@character-foundry/character-foundry 0.4.3-dev.1766019473 → 0.4.3

package/dist/index.cjs

@@ -1363,6 +1363,36 @@ var SAFE_ASSET_TYPES = /* @__PURE__ */ new Set([
   "data",
   "unknown"
 ]);
+var SAFE_EXTENSIONS = /* @__PURE__ */ new Set([
+  // Images
+  "png",
+  "jpg",
+  "jpeg",
+  "webp",
+  "gif",
+  "avif",
+  "svg",
+  "bmp",
+  "ico",
+  // Audio
+  "mp3",
+  "wav",
+  "ogg",
+  "flac",
+  "m4a",
+  "aac",
+  "opus",
+  // Video
+  "mp4",
+  "webm",
+  "avi",
+  "mov",
+  "mkv",
+  // Data
+  "json",
+  "txt",
+  "bin"
+]);
 function getCharxCategory(mimetype) {
   if (mimetype.startsWith("image/")) return "images";
   if (mimetype.startsWith("audio/")) return "audio";
@@ -1378,20 +1408,11 @@ function sanitizeAssetType(type) {
   return sanitized || "custom";
 }
 function sanitizeExtension(ext) {
-  const normalized = ext.trim().replace(/^\./, "").toLowerCase();
-  if (!normalized) {
-    throw new Error("Invalid asset extension: empty extension");
-  }
-  if (normalized.length > 64) {
-    throw new Error(`Invalid asset extension: too long (${normalized.length} chars)`);
-  }
-  if (normalized.includes("/") || normalized.includes("\\") || normalized.includes("\0")) {
-    throw new Error("Invalid asset extension: path separators are not allowed");
-  }
-  if (!/^[a-z0-9][a-z0-9._-]*$/.test(normalized)) {
-    throw new Error(`Invalid asset extension: "${ext}"`);
+  const normalized = ext.replace(/^\./, "").toLowerCase().replace(/[^a-z0-9]/g, "");
+  if (SAFE_EXTENSIONS.has(normalized)) {
+    return normalized;
   }
-  return normalized;
+  return "bin";
 }
 function sanitizeName(name, ext) {
   let safeName = name;
@@ -8173,22 +8194,6 @@ function sanitizeName2(name, ext) {
   if (!safeName) safeName = "asset";
   return safeName;
 }
-function sanitizeExtension2(ext) {
-  const normalized = ext.trim().replace(/^\./, "").toLowerCase();
-  if (!normalized) {
-    throw new Error("Invalid asset extension: empty extension");
-  }
-  if (normalized.length > 64) {
-    throw new Error(`Invalid asset extension: too long (${normalized.length} chars)`);
-  }
-  if (normalized.includes("/") || normalized.includes("\\") || normalized.includes("\0")) {
-    throw new Error("Invalid asset extension: path separators are not allowed");
-  }
-  if (!/^[a-z0-9][a-z0-9._-]*$/.test(normalized)) {
-    throw new Error(`Invalid asset extension: "${ext}"`);
-  }
-  return normalized;
-}
 function writeVoxta(card, assets, options = {}) {
   const { compressionLevel = 6, includePackageJson = false } = options;
   const cardData = card.data;
@@ -8277,9 +8282,8 @@ function writeVoxta(card, assets, options = {}) {
   let assetCount = 0;
   let mainThumbnail;
   for (const asset of assets) {
-    const safeExt = sanitizeExtension2(asset.ext);
-    const safeName = sanitizeName2(asset.name, safeExt);
-    const finalFilename = `${safeName}.${safeExt}`;
+    const safeName = sanitizeName2(asset.name, asset.ext);
+    const finalFilename = `${safeName}.${asset.ext}`;
     let voxtaPath = "";
     const tags = asset.tags || [];
     const isMainIcon = asset.type === "icon" && (tags.includes("portrait-override") || asset.name === "main" || asset.isMain);