polotno-node 3.14.0 → 3.15.0

package/dist/index.html

@@ -3,7 +3,7 @@
     <title>Canvas editor</title>
     <style>body{margin:0;padding:0}</style>
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <script type="module" crossorigin src="./assets/index-BZiOShMo.js"></script>
+    <script type="module" crossorigin src="./assets/index-DO5siyU6.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/rolldown-runtime-XKyaHtl9.js">
   </head>
   <body>

package/lib/errors.d.ts

@@ -51,6 +51,11 @@ export interface PolotnoErrorDetailsMap {
         reason: 'busy';
     } | {
         reason: 'pdfx';
+    } | {
+        reason: 'empty-output';
+        pageId?: string;
+        mimeType: string;
+        pixelRatio: number;
     }) & RenderContext;
     IMAGE_FAILED: ({
         reason: 'load';

package/lib/font-cache.d.ts

@@ -1,3 +1,4 @@
+export declare const isHttpsHost: (url: string, hosts: readonly string[]) => boolean;
 declare const tryRespond: (request: any) => boolean;
 declare const capture: (response: any) => Promise<void>;
 export { tryRespond, capture };

package/lib/font-cache.js

@@ -13,9 +13,29 @@ import crypto from 'crypto';
 //   1. an in-memory Map for the lifetime of the process, and
 //   2. a disk cache shared between processes and across runs (e.g. parallel
 //      test workers), so even a cold process doesn't re-download.
+//
+// A cached URL is answered before the caller's requestInterceptor, so only
+// Google's own hosts may enter: a design names any URL it likes.
 const FONT_HOSTS = ['fonts.googleapis.com', 'fonts.gstatic.com'];
-const isFontUrl = (url) => FONT_HOSTS.some((host) => url.includes(host));
+export const isHttpsHost = (url, hosts) => {
+    try {
+        const { protocol, hostname } = new URL(url);
+        return protocol === 'https:' && hosts.includes(hostname);
+    }
+    catch {
+        return false;
+    }
+};
+const isFontUrl = (url) => isHttpsHost(url, FONT_HOSTS);
 const memoryCache = new Map(); // url -> { contentType, body }
+// Distinct Google URLs are unbounded (any `text=` query is a 200).
+const MAX_MEMORY_ENTRIES = 1000;
+const remember = (url, entry) => {
+    if (memoryCache.size >= MAX_MEMORY_ENTRIES) {
+        memoryCache.delete(memoryCache.keys().next().value);
+    }
+    memoryCache.set(url, entry);
+};
 const FONT_CACHE_DIR = path.join(os.tmpdir(), 'polotno-node-font-cache');
 const FONT_CACHE_TTL = 7 * 24 * 60 * 60 * 1000;
 const fontCacheDiskPath = (url) => path.join(FONT_CACHE_DIR, crypto.createHash('sha1').update(url).digest('hex') + '.json');
@@ -62,7 +82,7 @@ const tryRespond = (request) => {
     if (!cached) {
         cached = readFontCacheFromDisk(url);
         if (cached) {
-            memoryCache.set(url, cached);
+            remember(url, cached);
         }
     }
     if (!cached)
@@ -97,7 +117,7 @@ const capture = async (response) => {
             contentType: response.headers()['content-type'] || '',
             body,
         };
-        memoryCache.set(url, entry);
+        remember(url, entry);
         writeFontCacheToDisk(url, entry);
     }
     catch (e) {

package/lib/instance.d.ts

@@ -14,6 +14,12 @@ declare global {
     }
 }
 export { URL_FIELDS, forEveryUrlField } from '@polotno/schema/asset-urls';
+/**
+ * `allowLocalFiles: false`: reject a design that names any `file:` source,
+ * before anything is downloaded or rendered. A design that may not read this
+ * host's disk is invalid input, so the error is DESIGN_INVALID.
+ */
+export declare const assertNoLocalFiles: (json: any) => void;
 /**
  * Rewrite every `file:` source in a design to a URL the client can load with
  * any API. Designs without one — the common case — come back untouched, so this
@@ -22,7 +28,6 @@ export { URL_FIELDS, forEveryUrlField } from '@polotno/schema/asset-urls';
  */
 export declare const serveLocalFiles: (json: any) => {
     json: any;
-    serving: boolean;
     release: () => void;
 };
 export declare const guessExtension: (contentType: any, kind: any) => any;

