@schmock/core 2.2.0 → 2.2.2

package/dist/builder.d.ts

@@ -20,6 +20,13 @@ export declare class CallableMockInstance {
     defineRoute(route: Schmock.RouteKey, generator: Schmock.Generator, config: Schmock.RouteConfig): this;
     setCallableRef(ref: Schmock.CallableMockInstance): void;
     pipe(plugin: Schmock.Plugin): this;
+    /**
+     * FIX 2.3: Deep-clone a request record so callers cannot corrupt internal
+     * history by mutating nested body/response objects.
+     * Falls back to a shallow spread for bodies that are not structuredClone-able
+     * (e.g. Buffers, streams — rare in practice but defensively handled).
+     */
+    private cloneRecord;
     history(method?: Schmock.HttpMethod, path?: string): Schmock.RequestRecord[];
     called(method?: Schmock.HttpMethod, path?: string): boolean;
     callCount(method?: Schmock.HttpMethod, path?: string): number;

package/dist/builder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../src/builder.ts"],"names":[],"mappings":"AAuDA;;;;GAIG;AACH,qBAAa,oBAAoB;;IAanB,OAAO,CAAC,YAAY;IAZhC,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,YAAY,CAA4C;IAChE,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,WAAW,CAA2C;IAC9D,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,UAAU,CAAiC;IACnD,OAAO,CAAC,eAAe,CAAwC;IAE/D,OAAO,CAAC,SAAS,CAAoC;gBAEjC,YAAY,GAAE,OAAO,CAAC,YAAiB;IAa3D,WAAW,CACT,KAAK,EAAE,OAAO,CAAC,QAAQ,EACvB,SAAS,EAAE,OAAO,CAAC,SAAS,EAC5B,MAAM,EAAE,OAAO,CAAC,WAAW,GAC1B,IAAI;IA+EP,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,oBAAoB,GAAG,IAAI;IAIvD,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI;IAoBlC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE;IAS5E,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAS3D,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IAS7D,WAAW,CACT,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,EAC3B,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,SAAS;IAYpC,SAAS,IAAI,OAAO,CAAC,SAAS,EAAE;IAQhC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAMnC,EAAE,CAAC,CAAC,SAAS,OAAO,CAAC,YAAY,EAC/B,KAAK,EAAE,CAAC,EACR,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,IAAI,GACnD,IAAI;IAUP,GAAG,CAAC,CAAC,SAAS,OAAO,CAAC,YAAY,EAChC,KAAK,EAAE,CAAC,EACR,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,IAAI,GACnD,IAAI;IAKP,OAAO,CAAC,IAAI;IAWZ,KAAK,IAAI,IAAI;IAiBb,YAAY,IAAI,IAAI;IAKpB,UAAU,IAAI,IAAI;IAWlB,MAAM,CAAC,IAAI,SAAI,EAAE,QAAQ,SAAc,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;IAgErE,KAAK,IAAI,IAAI;IAab,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe;IAgBhE,MAAM,CACV,MAAM,EAAE,OAAO,CAAC,UAAU,EAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,GAC/B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IA+O5B;;;;OAIG;YACW,UAAU;CAezB"}
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../src/builder.ts"],"names":[],"mappings":"AAuDA;;;;GAIG;AACH,qBAAa,oBAAoB;;IAanB,OAAO,CAAC,YAAY;IAZhC,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,YAAY,CAA4C;IAChE,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,WAAW,CAA2C;IAC9D,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,UAAU,CAAiC;IACnD,OAAO,CAAC,eAAe,CAAwC;IAE/D,OAAO,CAAC,SAAS,CAAoC;gBAEjC,YAAY,GAAE,OAAO,CAAC,YAAiB;IAa3D,WAAW,CACT,KAAK,EAAE,OAAO,CAAC,QAAQ,EACvB,SAAS,EAAE,OAAO,CAAC,SAAS,EAC5B,MAAM,EAAE,OAAO,CAAC,WAAW,GAC1B,IAAI;IAsFP,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,oBAAoB,GAAG,IAAI;IAIvD,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI;IAoBlC;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAWnB,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE;IAW5E,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAS3D,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IAS7D,WAAW,CACT,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,EAC3B,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,SAAS;IAgBpC,SAAS,IAAI,OAAO,CAAC,SAAS,EAAE;IAQhC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAMnC,EAAE,CAAC,CAAC,SAAS,OAAO,CAAC,YAAY,EAC/B,KAAK,EAAE,CAAC,EACR,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,IAAI,GACnD,IAAI;IAUP,GAAG,CAAC,CAAC,SAAS,OAAO,CAAC,YAAY,EAChC,KAAK,EAAE,CAAC,EACR,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,IAAI,GACnD,IAAI;IAKP,OAAO,CAAC,IAAI;IAWZ,KAAK,IAAI,IAAI;IAiBb,YAAY,IAAI,IAAI;IAKpB,UAAU,IAAI,IAAI;IAWlB,MAAM,CAAC,IAAI,SAAI,EAAE,QAAQ,SAAc,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;IAgErE,KAAK,IAAI,IAAI;IAab,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe;IAgBhE,MAAM,CACV,MAAM,EAAE,OAAO,CAAC,UAAU,EAC1B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,GAC/B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IA+O5B;;;;OAIG;YACW,UAAU;CAezB"}

