fabricjs-document-engine 1.0.2 → 1.2.0

package/dist/recovery/recovery-controller.cjs

@@ -1,4 +1,5 @@
 const require_asset_pipeline = require("../assets/asset-pipeline.cjs");
+const require_ids = require("../document/ids.cjs");
 //#region src/recovery/recovery-controller.ts
 async function toStoredFiles(files) {
 	const entries = await Promise.all(Object.entries(files).map(async ([url, blob]) => [url, {
@@ -12,22 +13,55 @@ function fromStoredFiles(files) {
 	for (const [url, file] of Object.entries(files ?? {})) restored[url] = file instanceof Blob ? file : new Blob([file.bytes], { type: file.type });
 	return restored;
 }
-function fromStoredRecord(value) {
+function fromStoredRecord(value, sessionId, active) {
 	if (!isRecoveryRecord(value)) return void 0;
 	const stored = value;
 	return {
 		...stored,
+		sessionId,
+		active,
 		files: fromStoredFiles(stored.files)
 	};
 }
-const documentKeyPrefix = "document:";
-const unloadKeyPrefix = "unload:";
-const loadingKey = "loading";
-function documentKey(documentId) {
-	return `${documentKeyPrefix}${documentId}`;
+const LEGACY_SESSION = "legacy";
+const checkpointPrefix = "checkpoint:";
+const closingPrefix = "closing:";
+const loadingPrefix = "loading:";
+const legacyDocumentPrefix = "document:";
+const legacyUnloadPrefix = "unload:";
+const legacyLoadingKey = "loading";
+function branchKeys({ sessionId, documentId }) {
+	if (sessionId === LEGACY_SESSION) return {
+		checkpoint: `${legacyDocumentPrefix}${documentId}`,
+		closing: `${legacyUnloadPrefix}${documentId}`
+	};
+	const document = encodeURIComponent(documentId);
+	return {
+		checkpoint: `${checkpointPrefix}${sessionId}:${document}`,
+		closing: `${closingPrefix}${sessionId}:${document}`
+	};
+}
+/** The branch a key belongs to, or undefined for keys that are not copies. */
+function parseBranch(key) {
+	for (const prefix of [checkpointPrefix, closingPrefix]) {
+		if (!key.startsWith(prefix)) continue;
+		const rest = key.slice(prefix.length);
+		const separator = rest.indexOf(":");
+		if (separator <= 0) return void 0;
+		return {
+			sessionId: rest.slice(0, separator),
+			documentId: decodeURIComponent(rest.slice(separator + 1))
+		};
+	}
+	for (const prefix of [legacyDocumentPrefix, legacyUnloadPrefix]) if (key.startsWith(prefix)) return {
+		sessionId: LEGACY_SESSION,
+		documentId: key.slice(prefix.length)
+	};
 }
-function unloadKey(documentId) {
-	return `${unloadKeyPrefix}${documentId}`;
+const LOCK_PREFIX = "fabricjs-document-engine/recovery/";
+function lockManager() {
+	const locks = globalThis.navigator?.locks;
+	return typeof locks?.request === "function" && typeof locks.query === "function" ? locks : void 0;
 }
 function newerRecord(checkpoint, unloadCopy) {
 	if (!unloadCopy) return checkpoint;
@@ -58,6 +92,24 @@ async function restoreRecordedFiles(record) {
 }
 function createRecoveryController(options) {
 	const { store } = options;
+	const sessionId = require_ids.createId();
+	const own = (documentId) => ({
+		sessionId,
+		documentId
+	});
+	const adopted = /* @__PURE__ */ new Map();
+	const locks = lockManager();
+	let releaseLock;
+	locks?.request(`${LOCK_PREFIX}${sessionId}`, () => new Promise((resolve) => releaseLock = resolve)).catch(() => void 0);
+	async function liveSessions() {
+		const live = /* @__PURE__ */ new Set([sessionId]);
+		if (!locks) return live;
+		try {
