@json-to-office/jto 0.26.0 → 0.28.0

package/dist/cli.js

@@ -422,12 +422,15 @@ var init_generator = __esm({
           }
         }
         const bypassCache = options?.bypassCache === true || extraEntries.length > 0;
+        const baseDir = typeof options?.baseDir === "string" ? options.baseDir : void 0;
         const cacheKeyData = {
           config: config2,
           customThemes: customThemes && Object.keys(customThemes).length > 0 ? customThemes : null,
           fontMode: fontMode ?? null,
           fontSubstitution: fontSubstitution ?? null,
-          fontStrict: callerStrict ?? null
+          fontStrict: callerStrict ?? null,
+          // Same definition, different source directory → different local assets.
+          baseDir: baseDir ?? null
         };
         const cacheKey = this.cacheService.generateCacheKey(cacheKeyData);
         const hasDynamicContent = this.cacheService.hasDynamicContent(config2);
@@ -464,13 +467,15 @@ var init_generator = __esm({
           const plugins = registry.getPlugins();
           const generator = await this.adapter.createGenerator(plugins, {
             customThemes,
-            fonts: fontOpts
+            fonts: fontOpts,
+            baseDir
           });
           buffer = await generator.generateBuffer(config2);
         } else {
           buffer = await this.adapter.generateBuffer(config2, {
             customThemes,
-            fonts: fontOpts
+            fonts: fontOpts,
+            baseDir
           });
         }
         this.cacheService.set(cacheKey, buffer, config2, {
@@ -1413,7 +1418,12 @@ var init_loose = __esm({
             {
               bypassCache: Type.Optional(Type.Boolean()),
               returnUrl: Type.Optional(Type.Boolean()),
-              fonts: Type.Optional(FontOptionsSchema)
+              fonts: Type.Optional(FontOptionsSchema),
+              // Name of the discovered document this definition came from; the
+              // server maps it to that document's directory so relative asset
+              // paths resolve against it (#142). Names, never paths — a client
+              // cannot point the server at an arbitrary directory.
+              sourceName: Type.Optional(Type.String())
             },
             { additionalProperties: true }
           )
@@ -1630,36 +1640,36 @@ function isPrivateHost(host) {
   const firstIpv6Group = Number.parseInt(normalized.split(":")[0] || "0", 16);
   return firstIpv6Group >= 64512 && firstIpv6Group <= 65023 || firstIpv6Group >= 65152 && firstIpv6Group <= 65215;
 }
-function assertAllowedUrl(source, path6, allowedHosts) {
+function assertAllowedUrl(source, path7, allowedHosts) {
   if (source.startsWith("data:")) return;
   let url;
   try {
     url = new URL(source);
   } catch {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path7,
       "local and relative file paths are disabled for HTTP requests"
     );
   }
   if (url.protocol !== "https:") {
-    throw new UnsafeOutboundSourceError(path6, "only HTTPS URLs are allowed");
+    throw new UnsafeOutboundSourceError(path7, "only HTTPS URLs are allowed");
   }
   if (url.username || url.password) {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path7,
       "URLs containing credentials are not allowed"
     );
   }
   const host = url.hostname.toLowerCase().replace(/\.$/, "");
   if (isPrivateHost(host)) {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path7,
       `private or local host "${host}" is not allowed`
     );
   }
   if (!allowedHosts.some((pattern) => hostMatches(host, pattern))) {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path7,
       `host "${host}" is not in OUTBOUND_HOST_ALLOWLIST`
     );
   }
@@ -1677,13 +1687,13 @@ function extractCssReferences(input) {
 function extractAbsoluteUrls(input) {
   return input.match(/(?:https?|file):\/\/[^\s'"<>)}\]]+/gi) ?? [];
 }
