@character-foundry/character-foundry 0.1.5 → 0.1.6

package/dist/charx.js

@@ -6,6 +6,7 @@ function toString(data) {
   return new TextDecoder().decode(data);
 }
 var isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+var LARGE_BUFFER_THRESHOLD = 1024 * 1024;
 function decode(base64) {
   if (isNode) {
     return new Uint8Array(Buffer.from(base64, "base64"));
@@ -802,12 +803,69 @@ async function readCharXAsync(data, options = {}) {
     assets: fetchedAssets
   };
 }
+var SAFE_ASSET_TYPES = /* @__PURE__ */ new Set([
+  "icon",
+  "user_icon",
+  "emotion",
+  "background",
+  "sound",
+  "video",
+  "custom",
+  "x-risu-asset",
+  "data",
+  "unknown"
+]);
+var SAFE_EXTENSIONS = /* @__PURE__ */ new Set([
+  // Images
+  "png",
+  "jpg",
+  "jpeg",
+  "webp",
+  "gif",
+  "avif",
+  "svg",
+  "bmp",
+  "ico",
+  // Audio
+  "mp3",
+  "wav",
+  "ogg",
+  "flac",
+  "m4a",
+  "aac",
+  "opus",
+  // Video
+  "mp4",
+  "webm",
+  "avi",
+  "mov",
+  "mkv",
+  // Data
+  "json",
+  "txt",
+  "bin"
+]);
 function getCharxCategory(mimetype) {
   if (mimetype.startsWith("image/")) return "images";
   if (mimetype.startsWith("audio/")) return "audio";
   if (mimetype.startsWith("video/")) return "video";
   return "other";
 }
+function sanitizeAssetType(type) {
+  const normalized = type.toLowerCase().replace(/[^a-z0-9-_]/g, "-");
+  if (SAFE_ASSET_TYPES.has(normalized)) {
+    return normalized;
+  }
+  const sanitized = normalized.replace(/[^a-z0-9]/g, "");
+  return sanitized || "custom";
+}
+function sanitizeExtension(ext) {
+  const normalized = ext.replace(/^\./, "").toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (SAFE_EXTENSIONS.has(normalized)) {
+    return normalized;
+  }
+  return "bin";
+}
 function sanitizeName(name, ext) {
   let safeName = name;
   if (safeName.toLowerCase().endsWith(`.${ext.toLowerCase()}`)) {
@@ -841,10 +899,12 @@ Import this file into SillyTavern, RisuAI, or other compatible applications.
   let assetCount = 0;
   for (let i = 0; i < assets.length; i++) {
     const asset = assets[i];
-    const mimetype = getMimeTypeFromExt(asset.ext);
+    const safeType = sanitizeAssetType(asset.type);
+    const safeExt = sanitizeExtension(asset.ext);
+    const mimetype = getMimeTypeFromExt(safeExt);
     const category = getCharxCategory(mimetype);
-    const safeName = sanitizeName(asset.name, asset.ext);
-    const assetPath = `assets/${asset.type}/${category}/${safeName}.${asset.ext}`;
+    const safeName = sanitizeName(asset.name, safeExt);
+    const assetPath = `assets/${safeType}/${category}/${safeName}.${safeExt}`;
     zipEntries[assetPath] = [asset.data, { level: compressionLevel }];
     assetCount++;
     if (emitXMeta && mimetype.startsWith("image/")) {
@@ -865,16 +925,18 @@ Import this file into SillyTavern, RisuAI, or other compatible applications.
   };
 }
 function transformAssetUris(card, assets) {
-  const transformed = JSON.parse(JSON.stringify(card));
+  const transformed = typeof structuredClone === "function" ? structuredClone(card) : JSON.parse(JSON.stringify(card));
   transformed.data.assets = assets.map((asset) => {
-    const mimetype = getMimeTypeFromExt(asset.ext);
+    const safeType = sanitizeAssetType(asset.type);
+    const safeExt = sanitizeExtension(asset.ext);
+    const mimetype = getMimeTypeFromExt(safeExt);
     const category = getCharxCategory(mimetype);
-    const safeName = sanitizeName(asset.name, asset.ext);
+    const safeName = sanitizeName(asset.name, safeExt);
     return {
       type: asset.type,
-      uri: `embeded://assets/${asset.type}/${category}/${safeName}.${asset.ext}`,
+      uri: `embeded://assets/${safeType}/${category}/${safeName}.${safeExt}`,
       name: safeName,
-      ext: asset.ext
+      ext: safeExt
     };
   });
   return transformed;