+			const { held = [] } = await locks.query();
+			for (const lock of held) if (lock.name?.startsWith(LOCK_PREFIX)) live.add(lock.name.slice(34));
+		} catch {}
+		return live;
+	}
 	const interval = options.interval ?? 2e3;
 	const capturedFiles = /* @__PURE__ */ new Map();
 	const readyFiles = /* @__PURE__ */ new Map();
@@ -88,6 +140,8 @@ function createRecoveryController(options) {
 	function createRecord(document, files) {
 		return {
 			documentId: document.id,
+			sessionId,
+			active: true,
 			savedAt: (/* @__PURE__ */ new Date()).toISOString(),
 			baseRevision: document.revision ?? 0,
 			document,
@@ -99,7 +153,7 @@ function createRecoveryController(options) {
 		if (!options.shouldWrite()) return;
 		const document = options.createDocument();
 		const record = createRecord(document, await captureTabOnlyFiles(document));
-		await store.set(documentKey(document.id), {
+		await store.set(branchKeys(own(document.id)).checkpoint, {
 			...record,
 			files: await toStoredFiles(record.files)
 		});
@@ -109,20 +163,52 @@ function createRecoveryController(options) {
 		cancel();
 		if (!options.shouldWrite()) return;
 		const document = options.createDocument();
+		const keys = branchKeys(own(document.id));
 		if (store.setNow) {
-			store.setNow(unloadKey(document.id), createRecord(document, {}));
+			store.setNow(keys.closing, createRecord(document, {}));
 			return;
 		}
 		const record = createRecord(document, Object.fromEntries(readyFiles));
-		toStoredFiles(record.files).then((files) => store.set(documentKey(document.id), {
+		toStoredFiles(record.files).then((files) => store.set(keys.checkpoint, {
 			...record,
 			files
 		})).then(() => options.onCheckpoint(record), options.onError);
 	}
-	async function read(documentId) {
+	async function readBranch(branch, live) {
+		const keys = branchKeys(branch);
+		const [checkpoint, closing] = await Promise.all([store.get(keys.checkpoint), store.get(keys.closing)]);
+		const active = live.has(branch.sessionId);
+		return newerRecord(fromStoredRecord(checkpoint, branch.sessionId, active), fromStoredRecord(closing, branch.sessionId, active));
+	}
+	/** Every branch in the store, de-duplicated, in one pass over the keys. */
+	async function branches(documentId) {
+		const found = /* @__PURE__ */ new Map();
+		for (const key of await store.keys()) {
+			const branch = parseBranch(key);
+			if (!branch || documentId !== void 0 && branch.documentId !== documentId) continue;
+			found.set(`${branch.sessionId}\u0000${branch.documentId}`, branch);
+		}
+		return [...found.values()];
+	}
+	async function readAll(documentId) {
 		await queue;
-		const [checkpoint, unloadCopy] = await Promise.all([store.get(documentKey(documentId)), store.get(unloadKey(documentId))]);
-		return newerRecord(fromStoredRecord(checkpoint), fromStoredRecord(unloadCopy));
+		const live = await liveSessions();
+		return (await Promise.all((await branches(documentId)).map((branch) => readBranch(branch, live)))).filter((record) => record !== void 0).sort((first, second) => second.savedAt.localeCompare(first.savedAt));
+	}
+	async function read(documentId, branchSession) {
+		if (branchSession !== void 0) {
+			await queue;
+			return readBranch({
+				sessionId: branchSession,
+				documentId
+			}, await liveSessions());
+		}
+		return (await readAll(documentId))[0];
+	}
+	async function deleteBranch(branch) {