-function assertSafeSvg(svg, path6, allowedHosts) {
+function assertSafeSvg(svg, path7, allowedHosts) {
   if (/<\s*script\b/i.test(svg) || /<\s*(?:foreignObject|iframe|object|embed)\b/i.test(svg) || /\bon[a-z]+\s*=/i.test(svg)) {
-    throw new UnsafeOutboundSourceError(path6, "active SVG content is disabled");
+    throw new UnsafeOutboundSourceError(path7, "active SVG content is disabled");
   }
   if (/<!\s*(?:DOCTYPE|ENTITY)\b/i.test(svg)) {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path7,
       "SVG document types and entities are disabled"
     );
   }
@@ -1692,20 +1702,20 @@ function assertSafeSvg(svg, path6, allowedHosts) {
   while (match = refPattern.exec(svg)) {
     const ref = match[2].trim();
     if (!ref || ref.startsWith("#") || ref.startsWith("data:")) continue;
-    assertAllowedUrl(ref, path6, allowedHosts);
+    assertAllowedUrl(ref, path7, allowedHosts);
   }
   for (const ref of extractCssReferences(svg)) {
     if (ref.startsWith("#") || ref.startsWith("data:")) continue;
-    assertAllowedUrl(ref, path6, allowedHosts);
+    assertAllowedUrl(ref, path7, allowedHosts);
   }
 }
-function assertSafeEncodedImage(source, path6, allowedHosts) {
+function assertSafeEncodedImage(source, path7, allowedHosts) {
   let candidate = source.trim();
   let declaredSvg = false;
   if (candidate.startsWith("data:")) {
     const comma = candidate.indexOf(",");
     if (comma < 0) {
-      throw new UnsafeOutboundSourceError(path6, "malformed image data URL");
+      throw new UnsafeOutboundSourceError(path7, "malformed image data URL");
     }
     const metadata = candidate.slice(5, comma);
     declaredSvg = metadata.split(";")[0].toLowerCase() === "image/svg+xml";
@@ -1714,7 +1724,7 @@ function assertSafeEncodedImage(source, path6, allowedHosts) {
     try {
       candidate = /(?:^|;)base64(?:;|$)/i.test(metadata) ? Buffer.from(payload, "base64").toString("utf8") : decodeURIComponent(payload);
     } catch {
-      throw new UnsafeOutboundSourceError(path6, "malformed SVG data URL");
+      throw new UnsafeOutboundSourceError(path7, "malformed SVG data URL");
     }
   } else if (!/<\s*svg\b/i.test(candidate)) {
     candidate = Buffer.from(candidate, "base64").toString("utf8");
@@ -1722,37 +1732,37 @@ function assertSafeEncodedImage(source, path6, allowedHosts) {
   const svgStart = candidate.search(/<\s*svg\b/i);
   if (svgStart < 0) {
     if (declaredSvg) {
-      throw new UnsafeOutboundSourceError(path6, "malformed SVG image data");
+      throw new UnsafeOutboundSourceError(path7, "malformed SVG image data");
     }
     return;
   }
-  assertSafeSvg(candidate, path6, allowedHosts);
+  assertSafeSvg(candidate, path7, allowedHosts);
 }
-function assertSafeResources(resources, path6, allowedHosts) {
+function assertSafeResources(resources, path7, allowedHosts) {
   if (typeof resources.js === "string" && resources.js.trim()) {
     throw new UnsafeOutboundSourceError(
-      `${path6}.js`,
+      `${path7}.js`,
       "remote renderer JavaScript resources are disabled"
     );
   }
   if (typeof resources.css === "string") {
     for (const ref of extractCssReferences(resources.css)) {
       if (ref.startsWith("data:")) continue;
-      assertAllowedUrl(ref, `${path6}.css`, allowedHosts);
+      assertAllowedUrl(ref, `${path7}.css`, allowedHosts);
     }
   }
   if (Array.isArray(resources.files) && resources.files.length > 0) {
     throw new UnsafeOutboundSourceError(
-      `${path6}.files`,
+      `${path7}.files`,
       "remote renderer JavaScript resources are disabled"
     );
   }
 }
-function assertNoRemoteReferences(value, path6, allowedHosts, seen) {
+function assertNoRemoteReferences(value, path7, allowedHosts, seen) {
   if (typeof value === "string") {
     if (/\b(?:fetch|XMLHttpRequest|WebSocket|EventSource)\s*\(/i.test(value) || /\b(?:javascript|file):/i.test(value)) {
       throw new UnsafeOutboundSourceError(
