@character-foundry/character-foundry 0.4.2 → 0.4.3-dev.1766019473

package/dist/exporter.cjs

@@ -276,7 +276,7 @@ var CCv2LorebookEntrySchema = import_zod2.z.object({
   selective: import_zod2.z.boolean().nullable().optional(),
   secondary_keys: import_zod2.z.array(import_zod2.z.string()).nullable().optional(),
   constant: import_zod2.z.boolean().nullable().optional(),
-  position: import_zod2.z.union([import_zod2.z.enum(["before_char", "after_char"]), import_zod2.z.number().int(), import_zod2.z.literal("")]).nullable().optional()
+  position: import_zod2.z.union([import_zod2.z.enum(["before_char", "after_char", "in_chat"]), import_zod2.z.number().int(), import_zod2.z.literal("")]).nullable().optional()
 }).passthrough();
 var CCv2CharacterBookSchema = import_zod2.z.object({
   name: import_zod2.z.string().optional(),
@@ -329,7 +329,7 @@ var CCv3LorebookEntrySchema = import_zod3.z.object({
   selective: import_zod3.z.boolean().nullable().optional(),
   secondary_keys: import_zod3.z.array(import_zod3.z.string()).nullable().optional(),
   constant: import_zod3.z.boolean().nullable().optional(),
-  position: import_zod3.z.union([import_zod3.z.enum(["before_char", "after_char"]), import_zod3.z.number().int(), import_zod3.z.literal("")]).nullable().optional(),
+  position: import_zod3.z.union([import_zod3.z.enum(["before_char", "after_char", "in_chat"]), import_zod3.z.number().int(), import_zod3.z.literal("")]).nullable().optional(),
   extensions: import_zod3.z.record(import_zod3.z.unknown()).optional(),
   // v3 specific - also lenient with types since SillyTavern uses numbers for enums
   automation_id: import_zod3.z.string().optional(),
@@ -546,36 +546,6 @@ var SAFE_ASSET_TYPES = /* @__PURE__ */ new Set([
   "data",
   "unknown"
 ]);
-var SAFE_EXTENSIONS = /* @__PURE__ */ new Set([
-  // Images
-  "png",
-  "jpg",
-  "jpeg",
-  "webp",
-  "gif",
-  "avif",
-  "svg",
-  "bmp",
-  "ico",
-  // Audio
-  "mp3",
-  "wav",
-  "ogg",
-  "flac",
-  "m4a",
-  "aac",
-  "opus",
-  // Video
-  "mp4",
-  "webm",
-  "avi",
-  "mov",
-  "mkv",
-  // Data
-  "json",
-  "txt",
-  "bin"
-]);
 function getCharxCategory(mimetype) {
   if (mimetype.startsWith("image/")) return "images";
   if (mimetype.startsWith("audio/")) return "audio";
@@ -591,11 +561,20 @@ function sanitizeAssetType(type) {
   return sanitized || "custom";
 }
 function sanitizeExtension(ext) {
-  const normalized = ext.replace(/^\./, "").toLowerCase().replace(/[^a-z0-9]/g, "");
-  if (SAFE_EXTENSIONS.has(normalized)) {
-    return normalized;
+  const normalized = ext.trim().replace(/^\./, "").toLowerCase();
+  if (!normalized) {
+    throw new Error("Invalid asset extension: empty extension");
+  }
+  if (normalized.length > 64) {
+    throw new Error(`Invalid asset extension: too long (${normalized.length} chars)`);
+  }
+  if (normalized.includes("/") || normalized.includes("\\") || normalized.includes("\0")) {
+    throw new Error("Invalid asset extension: path separators are not allowed");
+  }
+  if (!/^[a-z0-9][a-z0-9._-]*$/.test(normalized)) {
+    throw new Error(`Invalid asset extension: "${ext}"`);
   }
-  return "bin";
+  return normalized;
 }
 function sanitizeName(name, ext) {
   let safeName = name;
@@ -7046,6 +7025,22 @@ function sanitizeName2(name, ext) {
   if (!safeName) safeName = "asset";
   return safeName;
 }
+function sanitizeExtension2(ext) {
+  const normalized = ext.trim().replace(/^\./, "").toLowerCase();
+  if (!normalized) {
+    throw new Error("Invalid asset extension: empty extension");
+  }
+  if (normalized.length > 64) {
+    throw new Error(`Invalid asset extension: too long (${normalized.length} chars)`);
+  }
+  if (normalized.includes("/") || normalized.includes("\\") || normalized.includes("\0")) {
+    throw new Error("Invalid asset extension: path separators are not allowed");
+  }
+  if (!/^[a-z0-9][a-z0-9._-]*$/.test(normalized)) {
+    throw new Error(`Invalid asset extension: "${ext}"`);
+  }
+  return normalized;
+}
 function writeVoxta(card, assets, options = {}) {
   const { compressionLevel = 6, includePackageJson = false } = options;
   const cardData = card.data;
@@ -7134,8 +7129,9 @@ function writeVoxta(card, assets, options = {}) {
   let assetCount = 0;
   let mainThumbnail;
   for (const asset of assets) {
-    const safeName = sanitizeName2(asset.name, asset.ext);
-    const finalFilename = `${safeName}.${asset.ext}`;
+    const safeExt = sanitizeExtension2(asset.ext);
+    const safeName = sanitizeName2(asset.name, safeExt);
+    const finalFilename = `${safeName}.${safeExt}`;
     let voxtaPath = "";
     const tags = asset.tags || [];
     const isMainIcon = asset.type === "icon" && (tags.includes("portrait-override") || asset.name === "main" || asset.isMain);