ВЕРСИИ (2)

## Better Enchant Commands 1.1.0 A hardening + polish release. Every existing command still works the same way for valid input — this release is about making bad input safer and bulk operations more transparent. ### Security - **Preset-name validation.** `/enchantpreset save <name>` and `/enchantpreset delete <name>` now require **1–64 characters** of `A–Z`, `a–z`, `0–9`, `_`, or `-`. Previously any non-whitespace token was accepted, which made unbounded disk growth and log-injection via crafted names possible. - **Preset-level clamping on disk load.** Preset entries read from the config file are now validated against `MIN_LEVEL..MAX_LEVEL` (1..255). A hand-edited or corrupted config can no longer push an out-of-range level into item NBT. - **Log-injection hardening.** `AuditLogger` strips ASCII control characters (newlines, tabs, ANSI escapes) from operator names, target names, labels, and config values before they reach SLF4J `{}` placeholders. Crafted scoreboard names can no longer forge or break lines in the audit log. ### Correctness - **Modded enchantment IDs with colons.** `EnchantmentParser` now splits on the **last** `:` in a token, so IDs like `mymod:some:path:10` parse correctly as namespace + path + level instead of being rejected with a confusing "too many parts" error. - **`/enchantpreset apply` empty-hand reporting.** Previously, players in the selector with an empty main hand were silently skipped. They're now listed in the failure output, matching the pattern already used by `/enchant` and `/unenchant`. - **Build fix.** A pre-existing compile error (`IllegalArgumentException | CommandSyntaxException | RuntimeException` multi-catch, which is invalid because `IllegalArgumentException` extends `RuntimeException`) is resolved, and two `createItemStack` call sites that newly throw `CommandSyntaxException` are properly handled. ### Performance - **Cached `/repair` lookups.** The reflective `mending` and `unbreaking` holder lookups in `/repair` are cached per enchantment registry, so they only run once per server session instead of on every command invocation. ### Added - `ConfirmationManager.storeWithReplacement` — an API variant callers can use to notify the operator when a prior pending confirmation is displaced. Not wired into any user-facing command yet, but available for downstream callers. ### Unchanged - Command surface, permission gates (op level 2), tab-completion behaviour, undo semantics, and preset JSON format are identical to 1.0.0. - Compiled against 1.21 base, still compatible across **all 1.21.x versions**.