@json-to-office/jto 0.20.0 → 0.22.0

package/dist/cli.js

@@ -20,24 +20,61 @@ var init_esm_shims = __esm({
 
 // src/server/config/index.ts
 import dotenv from "dotenv";
+function positiveInteger(value, fallback) {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function parseAuthMode(value, nodeEnv) {
+  if (value === "auto" || value === "required" || value === "disabled") {
+    return value;
+  }
+  return nodeEnv === "production" ? "required" : "auto";
+}
+function parseOutboundSourceMode(value, nodeEnv) {
+  if (value === "development" || value === "safe") return value;
+  return nodeEnv === "production" ? "safe" : "development";
+}
+function normalizeNodeEnv(value) {
+  return value === "development" || value === "test" ? value : "production";
+}
 function parseEnv(env) {
+  const nodeEnv = normalizeNodeEnv(env.NODE_ENV || "development");
   return {
-    NODE_ENV: env.NODE_ENV || "development",
-    PORT: parseInt(env.PORT || "3003", 10),
+    NODE_ENV: nodeEnv,
+    // No PORT here: the listener is opened by the dev server from the CLI
+    // config (`-p` > `server.port` > `PORT` env > format default), so a second
+    // copy of it in this module would be silently ignored.
     CORS_ORIGIN: env.CORS_ORIGIN || "*",
     API_KEY: env.API_KEY,
     API_KEY_HEADER: env.API_KEY_HEADER || "x-api-key",
-    RATE_LIMIT_WINDOW_MS: parseInt(env.RATE_LIMIT_WINDOW_MS || "900000", 10),
-    RATE_LIMIT_MAX: parseInt(env.RATE_LIMIT_MAX || "100", 10),
-    MAX_FILE_SIZE: parseInt(env.MAX_FILE_SIZE || "10485760", 10),
-    UPLOAD_DIR: env.UPLOAD_DIR || "uploads",
+    API_AUTH_MODE: parseAuthMode(env.API_AUTH_MODE, nodeEnv),
+    RATE_LIMIT_WINDOW_MS: positiveInteger(env.RATE_LIMIT_WINDOW_MS, 9e5),
+    RATE_LIMIT_MAX: positiveInteger(
+      env.RATE_LIMIT_MAX,
+      nodeEnv === "production" ? 100 : 1e3
+    ),
+    TRUST_PROXY_HEADERS: env.TRUST_PROXY_HEADERS === "true",
+    MAX_FILE_SIZE: positiveInteger(env.MAX_FILE_SIZE, 10 * 1024 * 1024),
+    MAX_REQUEST_BODY_SIZE: positiveInteger(
+      env.MAX_REQUEST_BODY_SIZE,
+      32 * 1024 * 1024
+    ),
+    MAX_CONCURRENT_REQUESTS: positiveInteger(
+      env.MAX_CONCURRENT_REQUESTS,
+      nodeEnv === "production" ? 8 : 64
+    ),
+    OUTBOUND_SOURCE_MODE: parseOutboundSourceMode(
+      env.OUTBOUND_SOURCE_MODE,
+      nodeEnv
+    ),
+    OUTBOUND_HOST_ALLOWLIST: (env.OUTBOUND_HOST_ALLOWLIST || "").split(",").map((host) => host.trim().toLowerCase()).filter(Boolean),
     LIBREOFFICE_PATH: env.LIBREOFFICE_PATH,
-    LIBREOFFICE_TIMEOUT_MS: env.LIBREOFFICE_TIMEOUT_MS ? parseInt(env.LIBREOFFICE_TIMEOUT_MS, 10) : 3e4,
+    LIBREOFFICE_TIMEOUT_MS: env.LIBREOFFICE_TIMEOUT_MS ? positiveInteger(env.LIBREOFFICE_TIMEOUT_MS, 3e4) : 3e4,
     LOG_LEVEL: env.LOG_LEVEL || "info",
     CACHE_ENABLED: env.CACHE_ENABLED !== "false",
-    CACHE_MAX_SIZE_MB: parseInt(env.CACHE_MAX_SIZE_MB || "100", 10),
-    CACHE_TTL_SECONDS: parseInt(env.CACHE_TTL_SECONDS || "3600", 10),
-    CACHE_MAX_ITEMS: parseInt(env.CACHE_MAX_ITEMS || "1000", 10)
+    CACHE_MAX_SIZE_MB: positiveInteger(env.CACHE_MAX_SIZE_MB, 100),
+    CACHE_TTL_SECONDS: positiveInteger(env.CACHE_TTL_SECONDS, 3600),
+    CACHE_MAX_ITEMS: positiveInteger(env.CACHE_MAX_ITEMS, 1e3)
   };
 }
 var parsedEnv, config;
@@ -53,7 +90,7 @@ var init_config = __esm({
       isProduction: parsedEnv.NODE_ENV === "production",
       isTest: parsedEnv.NODE_ENV === "test",
       features: {
-        apiKey: Boolean(parsedEnv.API_KEY),
+        apiKey: parsedEnv.API_AUTH_MODE !== "disabled",
         cache: parsedEnv.CACHE_ENABLED
       },
       cors: {
@@ -62,7 +99,17 @@ var init_config = __esm({
       },
       rateLimit: {
         windowMs: parsedEnv.RATE_LIMIT_WINDOW_MS,
-        max: parsedEnv.RATE_LIMIT_MAX
+        max: parsedEnv.RATE_LIMIT_MAX,
+        trustProxy: parsedEnv.TRUST_PROXY_HEADERS
+      },
+      requestLimits: {
+        maxBodySize: parsedEnv.MAX_REQUEST_BODY_SIZE,
+        maxConcurrent: parsedEnv.MAX_CONCURRENT_REQUESTS,
+        maxFileSize: parsedEnv.MAX_FILE_SIZE
+      },
+      outboundSources: {
+        mode: parsedEnv.OUTBOUND_SOURCE_MODE,
+        allowedHosts: parsedEnv.OUTBOUND_HOST_ALLOWLIST
       },
       cache: {
         enabled: parsedEnv.CACHE_ENABLED,
@@ -187,10 +234,10 @@ function collectReferencedNames(config2, customThemes, adapterName) {
 }
 function collectReferencedWeights(config2, customThemes) {
   const weights = /* @__PURE__ */ new Set();
-  const visit = (node) => {
+  const visit2 = (node) => {
     if (node == null) return;
     if (Array.isArray(node)) {
-      for (const item of node) visit(item);
+      for (const item of node) visit2(item);
       return;
     }
     if (typeof node === "object") {
@@ -198,21 +245,21 @@ function collectReferencedWeights(config2, customThemes) {
         if (k === "fontWeight" && typeof v === "number" && v >= 100 && v <= 900) {
           weights.add(v);
         } else {
-          visit(v);
+          visit2(v);
         }
       }
     }
   };
-  visit(config2);
