@json-to-office/jto 0.20.0 → 0.22.0

package/dist/render-server.js

@@ -1,6 +1,10 @@
 // src/render-server.ts
-import { serve } from "@hono/node-server";
+import { fileURLToPath } from "url";
+import { resolve } from "path";
 import { Hono } from "hono";
+import { bodyLimit as bodyLimit2 } from "hono/body-limit";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { secureHeaders } from "hono/secure-headers";
 
 // src/server/rasterize-route.ts
 import { Type } from "@sinclair/typebox";
@@ -63,6 +67,319 @@ function getValidated(c, target) {
   return validatedData[target];
 }
 
+// src/server/security/outbound-source-policy.ts
+var UnsafeOutboundSourceError = class extends Error {
+  constructor(path, reason) {
+    super(`Unsafe outbound source at ${path}: ${reason}`);
+    this.path = path;
+    this.name = "UnsafeOutboundSourceError";
+  }
+};
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+var COMPONENT_SOURCE_NAMES = /* @__PURE__ */ new Set(["image"]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hostMatches(host, pattern) {
+  const normalized = pattern.toLowerCase().replace(/\.$/, "");
+  if (normalized.startsWith("*.")) {
+    const suffix = normalized.slice(1);
+    return host.endsWith(suffix) && host.length > suffix.length;
+  }
+  return host === normalized;
+}
+function isPrivateIpv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4) return false;
+  const octets = parts.map(Number);
+  if (octets.some(
+    (part, index) => !Number.isInteger(part) || part < 0 || part > 255 || String(part) !== parts[index]
+  )) {
+    return false;
+  }
+  const [a, b] = octets;
+  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 0 || b === 168) || a === 198 && (b === 18 || b === 19) || a >= 224;
+}
+function isPrivateHost(host) {
+  const normalized = host.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::" || normalized === "::1") {
+    return true;
+  }
+  if (isPrivateIpv4(normalized)) return true;
+  if (normalized.startsWith("::ffff:")) {
+    const mapped = normalized.slice("::ffff:".length);
+    if (isPrivateIpv4(mapped)) return true;
+    const groups = mapped.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+    if (groups) {
+      const value = Number.parseInt(groups[1], 16) * 65536 + Number.parseInt(groups[2], 16);
+      return isPrivateIpv4(
+        [
+          value >>> 24,
+          value >>> 16 & 255,
+          value >>> 8 & 255,
+          value & 255
+        ].join(".")
+      );
+    }
+  }
+  const firstIpv6Group = Number.parseInt(normalized.split(":")[0] || "0", 16);
+  return firstIpv6Group >= 64512 && firstIpv6Group <= 65023 || firstIpv6Group >= 65152 && firstIpv6Group <= 65215;
+}
+function assertAllowedUrl(source, path, allowedHosts) {
+  if (source.startsWith("data:")) return;
+  let url;
+  try {
+    url = new URL(source);
+  } catch {
+    throw new UnsafeOutboundSourceError(
+      path,
+      "local and relative file paths are disabled for HTTP requests"
+    );
+  }
+  if (url.protocol !== "https:") {
+    throw new UnsafeOutboundSourceError(path, "only HTTPS URLs are allowed");
+  }
+  if (url.username || url.password) {
+    throw new UnsafeOutboundSourceError(
+      path,
+      "URLs containing credentials are not allowed"
+    );
+  }
+  const host = url.hostname.toLowerCase().replace(/\.$/, "");
+  if (isPrivateHost(host)) {
+    throw new UnsafeOutboundSourceError(
+      path,
+      `private or local host "${host}" is not allowed`
+    );
+  }
+  if (!allowedHosts.some((pattern) => hostMatches(host, pattern))) {
+    throw new UnsafeOutboundSourceError(
+      path,
+      `host "${host}" is not in OUTBOUND_HOST_ALLOWLIST`
+    );
+  }
+}
+function extractCssReferences(input) {
+  const references = [];
+  const urlPattern = /url\(\s*(['"]?)([^)'"\s]+)\1\s*\)/gi;
+  const importPattern = /@import\s+(?:url\(\s*)?(['"])([^'"]+)\1/gi;
+  for (const pattern of [urlPattern, importPattern]) {
+    let match;
+    while (match = pattern.exec(input)) references.push(match[2]);
+  }
+  return references;
+}
+function extractAbsoluteUrls(input) {
+  return input.match(/(?:https?|file):\/\/[^\s'"<>)}\]]+/gi) ?? [];
+}
+function assertSafeSvg(svg, path, allowedHosts) {
+  if (/<\s*script\b/i.test(svg) || /<\s*(?:foreignObject|iframe|object|embed)\b/i.test(svg) || /\bon[a-z]+\s*=/i.test(svg)) {