package/dist/builder.js

@@ -69,30 +69,32 @@ export class CallableMockInstance {
     }
     // Method for defining routes (called when instance is invoked)
     defineRoute(route, generator, config) {
+        // FIX 1.2: shallow-clone the caller's config so mutations below stay private
+        const routeConfig = { ...config };
         // Auto-detect contentType if not provided
-        if (!config.contentType) {
+        if (!routeConfig.contentType) {
             if (typeof generator === "function") {
                 // Default to JSON for function generators
-                config.contentType = "application/json";
+                routeConfig.contentType = "application/json";
             }
             else if (typeof generator === "string" ||
                 typeof generator === "number" ||
                 typeof generator === "boolean") {
                 // Default to plain text for primitives
-                config.contentType = "text/plain";
+                routeConfig.contentType = "text/plain";
             }
             else if (Buffer.isBuffer(generator)) {
                 // Default to octet-stream for buffers
-                config.contentType = "application/octet-stream";
+                routeConfig.contentType = "application/octet-stream";
             }
             else {
                 // Default to JSON for objects/arrays
-                config.contentType = "application/json";
+                routeConfig.contentType = "application/json";
             }
         }
         // Validate generator matches contentType if it's static data
         if (typeof generator !== "function" &&
-            config.contentType === "application/json") {
+            routeConfig.contentType === "application/json") {
             try {
                 JSON.stringify(generator);
             }
@@ -102,8 +104,11 @@ export class CallableMockInstance {
         }
         // Parse the route key to create pattern and extract parameters
         const parsed = parseRouteKey(route);
-        // Check for duplicate routes — first registration wins, subsequent ones are dropped
-        const existing = this.routes.find((r) => r.method === parsed.method && r.path === parsed.path);
+        // FIX 2.2: normalize paths before duplicate check so /users and /users/ are
+        // treated as the same route (consistent with the static-route Map key below)
+        const normalizedParsedPath = normalizePath(parsed.path);
+        const existing = this.routes.find((r) => r.method === parsed.method &&
+            normalizePath(r.path) === normalizedParsedPath);
         if (existing) {
             this.logger.log("warning", `Duplicate route: ${route} — first registration wins`);
             return this;
@@ -115,7 +120,7 @@ export class CallableMockInstance {
             method: parsed.method,
             path: parsed.path,
             generator,
-            config,
+            config: routeConfig,
         };
         this.routes.push(compiledRoute);
         // Store static routes (no params) in Map for O(1) lookup
@@ -124,7 +129,7 @@ export class CallableMockInstance {
             this.staticRoutes.set(key, compiledRoute);
         }
         this.logger.log("route", `Route defined: ${route}`, {
-            contentType: config.contentType,
+            contentType: routeConfig.contentType,
             generatorType: typeof generator,
             hasParams: parsed.params.length > 0,
         });
@@ -147,11 +152,30 @@ export class CallableMockInstance {
         return this;
     }
     // ===== Request Spy / History API =====
+    /**
+     * FIX 2.3: Deep-clone a request record so callers cannot corrupt internal
+     * history by mutating nested body/response objects.
+     * Falls back to a shallow spread for bodies that are not structuredClone-able
+     * (e.g. Buffers, streams — rare in practice but defensively handled).
+     */
+    cloneRecord(r) {
+        try {
+            return structuredClone(r);
+        }
+        catch {
+            return {
+                ...r,
+                response: { ...r.response },
+            };
+        }
+    }
     history(method, path) {
         if (method || path) {
-            return this.requestHistory.filter((r) => (!method || r.method === method) && (!path || r.path === path));
+            return this.requestHistory
+                .filter((r) => (!method || r.method === method) && (!path || r.path === path))
+                .map((r) => this.cloneRecord(r));
         }
-        return [...this.requestHistory];
+        return this.requestHistory.map((r) => this.cloneRecord(r));
     }
     called(method, path) {
         if (method || path) {
@@ -168,9 +192,13 @@ export class CallableMockInstance {
     lastRequest(method, path) {
         if (method || path) {
             const filtered = this.requestHistory.filter((r) => (!method || r.method === method) && (!path || r.path === path));
-            return filtered[filtered.length - 1];
+            const last = filtered[filtered.length - 1];
+            // FIX 2.3: return a deep clone so callers cannot corrupt internal history
+            return last ? this.cloneRecord(last) : undefined;
         }
-        return this.requestHistory[this.requestHistory.length - 1];
+        const last = this.requestHistory[this.requestHistory.length - 1];
+        // FIX 2.3: return a deep clone so callers cannot corrupt internal history
+        return last ? this.cloneRecord(last) : undefined;
     }
     // ===== Introspection =====
     getRoutes() {
@@ -215,10 +243,10 @@ export class CallableMockInstance {
         this.plugins = [];
         this.requestHistory = [];
         this.listeners.clear();
+        // FIX 3.3: assign a fresh object instead of deleting keys off the caller's
+        // reference — this avoids mutating the external state object passed by the user
         if (this.globalConfig.state) {
-            for (const key of Object.keys(this.globalConfig.state)) {
-                delete this.globalConfig.state[key];
-            }
+            this.globalConfig.state = {};
         }
         this.logger.log("lifecycle", "Mock fully reset");
     }
@@ -227,10 +255,10 @@ export class CallableMockInstance {
         this.logger.log("lifecycle", "Request history cleared");
     }
     resetState() {
+        // FIX 3.3: assign a fresh object instead of deleting keys off the caller's
+        // reference — this avoids mutating the external state object passed by the user
         if (this.globalConfig.state) {
-            for (const key of Object.keys(this.globalConfig.state)) {
-                delete this.globalConfig.state[key];
-            }
+            this.globalConfig.state = {};
         }
         this.logger.log("lifecycle", "State cleared");
     }