-  for (const theme of Object.values(customThemes ?? {})) visit(theme);
+  visit2(config2);
+  for (const theme of Object.values(customThemes ?? {})) visit2(theme);
   return weights;
 }
 function collectReferencedItalic(config2, customThemes) {
   let found = false;
-  const visit = (node) => {
+  const visit2 = (node) => {
     if (found || node == null) return;
     if (Array.isArray(node)) {
-      for (const item of node) visit(item);
+      for (const item of node) visit2(item);
       return;
     }
     if (typeof node === "object") {
@@ -221,14 +268,14 @@ function collectReferencedItalic(config2, customThemes) {
           found = true;
           return;
         }
-        visit(v);
+        visit2(v);
       }
     }
   };
-  visit(config2);
+  visit2(config2);
   if (!found) {
     for (const theme of Object.values(customThemes ?? {})) {
-      visit(theme);
+      visit2(theme);
       if (found) break;
     }
   }
@@ -1467,29 +1514,46 @@ var init_typebox_validator = __esm({
 
 // src/server/middleware/hono/rate-limit.ts
 import { HTTPException as HTTPException2 } from "hono/http-exception";
-var rateLimitStore, rateLimiter;
+function clientAddress(c, trustProxy) {
+  if (trustProxy) {
+    const forwarded = c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",")[0]?.trim();
+    if (forwarded) return forwarded;
+  }
+  const incoming = c.env?.incoming || c.env?.req;
+  return incoming?.socket?.remoteAddress || "anonymous";
+}
+var rateLimiter;
 var init_rate_limit = __esm({
   "src/server/middleware/hono/rate-limit.ts"() {
     "use strict";
     init_esm_shims();
-    rateLimitStore = /* @__PURE__ */ new Map();
     rateLimiter = (options) => {
       const { limit, window, keyGenerator } = options;
+      const maxEntries = options.maxEntries ?? 1e4;
+      const rateLimitStore = /* @__PURE__ */ new Map();
+      let lastCleanup = 0;
       return async (c, next) => {
-        const key = keyGenerator ? keyGenerator(c) : c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",").pop()?.trim() || "anonymous";
+        const clientKey = keyGenerator ? keyGenerator(c) : clientAddress(c, options.trustProxy === true);
+        const namespace = typeof options.namespace === "function" ? options.namespace(c) : options.namespace || `${c.req.method}:${c.req.path}`;
+        const key = `${namespace}:${String(clientKey).slice(0, 256)}`;
         const now = Date.now();
-        for (const [k, v] of rateLimitStore.entries()) {
-          if (v.resetTime < now) {
-            rateLimitStore.delete(k);
+        if (now - lastCleanup >= Math.min(window, 6e4)) {
+          for (const [storedKey, value] of rateLimitStore.entries()) {
+            if (value.resetTime <= now) rateLimitStore.delete(storedKey);
           }
+          lastCleanup = now;
         }
         const record = rateLimitStore.get(key);
         if (!record) {
+          if (rateLimitStore.size >= maxEntries) {
+            const oldestKey = rateLimitStore.keys().next().value;
+            if (oldestKey) rateLimitStore.delete(oldestKey);
+          }
           rateLimitStore.set(key, {
             count: 1,
             resetTime: now + window
           });
-        } else if (record.resetTime < now) {
+        } else if (record.resetTime <= now) {
           record.count = 1;
           record.resetTime = now + window;
         } else if (record.count >= limit) {
@@ -1517,6 +1581,316 @@ var init_rate_limit = __esm({
   }
 });
 
+// src/server/security/outbound-source-policy.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hostMatches(host, pattern) {
+  const normalized = pattern.toLowerCase().replace(/\.$/, "");
+  if (normalized.startsWith("*.")) {
+    const suffix = normalized.slice(1);
+    return host.endsWith(suffix) && host.length > suffix.length;
+  }
+  return host === normalized;
+}
+function isPrivateIpv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4) return false;
+  const octets = parts.map(Number);
+  if (octets.some(
+    (part, index) => !Number.isInteger(part) || part < 0 || part > 255 || String(part) !== parts[index]
+  )) {
+    return false;
+  }
+  const [a, b] = octets;
+  return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && (b === 0 || b === 168) || a === 198 && (b === 18 || b === 19) || a >= 224;
+}
+function isPrivateHost(host) {
+  const normalized = host.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::" || normalized === "::1") {
+    return true;
+  }
+  if (isPrivateIpv4(normalized)) return true;
+  if (normalized.startsWith("::ffff:")) {
+    const mapped = normalized.slice("::ffff:".length);
+    if (isPrivateIpv4(mapped)) return true;
+    const groups = mapped.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+    if (groups) {
+      const value = Number.parseInt(groups[1], 16) * 65536 + Number.parseInt(groups[2], 16);
+      return isPrivateIpv4(
+        [
+          value >>> 24,
+          value >>> 16 & 255,
+          value >>> 8 & 255,
+          value & 255
+        ].join(".")
