@json-to-office/jto 2.0.0 → 2.2.0

package/dist/cli.js

@@ -34,6 +34,14 @@ function parseOutboundSourceMode(value, nodeEnv) {
   if (value === "development" || value === "safe") return value;
   return nodeEnv === "production" ? "safe" : "development";
 }
+function pluginAutoloadEnabled(env = process.env) {
+  const explicit = env.PLUGIN_AUTOLOAD?.trim();
+  if (explicit) return explicit === "true" || explicit === "1";
+  return normalizeNodeEnv(env.NODE_ENV || "development") !== "production";
+}
+function requestTriggeredPluginLoadAllowed(env = process.env) {
+  return pluginAutoloadEnabled(env) && normalizeNodeEnv(env.NODE_ENV || "development") !== "production";
+}
 function normalizeNodeEnv(value) {
   return value === "development" || value === "test" ? value : "production";
 }
@@ -2005,8 +2013,8 @@ async function toDataUrl(source, baseDir, state, mimeByExtension) {
     if (cached !== void 0) return cached;
     const contained = resolved === state.baseDirReal || resolved.startsWith(state.baseDirReal + path4.sep);
     if (contained) {
-      const stat = await fs2.stat(resolved);
-      if (stat.isFile() && stat.size <= state.maxFileBytes && stat.size <= state.totalBudget) {
+      const stat2 = await fs2.stat(resolved);
+      if (stat2.isFile() && stat2.size <= state.maxFileBytes && stat2.size <= state.totalBudget) {
         const buffer = await fs2.readFile(resolved);
         state.totalBudget -= buffer.length;
         result = `data:${mime};base64,${buffer.toString("base64")}`;
@@ -2712,13 +2720,213 @@ var init_format = __esm({
   }
 });
 
+// src/server/middleware/hono/auth.ts
+import { createHash, timingSafeEqual } from "crypto";
+function keysEqual(received, expected) {
+  const receivedDigest = createHash("sha256").update(received).digest();
+  const expectedDigest = createHash("sha256").update(expected).digest();
+  return timingSafeEqual(receivedDigest, expectedDigest);
+}
+function readCredential(headers, headerName) {
+  const direct = headers.get(headerName)?.trim();
+  if (direct) {
+    if (headerName.toLowerCase() === "authorization" && direct.toLowerCase().startsWith("bearer ")) {
+      return direct.slice(7).trim() || void 0;
+    }
+    return direct;
+  }
+  const authorization = headers.get("authorization")?.trim();
+  if (authorization?.toLowerCase().startsWith("bearer ")) {
+    return authorization.slice(7).trim() || void 0;
+  }
+  return void 0;
+}
+function hasValidApiKey(headers, env = process.env) {
+  const expected = env.API_KEY?.trim();
+  if (!expected) return false;
+  const received = readCredential(headers, env.API_KEY_HEADER || "x-api-key");
+  if (!received) return false;
+  return keysEqual(received, expected);
+}
+function createApiKeyAuthMiddleware(options) {
+  const headerName = options.headerName || "x-api-key";
+  return async (c, next) => {
+    if (c.req.method === "OPTIONS" || options.mode === "disabled") {
+      return next();
+    }
+    if (!options.apiKey) {
+      if (options.mode === "auto") return next();
+      return c.json(
+        {
+          success: false,
+          error: "API authentication is not configured",
+          code: "AUTH_CONFIGURATION_ERROR"
+        },
+        503
+      );
+    }
+    const apiKey = readCredential(c.req.raw.headers, headerName);
+    if (!apiKey) {
+      return c.json(
+        {
+          success: false,
+          error: "API key required",
+          code: "UNAUTHORIZED"
+        },
+        401
+      );
+    }
+    if (!keysEqual(apiKey, options.apiKey)) {
+      return c.json(
+        {
