stubsmith 0.2.0 → 0.2.1

package/dist/index.d.cts

@@ -348,7 +348,7 @@ declare function install(options?: StubsmithOptions): StubsmithClient;
 /** True while an installed client exists and is not stopped. */
 declare function isInstalled(): boolean;
 
-declare const VERSION = "0.2.0";
+declare const VERSION = "0.2.1";
 
 interface FixturesOptions {
     /** Only `"status"`: at most one fixture per distinct HTTP status, newest first. */

package/dist/index.d.ts

@@ -348,7 +348,7 @@ declare function install(options?: StubsmithOptions): StubsmithClient;
 /** True while an installed client exists and is not stopped. */
 declare function isInstalled(): boolean;
 
-declare const VERSION = "0.2.0";
+declare const VERSION = "0.2.1";
 
 interface FixturesOptions {
     /** Only `"status"`: at most one fixture per distinct HTTP status, newest first. */

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/_version.ts
-var VERSION = "0.2.0";
+var VERSION = "0.2.1";
 
 // src/instrument.ts
 import http2 from "http";
@@ -86,6 +86,31 @@ function truncateUtf8Bytes(s, n) {
 // src/client.ts
 import { gzipSync } from "zlib";
 
+// src/endpoint.ts
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+var InsecureEndpointError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InsecureEndpointError";
+  }
+};
+function checkEndpoint(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    throw new InsecureEndpointError(
+      "stubsmith: the Stubsmith URL is not a valid URL; the SDK sends only to an https URL."
+    );
+  }
+  if (u.protocol === "https:" && u.hostname !== "") return;
+  if (u.protocol === "http:" && LOCAL_HOSTS.has(u.hostname)) return;
+  const shown = u.hostname ? `${u.protocol}//${u.hostname}` : u.protocol;
+  throw new InsecureEndpointError(
+    `stubsmith: refusing to send to ${shown}. The SDK sends only over https; plain http is allowed only for localhost, 127.0.0.1 and ::1.`
+  );
+}
+
 // src/internal/codepoint.ts
 function compareCodePoints(a, b) {
   const la = a.length;
@@ -2621,6 +2646,12 @@ function sendRequest(url, opts) {
       fail(err);
       return;
     }
+    try {
+      checkEndpoint(url);
+    } catch (err) {
+      fail(err);
+      return;
+    }
     const request = u.protocol === "https:" ? ORIGINAL_REQUEST.https : u.protocol === "http:" ? ORIGINAL_REQUEST.http : null;
     if (request === null) {
       fail(new Error(`unsupported protocol ${u.protocol}`));
@@ -2888,9 +2919,22 @@ var StubsmithClient = class _StubsmithClient {
     counters.set(this, this.counts);
     const env2 = readEnv();
     this.apiKey = options.apiKey || env2.apiKey;
-    this.enabled = Boolean(this.apiKey);
     this.url = options.url || env2.url || DEFAULT_URL;
     this.backendUrl = options.backendUrl || env2.backendUrl || DEFAULT_BACKEND_URL;
+    let secure = true;
+    if (this.apiKey) {
+      try {
+        checkEndpoint(this.url);
+        checkEndpoint(this.backendUrl);
+      } catch (err) {
+        secure = false;
+        try {
+          console.warn(`${err instanceof Error ? err.message : String(err)} Capture is off.`);
+        } catch {
+        }
+      }
+    }
+    this.enabled = Boolean(this.apiKey) && secure;
     this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const sr = options.sampleRate ?? 1;
     this.sampleRate = Number.isNaN(sr) ? 1 : Math.max(0, Math.min(1, sr));
@@ -3136,7 +3180,7 @@ var StubsmithClient = class _StubsmithClient {
         if (this.inflight === t) this.inflight = null;
       }
       reportIngestRefusal(res.body, res.status, this.debug);
-      if (res.status >= 400) {
+      if (res.status >= 300) {
         this.sendFailures++;
         debugLog(`send failed - status=${res.status} url=${this.url}`);
       }
@@ -3854,6 +3898,7 @@ async function fixturesBundle(spec, opts = {}) {
   const params = new URLSearchParams({ method: method.toUpperCase(), path: path3 });
   if (opts.distinct !== void 0) params.set("distinct", opts.distinct);
   if (opts.limit !== void 0) params.set("limit", String(opts.limit));
+  checkEndpoint(base);
   const url = `${base.replace(/\/+$/, "")}/v1/fixtures?${params.toString()}`;
   let res;
   try {
@@ -3928,6 +3973,7 @@ async function fetchOne(apiUrl, apiKey, method, p, samples) {
   if (method) params.set("method", method);
   if (p) params.set("path", p);
   if (samples !== null) params.set("samples", samples);
+  checkEndpoint(apiUrl);
   const qs = [...params].length > 0 ? `?${params.toString()}` : "";
   const url = `${apiUrl.replace(/\/+$/, "")}/v1/replay/bundle${qs}`;
   let res;