Encode dynamic API path values as segments

[0xmrma]

Summary

Encode all caller-provided values that are inserted into App Store Server API URL paths. This preserves each value as one path segment and prevents URL parsing from treating slashes, query delimiters, fragments, or dot segments as request-target syntax.

What changed

• Added a single encodePathSegment helper to AppStoreServerAPIClient.
• Applied it to every dynamic path component used by the client, including transaction identifiers, order identifiers, notification tokens, messaging identifiers, product IDs, locales, performance-test identifiers, and the transaction-history version.
• Added special handling for exact . and .. values because WHATWG URL parsing normalizes even their percent-encoded forms. These values are encoded again so they cannot remove or traverse URL path segments.
• Added regression coverage for slash-containing values, query and fragment delimiters, exact dot segments, and ordinary identifiers.

Behavioral effect

For normal identifiers such as com.example.product and en-US, the generated paths are unchanged. Values containing URL syntax characters are serialized as data inside one path segment, allowing the server to reject malformed identifiers without the client changing the structure of the request path.

This also keeps the public method boundary aligned with the request target: a value containing URL syntax characters remains data inside the parameter’s path segment instead of changing the structure of the request path.

Validation

• npm run build
• npm test -- --runInBand

Result: 20 test suites passed, 332 tests passed.