+          success: false,
+          error: "Invalid API key",
+          code: "UNAUTHORIZED"
+        },
+        401
+      );
+    }
+    await next();
+  };
+}
+var apiKeyAuthMiddleware;
+var init_auth = __esm({
+  "src/server/middleware/hono/auth.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    apiKeyAuthMiddleware = createApiKeyAuthMiddleware({
+      mode: config.API_AUTH_MODE,
+      apiKey: config.API_KEY,
+      headerName: config.API_KEY_HEADER
+    });
+  }
+});
+
+// src/server/lib/browser-plugin-schema.ts
+function jsonDepth(value) {
+  let deepest = 0;
+  const stack = [{ value, depth: 1 }];
+  while (stack.length > 0) {
+    const { value: current, depth } = stack.pop();
+    if (current === null || typeof current !== "object") continue;
+    if (depth > deepest) deepest = depth;
+    const children = Array.isArray(current) ? current : Object.values(current);
+    for (const child of children) {
+      if (child !== null && typeof child === "object") {
+        stack.push({ value: child, depth: depth + 1 });
+      }
+    }
+  }
+  return deepest;
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function namespaceSchemaIds(schema, namespace) {
+  const ids = /* @__PURE__ */ new Set();
+  const collect = (node) => {
+    if (Array.isArray(node)) {
+      node.forEach(collect);
+      return;
+    }
+    if (!isRecord3(node)) return;
+    if (typeof node.$id === "string") ids.add(node.$id);
+    Object.values(node).forEach(collect);
+  };
+  collect(schema);
+  const rename = (id) => `${namespace}:${id}`;
+  const rewrite = (node) => {
+    if (Array.isArray(node)) return node.map(rewrite);
+    if (!isRecord3(node)) return node;
+    const out = {};
+    for (const [key, value] of Object.entries(node)) {
+      if (key === "$id" && typeof value === "string") {
+        out[key] = rename(value);
+      } else if (key === "$ref" && typeof value === "string") {
+        if (ids.has(value)) out[key] = rename(value);
+        else if (value.startsWith("#")) out[key] = value;
+        else {
+          throw new BrowserPluginSchemaError(
+            `propsSchema references "${value}"; only ids defined in the schema itself and local "#" pointers are allowed.`
+          );
+        }
+      } else if (key === "$schema") {
+        continue;
+      } else {
+        out[key] = rewrite(value);
+      }
+    }
+    return out;
+  };
+  return rewrite(schema);
+}
+function prepareBrowserPlugins(components) {
+  const bytes = JSON.stringify(components).length;
+  if (bytes > MAX_BROWSER_SCHEMA_BYTES) {
+    throw new BrowserPluginSchemaError(
+      `customComponents is ${Math.round(bytes / 1024)} KB serialized; the limit is ${MAX_BROWSER_SCHEMA_BYTES / 1024} KB.`
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return components.map((component) => {
+    if (seen.has(component.name)) {
+      throw new BrowserPluginSchemaError(
+        `customComponents lists "${component.name}" more than once.`
+      );
+    }
+    seen.add(component.name);
+    return {
+      ...component,
+      versions: component.versions.map((version) => {
+        const depth = jsonDepth(version.propsSchema);
+        if (depth > MAX_BROWSER_SCHEMA_DEPTH) {
+          throw new BrowserPluginSchemaError(
+            `propsSchema of "${component.name}" v${version.version} nests ${depth} levels deep; the limit is ${MAX_BROWSER_SCHEMA_DEPTH}.`
+          );
+        }
+        return {
+          ...version,
+          propsSchema: namespaceSchemaIds(
+            version.propsSchema,