+    throw new UnsafeOutboundSourceError(path, "active SVG content is disabled");
+  }
+  if (/<!\s*(?:DOCTYPE|ENTITY)\b/i.test(svg)) {
+    throw new UnsafeOutboundSourceError(
+      path,
+      "SVG document types and entities are disabled"
+    );
+  }
+  const refPattern = /\b(?:href|src)\s*=\s*(['"])(.*?)\1/gi;
+  let match;
+  while (match = refPattern.exec(svg)) {
+    const ref = match[2].trim();
+    if (!ref || ref.startsWith("#") || ref.startsWith("data:")) continue;
+    assertAllowedUrl(ref, path, allowedHosts);
+  }
+  for (const ref of extractCssReferences(svg)) {
+    if (ref.startsWith("#") || ref.startsWith("data:")) continue;
+    assertAllowedUrl(ref, path, allowedHosts);
+  }
+}
+function assertSafeEncodedImage(source, path, allowedHosts) {
+  let candidate = source.trim();
+  let declaredSvg = false;
+  if (candidate.startsWith("data:")) {
+    const comma = candidate.indexOf(",");
+    if (comma < 0) {
+      throw new UnsafeOutboundSourceError(path, "malformed image data URL");
+    }
+    const metadata = candidate.slice(5, comma);
+    declaredSvg = metadata.split(";")[0].toLowerCase() === "image/svg+xml";
+    if (!declaredSvg) return;
+    const payload = candidate.slice(comma + 1);
+    try {
+      candidate = /(?:^|;)base64(?:;|$)/i.test(metadata) ? Buffer.from(payload, "base64").toString("utf8") : decodeURIComponent(payload);
+    } catch {
+      throw new UnsafeOutboundSourceError(path, "malformed SVG data URL");
+    }
+  } else if (!/<\s*svg\b/i.test(candidate)) {
+    candidate = Buffer.from(candidate, "base64").toString("utf8");
+  }
+  const svgStart = candidate.search(/<\s*svg\b/i);
+  if (svgStart < 0) {
+    if (declaredSvg) {
+      throw new UnsafeOutboundSourceError(path, "malformed SVG image data");
+    }
+    return;
+  }
+  assertSafeSvg(candidate, path, allowedHosts);
+}
+function assertSafeResources(resources, path, allowedHosts) {
+  if (typeof resources.js === "string" && resources.js.trim()) {
+    throw new UnsafeOutboundSourceError(
+      `${path}.js`,
+      "remote renderer JavaScript resources are disabled"
+    );
+  }
+  if (typeof resources.css === "string") {
+    for (const ref of extractCssReferences(resources.css)) {
+      if (ref.startsWith("data:")) continue;
+      assertAllowedUrl(ref, `${path}.css`, allowedHosts);
+    }
+  }
+  if (Array.isArray(resources.files) && resources.files.length > 0) {
+    throw new UnsafeOutboundSourceError(
+      `${path}.files`,
+      "remote renderer JavaScript resources are disabled"
+    );
+  }
+}
+function assertNoRemoteReferences(value, path, allowedHosts, seen) {
+  if (typeof value === "string") {
+    if (/\b(?:fetch|XMLHttpRequest|WebSocket|EventSource)\s*\(/i.test(value) || /\b(?:javascript|file):/i.test(value)) {
+      throw new UnsafeOutboundSourceError(
+        path,
+        "network-capable JavaScript and file URLs are disabled"
+      );
+    }
+    for (const url of [
+      ...extractAbsoluteUrls(value),
+      ...extractCssReferences(value)
+    ]) {
+      if (url.startsWith("data:")) continue;
+      assertAllowedUrl(url, path, allowedHosts);
+    }
+    if (/^\/\//.test(value.trim())) {
+      throw new UnsafeOutboundSourceError(
+        path,
+        "protocol-relative URLs are disabled"
+      );
+    }
+    return;
+  }
+  if (!value || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    value.forEach(
+      (entry, index) => assertNoRemoteReferences(entry, `${path}[${index}]`, allowedHosts, seen)
+    );
+    return;
+  }
+  for (const [key, child] of Object.entries(value)) {
+    assertNoRemoteReferences(child, `${path}.${key}`, allowedHosts, seen);
+  }
+}
+function visit(value, path, containerKey, allowedHosts, seen) {
+  if (!value || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    value.forEach(
+      (entry, index) => visit(entry, `${path}[${index}]`, containerKey, allowedHosts, seen)
+    );
+    return;
+  }
+  const record = value;
+  for (const key of Object.keys(record)) {
+    if (DANGEROUS_KEYS.has(key)) {
+      throw new UnsafeOutboundSourceError(
+        `${path}.${key}`,
+        "prototype mutation keys are disabled"
+      );
+    }
+  }
+  const kind = typeof record.kind === "string" ? record.kind : void 0;
