refactor: unify resource loading through IResourceLoader chain

- ContentSourceResolver now delegates all URI resolution to loaders
- Base64ResourceLoader handles data:, data://, base64:, base64:// schemes
- FileResourceLoader uses generic URI scheme detection instead of blacklist
- FileResourceLoader supports file:, file://, file:/// prefixes
- base64: is a shorthand alias for data:application/octet-stream;base64,...
- Cookbook: add CLI commands and image source recipes

Author: RoboNET

docs/wiki/API-Reference.md

@@ -140,8 +140,8 @@ var data = new ObjectValue { ["receipt"] = new BytesValue(rawBytes) };
 // From Stream
 var data = new ObjectValue { ["receipt"] = BytesValue.FromStream(fileStream) };
 
-// From base64 in YAML source
-// source: "base64:SGVsbG8gV29ybGQ="
+// From data URI in YAML source
+// source: "data:application/octet-stream;base64,SGVsbG8gV29ybGQ="
 ```
 
 `BytesValue` wraps `ReadOnlyMemory<byte>` and is passed directly to `IBinaryContentParser` without encoding conversion. When only `IContentParser` is registered, binary data is decoded as UTF-8.

docs/wiki/Cookbook.md

@@ -559,10 +559,10 @@ var render = new FlexRenderBuilder()
     .Build();
 ```
 
-> **Note:** NDC receipts use binary data (`BytesValue`), so they must be rendered through the C# API. The CLI does not support binary data inputs. For text-based NDC content, you can use `base64:` prefix in the JSON data:
+> **Note:** NDC receipts use binary data (`BytesValue`), so they must be rendered through the C# API. The CLI does not support binary data inputs. For text-based NDC content, you can use `data:` URI format in the JSON data:
 >
 > ```json
-> { "receiptData": "base64:PFN0YXJ0PjxOREMgZGF0YT4..." }
+> { "receiptData": "data:application/octet-stream;base64,PFN0YXJ0PjxOREMgZGF0YT4..." }
 > ```
 >
 > ```bash
@@ -1313,7 +1313,7 @@ FlexRender supports four ways to load images in `type: image` elements. All sour
 | Base64 data URL | `src: "data:image/png;base64,iVBOR..."` | Default (Base64ResourceLoader) |
 | Embedded resource | `src: "embedded://MyApp.Assets.logo.png"` | `.WithEmbeddedLoader(assembly)` |
 
-> **Important:** For `data:` URIs, the MIME type is **required** (e.g., `data:image/png;base64,...`). For the `base64:` prefix in content sources, MIME type is **not required** (e.g., `base64:SGVsbG8=`).
+> **Important:** For image `data:` URIs, the MIME type is **required** (e.g., `data:image/png;base64,...`). For content source `data:` URIs, the MIME type is **optional** (e.g., `data:;base64,SGVsbG8=` or `data:application/octet-stream;base64,SGVsbG8=`).
 
 ---
 

docs/wiki/Element-Reference.md

@@ -1451,7 +1451,7 @@ Renders tabular data with configurable columns, optional header row, and support
 
 ## Content Element (Control Flow)
 
-Embeds dynamically formatted content (Markdown, HTML, NDC binary data, etc.) from template data. The `source` supports multiple input types: plain text, `base64:`-encoded binary data, `file:` URIs, `text:` prefixed strings, and template variables bound to `string` or `byte[]` (`BytesValue`). The source is parsed at render time into a subtree of FlexRender elements using pluggable content parsers.
+Embeds dynamically formatted content (Markdown, HTML, NDC binary data, etc.) from template data. The `source` supports multiple input types: plain text, `data:` URI-encoded binary data, `file:` URIs, `text:` prefixed strings, and template variables bound to `string` or `byte[]` (`BytesValue`). The source is parsed at render time into a subtree of FlexRender elements using pluggable content parsers.
 
 This is a **control-flow element** — like `each` and `if`, it is expanded during template processing and does not appear in the final render tree.
 