+      );
+    }
+  }
+  const firstIpv6Group = Number.parseInt(normalized.split(":")[0] || "0", 16);
+  return firstIpv6Group >= 64512 && firstIpv6Group <= 65023 || firstIpv6Group >= 65152 && firstIpv6Group <= 65215;
+}
+function assertAllowedUrl(source, path6, allowedHosts) {
+  if (source.startsWith("data:")) return;
+  let url;
+  try {
+    url = new URL(source);
+  } catch {
+    throw new UnsafeOutboundSourceError(
+      path6,
+      "local and relative file paths are disabled for HTTP requests"
+    );
+  }
+  if (url.protocol !== "https:") {
+    throw new UnsafeOutboundSourceError(path6, "only HTTPS URLs are allowed");
+  }
+  if (url.username || url.password) {
+    throw new UnsafeOutboundSourceError(
+      path6,
+      "URLs containing credentials are not allowed"
+    );
+  }
+  const host = url.hostname.toLowerCase().replace(/\.$/, "");
+  if (isPrivateHost(host)) {
+    throw new UnsafeOutboundSourceError(
+      path6,
+      `private or local host "${host}" is not allowed`
+    );
+  }
+  if (!allowedHosts.some((pattern) => hostMatches(host, pattern))) {
+    throw new UnsafeOutboundSourceError(
+      path6,
+      `host "${host}" is not in OUTBOUND_HOST_ALLOWLIST`
+    );
+  }
+}
+function extractCssReferences(input) {
+  const references = [];
+  const urlPattern = /url\(\s*(['"]?)([^)'"\s]+)\1\s*\)/gi;
+  const importPattern = /@import\s+(?:url\(\s*)?(['"])([^'"]+)\1/gi;
+  for (const pattern of [urlPattern, importPattern]) {
+    let match;
+    while (match = pattern.exec(input)) references.push(match[2]);
+  }
+  return references;
+}
+function extractAbsoluteUrls(input) {
+  return input.match(/(?:https?|file):\/\/[^\s'"<>)}\]]+/gi) ?? [];
+}
+function assertSafeSvg(svg, path6, allowedHosts) {
+  if (/<\s*script\b/i.test(svg) || /<\s*(?:foreignObject|iframe|object|embed)\b/i.test(svg) || /\bon[a-z]+\s*=/i.test(svg)) {
+    throw new UnsafeOutboundSourceError(path6, "active SVG content is disabled");
+  }
+  if (/<!\s*(?:DOCTYPE|ENTITY)\b/i.test(svg)) {
+    throw new UnsafeOutboundSourceError(
+      path6,
+      "SVG document types and entities are disabled"
+    );
+  }
+  const refPattern = /\b(?:href|src)\s*=\s*(['"])(.*?)\1/gi;
+  let match;
+  while (match = refPattern.exec(svg)) {
+    const ref = match[2].trim();
+    if (!ref || ref.startsWith("#") || ref.startsWith("data:")) continue;
+    assertAllowedUrl(ref, path6, allowedHosts);
+  }
+  for (const ref of extractCssReferences(svg)) {
+    if (ref.startsWith("#") || ref.startsWith("data:")) continue;
+    assertAllowedUrl(ref, path6, allowedHosts);
+  }
+}
+function assertSafeEncodedImage(source, path6, allowedHosts) {
+  let candidate = source.trim();
+  let declaredSvg = false;
+  if (candidate.startsWith("data:")) {
+    const comma = candidate.indexOf(",");
+    if (comma < 0) {
+      throw new UnsafeOutboundSourceError(path6, "malformed image data URL");
+    }
+    const metadata = candidate.slice(5, comma);
+    declaredSvg = metadata.split(";")[0].toLowerCase() === "image/svg+xml";
+    if (!declaredSvg) return;
+    const payload = candidate.slice(comma + 1);
+    try {
+      candidate = /(?:^|;)base64(?:;|$)/i.test(metadata) ? Buffer.from(payload, "base64").toString("utf8") : decodeURIComponent(payload);
+    } catch {
+      throw new UnsafeOutboundSourceError(path6, "malformed SVG data URL");
+    }
+  } else if (!/<\s*svg\b/i.test(candidate)) {
+    candidate = Buffer.from(candidate, "base64").toString("utf8");
+  }
+  const svgStart = candidate.search(/<\s*svg\b/i);
+  if (svgStart < 0) {
+    if (declaredSvg) {
+      throw new UnsafeOutboundSourceError(path6, "malformed SVG image data");
+    }
+    return;
+  }
+  assertSafeSvg(candidate, path6, allowedHosts);
+}
+function assertSafeResources(resources, path6, allowedHosts) {
+  if (typeof resources.js === "string" && resources.js.trim()) {
+    throw new UnsafeOutboundSourceError(
+      `${path6}.js`,
+      "remote renderer JavaScript resources are disabled"
+    );
+  }
+  if (typeof resources.css === "string") {
+    for (const ref of extractCssReferences(resources.css)) {
+      if (ref.startsWith("data:")) continue;
+      assertAllowedUrl(ref, `${path6}.css`, allowedHosts);
+    }
+  }
+  if (Array.isArray(resources.files) && resources.files.length > 0) {
+    throw new UnsafeOutboundSourceError(
+      `${path6}.files`,
+      "remote renderer JavaScript resources are disabled"
+    );
+  }
+}
+function assertNoRemoteReferences(value, path6, allowedHosts, seen) {
+  if (typeof value === "string") {
+    if (/\b(?:fetch|XMLHttpRequest|WebSocket|EventSource)\s*\(/i.test(value) || /\b(?:javascript|file):/i.test(value)) {
+      throw new UnsafeOutboundSourceError(
+        path6,
+        "network-capable JavaScript and file URLs are disabled"
+      );
+    }
+    for (const url of [
+      ...extractAbsoluteUrls(value),
+      ...extractCssReferences(value)
+    ]) {
+      if (url.startsWith("data:")) continue;
+      assertAllowedUrl(url, path6, allowedHosts);
+    }
+    if (/^\/\//.test(value.trim())) {
+      throw new UnsafeOutboundSourceError(
+        path6,
+        "protocol-relative URLs are disabled"
+      );
+    }
+    return;
+  }
+  if (!value || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    value.forEach(
+      (entry, index) => assertNoRemoteReferences(entry, `${path6}[${index}]`, allowedHosts, seen)
+    );
+    return;
+  }
+  for (const [key, child] of Object.entries(value)) {
+    assertNoRemoteReferences(child, `${path6}.${key}`, allowedHosts, seen);
+  }
+}
