@schmock/core 2.3.0 → 2.4.0

package/dist/plugin-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-pipeline.d.ts","sourceRoot":"","sources":["../src/plugin-pipeline.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,UAAU,cAAc;IACtB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9D;AAED,UAAU,cAAc;IACtB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAqDD,kEAAkE;AAClE,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EACzB,OAAO,EAAE,OAAO,CAAC,aAAa,EAC9B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,cAAc,CAAC,CAiDzB;AAED,gFAAgF;AAChF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EACzB,OAAO,EAAE,OAAO,CAAC,aAAa,EAC9B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,cAAc,CAAC,CAUzB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EACzB,OAAO,EAAE,OAAO,CAAC,aAAa,EAC9B,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,cAAc,CAAC,CA0DzB"}
+{"version":3,"file":"plugin-pipeline.d.ts","sourceRoot":"","sources":["../src/plugin-pipeline.ts"],"names":[],"mappings":"AAGA,uEAAuE;AACvE,UAAU,cAAc;IACtB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9D;AAED,UAAU,cAAc;IACtB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAmED,kEAAkE;AAClE,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,EAAE,EAClC,OAAO,EAAE,OAAO,CAAC,aAAa,EAC9B,MAAM,EAAE,cAAc,EACtB,MAAM,0BAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAwDzB;AAED,gFAAgF;AAChF,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,EAAE,EAClC,OAAO,EAAE,OAAO,CAAC,aAAa,EAC9B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,cAAc,EACtB,MAAM,0BAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAmBzB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,EAAE,EAClC,OAAO,EAAE,OAAO,CAAC,aAAa,EAC9B,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,cAAc,EACtB,MAAM,0BAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAiEzB"}