+  if (kind === "file" && typeof record.path === "string") {
+    throw new UnsafeOutboundSourceError(
+      `${path}.path`,
+      "local file sources are disabled for HTTP requests"
+    );
+  }
+  if ((kind === "url" || kind === "variable") && typeof record.url === "string") {
+    assertAllowedUrl(record.url, `${path}.url`, allowedHosts);
+  }
+  const componentName = typeof record.name === "string" ? record.name.toLowerCase() : void 0;
+  const props = isRecord(record.props) ? record.props : void 0;
+  if (componentName && props) {
+    if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.path === "string") {
+      assertAllowedUrl(props.path, `${path}.props.path`, allowedHosts);
+      assertSafeEncodedImage(props.path, `${path}.props.path`, allowedHosts);
+    }
+    if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.base64 === "string") {
+      assertSafeEncodedImage(
+        props.base64,
+        `${path}.props.base64`,
+        allowedHosts
+      );
+    }
+    if ((componentName === "highcharts" || componentName === "visual") && typeof props.serverUrl === "string") {
+      assertAllowedUrl(
+        props.serverUrl,
+        `${path}.props.serverUrl`,
+        allowedHosts
+      );
+    }
+    if (componentName === "highcharts") {
+      if (isRecord(props.resources)) {
+        assertSafeResources(
+          props.resources,
+          `${path}.props.resources`,
+          allowedHosts
+        );
+      }
+      assertNoRemoteReferences(
+        props.options,
+        `${path}.props.options`,
+        allowedHosts,
+        /* @__PURE__ */ new WeakSet()
+      );
+    }
+  }
+  if (containerKey === "image" && typeof record.path === "string") {
+    assertAllowedUrl(record.path, `${path}.path`, allowedHosts);
+    assertSafeEncodedImage(record.path, `${path}.path`, allowedHosts);
+  }
+  if (typeof record.svg === "string") {
+    assertSafeSvg(record.svg, `${path}.svg`, allowedHosts);
+  }
+  if (containerKey === "resources") {
+    assertSafeResources(record, path, allowedHosts);
+  }
+  for (const [key, child] of Object.entries(record)) {
+    visit(child, `${path}.${key}`, key, allowedHosts, seen);
+  }
+}
+function assertSafeOutboundSources(value, policy, rootPath = "request") {
+  if (policy.mode === "development") return;
+  let parsed = value;
+  if (typeof value === "string") {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      return;
+    }
+  }
+  visit(parsed, rootPath, void 0, policy.allowedHosts, /* @__PURE__ */ new WeakSet());
+}
+function assertSafeRendererPayload(value, policy) {
+  assertSafeOutboundSources(value, policy, "export");
+  if (policy.mode === "development" || !isRecord(value)) return;
+  assertNoRemoteReferences(
+    value.infile,
+    "export.infile",
+    policy.allowedHosts,
+    /* @__PURE__ */ new WeakSet()
+  );
+}
+
 // src/server/rasterize-route.ts
 var RasterizeRequestSchema = Type.Object(
   {
@@ -105,6 +422,13 @@ function registerRasterizeRoute(router, options = {}) {
     async (c) => {
       const { presentation, dpi } = getValidated(c, "json");
       try {
+        if (options.sourcePolicy) {
+          assertSafeOutboundSources(
+            presentation,
+            options.sourcePolicy,
+            "presentation"
+          );
+        }
         const result = await getRasterizer()({
           presentation,
           dpi: clampVisualDpi(dpi ?? DEFAULT_VISUAL_DPI)
@@ -113,6 +437,9 @@ function registerRasterizeRoute(router, options = {}) {
       } catch (error) {
         options.onError?.(error);
         if (error instanceof HTTPException2) throw error;
+        if (error instanceof UnsafeOutboundSourceError) {
+          throw new HTTPException2(400, { message: error.message });
+        }
         const msg = error instanceof Error ? error.message.toLowerCase() : String(error);
         if (msg.includes("not found") || msg.includes("rasterization needs")) {
           throw new HTTPException2(503, { message: error.message });
@@ -130,24 +457,41 @@ function registerRasterizeRoute(router, options = {}) {
 
 // src/server/middleware/hono/rate-limit.ts
 import { HTTPException as HTTPException3 } from "hono/http-exception";
-var rateLimitStore = /* @__PURE__ */ new Map();
+function clientAddress(c, trustProxy) {
+  if (trustProxy) {