package/dist/plugin-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-pipeline.d.ts","sourceRoot":"","sources":["../src/plugin-pipeline.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,UAAU,cAAc;IACtB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EACzB,OAAO,EAAE,OAAO,CAAC,aAAa,EAC9B,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAkFjE"}
+{"version":3,"file":"plugin-pipeline.d.ts","sourceRoot":"","sources":["../src/plugin-pipeline.ts"],"names":[],"mappings":"AAGA,uEAAuE;AACvE,UAAU,cAAc;IACtB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9D;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EACzB,OAAO,EAAE,OAAO,CAAC,aAAa,EAC9B,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoFjE"}

package/dist/plugin-pipeline.js

@@ -1,3 +1,4 @@
+import { isStatusTuple } from "./constants.js";
 import { errorMessage, PluginError } from "./errors.js";
 /**
  * Run all registered plugins in sequence
@@ -41,9 +42,11 @@ export async function runPluginPipeline(plugins, context, initialResponse, logge
                             throw new PluginError(plugin.name, errorResult);
                         }
                         // ResponseResult return → recover, stop pipeline
-                        if (typeof errorResult === "object" &&
-                            errorResult !== null &&
-                            "status" in errorResult) {
+                        // Accept both object-with-status and status tuple [code, body] / [code, body, headers]
+                        if (isStatusTuple(errorResult) ||
+                            (typeof errorResult === "object" &&
+                                errorResult !== null &&
+                                "status" in errorResult)) {
                             response = errorResult;
                             break;
                         }

package/dist/response-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-parser.d.ts","sourceRoot":"","sources":["../src/response-parser.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,OAAO,CAAC,WAAW,GAC/B,OAAO,CAAC,QAAQ,CAmDlB"}
+{"version":3,"file":"response-parser.d.ts","sourceRoot":"","sources":["../src/response-parser.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,OAAO,CAAC,WAAW,GAC/B,OAAO,CAAC,QAAQ,CAmDlB"}

package/dist/response-parser.js

@@ -3,6 +3,7 @@ function isResponseObject(value) {
     return (typeof value === "object" &&
         value !== null &&
         "status" in value &&
+        typeof value.status === "number" &&
         "body" in value);
 }
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schmock/core",
   "description": "Core functionality for Schmock",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -32,10 +32,10 @@
   },
   "license": "MIT",
   "devDependencies": {
-    "@amiceli/vitest-cucumber": "^6.5.0",
+    "@amiceli/vitest-cucumber": "^7.0.0",
     "@types/json-schema": "^7.0.15",
-    "@types/node": "^25.8.0",
-    "@vitest/ui": "^4.1.6",
-    "vitest": "^4.1.7"
+    "@types/node": "^26.1.0",
+    "@vitest/ui": "^4.1.9",
+    "vitest": "^4.1.9"
   }
 }

