@json-to-office/jto 0.27.0 → 0.28.1

package/dist/cli.js

@@ -234,10 +234,10 @@ function collectReferencedNames(config2, customThemes, adapterName) {
 }
 function collectReferencedWeights(config2, customThemes) {
   const weights = /* @__PURE__ */ new Set();
-  const visit2 = (node) => {
+  const visit3 = (node) => {
     if (node == null) return;
     if (Array.isArray(node)) {
-      for (const item of node) visit2(item);
+      for (const item of node) visit3(item);
       return;
     }
     if (typeof node === "object") {
@@ -245,21 +245,21 @@ function collectReferencedWeights(config2, customThemes) {
         if (k === "fontWeight" && typeof v === "number" && v >= 100 && v <= 900) {
           weights.add(v);
         } else {
-          visit2(v);
+          visit3(v);
         }
       }
     }
   };
-  visit2(config2);
-  for (const theme of Object.values(customThemes ?? {})) visit2(theme);
+  visit3(config2);
+  for (const theme of Object.values(customThemes ?? {})) visit3(theme);
   return weights;
 }
 function collectReferencedItalic(config2, customThemes) {
   let found = false;
-  const visit2 = (node) => {
+  const visit3 = (node) => {
     if (found || node == null) return;
     if (Array.isArray(node)) {
-      for (const item of node) visit2(item);
+      for (const item of node) visit3(item);
       return;
     }
     if (typeof node === "object") {
@@ -268,14 +268,14 @@ function collectReferencedItalic(config2, customThemes) {
           found = true;
           return;
         }
-        visit2(v);
+        visit3(v);
       }
     }
   };
-  visit2(config2);
+  visit3(config2);
   if (!found) {
     for (const theme of Object.values(customThemes ?? {})) {
-      visit2(theme);
+      visit3(theme);
       if (found) break;
     }
   }
@@ -422,12 +422,15 @@ var init_generator = __esm({
           }
         }
         const bypassCache = options?.bypassCache === true || extraEntries.length > 0;
+        const baseDir = typeof options?.baseDir === "string" ? options.baseDir : void 0;
         const cacheKeyData = {
           config: config2,
           customThemes: customThemes && Object.keys(customThemes).length > 0 ? customThemes : null,
           fontMode: fontMode ?? null,
           fontSubstitution: fontSubstitution ?? null,
-          fontStrict: callerStrict ?? null
+          fontStrict: callerStrict ?? null,
+          // Same definition, different source directory → different local assets.
+          baseDir: baseDir ?? null
         };
         const cacheKey = this.cacheService.generateCacheKey(cacheKeyData);
         const hasDynamicContent = this.cacheService.hasDynamicContent(config2);
@@ -464,13 +467,15 @@ var init_generator = __esm({
           const plugins = registry.getPlugins();
           const generator = await this.adapter.createGenerator(plugins, {
             customThemes,
-            fonts: fontOpts
+            fonts: fontOpts,
+            baseDir
           });
           buffer = await generator.generateBuffer(config2);
         } else {
           buffer = await this.adapter.generateBuffer(config2, {
             customThemes,
-            fonts: fontOpts
+            fonts: fontOpts,
+            baseDir
           });
         }
         this.cacheService.set(cacheKey, buffer, config2, {
@@ -1413,7 +1418,12 @@ var init_loose = __esm({
             {
               bypassCache: Type.Optional(Type.Boolean()),
               returnUrl: Type.Optional(Type.Boolean()),
-              fonts: Type.Optional(FontOptionsSchema)
+              fonts: Type.Optional(FontOptionsSchema),
+              // Name of the discovered document this definition came from; the
+              // server maps it to that document's directory so relative asset
+              // paths resolve against it (#142). Names, never paths — a client
+              // cannot point the server at an arbitrary directory.