+    const forwarded = c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",")[0]?.trim();
+    if (forwarded) return forwarded;
+  }
+  const incoming = c.env?.incoming || c.env?.req;
+  return incoming?.socket?.remoteAddress || "anonymous";
+}
 var rateLimiter = (options) => {
   const { limit, window, keyGenerator } = options;
+  const maxEntries = options.maxEntries ?? 1e4;
+  const rateLimitStore = /* @__PURE__ */ new Map();
+  let lastCleanup = 0;
   return async (c, next) => {
-    const key = keyGenerator ? keyGenerator(c) : c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",").pop()?.trim() || "anonymous";
+    const clientKey = keyGenerator ? keyGenerator(c) : clientAddress(c, options.trustProxy === true);
+    const namespace = typeof options.namespace === "function" ? options.namespace(c) : options.namespace || `${c.req.method}:${c.req.path}`;
+    const key = `${namespace}:${String(clientKey).slice(0, 256)}`;
     const now = Date.now();
-    for (const [k, v] of rateLimitStore.entries()) {
-      if (v.resetTime < now) {
-        rateLimitStore.delete(k);
+    if (now - lastCleanup >= Math.min(window, 6e4)) {
+      for (const [storedKey, value] of rateLimitStore.entries()) {
+        if (value.resetTime <= now) rateLimitStore.delete(storedKey);
       }
+      lastCleanup = now;
     }
     const record = rateLimitStore.get(key);
     if (!record) {
+      if (rateLimitStore.size >= maxEntries) {
+        const oldestKey = rateLimitStore.keys().next().value;
+        if (oldestKey) rateLimitStore.delete(oldestKey);
+      }
       rateLimitStore.set(key, {
         count: 1,
         resetTime: now + window
       });
-    } else if (record.resetTime < now) {
+    } else if (record.resetTime <= now) {
       record.count = 1;
       record.resetTime = now + window;
     } else if (record.count >= limit) {
@@ -173,83 +517,512 @@ var rateLimiter = (options) => {
   };
 };
 
+// src/server/middleware/hono/concurrency-limit.ts
+function concurrencyLimiter(options) {
+  const limit = Math.max(1, Math.floor(options.limit));
+  const retryAfterSeconds = options.retryAfterSeconds ?? 1;
+  let active = 0;
+  return async (c, next) => {
+    c.header("X-Concurrency-Limit", String(limit));
+    if (active >= limit) {
+      c.header("Retry-After", String(retryAfterSeconds));
+      return c.json(
+        {
+          success: false,
+          error: "Server is at capacity",
+          code: "CONCURRENCY_LIMIT_EXCEEDED"
+        },
+        503
+      );
+    }
+    active += 1;
+    c.header("X-Concurrency-Remaining", String(Math.max(0, limit - active)));
+    try {
+      await next();
+    } finally {
+      active -= 1;
+    }
+  };
+}
+
+// src/server/middleware/hono/auth.ts
+import { createHash, timingSafeEqual } from "crypto";
+
+// src/server/config/index.ts
+import dotenv from "dotenv";
+dotenv.config();
+function positiveInteger(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function parseAuthMode(value, nodeEnv) {
+  if (value === "auto" || value === "required" || value === "disabled") {
+    return value;
+  }
+  return nodeEnv === "production" ? "required" : "auto";
+}
+function parseOutboundSourceMode(value, nodeEnv) {
+  if (value === "development" || value === "safe") return value;
+  return nodeEnv === "production" ? "safe" : "development";
+}
+function normalizeNodeEnv(value) {
+  return value === "development" || value === "test" ? value : "production";
+}
+function parseEnv(env) {
+  const nodeEnv = normalizeNodeEnv(env.NODE_ENV || "development");
+  return {
+    NODE_ENV: nodeEnv,
+    // No PORT here: the listener is opened by the dev server from the CLI
+    // config (`-p` > `server.port` > `PORT` env > format default), so a second
+    // copy of it in this module would be silently ignored.
+    CORS_ORIGIN: env.CORS_ORIGIN || "*",
+    API_KEY: env.API_KEY,
+    API_KEY_HEADER: env.API_KEY_HEADER || "x-api-key",
+    API_AUTH_MODE: parseAuthMode(env.API_AUTH_MODE, nodeEnv),
+    RATE_LIMIT_WINDOW_MS: positiveInteger(env.RATE_LIMIT_WINDOW_MS, 9e5),
+    RATE_LIMIT_MAX: positiveInteger(
+      env.RATE_LIMIT_MAX,
+      nodeEnv === "production" ? 100 : 1e3
+    ),
+    TRUST_PROXY_HEADERS: env.TRUST_PROXY_HEADERS === "true",
+    MAX_FILE_SIZE: positiveInteger(env.MAX_FILE_SIZE, 10 * 1024 * 1024),