package/src/audit-core-builder.test.ts

@@ -0,0 +1,218 @@
+import { describe, expect, it } from "vitest";
+import { schmock } from "./index";
+
+// ── FIX 1.2: defineRoute must shallow-clone the config ────────────────────────
+
+describe("FIX 1.2 — defineRoute must not mutate the caller's config", () => {
+  it("does not add contentType to the caller's config object", () => {
+    const sharedConfig: Schmock.RouteConfig = {};
+    const mock = schmock();
+    mock("GET /a", { x: 1 }, sharedConfig);
+    // sharedConfig must remain empty — defineRoute must work on a clone
+    expect(Object.keys(sharedConfig)).toHaveLength(0);
+  });
+
+  it("second route registered with same config is not polluted by first route detection", () => {
+    const sharedConfig: Schmock.RouteConfig = {};
+    const mock = schmock();
+    mock("GET /first", { x: 1 }, sharedConfig);
+    mock("GET /second", "hello", sharedConfig);
+    // sharedConfig must still be clean — neither call should have written to it
+    expect(Object.keys(sharedConfig)).toHaveLength(0);
+  });
+
+  it("mutating caller's config after registration does not change the registered route response", async () => {
+    const config: Schmock.RouteConfig = {};
+    const mock = schmock();
+    mock("GET /item", { value: 99 }, config);
+
+    // After registration, mutate the caller's config
+    config.status = 503;
+    config.contentType = "text/html";
+
+    const response = await mock.handle("GET", "/item");
+    // The registered route must use its own cloned config — not 503
+    expect(response.status).toBe(200);
+    const ct =
+      response.headers?.["content-type"] ?? response.headers?.["Content-Type"];
+    expect(ct).toContain("application/json");
+  });
+
+  it("each route keeps its own detected contentType even when sharing the same config object", async () => {
+    const sharedConfig: Schmock.RouteConfig = {};
+    const mock = schmock();
+    // First route: object → application/json
+    mock("GET /obj", { value: 1 }, sharedConfig);
+    // Second route: primitive string → text/plain
+    mock("GET /str", "hello", sharedConfig);
+
+    const objResp = await mock.handle("GET", "/obj");
+    const strResp = await mock.handle("GET", "/str");
+
+    const ctObj =
+      objResp.headers?.["content-type"] ?? objResp.headers?.["Content-Type"];
+    const ctStr =
+      strResp.headers?.["content-type"] ?? strResp.headers?.["Content-Type"];
+
+    expect(ctObj).toContain("application/json");
+    expect(ctStr).toContain("text/plain");
+  });
+});
+
+// ── FIX 2.2: duplicate route detection must normalize trailing slash ──────────
+
+describe("FIX 2.2 — duplicate-route detection uses normalized paths", () => {
+  it("GET /users/ is treated as duplicate of GET /users", () => {
+    const mock = schmock();
+    mock("GET /users", [{ id: 1 }], {});
+    // Registering with trailing slash must not add a second route
+    mock("GET /users/", [{ id: 2 }], {});
+
+    const routes = mock.getRoutes();
+    const userRoutes = routes.filter(
+      (r) =>
+        r.method === "GET" && (r.path === "/users" || r.path === "/users/"),
+    );
+    expect(userRoutes).toHaveLength(1);
+  });
+
+  it("first registration wins — trailing-slash variant does not overwrite", async () => {
+    const mock = schmock();
+    mock("GET /items", [{ id: 1 }], {});
+    mock("GET /items/", [{ id: 999 }], {});
+
+    // Should still get the first registration's data
+    const resp = await mock.handle("GET", "/items");
+    expect(resp.status).toBe(200);
+    expect(Array.isArray(resp.body)).toBe(true);
+    expect((resp.body as { id: number }[])[0].id).toBe(1);
+  });
+
+  it("registering verbatim duplicate also produces only one route", () => {
+    const mock = schmock();
+    mock("GET /same", { ok: true }, {});
+    mock("GET /same", { ok: false }, {});
+
+    const routes = mock.getRoutes();
+    const sameRoutes = routes.filter(
+      (r) => r.method === "GET" && r.path === "/same",
+    );
+    expect(sameRoutes).toHaveLength(1);
+  });
+});
+
+// ── FIX 3.3: reset()/resetState() must reassign, not delete keys ─────────────
+
+describe("FIX 3.3 — reset()/resetState() must not mutate caller's state", () => {
+  it("reset() leaves the external state object untouched", () => {
+    const st = { a: 1 };
+    const mock = schmock({ state: st });
+    mock.reset();
+    expect(st).toEqual({ a: 1 });
+  });
+
+  it("resetState() leaves the external state object untouched", () => {
+    const st = { b: 2 };
+    const mock = schmock({ state: st });
+    mock.resetState();
+    expect(st).toEqual({ b: 2 });
+  });
+
+  it("mock.getState() is empty after reset()", () => {
+    const st = { x: 10 };
+    const mock = schmock({ state: st });
+    mock.reset();
+    expect(mock.getState()).toEqual({});
+  });
+
+  it("mock.getState() is empty after resetState()", () => {
+    const st = { y: 20 };
+    const mock = schmock({ state: st });
+    mock.resetState();
+    expect(mock.getState()).toEqual({});
+  });
+
+  it("generator sees empty state after resetState", async () => {
+    const st: Record<string, unknown> = { counter: 0 };
+    const mock = schmock({ state: st });
+    mock("GET /stateful", (ctx: Schmock.RequestContext) => {
+      return { stateKeys: Object.keys(ctx.state) };
+    });
+
+    mock.resetState();
+
+    const resp = await mock.handle("GET", "/stateful");
+    expect(resp.status).toBe(200);
+    // After resetState, the generator should see an empty state
+    expect((resp.body as { stateKeys: string[] }).stateKeys).toHaveLength(0);
+  });
+});
+
+// ── FIX 2.3: history()/lastRequest() must return deep clones ─────────────────
+
+describe("FIX 2.3 — history() and lastRequest() return deep clones", () => {
+  it("mutating a history() record's nested body does not corrupt internal history", async () => {
+    const mock = schmock();
+    mock("GET /nested", { deep: { value: "original" } }, {});
+
+    await mock.handle("GET", "/nested");
+
+    // First read: mutate the returned record's body
+    const records1 = mock.history();
+    const firstRecord = records1[0];
+    (firstRecord.response.body as { deep: { value: string } }).deep.value =
+      "MUTATED";
+
+    // Second read: internal history must be unchanged
+    const records2 = mock.history();
+    expect(
+      (records2[0].response.body as { deep: { value: string } }).deep.value,
+    ).toBe("original");
+  });
+
+  it("mutating filtered history() record does not corrupt internal history", async () => {
+    const mock = schmock();
+    mock("GET /data", { info: { count: 42 } }, {});
+    await mock.handle("GET", "/data");
+
+    const filtered = mock.history("GET", "/data");
+    (filtered[0].response.body as { info: { count: number } }).info.count = 0;
+
+    const again = mock.history("GET", "/data");
+    expect(
+      (again[0].response.body as { info: { count: number } }).info.count,
+    ).toBe(42);
+  });
+
+  it("mutating lastRequest() record does not corrupt internal history", async () => {
+    const mock = schmock();
+    mock("GET /last", { meta: { tag: "safe" } }, {});
+    await mock.handle("GET", "/last");
+
+    const last = mock.lastRequest();
+    if (!last) throw new Error("expected a record");
+    (last.response.body as { meta: { tag: string } }).meta.tag = "corrupted";
+
+    const again = mock.lastRequest();
+    if (!again) throw new Error("expected a record");
+    expect((again.response.body as { meta: { tag: string } }).meta.tag).toBe(
+      "safe",
+    );
+  });
+
+  it("mutating filtered lastRequest() record does not corrupt internal history", async () => {
+    const mock = schmock();
+    mock("POST /echo", { msg: { text: "hello" } }, {});
+    await mock.handle("POST", "/echo");
+
+    const last = mock.lastRequest("POST", "/echo");
+    if (!last) throw new Error("expected a record");
+    (last.response.body as { msg: { text: string } }).msg.text = "CHANGED";
+
+    const again = mock.lastRequest("POST", "/echo");
+    if (!again) throw new Error("expected a record");
+    expect((again.response.body as { msg: { text: string } }).msg.text).toBe(
+      "hello",
+    );
+  });
+});