+            `${component.name}@${version.version}`
+          )
+        };
+      })
+    };
+  });
+}
+var MAX_BROWSER_SCHEMA_BYTES, MAX_BROWSER_SCHEMA_DEPTH, BrowserPluginSchemaError;
+var init_browser_plugin_schema = __esm({
+  "src/server/lib/browser-plugin-schema.ts"() {
+    "use strict";
+    init_esm_shims();
+    MAX_BROWSER_SCHEMA_BYTES = 256 * 1024;
+    MAX_BROWSER_SCHEMA_DEPTH = 32;
+    BrowserPluginSchemaError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "BrowserPluginSchemaError";
+      }
+    };
+  }
+});
+
 // src/server/routes/discovery.ts
 import { Hono as Hono3 } from "hono";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { bodyLimit as bodyLimit3 } from "hono/body-limit";
+import { Type as Type3 } from "@sinclair/typebox";
+import { readFile, stat } from "fs/promises";
 import {
   PluginDiscoveryService as PluginDiscoveryService2,
   PluginRegistry as PluginRegistry3
 } from "@json-to-office/jto-cli";
 import { latestVersion } from "@json-to-office/shared";
+function sameSiteOnly(c) {
+  const site = c.req.header("sec-fetch-site");
+  return site === void 0 || site === "same-origin" || site === "none";
+}
 function cleanupTypeBoxIds(schema) {
   if (typeof schema !== "object" || schema === null) return;
   if (schema.$id && /^T\d+$/.test(schema.$id)) delete schema.$id;
@@ -2734,7 +2942,7 @@ function cleanupTypeBoxIds(schema) {
   });
 }
 async function ensurePluginsRegistered(format, pluginNames) {
-  if (process.env.NODE_ENV === "production") return;
+  if (!requestTriggeredPluginLoadAllowed()) return;
   const registry = PluginRegistry3.getInstance();
   const satisfied = pluginNames ? pluginNames.every((name) => registry.getPlugin(name)) : registry.hasPlugins();
   if (satisfied) return;
@@ -2759,9 +2967,12 @@ function getSelectedPlugins(pluginNames) {
     return { name: plugin.name, versions, versionKeys, latest, latestEntry };
   });
 }
-async function generateDocumentSchema(format, pluginNames) {
+async function generateDocumentSchema(format, pluginNames, browserPlugins = []) {
   await ensurePluginsRegistered(format, pluginNames);
-  const selected = getSelectedPlugins(pluginNames);
+  const browserNames = new Set(browserPlugins.map((p) => p.name));
+  const selected = getSelectedPlugins(pluginNames).filter(
+    (p) => !browserNames.has(p.name)
+  );
   if (format === "docx") {
     const shared = await import("@json-to-office/shared-docx");
     const customComponents = selected.filter((p) => p.latestEntry?.propsSchema).map((p) => {
@@ -2781,6 +2992,25 @@ async function generateDocumentSchema(format, pluginNames) {
       }
       return info;
     });
+    for (const plugin of browserPlugins) {
+      const latest = latestVersion(plugin.versions.map((v) => v.version));
+      const latestEntry = plugin.versions.find((v) => v.version === latest);
+      const info = {
+        name: plugin.name,
+        propsSchema: latestEntry.propsSchema,
+        hasChildren: latestEntry.hasChildren,
+        description: latestEntry.description
+      };
+      if (plugin.versions.length > 1) {
+        info.versionedProps = plugin.versions.map((v) => ({
+          version: v.version,
+          propsSchema: v.propsSchema,
+          description: v.description,
+          hasChildren: v.hasChildren
+        }));
+      }
+      customComponents.push(info);
+    }
     const unified = shared.generateUnifiedDocumentSchema({ customComponents });
     return shared.convertToJsonSchema(unified, {
       $schema: "http://json-schema.org/draft-07/schema#",
