@json-to-office/jto 0.28.0 → 0.28.1

package/dist/cli.js

@@ -234,10 +234,10 @@ function collectReferencedNames(config2, customThemes, adapterName) {
 }
 function collectReferencedWeights(config2, customThemes) {
   const weights = /* @__PURE__ */ new Set();
-  const visit2 = (node) => {
+  const visit3 = (node) => {
     if (node == null) return;
     if (Array.isArray(node)) {
-      for (const item of node) visit2(item);
+      for (const item of node) visit3(item);
       return;
     }
     if (typeof node === "object") {
@@ -245,21 +245,21 @@ function collectReferencedWeights(config2, customThemes) {
         if (k === "fontWeight" && typeof v === "number" && v >= 100 && v <= 900) {
           weights.add(v);
         } else {
-          visit2(v);
+          visit3(v);
         }
       }
     }
   };
-  visit2(config2);
-  for (const theme of Object.values(customThemes ?? {})) visit2(theme);
+  visit3(config2);
+  for (const theme of Object.values(customThemes ?? {})) visit3(theme);
   return weights;
 }
 function collectReferencedItalic(config2, customThemes) {
   let found = false;
-  const visit2 = (node) => {
+  const visit3 = (node) => {
     if (found || node == null) return;
     if (Array.isArray(node)) {
-      for (const item of node) visit2(item);
+      for (const item of node) visit3(item);
       return;
     }
     if (typeof node === "object") {
@@ -268,14 +268,14 @@ function collectReferencedItalic(config2, customThemes) {
           found = true;
           return;
         }
-        visit2(v);
+        visit3(v);
       }
     }
   };
-  visit2(config2);
+  visit3(config2);
   if (!found) {
     for (const theme of Object.values(customThemes ?? {})) {
-      visit2(theme);
+      visit3(theme);
       if (found) break;
     }
   }
@@ -1640,36 +1640,36 @@ function isPrivateHost(host) {
   const firstIpv6Group = Number.parseInt(normalized.split(":")[0] || "0", 16);
   return firstIpv6Group >= 64512 && firstIpv6Group <= 65023 || firstIpv6Group >= 65152 && firstIpv6Group <= 65215;
 }
-function assertAllowedUrl(source, path7, allowedHosts) {
+function assertAllowedUrl(source, path8, allowedHosts) {
   if (source.startsWith("data:")) return;
   let url;
   try {
     url = new URL(source);
   } catch {
     throw new UnsafeOutboundSourceError(
-      path7,
+      path8,
       "local and relative file paths are disabled for HTTP requests"
     );
   }
   if (url.protocol !== "https:") {
-    throw new UnsafeOutboundSourceError(path7, "only HTTPS URLs are allowed");
+    throw new UnsafeOutboundSourceError(path8, "only HTTPS URLs are allowed");
   }
   if (url.username || url.password) {
     throw new UnsafeOutboundSourceError(
-      path7,
+      path8,
       "URLs containing credentials are not allowed"
     );
   }
   const host = url.hostname.toLowerCase().replace(/\.$/, "");
   if (isPrivateHost(host)) {
     throw new UnsafeOutboundSourceError(
-      path7,
+      path8,
       `private or local host "${host}" is not allowed`
     );
   }
   if (!allowedHosts.some((pattern) => hostMatches(host, pattern))) {
     throw new UnsafeOutboundSourceError(
-      path7,
+      path8,
       `host "${host}" is not in OUTBOUND_HOST_ALLOWLIST`
     );
   }
@@ -1687,13 +1687,13 @@ function extractCssReferences(input) {
 function extractAbsoluteUrls(input) {
   return input.match(/(?:https?|file):\/\/[^\s'"<>)}\]]+/gi) ?? [];
 }
-function assertSafeSvg(svg, path7, allowedHosts) {
+function assertSafeSvg(svg, path8, allowedHosts) {
   if (/<\s*script\b/i.test(svg) || /<\s*(?:foreignObject|iframe|object|embed)\b/i.test(svg) || /\bon[a-z]+\s*=/i.test(svg)) {
-    throw new UnsafeOutboundSourceError(path7, "active SVG content is disabled");
+    throw new UnsafeOutboundSourceError(path8, "active SVG content is disabled");
   }
   if (/<!\s*(?:DOCTYPE|ENTITY)\b/i.test(svg)) {
     throw new UnsafeOutboundSourceError(
-      path7,
+      path8,
       "SVG document types and entities are disabled"