+		const keys = branchKeys(branch);
+		await store.delete(keys.closing);
+		await store.delete(keys.checkpoint);
 	}
 	function cancel() {
 		if (timer !== void 0) clearTimeout(timer);
@@ -151,31 +237,64 @@ function createRecoveryController(options) {
 		flush,
 		writeNow: writeCheckpointBeforeThePageCloses,
 		cancel,
+		sessionId,
 		remove: (documentId) => enqueue(async () => {
-			await store.delete(unloadKey(documentId));
-			await store.delete(documentKey(documentId));
+			await deleteBranch(own(documentId));
+			await deleteBranch({
+				sessionId: LEGACY_SESSION,
+				documentId
+			});
+			for (const other of adopted.get(documentId) ?? []) await deleteBranch({
+				sessionId: other,
+				documentId
+			});
+			adopted.delete(documentId);
 		}),
-		read,
-		async list() {
-			await queue;
-			const documentIds = /* @__PURE__ */ new Set();
-			for (const key of await store.keys()) {
-				if (key.startsWith(documentKeyPrefix)) documentIds.add(key.slice(9));
-				if (key.startsWith(unloadKeyPrefix)) documentIds.add(key.slice(7));
-			}
-			return (await Promise.all([...documentIds].map(read))).filter((record) => record !== void 0).sort((first, second) => second.savedAt.localeCompare(first.savedAt));
+		adopt(documentId, other) {
+			if (other === sessionId) return;
+			const sessions = adopted.get(documentId) ?? /* @__PURE__ */ new Set();
+			sessions.add(other);
+			adopted.set(documentId, sessions);
 		},
-		markLoadStarted: (documentId) => store.set(loadingKey, {
+		discard: (documentId, branchSession) => enqueue(async () => {
+			const targets = branchSession === void 0 ? await branches(documentId) : [{
+				sessionId: branchSession,
+				documentId
+			}];
+			for (const branch of targets) await deleteBranch(branch);
+		}),
+		read,
+		list: () => readAll(),
+		markLoadStarted: (documentId) => store.set(`${loadingPrefix}${sessionId}`, {
 			documentId,
 			startedAt: (/* @__PURE__ */ new Date()).toISOString()
 		}).catch(options.onError),
-		markLoadFinished: () => store.delete(loadingKey).catch(options.onError),
+		markLoadFinished: async () => {
+			try {
+				await store.delete(`${loadingPrefix}${sessionId}`);
+				const live = await liveSessions();
+				for (const key of await store.keys()) {
+					const markerSession = key === legacyLoadingKey ? LEGACY_SESSION : key.startsWith(loadingPrefix) ? key.slice(8) : void 0;
+					if (markerSession !== void 0 && !live.has(markerSession)) await store.delete(key);
+				}
+			} catch (error) {
+				options.onError(error);
+			}
+		},
 		async interruptedLoad() {
-			const marker = await store.get(loadingKey);
-			return marker && typeof marker.startedAt === "string" ? marker : void 0;
+			const live = await liveSessions();
+			let newest;
+			for (const key of await store.keys()) {
+				const markerSession = key === legacyLoadingKey ? LEGACY_SESSION : key.startsWith(loadingPrefix) ? key.slice(8) : void 0;
+				if (markerSession === void 0 || live.has(markerSession)) continue;
+				const marker = await store.get(key);
+				if (marker && typeof marker.startedAt === "string" && (!newest || marker.startedAt > newest.startedAt)) newest = marker;
+			}
+			return newest;
 		},
 		destroy() {
 			cancel();
+			releaseLock?.();
 			pageEvents?.removeEventListener("pagehide", handlePageHidden);
 			pageEvents?.document.removeEventListener("visibilitychange", handleVisibilityChange);
 		}

