capman 0.4.4 → 0.5.0

package/dist/esm/resolver.js

@@ -1,4 +1,7 @@
 import { logger } from './logger';
+function redactParams(params) {
+    return Object.fromEntries(Object.entries(params).map(([k, v]) => [k, v != null ? '[REDACTED]' : 'null']));
+}
 function checkPrivacy(capability, auth) {
     const level = capability.privacy.level;
     if (level === 'public')
@@ -43,17 +46,17 @@ export async function resolve(matchResult, params = {}, options = {}) {
     // ── Session param injection ───────────────────────────────────────────────
     // Inject auth.userId into any params marked as source: 'session'
     const enrichedParams = { ...params };
-    if (options.auth?.userId !== undefined) {
+    if (options.auth?.userId !== undefined && options.auth.userId !== '') {
         for (const param of capability.params) {
             if (param.source === 'session') {
                 enrichedParams[param.name] = options.auth.userId;
-                logger.debug(`Injected session param "${param.name}" = "${options.auth.userId}"`);
+                logger.debug(`Injected session param "${param.name}" (value redacted)`);
             }
         }
     }
     const resolver = capability.resolver;
     logger.info(`Resolving capability "${capability.id}" via ${resolver.type} resolver`);
-    logger.debug(`Params: ${JSON.stringify(params)}`);
+    logger.debug(`Params: ${JSON.stringify(redactParams(params))}`);
     logger.debug(`Options: baseUrl=${options.baseUrl} dryRun=${options.dryRun}`);
     try {
         switch (resolver.type) {
@@ -169,12 +172,20 @@ async function resolveApi(resolver, params, options) {
         };
     }
 }
+function validateNavParam(key, value) {
+    if (!/^[a-zA-Z0-9_\-]+$/.test(value)) {
+        throw new Error(`Nav param "${key}" contains invalid characters: "${value}". ` +
+            `Only alphanumeric, hyphens, and underscores are allowed.`);
+    }
+}
 function resolveNav(resolver, params) {
     let destination = resolver.destination;
     for (const [key, value] of Object.entries(params)) {
         if (value === null || value === undefined)
             continue;
-        destination = destination.replace(`{${key}}`, encodeURIComponent(String(value)));
+        const str = String(value);
+        validateNavParam(key, str);
+        destination = destination.replace(`{${key}}`, encodeURIComponent(str));
     }
     return { success: true, resolverType: 'nav', navTarget: destination };
 }

package/dist/esm/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.4.4";
+export declare const VERSION = "0.5.0";

package/dist/esm/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/version.js — do not edit manually
-export const VERSION = '0.4.4';
+export const VERSION = '0.5.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "capman",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "description": "Capability Manifest Engine — let AI agents interact with your app without navigating the UI",
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",