@schmock/core 2.2.3 → 2.3.1

package/dist/response-parser.js

@@ -1,10 +1,59 @@
+import { isBinaryBody } from "./binary.js";
 import { isStatusTuple } from "./constants.js";
+import { InvalidResponseError } from "./errors.js";
+const BINARY_CONTENT_TYPE = "application/octet-stream";
+/**
+ * Take ownership of caller-supplied response headers.
+ *
+ * Parsing injects a content type into the header record, so the caller's object
+ * must never be aliased — a generator reusing a module-level header object would
+ * otherwise leak the content type of one response into the next. Only the shape
+ * is checked here; per-value type checks stay in `normalizeResponse` so its
+ * distinct messages ("header names/values must be strings") are preserved.
+ */
+function toOwnHeaderRecord(value) {
+    if (value === undefined)
+        return {};
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new InvalidResponseError("headers must be a string record");
+    }
+    // Per-value types are `normalizeResponse`'s job (it keeps its own distinct
+    // message), so a non-string value is carried through here rather than
+    // rejected; this pass only shape-checks and detaches the caller's object.
+    const record = {};
+    Object.assign(record, value);
+    return record;
+}
+function hasContentType(headers) {
+    return Object.keys(headers).some((header) => header.toLowerCase() === "content-type");
+}
+/**
+ * Detect the object response envelope `{ status, body, headers? }`.
+ *
+ * Detection is by shape, so a legitimate domain object carrying a numeric
+ * `status` next to a `body` is unwrapped instead of being delivered as the
+ * payload. Callers who need to return such a shape as data should nest it or
+ * use an explicit `[status, body]` tuple for the envelope. An object whose
+ * `headers` is present but not a string record is deliberately NOT an envelope
+ * and is delivered whole — plugins that inspect responses must use this same
+ * rule (see `@schmock/validation`) or they will judge an undelivered payload.
+ */
 function isResponseObject(value) {
     return (typeof value === "object" &&
         value !== null &&
+        !Array.isArray(value) &&
         "status" in value &&
         typeof value.status === "number" &&
-        "body" in value);
+        "body" in value &&
+        (!("headers" in value) ||
+            value.headers === undefined ||
+            isStringRecord(value.headers)));
+}
+function isStringRecord(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.values(value).every((entry) => typeof entry === "string"));
 }
 /**
  * Parse and normalize response result into Response object
@@ -17,15 +66,15 @@ export function parseResponse(result, routeConfig) {
     let tupleFormat = false;
     // Handle already-formed response objects (from plugin error recovery)
     if (isResponseObject(result)) {
-        return {
-            status: result.status,
-            body: result.body,
-            headers: result.headers || {},
-        };
+        status = result.status;
+        body = result.body;
+        headers = toOwnHeaderRecord(result.headers);
+        tupleFormat = true;
     }
-    // Handle tuple response format [status, body, headers?]
-    if (isStatusTuple(result)) {
-        [status, body, headers = {}] = result;
+    else if (isStatusTuple(result)) {
+        // Handle tuple response format [status, body, headers?]
+        [status, body] = result;
+        headers = toOwnHeaderRecord(result[2]);
         tupleFormat = true;
     }
     // Handle null/undefined responses with 204 No Content
@@ -36,18 +85,36 @@ export function parseResponse(result, routeConfig) {
         }
         body = undefined; // Ensure body is undefined for null responses
     }
+    const binaryBody = isBinaryBody(body);
+    // Binary response values need a transport-safe MIME type. Tuple headers still
+    // take precedence, while a non-JSON route override (for example image/png)
+    // remains authoritative for non-tuple responses.
+    if (!hasContentType(headers) && binaryBody) {
+        headers["content-type"] =
+            !tupleFormat &&
+                routeConfig.contentType &&
+                routeConfig.contentType !== "application/json"
+                ? routeConfig.contentType
+                : BINARY_CONTENT_TYPE;
+    }
     // Add content-type header from route config if it exists and headers don't already have it
     // But only if this isn't a tuple response (where headers are explicitly controlled)
-    if (!headers["content-type"] && routeConfig.contentType && !tupleFormat) {
+    let appliedRouteContentType = false;
+    if (!hasContentType(headers) && routeConfig.contentType && !tupleFormat) {
         headers["content-type"] = routeConfig.contentType;
-        // Handle special conversion cases when contentType is explicitly set
-        if (routeConfig.contentType === "text/plain" && body !== undefined) {
-            if (typeof body === "object" && !Buffer.isBuffer(body)) {
-                body = JSON.stringify(body);
-            }
-            else if (typeof body !== "string") {
-                body = String(body);
-            }
+        appliedRouteContentType = true;
+    }
+    // Handle special conversion cases when contentType is explicitly set. A
+    // binary body keeps its bytes even when a custom MIME type is configured.
+    if (appliedRouteContentType &&
+        routeConfig.contentType === "text/plain" &&
+        body !== undefined &&
+        !binaryBody) {
+        if (typeof body === "object") {
+            body = JSON.stringify(body);
+        }
+        else if (typeof body !== "string") {
+            body = String(body);
         }
     }
     return {

