[RishavTiwari25]

Problem

Path parameters go into the URL as they are passed (f"/domains/{domain_id}"). Both HTTP clients the SDK uses resolve . and .. segments before sending the request:

>>> urllib3.util.parse_url("https://api.resend.com/domains/../api-keys/k").path
'/api-keys/k'
>>> httpx.URL("https://api.resend.com/domains/../api-keys/k").path
'/api-keys/k'

So when an app passes user input as an id, the call can leave its own endpoint:

• resend.Emails.cancel("..") sends POST /cancel
• resend.Domains.remove("../api-keys/KEY_ID") sends DELETE /api-keys/KEY_ID, which deletes an API key

resend-node fixed the same problem in resend/resend-node#1139. This PR ports that fix to Python.

Fix

Request.perform() and AsyncRequest.perform() now call ensure_no_dot_segments(self.path) before making the request. If any path segment is . or .., it raises ValueError("Path parameters cannot be .or...") and nothing is sent. The percent-encoded forms (%2E%2E, .%2e) count too, because servers decode them into the same dot segments. The check reuses the regex from the Node SDK and ignores the query string and the fragment.

I used ValueError because the ResendError docstring says that client-side argument errors raise ValueError, and Webhooks.verify already does the same. I can switch it to a ResendError subclass if you'd rather match the Node invalid_parameter error.

Nothing that works today changes. A dot segment always reached the wrong endpoint. Ids that only contain dots (example.com, ..., john.doe@example.com) are still sent as they are.

Tests

tests/dot_segment_path_test.py:

• Emails.get(".."), Emails.cancel(".."), Domains.remove("."), Domains.remove("../api-keys/key_id") and Domains.get("%2E%2E") raise and never reach the HTTP client. The same goes for Domains.remove_async. All six fail on main.
• Dotted ids are still sent.
• has_dot_segment gets the same table of cases as has-dot-segment.spec.ts in resend-node.

pytest tests              # 870 passed
black / isort / flake8 --max-line-length=130 ./resend/   # clean
mypy --ignore-missing-imports resend/                    # no issues