{"record":{"id":"ec3acaeacd825ea4","repo":"JuliusBrussee/caveman","slug":"label-must-use-https-plain-http-is-allowed-onl","errorCode":null,"errorMessage":"${label} must use https (plain http is allowed only for localhost)","messagePattern":"(.+?) must use https \\(plain http is allowed only for localhost\\)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/mastra/src/index.ts","lineNumber":828,"sourceCode":"function requireNonEmpty(value: string | undefined, label: string): string {\n  if (typeof value !== \"string\" || value.trim() === \"\") throw new Error(`${label} is required`);\n  return value.trim();\n}\n\nfunction requireBaseUrl(value: string | undefined, label: string): string {\n  const raw = requireNonEmpty(value, label);\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error(`${label} must be an absolute http(s) URL`);\n  }\n  // Credentials ride every request to this host. Plain http is allowed only\n  // for loopback development targets — anywhere else the key or session token\n  // would transit unencrypted to a caller-chosen host.\n  const loopback = parsed.hostname === \"localhost\" || parsed.hostname === \"127.0.0.1\" || parsed.hostname === \"::1\" || parsed.hostname === \"[::1]\";\n  if (parsed.protocol === \"http:\" && !loopback) {\n    throw new Error(`${label} must use https (plain http is allowed only for localhost)`);\n  }\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    throw new Error(`${label} must be an absolute http(s) URL`);\n  }\n  return trimTrailingSlashes(raw);\n}\n\nfunction trimTrailingSlashes(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction isObject(value: unknown): value is object {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (!isObject(value) || Array.isArray(value)) return false;\n  const proto: unknown = Object.getPrototypeOf(value);","sourceCodeStart":810,"sourceCodeEnd":846,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/packages/mastra/src/index.ts#L810-L846","documentation":"Error \"${label} must use https (plain http is allowed only for localhost)\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at packages/mastra/src/index.ts:828 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use https for the URL; plain http is allowed only for localhost."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}