package/dist/route-matcher.d.ts

@@ -19,6 +19,9 @@ export declare function findRoute(method: Schmock.HttpMethod, path: string, stat
 /**
  * Extract parameter values from path based on route pattern
  * Maps capture groups from regex match to parameter names
+ *
+ * Matching runs on the ENCODED path so `%2F` cannot act as a separator;
+ * captures are decoded afterwards, so a generator receives readable values.
  */
 export declare function extractParams(route: CompiledCallableRoute, path: string): Record<string, string>;
 //# sourceMappingURL=route-matcher.d.ts.map

package/dist/route-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../src/route-matcher.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;IAC7B,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;CAC7B;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,CAAC,SAAS,GACrB,GAAG,IAAI,OAAO,CAAC,iBAAiB,CAElC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,OAAO,CAAC,UAAU,EAC1B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAChD,MAAM,EAAE,qBAAqB,EAAE,GAC9B,qBAAqB,GAAG,SAAS,CAmBnC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUxB"}
+{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../src/route-matcher.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;IAC7B,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;CAC7B;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,CAAC,SAAS,GACrB,GAAG,IAAI,OAAO,CAAC,iBAAiB,CAElC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,OAAO,CAAC,UAAU,EAC1B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAChD,MAAM,EAAE,qBAAqB,EAAE,GAC9B,qBAAqB,GAAG,SAAS,CAmBnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB"}

package/dist/route-matcher.js

@@ -1,4 +1,4 @@
-import { normalizePath } from "./constants.js";
+import { decodePathSegment, normalizePath } from "./constants.js";
 export function isGeneratorFunction(gen) {
     return typeof gen === "function";
 }
@@ -26,14 +26,20 @@ export function findRoute(method, path, staticRoutes, routes) {
 /**
  * Extract parameter values from path based on route pattern
  * Maps capture groups from regex match to parameter names
+ *
+ * Matching runs on the ENCODED path so `%2F` cannot act as a separator;
+ * captures are decoded afterwards, so a generator receives readable values.
  */
 export function extractParams(route, path) {
     const match = path.match(route.pattern);
     if (!match)
         return {};
-    const params = {};
-    route.params.forEach((param, index) => {
-        params[param] = match[index + 1];
-    });
-    return params;
+    // Object.fromEntries defines own properties, so a parameter named
+    // `__proto__` (or any other Object.prototype key) survives instead of being
+    // swallowed by the prototype setter. The prototype itself is retained so
+    // generators can still call params.hasOwnProperty(...).
+    return Object.fromEntries(route.params.map((param, index) => [
+        param,
+        decodePathSegment(match[index + 1]),
+    ]));
 }

