Security

• SSRF: urlSource needs an explicit host allow-list, accepts only http(s), and refuses redirects.
• Source verification: the fetched bytes' sha256 must match the log's source.hash; otherwise SOURCE_MISMATCH.
• Limits before decode: byte size, megapixels (from the header), edit log size and a timeout are enforced before pixels are touched.
• Assets: fonts and images are addressed by id and verified by sha256. The log cannot point at arbitrary URLs.
• Validation: every request and every op passes a strict zod schema; unknown fields and unknown plugins are rejected.
• Idempotency: replays are served from the object store, so retries cannot multiply work.