+function visit(value, path6, containerKey, allowedHosts, seen) {
+  if (!value || typeof value !== "object" || seen.has(value)) return;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    value.forEach(
+      (entry, index) => visit(entry, `${path6}[${index}]`, containerKey, allowedHosts, seen)
+    );
+    return;
+  }
+  const record = value;
+  for (const key of Object.keys(record)) {
+    if (DANGEROUS_KEYS.has(key)) {
+      throw new UnsafeOutboundSourceError(
+        `${path6}.${key}`,
+        "prototype mutation keys are disabled"
+      );
+    }
+  }
+  const kind = typeof record.kind === "string" ? record.kind : void 0;
+  if (kind === "file" && typeof record.path === "string") {
+    throw new UnsafeOutboundSourceError(
+      `${path6}.path`,
+      "local file sources are disabled for HTTP requests"
+    );
+  }
+  if ((kind === "url" || kind === "variable") && typeof record.url === "string") {
+    assertAllowedUrl(record.url, `${path6}.url`, allowedHosts);
+  }
+  const componentName = typeof record.name === "string" ? record.name.toLowerCase() : void 0;
+  const props = isRecord(record.props) ? record.props : void 0;
+  if (componentName && props) {
+    if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.path === "string") {
+      assertAllowedUrl(props.path, `${path6}.props.path`, allowedHosts);
+      assertSafeEncodedImage(props.path, `${path6}.props.path`, allowedHosts);
+    }
+    if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.base64 === "string") {
+      assertSafeEncodedImage(
+        props.base64,
+        `${path6}.props.base64`,
+        allowedHosts
+      );
+    }
+    if ((componentName === "highcharts" || componentName === "visual") && typeof props.serverUrl === "string") {
+      assertAllowedUrl(
+        props.serverUrl,
+        `${path6}.props.serverUrl`,
+        allowedHosts
+      );
+    }
+    if (componentName === "highcharts") {
+      if (isRecord(props.resources)) {
+        assertSafeResources(
+          props.resources,
+          `${path6}.props.resources`,
+          allowedHosts
+        );
+      }
+      assertNoRemoteReferences(
+        props.options,
+        `${path6}.props.options`,
+        allowedHosts,
+        /* @__PURE__ */ new WeakSet()
+      );
+    }
+  }
+  if (containerKey === "image" && typeof record.path === "string") {
+    assertAllowedUrl(record.path, `${path6}.path`, allowedHosts);
+    assertSafeEncodedImage(record.path, `${path6}.path`, allowedHosts);
+  }
+  if (typeof record.svg === "string") {
+    assertSafeSvg(record.svg, `${path6}.svg`, allowedHosts);
+  }
+  if (containerKey === "resources") {
+    assertSafeResources(record, path6, allowedHosts);
+  }
+  for (const [key, child] of Object.entries(record)) {
+    visit(child, `${path6}.${key}`, key, allowedHosts, seen);
+  }
+}
+function assertSafeOutboundSources(value, policy, rootPath = "request") {
+  if (policy.mode === "development") return;
+  let parsed = value;
+  if (typeof value === "string") {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      return;
+    }
+  }
+  visit(parsed, rootPath, void 0, policy.allowedHosts, /* @__PURE__ */ new WeakSet());
+}
+var UnsafeOutboundSourceError, DANGEROUS_KEYS, COMPONENT_SOURCE_NAMES;
+var init_outbound_source_policy = __esm({
+  "src/server/security/outbound-source-policy.ts"() {
+    "use strict";
+    init_esm_shims();
+    UnsafeOutboundSourceError = class extends Error {
+      constructor(path6, reason) {
+        super(`Unsafe outbound source at ${path6}: ${reason}`);
+        this.path = path6;
+        this.name = "UnsafeOutboundSourceError";
+      }
+    };
+    DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+    COMPONENT_SOURCE_NAMES = /* @__PURE__ */ new Set(["image"]);
+  }
+});
+
 // src/server/rasterize-route.ts
 import { Type as Type2 } from "@sinclair/typebox";
 import { bodyLimit } from "hono/body-limit";
@@ -1550,6 +1924,13 @@ function registerRasterizeRoute(router, options = {}) {
     async (c) => {
       const { presentation, dpi } = getValidated(c, "json");
       try {
+        if (options.sourcePolicy) {
+          assertSafeOutboundSources(
+            presentation,
+            options.sourcePolicy,
+            "presentation"
+          );
+        }
         const result = await getRasterizer()({
           presentation,
           dpi: clampVisualDpi(dpi ?? DEFAULT_VISUAL_DPI)
@@ -1558,6 +1939,9 @@ function registerRasterizeRoute(router, options = {}) {
       } catch (error) {
         options.onError?.(error);
         if (error instanceof HTTPException3) throw error;
+        if (error instanceof UnsafeOutboundSourceError) {
+          throw new HTTPException3(400, { message: error.message });
+        }
         const msg = error instanceof Error ? error.message.toLowerCase() : String(error);
         if (msg.includes("not found") || msg.includes("rasterization needs")) {
           throw new HTTPException3(503, { message: error.message });
@@ -1578,6 +1962,7 @@ var init_rasterize_route = __esm({
     "use strict";
     init_esm_shims();
     init_typebox_validator();
+    init_outbound_source_policy();
     RasterizeRequestSchema = Type2.Object(
       {
         presentation: Type2.Object({}, { additionalProperties: true }),
@@ -1606,6 +1991,16 @@ import { bodyLimit as bodyLimit2 } from "hono/body-limit";
 import { PluginRegistry as PluginRegistry2 } from "@json-to-office/jto-cli";
 function createFormatRouter(adapter) {
   const router = new Hono2();
+  const assertRequestSources = (value, path6) => {
+    try {