+              sourceName: Type.Optional(Type.String())
             },
             { additionalProperties: true }
           )
@@ -1630,36 +1640,36 @@ function isPrivateHost(host) {
   const firstIpv6Group = Number.parseInt(normalized.split(":")[0] || "0", 16);
   return firstIpv6Group >= 64512 && firstIpv6Group <= 65023 || firstIpv6Group >= 65152 && firstIpv6Group <= 65215;
 }
-function assertAllowedUrl(source, path6, allowedHosts) {
+function assertAllowedUrl(source, path8, allowedHosts) {
   if (source.startsWith("data:")) return;
   let url;
   try {
     url = new URL(source);
   } catch {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path8,
       "local and relative file paths are disabled for HTTP requests"
     );
   }
   if (url.protocol !== "https:") {
-    throw new UnsafeOutboundSourceError(path6, "only HTTPS URLs are allowed");
+    throw new UnsafeOutboundSourceError(path8, "only HTTPS URLs are allowed");
   }
   if (url.username || url.password) {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path8,
       "URLs containing credentials are not allowed"
     );
   }
   const host = url.hostname.toLowerCase().replace(/\.$/, "");
   if (isPrivateHost(host)) {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path8,
       `private or local host "${host}" is not allowed`
     );
   }
   if (!allowedHosts.some((pattern) => hostMatches(host, pattern))) {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path8,
       `host "${host}" is not in OUTBOUND_HOST_ALLOWLIST`
     );
   }
@@ -1677,13 +1687,13 @@ function extractCssReferences(input) {
 function extractAbsoluteUrls(input) {
   return input.match(/(?:https?|file):\/\/[^\s'"<>)}\]]+/gi) ?? [];
 }
-function assertSafeSvg(svg, path6, allowedHosts) {
+function assertSafeSvg(svg, path8, allowedHosts) {
   if (/<\s*script\b/i.test(svg) || /<\s*(?:foreignObject|iframe|object|embed)\b/i.test(svg) || /\bon[a-z]+\s*=/i.test(svg)) {
-    throw new UnsafeOutboundSourceError(path6, "active SVG content is disabled");
+    throw new UnsafeOutboundSourceError(path8, "active SVG content is disabled");
   }
   if (/<!\s*(?:DOCTYPE|ENTITY)\b/i.test(svg)) {
     throw new UnsafeOutboundSourceError(
-      path6,
+      path8,
       "SVG document types and entities are disabled"
     );
   }
@@ -1692,20 +1702,20 @@ function assertSafeSvg(svg, path6, allowedHosts) {
   while (match = refPattern.exec(svg)) {
     const ref = match[2].trim();
     if (!ref || ref.startsWith("#") || ref.startsWith("data:")) continue;
-    assertAllowedUrl(ref, path6, allowedHosts);
+    assertAllowedUrl(ref, path8, allowedHosts);
   }
   for (const ref of extractCssReferences(svg)) {
     if (ref.startsWith("#") || ref.startsWith("data:")) continue;
-    assertAllowedUrl(ref, path6, allowedHosts);
+    assertAllowedUrl(ref, path8, allowedHosts);
   }
 }
-function assertSafeEncodedImage(source, path6, allowedHosts) {
+function assertSafeEncodedImage(source, path8, allowedHosts) {
   let candidate = source.trim();
   let declaredSvg = false;
   if (candidate.startsWith("data:")) {
     const comma = candidate.indexOf(",");
     if (comma < 0) {
-      throw new UnsafeOutboundSourceError(path6, "malformed image data URL");
+      throw new UnsafeOutboundSourceError(path8, "malformed image data URL");
     }
     const metadata = candidate.slice(5, comma);
     declaredSvg = metadata.split(";")[0].toLowerCase() === "image/svg+xml";
@@ -1714,7 +1724,7 @@ function assertSafeEncodedImage(source, path6, allowedHosts) {
     try {
       candidate = /(?:^|;)base64(?:;|$)/i.test(metadata) ? Buffer.from(payload, "base64").toString("utf8") : decodeURIComponent(payload);
     } catch {
-      throw new UnsafeOutboundSourceError(path6, "malformed SVG data URL");
+      throw new UnsafeOutboundSourceError(path8, "malformed SVG data URL");
     }
   } else if (!/<\s*svg\b/i.test(candidate)) {
     candidate = Buffer.from(candidate, "base64").toString("utf8");
@@ -1722,37 +1732,37 @@ function assertSafeEncodedImage(source, path6, allowedHosts) {
