG,OAAO,EACrB,UAAU,SAAS,kBAAkB,GAAG,kBAAkB,IACxD;IACF;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAEjC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IAEjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,CACvB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,KAChC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,CAAC;IAE3E;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,CACxB,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,KAChC,iBAAiB,GAAG,SAAS,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAE/D;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAEjD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC,CAAC"}

package/dist/contracts/index.d.ts

@@ -1,2 +1,2 @@
-export type { ScenaristAdapter, BaseAdapterOptions, } from './framework-adapter.js';
+export type { ScenaristAdapter, BaseAdapterOptions, } from "./framework-adapter.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/domain/config-builder.d.ts

@@ -1,4 +1,4 @@
-import type { ScenaristConfig, ScenaristConfigInput, ScenaristScenarios } from '../types/index.js';
+import type { ScenaristConfig, ScenaristConfigInput, ScenaristScenarios } from "../types/index.js";
 /**
  * Build a complete config from partial user input.
  * Applies sensible defaults for missing values.

package/dist/domain/config-builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-builder.d.ts","sourceRoot":"","sources":["../../src/domain/config-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGnG;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,kBAAkB,EACtD,OAAO,oBAAoB,CAAC,CAAC,CAAC,KAC7B,eAaF,CAAC"}
+{"version":3,"file":"config-builder.d.ts","sourceRoot":"","sources":["../../src/domain/config-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAG3B;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,kBAAkB,EACtD,OAAO,oBAAoB,CAAC,CAAC,CAAC,KAC7B,eAaF,CAAC"}

package/dist/domain/config-builder.js

@@ -1,4 +1,4 @@
-import { ScenariosObjectSchema } from '../schemas/index.js';
+import { ScenariosObjectSchema } from "../schemas/index.js";
 /**
  * Build a complete config from partial user input.
  * Applies sensible defaults for missing values.
@@ -12,9 +12,9 @@ export const buildConfig = (input) => {
         enabled: input.enabled,
         strictMode: input.strictMode ?? false,
         endpoints: {
-            setScenario: input.endpoints?.setScenario ?? '/__scenario__',
-            getScenario: input.endpoints?.getScenario ?? '/__scenario__',
+            setScenario: input.endpoints?.setScenario ?? "/__scenario__",
+            getScenario: input.endpoints?.getScenario ?? "/__scenario__",
         },
-        defaultTestId: input.defaultTestId ?? 'default-test',
+        defaultTestId: input.defaultTestId ?? "default-test",
     };
 };

package/dist/domain/index.d.ts

@@ -1,5 +1,5 @@
-export { createScenarioManager } from './scenario-manager.js';
-export { buildConfig } from './config-builder.js';
-export { createResponseSelector } from './response-selector.js';
-export { matchesRegex } from './regex-matching.js';
+export { createScenarioManager } from "./scenario-manager.js";
+export { buildConfig } from "./config-builder.js";
+export { createResponseSelector } from "./response-selector.js";
+export { matchesRegex } from "./regex-matching.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/domain/index.js

@@ -1,4 +1,4 @@
-export { createScenarioManager } from './scenario-manager.js';
-export { buildConfig } from './config-builder.js';
-export { createResponseSelector } from './response-selector.js';
-export { matchesRegex } from './regex-matching.js';
+export { createScenarioManager } from "./scenario-manager.js";
+export { buildConfig } from "./config-builder.js";
+export { createResponseSelector } from "./response-selector.js";
+export { matchesRegex } from "./regex-matching.js";

package/dist/domain/path-extraction.d.ts

@@ -1,4 +1,4 @@
-import type { HttpRequestContext } from '../types/scenario.js';
+import type { HttpRequestContext } from "../types/scenario.js";
 /**
  * Extracts a value from HttpRequestContext based on a path expression.
  *

package/dist/domain/path-extraction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-extraction.d.ts","sourceRoot":"","sources":["../../src/domain/path-extraction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,GAAI,SAAS,kBAAkB,EAAE,MAAM,MAAM,KAAG,OA+B3E,CAAC"}
+{"version":3,"file":"path-extraction.d.ts","sourceRoot":"","sources":["../../src/domain/path-extraction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAM/D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,GAC1B,SAAS,kBAAkB,EAC3B,MAAM,MAAM,KACX,OAyBF,CAAC"}

