@json-to-office/core-pptx 0.26.0 → 0.28.0

package/dist/utils/baseDirContext.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Scope the document base directory for a generation run, so relative asset
+ * paths (`image.props.path`, slide background images) resolve against the
+ * document's own location rather than `process.cwd()` (#142). No baseDir →
+ * plain callback, preserving the historical cwd-relative behavior. Mirrors
+ * core-docx/src/utils/generationContext.ts.
+ */
+export declare function runWithBaseDir<T>(baseDir: string | undefined, callback: () => T): T;
+/** The active document base directory, if a generation scope set one. */
+export declare function getBaseDir(): string | undefined;
+/**
+ * Resolve a relative file path against the active base directory. Absolute
+ * paths pass through; with no active baseDir the path is returned as-is,
+ * which pptxgenjs / `fs` resolve against cwd — the legacy behavior. The
+ * rewrite must happen eagerly at render time: pptxgenjs reads `path` entries
+ * later, during `write()`, outside any generation scope.
+ */
+export declare function resolveFromBaseDir(filePath: string): string;
+//# sourceMappingURL=baseDirContext.d.ts.map

package/dist/utils/baseDirContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseDirContext.d.ts","sourceRoot":"","sources":["../../src/utils/baseDirContext.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,QAAQ,EAAE,MAAM,CAAC,GAChB,CAAC,CAIH;AAED,yEAAyE;AACzE,wBAAgB,UAAU,IAAI,MAAM,GAAG,SAAS,CAE/C;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI3D"}

package/dist/utils/imageSource.d.ts

@@ -3,4 +3,18 @@ export declare function resolveImageSource(props: {
     base64?: string;
     path?: string;
 }): string | undefined;
+/**
+ * Local files must live under the document base directory (when set) or CWD —
+ * path-traversal guard (#142). `resolved` must already be absolute.
+ */
+export declare function isAllowedLocalPath(resolved: string): boolean;
+/**
+ * Resolve a source string that may be a URL, data URI, or local file path:
+ * URLs and data URIs pass through; local paths resolve against the active
+ * document base directory when the generation scope set one, eagerly —
+ * pptxgenjs reads `path` entries during write(), outside the generation
+ * scope. Returns `undefined` when a local path escapes the allowed roots, so
+ * out-of-root paths never reach pptxgenjs (#142).
+ */
+export declare function safeLocalPath(source: string): string | undefined;
 //# sourceMappingURL=imageSource.d.ts.map

package/dist/utils/imageSource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"imageSource.d.ts","sourceRoot":"","sources":["../../src/utils/imageSource.ts"],"names":[],"mappings":"AAYA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,GAAG,SAAS,CAUrB"}
+{"version":3,"file":"imageSource.d.ts","sourceRoot":"","sources":["../../src/utils/imageSource.ts"],"names":[],"mappings":"AAeA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,GAAG,SAAS,CAUrB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM5D;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhE"}

package/dist/utils/warn.d.ts

@@ -8,6 +8,7 @@ export declare const W: {
     readonly CHART_MULTI_SERIES: "CHART_MULTI_SERIES";
     readonly IMAGE_NO_SOURCE: "IMAGE_NO_SOURCE";
     readonly IMAGE_PROBE_FAILED: "IMAGE_PROBE_FAILED";
+    readonly IMAGE_PATH_OUTSIDE_ROOTS: "IMAGE_PATH_OUTSIDE_ROOTS";
     readonly MISSING_TEMPLATE: "MISSING_TEMPLATE";
     readonly UNKNOWN_PLACEHOLDER: "UNKNOWN_PLACEHOLDER";
     readonly PLACEHOLDER_NO_POSITION: "PLACEHOLDER_NO_POSITION";

package/dist/utils/warn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"warn.d.ts","sourceRoot":"","sources":["../../src/utils/warn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,eAAO,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;CAoBJ,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC;AAErD,wBAAgB,IAAI,CAClB,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,EACvC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAC/B,IAAI,CAMN"}
+{"version":3,"file":"warn.d.ts","sourceRoot":"","sources":["../../src/utils/warn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,eAAO,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;CAqBJ,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC;AAErD,wBAAgB,IAAI,CAClB,QAAQ,EAAE,eAAe,EAAE,GAAG,SAAS,EACvC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAC/B,IAAI,CAMN"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@json-to-office/core-pptx",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Core PPTX presentation generation engine",
   "type": "module",
   "main": "dist/index.js",
@@ -22,8 +22,8 @@
     "jszip": "3.10.1",
     "pptxgenjs": "^3.12.0",
     "probe-image-size": "7.2.3",
-    "@json-to-office/shared": "^0.25.0",
-    "@json-to-office/shared-pptx": "^0.25.0"
+    "@json-to-office/shared": "^0.28.0",
+    "@json-to-office/shared-pptx": "^0.28.0"
   },
   "devDependencies": {
     "@types/node": "20.11.0",