@cairnvibe/indexer 0.2.4 → 0.2.5

package/dist/manifest.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.assembleManifest = assembleManifest;
+exports.parseApiCall = parseApiCall;
 const node_child_process_1 = require("node:child_process");
 function assembleManifest(rootDir, facts, l2, l3) {
     const globalElements = facts.frameworkElements.map((el) => toManifestElement(el, l3.globalElements.find((e) => e.id === el.id), "present in the root layout"));
@@ -29,13 +30,23 @@ function assembleManifest(rootDir, facts, l2, l3) {
 }
 const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 /**
- * Turns l1-scan's traced `"POST /api/items/${id}"`-shaped string into
- * structured, executable data — this is what lets a `do` action actually
- * run (verb-executor.ts) instead of only ever describing itself. Only
- * real mutating methods count as an action; `"navigate ..."` (a Link) and
- * a bare GET aren't "do" material — see ApiCallSchema's doc comment in
+ * Turns l1-scan's traced `"POST /api/items"`-shaped string into structured,
+ * executable data — this is what lets a `do` action actually run
+ * (verb-executor.ts) instead of only ever describing itself. Only real
+ * mutating methods count as an action; `"navigate ..."` (a Link) and a bare
+ * GET aren't "do" material — see ApiCallSchema's doc comment in
  * @cairnvibe/core for the safety reasoning (bounded to calls a human
  * developer already wrote and shipped, nothing invented at runtime).
+ *
+ * Only accepts a clean, static, same-origin relative path. l1-scan.ts's URL
+ * capture falls back to a call's raw source text when the first argument
+ * isn't a plain string literal — for a template literal (a per-row action
+ * built as `` `/api/items/${id}/archive` ``) that's literal backticks and a
+ * "${...}" hole, not a real fetchable URL; for a bare identifier or some
+ * other expression it isn't a URL at all. Rejecting both instead of
+ * guessing at resolving them is what keeps this bounded to calls that are
+ * actually safe to fire as-is — see ApiCallSchema's doc comment for the
+ * real gap this leaves (per-row actions aren't auto-executable yet).
  */
 function parseApiCall(handlerCall) {
     if (!handlerCall)
@@ -47,6 +58,8 @@ function parseApiCall(handlerCall) {
     const url = handlerCall.slice(spaceIndex + 1);
     if (!MUTATING_METHODS.has(method) || !url)
         return null;
+    if (!/^\/[a-zA-Z0-9/_.-]*$/.test(url))
+        return null;
     return { method: method, url };
 }
 function toManifestElement(el, elDesc, baseEvidence) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cairnvibe/indexer",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Cairn's analyzer and installer (the `cairn` CLI) — scans Next.js source or crawls any running app, and scaffolds the backend either way.",
   "license": "MIT",
   "publishConfig": { "access": "public" },