@@ -1465,7 +1465,7 @@ This is a **control-flow element** — like `each` and `if`, it is expanded duri
 
 | Property | YAML Name | Type | Default | Valid Values | Expression | Description |
 |----------|-----------|------|---------|--------------|-----------|-------------|
-| Source | `source` | string | `""` | Any string, typically `{{variable}}` | Yes | The content to parse. Supports plain text, `base64:` binary, `file:` URIs, `text:` prefix, and `{{variable}}` expressions resolving to `string` or `BytesValue` (`byte[]`). See [Content Source Resolution](#content-source-resolution) below. |
+| Source | `source` | string | `""` | Any string, typically `{{variable}}` | Yes | The content to parse. Supports plain text, `data:` URI binary, `file:` URIs, `text:` prefix, and `{{variable}}` expressions resolving to `string` or `BytesValue` (`byte[]`). See [Content Source Resolution](#content-source-resolution) below. |
 | Format | `format` | string | `""` | `markdown`, `html`, or any registered parser name | Yes | The content format. Must match a registered `IContentParser.FormatName`. |
 | Options | `options` | dict? | `null` | Key-value dictionary | No | Parser-specific options (e.g., NDC `columns`, `charsets`). Passed to the content parser. |
 
@@ -1476,7 +1476,7 @@ The `source` property is resolved at render time through `ContentSourceResolver`
 | Source Format | Example | Resolved As | Description |
 |---------------|---------|-------------|-------------|
 | Template variable (`BytesValue`) | `source: "{{rawData}}"` | Binary (`byte[]`) | When `{{variable}}` resolves to `BytesValue` in the data context, binary data is passed directly to `IBinaryContentParser`. No string encoding overhead. |
-| `base64:` prefix | `source: "base64:SGVsbG8="` | Binary (`byte[]`) | Base64-encoded payload decoded into bytes. Useful for embedding binary data in JSON/YAML. |
+| `data:` URI | `source: "data:;base64,SGVsbG8="` | Binary (`byte[]`) | Data URI with base64-encoded payload decoded into bytes. MIME type is optional (e.g., `data:application/octet-stream;base64,...`). Useful for embedding binary data in JSON/YAML. |
 | `file:` scheme | `source: "file:receipt.bin"` | Binary (`byte[]`) | Loads content via registered resource loaders (file system, HTTP, embedded). Also supports `file:///` URIs. Throws if file not found. |
 | `text:` prefix | `source: "text:# Hello"` | Text (`string`) | Forces text interpretation, skipping file path detection. |
 | File path heuristic | `source: "receipt.md"` | Binary (`byte[]`) | If source looks like a file path (contains `/`, `\`, or a file extension), tries resource loaders first. Falls back to text if no loader matches. |
@@ -1585,10 +1585,10 @@ layout:
           font_style: bold
 ```
 
-Data (JSON with base64-encoded NDC binary):
+Data (JSON with data URI-encoded NDC binary):
 ```json
 {
-  "receiptData": "base64:G1sxfjQwHSgxHQ=="
+  "receiptData": "data:application/octet-stream;base64,G1sxfjQwHSgxHQ=="
 }
 ```
 

src/FlexRender.Core/Loaders/Base64ResourceLoader.cs

@@ -13,6 +13,9 @@ namespace FlexRender.Loaders;
 public sealed class Base64ResourceLoader : IResourceLoader
 {
     private const string DataPrefix = "data:";
+    private const string DataUriPrefix = "data://";
+    private const string Base64Shorthand = "base64:";
+    private const string Base64UriPrefix = "base64://";
 
     private readonly FlexRenderOptions _options;
 
@@ -36,7 +39,8 @@ public Base64ResourceLoader(FlexRenderOptions options)
 
     /// <inheritdoc />
     /// <remarks>
-    /// Returns <c>true</c> for URIs that start with "data:".
+    /// Returns <c>true</c> for URIs that start with "data:", "data://", "base64:", or "base64://".
+    /// All shorthand forms are normalized to standard "data:" URI format internally.
     /// </remarks>
     public bool CanHandle(string uri)
     {
@@ -45,7 +49,8 @@ public bool CanHandle(string uri)
             return false;
         }
 
-        return uri.StartsWith(DataPrefix, StringComparison.OrdinalIgnoreCase);
+        return uri.StartsWith(DataPrefix, StringComparison.OrdinalIgnoreCase)
