fabricjs-document-engine 0.7.0 → 0.8.0

package/README.md

@@ -16,6 +16,7 @@ Fabric already draws objects, handles interaction and serializes to JSON. This p
 - **Versions and migration.** Keep named versions, restore any of them as a new revision, and open plain Fabric JSON or documents saved by older versions of this package.
 - **Reliable undo and redo.** One user action is one undo step. Transactions group several code changes into one labelled step, and ids survive undo and redo.
 - **React ready, framework free.** Hooks for React, and a small state store for any other framework. Your toolbar and UI stay yours.
+- **Hardened.** Imported documents are cleaned and size-limited, undo history has a memory budget, and every feature is tested in Chromium, Firefox and WebKit. See the [compatibility and performance results](https://github.com/re-sohail/fabricjs-document-engine/blob/main/docs/compatibility.md).
 - **Fabric 6 and 7.** Every release is tested against both.
 
 ## Install
@@ -439,6 +440,7 @@ Keep project data such as titles, owners and tags in `metadata` with `engine.upd
 | `bindKeyboardShortcuts(engine, { target? })` | Adds the undo and redo shortcuts. Returns an unbind function. |
 | `engine.on(event, handler)` | Listens to `load:start`, `document:change`, `load:success`, `load:error`, `save:start`, `save:success`, `save:error`, `save:retry`, `save:status`, `assets:warning`, `recovery:checkpoint`, `recovery:restored`, `recovery:error`, `export:success`, `export:error`, `version:created`, `version:restored`, `version:error`, `history:change` or `history:error`. Returns an unsubscribe function. |
 | `engine.destroy()` | Stops listening to the canvas and cancels a running load. |
+| `secureDocument(value, limits?)` / `refuseUnsafeImageUrls(objects, isAllowed?)` / `isSafeImageUrl(url)` | The safety checks, exported for server-side validation. |
 | `createDocumentStateStore(engine)` | Framework-free `{ getSnapshot, subscribe, destroy }` state for toolbars. |
 | `validateDocument(value)` | Returns a list of issues with the exact path of each problem. |
 
@@ -448,6 +450,7 @@ Every failure is a `DocumentEngineError` with a `code` you can switch on:
 
 | Code | Meaning |
 | --- | --- |
+| `UNSAFE_DOCUMENT` | The document broke a safety rule: an unsafe image address, too many objects, or nesting too deep. `error.issues` lists each one. |
 | `INVALID_DOCUMENT` | The document shape is wrong. `error.issues` lists each path, such as `objects[3].objects[1].type`. |
 | `UNSUPPORTED_SCHEMA` | The document was written by a newer version of this package. |
 | `UNKNOWN_OBJECT_TYPE` | A type is not registered. `error.unknownTypes` lists them. |
@@ -490,9 +493,33 @@ A failed load never clears or half-fills your canvas.
 | 6 | PNG, JPEG, SVG and JSON export with preflight checks | 0.5.0 |
 | 7 | Named versions and schema migrations | 0.6.0 |
 | 8 | React adapter and examples | 0.7.0 |
-| 9 | Hardening and benchmarks | |
+| 9 | Hardening and benchmarks | 0.8.0 |
 | 10 | Stable API | 1.0.0 |
 
+## Imported content and limits
+
+Documents often come from users, so the engine treats them as untrusted:
+
+- Keys named `__proto__`, `constructor` or `prototype` are removed before Fabric sees them. Fabric copies every key onto the object it creates, so these keys could otherwise change an object's prototype.
+- Image addresses are checked after `assets.resolveUrl`, before anything is fetched. `http:`, `https:`, `blob:`, relative addresses and `data:image/...` are allowed. `javascript:`, `file:` and non-image `data:` addresses are refused with `UNSAFE_DOCUMENT`.
+- A document with more than 50,000 objects, or nested more than 100 levels deep, is refused before loading, so a hostile file cannot freeze the tab.
+
+```ts
+createDocumentEngine({
+  canvas,
+  limits: {
+    maxObjects: 10_000,
+    maxDepth: 40,
+    isAllowedUrl: (url) => url.startsWith('https://cdn.example.com/'),
+  },
+  history: { limit: 100, maxBytes: 32 * 1024 * 1024 },
+});
+```
+
+`history.maxBytes` caps the memory undo history uses. The default is 64 MB, and the oldest steps are dropped first. SVG export escapes text, so text such as `<script>` inside a text box stays text.
+
+Accessibility guidance for your toolbar, status text and dialogs is in [docs/accessibility.md](https://github.com/re-sohail/fabricjs-document-engine/blob/main/docs/accessibility.md).
+
 ## Troubleshooting
 
 Common problems and fixes are in [docs/troubleshooting.md](https://github.com/re-sohail/fabricjs-document-engine/blob/main/docs/troubleshooting.md).

package/dist/assets/asset-pipeline.cjs

@@ -2,6 +2,7 @@ const require_asset_references = require("./asset-references.cjs");
 const require_asset_manifest = require("./asset-manifest.cjs");
 const require_errors = require("../engine/errors.cjs");
 const require_font_check = require("./font-check.cjs");
+const require_content_limits = require("../security/content-limits.cjs");
 const require_image_check = require("./image-check.cjs");
 //#region src/assets/asset-pipeline.ts
 function cloneDocument(document) {
@@ -105,10 +106,11 @@ async function replaceMissingImages(document, missingImages, options, signal) {
 		warnings
 	};
 }
-async function prepareAssetsForLoad(input, options, signal) {
+async function prepareAssetsForLoad(input, options, signal, isAllowedUrl) {
 	const document = cloneDocument(input);
 	const { resolveUrl } = options;
 	if (resolveUrl) await rewriteUrls(document, async (url) => resolveUrl(url));
+	require_content_limits.refuseUnsafeImageUrls(document.objects, isAllowedUrl);
 	const report = await inspectAssets(document, options, signal);
 	if (options.requireFonts && report.unavailableFonts.length > 0) {
 		const families = report.unavailableFonts.map((font) => font.family).join(", ");

package/dist/assets/asset-pipeline.js

@@ -2,6 +2,7 @@ import { findImageReferences } from "./asset-references.js";
 import { buildAssetManifest, isEmbeddedUrl } from "./asset-manifest.js";
 import { DocumentEngineError, isDocumentEngineError } from "../engine/errors.js";
 import { findUnavailableFonts } from "./font-check.js";
+import { refuseUnsafeImageUrls } from "../security/content-limits.js";
 import { findMissingImages, isCrossOriginUrl, isPortableUrl } from "./image-check.js";
 //#region src/assets/asset-pipeline.ts
 function cloneDocument(document) {
@@ -105,10 +106,11 @@ async function replaceMissingImages(document, missingImages, options, signal) {
 		warnings
 	};
 }
-async function prepareAssetsForLoad(input, options, signal) {
+async function prepareAssetsForLoad(input, options, signal, isAllowedUrl) {
 	const document = cloneDocument(input);
 	const { resolveUrl } = options;
 	if (resolveUrl) await rewriteUrls(document, async (url) => resolveUrl(url));
+	refuseUnsafeImageUrls(document.objects, isAllowedUrl);
 	const report = await inspectAssets(document, options, signal);
 	if (options.requireFonts && report.unavailableFonts.length > 0) {
 		const families = report.unavailableFonts.map((font) => font.family).join(", ");