package/dist/plugin-pipeline.js

@@ -1,3 +1,4 @@
+import { awaitWithAbort, throwIfAborted } from "./abort.js";
 import { errorMessage, PluginError } from "./errors.js";
 function isPluginResult(value) {
     return (typeof value === "object" &&
@@ -6,14 +7,19 @@ function isPluginResult(value) {
         typeof value.context === "object" &&
         value.context !== null);
 }
-async function recoverPluginError(plugins, startIndex, error, context, logger) {
+function preserveRequestSignal(context, signal) {
+    return context.signal === signal ? context : { ...context, signal };
+}
+async function recoverPluginError(plugins, startIndex, error, context, logger, signal) {
     let currentError = error instanceof Error ? error : new Error(errorMessage(error));
     for (let index = startIndex; index < plugins.length; index += 1) {
+        throwIfAborted(signal);
         const plugin = plugins[index];
         if (!plugin.onError)
             continue;
         try {
-            const errorResult = await plugin.onError(currentError, context);
+            const errorResult = await awaitWithAbort(plugin.onError(currentError, context), signal);
+            throwIfAborted(signal);
             if (errorResult instanceof Error) {
                 currentError = errorResult;
                 continue;
@@ -24,6 +30,7 @@ async function recoverPluginError(plugins, startIndex, error, context, logger) {
             }
         }
         catch (hookError) {
+            throwIfAborted(signal);
             currentError =
                 hookError instanceof Error
                     ? hookError
@@ -34,21 +41,23 @@ async function recoverPluginError(plugins, startIndex, error, context, logger) {
     return { handled: false, error: currentError };
 }
 /** Run request guards before route code is allowed to execute. */
-export async function runPluginBeforeRequest(plugins, context, logger) {
-    let currentContext = context;
+export async function runPluginBeforeRequest(plugins, context, logger, signal = context.signal) {
+    let currentContext = preserveRequestSignal(context, signal);
     for (let index = 0; index < plugins.length; index += 1) {
+        throwIfAborted(signal);
         const plugin = plugins[index];
         if (!plugin.beforeRequest)
             continue;
         logger.log("pipeline", `Running beforeRequest: ${plugin.name}`);
         try {
-            const result = await plugin.beforeRequest(currentContext);
+            const result = await awaitWithAbort(plugin.beforeRequest(currentContext), signal);
+            throwIfAborted(signal);
             if (result === undefined)
                 continue;
             if (!isPluginResult(result)) {
                 throw new Error(`Plugin ${plugin.name} didn't return valid result`);
             }
-            currentContext = result.context;
+            currentContext = preserveRequestSignal(result.context, signal);
             if (result.response !== undefined) {
                 logger.log("pipeline", `Plugin ${plugin.name} rejected request`);
                 return {
@@ -59,8 +68,9 @@ export async function runPluginBeforeRequest(plugins, context, logger) {
             }
         }
         catch (error) {
+            throwIfAborted(signal);
             logger.log("pipeline", `Plugin ${plugin.name} beforeRequest failed: ${errorMessage(error)}`);
-            const recovery = await recoverPluginError(plugins, index, error, currentContext, logger);
+            const recovery = await recoverPluginError(plugins, index, error, currentContext, logger, signal);
             if (recovery.handled) {
                 return {
                     context: currentContext,
@@ -75,8 +85,10 @@ export async function runPluginBeforeRequest(plugins, context, logger) {
     return { context: currentContext };
 }
 /** Give pipeline error handlers a chance to recover a route-generator error. */
-export async function recoverGeneratorError(plugins, context, error, logger) {
-    const recovery = await recoverPluginError(plugins, 0, error, context, logger);
+export async function recoverGeneratorError(plugins, context, error, logger, signal = context.signal) {
+    throwIfAborted(signal);
+    const recovery = await recoverPluginError(plugins, 0, error, context, logger, signal);
+    throwIfAborted(signal);
     if (recovery.handled) {
         return {
             context,
@@ -91,19 +103,21 @@ export async function recoverGeneratorError(plugins, context, error, logger) {
  * First plugin to set response becomes generator, subsequent plugins transform
  * Handles plugin errors via onError hooks
  */
-export async function runPluginPipeline(plugins, context, initialResponse, logger) {
-    let currentContext = context;
+export async function runPluginPipeline(plugins, context, initialResponse, logger, signal = context.signal) {
+    let currentContext = preserveRequestSignal(context, signal);
     let response = initialResponse;
     logger.log("pipeline", `Running plugin pipeline for ${plugins.length} plugins`);
     for (let index = 0; index < plugins.length; index += 1) {
+        throwIfAborted(signal);
         const plugin = plugins[index];
         logger.log("pipeline", `Processing plugin: ${plugin.name}`);
         try {
-            const result = await plugin.process(currentContext, response);
+            const result = await awaitWithAbort(plugin.process(currentContext, response), signal);
+            throwIfAborted(signal);
             if (!isPluginResult(result)) {
                 throw new Error(`Plugin ${plugin.name} didn't return valid result`);
             }
-            currentContext = result.context;
+            currentContext = preserveRequestSignal(result.context, signal);
             // First plugin to set response becomes the generator
             if (result.response !== undefined &&
                 (response === undefined || response === null)) {
@@ -116,8 +130,9 @@ export async function runPluginPipeline(plugins, context, initialResponse, logge
             }
         }
         catch (error) {
+            throwIfAborted(signal);
             logger.log("pipeline", `Plugin ${plugin.name} failed: ${errorMessage(error)}`);
-            const recovery = await recoverPluginError(plugins, index, error, currentContext, logger);
+            const recovery = await recoverPluginError(plugins, index, error, currentContext, logger, signal);
             if (recovery.handled) {
                 return {
                     context: currentContext,

package/dist/response-normalizer.d.ts

@@ -0,0 +1,16 @@
+type OwnedBytes = ReturnType<typeof Uint8Array.of>;
+interface NormalizableResponse {
+    status: number;
+    body: unknown;
+    headers?: Record<string, string>;
+}
+/**
+ * Validate and stabilize a response before it reaches a transport adapter.
+ */
+export declare function normalizeResponse(response: NormalizableResponse, method: string): Schmock.Response;
+/**
+ * Encode a response body using its normalized content type semantics.
+ */
+export declare function serializeResponseBody(response: Schmock.Response): OwnedBytes | undefined;
+export {};
+//# sourceMappingURL=response-normalizer.d.ts.map