package/lib/instance.js

@@ -2,16 +2,17 @@ import path from 'path';
 import fs from 'fs';
 import os from 'os';
 import crypto from 'crypto';
-import { execFileSync } from 'child_process';
+import { spawn } from 'child_process';
 import { pathToFileURL, fileURLToPath } from 'url';
 import { Readable } from 'stream';
 import { pipeline } from 'stream/promises';
 import { assertValidDesign } from '@polotno/schema';
 import { forEveryUrlField } from '@polotno/schema/asset-urls';
+import { fontSrcUrl } from '@polotno/core/fonts';
 import * as fontCache from './font-cache.js';
 import * as localMedia from './local-media.js';
 import { polotnoError, rehydrateError } from './errors.js';
-import { assertUrlAllowed } from './ssrf-guard.js';
+import { assertUrlAllowed, guardedFetch, } from './ssrf-guard.js';
 import { createVideoStatusMonitor } from './video-status.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // Compiled to lib/instance.js; the client bundle is published to ../dist.
@@ -59,9 +60,44 @@ export { URL_FIELDS, forEveryUrlField } from '@polotno/schema/asset-urls';
 // Not `toLowerCase().startsWith`: a `src` is routinely a data URL of several
 // MB, and that would copy every one of them on every render.
 const isFileUrl = (value) => /^file:/i.test(value);
+/**
+ * The `file:` URL a design value names, bare or inside CSS `url(...)`, with a
+ * function that puts a replacement back the same way. `null` for any other
+ * value.
+ */
+const localFileIn = (value) => {
+    if (isFileUrl(value))
+        return { url: value, wrap: (url) => url };
+    // A font style's `src` is CSS; the `url(` check skips multi-MB data URLs.
+    const url = /^url\(/i.test(value) ? fontSrcUrl(value) : null;
+    if (url && isFileUrl(url))
+        return { url, wrap: (served) => value.replace(url, served) };
+    return null;
+};
+/**
+ * `allowLocalFiles: false`: reject a design that names any `file:` source,
+ * before anything is downloaded or rendered. A design that may not read this
+ * host's disk is invalid input, so the error is DESIGN_INVALID.
+ */
+export const assertNoLocalFiles = (json) => {
+    const errors = [];
+    forEveryUrlField(json, (node, key, value) => {
+        const local = localFileIn(value);
+        if (!local)
+            return;
+        errors.push({
+            path: typeof node.id === 'string' ? `${node.id}.${key}` : key,
+            message: `Local file source is not allowed (allowLocalFiles: false): ${local.url}`,
+        });
+    });
+    if (errors.length === 0)
+        return;
+    throw polotnoError('DESIGN_INVALID', `Invalid Polotno design: ${errors[0].message}` +
+        (errors.length > 1 ? ` (and ${errors.length - 1} more)` : ''), { errors });
+};
 // The design goes to the browser as the caller wrote it, and there is nothing
-// to release or to switch on.
-const nothingToServe = (json) => ({ json, serving: false, release: () => { } });
+// to release.
+const nothingToServe = (json) => ({ json, release: () => { } });
 /**
  * Rewrite every `file:` source in a design to a URL the client can load with
  * any API. Designs without one — the common case — come back untouched, so this
@@ -71,7 +107,7 @@ const nothingToServe = (json) => ({ json, serving: false, release: () => { } });
 export const serveLocalFiles = (json) => {
     let found = false;
     forEveryUrlField(json, (_node, _key, value) => {
-        found || (found = isFileUrl(value));
+        found || (found = localFileIn(value) !== null);
     });
     if (!found)
         return nothingToServe(json);
@@ -80,11 +116,12 @@ export const serveLocalFiles = (json) => {
     // request the browser answers from its own cache.
     const byPath = new Map();
     forEveryUrlField(cloned, (target, key, value) => {
-        if (!isFileUrl(value))
+        const local = localFileIn(value);
+        if (!local)
             return;
         let filePath;
         try {
-            filePath = fileURLToPath(value);
+            filePath = fileURLToPath(local.url);
         }
         catch (e) {
             // Not a file URL we can resolve to a path. Leave it alone: the client
@@ -93,15 +130,11 @@ export const serveLocalFiles = (json) => {
         }
         if (!byPath.has(filePath))
             byPath.set(filePath, localMedia.register(filePath));
-        target[key] = byPath.get(filePath);
+        target[key] = local.wrap(byPath.get(filePath));
     });
     const urls = [...byPath.values()];
-    // `serving` is per render, and the page-level switch is gated on it: a
-    // process-wide "is anything registered" would let one render turn