package/dist/engine/create-document-engine.cjs

@@ -1,5 +1,6 @@
 const require_asset_manifest = require("../assets/asset-manifest.cjs");
 const require_errors = require("./errors.cjs");
+const require_content_limits = require("../security/content-limits.cjs");
 const require_image_check = require("../assets/image-check.cjs");
 const require_asset_pipeline = require("../assets/asset-pipeline.cjs");
 const require_export_area = require("../export/export-area.cjs");
@@ -72,6 +73,7 @@ function createDocumentEngine(options) {
 	const history = require_create_history.createHistory({
 		canvas,
 		limit: options.history?.limit,
+		maxBytes: options.history?.maxBytes,
 		serializeObjects: () => {
 			rebuildIndex();
 			return require_fabric_adapter.serializeCanvas(canvas, registry.propertiesToInclude()).objects;
@@ -171,13 +173,13 @@ function createDocumentEngine(options) {
 		try {
 			await recovery?.markLoadStarted(documentId);
 			if (controller.signal.aborted) throw new Error("aborted");
-			const { document: migrated, migratedFrom } = require_migrate_document.migrateDocument(input, {
+			const { document: migrated, migratedFrom } = require_migrate_document.migrateDocument(require_content_limits.secureDocument(input, options.limits), {
 				canvasWidth: canvas.getWidth(),
 				canvasHeight: canvas.getHeight(),
 				...importDetails
 			});
 			const checked = checkDocument(migrated);
-			const { document, warnings } = await require_asset_pipeline.prepareAssetsForLoad(checked, assetOptions, controller.signal);
+			const { document, warnings } = await require_asset_pipeline.prepareAssetsForLoad(checked, assetOptions, controller.signal, options.limits?.isAllowedUrl);
 			if (controller.signal.aborted) throw new Error("aborted");
 			await history.withoutRecording(() => require_fabric_adapter.loadIntoCanvas(canvas, {
 				version: document.fabricVersion,
@@ -412,10 +414,10 @@ function createDocumentEngine(options) {
 				const area = require_export_area.resolveExportArea(canvas, settings.area, settings.padding);
 				return {
 					area,
-					content: format === "svg" ? require_render_export.renderSvg(canvas, area, settings.scale) : require_render_export.renderRaster(canvas, area, format, settings.scale, settings.quality)
+					content: format === "svg" ? Promise.resolve(new Blob([require_render_export.renderSvg(canvas, area, settings.scale)], { type: require_render_export.mimeTypes.svg })) : require_render_export.renderRaster(canvas, area, format, settings.scale, settings.quality)
 				};
 			});
-			const blob = format === "svg" ? new Blob([rendered.content], { type: require_render_export.mimeTypes.svg }) : require_render_export.dataUrlToBlob(rendered.content);
+			const blob = await rendered.content;
 			return {
 				format,
 				mimeType: blob.type || require_render_export.mimeTypes[format],

package/dist/engine/create-document-engine.d.cts

@@ -6,6 +6,7 @@ import { ExportPreflight } from "../export/preflight-export.cjs";
 import { NewDocumentOptions } from "../document/create-document.cjs";
 import { CustomObjectDefinition } from "../fabric/object-registry.cjs";
 import { HistoryOptions, HistoryState } from "../history/create-history.cjs";
+import { ContentLimits } from "../security/content-limits.cjs";
 import { VersionOptions, VersionSummary } from "../versions/document-version.cjs";
 import { InterruptedLoad, RecoveryOptions, RecoveryRecord } from "../recovery/recovery-controller.cjs";
 import { AutosaveOptions } from "../save/autosave-scheduler.cjs";
@@ -27,6 +28,7 @@ export interface DocumentEngineOptions {
   assets?: AssetOptions;
   recovery?: RecoveryOptions;
   versions?: VersionOptions;
+  limits?: ContentLimits;
 }
 export interface LoadOptions {
   restoreCanvasSize?: boolean;

package/dist/engine/create-document-engine.d.ts

@@ -6,6 +6,7 @@ import { ExportPreflight } from "../export/preflight-export.js";
 import { NewDocumentOptions } from "../document/create-document.js";
 import { CustomObjectDefinition } from "../fabric/object-registry.js";
 import { HistoryOptions, HistoryState } from "../history/create-history.js";
+import { ContentLimits } from "../security/content-limits.js";
 import { VersionOptions, VersionSummary } from "../versions/document-version.js";
 import { InterruptedLoad, RecoveryOptions, RecoveryRecord } from "../recovery/recovery-controller.js";
 import { AutosaveOptions } from "../save/autosave-scheduler.js";
@@ -27,6 +28,7 @@ export interface DocumentEngineOptions {
   assets?: AssetOptions;
   recovery?: RecoveryOptions;
   versions?: VersionOptions;
+  limits?: ContentLimits;
 }
 export interface LoadOptions {
   restoreCanvasSize?: boolean;

package/dist/engine/create-document-engine.js

@@ -1,5 +1,6 @@
 import { buildAssetManifest } from "../assets/asset-manifest.js";
 import { DocumentEngineError, isDocumentEngineError } from "./errors.js";
+import { secureDocument } from "../security/content-limits.js";
 import { isSameUrl } from "../assets/image-check.js";
 import { inspectAssets, prepareAssetsForLoad, prepareAssetsForSave } from "../assets/asset-pipeline.js";
 import { resolveExportArea } from "../export/export-area.js";
@@ -7,7 +8,7 @@ import { normalizeExportOptions } from "../export/export-options.js";
 import { readObjectId, writeObjectId } from "../fabric/object-ids.js";
 import { collectSerializedTypes, walkObjects } from "../fabric/walk-objects.js";
 import { preflightExport } from "../export/preflight-export.js";
-import { dataUrlToBlob, mimeTypes, renderRaster, renderSvg, withExportView } from "../export/render-export.js";
+import { mimeTypes, renderRaster, renderSvg, withExportView } from "../export/render-export.js";
 import "../document/document-format.js";
 import { createId } from "../document/ids.js";
 import { createDocumentInfo } from "../document/create-document.js";
@@ -72,6 +73,7 @@ function createDocumentEngine(options) {
 	const history = createHistory({
 		canvas,
 		limit: options.history?.limit,
+		maxBytes: options.history?.maxBytes,
 		serializeObjects: () => {
 			rebuildIndex();
 			return serializeCanvas(canvas, registry.propertiesToInclude()).objects;
@@ -171,13 +173,13 @@ function createDocumentEngine(options) {
 		try {
 			await recovery?.markLoadStarted(documentId);
 			if (controller.signal.aborted) throw new Error("aborted");
-			const { document: migrated, migratedFrom } = migrateDocument(input, {
+			const { document: migrated, migratedFrom } = migrateDocument(secureDocument(input, options.limits), {
 				canvasWidth: canvas.getWidth(),
 				canvasHeight: canvas.getHeight(),
 				...importDetails
 			});
 			const checked = checkDocument(migrated);
-			const { document, warnings } = await prepareAssetsForLoad(checked, assetOptions, controller.signal);
+			const { document, warnings } = await prepareAssetsForLoad(checked, assetOptions, controller.signal, options.limits?.isAllowedUrl);
 			if (controller.signal.aborted) throw new Error("aborted");
 			await history.withoutRecording(() => loadIntoCanvas(canvas, {
 				version: document.fabricVersion,
@@ -412,10 +414,10 @@ function createDocumentEngine(options) {
 				const area = resolveExportArea(canvas, settings.area, settings.padding);
 				return {
 					area,
-					content: format === "svg" ? renderSvg(canvas, area, settings.scale) : renderRaster(canvas, area, format, settings.scale, settings.quality)
+					content: format === "svg" ? Promise.resolve(new Blob([renderSvg(canvas, area, settings.scale)], { type: mimeTypes.svg })) : renderRaster(canvas, area, format, settings.scale, settings.quality)
 				};
 			});
-			const blob = format === "svg" ? new Blob([rendered.content], { type: mimeTypes.svg }) : dataUrlToBlob(rendered.content);
+			const blob = await rendered.content;
 			return {
 				format,
 				mimeType: blob.type || mimeTypes[format],