package/dist/recovery/recovery-controller.d.cts

@@ -7,6 +7,14 @@ export interface RecoveryOptions {
 }
 export interface RecoveryRecord {
   documentId: string;
+  /**
+   * The editor session (one per engine, so one per tab) that wrote this copy.
+   * Two tabs editing the same document keep separate copies. `legacy` marks
+   * a copy written before 1.2.
+   */
+  sessionId: string;
+  /** True while the session that wrote the copy is still open in a tab, when the browser can tell. */
+  active: boolean;
   savedAt: string;
   baseRevision: number;
   document: FabricDocument;

package/dist/recovery/recovery-controller.d.ts

@@ -7,6 +7,14 @@ export interface RecoveryOptions {
 }
 export interface RecoveryRecord {
   documentId: string;
+  /**
+   * The editor session (one per engine, so one per tab) that wrote this copy.
+   * Two tabs editing the same document keep separate copies. `legacy` marks
+   * a copy written before 1.2.
+   */
+  sessionId: string;
+  /** True while the session that wrote the copy is still open in a tab, when the browser can tell. */
+  active: boolean;
   savedAt: string;
   baseRevision: number;
   document: FabricDocument;

package/dist/recovery/recovery-controller.js

@@ -1,4 +1,5 @@
 import { rewriteUrls } from "../assets/asset-pipeline.js";
+import { createId } from "../document/ids.js";
 //#region src/recovery/recovery-controller.ts
 async function toStoredFiles(files) {
 	const entries = await Promise.all(Object.entries(files).map(async ([url, blob]) => [url, {
@@ -12,22 +13,55 @@ function fromStoredFiles(files) {
 	for (const [url, file] of Object.entries(files ?? {})) restored[url] = file instanceof Blob ? file : new Blob([file.bytes], { type: file.type });
 	return restored;
 }
-function fromStoredRecord(value) {
+function fromStoredRecord(value, sessionId, active) {
 	if (!isRecoveryRecord(value)) return void 0;
 	const stored = value;
 	return {
 		...stored,
+		sessionId,
+		active,
 		files: fromStoredFiles(stored.files)
 	};
 }
-const documentKeyPrefix = "document:";
-const unloadKeyPrefix = "unload:";
-const loadingKey = "loading";
-function documentKey(documentId) {
-	return `${documentKeyPrefix}${documentId}`;
+const LEGACY_SESSION = "legacy";
+const checkpointPrefix = "checkpoint:";
+const closingPrefix = "closing:";
+const loadingPrefix = "loading:";
+const legacyDocumentPrefix = "document:";
+const legacyUnloadPrefix = "unload:";
+const legacyLoadingKey = "loading";
+function branchKeys({ sessionId, documentId }) {
+	if (sessionId === LEGACY_SESSION) return {
+		checkpoint: `${legacyDocumentPrefix}${documentId}`,
+		closing: `${legacyUnloadPrefix}${documentId}`
+	};
+	const document = encodeURIComponent(documentId);
+	return {
+		checkpoint: `${checkpointPrefix}${sessionId}:${document}`,
+		closing: `${closingPrefix}${sessionId}:${document}`
+	};
+}
+/** The branch a key belongs to, or undefined for keys that are not copies. */
+function parseBranch(key) {
+	for (const prefix of [checkpointPrefix, closingPrefix]) {
+		if (!key.startsWith(prefix)) continue;
+		const rest = key.slice(prefix.length);
+		const separator = rest.indexOf(":");
+		if (separator <= 0) return void 0;
+		return {
+			sessionId: rest.slice(0, separator),
+			documentId: decodeURIComponent(rest.slice(separator + 1))
+		};
+	}
+	for (const prefix of [legacyDocumentPrefix, legacyUnloadPrefix]) if (key.startsWith(prefix)) return {
+		sessionId: LEGACY_SESSION,
+		documentId: key.slice(prefix.length)
+	};
 }
-function unloadKey(documentId) {
-	return `${unloadKeyPrefix}${documentId}`;
+const LOCK_PREFIX = "fabricjs-document-engine/recovery/";
+function lockManager() {
+	const locks = globalThis.navigator?.locks;
+	return typeof locks?.request === "function" && typeof locks.query === "function" ? locks : void 0;