+    MAX_REQUEST_BODY_SIZE: positiveInteger(
+      env.MAX_REQUEST_BODY_SIZE,
+      32 * 1024 * 1024
+    ),
+    MAX_CONCURRENT_REQUESTS: positiveInteger(
+      env.MAX_CONCURRENT_REQUESTS,
+      nodeEnv === "production" ? 8 : 64
+    ),
+    OUTBOUND_SOURCE_MODE: parseOutboundSourceMode(
+      env.OUTBOUND_SOURCE_MODE,
+      nodeEnv
+    ),
+    OUTBOUND_HOST_ALLOWLIST: (env.OUTBOUND_HOST_ALLOWLIST || "").split(",").map((host) => host.trim().toLowerCase()).filter(Boolean),
+    LIBREOFFICE_PATH: env.LIBREOFFICE_PATH,
+    LIBREOFFICE_TIMEOUT_MS: env.LIBREOFFICE_TIMEOUT_MS ? positiveInteger(env.LIBREOFFICE_TIMEOUT_MS, 3e4) : 3e4,
+    LOG_LEVEL: env.LOG_LEVEL || "info",
+    CACHE_ENABLED: env.CACHE_ENABLED !== "false",
+    CACHE_MAX_SIZE_MB: positiveInteger(env.CACHE_MAX_SIZE_MB, 100),
+    CACHE_TTL_SECONDS: positiveInteger(env.CACHE_TTL_SECONDS, 3600),
+    CACHE_MAX_ITEMS: positiveInteger(env.CACHE_MAX_ITEMS, 1e3)
+  };
+}
+var parsedEnv = parseEnv(process.env);
+var config = {
+  ...parsedEnv,
+  isDevelopment: parsedEnv.NODE_ENV === "development",
+  isProduction: parsedEnv.NODE_ENV === "production",
+  isTest: parsedEnv.NODE_ENV === "test",
+  features: {
+    apiKey: parsedEnv.API_AUTH_MODE !== "disabled",
+    cache: parsedEnv.CACHE_ENABLED
+  },
+  cors: {
+    origin: parsedEnv.CORS_ORIGIN === "*" ? parsedEnv.CORS_ORIGIN : parsedEnv.CORS_ORIGIN.split(",").map((o) => o.trim()),
+    credentials: true
+  },
+  rateLimit: {
+    windowMs: parsedEnv.RATE_LIMIT_WINDOW_MS,
+    max: parsedEnv.RATE_LIMIT_MAX,
+    trustProxy: parsedEnv.TRUST_PROXY_HEADERS
+  },
+  requestLimits: {
+    maxBodySize: parsedEnv.MAX_REQUEST_BODY_SIZE,
+    maxConcurrent: parsedEnv.MAX_CONCURRENT_REQUESTS,
+    maxFileSize: parsedEnv.MAX_FILE_SIZE
+  },
+  outboundSources: {
+    mode: parsedEnv.OUTBOUND_SOURCE_MODE,
+    allowedHosts: parsedEnv.OUTBOUND_HOST_ALLOWLIST
+  },
+  cache: {
+    enabled: parsedEnv.CACHE_ENABLED,
+    maxSizeMB: parsedEnv.CACHE_MAX_SIZE_MB,
+    ttlSeconds: parsedEnv.CACHE_TTL_SECONDS,
+    maxItems: parsedEnv.CACHE_MAX_ITEMS
+  }
+};
+
+// src/server/middleware/hono/auth.ts
+function keysEqual(received, expected) {
+  const receivedDigest = createHash("sha256").update(received).digest();
+  const expectedDigest = createHash("sha256").update(expected).digest();
+  return timingSafeEqual(receivedDigest, expectedDigest);
+}
+function readCredential(headers, headerName) {
+  const direct = headers.get(headerName)?.trim();
+  if (direct) {
+    if (headerName.toLowerCase() === "authorization" && direct.toLowerCase().startsWith("bearer ")) {
+      return direct.slice(7).trim() || void 0;
+    }
+    return direct;
+  }
+  const authorization = headers.get("authorization")?.trim();
+  if (authorization?.toLowerCase().startsWith("bearer ")) {
+    return authorization.slice(7).trim() || void 0;
+  }
+  return void 0;
+}
+function createApiKeyAuthMiddleware(options) {
+  const headerName = options.headerName || "x-api-key";
+  return async (c, next) => {
+    if (c.req.method === "OPTIONS" || options.mode === "disabled") {
+      return next();
+    }
+    if (!options.apiKey) {
+      if (options.mode === "auto") return next();
+      return c.json(
+        {
+          success: false,
+          error: "API authentication is not configured",
+          code: "AUTH_CONFIGURATION_ERROR"
+        },
+        503
+      );
+    }
+    const apiKey = readCredential(c.req.raw.headers, headerName);
+    if (!apiKey) {
+      return c.json(
+        {
+          success: false,
+          error: "API key required",
+          code: "UNAUTHORIZED"
+        },
+        401
+      );
+    }
+    if (!keysEqual(apiKey, options.apiKey)) {
+      return c.json(
+        {
+          success: false,
+          error: "Invalid API key",
+          code: "UNAUTHORIZED"
+        },
+        401
+      );
+    }
+    await next();
+  };
+}
+var apiKeyAuthMiddleware = createApiKeyAuthMiddleware({
+  mode: config.API_AUTH_MODE,
+  apiKey: config.API_KEY,
+  headerName: config.API_KEY_HEADER
+});
+
 // src/render-server.ts
-var UPSTREAM = (process.env.HIGHCHARTS_UPSTREAM_URL || "http://127.0.0.1:7801").replace(/\/$/, "");
-var PORT = Number(process.env.PORT || 1e4);
-var PROXY_TIMEOUT_MS = Number(process.env.PROXY_TIMEOUT_MS || 3e4);