@@ -2799,6 +3029,17 @@ async function generateDocumentSchema(format, pluginNames) {
         description: p.versions[v].description
       }))
     }));
+    for (const plugin of browserPlugins) {
+      customComponents.push({
+        name: plugin.name,
+        versions: plugin.versions.map((v) => ({
+          version: v.version,
+          propsSchema: v.propsSchema,
+          hasChildren: v.hasChildren,
+          description: v.description
+        }))
+      });
+    }
     const unified = shared.generateUnifiedDocumentSchema({ customComponents });
     return shared.convertToJsonSchema(unified, {
       $schema: "http://json-schema.org/draft-07/schema#",
@@ -2830,14 +3071,54 @@ async function generateThemeSchema(format) {
     description: `Theme definition for JSON to ${label} ${format === "docx" ? "documents" : "presentations"}`
   };
 }
-var discoveryRouter;
+var discoveryRouter, BrowserPluginVersionSchema, BrowserPluginSchema, DocumentSchemaRequestSchema, MAX_PLUGIN_SOURCE_BYTES;
 var init_discovery = __esm({
   "src/server/routes/discovery.ts"() {
     "use strict";
     init_esm_shims();
     init_logger();
     init_container();
+    init_typebox_validator();
+    init_rate_limit();
+    init_auth();
+    init_config();
+    init_browser_plugin_schema();
     discoveryRouter = new Hono3();
+    BrowserPluginVersionSchema = Type3.Object(
+      {
+        version: Type3.String({ pattern: "^\\d+\\.\\d+\\.\\d+$" }),
+        propsSchema: Type3.Object({}, { additionalProperties: true }),
+        hasChildren: Type3.Optional(Type3.Boolean()),
+        description: Type3.Optional(Type3.String({ maxLength: 2e3 }))
+      },
+      { additionalProperties: false }
+    );
+    BrowserPluginSchema = Type3.Object(
+      {
+        name: Type3.String({
+          minLength: 1,
+          maxLength: 64,
+          pattern: "^[a-zA-Z][a-zA-Z0-9_-]*$"
+        }),
+        versions: Type3.Array(BrowserPluginVersionSchema, {
+          minItems: 1,
+          maxItems: 10
+        })
+      },
+      { additionalProperties: false }
+    );
+    DocumentSchemaRequestSchema = Type3.Object(
+      {
+        plugins: Type3.Optional(
+          Type3.Array(Type3.String({ maxLength: 128 }), { maxItems: 100 })
+        ),
+        customComponents: Type3.Optional(
+          Type3.Array(BrowserPluginSchema, { maxItems: 20 })
+        )
+      },
+      { additionalProperties: false }
+    );
+    MAX_PLUGIN_SOURCE_BYTES = 512 * 1024;
     discoveryRouter.get("/all", async (c) => {
       try {
         const format = Container.getAdapter().name;
@@ -2851,7 +3132,12 @@ var init_discovery = __esm({
           discovery.discoverDocuments(format),
           discovery.discoverThemes(format)
         ]);
-        const results = { plugins, documents, themes };
+        const results = {
+          plugins,
+          documents,
+          themes,
+          pluginAutoload: pluginAutoloadEnabled()
+        };
         return c.json({
           success: true,
           data: results,
@@ -2886,7 +3172,15 @@ var init_discovery = __esm({
           if (!includeExamples) delete result.examples;
           return result;
         });
-        return c.json({ success: true, data: processed, count: plugins.length });
+        return c.json({
+          success: true,
+          data: processed,
+          count: plugins.length,
+          // Whether switching one of these on will actually reach a schema or a
+          // build here. The rail shows them either way — the details are worth
+          // reading — but a switch it cannot honour is a lie.