package/dist/domain/path-extraction.js

@@ -1,3 +1,5 @@
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+const isDangerousKey = (key) => DANGEROUS_KEYS.has(key);
 /**
  * Extracts a value from HttpRequestContext based on a path expression.
  *
@@ -13,29 +15,34 @@
  * @returns Extracted value, or undefined if path not found
  */
 export const extractFromPath = (context, path) => {
-    const segments = path.split('.');
+    const segments = path.split(".");
     // Guard: Need at least 2 segments (prefix.field)
     if (segments.length < 2) {
         return undefined;
     }
     const prefix = segments[0];
     // Guard: Must be valid prefix
-    if (prefix !== 'body' && prefix !== 'headers' && prefix !== 'query') {
+    if (prefix !== "body" && prefix !== "headers" && prefix !== "query") {
         return undefined;
     }
     const remainingPath = segments.slice(1);
-    const sourceMap = {
-        body: context.body,
-        headers: context.headers,
-        query: context.query,
-    };
-    const source = sourceMap[prefix];
+    const source = getSourceForPrefix(context, prefix);
     // Guard: Source must exist
     if (source === undefined || source === null) {
         return undefined;
     }
     return traversePath(source, remainingPath);
 };
+const getSourceForPrefix = (context, prefix) => {
+    switch (prefix) {
+        case "body":
+            return context.body;
+        case "headers":
+            return context.headers;
+        case "query":
+            return context.query;
+    }
+};
 /**
  * Traverses a nested object path.
  *
@@ -49,10 +56,18 @@ const traversePath = (obj, path) => {
         return obj;
     }
     // Guard: Can only traverse objects
-    if (typeof obj !== 'object' || obj === null || Array.isArray(obj)) {
+    if (typeof obj !== "object" || obj === null || Array.isArray(obj)) {
         return undefined;
     }
     const key = path[0];
+    // Guard: Prevent prototype pollution attacks
+    if (isDangerousKey(key)) {
+        return undefined;
+    }
+    // Guard: Only access own properties, not inherited ones
+    if (!Object.hasOwn(obj, key)) {
+        return undefined;
+    }
     const record = obj;
     const value = record[key];
     // Recursively traverse remaining path

package/dist/domain/regex-matching.d.ts

@@ -1,4 +1,4 @@
-import type { SerializedRegex } from '../schemas/match-criteria.js';
+import type { SerializedRegex } from "../schemas/match-criteria.js";
 /**
  * Match a value against a regex pattern.
  *

package/dist/domain/regex-matching.js

@@ -21,7 +21,7 @@ export const matchesRegex = (value, pattern) => {
         return regex.test(value);
     }
     catch (error) {
-        console.error('Regex matching error:', error);
+        console.error("Regex matching error:", error);
         return false;
     }
 };

package/dist/domain/response-selector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-selector.d.ts","sourceRoot":"","sources":["../../src/domain/response-selector.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAazF;;GAEG;AACH,KAAK,6BAA6B,GAAG;IACnC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GACjC,UAAS,6BAAkC,KAC1C,gBAwHF,CAAC"}
+{"version":3,"file":"response-selector.d.ts","sourceRoot":"","sources":["../../src/domain/response-selector.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,YAAY,EACb,MAAM,mBAAmB,CAAC;AAa3B;;GAEG;AACH,KAAK,6BAA6B,GAAG;IACnC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,GACjC,UAAS,6BAAkC,KAC1C,gBAiIF,CAAC"}