package/dist/response-normalizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-normalizer.d.ts","sourceRoot":"","sources":["../src/response-normalizer.ts"],"names":[],"mappings":"AAwBA,KAAK,UAAU,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;AAEnD,UAAU,oBAAoB;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAmSD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,QAAQ,CAmClB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ,GACzB,UAAU,GAAG,SAAS,CAcxB"}

package/dist/response-normalizer.js

@@ -0,0 +1,316 @@
+import { isBinaryBody } from "./binary.js";
+import { errorMessage, InvalidResponseError } from "./errors.js";
+const BODY_FORBIDDEN_STATUSES = new Set([204, 205, 304]);
+const HEADER_NAME_PATTERN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const FRAMING_HEADERS = new Set([
+    "content-length",
+    "trailer",
+    "transfer-encoding",
+]);
+/**
+ * Headers that describe the connection rather than the message (RFC 9110 §7.6.1).
+ * Kept separate from {@link FRAMING_HEADERS}, which is parameterised by
+ * `preserveContentLength`: these are never a route's to send, so the strip is
+ * unconditional.
+ */
+const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "upgrade",
+]);
+function hasInvalidHeaderValue(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 8 || (code >= 10 && code <= 31) || code === 127)
+            return true;
+    }
+    return false;
+}
+function validateStatus(status) {
+    if (typeof status !== "number" ||
+        !Number.isFinite(status) ||
+        !Number.isInteger(status) ||
+        status < 200 ||
+        status > 599) {
+        throw new InvalidResponseError("status must be a finite integer from 200 through 599", { status });
+    }
+}
+function headerEntries(headers) {
+    if (typeof headers !== "object" ||
+        headers === null ||
+        Array.isArray(headers)) {
+        throw new InvalidResponseError("headers must be a string record");
+    }
+    try {
+        const entries = [];
+        for (const name of Reflect.ownKeys(headers)) {
+            const descriptor = Object.getOwnPropertyDescriptor(headers, name);
+            if (!descriptor?.enumerable)
+                continue;
+            if (typeof name !== "string") {
+                throw new InvalidResponseError("header names must be strings");
+            }
+            const value = headers[name];
+            if (typeof value !== "string") {
+                throw new InvalidResponseError("header values must be strings", {
+                    headerName: name,
+                });
+            }
+            entries.push([name, value]);
+        }
+        return entries;
+    }
+    catch (error) {
+        if (error instanceof InvalidResponseError)
+            throw error;
+        throw new InvalidResponseError("headers could not be read", {
+            cause: errorMessage(error),
+        });
+    }
+}
+function normalizeHeadersWithPlatform(entries, PlatformHeaders) {
+    try {
+        const normalized = {};
+        for (const [name, value] of entries) {
+            try {
+                const headers = new PlatformHeaders([[name, value]]);
+                normalized[name] = headers.get(name) ?? value;
+            }
+            catch (error) {
+                throw new InvalidResponseError("header is invalid", {
+                    cause: errorMessage(error),
+                    headerName: name,
+                });
+            }
+        }
+        return normalized;
+    }
+    catch (error) {
+        if (error instanceof InvalidResponseError)
+            throw error;
+        throw new InvalidResponseError("headers could not be normalized", {
+            cause: errorMessage(error),
+        });
+    }
+}
+function normalizeHeadersWithoutPlatform(entries) {
+    const normalized = {};
+    for (const [name, value] of entries) {
+        if (!HEADER_NAME_PATTERN.test(name) || hasInvalidHeaderValue(value)) {
+            throw new InvalidResponseError("header is invalid", {
+                headerName: name,
