fix: harden upload resilience and contracts

lib/validate-folder.ts

@@ -6,22 +6,25 @@ import type { TextureFile } from '@/lib/client-types'
 const SUPPORT_FILE_EXT_ARRAY = [...TEXTURE_EXTENSIONS, ...ASSET_EXTENSIONS]
 
 interface GltfBufferReference {
-  uri?: unknown
+  uri?: string
 }
 
 interface GltfJson {
   buffers?: GltfBufferReference[]
 }
 
-/** Discriminated union: either valid (with model) or invalid (with errors). */
 type ValidationResult =
   | { ok: true; model: File; textures: TextureFile[]; warnings: string[] }
   | { ok: false; errors: string[] }
 
+function isGltfBufferReference(value: unknown): value is GltfBufferReference {
+  return isRecord(value) && (value.uri === undefined || typeof value.uri === 'string')
+}
+
 function isGltfJson(value: unknown): value is GltfJson {
   if (!isRecord(value)) return false
   if (value.buffers === undefined) return true
-  return Array.isArray(value.buffers) && value.buffers.every(isRecord)
+  return Array.isArray(value.buffers) && value.buffers.every(isGltfBufferReference)
 }
 
 function getReferencedBufferNames(gltf: GltfJson) {