package/dist/engine/errors.d.cts

@@ -1,7 +1,7 @@
 import { FontAsset, ImageAsset } from "../assets/asset-manifest.cjs";
 import { ExportProblem } from "../export/preflight-export.cjs";
 //#region src/engine/errors.d.ts
-export type DocumentErrorCode = "INVALID_DOCUMENT" | "UNSUPPORTED_SCHEMA" | "UNKNOWN_OBJECT_TYPE" | "INVALID_CUSTOM_OBJECT" | "LOAD_ABORTED" | "LOAD_FAILED" | "MISSING_ASSETS" | "MISSING_FONTS" | "ASSET_UPLOAD_FAILED" | "STORAGE_MISSING" | "SAVE_FAILED" | "SAVE_CONFLICT" | "SAVE_CANCELLED" | "DOCUMENT_NOT_FOUND" | "HISTORY_FAILED" | "RECOVERY_MISSING" | "RECOVERY_NOT_FOUND" | "RECOVERY_FAILED" | "MIGRATION_FAILED" | "VERSIONS_UNSUPPORTED" | "VERSION_NOT_FOUND" | "VERSION_FAILED" | "INVALID_EXPORT_OPTIONS" | "EXPORT_BLOCKED" | "EXPORT_FAILED" | "EXPORT_ABORTED" | "ENGINE_DESTROYED";
+export type DocumentErrorCode = "INVALID_DOCUMENT" | "UNSAFE_DOCUMENT" | "UNSUPPORTED_SCHEMA" | "UNKNOWN_OBJECT_TYPE" | "INVALID_CUSTOM_OBJECT" | "LOAD_ABORTED" | "LOAD_FAILED" | "MISSING_ASSETS" | "MISSING_FONTS" | "ASSET_UPLOAD_FAILED" | "STORAGE_MISSING" | "SAVE_FAILED" | "SAVE_CONFLICT" | "SAVE_CANCELLED" | "DOCUMENT_NOT_FOUND" | "HISTORY_FAILED" | "RECOVERY_MISSING" | "RECOVERY_NOT_FOUND" | "RECOVERY_FAILED" | "MIGRATION_FAILED" | "VERSIONS_UNSUPPORTED" | "VERSION_NOT_FOUND" | "VERSION_FAILED" | "INVALID_EXPORT_OPTIONS" | "EXPORT_BLOCKED" | "EXPORT_FAILED" | "EXPORT_ABORTED" | "ENGINE_DESTROYED";
 export interface DocumentIssue {
   code: DocumentErrorCode;
   path: string;

package/dist/engine/errors.d.ts

@@ -1,7 +1,7 @@
 import { FontAsset, ImageAsset } from "../assets/asset-manifest.js";
 import { ExportProblem } from "../export/preflight-export.js";
 //#region src/engine/errors.d.ts
-export type DocumentErrorCode = "INVALID_DOCUMENT" | "UNSUPPORTED_SCHEMA" | "UNKNOWN_OBJECT_TYPE" | "INVALID_CUSTOM_OBJECT" | "LOAD_ABORTED" | "LOAD_FAILED" | "MISSING_ASSETS" | "MISSING_FONTS" | "ASSET_UPLOAD_FAILED" | "STORAGE_MISSING" | "SAVE_FAILED" | "SAVE_CONFLICT" | "SAVE_CANCELLED" | "DOCUMENT_NOT_FOUND" | "HISTORY_FAILED" | "RECOVERY_MISSING" | "RECOVERY_NOT_FOUND" | "RECOVERY_FAILED" | "MIGRATION_FAILED" | "VERSIONS_UNSUPPORTED" | "VERSION_NOT_FOUND" | "VERSION_FAILED" | "INVALID_EXPORT_OPTIONS" | "EXPORT_BLOCKED" | "EXPORT_FAILED" | "EXPORT_ABORTED" | "ENGINE_DESTROYED";
+export type DocumentErrorCode = "INVALID_DOCUMENT" | "UNSAFE_DOCUMENT" | "UNSUPPORTED_SCHEMA" | "UNKNOWN_OBJECT_TYPE" | "INVALID_CUSTOM_OBJECT" | "LOAD_ABORTED" | "LOAD_FAILED" | "MISSING_ASSETS" | "MISSING_FONTS" | "ASSET_UPLOAD_FAILED" | "STORAGE_MISSING" | "SAVE_FAILED" | "SAVE_CONFLICT" | "SAVE_CANCELLED" | "DOCUMENT_NOT_FOUND" | "HISTORY_FAILED" | "RECOVERY_MISSING" | "RECOVERY_NOT_FOUND" | "RECOVERY_FAILED" | "MIGRATION_FAILED" | "VERSIONS_UNSUPPORTED" | "VERSION_NOT_FOUND" | "VERSION_FAILED" | "INVALID_EXPORT_OPTIONS" | "EXPORT_BLOCKED" | "EXPORT_FAILED" | "EXPORT_ABORTED" | "ENGINE_DESTROYED";
 export interface DocumentIssue {
   code: DocumentErrorCode;
   path: string;

package/dist/export/render-export.cjs

@@ -33,12 +33,9 @@ function withExportView(canvas, background, format, work) {
 	}
 }
 function renderRaster(canvas, area, format, scale, quality) {
-	return canvas.toDataURL({
-		...area,
-		format,
-		quality,
-		multiplier: scale,
-		enableRetinaScaling: false
+	const rendered = canvas.toCanvasElement(scale, area);
+	return new Promise((resolve, reject) => {
+		rendered.toBlob((blob) => blob ? resolve(blob) : reject(/* @__PURE__ */ new Error(`The browser could not encode ${format}`)), mimeTypes[format], quality);
 	});
 }
 function renderSvg(canvas, area, scale) {
@@ -53,16 +50,7 @@ function renderSvg(canvas, area, scale) {
 		height: String(area.height * scale)
 	});
 }
-function dataUrlToBlob(dataUrl) {
-	const [header, payload = ""] = dataUrl.split(",");
-	const mimeType = /data:([^;]+)/.exec(header ?? "")?.[1] ?? "application/octet-stream";
-	const binary = atob(payload);
-	const bytes = new Uint8Array(binary.length);
-	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
-	return new Blob([bytes], { type: mimeType });
-}
 //#endregion
-exports.dataUrlToBlob = dataUrlToBlob;
 exports.mimeTypes = mimeTypes;
 exports.renderRaster = renderRaster;
 exports.renderSvg = renderSvg;