   const svgStart = candidate.search(/<\s*svg\b/i);
   if (svgStart < 0) {
     if (declaredSvg) {
-      throw new UnsafeOutboundSourceError(path6, "malformed SVG image data");
+      throw new UnsafeOutboundSourceError(path8, "malformed SVG image data");
     }
     return;
   }
-  assertSafeSvg(candidate, path6, allowedHosts);
+  assertSafeSvg(candidate, path8, allowedHosts);
 }
-function assertSafeResources(resources, path6, allowedHosts) {
+function assertSafeResources(resources, path8, allowedHosts) {
   if (typeof resources.js === "string" && resources.js.trim()) {
     throw new UnsafeOutboundSourceError(
-      `${path6}.js`,
+      `${path8}.js`,
       "remote renderer JavaScript resources are disabled"
     );
   }
   if (typeof resources.css === "string") {
     for (const ref of extractCssReferences(resources.css)) {
       if (ref.startsWith("data:")) continue;
-      assertAllowedUrl(ref, `${path6}.css`, allowedHosts);
+      assertAllowedUrl(ref, `${path8}.css`, allowedHosts);
     }
   }
   if (Array.isArray(resources.files) && resources.files.length > 0) {
     throw new UnsafeOutboundSourceError(
-      `${path6}.files`,
+      `${path8}.files`,
       "remote renderer JavaScript resources are disabled"
     );
   }
 }
-function assertNoRemoteReferences(value, path6, allowedHosts, seen) {
+function assertNoRemoteReferences(value, path8, allowedHosts, seen) {
   if (typeof value === "string") {
     if (/\b(?:fetch|XMLHttpRequest|WebSocket|EventSource)\s*\(/i.test(value) || /\b(?:javascript|file):/i.test(value)) {
       throw new UnsafeOutboundSourceError(
-        path6,
+        path8,
         "network-capable JavaScript and file URLs are disabled"
       );
     }
@@ -1761,11 +1771,11 @@ function assertNoRemoteReferences(value, path6, allowedHosts, seen) {
       ...extractCssReferences(value)
     ]) {
       if (url.startsWith("data:")) continue;
-      assertAllowedUrl(url, path6, allowedHosts);
+      assertAllowedUrl(url, path8, allowedHosts);
     }
     if (/^\/\//.test(value.trim())) {
       throw new UnsafeOutboundSourceError(
-        path6,
+        path8,
         "protocol-relative URLs are disabled"
       );
     }
@@ -1775,20 +1785,20 @@ function assertNoRemoteReferences(value, path6, allowedHosts, seen) {
   seen.add(value);
   if (Array.isArray(value)) {
     value.forEach(
-      (entry, index) => assertNoRemoteReferences(entry, `${path6}[${index}]`, allowedHosts, seen)
+      (entry, index) => assertNoRemoteReferences(entry, `${path8}[${index}]`, allowedHosts, seen)
     );
     return;
   }
   for (const [key, child] of Object.entries(value)) {
-    assertNoRemoteReferences(child, `${path6}.${key}`, allowedHosts, seen);
+    assertNoRemoteReferences(child, `${path8}.${key}`, allowedHosts, seen);
   }
 }
-function visit(value, path6, containerKey, allowedHosts, seen) {
+function visit(value, path8, containerKey, allowedHosts, seen) {
   if (!value || typeof value !== "object" || seen.has(value)) return;
   seen.add(value);
   if (Array.isArray(value)) {
     value.forEach(
-      (entry, index) => visit(entry, `${path6}[${index}]`, containerKey, allowedHosts, seen)
+      (entry, index) => visit(entry, `${path8}[${index}]`, containerKey, allowedHosts, seen)
     );
     return;
   }
@@ -1796,7 +1806,7 @@ function visit(value, path6, containerKey, allowedHosts, seen) {
   for (const key of Object.keys(record)) {
     if (DANGEROUS_KEYS.has(key)) {
       throw new UnsafeOutboundSourceError(
-        `${path6}.${key}`,
+        `${path8}.${key}`,
         "prototype mutation keys are disabled"
       );
     }
@@ -1804,31 +1814,31 @@ function visit(value, path6, containerKey, allowedHosts, seen) {
   const kind = typeof record.kind === "string" ? record.kind : void 0;
   if (kind === "file" && typeof record.path === "string") {
     throw new UnsafeOutboundSourceError(
-      `${path6}.path`,
+      `${path8}.path`,
       "local file sources are disabled for HTTP requests"
     );
   }