-        path6,
+        path7,
         "network-capable JavaScript and file URLs are disabled"
       );
     }
@@ -1761,11 +1771,11 @@ function assertNoRemoteReferences(value, path6, allowedHosts, seen) {
       ...extractCssReferences(value)
     ]) {
       if (url.startsWith("data:")) continue;
-      assertAllowedUrl(url, path6, allowedHosts);
+      assertAllowedUrl(url, path7, allowedHosts);
     }
     if (/^\/\//.test(value.trim())) {
       throw new UnsafeOutboundSourceError(
-        path6,
+        path7,
         "protocol-relative URLs are disabled"
       );
     }
@@ -1775,20 +1785,20 @@ function assertNoRemoteReferences(value, path6, allowedHosts, seen) {
   seen.add(value);
   if (Array.isArray(value)) {
     value.forEach(
-      (entry, index) => assertNoRemoteReferences(entry, `${path6}[${index}]`, allowedHosts, seen)
+      (entry, index) => assertNoRemoteReferences(entry, `${path7}[${index}]`, allowedHosts, seen)
     );
     return;
   }
   for (const [key, child] of Object.entries(value)) {
-    assertNoRemoteReferences(child, `${path6}.${key}`, allowedHosts, seen);
+    assertNoRemoteReferences(child, `${path7}.${key}`, allowedHosts, seen);
   }
 }
-function visit(value, path6, containerKey, allowedHosts, seen) {
+function visit(value, path7, containerKey, allowedHosts, seen) {
   if (!value || typeof value !== "object" || seen.has(value)) return;
   seen.add(value);
   if (Array.isArray(value)) {
     value.forEach(
-      (entry, index) => visit(entry, `${path6}[${index}]`, containerKey, allowedHosts, seen)
+      (entry, index) => visit(entry, `${path7}[${index}]`, containerKey, allowedHosts, seen)
     );
     return;
   }
@@ -1796,7 +1806,7 @@ function visit(value, path6, containerKey, allowedHosts, seen) {
   for (const key of Object.keys(record)) {
     if (DANGEROUS_KEYS.has(key)) {
       throw new UnsafeOutboundSourceError(
-        `${path6}.${key}`,
+        `${path7}.${key}`,
         "prototype mutation keys are disabled"
       );
     }
@@ -1804,31 +1814,31 @@ function visit(value, path6, containerKey, allowedHosts, seen) {
   const kind = typeof record.kind === "string" ? record.kind : void 0;
   if (kind === "file" && typeof record.path === "string") {
     throw new UnsafeOutboundSourceError(
-      `${path6}.path`,
+      `${path7}.path`,
       "local file sources are disabled for HTTP requests"
     );
   }
   if ((kind === "url" || kind === "variable") && typeof record.url === "string") {
-    assertAllowedUrl(record.url, `${path6}.url`, allowedHosts);
+    assertAllowedUrl(record.url, `${path7}.url`, allowedHosts);
   }
   const componentName = typeof record.name === "string" ? record.name.toLowerCase() : void 0;
   const props = isRecord(record.props) ? record.props : void 0;
   if (componentName && props) {
     if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.path === "string") {
-      assertAllowedUrl(props.path, `${path6}.props.path`, allowedHosts);
-      assertSafeEncodedImage(props.path, `${path6}.props.path`, allowedHosts);
+      assertAllowedUrl(props.path, `${path7}.props.path`, allowedHosts);
+      assertSafeEncodedImage(props.path, `${path7}.props.path`, allowedHosts);
     }
     if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.base64 === "string") {
       assertSafeEncodedImage(
         props.base64,
-        `${path6}.props.base64`,
+        `${path7}.props.base64`,
         allowedHosts
       );
     }
     if ((componentName === "highcharts" || componentName === "visual") && typeof props.serverUrl === "string") {
       assertAllowedUrl(
         props.serverUrl,
-        `${path6}.props.serverUrl`,
+        `${path7}.props.serverUrl`,
         allowedHosts
       );
     }
@@ -1836,30 +1846,30 @@ function visit(value, path6, containerKey, allowedHosts, seen) {
       if (isRecord(props.resources)) {
         assertSafeResources(
           props.resources,