+      assertSafeOutboundSources(value, config.outboundSources, path6);
+    } catch (error) {
+      if (error instanceof UnsafeOutboundSourceError) {
+        throw new HTTPException4(400, { message: error.message });
+      }
+      throw error;
+    }
+  };
   const contentTypeMw = async (c, next) => {
     const contentType = c.req.header("content-type");
     if (!contentType || !contentType.includes("application/json")) {
@@ -1620,7 +2015,7 @@ function createFormatRouter(adapter) {
     rateLimiter({
       limit: process.env.NODE_ENV === "production" ? 10 : 1e3,
       window: 15 * 60 * 1e3,
-      keyGenerator: (c) => c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",").pop()?.trim() || "anonymous"
+      trustProxy: config.rateLimit.trustProxy
     }),
     contentTypeMw,
     tbValidator(LooseDocumentGenerationRequestSchema),
@@ -1629,6 +2024,9 @@ function createFormatRouter(adapter) {
       const { jsonDefinition, customThemes, options } = getValidated(c, "json");
       const requestId = c.get("requestId");
       try {
+        assertRequestSources(jsonDefinition, "jsonDefinition");
+        assertRequestSources(customThemes, "customThemes");
+        assertRequestSources(options, "options");
         const bypassCache = c.req.header("X-Bypass-Cache") === "true" || c.req.query("bypass-cache") === "true" || options?.bypassCache === true;
         let sanitizedFonts;
         const rawFonts = options?.fonts;
@@ -1721,7 +2119,7 @@ function createFormatRouter(adapter) {
       rateLimiter({
         limit: process.env.NODE_ENV === "production" ? 30 : 1e3,
         window: 15 * 60 * 1e3,
-        keyGenerator: (c) => c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",").pop()?.trim() || "anonymous"
+        trustProxy: config.rateLimit.trustProxy
       }),
       contentTypeMw,
       tbValidator(LooseDocumentDiffRequestSchema),
@@ -1796,10 +2194,17 @@ function createFormatRouter(adapter) {
   }
   router.post(
     "/preview/libreoffice",
+    bodyLimit2({
+      // Multipart framing adds a small amount around the configured file cap.
+      maxSize: config.requestLimits.maxFileSize + 64 * 1024,
+      onError: () => {
+        throw new HTTPException4(413, { message: "Request body too large" });
+      }
+    }),
     rateLimiter({
       limit: process.env.NODE_ENV === "production" ? 20 : 1e3,
       window: 15 * 60 * 1e3,
-      keyGenerator: (c) => c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",").pop()?.trim() || "anonymous"
+      trustProxy: config.rateLimit.trustProxy
     }),
     async (c) => {
       const requestId = c.get("requestId");
@@ -1819,13 +2224,30 @@ function createFormatRouter(adapter) {
             message: `${adapter.name.toUpperCase()} file is empty`
           });
         }
+        if (file.size > config.requestLimits.maxFileSize) {
+          throw new HTTPException4(413, {
+            message: `File exceeds ${config.requestLimits.maxFileSize} bytes`
+          });
+        }
+        const expectedExtension = `.${adapter.name}`;
+        const originalName = file.name || `preview${expectedExtension}`;
+        if (!originalName.toLowerCase().endsWith(expectedExtension)) {
+          throw new HTTPException4(400, {
+            message: `Expected a ${adapter.name.toUpperCase()} file`
+          });
+        }
         const arrayBuffer = await file.arrayBuffer();
         const inputBuffer = Buffer.from(arrayBuffer);
+        if (inputBuffer.length < 4 || inputBuffer[0] !== 80 || inputBuffer[1] !== 75) {
+          throw new HTTPException4(400, {
+            message: `Invalid ${adapter.name.toUpperCase()} file`
+          });
+        }
         const pdfBuffer = await libreOfficeService.convertToPdf(
           inputBuffer,
-          file.name
+          originalName
         );
-        const pdfName = (file.name || "preview").replace(/\.[^.]+$/i, "") + ".pdf";
+        const pdfName = originalName.replace(/\.[^.]+$/i, "").replace(/[^a-zA-Z0-9._-]/g, "_") + ".pdf";
         c.header("Content-Type", "application/pdf");
         c.header("Content-Disposition", `inline; filename="${pdfName}"`);
         c.header("Content-Length", String(pdfBuffer.length));
@@ -1866,7 +2288,7 @@ function createFormatRouter(adapter) {
     rateLimiter({
       limit: process.env.NODE_ENV === "production" ? 20 : 1e3,
       window: 15 * 60 * 1e3,
-      keyGenerator: (c) => c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",").pop()?.trim() || "anonymous"
+      trustProxy: config.rateLimit.trustProxy
     }),
     contentTypeMw,
     tbValidator(LooseDocumentGenerationRequestSchema),
@@ -1878,6 +2300,8 @@ function createFormatRouter(adapter) {
       );
       const { jsonDefinition, customThemes } = getValidated(c, "json");
       try {
+        assertRequestSources(jsonDefinition, "jsonDefinition");
+        assertRequestSources(customThemes, "customThemes");
         const generated = await generatorService.generate({
           jsonDefinition,
           customThemes,
@@ -1923,6 +2347,8 @@ function createFormatRouter(adapter) {
       const { jsonDefinition, customThemes } = getValidated(c, "json");
       const requestId = c.get("requestId");
       try {
+        assertRequestSources(jsonDefinition, "jsonDefinition");
+        assertRequestSources(customThemes, "customThemes");
         const config2 = typeof jsonDefinition === "string" ? JSON.parse(jsonDefinition) : jsonDefinition;
         const registry = PluginRegistry2.getInstance();
         if (registry.hasPlugins()) {
@@ -2026,9 +2452,10 @@ function createFormatRouter(adapter) {