   if ((kind === "url" || kind === "variable") && typeof record.url === "string") {
-    assertAllowedUrl(record.url, `${path6}.url`, allowedHosts);
+    assertAllowedUrl(record.url, `${path8}.url`, allowedHosts);
   }
   const componentName = typeof record.name === "string" ? record.name.toLowerCase() : void 0;
   const props = isRecord(record.props) ? record.props : void 0;
   if (componentName && props) {
     if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.path === "string") {
-      assertAllowedUrl(props.path, `${path6}.props.path`, allowedHosts);
-      assertSafeEncodedImage(props.path, `${path6}.props.path`, allowedHosts);
+      assertAllowedUrl(props.path, `${path8}.props.path`, allowedHosts);
+      assertSafeEncodedImage(props.path, `${path8}.props.path`, allowedHosts);
     }
     if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.base64 === "string") {
       assertSafeEncodedImage(
         props.base64,
-        `${path6}.props.base64`,
+        `${path8}.props.base64`,
         allowedHosts
       );
     }
     if ((componentName === "highcharts" || componentName === "visual") && typeof props.serverUrl === "string") {
       assertAllowedUrl(
         props.serverUrl,
-        `${path6}.props.serverUrl`,
+        `${path8}.props.serverUrl`,
         allowedHosts
       );
     }
@@ -1836,30 +1846,30 @@ function visit(value, path6, containerKey, allowedHosts, seen) {
       if (isRecord(props.resources)) {
         assertSafeResources(
           props.resources,
-          `${path6}.props.resources`,
+          `${path8}.props.resources`,
           allowedHosts
         );
       }
       assertNoRemoteReferences(
         props.options,
-        `${path6}.props.options`,
+        `${path8}.props.options`,
         allowedHosts,
         /* @__PURE__ */ new WeakSet()
       );
     }
   }
   if (containerKey === "image" && typeof record.path === "string") {
-    assertAllowedUrl(record.path, `${path6}.path`, allowedHosts);
-    assertSafeEncodedImage(record.path, `${path6}.path`, allowedHosts);
+    assertAllowedUrl(record.path, `${path8}.path`, allowedHosts);
+    assertSafeEncodedImage(record.path, `${path8}.path`, allowedHosts);
   }
   if (typeof record.svg === "string") {
-    assertSafeSvg(record.svg, `${path6}.svg`, allowedHosts);
+    assertSafeSvg(record.svg, `${path8}.svg`, allowedHosts);
   }
   if (containerKey === "resources") {
-    assertSafeResources(record, path6, allowedHosts);
+    assertSafeResources(record, path8, allowedHosts);
   }
   for (const [key, child] of Object.entries(record)) {
-    visit(child, `${path6}.${key}`, key, allowedHosts, seen);
+    visit(child, `${path8}.${key}`, key, allowedHosts, seen);
   }
 }
 function assertSafeOutboundSources(value, policy, rootPath = "request") {
@@ -1880,9 +1890,9 @@ var init_outbound_source_policy = __esm({
     "use strict";
     init_esm_shims();
     UnsafeOutboundSourceError = class extends Error {
-      constructor(path6, reason) {
-        super(`Unsafe outbound source at ${path6}: ${reason}`);
-        this.path = path6;
+      constructor(path8, reason) {
+        super(`Unsafe outbound source at ${path8}: ${reason}`);
+        this.path = path8;
         this.name = "UnsafeOutboundSourceError";
       }
     };
@@ -1892,6 +1902,7 @@ var init_outbound_source_policy = __esm({
 });
 
 // src/server/rasterize-route.ts
+import path6 from "path";
 import { Type as Type2 } from "@sinclair/typebox";
 import { bodyLimit } from "hono/body-limit";
 import { HTTPException as HTTPException3 } from "hono/http-exception";
@@ -1922,7 +1933,18 @@ function registerRasterizeRoute(router, options = {}) {
     jsonOnly,
     tbValidator(RasterizeRequestSchema),
     async (c) => {
-      const { presentation, dpi } = getValidated(c, "json");
+      const { presentation, dpi, baseDir } = getValidated(c, "json");
+      let safeBaseDir;
+      if (baseDir !== void 0) {
+        const resolved = path6.resolve(baseDir);
+        const cwd = process.cwd();
+        if (resolved !== cwd && !resolved.startsWith(cwd + path6.sep)) {