-var HEALTH_TIMEOUT_MS = 2e3;
-var app = new Hono();
+var DEFAULT_UPSTREAM = "http://127.0.0.1:7801";
+var DEFAULT_PORT = 1e4;
+var DEFAULT_PROXY_TIMEOUT_MS = 3e4;
+var DEFAULT_HEALTH_TIMEOUT_MS = 2e3;
+var DEFAULT_EXPORT_BODY_BYTES = 4 * 1024 * 1024;
+var DEFAULT_RASTERIZE_BODY_BYTES = 32 * 1024 * 1024;
+var DEFAULT_RESPONSE_BYTES = 24 * 1024 * 1024;
+var MAX_CHART_DIMENSION = 4096;
+var MAX_CHART_PIXELS = 16e6;
+var MAX_CHART_SCALE = 4;
+var UpstreamResponseTooLargeError = class extends Error {
+};
+function positiveInteger2(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function isHardenedEnv() {
+  const nodeEnv = process.env.NODE_ENV;
+  return nodeEnv !== void 0 && nodeEnv !== "development" && nodeEnv !== "test";
+}
+function envAuthOptions() {
+  const production = isHardenedEnv();
+  const requestedMode = process.env.RENDER_AUTH_MODE;
+  const mode = requestedMode === "auto" || requestedMode === "required" || requestedMode === "disabled" ? requestedMode : production ? "required" : "auto";
+  return {
+    mode,
+    apiKey: process.env.RENDER_API_KEY || process.env.API_KEY,
+    headerName: process.env.RENDER_API_KEY_HEADER || "x-api-key"
+  };
+}
+function envSourcePolicy() {
+  const requestedMode = process.env.OUTBOUND_SOURCE_MODE;
+  const mode = requestedMode === "safe" || requestedMode === "development" ? requestedMode : isHardenedEnv() ? "safe" : "development";
+  return {
+    mode,
+    allowedHosts: (process.env.OUTBOUND_HOST_ALLOWLIST || "").split(",").map((host) => host.trim().toLowerCase()).filter(Boolean)
+  };
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function resolveDimension(exporting, chart, sourceKey, chartKey, fallback) {
+  for (const candidate of [exporting?.[sourceKey], chart?.[chartKey]]) {
+    if (candidate === void 0) continue;
+    if (typeof candidate !== "number" || !Number.isFinite(candidate) || candidate <= 0 || candidate > MAX_CHART_DIMENSION) {
+      throw new HTTPException4(400, {
+        message: "Requested chart dimensions are too large"
+      });
+    }
+    return candidate;
+  }
+  return fallback;
+}
+function resolveScale(value, fallback) {
+  if (value === void 0) return fallback;
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > MAX_CHART_SCALE) {
+    throw new HTTPException4(400, {
+      message: `scale must be between 0 and ${MAX_CHART_SCALE}`
+    });
+  }
+  return value;
+}
+function validateExportRequest(value) {
+  if (!isRecord2(value)) {
+    throw new HTTPException4(400, { message: "Export body must be an object" });
+  }
+  const allowedKeys = /* @__PURE__ */ new Set(["infile", "type", "b64", "scale", "resources"]);
+  const unknown = Object.keys(value).filter((key) => !allowedKeys.has(key));
+  if (unknown.length > 0) {
+    throw new HTTPException4(400, {
+      message: `Unsupported export field: ${unknown[0]}`
+    });
+  }
+  if (!isRecord2(value.infile)) {
+    throw new HTTPException4(400, {
+      message: "Export infile must be a chart options object"
+    });
+  }
+  if (value.type !== "png" || value.b64 !== true) {
+    throw new HTTPException4(400, {
+      message: "Only base64 PNG exports are allowed"
+    });
+  }
+  const chart = isRecord2(value.infile.chart) ? value.infile.chart : void 0;
+  const exporting = isRecord2(value.infile.exporting) ? value.infile.exporting : void 0;
+  const scale = resolveScale(value.scale, resolveScale(exporting?.scale, 1));
+  const width = resolveDimension(exporting, chart, "sourceWidth", "width", 600);
+  const height = resolveDimension(
+    exporting,
+    chart,
+    "sourceHeight",
+    "height",
+    400
+  );
+  if (width * height * scale * scale > MAX_CHART_PIXELS) {
+    throw new HTTPException4(400, {
+      message: "Requested chart dimensions are too large"
+    });
+  }
+}
 function isTimeout(error) {
   const name = error?.name;
   return name === "TimeoutError" || name === "AbortError";
 }
-app.get("/health", async (c) => {
-  try {
-    const res = await fetch(`${UPSTREAM}/health`, {
-      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS)
-    });
-    if (res.ok) return c.text("ok");
-    return c.json({ status: "degraded", upstream: res.status }, 503);
-  } catch {
-    return c.json({ status: "degraded", upstream: "unreachable" }, 503);
+async function readLimitedBody(response, maxBytes) {