package/dist/export/render-export.js

@@ -33,12 +33,9 @@ function withExportView(canvas, background, format, work) {
 	}
 }
 function renderRaster(canvas, area, format, scale, quality) {
-	return canvas.toDataURL({
-		...area,
-		format,
-		quality,
-		multiplier: scale,
-		enableRetinaScaling: false
+	const rendered = canvas.toCanvasElement(scale, area);
+	return new Promise((resolve, reject) => {
+		rendered.toBlob((blob) => blob ? resolve(blob) : reject(/* @__PURE__ */ new Error(`The browser could not encode ${format}`)), mimeTypes[format], quality);
 	});
 }
 function renderSvg(canvas, area, scale) {
@@ -53,13 +50,5 @@ function renderSvg(canvas, area, scale) {
 		height: String(area.height * scale)
 	});
 }
-function dataUrlToBlob(dataUrl) {
-	const [header, payload = ""] = dataUrl.split(",");
-	const mimeType = /data:([^;]+)/.exec(header ?? "")?.[1] ?? "application/octet-stream";
-	const binary = atob(payload);
-	const bytes = new Uint8Array(binary.length);
-	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
-	return new Blob([bytes], { type: mimeType });
-}
 //#endregion
-export { dataUrlToBlob, mimeTypes, renderRaster, renderSvg, withExportView };
+export { mimeTypes, renderRaster, renderSvg, withExportView };

package/dist/history/apply-state.cjs

@@ -34,10 +34,12 @@ async function applyStateChange(canvas, change) {
 	try {
 		const outgoing = current.filter((object) => !kept.has(object));
 		if (outgoing.length > 0) canvas.remove(...outgoing);
+		let onCanvas = canvas.getObjects();
 		arranged.forEach((object, index) => {
-			if (canvas.getObjects()[index] === object) return;
+			if (onCanvas[index] === object) return;
 			if (object.canvas === canvas) canvas.moveObjectTo(object, index);
 			else canvas.insertAt(index, object);
+			onCanvas = canvas.getObjects();
 		});
 	} finally {
 		canvas.renderOnAddRemove = renderOnAddRemove;

package/dist/history/apply-state.js

@@ -34,10 +34,12 @@ async function applyStateChange(canvas, change) {
 	try {
 		const outgoing = current.filter((object) => !kept.has(object));
 		if (outgoing.length > 0) canvas.remove(...outgoing);
+		let onCanvas = canvas.getObjects();
 		arranged.forEach((object, index) => {
-			if (canvas.getObjects()[index] === object) return;
+			if (onCanvas[index] === object) return;
 			if (object.canvas === canvas) canvas.moveObjectTo(object, index);
 			else canvas.insertAt(index, object);
+			onCanvas = canvas.getObjects();
 		});
 	} finally {
 		canvas.renderOnAddRemove = renderOnAddRemove;

package/dist/history/create-history.cjs

@@ -25,7 +25,10 @@ function describePendingChanges(changes) {
 }
 function createHistory(options) {
 	const { canvas, serializeObjects, onChange, onContentChange } = options;
-	const stack = require_history_stack.createHistoryStack(Math.max(1, options.limit ?? 100));
+	const stack = require_history_stack.createHistoryStack({
+		steps: Math.max(1, options.limit ?? 100),
+		bytes: Math.max(0, options.maxBytes ?? 67108864)
+	});
 	let snapshot = require_snapshot.createSnapshot(serializeObjects());
 	let pendingChanges = [];
 	let flushScheduled = false;

package/dist/history/create-history.d.cts

@@ -2,6 +2,7 @@ import { StaticCanvas } from "fabric";
 //#region src/history/create-history.d.ts
 export interface HistoryOptions {
   limit?: number;
+  maxBytes?: number;
 }
 export interface HistoryState {
   canUndo: boolean;

package/dist/history/create-history.d.ts

@@ -2,6 +2,7 @@ import { StaticCanvas } from "fabric";
 //#region src/history/create-history.d.ts
 export interface HistoryOptions {
   limit?: number;
+  maxBytes?: number;
 }
 export interface HistoryState {
   canUndo: boolean;

package/dist/history/create-history.js

@@ -25,7 +25,10 @@ function describePendingChanges(changes) {
 }
 function createHistory(options) {
 	const { canvas, serializeObjects, onChange, onContentChange } = options;
-	const stack = createHistoryStack(Math.max(1, options.limit ?? 100));
+	const stack = createHistoryStack({
+		steps: Math.max(1, options.limit ?? 100),
+		bytes: Math.max(0, options.maxBytes ?? 67108864)
+	});
 	let snapshot = createSnapshot(serializeObjects());
 	let pendingChanges = [];
 	let flushScheduled = false;

package/dist/history/history-stack.cjs

@@ -1,27 +1,63 @@
 //#region src/history/history-stack.ts
-function createHistoryStack(limit) {
+function bytesOfChange(change) {
+	let bytes = (change.order?.length ?? 0) * 8;
+	for (const [id, json] of change.objects) bytes += (id.length + (json?.length ?? 0)) * 2;
+	return bytes;
+}
+function estimateStepBytes(step) {
+	return bytesOfChange(step.before) + bytesOfChange(step.after) + step.label.length * 2;
+}
+function createHistoryStack(limits) {
 	const undoSteps = [];
 	const redoSteps = [];
-	function pushWithinLimit(steps, step) {
+	const sizes = /* @__PURE__ */ new WeakMap();
+	let totalBytes = 0;
+	function sizeOf(step) {
+		let size = sizes.get(step);
+		if (size === void 0) {
+			size = estimateStepBytes(step);
+			sizes.set(step, size);
+		}
+		return size;
+	}
+	function forget(step) {
+		if (step) totalBytes -= sizeOf(step);
+	}
+	function stayWithinLimits() {
+		while (undoSteps.length > limits.steps) forget(undoSteps.shift());
+		while (redoSteps.length > limits.steps) forget(redoSteps.shift());
+		while (totalBytes > limits.bytes && undoSteps.length + redoSteps.length > 1) forget(undoSteps.length > 0 ? undoSteps.shift() : redoSteps.shift());
+	}
+	function add(steps, step) {
 		steps.push(step);
-		if (steps.length > limit) steps.shift();
+		totalBytes += sizeOf(step);
+		stayWithinLimits();
+	}
+	function take(steps) {
+		const step = steps.pop();
+		forget(step);
+		return step;
 	}
 	return {
 		record(step) {
-			pushWithinLimit(undoSteps, step);
+			redoSteps.forEach(forget);
 			redoSteps.length = 0;
+			add(undoSteps, step);
 		},
-		takeUndo: () => undoSteps.pop(),
-		takeRedo: () => redoSteps.pop(),
-		returnUndo: (step) => pushWithinLimit(undoSteps, step),
-		returnRedo: (step) => pushWithinLimit(redoSteps, step),
+		takeUndo: () => take(undoSteps),
+		takeRedo: () => take(redoSteps),
+		returnUndo: (step) => add(undoSteps, step),
+		returnRedo: (step) => add(redoSteps, step),
 		undoLabels: () => undoSteps.map((step) => step.label).reverse(),
 		redoLabels: () => redoSteps.map((step) => step.label).reverse(),
+		usedBytes: () => totalBytes,
 		clear() {
 			undoSteps.length = 0;
 			redoSteps.length = 0;
+			totalBytes = 0;
 		}
 	};
 }
 //#endregion
 exports.createHistoryStack = createHistoryStack;
+exports.estimateStepBytes = estimateStepBytes;