+          throw new HTTPException3(400, {
+            message: "baseDir must be inside the server working directory"
+          });
+        }
+        safeBaseDir = resolved;
+      }
       try {
         if (options.sourcePolicy) {
           assertSafeOutboundSources(
@@ -1933,7 +1955,8 @@ function registerRasterizeRoute(router, options = {}) {
         }
         const result = await getRasterizer()({
           presentation,
-          dpi: clampVisualDpi(dpi ?? DEFAULT_VISUAL_DPI)
+          dpi: clampVisualDpi(dpi ?? DEFAULT_VISUAL_DPI),
+          baseDir: safeBaseDir
         });
         return c.json(result);
       } catch (error) {
@@ -1968,7 +1991,8 @@ var init_rasterize_route = __esm({
         presentation: Type2.Object({}, { additionalProperties: true }),
         dpi: Type2.Optional(
           Type2.Number({ minimum: MIN_VISUAL_DPI, maximum: MAX_VISUAL_DPI })
-        )
+        ),
+        baseDir: Type2.Optional(Type2.String())
       },
       { additionalProperties: false }
     );
@@ -1984,16 +2008,132 @@ var init_rasterize_route = __esm({
   }
 });
 
+// src/server/services/template-media-inliner.ts
+import { promises as fs5 } from "fs";
+import path7 from "path";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isInlineCandidate(source) {
+  if (!source || source.includes("\0")) return false;
+  if (source.startsWith("data:")) return false;
+  if (path7.isAbsolute(source)) return false;
+  try {
+    new URL(source);
+    return false;
+  } catch {
+    return true;
+  }
+}
+async function toDataUrl(source, baseDir, state) {
+  let cacheKey = source;
+  let result = null;
+  try {
+    const resolved = await fs5.realpath(path7.resolve(baseDir, source));
+    cacheKey = resolved;
+    const cached2 = state.cache.get(cacheKey);
+    if (cached2 !== void 0) return cached2;
+    const contained = resolved === state.baseDirReal || resolved.startsWith(state.baseDirReal + path7.sep);
+    if (contained) {
+      const mime = MIME_BY_EXTENSION[path7.extname(resolved).toLowerCase()];
+      if (mime) {
+        const stat = await fs5.stat(resolved);
+        if (stat.isFile() && stat.size <= state.maxFileBytes && stat.size <= state.totalBudget) {
+          const buffer = await fs5.readFile(resolved);
+          state.totalBudget -= buffer.length;
+          result = `data:${mime};base64,${buffer.toString("base64")}`;
+        }
+      }
+    }
+  } catch {
+  }
+  state.cache.set(cacheKey, result);
+  return result;
+}
+async function visit2(value, containerKey, baseDir, state, seen) {
+  if (!value || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      await visit2(entry, containerKey, baseDir, state, seen);
+    }
+    return;
+  }
+  const record = value;
+  const componentName = typeof record.name === "string" ? record.name.toLowerCase() : void 0;
+  const props = isRecord2(record.props) ? record.props : void 0;
+  if (componentName === "image" && props && typeof props.path === "string" && isInlineCandidate(props.path)) {
+    const inlined = await toDataUrl(props.path, baseDir, state);
+    if (inlined !== null) props.path = inlined;
+  }
+  if (containerKey === "image" && typeof record.path === "string" && isInlineCandidate(record.path)) {
+    const inlined = await toDataUrl(record.path, baseDir, state);
+    if (inlined !== null) record.path = inlined;
+  }
+  for (const [key, child] of Object.entries(record)) {
+    await visit2(child, key, baseDir, state, seen);
+  }
+}
+async function inlineTemplateMedia(jsonDefinition, baseDir, options = {}) {
+  if (typeof jsonDefinition === "string") {
+    try {
+      jsonDefinition = JSON.parse(jsonDefinition);
+    } catch {
+      return jsonDefinition;
+    }
+  }
+  if (!jsonDefinition || typeof jsonDefinition !== "object") {
+    return jsonDefinition;
+  }
+  let baseDirReal;
+  try {
+    baseDirReal = await fs5.realpath(baseDir);
+  } catch {
+    return jsonDefinition;
+  }
+  const clone = structuredClone(jsonDefinition);
+  const state = {