     );
   }
@@ -1702,20 +1702,20 @@ function assertSafeSvg(svg, path7, allowedHosts) {
   while (match = refPattern.exec(svg)) {
     const ref = match[2].trim();
     if (!ref || ref.startsWith("#") || ref.startsWith("data:")) continue;
-    assertAllowedUrl(ref, path7, allowedHosts);
+    assertAllowedUrl(ref, path8, allowedHosts);
   }
   for (const ref of extractCssReferences(svg)) {
     if (ref.startsWith("#") || ref.startsWith("data:")) continue;
-    assertAllowedUrl(ref, path7, allowedHosts);
+    assertAllowedUrl(ref, path8, allowedHosts);
   }
 }
-function assertSafeEncodedImage(source, path7, allowedHosts) {
+function assertSafeEncodedImage(source, path8, allowedHosts) {
   let candidate = source.trim();
   let declaredSvg = false;
   if (candidate.startsWith("data:")) {
     const comma = candidate.indexOf(",");
     if (comma < 0) {
-      throw new UnsafeOutboundSourceError(path7, "malformed image data URL");
+      throw new UnsafeOutboundSourceError(path8, "malformed image data URL");
     }
     const metadata = candidate.slice(5, comma);
     declaredSvg = metadata.split(";")[0].toLowerCase() === "image/svg+xml";
@@ -1724,7 +1724,7 @@ function assertSafeEncodedImage(source, path7, allowedHosts) {
     try {
       candidate = /(?:^|;)base64(?:;|$)/i.test(metadata) ? Buffer.from(payload, "base64").toString("utf8") : decodeURIComponent(payload);
     } catch {
-      throw new UnsafeOutboundSourceError(path7, "malformed SVG data URL");
+      throw new UnsafeOutboundSourceError(path8, "malformed SVG data URL");
     }
   } else if (!/<\s*svg\b/i.test(candidate)) {
     candidate = Buffer.from(candidate, "base64").toString("utf8");
@@ -1732,37 +1732,37 @@ function assertSafeEncodedImage(source, path7, allowedHosts) {
   const svgStart = candidate.search(/<\s*svg\b/i);
   if (svgStart < 0) {
     if (declaredSvg) {
-      throw new UnsafeOutboundSourceError(path7, "malformed SVG image data");
+      throw new UnsafeOutboundSourceError(path8, "malformed SVG image data");
     }
     return;
   }
-  assertSafeSvg(candidate, path7, allowedHosts);
+  assertSafeSvg(candidate, path8, allowedHosts);
 }
-function assertSafeResources(resources, path7, allowedHosts) {
+function assertSafeResources(resources, path8, allowedHosts) {
   if (typeof resources.js === "string" && resources.js.trim()) {
     throw new UnsafeOutboundSourceError(
-      `${path7}.js`,
+      `${path8}.js`,
       "remote renderer JavaScript resources are disabled"
     );
   }
   if (typeof resources.css === "string") {
     for (const ref of extractCssReferences(resources.css)) {
       if (ref.startsWith("data:")) continue;
-      assertAllowedUrl(ref, `${path7}.css`, allowedHosts);
+      assertAllowedUrl(ref, `${path8}.css`, allowedHosts);
     }
   }
   if (Array.isArray(resources.files) && resources.files.length > 0) {
     throw new UnsafeOutboundSourceError(
-      `${path7}.files`,
+      `${path8}.files`,
       "remote renderer JavaScript resources are disabled"
     );
   }
 }
-function assertNoRemoteReferences(value, path7, allowedHosts, seen) {
+function assertNoRemoteReferences(value, path8, allowedHosts, seen) {
   if (typeof value === "string") {
     if (/\b(?:fetch|XMLHttpRequest|WebSocket|EventSource)\s*\(/i.test(value) || /\b(?:javascript|file):/i.test(value)) {
       throw new UnsafeOutboundSourceError(
-        path7,
+        path8,
         "network-capable JavaScript and file URLs are disabled"
       );
     }
@@ -1771,11 +1771,11 @@ function assertNoRemoteReferences(value, path7, allowedHosts, seen) {
       ...extractCssReferences(value)
     ]) {
       if (url.startsWith("data:")) continue;
-      assertAllowedUrl(url, path7, allowedHosts);
+      assertAllowedUrl(url, path8, allowedHosts);
     }
     if (/^\/\//.test(value.trim())) {
       throw new UnsafeOutboundSourceError(
-        path7,
+        path8,
         "protocol-relative URLs are disabled"
       );