+            });
+        }
+        normalized[name] = value.replace(/^[\t ]+|[\t ]+$/g, "");
+    }
+    return normalized;
+}
+function normalizeHeaders(headers) {
+    const entries = headerEntries(headers);
+    const seenNames = new Set();
+    for (const [name, value] of entries) {
+        const normalizedName = name.toLowerCase();
+        if (seenNames.has(normalizedName)) {
+            throw new InvalidResponseError("header names must be unique", {
+                headerName: name,
+            });
+        }
+        if (!HEADER_NAME_PATTERN.test(name) || hasInvalidHeaderValue(value)) {
+            throw new InvalidResponseError("header is invalid", {
+                headerName: name,
+            });
+        }
+        seenNames.add(normalizedName);
+    }
+    const PlatformHeaders = globalThis.Headers;
+    return typeof PlatformHeaders === "function"
+        ? normalizeHeadersWithPlatform(entries, PlatformHeaders)
+        : normalizeHeadersWithoutPlatform(entries);
+}
+function copyBinaryBody(body) {
+    try {
+        if (body instanceof Uint8Array) {
+            // Uint8Array.prototype.slice species-creates, so subclasses such as
+            // Node's Buffer keep their type while the bytes are still copied.
+            // body.slice() would not: Buffer overrides slice() to return a view.
+            return Uint8Array.prototype.slice.call(body);
+        }
+        const source = body instanceof ArrayBuffer
+            ? new Uint8Array(body)
+            : new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+        return Uint8Array.from(source);
+    }
+    catch (error) {
+        throw new InvalidResponseError("binary body could not be copied", {
+            cause: errorMessage(error),
+        });
+    }
+}
+function bodyType(value) {
+    if (value === null)
+        return "null";
+    if (typeof value !== "object")
+        return typeof value;
+    try {
+        return Object.prototype.toString.call(value);
+    }
+    catch {
+        return "object";
+    }
+}
+function hasFunctionProperty(value, property) {
+    return typeof Reflect.get(value, property) === "function";
+}
+function assertJsonCompatible(value) {
+    if (value === null)
+        return;
+    switch (typeof value) {
+        case "boolean":
+        case "string":
+            return;
+        case "number":
+            if (Number.isFinite(value))
+                return;
+            throw new InvalidResponseError("body contains a non-finite number", {
+                bodyType: "number",
+            });
+        case "undefined":
+        case "function":
+        case "symbol":
+        case "bigint":
+            throw new InvalidResponseError(`body contains an unsupported ${typeof value} value`, { bodyType: typeof value });
+        case "object":
+            break;
+    }
+    try {
+        if (isBinaryBody(value)) {
+            throw new InvalidResponseError("binary values are supported only as the top-level body", { bodyType: bodyType(value) });
+        }
+        if (hasFunctionProperty(value, "then") ||
+            hasFunctionProperty(value, "getReader") ||
+            hasFunctionProperty(value, "getWriter") ||
+            (hasFunctionProperty(value, "pipe") &&
+                hasFunctionProperty(value, "on")) ||
+            hasFunctionProperty(value, Symbol.asyncIterator)) {
+            throw new InvalidResponseError("promise, iterable, and stream bodies are unsupported", { bodyType: bodyType(value) });
+        }
+        for (const key of Reflect.ownKeys(value)) {
+            if (typeof key === "symbol" &&
+                Object.getOwnPropertyDescriptor(value, key)?.enumerable) {
+                throw new InvalidResponseError("body contains an enumerable symbol property", { bodyType: bodyType(value) });
+            }
+        }
+        if (!Array.isArray(value) &&
+            Object.prototype.toString.call(value) !== "[object Object]") {
+            throw new InvalidResponseError("body contains an unsupported object", {
