Reject an empty or dot path parameter

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smtpfast/sdk",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "The official SMTPfast SDK for Node.js and TypeScript.",
   "license": "MIT",
   "type": "module",

src/core.ts

@@ -81,6 +81,7 @@ export class Core {
 
   /** Make one API call and return the parsed body, or throw an APIError. */
   async call<R>(fn: SdkFn, args: object, options: RequestOptions = {}, idempotent = false): Promise<R> {
+    checkPath((args as { path?: Record<string, unknown> }).path);
     const maxRetries = options.maxRetries ?? this.#maxRetries;
     const headers: Record<string, string> = { ...options.headers };
     if (idempotent) {
@@ -142,6 +143,17 @@ export class Core {
 }
 
 /** How long to wait before retrying this response, or null for no retry. */
+// An id of "", "." or ".." would become a dot-segment that the URL parser
+// resolves, so the request would reach a different endpoint.
+function checkPath(path: Record<string, unknown> | undefined): void {
+  for (const [name, value] of Object.entries(path ?? {})) {
+    const text = typeof value === "string" || (typeof value === "number" && Number.isFinite(value)) ? String(value) : null;
+    if (text === null || text === "" || text === "." || text === "..") {
+      throw new SMTPfastError(`Invalid path parameter ${name}: ${JSON.stringify(value) ?? String(value)}`);
+    }
+  }
+}
+
 function retryDelay(response: Response, attempt: number, retryable: boolean): number | null {
   if (!RETRY_STATUS.has(response.status)) return null;
   const header = response.headers.get("Retry-After");

src/version.ts

@@ -1 +1 @@
-export const VERSION = "0.1.0";
+export const VERSION = "0.1.1";

test/client.test.ts

@@ -33,6 +33,14 @@ describe("requests", () => {
     expect(calls[0].url.pathname).toBe("/api/v1/inboxes/in%201/threads/th_2/emails/em%2F3/reply");
   });
 
+  it("rejects an empty or dot path parameter before any request", async () => {
+    const { client, calls } = mockClient([]);
+    for (const id of ["", ".", "..", [".."], { toString: () => ".." }, null, undefined]) {
+      await expect(client.emails.get(id as string)).rejects.toThrow(SMTPfastError);
+    }
+    expect(calls).toHaveLength(0);
+  });
+
   it("sends query parameters", async () => {
     const { client, calls } = mockClient([json({ data: [], has_more: false })]);
     await client.emails.list({ limit: 5, after: "em_9" });