-    // interception on for another's page.
     return {
         json: cloned,
-        serving: urls.length > 0,
         release: () => localMedia.release(urls),
     };
 };
@@ -134,32 +167,6 @@ export const guessExtension = (contentType, kind) => {
         .toLowerCase();
     return CONTENT_TYPE_EXTENSION[ct] || (kind === 'audio' ? '.m4a' : '.mp4');
 };
-// Follow redirects by hand, re-running the SSRF guard on every hop. `fetch`
-// follows redirects transparently, so a guard that only checked the original
-// URL would be trivially bypassed by a public URL that 302s to an internal
-// address. `redirect: 'manual'` hands us each 3xx so we can validate its
-// Location before chasing it.
-const MAX_REDIRECTS = 5;
-const guardedFetch = async (startUrl, policy, signal) => {
-    let url = startUrl;
-    for (let hop = 0;; hop++) {
-        await assertUrlAllowed(url, policy);
-        const res = await fetch(url, { redirect: 'manual', signal });
-        if (res.status >= 300 && res.status < 400) {
-            const location = res.headers.get('location');
-            if (!location)
-                return res; // 3xx without a target — let caller handle it
-            if (hop >= MAX_REDIRECTS) {
-                throw polotnoError('FETCH_FAILED', `Too many redirects while downloading: ${startUrl}`, { url: startUrl });
-            }
-            // Resolve relative Location against the current URL, drop the body.
-            url = new URL(location, url).toString();
-            await res.body?.cancel?.().catch(() => { });
-            continue;
-        }
-        return res;
-    }
-};
 // A media download only gets a deadline up to the RESPONSE HEADERS. The body
 // can legitimately be a hundred megabytes of video on a slow link, and there is
 // no way to tell that from a stalled socket — capping the whole transfer would
@@ -174,36 +181,10 @@ const downloadUrlToFile = async (urlString, destinationPath, policy = {}) => {
     const attemptDownload = async () => {
         // Ensure no partial file exists from a previous attempt
         await fs.promises.rm(destinationPath, { force: true });
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), HEADERS_TIMEOUT_MS);
-        let res;
-        try {
-            res = await guardedFetch(urlString, policy, controller.signal);
-        }
-        finally {
-            // Cleared before the body streams — see HEADERS_TIMEOUT_MS.
-            clearTimeout(timeoutId);
-        }
-        if (!res.ok) {
-            // Best-effort read of error body (small) for debugging.
-            let bodyPreview = '';
-            try {
-                bodyPreview = await res.text();
-                if (bodyPreview.length > 500) {
-                    bodyPreview = bodyPreview.slice(0, 500) + '...';
-                }
-            }
-            catch (e) {
-                // ignore
-            }
-            const details = [
-                `${res.status} ${res.statusText}`.trim(),
-                bodyPreview ? `body: ${JSON.stringify(bodyPreview)}` : null,
-            ]
-                .filter(Boolean)
-                .join(', ');
-            throw polotnoError('FETCH_FAILED', `HTTP error while downloading: ${details}`, { url: urlString, status: res.status });
-        }
+        // Rejects on a non-ok status, with `details.status` for the retry rule.
+        const res = await guardedFetch(urlString, policy, {
+            timeout: HEADERS_TIMEOUT_MS,
+        });
         if (!res.body) {
             throw polotnoError('FETCH_FAILED', 'Empty response body', {
                 url: urlString,
@@ -212,8 +193,8 @@ const downloadUrlToFile = async (urlString, destinationPath, policy = {}) => {
         await pipeline(Readable.fromWeb(res.body), fs.createWriteStream(destinationPath));
         return res.headers.get('content-type') || '';
     };
-    // A local loop rather than @polotno/core/retry: importing that made core (and
-    // konva) a runtime dependency of polotno-node for one call site.
+    // A local loop rather than core's retry: an attempt also covers streaming the
+    // body to disk.
     for (let attempt = 1;; attempt++) {
         try {
             return await attemptDownload();
@@ -234,11 +215,38 @@ const downloadUrlToFile = async (urlString, destinationPath, policy = {}) => {
         }
     }
 };
+// Async, so a long transcode never freezes other renders; argv, so no shell parses a path.
+const FFPROBE_TIMEOUT_MS = 30 * 1000;
+// A full re-encode of a long clip on a slow box is minutes of honest work.
+const FFMPEG_TIMEOUT_MS = 10 * 60 * 1000;
+/** Run a tool; resolve with its stdout on exit 0, reject otherwise. */