package/dist/history/history-stack.js

@@ -1,27 +1,62 @@
 //#region src/history/history-stack.ts
-function createHistoryStack(limit) {
+function bytesOfChange(change) {
+	let bytes = (change.order?.length ?? 0) * 8;
+	for (const [id, json] of change.objects) bytes += (id.length + (json?.length ?? 0)) * 2;
+	return bytes;
+}
+function estimateStepBytes(step) {
+	return bytesOfChange(step.before) + bytesOfChange(step.after) + step.label.length * 2;
+}
+function createHistoryStack(limits) {
 	const undoSteps = [];
 	const redoSteps = [];
-	function pushWithinLimit(steps, step) {
+	const sizes = /* @__PURE__ */ new WeakMap();
+	let totalBytes = 0;
+	function sizeOf(step) {
+		let size = sizes.get(step);
+		if (size === void 0) {
+			size = estimateStepBytes(step);
+			sizes.set(step, size);
+		}
+		return size;
+	}
+	function forget(step) {
+		if (step) totalBytes -= sizeOf(step);
+	}
+	function stayWithinLimits() {
+		while (undoSteps.length > limits.steps) forget(undoSteps.shift());
+		while (redoSteps.length > limits.steps) forget(redoSteps.shift());
+		while (totalBytes > limits.bytes && undoSteps.length + redoSteps.length > 1) forget(undoSteps.length > 0 ? undoSteps.shift() : redoSteps.shift());
+	}
+	function add(steps, step) {
 		steps.push(step);
-		if (steps.length > limit) steps.shift();
+		totalBytes += sizeOf(step);
+		stayWithinLimits();
+	}
+	function take(steps) {
+		const step = steps.pop();
+		forget(step);
+		return step;
 	}
 	return {
 		record(step) {
-			pushWithinLimit(undoSteps, step);
+			redoSteps.forEach(forget);
 			redoSteps.length = 0;
+			add(undoSteps, step);
 		},
-		takeUndo: () => undoSteps.pop(),
-		takeRedo: () => redoSteps.pop(),
-		returnUndo: (step) => pushWithinLimit(undoSteps, step),
-		returnRedo: (step) => pushWithinLimit(redoSteps, step),
+		takeUndo: () => take(undoSteps),
+		takeRedo: () => take(redoSteps),
+		returnUndo: (step) => add(undoSteps, step),
+		returnRedo: (step) => add(redoSteps, step),
 		undoLabels: () => undoSteps.map((step) => step.label).reverse(),
 		redoLabels: () => redoSteps.map((step) => step.label).reverse(),
+		usedBytes: () => totalBytes,
 		clear() {
 			undoSteps.length = 0;
 			redoSteps.length = 0;
+			totalBytes = 0;
 		}
 	};
 }
 //#endregion
-export { createHistoryStack };
+export { createHistoryStack, estimateStepBytes };

package/dist/index.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_errors = require("./engine/errors.cjs");
+const require_content_limits = require("./security/content-limits.cjs");
 const require_document_format = require("./document/document-format.cjs");
 const require_validate_document = require("./document/validate-document.cjs");
 const require_migrate_document = require("./migrations/migrate-document.cjs");
@@ -18,5 +19,8 @@ exports.createDocumentStateStore = require_document_state_store.createDocumentSt
 exports.detectSchemaVersion = require_migrate_document.detectSchemaVersion;
 exports.downloadExport = require_download_export.downloadExport;
 exports.isDocumentEngineError = require_errors.isDocumentEngineError;
+exports.isSafeImageUrl = require_content_limits.isSafeImageUrl;
 exports.migrateDocument = require_migrate_document.migrateDocument;
+exports.refuseUnsafeImageUrls = require_content_limits.refuseUnsafeImageUrls;
+exports.secureDocument = require_content_limits.secureDocument;
 exports.validateDocument = require_validate_document.validateDocument;

package/dist/index.d.cts

@@ -7,6 +7,7 @@ import { ExportPreflight, ExportProblem, ExportProblemCode } from "./export/pref
 import { NewDocumentOptions } from "./document/create-document.cjs";
 import { CustomObjectDefinition } from "./fabric/object-registry.cjs";
 import { HistoryOptions, HistoryState } from "./history/create-history.cjs";
+import { ContentLimits, isSafeImageUrl, refuseUnsafeImageUrls, secureDocument } from "./security/content-limits.cjs";
 import { DocumentVersion, VersionKind, VersionOptions, VersionStorage, VersionSummary } from "./versions/document-version.cjs";
 import { RecoveryStore } from "./recovery/recovery-store.cjs";
 import { InterruptedLoad, RecoveryOptions, RecoveryRecord } from "./recovery/recovery-controller.cjs";
@@ -23,4 +24,4 @@ import { UnsavedChangesSource, bindUnsavedChangesWarning } from "./save/unsaved-
 import { DownloadableExport, downloadExport } from "./export/download-export.cjs";
 import { Migration, MigrationContext, MigrationResult, detectSchemaVersion, migrateDocument } from "./migrations/migrate-document.cjs";
 import { DocumentState, DocumentStateStore, createDocumentStateStore } from "./state/document-state-store.cjs";
-export { type AssetManifest, type AssetOptions, type AssetReport, type AssetWarning, type AssetWarningCode, type AutosaveOptions, CURRENT_SCHEMA_VERSION, type CustomObjectDefinition, type DocumentCanvas, type DocumentEngine, DocumentEngineError, type DocumentEngineErrorDetails, type DocumentEngineEvents, type DocumentEngineOptions, type DocumentErrorCode, type DocumentInfo, type DocumentIssue, type DocumentState, type DocumentStateStore, type DocumentStorage, type DocumentVersion, type DownloadableExport, type ExportArea, type ExportBackground, type ExportFormat, type ExportOptions, type ExportPreflight, type ExportProblem, type ExportProblemCode, type ExportRect, type ExportResult, type FabricDocument, type FontAsset, type FontLoader, type HistoryOptions, type HistoryState, type ImageAsset, type ImportOptions, type InterruptedLoad, type KeyboardShortcutOptions, type LoadOptions, type Migration, type MigrationContext, type MigrationResult, type NewDocumentOptions, type RecoveryOptions, type RecoveryRecord, type RecoveryStore, type RetryOptions, type SaveContext, type SaveOptions, type SaveResult, type SaveRetryEvent, type SaveState, type SaveStatus, type SerializedFabricObject, type UndoRedoTarget, type UnsavedChangesSource, type Unsubscribe, type UploadRequest, type VersionKind, type VersionOptions, type VersionStorage, type VersionSummary, bindKeyboardShortcuts, bindUnsavedChangesWarning, createConflictError, createDocumentEngine, createDocumentStateStore, detectSchemaVersion, downloadExport, isDocumentEngineError, migrateDocument, validateDocument };
+export { type AssetManifest, type AssetOptions, type AssetReport, type AssetWarning, type AssetWarningCode, type AutosaveOptions, CURRENT_SCHEMA_VERSION, type ContentLimits, type CustomObjectDefinition, type DocumentCanvas, type DocumentEngine, DocumentEngineError, type DocumentEngineErrorDetails, type DocumentEngineEvents, type DocumentEngineOptions, type DocumentErrorCode, type DocumentInfo, type DocumentIssue, type DocumentState, type DocumentStateStore, type DocumentStorage, type DocumentVersion, type DownloadableExport, type ExportArea, type ExportBackground, type ExportFormat, type ExportOptions, type ExportPreflight, type ExportProblem, type ExportProblemCode, type ExportRect, type ExportResult, type FabricDocument, type FontAsset, type FontLoader, type HistoryOptions, type HistoryState, type ImageAsset, type ImportOptions, type InterruptedLoad, type KeyboardShortcutOptions, type LoadOptions, type Migration, type MigrationContext, type MigrationResult, type NewDocumentOptions, type RecoveryOptions, type RecoveryRecord, type RecoveryStore, type RetryOptions, type SaveContext, type SaveOptions, type SaveResult, type SaveRetryEvent, type SaveState, type SaveStatus, type SerializedFabricObject, type UndoRedoTarget, type UnsavedChangesSource, type Unsubscribe, type UploadRequest, type VersionKind, type VersionOptions, type VersionStorage, type VersionSummary, bindKeyboardShortcuts, bindUnsavedChangesWarning, createConflictError, createDocumentEngine, createDocumentStateStore, detectSchemaVersion, downloadExport, isDocumentEngineError, isSafeImageUrl, migrateDocument, refuseUnsafeImageUrls, secureDocument, validateDocument };