+          autoload: pluginAutoloadEnabled()
+        });
       } catch (error) {
         logger.error("Plugin discovery failed", { error: error.message });
         return c.json({ success: false, error: error.message }, 500);
@@ -2922,6 +3216,55 @@ var init_discovery = __esm({
         return c.json({ success: false, error: error.message }, 500);
       }
     });
+    discoveryRouter.get("/themes/builtin", async (c) => {
+      try {
+        const adapter = Container.getAdapter();
+        const themes = adapter.getBuiltinThemeValues ? await adapter.getBuiltinThemeValues() : adapter.getBuiltinThemes();
+        return c.json({ success: true, data: themes });
+      } catch (error) {
+        logger.error("Built-in theme lookup failed", { error: error.message });
+        return c.json({ success: false, error: error.message }, 500);
+      }
+    });
+    discoveryRouter.get("/plugins/:name/source", async (c) => {
+      if (!sameSiteOnly(c)) {
+        return c.json(
+          {
+            success: false,
+            error: "Plugin source is only served to the playground"
+          },
+          403
+        );
+      }
+      try {
+        const pluginName = c.req.param("name");
+        const format = Container.getAdapter().name;
+        const discovery = new PluginDiscoveryService2({
+          maxDepth: 10,
+          includeNodeModules: false,
+          verbose: false
+        });
+        const plugins = await discovery.discoverPlugins(format);
+        const plugin = plugins.find((p) => p.name === pluginName);
+        if (!plugin) {
+          return c.json(
+            { success: false, error: `Plugin '${pluginName}' not found` },
+            404
+          );
+        }
+        const info = await stat(plugin.filePath);
+        if (info.size > MAX_PLUGIN_SOURCE_BYTES) {
+          return c.json(
+            { success: false, error: `Plugin '${pluginName}' source is too large` },
+            413
+          );
+        }
+        return c.text(await readFile(plugin.filePath, "utf-8"));
+      } catch (error) {
+        logger.error("Plugin source read failed", { error: error.message });
+        return c.json({ success: false, error: error.message }, 500);
+      }
+    });
     discoveryRouter.get("/plugin/:name", async (c) => {
       try {
         const pluginName = c.req.param("name");
@@ -2944,8 +3287,7 @@ var init_discovery = __esm({
       }
     });
     discoveryRouter.post("/load-plugins", async (c) => {
-      const apiKey = c.req.header("X-API-Key") || c.req.header("Authorization");
-      if (!apiKey && process.env.NODE_ENV === "production") {
+      if (!requestTriggeredPluginLoadAllowed() && !hasValidApiKey(c.req.raw.headers)) {
         return c.json({ success: false, error: "Authentication required" }, 401);
       }
       try {
@@ -3002,6 +3344,51 @@ var init_discovery = __esm({
         return c.json({ success: false, error: error.message }, 500);
       }
     });
+    discoveryRouter.post(
+      "/schemas/document",
+      bodyLimit3({
+        // The aggregate cap in prepareBrowserPlugins is the real bound; this only
+        // keeps a hostile body from being parsed at all.
+        maxSize: 512 * 1024,
+        onError: () => {
+          throw new HTTPException5(413, { message: "Request body too large" });
+        }
+      }),
+      rateLimiter({
+        limit: process.env.NODE_ENV === "production" ? 60 : 1e3,
+        window: 60 * 1e3,
+        namespace: "schemas-document",
+        trustProxy: config.rateLimit.trustProxy
+      }),
+      tbValidator(DocumentSchemaRequestSchema),
+      async (c) => {
+        try {
+          const adapter = Container.getAdapter();
+          const { plugins, customComponents } = getValidated(c, "json");
+          let prepared = [];
+          try {
+            prepared = prepareBrowserPlugins(customComponents ?? []);
+          } catch (error) {
+            if (error instanceof BrowserPluginSchemaError) {
+              throw new HTTPException5(400, { message: error.message });
+            }
+            throw error;
+          }
+          const schema = await generateDocumentSchema(
+            adapter.name,
+            plugins,
+            prepared
+          );
+          return c.json({ success: true, data: schema });
+        } catch (error) {
+          if (error instanceof HTTPException5) throw error;
+          logger.error("Document schema generation failed", {
+            error: error.message
+          });
+          return c.json({ success: false, error: error.message }, 500);
+        }
+      }
+    );
     discoveryRouter.get("/schemas/theme", async (c) => {
       try {
         const adapter = Container.getAdapter();
@@ -3484,10 +3871,10 @@ var init_ai = __esm({
 });
 
 // src/server/routes/fonts.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { Hono as Hono5 } from "hono";
-import { HTTPException as HTTPException5 } from "hono/http-exception";
-import { bodyLimit as bodyLimit3 } from "hono/body-limit";
+import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { bodyLimit as bodyLimit4 } from "hono/body-limit";
 import {
   SAFE_FONTS,
   POPULAR_GOOGLE_FONTS as POPULAR_GOOGLE_FONTS2,
@@ -3507,7 +3894,7 @@ var init_fonts = __esm({
       safe: SAFE_FONTS,
       google: POPULAR_GOOGLE_FONTS2
     });
-    CATALOG_ETAG = `"${createHash("sha256").update(CATALOG_BODY).digest("base64").slice(0, 24)}"`;
+    CATALOG_ETAG = `"${createHash2("sha256").update(CATALOG_BODY).digest("base64").slice(0, 24)}"`;
     fontsRouter.get("/catalog", (c) => {
       const ifNoneMatch = c.req.header("If-None-Match");
       if (ifNoneMatch && ifNoneMatch === CATALOG_ETAG) {
@@ -3522,11 +3909,11 @@ var init_fonts = __esm({
     });
     fontsRouter.post(
       "/materialize",
-      bodyLimit3({
+      bodyLimit4({
         // Body is just {family, weights, italics} — 16 KB is generous.