 }
 function newerRecord(checkpoint, unloadCopy) {
 	if (!unloadCopy) return checkpoint;
@@ -58,6 +92,24 @@ async function restoreRecordedFiles(record) {
 }
 function createRecoveryController(options) {
 	const { store } = options;
+	const sessionId = createId();
+	const own = (documentId) => ({
+		sessionId,
+		documentId
+	});
+	const adopted = /* @__PURE__ */ new Map();
+	const locks = lockManager();
+	let releaseLock;
+	locks?.request(`${LOCK_PREFIX}${sessionId}`, () => new Promise((resolve) => releaseLock = resolve)).catch(() => void 0);
+	async function liveSessions() {
+		const live = /* @__PURE__ */ new Set([sessionId]);
+		if (!locks) return live;
+		try {
+			const { held = [] } = await locks.query();
+			for (const lock of held) if (lock.name?.startsWith(LOCK_PREFIX)) live.add(lock.name.slice(34));
+		} catch {}
+		return live;
+	}
 	const interval = options.interval ?? 2e3;
 	const capturedFiles = /* @__PURE__ */ new Map();
 	const readyFiles = /* @__PURE__ */ new Map();
@@ -88,6 +140,8 @@ function createRecoveryController(options) {
 	function createRecord(document, files) {
 		return {
 			documentId: document.id,
+			sessionId,
+			active: true,
 			savedAt: (/* @__PURE__ */ new Date()).toISOString(),
 			baseRevision: document.revision ?? 0,
 			document,
@@ -99,7 +153,7 @@ function createRecoveryController(options) {
 		if (!options.shouldWrite()) return;
 		const document = options.createDocument();
 		const record = createRecord(document, await captureTabOnlyFiles(document));
-		await store.set(documentKey(document.id), {
+		await store.set(branchKeys(own(document.id)).checkpoint, {
 			...record,
 			files: await toStoredFiles(record.files)
 		});
@@ -109,20 +163,52 @@ function createRecoveryController(options) {
 		cancel();
 		if (!options.shouldWrite()) return;
 		const document = options.createDocument();
+		const keys = branchKeys(own(document.id));
 		if (store.setNow) {
-			store.setNow(unloadKey(document.id), createRecord(document, {}));
+			store.setNow(keys.closing, createRecord(document, {}));
 			return;
 		}
 		const record = createRecord(document, Object.fromEntries(readyFiles));
-		toStoredFiles(record.files).then((files) => store.set(documentKey(document.id), {
+		toStoredFiles(record.files).then((files) => store.set(keys.checkpoint, {
 			...record,
 			files
 		})).then(() => options.onCheckpoint(record), options.onError);
 	}
-	async function read(documentId) {
+	async function readBranch(branch, live) {
+		const keys = branchKeys(branch);
+		const [checkpoint, closing] = await Promise.all([store.get(keys.checkpoint), store.get(keys.closing)]);
+		const active = live.has(branch.sessionId);
+		return newerRecord(fromStoredRecord(checkpoint, branch.sessionId, active), fromStoredRecord(closing, branch.sessionId, active));
+	}
+	/** Every branch in the store, de-duplicated, in one pass over the keys. */
+	async function branches(documentId) {
+		const found = /* @__PURE__ */ new Map();
+		for (const key of await store.keys()) {
+			const branch = parseBranch(key);
+			if (!branch || documentId !== void 0 && branch.documentId !== documentId) continue;
+			found.set(`${branch.sessionId}\u0000${branch.documentId}`, branch);
+		}
+		return [...found.values()];
+	}
+	async function readAll(documentId) {
 		await queue;
-		const [checkpoint, unloadCopy] = await Promise.all([store.get(documentKey(documentId)), store.get(unloadKey(documentId))]);
-		return newerRecord(fromStoredRecord(checkpoint), fromStoredRecord(unloadCopy));
+		const live = await liveSessions();
+		return (await Promise.all((await branches(documentId)).map((branch) => readBranch(branch, live)))).filter((record) => record !== void 0).sort((first, second) => second.savedAt.localeCompare(first.savedAt));