package/src/audit-response-guard.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { schmock } from "./index";
+
+describe("isResponseObject guard — status type check", () => {
+  describe("non-numeric status must NOT be treated as response envelope", () => {
+    it("returns status 200 (default) when generator returns { status: 'ok', body: 'hello' }", async () => {
+      const mock = schmock();
+      mock("GET /bad-envelope", () => ({ status: "ok", body: "hello" }));
+
+      const response = await mock.handle("GET", "/bad-envelope");
+
+      // The string status must never leak into response.status
+      expect(response.status).toBe(200);
+    });
+
+    it("returns the whole object as body when generator returns { status: 'ok', body: 'hello' }", async () => {
+      const mock = schmock();
+      mock("GET /bad-envelope-body", () => ({ status: "ok", body: "hello" }));
+
+      const response = await mock.handle("GET", "/bad-envelope-body");
+
+      // The original object must be treated as plain body, not unwrapped
+      expect(response.body).toEqual({ status: "ok", body: "hello" });
+    });
+  });
+
+  describe("numeric status IS correctly treated as response envelope", () => {
+    it("returns status 201 and unwrapped body when generator returns { status: 201, body: { id: 1 } }", async () => {
+      const mock = schmock();
+      mock("POST /create", () => ({ status: 201, body: { id: 1 } }));
+
+      const response = await mock.handle("POST", "/create");
+
+      expect(response.status).toBe(201);
+      expect(response.body).toEqual({ id: 1 });
+    });
+  });
+});

package/src/builder.ts

@@ -89,31 +89,34 @@ export class CallableMockInstance {
     generator: Schmock.Generator,
     config: Schmock.RouteConfig,
   ): this {
+    // FIX 1.2: shallow-clone the caller's config so mutations below stay private
+    const routeConfig = { ...config };
+
     // Auto-detect contentType if not provided
-    if (!config.contentType) {
+    if (!routeConfig.contentType) {
       if (typeof generator === "function") {
         // Default to JSON for function generators
-        config.contentType = "application/json";
+        routeConfig.contentType = "application/json";
       } else if (
         typeof generator === "string" ||
         typeof generator === "number" ||
         typeof generator === "boolean"
       ) {
         // Default to plain text for primitives
-        config.contentType = "text/plain";
+        routeConfig.contentType = "text/plain";
       } else if (Buffer.isBuffer(generator)) {
         // Default to octet-stream for buffers
-        config.contentType = "application/octet-stream";
+        routeConfig.contentType = "application/octet-stream";
       } else {
         // Default to JSON for objects/arrays
-        config.contentType = "application/json";
+        routeConfig.contentType = "application/json";
       }
     }
 
     // Validate generator matches contentType if it's static data
     if (
       typeof generator !== "function" &&
-      config.contentType === "application/json"
+      routeConfig.contentType === "application/json"
     ) {
       try {
         JSON.stringify(generator);
@@ -128,9 +131,13 @@ export class CallableMockInstance {
     // Parse the route key to create pattern and extract parameters
     const parsed = parseRouteKey(route);
 