package/dist/index.d.ts

@@ -7,6 +7,7 @@ import { ExportPreflight, ExportProblem, ExportProblemCode } from "./export/pref
 import { NewDocumentOptions } from "./document/create-document.js";
 import { CustomObjectDefinition } from "./fabric/object-registry.js";
 import { HistoryOptions, HistoryState } from "./history/create-history.js";
+import { ContentLimits, isSafeImageUrl, refuseUnsafeImageUrls, secureDocument } from "./security/content-limits.js";
 import { DocumentVersion, VersionKind, VersionOptions, VersionStorage, VersionSummary } from "./versions/document-version.js";
 import { RecoveryStore } from "./recovery/recovery-store.js";
 import { InterruptedLoad, RecoveryOptions, RecoveryRecord } from "./recovery/recovery-controller.js";
@@ -23,4 +24,4 @@ import { UnsavedChangesSource, bindUnsavedChangesWarning } from "./save/unsaved-
 import { DownloadableExport, downloadExport } from "./export/download-export.js";
 import { Migration, MigrationContext, MigrationResult, detectSchemaVersion, migrateDocument } from "./migrations/migrate-document.js";
 import { DocumentState, DocumentStateStore, createDocumentStateStore } from "./state/document-state-store.js";
-export { type AssetManifest, type AssetOptions, type AssetReport, type AssetWarning, type AssetWarningCode, type AutosaveOptions, CURRENT_SCHEMA_VERSION, type CustomObjectDefinition, type DocumentCanvas, type DocumentEngine, DocumentEngineError, type DocumentEngineErrorDetails, type DocumentEngineEvents, type DocumentEngineOptions, type DocumentErrorCode, type DocumentInfo, type DocumentIssue, type DocumentState, type DocumentStateStore, type DocumentStorage, type DocumentVersion, type DownloadableExport, type ExportArea, type ExportBackground, type ExportFormat, type ExportOptions, type ExportPreflight, type ExportProblem, type ExportProblemCode, type ExportRect, type ExportResult, type FabricDocument, type FontAsset, type FontLoader, type HistoryOptions, type HistoryState, type ImageAsset, type ImportOptions, type InterruptedLoad, type KeyboardShortcutOptions, type LoadOptions, type Migration, type MigrationContext, type MigrationResult, type NewDocumentOptions, type RecoveryOptions, type RecoveryRecord, type RecoveryStore, type RetryOptions, type SaveContext, type SaveOptions, type SaveResult, type SaveRetryEvent, type SaveState, type SaveStatus, type SerializedFabricObject, type UndoRedoTarget, type UnsavedChangesSource, type Unsubscribe, type UploadRequest, type VersionKind, type VersionOptions, type VersionStorage, type VersionSummary, bindKeyboardShortcuts, bindUnsavedChangesWarning, createConflictError, createDocumentEngine, createDocumentStateStore, detectSchemaVersion, downloadExport, isDocumentEngineError, migrateDocument, validateDocument };
+export { type AssetManifest, type AssetOptions, type AssetReport, type AssetWarning, type AssetWarningCode, type AutosaveOptions, CURRENT_SCHEMA_VERSION, type ContentLimits, type CustomObjectDefinition, type DocumentCanvas, type DocumentEngine, DocumentEngineError, type DocumentEngineErrorDetails, type DocumentEngineEvents, type DocumentEngineOptions, type DocumentErrorCode, type DocumentInfo, type DocumentIssue, type DocumentState, type DocumentStateStore, type DocumentStorage, type DocumentVersion, type DownloadableExport, type ExportArea, type ExportBackground, type ExportFormat, type ExportOptions, type ExportPreflight, type ExportProblem, type ExportProblemCode, type ExportRect, type ExportResult, type FabricDocument, type FontAsset, type FontLoader, type HistoryOptions, type HistoryState, type ImageAsset, type ImportOptions, type InterruptedLoad, type KeyboardShortcutOptions, type LoadOptions, type Migration, type MigrationContext, type MigrationResult, type NewDocumentOptions, type RecoveryOptions, type RecoveryRecord, type RecoveryStore, type RetryOptions, type SaveContext, type SaveOptions, type SaveResult, type SaveRetryEvent, type SaveState, type SaveStatus, type SerializedFabricObject, type UndoRedoTarget, type UnsavedChangesSource, type Unsubscribe, type UploadRequest, type VersionKind, type VersionOptions, type VersionStorage, type VersionSummary, bindKeyboardShortcuts, bindUnsavedChangesWarning, createConflictError, createDocumentEngine, createDocumentStateStore, detectSchemaVersion, downloadExport, isDocumentEngineError, isSafeImageUrl, migrateDocument, refuseUnsafeImageUrls, secureDocument, validateDocument };

package/dist/index.js

@@ -1,4 +1,5 @@
 import { DocumentEngineError, createConflictError, isDocumentEngineError } from "./engine/errors.js";
+import { isSafeImageUrl, refuseUnsafeImageUrls, secureDocument } from "./security/content-limits.js";
 import { CURRENT_SCHEMA_VERSION } from "./document/document-format.js";
 import { validateDocument } from "./document/validate-document.js";
 import { detectSchemaVersion, migrateDocument } from "./migrations/migrate-document.js";
@@ -7,4 +8,4 @@ import { bindKeyboardShortcuts } from "./history/keyboard-shortcuts.js";
 import { bindUnsavedChangesWarning } from "./save/unsaved-changes-warning.js";
 import { downloadExport } from "./export/download-export.js";
 import { createDocumentStateStore } from "./state/document-state-store.js";
-export { CURRENT_SCHEMA_VERSION, DocumentEngineError, bindKeyboardShortcuts, bindUnsavedChangesWarning, createConflictError, createDocumentEngine, createDocumentStateStore, detectSchemaVersion, downloadExport, isDocumentEngineError, migrateDocument, validateDocument };
+export { CURRENT_SCHEMA_VERSION, DocumentEngineError, bindKeyboardShortcuts, bindUnsavedChangesWarning, createConflictError, createDocumentEngine, createDocumentStateStore, detectSchemaVersion, downloadExport, isDocumentEngineError, isSafeImageUrl, migrateDocument, refuseUnsafeImageUrls, secureDocument, validateDocument };