-          `${path6}.props.resources`,
+          `${path7}.props.resources`,
           allowedHosts
         );
       }
       assertNoRemoteReferences(
         props.options,
-        `${path6}.props.options`,
+        `${path7}.props.options`,
         allowedHosts,
         /* @__PURE__ */ new WeakSet()
       );
     }
   }
   if (containerKey === "image" && typeof record.path === "string") {
-    assertAllowedUrl(record.path, `${path6}.path`, allowedHosts);
-    assertSafeEncodedImage(record.path, `${path6}.path`, allowedHosts);
+    assertAllowedUrl(record.path, `${path7}.path`, allowedHosts);
+    assertSafeEncodedImage(record.path, `${path7}.path`, allowedHosts);
   }
   if (typeof record.svg === "string") {
-    assertSafeSvg(record.svg, `${path6}.svg`, allowedHosts);
+    assertSafeSvg(record.svg, `${path7}.svg`, allowedHosts);
   }
   if (containerKey === "resources") {
-    assertSafeResources(record, path6, allowedHosts);
+    assertSafeResources(record, path7, allowedHosts);
   }
   for (const [key, child] of Object.entries(record)) {
-    visit(child, `${path6}.${key}`, key, allowedHosts, seen);
+    visit(child, `${path7}.${key}`, key, allowedHosts, seen);
   }
 }
 function assertSafeOutboundSources(value, policy, rootPath = "request") {
@@ -1880,9 +1890,9 @@ var init_outbound_source_policy = __esm({
     "use strict";
     init_esm_shims();
     UnsafeOutboundSourceError = class extends Error {
-      constructor(path6, reason) {
-        super(`Unsafe outbound source at ${path6}: ${reason}`);
-        this.path = path6;
+      constructor(path7, reason) {
+        super(`Unsafe outbound source at ${path7}: ${reason}`);
+        this.path = path7;
         this.name = "UnsafeOutboundSourceError";
       }
     };
@@ -1892,6 +1902,7 @@ var init_outbound_source_policy = __esm({
 });
 
 // src/server/rasterize-route.ts
+import path6 from "path";
 import { Type as Type2 } from "@sinclair/typebox";
 import { bodyLimit } from "hono/body-limit";
 import { HTTPException as HTTPException3 } from "hono/http-exception";
@@ -1922,7 +1933,18 @@ function registerRasterizeRoute(router, options = {}) {
     jsonOnly,
     tbValidator(RasterizeRequestSchema),
     async (c) => {
-      const { presentation, dpi } = getValidated(c, "json");
+      const { presentation, dpi, baseDir } = getValidated(c, "json");
+      let safeBaseDir;
+      if (baseDir !== void 0) {
+        const resolved = path6.resolve(baseDir);
+        const cwd = process.cwd();
+        if (resolved !== cwd && !resolved.startsWith(cwd + path6.sep)) {
+          throw new HTTPException3(400, {
+            message: "baseDir must be inside the server working directory"
+          });
+        }
+        safeBaseDir = resolved;
+      }
       try {
         if (options.sourcePolicy) {
           assertSafeOutboundSources(
@@ -1933,7 +1955,8 @@ function registerRasterizeRoute(router, options = {}) {
         }
         const result = await getRasterizer()({
           presentation,
-          dpi: clampVisualDpi(dpi ?? DEFAULT_VISUAL_DPI)
+          dpi: clampVisualDpi(dpi ?? DEFAULT_VISUAL_DPI),
+          baseDir: safeBaseDir
         });
         return c.json(result);
       } catch (error) {
@@ -1968,7 +1991,8 @@ var init_rasterize_route = __esm({
         presentation: Type2.Object({}, { additionalProperties: true }),
         dpi: Type2.Optional(
           Type2.Number({ minimum: MIN_VISUAL_DPI, maximum: MAX_VISUAL_DPI })
-        )
+        ),
+        baseDir: Type2.Optional(Type2.String())
       },
       { additionalProperties: false }
     );
@@ -1988,12 +2012,16 @@ var init_rasterize_route = __esm({
 import { Hono as Hono2 } from "hono";
 import { HTTPException as HTTPException4 } from "hono/http-exception";
 import { bodyLimit as bodyLimit2 } from "hono/body-limit";
-import { PluginRegistry as PluginRegistry2 } from "@json-to-office/jto-cli";