         maxSize: 16 * 1024,
         onError: () => {
-          throw new HTTPException5(413, { message: "Request body too large" });
+          throw new HTTPException6(413, { message: "Request body too large" });
         }
       }),
       rateLimiter({
@@ -3604,84 +3991,8 @@ var init_request_id = __esm({
   }
 });
 
-// src/server/middleware/hono/auth.ts
-import { createHash as createHash2, timingSafeEqual } from "crypto";
-function keysEqual(received, expected) {
-  const receivedDigest = createHash2("sha256").update(received).digest();
-  const expectedDigest = createHash2("sha256").update(expected).digest();
-  return timingSafeEqual(receivedDigest, expectedDigest);
-}
-function readCredential(headers, headerName) {
-  const direct = headers.get(headerName)?.trim();
-  if (direct) {
-    if (headerName.toLowerCase() === "authorization" && direct.toLowerCase().startsWith("bearer ")) {
-      return direct.slice(7).trim() || void 0;
-    }
-    return direct;
-  }
-  const authorization = headers.get("authorization")?.trim();
-  if (authorization?.toLowerCase().startsWith("bearer ")) {
-    return authorization.slice(7).trim() || void 0;
-  }
-  return void 0;
-}
-function createApiKeyAuthMiddleware(options) {
-  const headerName = options.headerName || "x-api-key";
-  return async (c, next) => {
-    if (c.req.method === "OPTIONS" || options.mode === "disabled") {
-      return next();
-    }
-    if (!options.apiKey) {
-      if (options.mode === "auto") return next();
-      return c.json(
-        {
-          success: false,
-          error: "API authentication is not configured",
-          code: "AUTH_CONFIGURATION_ERROR"
-        },
-        503
-      );
-    }
-    const apiKey = readCredential(c.req.raw.headers, headerName);
-    if (!apiKey) {
-      return c.json(
-        {
-          success: false,
-          error: "API key required",
-          code: "UNAUTHORIZED"
-        },
-        401
-      );
-    }
-    if (!keysEqual(apiKey, options.apiKey)) {
-      return c.json(
-        {
-          success: false,
-          error: "Invalid API key",
-          code: "UNAUTHORIZED"
-        },
-        401
-      );
-    }
-    await next();
-  };
-}
-var apiKeyAuthMiddleware;
-var init_auth = __esm({
-  "src/server/middleware/hono/auth.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_config();
-    apiKeyAuthMiddleware = createApiKeyAuthMiddleware({
-      mode: config.API_AUTH_MODE,
-      apiKey: config.API_KEY,
-      headerName: config.API_KEY_HEADER
-    });
-  }
-});
-
 // src/server/middleware/hono/error-handler.ts
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { HTTPException as HTTPException7 } from "hono/http-exception";
 var errorHandler;
 var init_error_handler = __esm({
   "src/server/middleware/hono/error-handler.ts"() {
@@ -3691,7 +4002,7 @@ var init_error_handler = __esm({
     init_config();
     errorHandler = (err, c) => {
       const requestId = c.get("requestId") || "unknown";
-      if (err instanceof HTTPException6) {
+      if (err instanceof HTTPException7) {
         const cause = err.cause;
         if (cause?.code === "QUALITY_GATE_FAILED") {
           return c.json(
@@ -3911,8 +4222,8 @@ import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 import { logger as honoLogger } from "hono/logger";
 import { timing } from "hono/timing";
-import { bodyLimit as bodyLimit4 } from "hono/body-limit";