+                bodyType: bodyType(value),
+            });
+        }
+    }
+    catch (error) {
+        if (error instanceof InvalidResponseError)
+            throw error;
+        throw new InvalidResponseError("body could not be inspected", {
+            bodyType: bodyType(value),
+            cause: errorMessage(error),
+        });
+    }
+}
+function stringifyJsonBody(body) {
+    try {
+        const serialized = JSON.stringify(body, (_key, value) => {
+            assertJsonCompatible(value);
+            return value;
+        });
+        if (serialized !== undefined)
+            return serialized;
+        throw new InvalidResponseError("body did not produce JSON", {
+            bodyType: bodyType(body),
+        });
+    }
+    catch (error) {
+        if (error instanceof InvalidResponseError)
+            throw error;
+        throw new InvalidResponseError("body is not JSON-serializable", {
+            bodyType: bodyType(body),
+            cause: errorMessage(error),
+        });
+    }
+}
+function normalizeBody(body) {
+    if (body === undefined || typeof body === "string")
+        return body;
+    if (isBinaryBody(body))
+        return copyBinaryBody(body);
+    return JSON.parse(stringifyJsonBody(body));
+}
+function removeFramingHeaders(headers, preserveContentLength = false) {
+    for (const name of Object.keys(headers)) {
+        const normalizedName = name.toLowerCase();
+        if (FRAMING_HEADERS.has(normalizedName) &&
+            !(preserveContentLength && normalizedName === "content-length")) {
+            delete headers[name];
+        }
+    }
+}
+function removeHopByHopHeaders(headers) {
+    for (const name of Object.keys(headers)) {
+        if (HOP_BY_HOP_HEADERS.has(name.toLowerCase()))
+            delete headers[name];
+    }
+}
+/**
+ * Validate and stabilize a response before it reaches a transport adapter.
+ */
+export function normalizeResponse(response, method) {
+    const status = response.status;
+    validateStatus(status);
+    const headers = normalizeHeaders(response.headers ?? {});
+    const normalizedMethod = method.toUpperCase();
+    const body = normalizedMethod === "HEAD" || BODY_FORBIDDEN_STATUSES.has(status)
+        ? undefined
+        : normalizeBody(response.body);
+    // HEAD and 304 may keep an entity Content-Length (RFC 9110), but 204/205
+    // never carry one. Trailer and Transfer-Encoding are always removed —
+    // Node's writeHead rejects them on bodyless responses, killing the socket
+    // before any bytes reach the client.
+    if (status === 204 || status === 205) {
+        removeFramingHeaders(headers);
+    }
+    else {
+        removeFramingHeaders(headers, normalizedMethod === "HEAD" || status === 304);
+    }
+    // A hop-by-hop header belongs to the connection, which the transport owns:
+    // a route that emits `Connection: close` announces a close the server will
+    // not perform, and a conformant client then discards the next response on
+    // that socket. Adapters that genuinely mean it (an ingress rejection) add it
+    // after normalization, through their own extra-headers channel.
+    removeHopByHopHeaders(headers);
+    return {
+        status,
+        body,
+        headers,
+    };
+}
+/**
+ * Encode a response body using its normalized content type semantics.
+ */
+export function serializeResponseBody(response) {
+    const status = response.status;
+    validateStatus(status);
+    if (BODY_FORBIDDEN_STATUSES.has(status))
+        return undefined;
+    const body = response.body;
+    if (body === undefined)
+        return undefined;
+    if (isBinaryBody(body))
+        return copyBinaryBody(body);
+    // A string body is treated as pre-serialized wire bytes regardless of
+    // content type: quoting it under application/json would double-encode
+    // routes that return JSON.stringify(...) themselves.
+    const serialized = typeof body === "string" ? body : stringifyJsonBody(body);
+    return new TextEncoder().encode(serialized);
+}