+            || uri.StartsWith(Base64Shorthand, StringComparison.Ordinal);
     }
 
     /// <inheritdoc />
@@ -64,6 +69,21 @@ public bool CanHandle(string uri)
 
         cancellationToken.ThrowIfCancellationRequested();
 
+        // Normalize all variants to standard "data:" URI format
+        if (uri.StartsWith(Base64UriPrefix, StringComparison.Ordinal))
+        {
+            uri = "data:application/octet-stream;base64," + uri[Base64UriPrefix.Length..];
+        }
+        else if (uri.StartsWith(Base64Shorthand, StringComparison.Ordinal))
+        {
+            uri = "data:application/octet-stream;base64," + uri[Base64Shorthand.Length..];
+        }
+        else if (uri.StartsWith(DataUriPrefix, StringComparison.OrdinalIgnoreCase))
+        {
+            // "data://mime;base64,payload" → "data:mime;base64,payload"
+            uri = DataPrefix + uri[DataUriPrefix.Length..];
+        }
+
         var base64Data = ExtractBase64Data(uri);
         ValidateDataSize(base64Data);
 

src/FlexRender.Core/Loaders/FileResourceLoader.cs

@@ -13,8 +13,6 @@ namespace FlexRender.Loaders;
 /// </remarks>
 public sealed class FileResourceLoader : IResourceLoader
 {
-    private static readonly string[] UrlPrefixes = ["http://", "https://", "data:", "embedded://"];
-
     private readonly FlexRenderOptions _options;
 
     /// <summary>
@@ -37,7 +35,8 @@ public FileResourceLoader(FlexRenderOptions options)
 
     /// <inheritdoc />
     /// <remarks>
-    /// Returns <c>true</c> for URIs that do not start with http://, https://, data:, or embedded://.
+    /// Returns <c>true</c> for URIs that look like file paths or use the "file:" / "file://" scheme.
+    /// Rejects anything with other URI schemes (e.g., "http://", "data:", "base64:", "embedded://").
     /// </remarks>
     public bool CanHandle(string uri)
     {
@@ -46,9 +45,41 @@ public bool CanHandle(string uri)
             return false;
         }
 
-        foreach (var prefix in UrlPrefixes)
+        // Allow "file:" and "file://" scheme — this loader handles local files
+        if (uri.StartsWith("file:", StringComparison.OrdinalIgnoreCase))
+        {
+            return true;
+        }
+
+        // Reject any URI with a "://" scheme (e.g., "http://", "data://", "custom://")
+        if (uri.Contains("://", StringComparison.Ordinal))
         {
-            if (uri.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))
+            return false;
+        }
+
+        // Reject scheme-like prefixes without "://" (e.g., "data:", "base64:")
+        // A URI scheme is [a-zA-Z][a-zA-Z0-9+.-]*: (min 2 chars to exclude Windows drive letters like "C:")
+        var colonIndex = uri.IndexOf(':');
+        if (colonIndex > 1 && colonIndex < 20)
+        {
+            var scheme = uri.AsSpan(0, colonIndex);
+            if (char.IsLetter(scheme[0]) && IsValidScheme(scheme))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// Checks whether a span represents a valid URI scheme (letters, digits, +, ., -).
+    /// </summary>
+    private static bool IsValidScheme(ReadOnlySpan<char> scheme)
+    {
+        foreach (var c in scheme)
+        {
+            if (!char.IsLetterOrDigit(c) && c != '+' && c != '.' && c != '-')
             {
                 return false;
             }
@@ -70,9 +101,19 @@ public bool CanHandle(string uri)
             return Task.FromResult<Stream?>(null);
         }
 
-        ValidatePathSecurity(uri);
+        // Strip file: scheme prefix if present
+        // Supports: "file:///path" (RFC 8089), "file://path", "file:path"
+        var path = uri;
+        if (path.StartsWith("file:///", StringComparison.OrdinalIgnoreCase))
+            path = path["file:///".Length..];
+        else if (path.StartsWith("file://", StringComparison.OrdinalIgnoreCase))
+            path = path["file://".Length..];
+        else if (path.StartsWith("file:", StringComparison.OrdinalIgnoreCase))
+            path = path["file:".Length..];
+
+        ValidatePathSecurity(path);
 
-        var fullPath = ResolvePath(uri);
+        var fullPath = ResolvePath(path);
 
         if (!File.Exists(fullPath))
         {