-    // Check for duplicate routes — first registration wins, subsequent ones are dropped
+    // FIX 2.2: normalize paths before duplicate check so /users and /users/ are
+    // treated as the same route (consistent with the static-route Map key below)
+    const normalizedParsedPath = normalizePath(parsed.path);
     const existing = this.routes.find(
-      (r) => r.method === parsed.method && r.path === parsed.path,
+      (r) =>
+        r.method === parsed.method &&
+        normalizePath(r.path) === normalizedParsedPath,
     );
     if (existing) {
       this.logger.log(
@@ -147,7 +154,7 @@ export class CallableMockInstance {
       method: parsed.method,
       path: parsed.path,
       generator,
-      config,
+      config: routeConfig,
     };
 
     this.routes.push(compiledRoute);
@@ -159,7 +166,7 @@ export class CallableMockInstance {
     }
 
     this.logger.log("route", `Route defined: ${route}`, {
-      contentType: config.contentType,
+      contentType: routeConfig.contentType,
       generatorType: typeof generator,
       hasParams: parsed.params.length > 0,
     });
@@ -191,13 +198,32 @@ export class CallableMockInstance {
 
   // ===== Request Spy / History API =====
 
+  /**
+   * FIX 2.3: Deep-clone a request record so callers cannot corrupt internal
+   * history by mutating nested body/response objects.
+   * Falls back to a shallow spread for bodies that are not structuredClone-able
+   * (e.g. Buffers, streams — rare in practice but defensively handled).
+   */
+  private cloneRecord(r: Schmock.RequestRecord): Schmock.RequestRecord {
+    try {
+      return structuredClone(r);
+    } catch {
+      return {
+        ...r,
+        response: { ...r.response },
+      };
+    }
+  }
+
   history(method?: Schmock.HttpMethod, path?: string): Schmock.RequestRecord[] {
     if (method || path) {
-      return this.requestHistory.filter(
-        (r) => (!method || r.method === method) && (!path || r.path === path),
-      );
+      return this.requestHistory
+        .filter(
+          (r) => (!method || r.method === method) && (!path || r.path === path),
+        )
+        .map((r) => this.cloneRecord(r));
     }
-    return [...this.requestHistory];
+    return this.requestHistory.map((r) => this.cloneRecord(r));
   }
 
   called(method?: Schmock.HttpMethod, path?: string): boolean {
@@ -226,9 +252,13 @@ export class CallableMockInstance {
       const filtered = this.requestHistory.filter(
         (r) => (!method || r.method === method) && (!path || r.path === path),
       );
-      return filtered[filtered.length - 1];
+      const last = filtered[filtered.length - 1];
+      // FIX 2.3: return a deep clone so callers cannot corrupt internal history
+      return last ? this.cloneRecord(last) : undefined;
     }
-    return this.requestHistory[this.requestHistory.length - 1];
+    const last = this.requestHistory[this.requestHistory.length - 1];
+    // FIX 2.3: return a deep clone so callers cannot corrupt internal history
+    return last ? this.cloneRecord(last) : undefined;
   }
 
   // ===== Introspection =====
@@ -288,10 +318,10 @@ export class CallableMockInstance {
     this.plugins = [];
     this.requestHistory = [];
     this.listeners.clear();
+    // FIX 3.3: assign a fresh object instead of deleting keys off the caller's
+    // reference — this avoids mutating the external state object passed by the user
     if (this.globalConfig.state) {
-      for (const key of Object.keys(this.globalConfig.state)) {
-        delete this.globalConfig.state[key];
-      }
+      this.globalConfig.state = {};
     }
     this.logger.log("lifecycle", "Mock fully reset");
   }
@@ -302,10 +332,10 @@ export class CallableMockInstance {
   }
 
   resetState(): void {
+    // FIX 3.3: assign a fresh object instead of deleting keys off the caller's
+    // reference — this avoids mutating the external state object passed by the user
     if (this.globalConfig.state) {
-      for (const key of Object.keys(this.globalConfig.state)) {
-        delete this.globalConfig.state[key];
-      }
+      this.globalConfig.state = {};
     }
     this.logger.log("lifecycle", "State cleared");
   }

package/src/plugin-pipeline.ts

@@ -1,3 +1,4 @@
+import { isStatusTuple } from "./constants.js";
 import { errorMessage, PluginError } from "./errors.js";
 
 /** Structural typing — DebugLogger satisfies this without an import */
@@ -68,10 +69,12 @@ export async function runPluginPipeline(
             }
 
             // ResponseResult return → recover, stop pipeline
+            // Accept both object-with-status and status tuple [code, body] / [code, body, headers]
             if (
-              typeof errorResult === "object" &&
-              errorResult !== null &&
-              "status" in errorResult
+              isStatusTuple(errorResult) ||
+              (typeof errorResult === "object" &&
+                errorResult !== null &&
+                "status" in errorResult)
             ) {
               response = errorResult;
               break;

package/src/response-parser.ts

@@ -9,6 +9,7 @@ function isResponseObject(value: unknown): value is {
     typeof value === "object" &&
     value !== null &&
     "status" in value &&
+    typeof (value as Record<string, unknown>).status === "number" &&
     "body" in value
   );
 }