package/dist/domain/response-selector.js

@@ -41,7 +41,8 @@ export const createResponseSelector = (options = {}) => {
                     if (matchesCriteria(context, mock.match)) {
                         // Match criteria always have higher priority than fallbacks
                         // Base specificity ensures even 1 field beats any fallback
-                        const specificity = SPECIFICITY_RANGES.MATCH_CRITERIA_BASE + calculateSpecificity(mock.match);
+                        const specificity = SPECIFICITY_RANGES.MATCH_CRITERIA_BASE +
+                            calculateSpecificity(mock.match);
                         // Keep this mock if it's more specific than current best
                         // (or if no best match yet)
                         if (!bestMatch || specificity > bestMatch.specificity) {
@@ -61,7 +62,11 @@ export const createResponseSelector = (options = {}) => {
                     // For equal specificity fallbacks, last wins
                     // This allows active scenario mocks to override default mocks
                     // Applies to both simple fallbacks (0) and sequence fallbacks (1)
-                    bestMatch = { mockWithParams, mockIndex, specificity: fallbackSpecificity };
+                    bestMatch = {
+                        mockWithParams,
+                        mockIndex,
+                        specificity: fallbackSpecificity,
+                    };
                 }
             }
             // Return the best matching mock
@@ -126,7 +131,7 @@ const selectResponseFromMock = (testId, scenarioId, mockIndex, mock, sequenceTra
         // so position should always be valid here
         const response = mock.sequence.responses[position];
         // Advance position for next call
-        const repeatMode = mock.sequence.repeat || 'last';
+        const repeatMode = mock.sequence.repeat || "last";
         sequenceTracker.advance(testId, scenarioId, mockIndex, mock.sequence.responses.length, repeatMode);
         return response;
     }
@@ -216,7 +221,7 @@ const matchesBody = (requestBody, criteriaBody) => {
     for (const [key, criteriaValue] of Object.entries(criteriaBody)) {
         const requestValue = body[key];
         // Convert to string for matching (type coercion like headers/query)
-        const stringValue = requestValue == null ? '' : String(requestValue);
+        const stringValue = requestValue == null ? "" : String(requestValue);
         if (!matchesValue(stringValue, criteriaValue)) {
             return false;
         }
@@ -272,7 +277,7 @@ const matchesValue = (requestValue, criteriaValue) => {
         return requestValue === String(criteriaValue);
     }
     if (criteriaValue == null) {
-        return requestValue === '';
+        return requestValue === "";
     }
     const strategyValue = criteriaValue;
     if (strategyValue.equals !== undefined) {

package/dist/domain/scenario-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scenario-manager.d.ts","sourceRoot":"","sources":["../../src/domain/scenario-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACb,MAAM,mBAAmB,CAAC;AA6B3B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GAAI,qDAKnC;IACD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,aAAa,CAAC;IACrB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,KAAG,eAgFH,CAAC"}
+{"version":3,"file":"scenario-manager.d.ts","sourceRoot":"","sources":["../../src/domain/scenario-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,YAAY,EACb,MAAM,mBAAmB,CAAC;AAkC3B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GAAI,qDAKnC;IACD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,aAAa,CAAC;IACrB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,KAAG,eAgFH,CAAC"}

package/dist/domain/scenario-manager.js

@@ -37,9 +37,9 @@ export const createScenarioManager = ({ registry, store, stateManager, sequenceT
             // Validate scenario definition at trust boundary
             const validationResult = ScenaristScenarioSchema.safeParse(definition);
             if (!validationResult.success) {
-                const errorMessages = validationResult.error.issues.map((err) => `${err.path.join('.')}: ${err.message}`);
-                const scenarioId = definition?.id || '<unknown>';
-                throw new ScenarioValidationError(`Invalid scenario definition for '${scenarioId}': ${errorMessages.join(', ')}`, errorMessages);
+                const errorMessages = validationResult.error.issues.map((err) => `${err.path.join(".")}: ${err.message}`);
+                const scenarioId = definition?.id || "<unknown>";
+                throw new ScenarioValidationError(`Invalid scenario definition for '${scenarioId}': ${errorMessages.join(", ")}`, errorMessages);
             }
             const existing = registry.get(definition.id);
             // Allow re-registering the exact same scenario object (idempotent)

package/dist/domain/template-replacement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-replacement.d.ts","sourceRoot":"","sources":["../../src/domain/template-replacement.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,OAAO,EAAE,cAAc,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,OAwDtF,CAAC"}
+{"version":3,"file":"template-replacement.d.ts","sourceRoot":"","sources":["../../src/domain/template-replacement.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,OAAO,EACd,cAAc,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KACpC,OA8DF,CAAC"}