     }
@@ -1785,20 +1785,20 @@ function assertNoRemoteReferences(value, path7, allowedHosts, seen) {
   seen.add(value);
   if (Array.isArray(value)) {
     value.forEach(
-      (entry, index) => assertNoRemoteReferences(entry, `${path7}[${index}]`, allowedHosts, seen)
+      (entry, index) => assertNoRemoteReferences(entry, `${path8}[${index}]`, allowedHosts, seen)
     );
     return;
   }
   for (const [key, child] of Object.entries(value)) {
-    assertNoRemoteReferences(child, `${path7}.${key}`, allowedHosts, seen);
+    assertNoRemoteReferences(child, `${path8}.${key}`, allowedHosts, seen);
   }
 }
-function visit(value, path7, containerKey, allowedHosts, seen) {
+function visit(value, path8, containerKey, allowedHosts, seen) {
   if (!value || typeof value !== "object" || seen.has(value)) return;
   seen.add(value);
   if (Array.isArray(value)) {
     value.forEach(
-      (entry, index) => visit(entry, `${path7}[${index}]`, containerKey, allowedHosts, seen)
+      (entry, index) => visit(entry, `${path8}[${index}]`, containerKey, allowedHosts, seen)
     );
     return;
   }
@@ -1806,7 +1806,7 @@ function visit(value, path7, containerKey, allowedHosts, seen) {
   for (const key of Object.keys(record)) {
     if (DANGEROUS_KEYS.has(key)) {
       throw new UnsafeOutboundSourceError(
-        `${path7}.${key}`,
+        `${path8}.${key}`,
         "prototype mutation keys are disabled"
       );
     }
@@ -1814,31 +1814,31 @@ function visit(value, path7, containerKey, allowedHosts, seen) {
   const kind = typeof record.kind === "string" ? record.kind : void 0;
   if (kind === "file" && typeof record.path === "string") {
     throw new UnsafeOutboundSourceError(
-      `${path7}.path`,
+      `${path8}.path`,
       "local file sources are disabled for HTTP requests"
     );
   }
   if ((kind === "url" || kind === "variable") && typeof record.url === "string") {
-    assertAllowedUrl(record.url, `${path7}.url`, allowedHosts);
+    assertAllowedUrl(record.url, `${path8}.url`, allowedHosts);
   }
   const componentName = typeof record.name === "string" ? record.name.toLowerCase() : void 0;
   const props = isRecord(record.props) ? record.props : void 0;
   if (componentName && props) {
     if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.path === "string") {
-      assertAllowedUrl(props.path, `${path7}.props.path`, allowedHosts);
-      assertSafeEncodedImage(props.path, `${path7}.props.path`, allowedHosts);
+      assertAllowedUrl(props.path, `${path8}.props.path`, allowedHosts);
+      assertSafeEncodedImage(props.path, `${path8}.props.path`, allowedHosts);
     }
     if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.base64 === "string") {
       assertSafeEncodedImage(
         props.base64,
-        `${path7}.props.base64`,
+        `${path8}.props.base64`,
         allowedHosts
       );
     }
     if ((componentName === "highcharts" || componentName === "visual") && typeof props.serverUrl === "string") {
       assertAllowedUrl(
         props.serverUrl,
-        `${path7}.props.serverUrl`,
+        `${path8}.props.serverUrl`,
         allowedHosts
       );
     }
@@ -1846,30 +1846,30 @@ function visit(value, path7, containerKey, allowedHosts, seen) {
       if (isRecord(props.resources)) {
         assertSafeResources(
           props.resources,
-          `${path7}.props.resources`,
+          `${path8}.props.resources`,
           allowedHosts
         );
       }
       assertNoRemoteReferences(
         props.options,
-        `${path7}.props.options`,
+        `${path8}.props.options`,
         allowedHosts,
         /* @__PURE__ */ new WeakSet()
       );
     }
   }
   if (containerKey === "image" && typeof record.path === "string") {
-    assertAllowedUrl(record.path, `${path7}.path`, allowedHosts);
-    assertSafeEncodedImage(record.path, `${path7}.path`, allowedHosts);
+    assertAllowedUrl(record.path, `${path8}.path`, allowedHosts);