+import {
+  PluginRegistry as PluginRegistry2,
+  PluginDiscoveryService
+} from "@json-to-office/jto-cli";
+import { dirname } from "path";
 function createFormatRouter(adapter) {
   const router = new Hono2();
-  const assertRequestSources = (value, path6) => {
+  const assertRequestSources = (value, path7) => {
     try {
-      assertSafeOutboundSources(value, config.outboundSources, path6);
+      assertSafeOutboundSources(value, config.outboundSources, path7);
     } catch (error) {
       if (error instanceof UnsafeOutboundSourceError) {
         throw new HTTPException4(400, { message: error.message });
@@ -2001,6 +2029,26 @@ function createFormatRouter(adapter) {
       throw error;
     }
   };
+  const resolveSourceBaseDir = async (options) => {
+    const sourceName = options?.sourceName;
+    if (typeof sourceName !== "string" || sourceName.length === 0) {
+      return void 0;
+    }
+    try {
+      const discovery = new PluginDiscoveryService({
+        maxDepth: 10,
+        includeNodeModules: false,
+        verbose: false
+      });
+      const documents = await discovery.discoverDocuments(
+        adapter.name
+      );
+      const match = documents.find((doc) => doc.name === sourceName);
+      return match ? dirname(match.path) : void 0;
+    } catch {
+      return void 0;
+    }
+  };
   const contentTypeMw = async (c, next) => {
     const contentType = c.req.header("content-type");
     if (!contentType || !contentType.includes("application/json")) {
@@ -2036,12 +2084,16 @@ function createFormatRouter(adapter) {
         } else if (rawFonts) {
           sanitizedFonts = rawFonts;
         }
+        const baseDir = await resolveSourceBaseDir(options);
+        const clientOptions = { ...options };
+        delete clientOptions.baseDir;
         const result = await generatorService.generate({
           jsonDefinition,
           customThemes,
           options: {
-            ...options,
+            ...clientOptions,
             ...sanitizedFonts !== void 0 && { fonts: sanitizedFonts },
+            ...baseDir !== void 0 && { baseDir },
             bypassCache
           }
         });
@@ -2298,14 +2350,19 @@ function createFormatRouter(adapter) {
       const libreOfficeService = getContainer().get(
         "libreOfficeConverterService"
       );
-      const { jsonDefinition, customThemes } = getValidated(c, "json");
+      const { jsonDefinition, customThemes, options } = getValidated(c, "json");
       try {
         assertRequestSources(jsonDefinition, "jsonDefinition");
         assertRequestSources(customThemes, "customThemes");
+        assertRequestSources(options, "options");
+        const baseDir = await resolveSourceBaseDir(options);
         const generated = await generatorService.generate({
           jsonDefinition,
           customThemes,
-          options: { bypassCache: true }
+          options: {
+            bypassCache: true,
+            ...baseDir !== void 0 && { baseDir }
+          }
         });
         const pdfBuffer = await libreOfficeService.convertToPdf(
           generated.buffer,
@@ -2479,7 +2536,7 @@ var init_format = __esm({
 // src/server/routes/discovery.ts
 import { Hono as Hono3 } from "hono";
 import {
-  PluginDiscoveryService,
+  PluginDiscoveryService as PluginDiscoveryService2,
   PluginRegistry as PluginRegistry3
 } from "@json-to-office/jto-cli";
 import { latestVersion } from "@json-to-office/shared";
@@ -2590,7 +2647,7 @@ var init_discovery = __esm({
     discoveryRouter.get("/all", async (c) => {
       try {
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2620,7 +2677,7 @@ var init_discovery = __esm({
         const includeSchemas = c.req.query("schemas") === "true";
         const includeExamples = c.req.query("examples") === "true";
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2644,7 +2701,7 @@ var init_discovery = __esm({