+	}
+	async function read(documentId, branchSession) {
+		if (branchSession !== void 0) {
+			await queue;
+			return readBranch({
+				sessionId: branchSession,
+				documentId
+			}, await liveSessions());
+		}
+		return (await readAll(documentId))[0];
+	}
+	async function deleteBranch(branch) {
+		const keys = branchKeys(branch);
+		await store.delete(keys.closing);
+		await store.delete(keys.checkpoint);
 	}
 	function cancel() {
 		if (timer !== void 0) clearTimeout(timer);
@@ -151,31 +237,64 @@ function createRecoveryController(options) {
 		flush,
 		writeNow: writeCheckpointBeforeThePageCloses,
 		cancel,
+		sessionId,
 		remove: (documentId) => enqueue(async () => {
-			await store.delete(unloadKey(documentId));
-			await store.delete(documentKey(documentId));
+			await deleteBranch(own(documentId));
+			await deleteBranch({
+				sessionId: LEGACY_SESSION,
+				documentId
+			});
+			for (const other of adopted.get(documentId) ?? []) await deleteBranch({
+				sessionId: other,
+				documentId
+			});
+			adopted.delete(documentId);
 		}),
-		read,
-		async list() {
-			await queue;
-			const documentIds = /* @__PURE__ */ new Set();
-			for (const key of await store.keys()) {
-				if (key.startsWith(documentKeyPrefix)) documentIds.add(key.slice(9));
-				if (key.startsWith(unloadKeyPrefix)) documentIds.add(key.slice(7));
-			}
-			return (await Promise.all([...documentIds].map(read))).filter((record) => record !== void 0).sort((first, second) => second.savedAt.localeCompare(first.savedAt));
+		adopt(documentId, other) {
+			if (other === sessionId) return;
+			const sessions = adopted.get(documentId) ?? /* @__PURE__ */ new Set();
+			sessions.add(other);
+			adopted.set(documentId, sessions);
 		},
-		markLoadStarted: (documentId) => store.set(loadingKey, {
+		discard: (documentId, branchSession) => enqueue(async () => {
+			const targets = branchSession === void 0 ? await branches(documentId) : [{
+				sessionId: branchSession,
+				documentId
+			}];
+			for (const branch of targets) await deleteBranch(branch);
+		}),
+		read,
+		list: () => readAll(),
+		markLoadStarted: (documentId) => store.set(`${loadingPrefix}${sessionId}`, {
 			documentId,
 			startedAt: (/* @__PURE__ */ new Date()).toISOString()
 		}).catch(options.onError),
-		markLoadFinished: () => store.delete(loadingKey).catch(options.onError),
+		markLoadFinished: async () => {
+			try {
+				await store.delete(`${loadingPrefix}${sessionId}`);
+				const live = await liveSessions();
+				for (const key of await store.keys()) {
+					const markerSession = key === legacyLoadingKey ? LEGACY_SESSION : key.startsWith(loadingPrefix) ? key.slice(8) : void 0;
+					if (markerSession !== void 0 && !live.has(markerSession)) await store.delete(key);
+				}
+			} catch (error) {
+				options.onError(error);
+			}
+		},
 		async interruptedLoad() {
-			const marker = await store.get(loadingKey);
-			return marker && typeof marker.startedAt === "string" ? marker : void 0;
+			const live = await liveSessions();
+			let newest;
+			for (const key of await store.keys()) {
+				const markerSession = key === legacyLoadingKey ? LEGACY_SESSION : key.startsWith(loadingPrefix) ? key.slice(8) : void 0;
+				if (markerSession === void 0 || live.has(markerSession)) continue;
+				const marker = await store.get(key);
+				if (marker && typeof marker.startedAt === "string" && (!newest || marker.startedAt > newest.startedAt)) newest = marker;
+			}
+			return newest;
 		},
 		destroy() {
 			cancel();
+			releaseLock?.();
 			pageEvents?.removeEventListener("pagehide", handlePageHidden);
 			pageEvents?.document.removeEventListener("visibilitychange", handleVisibilityChange);
 		}