-import { HTTPException as HTTPException7 } from "hono/http-exception";
+import { bodyLimit as bodyLimit5 } from "hono/body-limit";
+import { HTTPException as HTTPException8 } from "hono/http-exception";
 function createAPIApp(adapter) {
   Container.initialize(adapter);
   const honoApp = new Hono6();
@@ -3936,10 +4247,10 @@ function createAPIApp(adapter) {
   honoApp.use("*", securityMiddleware);
   honoApp.use(
     "/api/*",
-    bodyLimit4({
+    bodyLimit5({
       maxSize: config.requestLimits.maxBodySize,
       onError: () => {
-        throw new HTTPException7(413, { message: "Request body too large" });
+        throw new HTTPException8(413, { message: "Request body too large" });
       }
     })
   );
@@ -4026,6 +4337,7 @@ import { logger as logger2 } from "hono/logger";
 import { compress } from "hono/compress";
 import { resolve, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+import { PluginRegistry as PluginRegistry4 } from "@json-to-office/jto-cli";
 var __filename2, __dirname3, UnifiedServer;
 var init_unified_server = __esm({
   "src/server/unified-server.ts"() {
@@ -4033,6 +4345,7 @@ var init_unified_server = __esm({
     init_esm_shims();
     init_app();
     init_logger();
+    init_config();
     __filename2 = fileURLToPath3(import.meta.url);
     __dirname3 = dirname3(__filename2);
     UnifiedServer = class {
@@ -4049,6 +4362,38 @@ var init_unified_server = __esm({
       async initialize() {
         await this.setupMiddleware();
         await this.setupRoutes();
+        await this.preloadPlugins();
+      }
+      /**
+       * Load the disk plugins once, before the first request.
+       *
+       * The registry is what generation reads, and nothing else fills it in a
+       * hosted deployment: the load route wants a key a public playground has
+       * none of, and no request may make the server walk its disk there anyway
+       * (see `requestTriggeredPluginLoadAllowed`). Loading here instead makes it
+       * the operator's decision, taken at boot from the image's own filesystem —
+       * see `pluginAutoloadEnabled`.
+       *
+       * Awaited rather than backgrounded so the first schema request cannot beat
+       * it and cache a plugin-less schema. A plugin that fails to import is a
+       * defect in that plugin, not a reason to refuse to serve.
+       */
+      async preloadPlugins() {
+        if (!pluginAutoloadEnabled()) return;
+        const registry = PluginRegistry4.getInstance();
+        registry.setFormat(this.adapter.name);
+        try {
+          const { discovered, loaded } = await registry.discoverAndLoad();
+          if (discovered > 0) {
+            logger.info(
+              `Loaded ${loaded} of ${discovered} plugin(s) found on disk`
+            );
+          }
+        } catch (error) {
+          logger.warn(
+            `Plugin autoload failed: ${error?.message ?? "unknown error"}`
+          );
+        }
       }
       async setupMiddleware() {
         this.app.use("*", logger2());
@@ -4388,7 +4733,7 @@ function createDevCommand(adapter) {
 }
 
 // src/cli.ts
-var PACKAGE_VERSION = true ? "2.0.0" : "dev-mode";
+var PACKAGE_VERSION = true ? "2.2.0" : "dev-mode";
 var program = new Command2();
 program.name("jto").description("JSON to Office CLI - Generate .docx and .pptx from JSON").version(PACKAGE_VERSION);
 registerCoreCommands(program, {