+const runTool = (command, args, timeoutMs) => new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+        // stderr is ignored, not buffered: ffmpeg's progress output is unbounded.
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: timeoutMs,
+        killSignal: 'SIGKILL',
+    });
+    let stdout = '';
+    child.stdout.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => {
+        stdout += chunk;
+    });
+    child.on('error', reject);
+    child.on('close', (code, signal) => {
+        if (code === 0)
+            resolve(stdout);
+        else
+            reject(new Error(signal
+                ? `${command} was killed with ${signal} (timeout ${timeoutMs} ms)`
+                : `${command} exited with code ${code}`));
+    });
+});
 // Returns a human-readable reason string if the video file needs transcoding
 // for Chromium headless compatibility, or null if it is already render-safe.
-const getVideoNormalizationReason = (filePath) => {
+const getVideoNormalizationReason = async (filePath) => {
     try {
-        const raw = execFileSync('ffprobe', [
+        const raw = await runTool('ffprobe', [
             '-v',
             'error',
             '-select_streams',
@@ -248,7 +256,7 @@ const getVideoNormalizationReason = (filePath) => {
             '-of',
             'json',
             filePath,
-        ], { encoding: 'utf8' });
+        ], FFPROBE_TIMEOUT_MS);
         const info = JSON.parse(raw);
         const vs = info?.streams?.[0];
         if (!vs)
@@ -268,18 +276,18 @@ const getVideoNormalizationReason = (filePath) => {
         return null;
     }
 };
-const isFfmpegAvailable = () => {
+const isFfmpegAvailable = async () => {
     try {
-        execFileSync('ffmpeg', ['-version'], { stdio: 'ignore' });
+        await runTool('ffmpeg', ['-version'], FFPROBE_TIMEOUT_MS);
         return true;
     }
     catch {
         return false;
     }
 };
-const getAudioCodec = (filePath) => {
+const getAudioCodec = async (filePath) => {
     try {
-        const result = execFileSync('ffprobe', [
+        const result = await runTool('ffprobe', [
             '-v',
             'error',
             '-select_streams',
@@ -289,16 +297,14 @@ const getAudioCodec = (filePath) => {
             '-of',
             'csv=p=0',
             filePath,
-        ], { encoding: 'utf8' });
+        ], FFPROBE_TIMEOUT_MS);
         return result.trim();
     }
     catch {
         return null;
     }
 };
-const convertAudioToAac = (inputPath, outputPath) => {
-    execFileSync('ffmpeg', ['-y', '-i', inputPath, '-c:v', 'copy', '-c:a', 'aac', outputPath], { stdio: 'ignore' });
-};
+const convertAudioToAac = (inputPath, outputPath) => runTool('ffmpeg', ['-y', '-i', inputPath, '-c:v', 'copy', '-c:a', 'aac', outputPath], FFMPEG_TIMEOUT_MS);
 export const prepareLocalMediaForVideoExport = async (json, policy = {}, onProgress) => {
     const clonedJson = JSON.parse(JSON.stringify(json));
     const pointers = collectMediaSourcePointers(clonedJson);
@@ -346,10 +352,10 @@ export const prepareLocalMediaForVideoExport = async (json, policy = {}, onProgr
             let finalPath = tmpPath + ext;
             await fs.promises.rename(tmpPath, finalPath);
             if (videoUrls.has(src)) {
-                const reason = getVideoNormalizationReason(finalPath);
+                const reason = await getVideoNormalizationReason(finalPath);
                 if (reason) {
                     const normalizedPath = finalPath + '.normalized.mp4';
-                    execFileSync('ffmpeg', [
+                    await runTool('ffmpeg', [
                         '-y',
                         '-i',
                         finalPath,
@@ -362,7 +368,7 @@ export const prepareLocalMediaForVideoExport = async (json, policy = {}, onProgr
                         '-movflags',
                         '+faststart',
                         normalizedPath,
-                    ], { stdio: 'ignore' });
+                    ], FFMPEG_TIMEOUT_MS);
                     finalPath = normalizedPath;
                 }
             }
@@ -395,27 +401,47 @@ export const prepareLocalMediaForVideoExport = async (json, policy = {}, onProgr
 // calls, not the navigation lifecycle. 2 minutes is generous but still bounded,
 // unlike `timeout: 0` ("disabled"), which turns a wedged load into a hang.
 const DEFAULT_NAVIGATION_TIMEOUT = 120 * 1000;
-// Pages that have request interception on. It is a page-level switch, and the
-// one handler each page carries must stay out of the way while it is off.
-const intercepting = new WeakSet();