package/dist/types.d.ts

@@ -1,3 +1,5 @@
+export type Schema = Schmock.Schema;
+export type SchemaDefinition = Schmock.SchemaDefinition;
 export type HttpMethod = Schmock.HttpMethod;
 export type RouteKey = Schmock.RouteKey;
 export type ResponseBody = Schmock.ResponseBody;
@@ -17,15 +19,18 @@ export type StaticData = Schmock.StaticData;
 export type RequestRecord = Schmock.RequestRecord;
 export type ServerInfo = Schmock.ServerInfo;
 export type RouteInfo = Schmock.RouteInfo;
+export type ResourceOverride = Schmock.ResourceOverride;
+export type ResponseHeaderDef = Schmock.ResponseHeaderDef;
+export type CrudOperationMeta = Schmock.CrudOperationMeta;
 export type SchemaGenerationContext = Schmock.SchemaGenerationContext;
 export type FakerPluginOptions = Schmock.FakerPluginOptions;
 export type ExpressAdapterOptions = Schmock.ExpressAdapterOptions;
 export type AngularAdapterOptions = Schmock.AngularAdapterOptions;
 export type OpenApiOptions = Schmock.OpenApiOptions;
+export type OpenApiCallbackRequest = Schmock.OpenApiCallbackRequest;
+export type OpenApiCallbackOptions = Schmock.OpenApiCallbackOptions;
 export type SeedSource = Schmock.SeedSource;
 export type SeedConfig = Schmock.SeedConfig;
-export type CliOptions = Schmock.CliOptions;
-export type CliServer = Schmock.CliServer;
 export type AdapterRequest = Schmock.AdapterRequest;
 export type AdapterResponse = Schmock.AdapterResponse;
 export type InterceptOptions = Schmock.InterceptOptions;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACxC,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACxC,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;AAC9C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC1D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;AAChE,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AACpC,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACxD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;AACtD,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AACpC,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACxC,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACxC,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;AAC9C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC1D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;AAChE,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AACpC,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACxD,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC1D,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC1D,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;AACpE,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACxD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;AACtD,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC"}

package/package.json

@@ -1,13 +1,21 @@
 {
   "name": "@schmock/core",
   "description": "Core functionality for Schmock",
-  "version": "2.2.3",
+  "version": "2.3.1",
   "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/khalic-lab/schmock.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://github.com/khalic-lab/schmock/tree/main/packages/core#readme",
+  "bugs": {
+    "url": "https://github.com/khalic-lab/schmock/issues"
+  },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "exports": {
     ".": {
@@ -18,11 +26,12 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "build": "bun build:lib && bun build:types",
-    "build:lib": "bun build --minify --target node --outdir=dist src/index.ts",
+    "clean": "rm -rf dist && rm -f tsconfig.tsbuildinfo",
+    "build": "bun run clean && bun run build:lib && bun run build:types",
+    "build:lib": "tsc -p tsconfig.runtime.json",
     "build:types": "rm -f tsconfig.tsbuildinfo && tsc --build && node scripts/embed-ambient-types.js",
     "pretest": "rm -f src/*.js src/*.d.ts || true",
-    "test": "vitest",
+    "test": "vitest run",
     "test:watch": "vitest --watch",
     "pretest:bdd": "rm -f src/*.js src/*.d.ts || true",
     "test:bdd": "vitest run --config vitest.config.bdd.ts",
@@ -31,11 +40,12 @@
     "check:publish": "publint && attw --pack --ignore-rules cjs-resolves-to-esm"
   },
   "license": "MIT",
+  "dependencies": {
+    "@types/json-schema": "^7.0.15"
+  },
   "devDependencies": {
     "@amiceli/vitest-cucumber": "^7.0.0",
-    "@types/json-schema": "^7.0.15",
     "@types/node": "^26.1.0",
-    "@vitest/ui": "^4.1.9",
     "vitest": "^4.1.9"
   }
 }