+    baseDirReal,
+    maxFileBytes: options.maxFileBytes ?? 10 * 1024 * 1024,
+    totalBudget: options.maxTotalBytes ?? 32 * 1024 * 1024,
+    cache: /* @__PURE__ */ new Map()
+  };
+  await visit2(clone, void 0, baseDir, state, /* @__PURE__ */ new WeakSet());
+  return clone;
+}
+var MIME_BY_EXTENSION;
+var init_template_media_inliner = __esm({
+  "src/server/services/template-media-inliner.ts"() {
+    "use strict";
+    init_esm_shims();
+    MIME_BY_EXTENSION = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".svg": "image/svg+xml",
+      ".webp": "image/webp",
+      ".bmp": "image/bmp",
+      ".tiff": "image/tiff",
+      ".tif": "image/tiff"
+    };
+  }
+});
+
 // src/server/routes/format.ts
 import { Hono as Hono2 } from "hono";
 import { HTTPException as HTTPException4 } from "hono/http-exception";
 import { bodyLimit as bodyLimit2 } from "hono/body-limit";
-import { PluginRegistry as PluginRegistry2 } from "@json-to-office/jto-cli";
+import {
+  PluginRegistry as PluginRegistry2,
+  PluginDiscoveryService
+} from "@json-to-office/jto-cli";
+import { dirname } from "path";
 function createFormatRouter(adapter) {
   const router = new Hono2();
-  const assertRequestSources = (value, path6) => {
+  const assertRequestSources = (value, path8) => {
     try {
-      assertSafeOutboundSources(value, config.outboundSources, path6);
+      assertSafeOutboundSources(value, config.outboundSources, path8);
     } catch (error) {
       if (error instanceof UnsafeOutboundSourceError) {
         throw new HTTPException4(400, { message: error.message });
@@ -2001,6 +2141,35 @@ function createFormatRouter(adapter) {
       throw error;
     }
   };
+  const resolveSourceBaseDir = async (options) => {
+    const sourceName = options?.sourceName;
+    if (typeof sourceName !== "string" || sourceName.length === 0) {
+      return void 0;
+    }
+    try {
+      const discovery = new PluginDiscoveryService({
+        maxDepth: 10,
+        includeNodeModules: false,
+        verbose: false
+      });
+      const documents = await discovery.discoverDocuments(
+        adapter.name
+      );
+      const match = documents.find((doc) => doc.name === sourceName);
+      return match ? dirname(match.path) : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+  const inlineDiscoveredMedia = async (jsonDefinition, baseDir) => {
+    if (baseDir === void 0 || config.outboundSources.mode === "development") {
+      return jsonDefinition;
+    }
+    return inlineTemplateMedia(jsonDefinition, baseDir, {
+      maxFileBytes: config.requestLimits.maxFileSize,
+      maxTotalBytes: config.requestLimits.maxBodySize
+    });
+  };
   const contentTypeMw = async (c, next) => {
     const contentType = c.req.header("content-type");
     if (!contentType || !contentType.includes("application/json")) {
@@ -2024,7 +2193,12 @@ function createFormatRouter(adapter) {
       const { jsonDefinition, customThemes, options } = getValidated(c, "json");
       const requestId = c.get("requestId");
       try {
-        assertRequestSources(jsonDefinition, "jsonDefinition");
+        const baseDir = await resolveSourceBaseDir(options);
+        const effectiveDefinition = await inlineDiscoveredMedia(
+          jsonDefinition,
+          baseDir
+        );
+        assertRequestSources(effectiveDefinition, "jsonDefinition");
         assertRequestSources(customThemes, "customThemes");
         assertRequestSources(options, "options");
         const bypassCache = c.req.header("X-Bypass-Cache") === "true" || c.req.query("bypass-cache") === "true" || options?.bypassCache === true;
@@ -2036,12 +2210,15 @@ function createFormatRouter(adapter) {
         } else if (rawFonts) {
           sanitizedFonts = rawFonts;
         }
+        const clientOptions = { ...options };
+        delete clientOptions.baseDir;
         const result = await generatorService.generate({
-          jsonDefinition,
+          jsonDefinition: effectiveDefinition,
           customThemes,
           options: {