package/dist/response-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-parser.d.ts","sourceRoot":"","sources":["../src/response-parser.ts"],"names":[],"mappings":"AAoCA;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,OAAO,CAAC,WAAW,GAC/B,OAAO,CAAC,QAAQ,CAsElB"}
+{"version":3,"file":"response-parser.d.ts","sourceRoot":"","sources":["../src/response-parser.ts"],"names":[],"mappings":"AAwEA;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,OAAO,CAAC,WAAW,GAC/B,OAAO,CAAC,QAAQ,CAuElB"}

package/dist/response-parser.js

@@ -1,12 +1,47 @@
 import { isBinaryBody } from "./binary.js";
 import { isStatusTuple } from "./constants.js";
+import { InvalidResponseError } from "./errors.js";
 const BINARY_CONTENT_TYPE = "application/octet-stream";
+/**
+ * Take ownership of caller-supplied response headers.
+ *
+ * Parsing injects a content type into the header record, so the caller's object
+ * must never be aliased — a generator reusing a module-level header object would
+ * otherwise leak the content type of one response into the next. Only the shape
+ * is checked here; per-value type checks stay in `normalizeResponse` so its
+ * distinct messages ("header names/values must be strings") are preserved.
+ */
+function toOwnHeaderRecord(value) {
+    if (value === undefined)
+        return {};
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new InvalidResponseError("headers must be a string record");
+    }
+    // Per-value types are `normalizeResponse`'s job (it keeps its own distinct
+    // message), so a non-string value is carried through here rather than
+    // rejected; this pass only shape-checks and detaches the caller's object.
+    const record = {};
+    Object.assign(record, value);
+    return record;
+}
 function hasContentType(headers) {
     return Object.keys(headers).some((header) => header.toLowerCase() === "content-type");
 }
+/**
+ * Detect the object response envelope `{ status, body, headers? }`.
+ *
+ * Detection is by shape, so a legitimate domain object carrying a numeric
+ * `status` next to a `body` is unwrapped instead of being delivered as the
+ * payload. Callers who need to return such a shape as data should nest it or
+ * use an explicit `[status, body]` tuple for the envelope. An object whose
+ * `headers` is present but not a string record is deliberately NOT an envelope
+ * and is delivered whole — plugins that inspect responses must use this same
+ * rule (see `@schmock/validation`) or they will judge an undelivered payload.
+ */
 function isResponseObject(value) {
     return (typeof value === "object" &&
         value !== null &&
+        !Array.isArray(value) &&
         "status" in value &&
         typeof value.status === "number" &&
         "body" in value &&
@@ -17,6 +52,7 @@ function isResponseObject(value) {
 function isStringRecord(value) {
     return (typeof value === "object" &&
         value !== null &&
+        !Array.isArray(value) &&
         Object.values(value).every((entry) => typeof entry === "string"));
 }
 /**
@@ -32,12 +68,13 @@ export function parseResponse(result, routeConfig) {
     if (isResponseObject(result)) {
         status = result.status;
         body = result.body;
-        headers = result.headers ?? {};
+        headers = toOwnHeaderRecord(result.headers);
         tupleFormat = true;
     }
     else if (isStatusTuple(result)) {
         // Handle tuple response format [status, body, headers?]
-        [status, body, headers = {}] = result;
+        [status, body] = result;
+        headers = toOwnHeaderRecord(result[2]);
         tupleFormat = true;
     }
     // Handle null/undefined responses with 204 No Content

package/dist/route-matcher.d.ts

@@ -19,6 +19,9 @@ export declare function findRoute(method: Schmock.HttpMethod, path: string, stat
 /**
  * Extract parameter values from path based on route pattern
  * Maps capture groups from regex match to parameter names
+ *
+ * Matching runs on the ENCODED path so `%2F` cannot act as a separator;
+ * captures are decoded afterwards, so a generator receives readable values.
  */
 export declare function extractParams(route: CompiledCallableRoute, path: string): Record<string, string>;
 //# sourceMappingURL=route-matcher.d.ts.map

package/dist/route-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../src/route-matcher.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;IAC7B,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;CAC7B;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,CAAC,SAAS,GACrB,GAAG,IAAI,OAAO,CAAC,iBAAiB,CAElC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,OAAO,CAAC,UAAU,EAC1B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAChD,MAAM,EAAE,qBAAqB,EAAE,GAC9B,qBAAqB,GAAG,SAAS,CAmBnC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUxB"}
+{"version":3,"file":"route-matcher.d.ts","sourceRoot":"","sources":["../src/route-matcher.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC;IAC7B,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC;CAC7B;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,CAAC,SAAS,GACrB,GAAG,IAAI,OAAO,CAAC,iBAAiB,CAElC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,OAAO,CAAC,UAAU,EAC1B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAChD,MAAM,EAAE,qBAAqB,EAAE,GAC9B,qBAAqB,GAAG,SAAS,CAmBnC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,qBAAqB,EAC5B,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB"}