package/dist/recovery/recovery-controller.cjs

@@ -1,5 +1,25 @@
 const require_asset_pipeline = require("../assets/asset-pipeline.cjs");
 //#region src/recovery/recovery-controller.ts
+async function toStoredFiles(files) {
+	const entries = await Promise.all(Object.entries(files).map(async ([url, blob]) => [url, {
+		type: blob.type,
+		bytes: await blob.arrayBuffer()
+	}]));
+	return Object.fromEntries(entries);
+}
+function fromStoredFiles(files) {
+	const restored = {};
+	for (const [url, file] of Object.entries(files ?? {})) restored[url] = file instanceof Blob ? file : new Blob([file.bytes], { type: file.type });
+	return restored;
+}
+function fromStoredRecord(value) {
+	if (!isRecoveryRecord(value)) return void 0;
+	const stored = value;
+	return {
+		...stored,
+		files: fromStoredFiles(stored.files)
+	};
+}
 const documentKeyPrefix = "document:";
 const unloadKeyPrefix = "unload:";
 const loadingKey = "loading";
@@ -79,7 +99,10 @@ function createRecoveryController(options) {
 		if (!options.shouldWrite()) return;
 		const document = options.createDocument();
 		const record = createRecord(document, await captureTabOnlyFiles(document));
-		await store.set(documentKey(document.id), record);
+		await store.set(documentKey(document.id), {
+			...record,
+			files: await toStoredFiles(record.files)
+		});
 		options.onCheckpoint(record);
 	}
 	function writeCheckpointBeforeThePageCloses() {
@@ -91,12 +114,15 @@ function createRecoveryController(options) {
 			return;
 		}
 		const record = createRecord(document, Object.fromEntries(readyFiles));
-		store.set(documentKey(document.id), record).then(() => options.onCheckpoint(record), options.onError);
+		toStoredFiles(record.files).then((files) => store.set(documentKey(document.id), {
+			...record,
+			files
+		})).then(() => options.onCheckpoint(record), options.onError);
 	}
 	async function read(documentId) {
 		await queue;
 		const [checkpoint, unloadCopy] = await Promise.all([store.get(documentKey(documentId)), store.get(unloadKey(documentId))]);
-		return newerRecord(isRecoveryRecord(checkpoint) ? checkpoint : void 0, isRecoveryRecord(unloadCopy) ? unloadCopy : void 0);
+		return newerRecord(fromStoredRecord(checkpoint), fromStoredRecord(unloadCopy));
 	}
 	function cancel() {
 		if (timer !== void 0) clearTimeout(timer);

package/dist/recovery/recovery-controller.js

@@ -1,5 +1,25 @@
 import { rewriteUrls } from "../assets/asset-pipeline.js";
 //#region src/recovery/recovery-controller.ts
+async function toStoredFiles(files) {
+	const entries = await Promise.all(Object.entries(files).map(async ([url, blob]) => [url, {
+		type: blob.type,
+		bytes: await blob.arrayBuffer()
+	}]));
+	return Object.fromEntries(entries);
+}
+function fromStoredFiles(files) {
+	const restored = {};
+	for (const [url, file] of Object.entries(files ?? {})) restored[url] = file instanceof Blob ? file : new Blob([file.bytes], { type: file.type });
+	return restored;
+}
+function fromStoredRecord(value) {
+	if (!isRecoveryRecord(value)) return void 0;
+	const stored = value;
+	return {
+		...stored,
+		files: fromStoredFiles(stored.files)
+	};
+}
 const documentKeyPrefix = "document:";
 const unloadKeyPrefix = "unload:";
 const loadingKey = "loading";
@@ -79,7 +99,10 @@ function createRecoveryController(options) {
 		if (!options.shouldWrite()) return;
 		const document = options.createDocument();
 		const record = createRecord(document, await captureTabOnlyFiles(document));
-		await store.set(documentKey(document.id), record);
+		await store.set(documentKey(document.id), {
+			...record,
+			files: await toStoredFiles(record.files)
+		});
 		options.onCheckpoint(record);
 	}
 	function writeCheckpointBeforeThePageCloses() {
@@ -91,12 +114,15 @@ function createRecoveryController(options) {
 			return;
 		}
 		const record = createRecord(document, Object.fromEntries(readyFiles));
-		store.set(documentKey(document.id), record).then(() => options.onCheckpoint(record), options.onError);
+		toStoredFiles(record.files).then((files) => store.set(documentKey(document.id), {
+			...record,
+			files
+		})).then(() => options.onCheckpoint(record), options.onError);
 	}
 	async function read(documentId) {
 		await queue;
 		const [checkpoint, unloadCopy] = await Promise.all([store.get(documentKey(documentId)), store.get(unloadKey(documentId))]);
-		return newerRecord(isRecoveryRecord(checkpoint) ? checkpoint : void 0, isRecoveryRecord(unloadCopy) ? unloadCopy : void 0);
+		return newerRecord(fromStoredRecord(checkpoint), fromStoredRecord(unloadCopy));
 	}
 	function cancel() {
 		if (timer !== void 0) clearTimeout(timer);