package/dist/domain/template-replacement.js

@@ -10,11 +10,11 @@
 export const applyTemplates = (value, templateData) => {
     // Backward compatibility: If templateData doesn't have 'state' or 'params' keys,
     // treat it as a flat state object and wrap it
-    const normalizedData = (templateData.state !== undefined || templateData.params !== undefined)
+    const normalizedData = templateData.state !== undefined || templateData.params !== undefined
         ? templateData
         : { state: templateData, params: {} };
     // Guard: Handle strings (base case)
-    if (typeof value === 'string') {
+    if (typeof value === "string") {
         // Check if entire string is a single pure template (no surrounding text)
         // Supports both {{state.key}} and {{params.key}}
         // Using {1,256} limit to prevent ReDoS attacks with malicious input
@@ -46,7 +46,7 @@ export const applyTemplates = (value, templateData) => {
         return value.map((item) => applyTemplates(item, normalizedData));
     }
     // Guard: Handle objects recursively
-    if (typeof value === 'object' && value !== null) {
+    if (typeof value === "object" && value !== null) {
         const result = {};
         for (const [key, val] of Object.entries(value)) {
             result[key] = applyTemplates(val, normalizedData);
@@ -69,19 +69,19 @@ const resolveTemplatePath = (templateData, prefix, path) => {
     // Get the root object (state or params)
     const root = templateData[prefix];
     // Guard: Prefix doesn't exist (e.g., no params provided)
-    if (root === undefined || typeof root !== 'object' || root === null) {
+    if (root === undefined || typeof root !== "object" || root === null) {
         return undefined;
     }
     // Resolve nested path within root object
-    const segments = path.split('.');
+    const segments = path.split(".");
     let current = root;
     for (const segment of segments) {
         // Guard: Can't traverse non-objects
-        if (typeof current !== 'object' || current === null) {
+        if (typeof current !== "object" || current === null) {
             return undefined;
         }
         // Handle arrays with .length property
-        if (Array.isArray(current) && segment === 'length') {
+        if (Array.isArray(current) && segment === "length") {
             return current.length;
         }
         // Traverse object

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-export type * from './types/index.js';
-export * from './schemas/index.js';
-export * from './constants/index.js';
-export type * from './ports/index.js';
-export type * from './contracts/index.js';
-export * from './domain/index.js';
-export * from './adapters/index.js';
+export type * from "./types/index.js";
+export * from "./schemas/index.js";
+export * from "./constants/index.js";
+export type * from "./ports/index.js";
+export type * from "./contracts/index.js";
+export * from "./domain/index.js";
+export * from "./adapters/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,8 +1,8 @@
 // Schemas (runtime validation)
-export * from './schemas/index.js';
+export * from "./schemas/index.js";
 // Constants
-export * from './constants/index.js';
+export * from "./constants/index.js";
 // Domain (implementations)
-export * from './domain/index.js';
+export * from "./domain/index.js";
 // Adapters (default implementations)
-export * from './adapters/index.js';
+export * from "./adapters/index.js";

package/dist/ports/driven/scenario-registry.d.ts

@@ -1,4 +1,4 @@
-import type { ScenaristScenario } from '../../types/index.js';
+import type { ScenaristScenario } from "../../types/index.js";
 /**
  * Secondary port for scenario registry.
  * Manages the catalog of available scenarios.

package/dist/ports/driven/scenario-store.d.ts

@@ -1,4 +1,4 @@
-import type { ActiveScenario } from '../../types/index.js';
+import type { ActiveScenario } from "../../types/index.js";
 /**
  * Secondary port for scenario storage.
  * Implementations determine where active scenarios are stored.

package/dist/ports/driven/sequence-tracker.d.ts

@@ -36,7 +36,7 @@ export interface SequenceTracker {
      * @param totalResponses - Total number of responses in the sequence
      * @param repeatMode - Repeat behavior ('last' | 'cycle' | 'none')
      */
-    advance(testId: string, scenarioId: string, mockIndex: number, totalResponses: number, repeatMode: 'last' | 'cycle' | 'none'): void;
+    advance(testId: string, scenarioId: string, mockIndex: number, totalResponses: number, repeatMode: "last" | "cycle" | "none"): void;
     /**
      * Reset all sequence positions for a specific test ID.
      *