+    assertSafeEncodedImage(record.path, `${path8}.path`, allowedHosts);
   }
   if (typeof record.svg === "string") {
-    assertSafeSvg(record.svg, `${path7}.svg`, allowedHosts);
+    assertSafeSvg(record.svg, `${path8}.svg`, allowedHosts);
   }
   if (containerKey === "resources") {
-    assertSafeResources(record, path7, allowedHosts);
+    assertSafeResources(record, path8, allowedHosts);
   }
   for (const [key, child] of Object.entries(record)) {
-    visit(child, `${path7}.${key}`, key, allowedHosts, seen);
+    visit(child, `${path8}.${key}`, key, allowedHosts, seen);
   }
 }
 function assertSafeOutboundSources(value, policy, rootPath = "request") {
@@ -1890,9 +1890,9 @@ var init_outbound_source_policy = __esm({
     "use strict";
     init_esm_shims();
     UnsafeOutboundSourceError = class extends Error {
-      constructor(path7, reason) {
-        super(`Unsafe outbound source at ${path7}: ${reason}`);
-        this.path = path7;
+      constructor(path8, reason) {
+        super(`Unsafe outbound source at ${path8}: ${reason}`);
+        this.path = path8;
         this.name = "UnsafeOutboundSourceError";
       }
     };
@@ -2008,6 +2008,118 @@ var init_rasterize_route = __esm({
   }
 });
 
+// src/server/services/template-media-inliner.ts
+import { promises as fs5 } from "fs";
+import path7 from "path";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isInlineCandidate(source) {
+  if (!source || source.includes("\0")) return false;
+  if (source.startsWith("data:")) return false;
+  if (path7.isAbsolute(source)) return false;
+  try {
+    new URL(source);
+    return false;
+  } catch {
+    return true;
+  }
+}
+async function toDataUrl(source, baseDir, state) {
+  let cacheKey = source;
+  let result = null;
+  try {
+    const resolved = await fs5.realpath(path7.resolve(baseDir, source));
+    cacheKey = resolved;
+    const cached2 = state.cache.get(cacheKey);
+    if (cached2 !== void 0) return cached2;
+    const contained = resolved === state.baseDirReal || resolved.startsWith(state.baseDirReal + path7.sep);
+    if (contained) {
+      const mime = MIME_BY_EXTENSION[path7.extname(resolved).toLowerCase()];
+      if (mime) {
+        const stat = await fs5.stat(resolved);
+        if (stat.isFile() && stat.size <= state.maxFileBytes && stat.size <= state.totalBudget) {
+          const buffer = await fs5.readFile(resolved);
+          state.totalBudget -= buffer.length;
+          result = `data:${mime};base64,${buffer.toString("base64")}`;
+        }
+      }
+    }
+  } catch {
+  }
+  state.cache.set(cacheKey, result);
+  return result;
+}
+async function visit2(value, containerKey, baseDir, state, seen) {
+  if (!value || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      await visit2(entry, containerKey, baseDir, state, seen);
+    }
+    return;
+  }
+  const record = value;
+  const componentName = typeof record.name === "string" ? record.name.toLowerCase() : void 0;
+  const props = isRecord2(record.props) ? record.props : void 0;
+  if (componentName === "image" && props && typeof props.path === "string" && isInlineCandidate(props.path)) {
+    const inlined = await toDataUrl(props.path, baseDir, state);
+    if (inlined !== null) props.path = inlined;
+  }
+  if (containerKey === "image" && typeof record.path === "string" && isInlineCandidate(record.path)) {
+    const inlined = await toDataUrl(record.path, baseDir, state);
+    if (inlined !== null) record.path = inlined;
+  }
+  for (const [key, child] of Object.entries(record)) {
+    await visit2(child, key, baseDir, state, seen);
+  }
+}
+async function inlineTemplateMedia(jsonDefinition, baseDir, options = {}) {
+  if (typeof jsonDefinition === "string") {
+    try {
+      jsonDefinition = JSON.parse(jsonDefinition);
+    } catch {
+      return jsonDefinition;
+    }
+  }
+  if (!jsonDefinition || typeof jsonDefinition !== "object") {
+    return jsonDefinition;
+  }
+  let baseDirReal;
+  try {
