# ApiVault v0.5.0 — Runtime Test Lab Hardening

This release hardens ApiVault's runtime test lab while preserving the existing security model.

## Added

- Argument builder with conservative string-to-Lua conversion.
- Explicit argument prefixes: `str:`, `number:`, `bool:`.
- Safer return serializer with caps:
  - max table depth
  - max table keys
  - max string length
  - max returned values
- Recursive table detection.
- Frame/userdata-like object summarizer.
- Runtime test history stored as capped SavedVariables metadata.
- Blocked reason panel through `/av testlab`.
- Test Lab button in the API detail view.

## Security policy

ApiVault does not enable protected or secure execution.

Blocked behavior remains blocked:

- protected API calls
- metadata-only ScriptObject methods
- secure-sensitive linked APIs
- restricted/review APIs unless manually allowed out of combat
- restricted/review APIs while in combat

The test history stores only summarized text. Full return tables are not persisted.

## Commands

```text
/av testlab
/av tests
/av testhistory
/av runtime
/av lab
```

## Notes

The argument builder does not execute Lua table literals and does not use `loadstring`.
Table-typed arguments are passed as strings unless the user explicitly enters `nil` for a nilable argument.