package/src/audit-core-builder.test.ts

@@ -1,218 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { schmock } from "./index";
-
-// ── FIX 1.2: defineRoute must shallow-clone the config ────────────────────────
-
-describe("FIX 1.2 — defineRoute must not mutate the caller's config", () => {
-  it("does not add contentType to the caller's config object", () => {
-    const sharedConfig: Schmock.RouteConfig = {};
-    const mock = schmock();
-    mock("GET /a", { x: 1 }, sharedConfig);
-    // sharedConfig must remain empty — defineRoute must work on a clone
-    expect(Object.keys(sharedConfig)).toHaveLength(0);
-  });
-
-  it("second route registered with same config is not polluted by first route detection", () => {
-    const sharedConfig: Schmock.RouteConfig = {};
-    const mock = schmock();
-    mock("GET /first", { x: 1 }, sharedConfig);
-    mock("GET /second", "hello", sharedConfig);
-    // sharedConfig must still be clean — neither call should have written to it
-    expect(Object.keys(sharedConfig)).toHaveLength(0);
-  });
-
-  it("mutating caller's config after registration does not change the registered route response", async () => {
-    const config: Schmock.RouteConfig = {};
-    const mock = schmock();
-    mock("GET /item", { value: 99 }, config);
-
-    // After registration, mutate the caller's config
-    config.status = 503;
-    config.contentType = "text/html";
-
-    const response = await mock.handle("GET", "/item");
-    // The registered route must use its own cloned config — not 503
-    expect(response.status).toBe(200);
-    const ct =
-      response.headers?.["content-type"] ?? response.headers?.["Content-Type"];
-    expect(ct).toContain("application/json");
-  });
-
-  it("each route keeps its own detected contentType even when sharing the same config object", async () => {
-    const sharedConfig: Schmock.RouteConfig = {};
-    const mock = schmock();
-    // First route: object → application/json
-    mock("GET /obj", { value: 1 }, sharedConfig);
-    // Second route: primitive string → text/plain
-    mock("GET /str", "hello", sharedConfig);
-
-    const objResp = await mock.handle("GET", "/obj");
-    const strResp = await mock.handle("GET", "/str");
-
-    const ctObj =
-      objResp.headers?.["content-type"] ?? objResp.headers?.["Content-Type"];
-    const ctStr =
-      strResp.headers?.["content-type"] ?? strResp.headers?.["Content-Type"];
-
-    expect(ctObj).toContain("application/json");
-    expect(ctStr).toContain("text/plain");
-  });
-});
-
-// ── FIX 2.2: duplicate route detection must normalize trailing slash ──────────
-
-describe("FIX 2.2 — duplicate-route detection uses normalized paths", () => {
-  it("GET /users/ is treated as duplicate of GET /users", () => {
-    const mock = schmock();
-    mock("GET /users", [{ id: 1 }], {});
-    // Registering with trailing slash must not add a second route
-    mock("GET /users/", [{ id: 2 }], {});
-
-    const routes = mock.getRoutes();
-    const userRoutes = routes.filter(
-      (r) =>
-        r.method === "GET" && (r.path === "/users" || r.path === "/users/"),
-    );
-    expect(userRoutes).toHaveLength(1);
-  });
-
-  it("first registration wins — trailing-slash variant does not overwrite", async () => {
-    const mock = schmock();
-    mock("GET /items", [{ id: 1 }], {});
-    mock("GET /items/", [{ id: 999 }], {});
-
-    // Should still get the first registration's data
-    const resp = await mock.handle("GET", "/items");
-    expect(resp.status).toBe(200);
-    expect(Array.isArray(resp.body)).toBe(true);
-    expect((resp.body as { id: number }[])[0].id).toBe(1);
-  });
-
-  it("registering verbatim duplicate also produces only one route", () => {
-    const mock = schmock();
-    mock("GET /same", { ok: true }, {});
-    mock("GET /same", { ok: false }, {});
-
-    const routes = mock.getRoutes();
-    const sameRoutes = routes.filter(
-      (r) => r.method === "GET" && r.path === "/same",
-    );
-    expect(sameRoutes).toHaveLength(1);
-  });
-});
-
-// ── FIX 3.3: reset()/resetState() must reassign, not delete keys ─────────────
-
-describe("FIX 3.3 — reset()/resetState() must not mutate caller's state", () => {
-  it("reset() leaves the external state object untouched", () => {
-    const st = { a: 1 };
-    const mock = schmock({ state: st });
-    mock.reset();
-    expect(st).toEqual({ a: 1 });
-  });
-
-  it("resetState() leaves the external state object untouched", () => {
-    const st = { b: 2 };
-    const mock = schmock({ state: st });
-    mock.resetState();
-    expect(st).toEqual({ b: 2 });
-  });
-
-  it("mock.getState() is empty after reset()", () => {
-    const st = { x: 10 };
-    const mock = schmock({ state: st });
-    mock.reset();
-    expect(mock.getState()).toEqual({});
-  });
-
-  it("mock.getState() is empty after resetState()", () => {
-    const st = { y: 20 };
-    const mock = schmock({ state: st });
-    mock.resetState();
-    expect(mock.getState()).toEqual({});
-  });
-
-  it("generator sees empty state after resetState", async () => {
-    const st: Record<string, unknown> = { counter: 0 };
-    const mock = schmock({ state: st });
-    mock("GET /stateful", (ctx: Schmock.RequestContext) => {
-      return { stateKeys: Object.keys(ctx.state) };
-    });
-
-    mock.resetState();
-
-    const resp = await mock.handle("GET", "/stateful");
-    expect(resp.status).toBe(200);
-    // After resetState, the generator should see an empty state
-    expect((resp.body as { stateKeys: string[] }).stateKeys).toHaveLength(0);
-  });
-});
-
-// ── FIX 2.3: history()/lastRequest() must return deep clones ─────────────────
-
-describe("FIX 2.3 — history() and lastRequest() return deep clones", () => {
-  it("mutating a history() record's nested body does not corrupt internal history", async () => {
-    const mock = schmock();
-    mock("GET /nested", { deep: { value: "original" } }, {});
-
-    await mock.handle("GET", "/nested");
-
-    // First read: mutate the returned record's body
-    const records1 = mock.history();
-    const firstRecord = records1[0];
-    (firstRecord.response.body as { deep: { value: string } }).deep.value =
-      "MUTATED";
-
-    // Second read: internal history must be unchanged
-    const records2 = mock.history();
-    expect(
-      (records2[0].response.body as { deep: { value: string } }).deep.value,
-    ).toBe("original");
-  });
-
-  it("mutating filtered history() record does not corrupt internal history", async () => {
-    const mock = schmock();
-    mock("GET /data", { info: { count: 42 } }, {});
-    await mock.handle("GET", "/data");
-
-    const filtered = mock.history("GET", "/data");
-    (filtered[0].response.body as { info: { count: number } }).info.count = 0;
-
-    const again = mock.history("GET", "/data");
-    expect(
-      (again[0].response.body as { info: { count: number } }).info.count,
-    ).toBe(42);
-  });
-
-  it("mutating lastRequest() record does not corrupt internal history", async () => {
-    const mock = schmock();
-    mock("GET /last", { meta: { tag: "safe" } }, {});
-    await mock.handle("GET", "/last");
-
-    const last = mock.lastRequest();
-    if (!last) throw new Error("expected a record");
-    (last.response.body as { meta: { tag: string } }).meta.tag = "corrupted";
-
-    const again = mock.lastRequest();
-    if (!again) throw new Error("expected a record");
-    expect((again.response.body as { meta: { tag: string } }).meta.tag).toBe(
-      "safe",
-    );
-  });
-
-  it("mutating filtered lastRequest() record does not corrupt internal history", async () => {
-    const mock = schmock();
-    mock("POST /echo", { msg: { text: "hello" } }, {});
-    await mock.handle("POST", "/echo");
-
-    const last = mock.lastRequest("POST", "/echo");
-    if (!last) throw new Error("expected a record");
-    (last.response.body as { msg: { text: string } }).msg.text = "CHANGED";
-
-    const again = mock.lastRequest("POST", "/echo");
-    if (!again) throw new Error("expected a record");
-    expect((again.response.body as { msg: { text: string } }).msg.text).toBe(
-      "hello",
-    );
-  });
-});