 // Pages `createPage` opened, and so the only ones carrying the handler that
 // answers a local-media URL. A caller who brings their own page keeps their own
 // request handling, and their design keeps the URLs they wrote.
 const ourPages = new WeakSet();
-/**
- * Turn request interception on for a page, once. Interception is on already for
- * everyone who keeps the font cache; this covers the caller who turned it off
- * and then renders a design that carries local files.
- */
-const ensureServing = async (page) => {
-    if (intercepting.has(page))
-        return;
-    await page.setRequestInterception(true);
-    // After the await, never before: a page marked while the switch failed to
-    // flip would let the handler respond on a page that is not intercepting, and
-    // the asset would fail silently. Nothing can slip in between — the statement
-    // runs in the same microtask the await resolves on.
-    intercepting.add(page);
+// The SSRF policy of the render running on a page, from its render options.
+// A page without one — still loading the client, or between renders — gets
+// the default policy, which blocks cloud-metadata endpoints.
+const renderPolicies = new WeakMap();
+// The directory a `file:` client page is served from, or null for any other
+// client URL. Its own bundle is the only thing the page may read from disk.
+const clientDirectory = (clientUrl) => {
+    if (!isFileUrl(clientUrl))
+        return null;
+    try {
+        return path.dirname(fileURLToPath(new URL(clientUrl)));
+    }
+    catch {
+        return null;
+    }
+};
+// The client's own services: the license check and Google Fonts. Fixed public
+// hosts, so they skip the render's URL policy — a strict `fetchGuard` written
+// with only the design's assets in mind must not cost the license or the fonts.
+const POLOTNO_SERVICE_HOSTS = [
+    'api.polotno.com',
+    'fonts.googleapis.com',
+    'fonts.gstatic.com',
+];
+const LOCAL_FILE_REFUSED = 'polotno-node: the render page may not read local files directly. ' +
+    'Put the file: URL in the design instead (polotno-node serves those), ' +
+    'or read the file in Node and pass its contents in.';
+const isInsideDirectory = (fileUrl, directory) => {
+    if (!directory)
+        return false;
+    try {
+        const filePath = fileURLToPath(new URL(fileUrl));
+        return filePath.startsWith(directory + path.sep);
+    }
+    catch {
+        return false;
+    }
 };
 // Match names across caller-supplied Puppeteer copies, not class identity.
 const isProtocolFailure = (error) => error instanceof Error &&
@@ -483,30 +509,58 @@ export const createPage = async (browser, url, requestInterceptor, useFontCache
         // 0 passes through as puppeteer's "no timeout", exactly as it does for
         // `goto`: a caller who disabled the budget meant it.
         page.setDefaultTimeout(navigationTimeout);
-        // One handler per page, always attached, because `ensureServing` may turn
-        // interception on later. It stays inert until then.
+        // Every request the page sends passes here, so interception is always on.
+        // Our own answers first, then the URL policy, so the caller's interceptor cannot skip it.
+        const ownDirectory = clientDirectory(url);
         page.on('request', (request) => {
-            if (!intercepting.has(page))
-                return;
             if (localMedia.tryRespond(request)) {
                 return;
             }
             if (useFontCache && fontCache.tryRespond(request)) {
                 return;
             }
-            if (typeof requestInterceptor === 'function') {
-                requestInterceptor(request);
-            }
-            else {
-                request.continue().catch(() => { });
-            }
+            void (async () => {
+                const requestUrl = request.url();
+                // The launch args allow file access, so only this can refuse a raw `file:` read.
+                if (isFileUrl(requestUrl)) {
+                    if (!isInsideDirectory(requestUrl, ownDirectory)) {
+                        // Answered, not aborted, so a script reading it gets the reason.
+                        console.warn(`${LOCAL_FILE_REFUSED} Refused: ${requestUrl}`);
+                        await request.respond({
+                            status: 403,
+                            contentType: 'text/plain',
+                            body: LOCAL_FILE_REFUSED,
+                        });
+                        return;
+                    }
+                }