package/dist/security/content-limits.cjs

@@ -0,0 +1,86 @@
+const require_asset_references = require("../assets/asset-references.cjs");
+const require_errors = require("../engine/errors.cjs");
+//#region src/security/content-limits.ts
+const dangerousKeys = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isSafeImageUrl(url) {
+	const trimmed = url.trim().toLowerCase();
+	const scheme = /^([a-z][a-z0-9+.-]*):/.exec(trimmed)?.[1];
+	if (scheme === void 0) return true;
+	if (scheme === "http" || scheme === "https" || scheme === "blob") return true;
+	if (scheme === "data") return trimmed.startsWith("data:image/");
+	return false;
+}
+function withoutDangerousKeys(value) {
+	return JSON.parse(JSON.stringify(value), (key, nested) => dangerousKeys.has(key) ? void 0 : nested);
+}
+function deepestNesting(value) {
+	let deepest = 0;
+	const pending = [{
+		value,
+		depth: 1
+	}];
+	while (pending.length > 0) {
+		const { value: current, depth } = pending.pop();
+		if (typeof current !== "object" || current === null) continue;
+		deepest = Math.max(deepest, depth);
+		for (const child of Object.values(current)) pending.push({
+			value: child,
+			depth: depth + 1
+		});
+	}
+	return deepest;
+}
+function countObjects(objects) {
+	let count = 0;
+	const pending = [...objects];
+	while (pending.length > 0) {
+		const object = pending.pop();
+		count += 1;
+		if (Array.isArray(object.objects)) pending.push(...object.objects);
+		if (object.clipPath && typeof object.clipPath === "object") pending.push(object.clipPath);
+	}
+	return count;
+}
+function unsafe(path, message) {
+	return {
+		code: "UNSAFE_DOCUMENT",
+		path,
+		message
+	};
+}
+function secureDocument(input, limits = {}) {
+	if (typeof input !== "object" || input === null) return input;
+	const maxDepth = limits.maxDepth ?? 100;
+	const maxObjects = limits.maxObjects ?? 5e4;
+	const document = withoutDangerousKeys(input);
+	const issues = [];
+	const depth = deepestNesting(document);
+	if (depth > maxDepth) issues.push(unsafe("", `the document is nested ${depth} levels deep, the limit is ${maxDepth}`));
+	if (Array.isArray(document.objects) && issues.length === 0) {
+		const count = countObjects(document.objects.filter((object) => typeof object === "object" && object !== null));
+		if (count > maxObjects) issues.push(unsafe("objects", `the document has ${count} objects, the limit is ${maxObjects}`));
+	}
+	refuseWhenUnsafe(issues);
+	return document;
+}
+function refuseWhenUnsafe(issues) {
+	if (issues.length === 0) return;
+	throw new require_errors.DocumentEngineError("UNSAFE_DOCUMENT", `The document was refused: ${issues.map((issue) => issue.message).join("; ")}`, { issues });
+}
+function refuseUnsafeImageUrls(objects, isAllowedUrl = isSafeImageUrl) {
+	const issues = [];
+	for (const reference of require_asset_references.findImageReferences(objects)) {
+		if (isAllowedUrl(reference.url)) continue;
+		const where = reference.objectId ? `object ${reference.objectId}` : "an object";
+		issues.push(unsafe("objects", `${where} uses the image address "${reference.url.slice(0, 60)}", which is not allowed`));
+	}
+	refuseWhenUnsafe(issues);
+}
+//#endregion
+exports.isSafeImageUrl = isSafeImageUrl;
+exports.refuseUnsafeImageUrls = refuseUnsafeImageUrls;
+exports.secureDocument = secureDocument;

package/dist/security/content-limits.d.cts

@@ -0,0 +1,11 @@
+import { SerializedFabricObject } from "../document/document-format.cjs";
+//#region src/security/content-limits.d.ts
+export interface ContentLimits {
+  maxObjects?: number;
+  maxDepth?: number;
+  isAllowedUrl?: (url: string) => boolean;
+}
+export declare function isSafeImageUrl(url: string): boolean;
+export declare function secureDocument(input: unknown, limits?: ContentLimits): unknown;
+export declare function refuseUnsafeImageUrls(objects: readonly SerializedFabricObject[], isAllowedUrl?: (url: string) => boolean): void;
+//#endregion

package/dist/security/content-limits.d.ts

@@ -0,0 +1,11 @@
+import { SerializedFabricObject } from "../document/document-format.js";
+//#region src/security/content-limits.d.ts
+export interface ContentLimits {
+  maxObjects?: number;
+  maxDepth?: number;
+  isAllowedUrl?: (url: string) => boolean;
+}
+export declare function isSafeImageUrl(url: string): boolean;
+export declare function secureDocument(input: unknown, limits?: ContentLimits): unknown;
+export declare function refuseUnsafeImageUrls(objects: readonly SerializedFabricObject[], isAllowedUrl?: (url: string) => boolean): void;
+//#endregion

package/dist/security/content-limits.js

@@ -0,0 +1,84 @@
+import { findImageReferences } from "../assets/asset-references.js";
+import { DocumentEngineError } from "../engine/errors.js";
+//#region src/security/content-limits.ts
+const dangerousKeys = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isSafeImageUrl(url) {
+	const trimmed = url.trim().toLowerCase();
+	const scheme = /^([a-z][a-z0-9+.-]*):/.exec(trimmed)?.[1];
+	if (scheme === void 0) return true;
+	if (scheme === "http" || scheme === "https" || scheme === "blob") return true;
+	if (scheme === "data") return trimmed.startsWith("data:image/");
+	return false;
+}
+function withoutDangerousKeys(value) {
+	return JSON.parse(JSON.stringify(value), (key, nested) => dangerousKeys.has(key) ? void 0 : nested);
+}
+function deepestNesting(value) {
+	let deepest = 0;
+	const pending = [{
+		value,
+		depth: 1
+	}];
+	while (pending.length > 0) {
+		const { value: current, depth } = pending.pop();
+		if (typeof current !== "object" || current === null) continue;
+		deepest = Math.max(deepest, depth);
+		for (const child of Object.values(current)) pending.push({
+			value: child,
+			depth: depth + 1
+		});
+	}
+	return deepest;
+}
+function countObjects(objects) {
+	let count = 0;
+	const pending = [...objects];
+	while (pending.length > 0) {
+		const object = pending.pop();
+		count += 1;
+		if (Array.isArray(object.objects)) pending.push(...object.objects);
+		if (object.clipPath && typeof object.clipPath === "object") pending.push(object.clipPath);
+	}
+	return count;
+}
+function unsafe(path, message) {
+	return {
+		code: "UNSAFE_DOCUMENT",
+		path,
+		message
+	};
+}
+function secureDocument(input, limits = {}) {
+	if (typeof input !== "object" || input === null) return input;
+	const maxDepth = limits.maxDepth ?? 100;
+	const maxObjects = limits.maxObjects ?? 5e4;
+	const document = withoutDangerousKeys(input);
+	const issues = [];
+	const depth = deepestNesting(document);
+	if (depth > maxDepth) issues.push(unsafe("", `the document is nested ${depth} levels deep, the limit is ${maxDepth}`));
+	if (Array.isArray(document.objects) && issues.length === 0) {
+		const count = countObjects(document.objects.filter((object) => typeof object === "object" && object !== null));
+		if (count > maxObjects) issues.push(unsafe("objects", `the document has ${count} objects, the limit is ${maxObjects}`));
+	}
+	refuseWhenUnsafe(issues);
+	return document;
+}
+function refuseWhenUnsafe(issues) {
+	if (issues.length === 0) return;
+	throw new DocumentEngineError("UNSAFE_DOCUMENT", `The document was refused: ${issues.map((issue) => issue.message).join("; ")}`, { issues });
+}
+function refuseUnsafeImageUrls(objects, isAllowedUrl = isSafeImageUrl) {
+	const issues = [];
+	for (const reference of findImageReferences(objects)) {
+		if (isAllowedUrl(reference.url)) continue;
+		const where = reference.objectId ? `object ${reference.objectId}` : "an object";
+		issues.push(unsafe("objects", `${where} uses the image address "${reference.url.slice(0, 60)}", which is not allowed`));
+	}
+	refuseWhenUnsafe(issues);
+}
+//#endregion
+export { isSafeImageUrl, refuseUnsafeImageUrls, secureDocument };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fabricjs-document-engine",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Turn an existing Fabric.js canvas into a dependable editable document: stable object ids, versioned save and load, undo and redo, safe autosave with conflict protection, custom objects and clear errors.",
   "keywords": [
     "fabric",
@@ -84,7 +84,7 @@
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.tools.json",
     "test": "vitest run",
     "test:unit": "vitest run --project unit",
-    "test:browser": "vitest run --project browser-fabric7 --project browser-fabric6",
+    "test:browser": "vitest run --project browser-fabric7 --project browser-fabric6 --project browser-firefox --project browser-webkit",
     "test:watch": "vitest",
     "lint:publint": "publint --strict",
     "lint:attw": "attw --pack . --profile node16",