package/dist/security/content-limits.cjs

@@ -1,6 +1,23 @@
 const require_asset_references = require("../assets/asset-references.cjs");
 const require_errors = require("../engine/errors.cjs");
 //#region src/security/content-limits.ts
+const DEFAULT_MAX_CANVAS_SIDE = 16384;
+const DEFAULT_MAX_CANVAS_PIXELS = 67108864;
+const DEFAULT_MAX_IMAGE_PIXELS = 67108864;
+const DEFAULT_MAX_DOCUMENT_LENGTH = 1e8;
+/**
+* Why a drawing surface of this size is refused, or undefined when it fits.
+* Pure arithmetic, run before any canvas is created: a canvas over the
+* browser's limit fails silently or crashes the tab.
+*/
+function canvasSizeProblem(width, height, limits = {}) {
+	const maxSide = limits.maxCanvasSide ?? 16384;
+	const maxPixels = limits.maxCanvasPixels ?? 67108864;
+	const w = Math.ceil(width);
+	const h = Math.ceil(height);
+	if (w > maxSide || h > maxSide) return `${w} × ${h} pixels is larger than the ${maxSide}-pixel limit per side`;
+	if (w * h > maxPixels) return `${w} × ${h} pixels is ${w * h} pixels, more than the limit of ${maxPixels}`;
+}
 const dangerousKeys = /* @__PURE__ */ new Set([
 	"__proto__",
 	"constructor",
@@ -14,8 +31,18 @@ function isSafeImageUrl(url) {
 	if (scheme === "data") return trimmed.startsWith("data:image/");
 	return false;
 }
-function withoutDangerousKeys(value) {
-	return JSON.parse(JSON.stringify(value), (key, nested) => dangerousKeys.has(key) ? void 0 : nested);
+function withoutDangerousKeys(json) {
+	return JSON.parse(json, (key, nested) => dangerousKeys.has(key) ? void 0 : nested);
+}
+function pageSize(document) {
+	const canvas = document.canvas;
+	return typeof canvas === "object" && canvas !== null ? {
+		width: canvas.width,
+		height: canvas.height
+	} : {
+		width: document.width,
+		height: document.height
+	};
 }
 function deepestNesting(value) {
 	let deepest = 0;
@@ -56,8 +83,16 @@ function secureDocument(input, limits = {}) {
 	if (typeof input !== "object" || input === null) return input;
 	const maxDepth = limits.maxDepth ?? 100;
 	const maxObjects = limits.maxObjects ?? 5e4;
-	const document = withoutDangerousKeys(input);
+	const json = JSON.stringify(input);
+	const maxLength = limits.maxDocumentLength ?? 1e8;
+	if (json.length > maxLength) refuseWhenUnsafe([unsafe("", `the document is ${json.length} characters of JSON, the limit is ${maxLength}`)]);
+	const document = withoutDangerousKeys(json);
 	const issues = [];
+	const { width, height } = pageSize(document);
+	if (typeof width === "number" && typeof height === "number") {
+		const problem = canvasSizeProblem(width, height, limits);
+		if (problem) issues.push(unsafe("canvas", `the page is ${problem}`));
+	}
 	const depth = deepestNesting(document);
 	if (depth > maxDepth) issues.push(unsafe("", `the document is nested ${depth} levels deep, the limit is ${maxDepth}`));
 	if (Array.isArray(document.objects) && issues.length === 0) {
@@ -81,6 +116,11 @@ function refuseUnsafeImageUrls(objects, isAllowedUrl = isSafeImageUrl) {
 	refuseWhenUnsafe(issues);
 }
 //#endregion
+exports.DEFAULT_MAX_CANVAS_PIXELS = DEFAULT_MAX_CANVAS_PIXELS;
+exports.DEFAULT_MAX_CANVAS_SIDE = DEFAULT_MAX_CANVAS_SIDE;
+exports.DEFAULT_MAX_DOCUMENT_LENGTH = DEFAULT_MAX_DOCUMENT_LENGTH;
+exports.DEFAULT_MAX_IMAGE_PIXELS = DEFAULT_MAX_IMAGE_PIXELS;
+exports.canvasSizeProblem = canvasSizeProblem;
 exports.isSafeImageUrl = isSafeImageUrl;
 exports.refuseUnsafeImageUrls = refuseUnsafeImageUrls;
 exports.secureDocument = secureDocument;

package/dist/security/content-limits.d.cts

@@ -4,6 +4,14 @@ export interface ContentLimits {
   maxObjects?: number;
   maxDepth?: number;
   isAllowedUrl?: (url: string) => boolean;
+  /** Longest side of the page or of an export, in pixels. Default 16,384. */
+  maxCanvasSide?: number;
+  /** Largest page or export area, in pixels. Default 67,108,864 (8,192 × 8,192, what iOS 18 Safari can draw). */
+  maxCanvasPixels?: number;
+  /** Largest decoded image, in pixels. Default 67,108,864. */
+  maxImagePixels?: number;
+  /** Longest document, in characters of JSON. Default 100,000,000. */
+  maxDocumentLength?: number;
 }
 export declare function isSafeImageUrl(url: string): boolean;
 export declare function secureDocument(input: unknown, limits?: ContentLimits): unknown;

package/dist/security/content-limits.d.ts

@@ -4,6 +4,14 @@ export interface ContentLimits {
   maxObjects?: number;
   maxDepth?: number;
   isAllowedUrl?: (url: string) => boolean;
+  /** Longest side of the page or of an export, in pixels. Default 16,384. */
+  maxCanvasSide?: number;
+  /** Largest page or export area, in pixels. Default 67,108,864 (8,192 × 8,192, what iOS 18 Safari can draw). */
+  maxCanvasPixels?: number;
+  /** Largest decoded image, in pixels. Default 67,108,864. */
+  maxImagePixels?: number;
+  /** Longest document, in characters of JSON. Default 100,000,000. */
+  maxDocumentLength?: number;
 }
 export declare function isSafeImageUrl(url: string): boolean;
 export declare function secureDocument(input: unknown, limits?: ContentLimits): unknown;