-            ...options,
+            ...clientOptions,
             ...sanitizedFonts !== void 0 && { fonts: sanitizedFonts },
+            ...baseDir !== void 0 && { baseDir },
             bypassCache
           }
         });
@@ -2298,14 +2475,23 @@ function createFormatRouter(adapter) {
       const libreOfficeService = getContainer().get(
         "libreOfficeConverterService"
       );
-      const { jsonDefinition, customThemes } = getValidated(c, "json");
+      const { jsonDefinition, customThemes, options } = getValidated(c, "json");
       try {
-        assertRequestSources(jsonDefinition, "jsonDefinition");
+        const baseDir = await resolveSourceBaseDir(options);
+        const effectiveDefinition = await inlineDiscoveredMedia(
+          jsonDefinition,
+          baseDir
+        );
+        assertRequestSources(effectiveDefinition, "jsonDefinition");
         assertRequestSources(customThemes, "customThemes");
+        assertRequestSources(options, "options");
         const generated = await generatorService.generate({
-          jsonDefinition,
+          jsonDefinition: effectiveDefinition,
           customThemes,
-          options: { bypassCache: true }
+          options: {
+            bypassCache: true,
+            ...baseDir !== void 0 && { baseDir }
+          }
         });
         const pdfBuffer = await libreOfficeService.convertToPdf(
           generated.buffer,
@@ -2473,13 +2659,14 @@ var init_format = __esm({
     init_config();
     init_outbound_source_policy();
     init_libreoffice_converter();
+    init_template_media_inliner();
   }
 });
 
 // src/server/routes/discovery.ts
 import { Hono as Hono3 } from "hono";
 import {
-  PluginDiscoveryService,
+  PluginDiscoveryService as PluginDiscoveryService2,
   PluginRegistry as PluginRegistry3
 } from "@json-to-office/jto-cli";
 import { latestVersion } from "@json-to-office/shared";
@@ -2590,7 +2777,7 @@ var init_discovery = __esm({
     discoveryRouter.get("/all", async (c) => {
       try {
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2620,7 +2807,7 @@ var init_discovery = __esm({
         const includeSchemas = c.req.query("schemas") === "true";
         const includeExamples = c.req.query("examples") === "true";
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2644,7 +2831,7 @@ var init_discovery = __esm({
     discoveryRouter.get("/documents", async (c) => {
       try {
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2659,7 +2846,7 @@ var init_discovery = __esm({
     discoveryRouter.get("/themes", async (c) => {
       try {
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2675,7 +2862,7 @@ var init_discovery = __esm({
       try {
         const pluginName = c.req.param("name");
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2711,7 +2898,7 @@ var init_discovery = __esm({
       try {
         const name = c.req.param("name");
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2727,7 +2914,7 @@ var init_discovery = __esm({
       try {
         const name = c.req.param("name");
         const format = Container.getAdapter().name;
-        const discovery = new PluginDiscoveryService({
+        const discovery = new PluginDiscoveryService2({
           maxDepth: 10,
           includeNodeModules: false,
           verbose: false
@@ -2850,7 +3037,7 @@ var init_ai_schema = __esm({
 
 // src/server/services/prompt-loader.ts
 import { readFileSync, existsSync } from "fs";
-import { join, dirname } from "path";
+import { join, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolvePromptsDir() {
   const candidates = [
@@ -2885,7 +3072,7 @@ var init_prompt_loader = __esm({
   "src/server/services/prompt-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __dirname2 = dirname(fileURLToPath2(import.meta.url));
+    __dirname2 = dirname2(fileURLToPath2(import.meta.url));
     PROMPTS_DIR = resolvePromptsDir();
     cache = /* @__PURE__ */ new Map();
   }
@@ -3760,7 +3947,7 @@ import { Hono as Hono7 } from "hono";
 import { serve } from "@hono/node-server";