package/dist/route-matcher.js

@@ -1,4 +1,4 @@
-import { normalizePath } from "./constants.js";
+import { decodePathSegment, normalizePath } from "./constants.js";
 export function isGeneratorFunction(gen) {
     return typeof gen === "function";
 }
@@ -26,14 +26,20 @@ export function findRoute(method, path, staticRoutes, routes) {
 /**
  * Extract parameter values from path based on route pattern
  * Maps capture groups from regex match to parameter names
+ *
+ * Matching runs on the ENCODED path so `%2F` cannot act as a separator;
+ * captures are decoded afterwards, so a generator receives readable values.
  */
 export function extractParams(route, path) {
     const match = path.match(route.pattern);
     if (!match)
         return {};
-    const params = {};
-    route.params.forEach((param, index) => {
-        params[param] = match[index + 1];
-    });
-    return params;
+    // Object.fromEntries defines own properties, so a parameter named
+    // `__proto__` (or any other Object.prototype key) survives instead of being
+    // swallowed by the prototype setter. The prototype itself is retained so
+    // generators can still call params.hasOwnProperty(...).
+    return Object.fromEntries(route.params.map((param, index) => [
+        param,
+        decodePathSegment(match[index + 1]),
+    ]));
 }

package/dist/types.d.ts

@@ -1,3 +1,5 @@
+export type Schema = Schmock.Schema;
+export type SchemaDefinition = Schmock.SchemaDefinition;
 export type HttpMethod = Schmock.HttpMethod;
 export type RouteKey = Schmock.RouteKey;
 export type ResponseBody = Schmock.ResponseBody;
@@ -17,15 +19,18 @@ export type StaticData = Schmock.StaticData;
 export type RequestRecord = Schmock.RequestRecord;
 export type ServerInfo = Schmock.ServerInfo;
 export type RouteInfo = Schmock.RouteInfo;
+export type ResourceOverride = Schmock.ResourceOverride;
+export type ResponseHeaderDef = Schmock.ResponseHeaderDef;
+export type CrudOperationMeta = Schmock.CrudOperationMeta;
 export type SchemaGenerationContext = Schmock.SchemaGenerationContext;
 export type FakerPluginOptions = Schmock.FakerPluginOptions;
 export type ExpressAdapterOptions = Schmock.ExpressAdapterOptions;
 export type AngularAdapterOptions = Schmock.AngularAdapterOptions;
 export type OpenApiOptions = Schmock.OpenApiOptions;
+export type OpenApiCallbackRequest = Schmock.OpenApiCallbackRequest;
+export type OpenApiCallbackOptions = Schmock.OpenApiCallbackOptions;
 export type SeedSource = Schmock.SeedSource;
 export type SeedConfig = Schmock.SeedConfig;
-export type CliOptions = Schmock.CliOptions;
-export type CliServer = Schmock.CliServer;
 export type AdapterRequest = Schmock.AdapterRequest;
 export type AdapterResponse = Schmock.AdapterResponse;
 export type InterceptOptions = Schmock.InterceptOptions;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACxC,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACxC,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;AAC9C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC1D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;AAChE,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AACpC,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACxD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;AACtD,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AACpC,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACxC,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;AACxC,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;AAC9C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC1D,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;AAChE,MAAM,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;AACpC,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;AAChD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;AAClD,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;AAC1C,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACxD,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC1D,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAC1D,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;AAC5D,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAClE,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;AACpE,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;AAC5C,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AACpD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;AACxD,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;AACtD,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC"}