     discoveryRouter.get("/documents", async (c) => {
       try {
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2659,7 +2716,7 @@ var init_discovery = __esm({
     discoveryRouter.get("/themes", async (c) => {
       try {
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2675,7 +2732,7 @@ var init_discovery = __esm({
       try {
         const pluginName = c.req.param("name");
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2711,7 +2768,7 @@ var init_discovery = __esm({
       try {
         const name = c.req.param("name");
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2727,7 +2784,7 @@ var init_discovery = __esm({
       try {
         const name = c.req.param("name");
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2850,7 +2907,7 @@ var init_ai_schema = __esm({
 
 // src/server/services/prompt-loader.ts
 import { readFileSync, existsSync } from "fs";
-import { join, dirname } from "path";
+import { join, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolvePromptsDir() {
   const candidates = [
@@ -2885,7 +2942,7 @@ var init_prompt_loader = __esm({
   "src/server/services/prompt-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __dirname2 = dirname(fileURLToPath2(import.meta.url));
+    __dirname2 = dirname2(fileURLToPath2(import.meta.url));
     PROMPTS_DIR = resolvePromptsDir();
     cache = /* @__PURE__ */ new Map();
   }
@@ -3760,7 +3817,7 @@ import { Hono as Hono7 } from "hono";
 import { serve } from "@hono/node-server";
 import { logger as logger2 } from "hono/logger";
 import { compress } from "hono/compress";
-import { resolve, dirname as dirname2 } from "path";
+import { resolve, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var __filename2, __dirname3, UnifiedServer;
 var init_unified_server = __esm({
@@ -3770,7 +3827,7 @@ var init_unified_server = __esm({
     init_app();
     init_logger();
     __filename2 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname2(__filename2);
+    __dirname3 = dirname3(__filename2);
     UnifiedServer = class {
       app;
       config;
@@ -3806,9 +3863,9 @@ var init_unified_server = __esm({
           return await apiApp.fetch(c.req.raw, c.env);
         });
         this.app.use("*", async (c, next) => {
-          const path6 = c.req.path;
-          if (path6.startsWith("/api")) {
-            if (/\.(ts|tsx|js|jsx|css|map)$/.test(path6)) {
+          const path7 = c.req.path;
+          if (path7.startsWith("/api")) {
+            if (/\.(ts|tsx|js|jsx|css|map)$/.test(path7)) {
               return next();
             }
             const response = await apiApp.fetch(c.req.raw, c.env);
@@ -3911,8 +3968,8 @@ var init_unified_server = __esm({
         }
         if (this.viteServer) {
           this.app.use("*", async (c, next) => {
-            const path6 = c.req.path;
-            if ((path6.startsWith("/api") || path6 === "/health") && !/\.(ts|tsx|js|jsx|css|map)$/.test(path6)) {
+            const path7 = c.req.path;
+            if ((path7.startsWith("/api") || path7 === "/health") && !/\.(ts|tsx|js|jsx|css|map)$/.test(path7)) {
               return next();
             }
             const env = c.env;
@@ -3939,7 +3996,7 @@ var init_unified_server = __esm({
           "/assets/*",
           serveStatic({
             root: clientPath,
-            rewriteRequestPath: (path6) => path6.replace(/^\/assets/, "/assets")
+            rewriteRequestPath: (path7) => path7.replace(/^\/assets/, "/assets")
           })
         );
         this.app.use("/*", async (c, next) => {
@@ -4124,7 +4181,7 @@ function createDevCommand(adapter) {
 }
 
 // src/cli.ts
-var PACKAGE_VERSION = true ? "0.26.0" : "dev-mode";
+var PACKAGE_VERSION = true ? "0.28.0" : "dev-mode";
 var program = new Command2();
 program.name("jto").description("JSON to Office CLI - Generate .docx and .pptx from JSON").version(PACKAGE_VERSION);
 registerCoreCommands(program, {