 import { logger as logger2 } from "hono/logger";
 import { compress } from "hono/compress";
-import { resolve, dirname as dirname2 } from "path";
+import { resolve, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var __filename2, __dirname3, UnifiedServer;
 var init_unified_server = __esm({
@@ -3770,7 +3957,7 @@ var init_unified_server = __esm({
     init_app();
     init_logger();
     __filename2 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname2(__filename2);
+    __dirname3 = dirname3(__filename2);
     UnifiedServer = class {
       app;
       config;
@@ -3806,9 +3993,9 @@ var init_unified_server = __esm({
           return await apiApp.fetch(c.req.raw, c.env);
         });
         this.app.use("*", async (c, next) => {
-          const path6 = c.req.path;
-          if (path6.startsWith("/api")) {
-            if (/\.(ts|tsx|js|jsx|css|map)$/.test(path6)) {
+          const path8 = c.req.path;
+          if (path8.startsWith("/api")) {
+            if (/\.(ts|tsx|js|jsx|css|map)$/.test(path8)) {
               return next();
             }
             const response = await apiApp.fetch(c.req.raw, c.env);
@@ -3911,8 +4098,8 @@ var init_unified_server = __esm({
         }
         if (this.viteServer) {
           this.app.use("*", async (c, next) => {
-            const path6 = c.req.path;
-            if ((path6.startsWith("/api") || path6 === "/health") && !/\.(ts|tsx|js|jsx|css|map)$/.test(path6)) {
+            const path8 = c.req.path;
+            if ((path8.startsWith("/api") || path8 === "/health") && !/\.(ts|tsx|js|jsx|css|map)$/.test(path8)) {
               return next();
             }
             const env = c.env;
@@ -3931,7 +4118,7 @@ var init_unified_server = __esm({
       }
       async setupBuiltClient(clientPath) {
         const { serveStatic } = await import("@hono/node-server/serve-static");
-        const fs5 = await import("fs");
+        const fs6 = await import("fs");
         const { extname } = await import("path");
         const mime = await import("mime-types");
         const format = this.adapter.name.replace(/[^a-zA-Z0-9]/g, "");
@@ -3939,7 +4126,7 @@ var init_unified_server = __esm({
           "/assets/*",
           serveStatic({
             root: clientPath,
-            rewriteRequestPath: (path6) => path6.replace(/^\/assets/, "/assets")
+            rewriteRequestPath: (path8) => path8.replace(/^\/assets/, "/assets")
           })
         );
         this.app.use("/*", async (c, next) => {
@@ -3948,9 +4135,9 @@ var init_unified_server = __esm({
           const ext = extname(reqPath);
           if (ext) {
             const filePath = resolve(clientPath, reqPath.slice(1));
-            if (fs5.existsSync(filePath)) {
+            if (fs6.existsSync(filePath)) {
               const mimeType = mime.lookup(filePath) || "application/octet-stream";
-              const content = fs5.readFileSync(filePath);
+              const content = fs6.readFileSync(filePath);
               c.header("Content-Type", mimeType);
               return c.body(content);
             }
@@ -3962,8 +4149,8 @@ var init_unified_server = __esm({
           if (reqPath.startsWith("/api") || reqPath === "/health")
             return c.notFound();
           const indexPath = resolve(clientPath, "index.html");
-          if (fs5.existsSync(indexPath)) {
-            let html = fs5.readFileSync(indexPath, "utf-8");
+          if (fs6.existsSync(indexPath)) {
+            let html = fs6.readFileSync(indexPath, "utf-8");
             html = html.replace(
               "</head>",
               `<script>window.__JTO_FORMAT__ = '${format}';</script>
@@ -4124,7 +4311,7 @@ function createDevCommand(adapter) {
 }
 
 // src/cli.ts
-var PACKAGE_VERSION = true ? "0.27.0" : "dev-mode";
+var PACKAGE_VERSION = true ? "0.28.1" : "dev-mode";
 var program = new Command2();
 program.name("jto").description("JSON to Office CLI - Generate .docx and .pptx from JSON").version(PACKAGE_VERSION);
 registerCoreCommands(program, {