package/src/steps/audit-core-builder.steps.ts

@@ -0,0 +1,188 @@
+import { describeFeature, loadFeature } from "@amiceli/vitest-cucumber";
+import { expect } from "vitest";
+import { schmock } from "../index";
+
+const feature = await loadFeature("../../features/audit-core-builder.feature");
+
+describeFeature(feature, ({ Scenario }) => {
+  // ── FIX 1.2: defineRoute must shallow-clone the config ───────────────────
+
+  Scenario(
+    "defineRoute does not mutate the caller's config object",
+    ({ Given, When, Then }) => {
+      let sharedConfig: Schmock.RouteConfig;
+      let mock: Schmock.CallableMockInstance;
+
+      Given("a shared config object with no contentType", () => {
+        sharedConfig = {};
+      });
+
+      When("I register two routes with the same config object", () => {
+        mock = schmock();
+        mock("GET /route1", { name: "route1" }, sharedConfig);
+        mock("GET /route2", { name: "route2" }, sharedConfig);
+      });
+
+      Then(
+        "the shared config object remains unchanged after registration",
+        () => {
+          expect(Object.keys(sharedConfig)).toHaveLength(0);
+        },
+      );
+    },
+  );
+
+  Scenario(
+    "Mutating a returned config does not affect the registered route",
+    ({ Given, When, Then, And }) => {
+      let singleConfig: Schmock.RouteConfig;
+      let mock: Schmock.CallableMockInstance;
+
+      Given("a single config object with no contentType", () => {
+        singleConfig = {};
+      });
+
+      When("I register one route with that config object", () => {
+        mock = schmock();
+        mock("GET /item", { value: 99 }, singleConfig);
+      });
+
+      And("I mutate the config object after registration", () => {
+        singleConfig.status = 503;
+        singleConfig.contentType = "text/html";
+      });
+
+      Then(
+        "the registered route still responds with application/json content type",
+        async () => {
+          const response = await mock.handle("GET", "/item");
+          expect(response.status).toBe(200);
+          const ct =
+            response.headers?.["content-type"] ??
+            response.headers?.["Content-Type"];
+          expect(ct).toContain("application/json");
+        },
+      );
+    },
+  );
+
+  // ── FIX 2.2: duplicate route detection must normalize trailing slash ──────
+
+  Scenario(
+    "Trailing-slash path is treated as duplicate",
+    ({ Given, And, Then }) => {
+      let mock: Schmock.CallableMockInstance;
+
+      Given("a fresh mock instance", () => {
+        mock = schmock();
+      });
+
+      And("I register GET /users without trailing slash", () => {
+        mock("GET /users", [{ id: 1 }], {});
+      });
+
+      And("I register GET /users with trailing slash", () => {
+        mock("GET /users/", [{ id: 2 }], {});
+      });
+
+      Then("only one route exists for GET /users", () => {
+        const routes = mock.getRoutes();
+        const userRoutes = routes.filter(
+          (r) =>
+            r.method === "GET" && (r.path === "/users" || r.path === "/users/"),
+        );
+        expect(userRoutes).toHaveLength(1);
+      });
+    },
+  );
+
+  // ── FIX 3.3: reset()/resetState() must not mutate caller's state ─────────
+
+  Scenario(
+    "reset() does not mutate the caller's state object",
+    ({ Given, When, Then, And }) => {
+      let externalState: Record<string, unknown>;
+      let mock: Schmock.CallableMockInstance;
+
+      Given('a mock with external state containing key "a" equal to 1', () => {
+        externalState = { a: 1 };
+        mock = schmock({ state: externalState });
+      });
+
+      When("I call mock reset", () => {
+        mock.reset();
+      });
+
+      Then('the external state still has key "a" equal to 1', () => {
+        expect(externalState).toEqual({ a: 1 });
+      });
+
+      And("the mock internal state is empty", () => {
+        expect(mock.getState()).toEqual({});
+      });
+    },
+  );
+
+  Scenario(
+    "resetState() does not mutate the caller's state object",
+    ({ Given, When, Then, And }) => {
+      let externalState: Record<string, unknown>;
+      let mock: Schmock.CallableMockInstance;
+
+      Given('a mock with external state containing key "b" equal to 2', () => {
+        externalState = { b: 2 };
+        mock = schmock({ state: externalState });
+      });
+
+      When("I call mock resetState", () => {
+        mock.resetState();
+      });
+
+      Then('the external state still has key "b" equal to 2', () => {
+        expect(externalState).toEqual({ b: 2 });
+      });
+
+      And("the mock internal state is empty after resetState", () => {
+        expect(mock.getState()).toEqual({});
+      });
+    },
+  );
+
+  // ── FIX 2.3: history()/lastRequest() must return deep clones ─────────────
+
+  Scenario(
+    "history() returns deep clones of request records",
+    ({ Given, When, Then, And }) => {
+      let mock: Schmock.CallableMockInstance;
+
+      Given("a fresh mock with a route returning a nested body", () => {
+        mock = schmock();
+        mock("GET /data", { nested: { value: "original" } }, {});
+      });
+
+      When("I handle that route once", async () => {
+        await mock.handle("GET", "/data");
+      });
+
+      And("I mutate the response body of the first history record", () => {
+        const records = mock.history();
+        expect(records).toHaveLength(1);
+        const body = records[0].response.body as { nested: { value: string } };
+        body.nested.value = "MUTATED";
+      });
+
+      Then("history returns the original body unchanged", () => {
+        const records = mock.history();
+        const body = records[0].response.body as { nested: { value: string } };
+        expect(body.nested.value).toBe("original");
+      });
+
+      And("lastRequest returns the original body unchanged", () => {
+        const last = mock.lastRequest();
+        if (!last) throw new Error("expected a record");
+        const body = last.response.body as { nested: { value: string } };
+        expect(body.nested.value).toBe("original");
+      });
+    },
+  );
+});