       rateLimiter({
         limit: process.env.NODE_ENV === "production" ? 10 : 1e3,
         window: 15 * 60 * 1e3,
-        keyGenerator: (c) => c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",").pop()?.trim() || "anonymous"
+        trustProxy: config.rateLimit.trustProxy
       })
     ],
+    sourcePolicy: config.outboundSources,
     onError: (error) => logger.error("Visual rasterization failed", { error })
   });
   return router;
@@ -2043,6 +2470,8 @@ var init_format = __esm({
     init_logger();
     init_rate_limit();
     init_rasterize_route();
+    init_config();
+    init_outbound_source_policy();
     init_libreoffice_converter();
   }
 });
@@ -2578,7 +3007,7 @@ function createAiRouter() {
     rateLimiter({
       limit: process.env.NODE_ENV === "production" ? 30 : 1e3,
       window: 15 * 60 * 1e3,
-      keyGenerator: (c) => c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",").pop()?.trim() || "anonymous"
+      trustProxy: config.rateLimit.trustProxy
     }),
     async (c) => {
       try {
@@ -2793,6 +3222,7 @@ var init_ai = __esm({
     init_prompt_loader();
     init_logger();
     init_rate_limit();
+    init_config();
     TEXT_MIME_TYPES = /* @__PURE__ */ new Set([
       "text/plain",
       "text/markdown",
@@ -2818,6 +3248,7 @@ var init_fonts = __esm({
     "use strict";
     init_esm_shims();
     init_rate_limit();
+    init_config();
     fontsRouter = new Hono5();
     MATERIALIZE_FAMILY_MAX = 64;
     MATERIALIZE_WEIGHTS_MAX = 9;
@@ -2850,7 +3281,7 @@ var init_fonts = __esm({
       rateLimiter({
         limit: process.env.NODE_ENV === "production" ? 20 : 1e3,
         window: 15 * 60 * 1e3,
-        keyGenerator: (c) => c.req.header("X-Real-IP") || c.req.header("X-Forwarded-For")?.split(",").pop()?.trim() || "anonymous"
+        trustProxy: config.rateLimit.trustProxy
       }),
       async (c) => {
         let body;
@@ -2923,39 +3354,78 @@ var init_request_id = __esm({
 });
 
 // src/server/middleware/hono/auth.ts
+import { createHash as createHash2, timingSafeEqual } from "crypto";
+function keysEqual(received, expected) {
+  const receivedDigest = createHash2("sha256").update(received).digest();
+  const expectedDigest = createHash2("sha256").update(expected).digest();
+  return timingSafeEqual(receivedDigest, expectedDigest);
+}
+function readCredential(headers, headerName) {
+  const direct = headers.get(headerName)?.trim();
+  if (direct) {
+    if (headerName.toLowerCase() === "authorization" && direct.toLowerCase().startsWith("bearer ")) {
+      return direct.slice(7).trim() || void 0;
+    }
+    return direct;
+  }
+  const authorization = headers.get("authorization")?.trim();
+  if (authorization?.toLowerCase().startsWith("bearer ")) {
+    return authorization.slice(7).trim() || void 0;
+  }
+  return void 0;
+}
+function createApiKeyAuthMiddleware(options) {
+  const headerName = options.headerName || "x-api-key";
+  return async (c, next) => {
+    if (c.req.method === "OPTIONS" || options.mode === "disabled") {
+      return next();
+    }
+    if (!options.apiKey) {
+      if (options.mode === "auto") return next();
+      return c.json(
+        {
+          success: false,
+          error: "API authentication is not configured",
+          code: "AUTH_CONFIGURATION_ERROR"
+        },
+        503
+      );
+    }
+    const apiKey = readCredential(c.req.raw.headers, headerName);
+    if (!apiKey) {
+      return c.json(
+        {
+          success: false,
+          error: "API key required",
+          code: "UNAUTHORIZED"
+        },
+        401
+      );
+    }
+    if (!keysEqual(apiKey, options.apiKey)) {
+      return c.json(
+        {
+          success: false,
+          error: "Invalid API key",
+          code: "UNAUTHORIZED"
+        },
+        401
+      );
+    }
+    await next();
+  };
+}
 var apiKeyAuthMiddleware;
 var init_auth = __esm({
   "src/server/middleware/hono/auth.ts"() {
     "use strict";
     init_esm_shims();
     init_config();
-    apiKeyAuthMiddleware = async (c, next) => {
-      if (!config.features.apiKey || !config.API_KEY) {
-        return next();
-      }
-      const apiKey = c.req.header(config.API_KEY_HEADER);
-      if (!apiKey) {
-        return c.json(
-          {
-            success: false,
-            error: "API key required",
-            code: "UNAUTHORIZED"
-          },
-          401
-        );
-      }
-      if (apiKey !== config.API_KEY) {
-        return c.json(
-          {
-            success: false,
-            error: "Invalid API key",
-            code: "UNAUTHORIZED"
-          },
-          401
-        );
-      }
-      await next();
-    };
+    apiKeyAuthMiddleware = createApiKeyAuthMiddleware({
+      mode: config.API_AUTH_MODE,
+      apiKey: config.API_KEY,
+      headerName: config.API_KEY_HEADER
+    });
   }
 });
 
@@ -3137,12 +3607,48 @@ var init_request_logger = __esm({
   }
 });
 
+// src/server/middleware/hono/concurrency-limit.ts
+function concurrencyLimiter(options) {
+  const limit = Math.max(1, Math.floor(options.limit));
+  const retryAfterSeconds = options.retryAfterSeconds ?? 1;
+  let active = 0;
+  return async (c, next) => {
+    c.header("X-Concurrency-Limit", String(limit));
+    if (active >= limit) {
+      c.header("Retry-After", String(retryAfterSeconds));
+      return c.json(
+        {
+          success: false,
+          error: "Server is at capacity",
+          code: "CONCURRENCY_LIMIT_EXCEEDED"
+        },
+        503
+      );
+    }
+    active += 1;