package/src/audit-response-guard.test.ts

@@ -1,38 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { schmock } from "./index";
-
-describe("isResponseObject guard — status type check", () => {
-  describe("non-numeric status must NOT be treated as response envelope", () => {
-    it("returns status 200 (default) when generator returns { status: 'ok', body: 'hello' }", async () => {
-      const mock = schmock();
-      mock("GET /bad-envelope", () => ({ status: "ok", body: "hello" }));
-
-      const response = await mock.handle("GET", "/bad-envelope");
-
-      // The string status must never leak into response.status
-      expect(response.status).toBe(200);
-    });
-
-    it("returns the whole object as body when generator returns { status: 'ok', body: 'hello' }", async () => {
-      const mock = schmock();
-      mock("GET /bad-envelope-body", () => ({ status: "ok", body: "hello" }));
-
-      const response = await mock.handle("GET", "/bad-envelope-body");
-
-      // The original object must be treated as plain body, not unwrapped
-      expect(response.body).toEqual({ status: "ok", body: "hello" });
-    });
-  });
-
-  describe("numeric status IS correctly treated as response envelope", () => {
-    it("returns status 201 and unwrapped body when generator returns { status: 201, body: { id: 1 } }", async () => {
-      const mock = schmock();
-      mock("POST /create", () => ({ status: 201, body: { id: 1 } }));
-
-      const response = await mock.handle("POST", "/create");
-
-      expect(response.status).toBe(201);
-      expect(response.body).toEqual({ id: 1 });
-    });
-  });
-});