+  const declaredLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+    await response.body?.cancel();
+    throw new UpstreamResponseTooLargeError();
   }
-});
-registerRasterizeRoute(app, {
-  preMiddleware: [
-    rateLimiter({
-      limit: process.env.NODE_ENV === "production" ? 30 : 1e3,
-      window: 15 * 60 * 1e3
-    })
-  ],
-  onError: (error) => (
-    // eslint-disable-next-line no-console
-    console.error(
-      "[jto-render-server] rasterize failed:",
-      error instanceof Error ? error.message : error
-    )
-  )
-});
-app.all("*", async (c) => {
-  const url = new URL(c.req.url);
-  const target = `${UPSTREAM}${url.pathname}${url.search}`;
-  const reqHeaders = new Headers(c.req.raw.headers);
-  reqHeaders.delete("host");
-  reqHeaders.delete("connection");
-  reqHeaders.delete("content-length");
-  const init = {
-    method: c.req.method,
-    headers: reqHeaders,
-    signal: AbortSignal.timeout(PROXY_TIMEOUT_MS)
-  };
-  if (c.req.method !== "GET" && c.req.method !== "HEAD") {
-    init.body = await c.req.arrayBuffer();
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw new UpstreamResponseTooLargeError();
+    }
+    chunks.push(value);
   }
-  let res;
-  try {
-    res = await fetch(target, init);
-  } catch (error) {
-    return isTimeout(error) ? c.json(
-      {
-        error: `Highcharts upstream timed out after ${PROXY_TIMEOUT_MS}ms`
-      },
-      504
-    ) : c.json(
-      { error: `Highcharts upstream unreachable at ${UPSTREAM}` },
-      502
-    );
+  const output = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    output.set(chunk, offset);
+    offset += chunk.byteLength;
   }
-  const payload = await res.arrayBuffer();
-  const headers = {};
-  res.headers.forEach((value, key) => {
-    if (key !== "content-encoding" && key !== "content-length" && key !== "transfer-encoding") {
-      headers[key] = value;
+  return output;
+}
+function createRenderServerApp(options = {}) {
+  const production = isHardenedEnv();
+  const upstream = (options.upstreamUrl || process.env.HIGHCHARTS_UPSTREAM_URL || DEFAULT_UPSTREAM).replace(/\/$/, "");
+  const proxyTimeoutMs = options.proxyTimeoutMs ?? positiveInteger2(process.env.PROXY_TIMEOUT_MS, DEFAULT_PROXY_TIMEOUT_MS);
+  const healthTimeoutMs = options.healthTimeoutMs ?? positiveInteger2(process.env.HEALTH_TIMEOUT_MS, DEFAULT_HEALTH_TIMEOUT_MS);
+  const maxExportBodyBytes = options.maxExportBodyBytes ?? positiveInteger2(
+    process.env.MAX_EXPORT_BODY_SIZE,
+    DEFAULT_EXPORT_BODY_BYTES
+  );
+  const maxRasterizeBodyBytes = options.maxRasterizeBodyBytes ?? positiveInteger2(
+    process.env.MAX_RASTERIZE_BODY_SIZE,
+    DEFAULT_RASTERIZE_BODY_BYTES
+  );
+  const maxResponseBytes = options.maxResponseBytes ?? positiveInteger2(
+    process.env.MAX_RENDER_RESPONSE_SIZE,
+    DEFAULT_RESPONSE_BYTES
+  );
+  const maxConcurrent = options.maxConcurrent ?? positiveInteger2(process.env.MAX_CONCURRENT_RENDERS, production ? 4 : 16);
+  const windowMs = options.rateLimitWindowMs ?? positiveInteger2(process.env.RENDER_RATE_LIMIT_WINDOW_MS, 15 * 60 * 1e3);
+  const fetchImpl = options.fetch ?? fetch;
+  const sourcePolicy = options.sourcePolicy ?? envSourcePolicy();
+  const trustProxyHeaders = options.trustProxyHeaders ?? process.env.TRUST_PROXY_HEADERS === "true";
+  const app = new Hono();
+  const auth = createApiKeyAuthMiddleware(options.auth ?? envAuthOptions());
+  const capacity = concurrencyLimiter({ limit: maxConcurrent });
+  app.use("*", secureHeaders());
+  app.onError((error, c) => {
+    if (error instanceof HTTPException4) {
+      return c.json({ success: false, error: error.message }, error.status);
     }
+    return c.json({ success: false, error: "Internal server error" }, 500);
   });
-  return c.body(payload, res.status, headers);
-});
-serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, (info) => {
-  console.log(
-    `[jto-render-server] listening on :${info.port} \u2014 POST /rasterize (local), proxy \u2192 ${UPSTREAM}`
+  app.get("/health", async (c) => {
+    try {
+      const response = await fetchImpl(`${upstream}/health`, {
+        signal: AbortSignal.timeout(healthTimeoutMs)
+      });
+      if (response.ok) return c.text("ok");
+      return c.json({ status: "degraded", upstream: response.status }, 503);