package/src/steps/audit-onerror-tuple.steps.ts

@@ -0,0 +1,99 @@
+import { describeFeature, loadFeature } from "@amiceli/vitest-cucumber";
+import { expect } from "vitest";
+import { schmock } from "../index";
+
+const feature = await loadFeature("../../features/audit-onerror-tuple.feature");
+
+describeFeature(feature, ({ Scenario }) => {
+  let mock: Schmock.CallableMockInstance;
+  let response: Awaited<ReturnType<Schmock.CallableMockInstance["handle"]>>;
+  let thrownError: unknown;
+
+  Scenario(
+    "2-element tuple from onError recovers with correct status and body",
+    ({ Given, When, Then, And }) => {
+      Given(
+        "a mock with a plugin whose process throws and onError returns a 2-element tuple",
+        () => {
+          mock = schmock({ state: {} });
+          mock("GET /fail", null, {}).pipe({
+            name: "failing-plugin",
+            process: (_ctx, _response) => {
+              throw new Error("simulated failure");
+            },
+            onError: (_error, _ctx) => {
+              return [503, { error: "recovered" }] as [number, unknown];
+            },
+          });
+        },
+      );
+
+      When('I handle a request to "GET /fail"', async () => {
+        thrownError = undefined;
+        try {
+          response = await mock.handle("GET", "/fail");
+        } catch (err) {
+          thrownError = err;
+        }
+      });
+
+      Then("the response status is 503", () => {
+        expect(response.status).toBe(503);
+      });
+
+      And('the response body is \'{"error":"recovered"}\'', () => {
+        expect(response.body).toEqual({ error: "recovered" });
+      });
+
+      And("no error is thrown", () => {
+        expect(thrownError).toBeUndefined();
+      });
+    },
+  );
+
+  Scenario(
+    "3-element tuple from onError recovers and includes custom headers",
+    ({ Given, When, Then, And }) => {
+      Given(
+        "a mock with a plugin whose process throws and onError returns a 3-element tuple with headers",
+        () => {
+          mock = schmock({ state: {} });
+          mock("GET /fail-with-headers", null, {}).pipe({
+            name: "failing-plugin-headers",
+            process: (_ctx, _response) => {
+              throw new Error("simulated failure with headers");
+            },
+            onError: (_error, _ctx) => {
+              return [
+                503,
+                { error: "recovered with headers" },
+                { "x-recovery": "true" },
+              ] as [number, unknown, Record<string, string>];
+            },
+          });
+        },
+      );
+
+      When('I handle a request to "GET /fail-with-headers"', async () => {
+        thrownError = undefined;
+        try {
+          response = await mock.handle("GET", "/fail-with-headers");
+        } catch (err) {
+          thrownError = err;
+        }
+      });
+
+      Then("the response status is 503", () => {
+        expect(response.status).toBe(503);
+      });
+
+      And('the response body is \'{"error":"recovered with headers"}\'', () => {
+        expect(response.body).toEqual({ error: "recovered with headers" });
+      });
+
+      And("no error is thrown", () => {
+        expect(thrownError).toBeUndefined();
+      });
+    },
+  );
+});

package/src/steps/performance-reliability.steps.ts

@@ -64,6 +64,9 @@ describeFeature(feature, ({ Scenario }) => {
       }
     });
 
+    // Generous ceiling, not a perf target: in-process handlers are sub-millisecond,
+    // so this only guards against a pathological hang. A tight bound (e.g. 50ms)
+    // flakes under CI load where 100 concurrent requests contend for the event loop.
     And("the average response time should be under {int}ms", (_, maxTime: number) => {
       const avgTime = responsesTimes.reduce((a, b) => a + b, 0) / responsesTimes.length;
       expect(avgTime).toBeLessThan(maxTime);

package/src/steps/response-delay.steps.ts

@@ -28,8 +28,11 @@ describeFeature(feature, ({ Scenario }) => {
       elapsed = performance.now() - start;
     });
 
-    Then("the response took less than 100ms", () => {
-      expect(elapsed).toBeLessThan(100);
+    // Upper bound is intentionally generous: it only needs to prove the 10ms
+    // route delay was used instead of the 200ms global. A tight bound here
+    // flakes under CI load (a single timer can be delayed tens of ms).
+    Then("the response took less than 150ms", () => {
+      expect(elapsed).toBeLessThan(150);
     });
 
     When('I request "GET /default" with timing', async () => {