+    baseDirReal = await fs5.realpath(baseDir);
+  } catch {
+    return jsonDefinition;
+  }
+  const clone = structuredClone(jsonDefinition);
+  const state = {
+    baseDirReal,
+    maxFileBytes: options.maxFileBytes ?? 10 * 1024 * 1024,
+    totalBudget: options.maxTotalBytes ?? 32 * 1024 * 1024,
+    cache: /* @__PURE__ */ new Map()
+  };
+  await visit2(clone, void 0, baseDir, state, /* @__PURE__ */ new WeakSet());
+  return clone;
+}
+var MIME_BY_EXTENSION;
+var init_template_media_inliner = __esm({
+  "src/server/services/template-media-inliner.ts"() {
+    "use strict";
+    init_esm_shims();
+    MIME_BY_EXTENSION = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".svg": "image/svg+xml",
+      ".webp": "image/webp",
+      ".bmp": "image/bmp",
+      ".tiff": "image/tiff",
+      ".tif": "image/tiff"
+    };
+  }
+});
+
 // src/server/routes/format.ts
 import { Hono as Hono2 } from "hono";
 import { HTTPException as HTTPException4 } from "hono/http-exception";
@@ -2019,9 +2131,9 @@ import {
 import { dirname } from "path";
 function createFormatRouter(adapter) {
   const router = new Hono2();
-  const assertRequestSources = (value, path7) => {
+  const assertRequestSources = (value, path8) => {
     try {
-      assertSafeOutboundSources(value, config.outboundSources, path7);
+      assertSafeOutboundSources(value, config.outboundSources, path8);
     } catch (error) {
       if (error instanceof UnsafeOutboundSourceError) {
         throw new HTTPException4(400, { message: error.message });
@@ -2049,6 +2161,15 @@ function createFormatRouter(adapter) {
       return void 0;
     }
   };
+  const inlineDiscoveredMedia = async (jsonDefinition, baseDir) => {
+    if (baseDir === void 0 || config.outboundSources.mode === "development") {
+      return jsonDefinition;
+    }
+    return inlineTemplateMedia(jsonDefinition, baseDir, {
+      maxFileBytes: config.requestLimits.maxFileSize,
+      maxTotalBytes: config.requestLimits.maxBodySize
+    });
+  };
   const contentTypeMw = async (c, next) => {
     const contentType = c.req.header("content-type");
     if (!contentType || !contentType.includes("application/json")) {
@@ -2072,7 +2193,12 @@ function createFormatRouter(adapter) {
       const { jsonDefinition, customThemes, options } = getValidated(c, "json");
       const requestId = c.get("requestId");
       try {
-        assertRequestSources(jsonDefinition, "jsonDefinition");
+        const baseDir = await resolveSourceBaseDir(options);
+        const effectiveDefinition = await inlineDiscoveredMedia(
+          jsonDefinition,
+          baseDir
+        );
+        assertRequestSources(effectiveDefinition, "jsonDefinition");
         assertRequestSources(customThemes, "customThemes");
         assertRequestSources(options, "options");
         const bypassCache = c.req.header("X-Bypass-Cache") === "true" || c.req.query("bypass-cache") === "true" || options?.bypassCache === true;
@@ -2084,11 +2210,10 @@ function createFormatRouter(adapter) {
         } else if (rawFonts) {
           sanitizedFonts = rawFonts;
         }
-        const baseDir = await resolveSourceBaseDir(options);
         const clientOptions = { ...options };
         delete clientOptions.baseDir;
         const result = await generatorService.generate({
-          jsonDefinition,
+          jsonDefinition: effectiveDefinition,
           customThemes,
           options: {
             ...clientOptions,
@@ -2352,12 +2477,16 @@ function createFormatRouter(adapter) {
       );
       const { jsonDefinition, customThemes, options } = getValidated(c, "json");
       try {
-        assertRequestSources(jsonDefinition, "jsonDefinition");
+        const baseDir = await resolveSourceBaseDir(options);
+        const effectiveDefinition = await inlineDiscoveredMedia(
+          jsonDefinition,
+          baseDir
+        );
+        assertRequestSources(effectiveDefinition, "jsonDefinition");
         assertRequestSources(customThemes, "customThemes");
