Add Redis cache, origin validation, SSRF hardening, and code quality refactor

.env.example

@@ -6,6 +6,7 @@ PORT=3000
 #   disk   - Persist to disk only (survives restarts)
 #   memory - In-memory only (fastest, lost on restart)
 #   hybrid - Memory (L1) + Disk (L2) for speed and persistence
+#   redis  - Redis/Valkey (uses Bun's built-in Redis client)
 #   none   - No caching
 CACHE_MODE=disk
 CACHE_DIR=./cache            # Directory for disk cache (disk/hybrid modes)
@@ -23,5 +24,11 @@ ALLOW_SELF_REFERENCE=false   # Allow /image to fetch from own /og endpoint (for
 MAX_IMAGE_SIZE=10485760      # Max image size in bytes (default: 10MB)
 REQUEST_TIMEOUT=30000        # Request timeout in ms (default: 30s)
 
+# Redis cache settings (only used when CACHE_MODE=redis)
+REDIS_URL=redis://localhost:6379   # Redis connection URL (supports redis://, rediss://, redis+unix://)
+REDIS_KEY_PREFIX=ps:               # Key prefix to namespace cache entries
+REDIS_CONNECTION_TIMEOUT=5000      # Connection timeout in ms
+REDIS_MAX_RETRIES=10               # Max reconnection attempts
+
 # Custom OG Templates
 TEMPLATES_DIR=./templates    # Directory for custom OG image templates (JSON files)

.oxfmtrc.json

@@ -0,0 +1,14 @@
+{
+  "useTabs": false,
+  "tabWidth": 2,
+  "printWidth": 80,
+  "singleQuote": false,
+  "jsxSingleQuote": false,
+  "quoteProps": "as-needed",
+  "trailingComma": "all",
+  "semi": true,
+  "arrowParens": "always",
+  "bracketSameLine": false,
+  "bracketSpacing": true,
+  "ignorePatterns": []
+}

.oxlintrc.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "categories": {
+    "correctness": "error",
+    "suspicious": "warn"
+  },
+  "ignorePatterns": ["node_modules", "dist", "cache"]
+}

CLAUDE.md

@@ -8,7 +8,9 @@ Image processing microservice with OG image generation.
 - **Framework**: Elysia (type-safe HTTP framework)
 - **Image Processing**: Sharp (libvips bindings)
 - **OG Generation**: Satori + resvg-js (SVG-based, no headless browser)
-- **Linting/Formatting**: Biome
+- **Linting**: oxlint (fast Rust-based linter)
+- **Formatting**: oxfmt (Prettier-compatible Rust formatter)
+- **Building**: tsdown (TypeScript bundler based on Rolldown)
 
 ## Commands
 
@@ -18,6 +20,9 @@ bun run dev          # Start with hot reload
 bun run start        # Start production server
 bun test             # Run all tests
 bun test tests/unit  # Run unit tests only
+bun run lint         # Lint with oxlint
+bun run format       # Format with oxfmt
+bun run build        # Build with tsdown
 ```
 
 ## Project Structure
@@ -57,10 +62,10 @@ tests/
 
 ## Code Style
 
-- Use Biome for linting/formatting: `bunx biome check --write .`
+- Use oxfmt for formatting: `bun run format`
+- Use oxlint for linting: `bun run lint`
 - Double quotes for strings
 - Space indentation
-- Organize imports automatically
 
 ## Bun-Specific Notes
 

README.md

@@ -390,6 +390,7 @@ Instead of creating template files, you can pass the entire template configurati
 **Encoding Options:**
 
 1. **Base64** (recommended for complex templates):
+
    ```bash
    # Encode your template
    echo '{"layout":{"elements":[{"type":"text","content":"{{title}}","fontSize":48}]}}' | base64
@@ -399,6 +400,7 @@ Instead of creating template files, you can pass the entire template configurati
    ```
 
 2. **URL-safe Base64** (uses `-` and `_` instead of `+` and `/`):
+
    ```bash
    /og?config=eyJsYXlvdXQiOnsiZWxlbWVudHMiOlt7InR5cGUiOiJ0ZXh0IiwiY29udGVudCI6Int7dGl0bGV9fSIsImZvbnRTaXplIjo0OH1dfX0-&title=Hello
    ```
@@ -424,23 +426,23 @@ const template = {
         content: "{{title}}",
         fontSize: 56,
         fontWeight: 700,
-        color: "#ffffff"
+        color: "#ffffff",
       },
       {
         type: "spacer",
         size: 20,
-        showIf: "description"
+        showIf: "description",
       },
       {
         type: "text",
         content: "{{description}}",
         fontSize: 24,
         color: "#ffffff",
         opacity: 0.9,
-        showIf: "description"
-      }
-    ]
-  }
+        showIf: "description",
+      },
+    ],
+  },
 };
 
 // Encode and use
@@ -540,6 +542,7 @@ docker run -e CLUSTER_WORKERS=4 ghcr.io/climactic/pixelserve:latest
 ```
 
 **Notes:**
+
 - Clustering requires Linux (uses `SO_REUSEPORT`). On macOS/Windows, it falls back to single process mode with a warning.
 - Each worker maintains its own memory cache; disk cache is shared across all workers.
 - Crashed workers are automatically respawned to maintain availability.