+    c.header("X-Concurrency-Remaining", String(Math.max(0, limit - active)));
+    try {
+      await next();
+    } finally {
+      active -= 1;
+    }
+  };
+}
+var init_concurrency_limit = __esm({
+  "src/server/middleware/hono/concurrency-limit.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/server/app.ts
 import { Hono as Hono6 } from "hono";
 import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 import { logger as honoLogger } from "hono/logger";
 import { timing } from "hono/timing";
+import { bodyLimit as bodyLimit4 } from "hono/body-limit";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
 function createAPIApp(adapter) {
   Container.initialize(adapter);
   const honoApp = new Hono6();
@@ -3152,7 +3658,7 @@ function createAPIApp(adapter) {
     "*",
     cors({
       origin: config.cors.origin,
-      credentials: config.cors.credentials,
+      credentials: config.cors.origin === "*" ? false : config.cors.credentials,
       allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
       allowHeaders: ["Content-Type", "Authorization", config.API_KEY_HEADER],
       exposeHeaders: ["X-Request-Id", "X-File-Id"],
@@ -3164,6 +3670,28 @@ function createAPIApp(adapter) {
   honoApp.use("*", errorRecoveryMiddleware);
   honoApp.use("*", requestLoggerMiddleware);
   honoApp.use("*", securityMiddleware);
+  honoApp.use(
+    "/api/*",
+    bodyLimit4({
+      maxSize: config.requestLimits.maxBodySize,
+      onError: () => {
+        throw new HTTPException7(413, { message: "Request body too large" });
+      }
+    })
+  );
+  honoApp.use(
+    "/api/*",
+    rateLimiter({
+      limit: config.rateLimit.max,
+      window: config.rateLimit.windowMs,
+      namespace: (c) => `${c.req.method}:${c.req.path}`,
+      trustProxy: config.rateLimit.trustProxy
+    })
+  );
+  honoApp.use(
+    "/api/*",
+    concurrencyLimiter({ limit: config.requestLimits.maxConcurrent })
+  );
   if (config.features.apiKey) {
     honoApp.use("/api/*", apiKeyAuthMiddleware);
   }
@@ -3217,6 +3745,8 @@ var init_app = __esm({
     init_security();
     init_error_recovery();
     init_request_logger();
+    init_rate_limit();
+    init_concurrency_limit();
     init_container();
   }
 });
@@ -3273,7 +3803,7 @@ var init_unified_server = __esm({
         );
         const apiApp = createAPIApp(this.adapter);
         this.app.get("/api", async (c) => {
-          return await apiApp.fetch(c.req.raw);
+          return await apiApp.fetch(c.req.raw, c.env);
         });
         this.app.use("*", async (c, next) => {
           const path6 = c.req.path;
@@ -3281,7 +3811,7 @@ var init_unified_server = __esm({
             if (/\.(ts|tsx|js|jsx|css|map)$/.test(path6)) {
               return next();
             }
-            const response = await apiApp.fetch(c.req.raw);
+            const response = await apiApp.fetch(c.req.raw, c.env);
             if (response.status !== 404) {
               return response;
             }
@@ -3478,20 +4008,53 @@ var init_unified_server = __esm({
 // src/cli.ts
 init_esm_shims();
 import { Command as Command2 } from "commander";
-import chalk2 from "chalk";
-import { registerCoreCommands } from "@json-to-office/jto-cli";
+import chalk from "chalk";
+import { registerCoreCommands, renderLines as renderLines2 } from "@json-to-office/jto-cli";
 
 // src/commands/dev.ts
 init_esm_shims();
 import { Command } from "commander";
-import chalk from "chalk";
-import ora from "ora";
-import boxen from "boxen";
 import {
   loadConfig,
+  parsePort,
   formatError,
+  renderLines,
+  runTask,
   EXIT_CODES
 } from "@json-to-office/jto-cli";
+function installShutdownHandlers(server) {
+  let shutdownPromise;
+  const removeHandlers = () => {
+    process.off("SIGINT", handleShutdown);
+    process.off("SIGTERM", handleShutdown);
+  };
+  const handleShutdown = () => {
+    shutdownPromise ??= (async () => {
+      let exitCode = EXIT_CODES.OK;
+      try {
+        await runTask("Shutting down...", () => server.stop(), {
+          success: "Server stopped",
+          failure: "Failed to stop server"
+        });
+      } catch (error) {
+        exitCode = EXIT_CODES.FAIL;
+        await formatError(error);
+      } finally {
+        removeHandlers();
+      }
+      process.exit(exitCode);
+    })();
+  };
+  process.once("SIGINT", handleShutdown);
+  process.once("SIGTERM", handleShutdown);
+}
+async function openBrowser(url) {
+  const { execFile: execFile2 } = await import("child_process");
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  await new Promise((resolve2, reject) => {
+    execFile2(command, args, (error) => error ? reject(error) : resolve2());
+  });
+}
 function createDevCommand(adapter) {
   const dev = new Command("dev");
   return dev.description("Start development server with web UI").option(
@@ -3499,64 +4062,69 @@ function createDevCommand(adapter) {
     "Port to run server on",
     String(adapter.defaultPort)
   ).option("-H, --host <host>", "Host to bind to", "localhost").option("-o, --open", "Open browser automatically").option("-c, --config <path>", "Path to config file").action(async (options) => {
-    const spinner = ora(
-      `Starting ${adapter.name.toUpperCase()} dev server...`
-    ).start();
     try {
-      const config2 = await loadConfig(options.config);
-      const portSource = dev.getOptionValueSource("port");
-      const hostSource = dev.getOptionValueSource("host");
-      if (portSource === "cli") {
-        config2.server.port = parseInt(options.port, 10);