         assertRequestSources(options, "options");
-        const baseDir = await resolveSourceBaseDir(options);
         const generated = await generatorService.generate({
-          jsonDefinition,
+          jsonDefinition: effectiveDefinition,
           customThemes,
           options: {
             bypassCache: true,
@@ -2530,6 +2659,7 @@ var init_format = __esm({
     init_config();
     init_outbound_source_policy();
     init_libreoffice_converter();
+    init_template_media_inliner();
   }
 });
 
@@ -3863,9 +3993,9 @@ var init_unified_server = __esm({
           return await apiApp.fetch(c.req.raw, c.env);
         });
         this.app.use("*", async (c, next) => {
-          const path7 = c.req.path;
-          if (path7.startsWith("/api")) {
-            if (/\.(ts|tsx|js|jsx|css|map)$/.test(path7)) {
+          const path8 = c.req.path;
+          if (path8.startsWith("/api")) {
+            if (/\.(ts|tsx|js|jsx|css|map)$/.test(path8)) {
               return next();
             }
             const response = await apiApp.fetch(c.req.raw, c.env);
@@ -3968,8 +4098,8 @@ var init_unified_server = __esm({
         }
         if (this.viteServer) {
           this.app.use("*", async (c, next) => {
-            const path7 = c.req.path;
-            if ((path7.startsWith("/api") || path7 === "/health") && !/\.(ts|tsx|js|jsx|css|map)$/.test(path7)) {
+            const path8 = c.req.path;
+            if ((path8.startsWith("/api") || path8 === "/health") && !/\.(ts|tsx|js|jsx|css|map)$/.test(path8)) {
               return next();
             }
             const env = c.env;
@@ -3988,7 +4118,7 @@ var init_unified_server = __esm({
       }
       async setupBuiltClient(clientPath) {
         const { serveStatic } = await import("@hono/node-server/serve-static");
-        const fs5 = await import("fs");
+        const fs6 = await import("fs");
         const { extname } = await import("path");
         const mime = await import("mime-types");
         const format = this.adapter.name.replace(/[^a-zA-Z0-9]/g, "");
@@ -3996,7 +4126,7 @@ var init_unified_server = __esm({
           "/assets/*",
           serveStatic({
             root: clientPath,
-            rewriteRequestPath: (path7) => path7.replace(/^\/assets/, "/assets")
+            rewriteRequestPath: (path8) => path8.replace(/^\/assets/, "/assets")
           })
         );
         this.app.use("/*", async (c, next) => {
@@ -4005,9 +4135,9 @@ var init_unified_server = __esm({
           const ext = extname(reqPath);
           if (ext) {
             const filePath = resolve(clientPath, reqPath.slice(1));
-            if (fs5.existsSync(filePath)) {
+            if (fs6.existsSync(filePath)) {
               const mimeType = mime.lookup(filePath) || "application/octet-stream";
-              const content = fs5.readFileSync(filePath);
+              const content = fs6.readFileSync(filePath);
               c.header("Content-Type", mimeType);
               return c.body(content);
             }
@@ -4019,8 +4149,8 @@ var init_unified_server = __esm({
           if (reqPath.startsWith("/api") || reqPath === "/health")
             return c.notFound();
           const indexPath = resolve(clientPath, "index.html");
-          if (fs5.existsSync(indexPath)) {
-            let html = fs5.readFileSync(indexPath, "utf-8");
+          if (fs6.existsSync(indexPath)) {
+            let html = fs6.readFileSync(indexPath, "utf-8");
             html = html.replace(
               "</head>",
               `<script>window.__JTO_FORMAT__ = '${format}';</script>
@@ -4181,7 +4311,7 @@ function createDevCommand(adapter) {
 }
 
 // src/cli.ts
-var PACKAGE_VERSION = true ? "0.28.0" : "dev-mode";
+var PACKAGE_VERSION = true ? "0.28.1" : "dev-mode";
 var program = new Command2();
 program.name("jto").description("JSON to Office CLI - Generate .docx and .pptx from JSON").version(PACKAGE_VERSION);
 registerCoreCommands(program, {