+    } catch {
+      return c.json({ status: "degraded", upstream: "unreachable" }, 503);
+    }
+  });
+  registerRasterizeRoute(app, {
+    getRasterizer: options.getRasterizer,
+    preMiddleware: [
+      rateLimiter({
+        limit: options.rasterizeRateLimit ?? positiveInteger2(
+          process.env.RASTERIZE_RATE_LIMIT,
+          production ? 30 : 1e3
+        ),
+        window: windowMs,
+        namespace: "rasterize",
+        trustProxy: trustProxyHeaders
+      }),
+      capacity,
+      bodyLimit2({
+        maxSize: maxRasterizeBodyBytes,
+        onError: () => {
+          throw new HTTPException4(413, { message: "Request body too large" });
+        }
+      }),
+      auth
+    ],
+    sourcePolicy
+  });
+  app.post(
+    "/export",
+    rateLimiter({
+      limit: options.exportRateLimit ?? positiveInteger2(process.env.EXPORT_RATE_LIMIT, production ? 60 : 1e3),
+      window: windowMs,
+      namespace: "export",
+      trustProxy: trustProxyHeaders
+    }),
+    capacity,
+    bodyLimit2({
+      maxSize: maxExportBodyBytes,
+      onError: () => {
+        throw new HTTPException4(413, { message: "Request body too large" });
+      }
+    }),
+    auth,
+    async (c) => {
+      const contentType = c.req.header("content-type");
+      if (!contentType?.toLowerCase().includes("application/json")) {
+        throw new HTTPException4(415, {
+          message: "Content-Type must be application/json"
+        });
+      }
+      let body;
+      try {
+        body = await c.req.json();
+      } catch {
+        throw new HTTPException4(400, { message: "Invalid JSON body" });
+      }
+      validateExportRequest(body);
+      try {
+        assertSafeRendererPayload(body, sourcePolicy);
+      } catch (error) {
+        if (error instanceof UnsafeOutboundSourceError) {
+          throw new HTTPException4(400, { message: error.message });
+        }
+        throw error;
+      }
+      let response;
+      try {
+        response = await fetchImpl(`${upstream}/export`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "text/plain, image/png, application/json"
+          },
+          body: JSON.stringify(body),
+          signal: AbortSignal.timeout(proxyTimeoutMs)
+        });
+      } catch (error) {
+        return isTimeout(error) ? c.json(
+          {
+            error: `Highcharts upstream timed out after ${proxyTimeoutMs}ms`
+          },
+          504
+        ) : c.json({ error: "Highcharts upstream unreachable" }, 502);
+      }
+      let payload;
+      try {
+        payload = await readLimitedBody(response, maxResponseBytes);
+      } catch (error) {
+        if (error instanceof UpstreamResponseTooLargeError) {
+          return c.json({ error: "Highcharts response too large" }, 502);
+        }
+        if (isTimeout(error)) {
+          return c.json(
+            {
+              error: `Highcharts upstream timed out after ${proxyTimeoutMs}ms`
+            },
+            504
+          );
+        }
+        return c.json({ error: "Failed to read Highcharts response" }, 502);
+      }
+      const headers = {};
+      for (const name of [
+        "content-type",
+        "content-disposition",
+        "cache-control"
+      ]) {
+        const value = response.headers.get(name);
+        if (value) headers[name] = value;
+      }
+      return c.body(payload, response.status, headers);
+    }
   );
-});
+  for (const route of ["/export", "/rasterize"]) {
+    app.all(route, (c) => {
+      c.header("Allow", "POST");
+      return c.json({ success: false, error: "Method not allowed" }, 405);
+    });
+  }
+  app.notFound((c) => c.json({ success: false, error: "Not found" }, 404));
+  return app;
+}
+function isMainModule() {
+  if (!process.argv[1]) return false;
+  try {
+    return resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isMainModule()) {
+  const port = positiveInteger2(process.env.PORT, DEFAULT_PORT);
+  const app = createRenderServerApp();
+  void import("@hono/node-server").then(({ serve }) => {
+    serve({ fetch: app.fetch, port, hostname: "0.0.0.0" }, (info) => {
+      console.log(`[jto-render-server] listening on :${info.port}`);
+    });
+  });
+}
+export {
+  createRenderServerApp
+};
 //# sourceMappingURL=render-server.js.map