-      } else if (config2.server.port === 3003 && adapter.defaultPort !== 3003) {
-        config2.server.port = adapter.defaultPort;
-      }
-      if (hostSource === "cli") {
-        config2.server.host = options.host;
-      }
-      const { UnifiedServer: UnifiedServer2 } = await Promise.resolve().then(() => (init_unified_server(), unified_server_exports));
-      const server = new UnifiedServer2(adapter, config2);
-      await server.start();
-      const url = `http://${config2.server.host}:${config2.server.port}`;
-      spinner.succeed("Server ready");
-      console.log(
-        boxen(
-          chalk.bold(`${adapter.name.toUpperCase()} Dev Server
-
-`) + `${chalk.cyan("Local:")}   ${chalk.bold(url)}
-${chalk.cyan("API:")}     ${url}/api/${adapter.name}/generate
-${chalk.cyan("Health:")}  ${url}/health
-
-` + chalk.gray("Press Ctrl+C to stop"),
-          {
-            padding: 1,
-            borderColor: "green",
-            borderStyle: "round"
+      const { server, url } = await runTask(
+        `Starting ${adapter.name.toUpperCase()} dev server...`,
+        async () => {
+          const config2 = await loadConfig(options.config, {
+            defaultPort: adapter.defaultPort
+          });
+          const portSource = dev.getOptionValueSource("port");
+          const hostSource = dev.getOptionValueSource("host");
+          if (portSource === "cli") {
+            const port = parsePort(options.port);
+            if (port === void 0) {
+              throw new Error(
+                `Invalid --port "${options.port}": expected an integer between 0 and 65535`
+              );
+            }
+            config2.server.port = port;
           }
-        )
+          if (hostSource === "cli") {
+            config2.server.host = options.host;
+          }
+          const { UnifiedServer: UnifiedServer2 } = await Promise.resolve().then(() => (init_unified_server(), unified_server_exports));
+          const server2 = new UnifiedServer2(adapter, config2);
+          await server2.start();
+          return {
+            server: server2,
+            url: `http://${config2.server.host}:${config2.server.port}`
+          };
+        },
+        { success: "Server ready", failure: "Failed to start dev server" }
       );
+      installShutdownHandlers(server);
+      await renderLines([
+        {
+          text: `${adapter.name.toUpperCase()} Dev Server`,
+          tone: "success"
+        },
+        { text: `Local:   ${url}` },
+        { text: `API:     ${url}/api/${adapter.name}/generate` },
+        { text: `Health:  ${url}/health` },
+        { text: "Press Ctrl+C to stop", tone: "muted" }
+      ]);
       if (options.open) {
-        const { execFile: execFile2 } = await import("child_process");
-        const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-        execFile2(cmd, [url]);
-      }
-      const shutdown = async () => {
-        console.log(chalk.yellow("\nShutting down..."));
-        await server.stop();
-        process.exit(EXIT_CODES.OK);
-      };
-      process.on("SIGINT", shutdown);
-      process.on("SIGTERM", shutdown);
+        try {
+          await openBrowser(url);
+        } catch (error) {
+          await renderLines([
+            {
+              text: `Could not open browser: ${error instanceof Error ? error.message : String(error)}`,
+              tone: "warning"
+            }
+          ]);
+        }
+      }
     } catch (error) {
-      spinner.fail("Failed to start dev server");
-      formatError(error);
+      await formatError(error);
       process.exit(EXIT_CODES.FAIL);
     }
   });
 }
 
 // src/cli.ts
-var PACKAGE_VERSION = true ? "0.20.0" : "dev-mode";
+var PACKAGE_VERSION = true ? "0.22.0" : "dev-mode";
 var program = new Command2();
 program.name("jto").description("JSON to Office CLI - Generate .docx and .pptx from JSON").version(PACKAGE_VERSION);
 registerCoreCommands(program, {
@@ -3565,14 +4133,14 @@ registerCoreCommands(program, {
 program.addHelpText(
   "after",
   `
-${chalk2.gray("Examples:")}
-  $ jto docx generate doc.json      ${chalk2.dim("# Generate DOCX from JSON")}
-  $ jto pptx generate slides.json   ${chalk2.dim("# Generate PPTX from JSON")}
-  $ jto docx dev                    ${chalk2.dim("# Start DOCX dev server")}
-  $ jto pptx validate slides.json   ${chalk2.dim("# Validate PPTX JSON")}
-  $ jto docx schemas                ${chalk2.dim("# Export DOCX JSON schemas")}
-  $ jto pptx discover               ${chalk2.dim("# Discover PPTX plugins")}
-  $ jto docx fonts install Inter    ${chalk2.dim("# Download a Google Font into ./fonts")}
+${chalk.gray("Examples:")}
+  $ jto docx generate doc.json      ${chalk.dim("# Generate DOCX from JSON")}
+  $ jto pptx generate slides.json   ${chalk.dim("# Generate PPTX from JSON")}
+  $ jto docx dev                    ${chalk.dim("# Start DOCX dev server")}
+  $ jto pptx validate slides.json   ${chalk.dim("# Validate PPTX JSON")}
+  $ jto docx schemas                ${chalk.dim("# Export DOCX JSON schemas")}
+  $ jto pptx discover               ${chalk.dim("# Discover PPTX plugins")}
+  $ jto docx fonts install Inter    ${chalk.dim("# Download a Google Font into ./fonts")}
 `
 );
 program.exitOverride();
@@ -3586,7 +4154,10 @@ program.exitOverride();
     if (error.code === "commander.executeSubCommandAsync") {
       process.exit(error.exitCode);
     }
-    console.error(chalk2.red("Error:"), error.message);
+    await renderLines2(
+      [{ text: `Error: ${error.message}`, tone: "error" }],
+      process.stderr
+    );
     process.exit(1);
   }
 })();