+                else if (/^https?:/i.test(requestUrl) &&
+                    !fontCache.isHttpsHost(requestUrl, POLOTNO_SERVICE_HOSTS)) {
+                    try {
+                        // Redirect hops arrive here as requests of their own.
+                        await assertUrlAllowed(requestUrl, renderPolicies.get(page) ?? {});
+                    }
+                    catch (e) {
+                        // The client reports the failed asset; the log names the rule.
+                        console.warn(`polotno-node: ${e.message}`);
+                        await request.abort('blockedbyclient');
+                        return;
+                    }
+                }
+                if (typeof requestInterceptor === 'function') {
+                    requestInterceptor(request);
+                }
+                else {
+                    await request.continue();
+                }
+            })().catch(() => {
+                // The page may be gone, or the request already handled.
+            });
         });
         if (useFontCache) {
             page.on('response', (response) => fontCache.capture(response));
         }
-        if (useFontCache || typeof requestInterceptor === 'function') {
-            await renderer.run(() => ensureServing(page));
-        }
+        await renderer.run(() => page.setRequestInterception(true));
         // we need to make sure that headless is inside user agent
         // because we use it for key validation check
         // but also lets NOT just overwrite default one, because Google Fonts may send "reduced" version of font
@@ -554,15 +608,19 @@ export const createPage = async (browser, url, requestInterceptor, useFontCache
  * trade a URL the browser might load for one nothing answers.
  */
 const evaluateServed = async (page, func, json, ...rest) => {
-    const served = ourPages.has(page)
-        ? serveLocalFiles(json)
-        : nothingToServe(json);
+    // The render options, as in the instance `run`.
+    const attrs = rest[0];
+    if (attrs?.allowLocalFiles === false)
+        assertNoLocalFiles(json);
+    if (!ourPages.has(page))
+        return page.evaluate(func, json, ...rest);
+    const served = serveLocalFiles(json);
+    renderPolicies.set(page, attrs ?? {});
     try {
-        if (served.serving)
-            await ensureServing(page);
         return await page.evaluate(func, served.json, ...rest);
     }
     finally {
+        renderPolicies.delete(page);
         served.release();
     }
 };
@@ -723,6 +781,9 @@ export const createInstance = async ({ key, url, useParallelPages = true, browse
         }
     }
     const run = async (func, ...args) => {
+        // Before a page is opened: a rejected design must not leave one behind.
+        if (args[1]?.allowLocalFiles === false)
+            assertNoLocalFiles(args[0]);
         const page = useParallelPages ? await openClientPage() : firstPage;
         if (busyPages.indexOf(page) >= 0) {
             throw polotnoError('EXPORT_FAILED', 'Current rendering context is busy with another task. Please use `useParallelPages: true` option to run multiple tasks in parallel or make sure previous task is finished before starting a new one.', { reason: 'busy' });
@@ -735,6 +796,8 @@ export const createInstance = async ({ key, url, useParallelPages = true, browse
         const served = serveLocalFiles(args[0]);
         const runArgs = [served.json, ...args.slice(1)];
         busyPages.push(page);
+        // The page's request handler reads it for every request of this render.
+        renderPolicies.set(page, args[1] ?? {});
         // Setup profiling if profilePath is provided
         let cdpSession = null;
         let profilerStopped = false;
@@ -743,9 +806,6 @@ export const createInstance = async ({ key, url, useParallelPages = true, browse
         const withRenderer = renderer.run;
         let succeeded = false;
         try {
-            if (served.serving) {
-                await withRenderer(() => ensureServing(page));
-            }
             if (profilePath) {
                 cdpSession = await withRenderer(() => page.target().createCDPSession());
                 await withRenderer(() => cdpSession.send('Profiler.enable'));
@@ -840,6 +900,7 @@ export const createInstance = async ({ key, url, useParallelPages = true, browse
         finally {
             renderer.dispose();
             busyPages.splice(busyPages.indexOf(page), 1);
+            renderPolicies.delete(page);
             if (!succeeded && useParallelPages)
                 closeFailedPage(page);
             served.release();
@@ -883,6 +944,10 @@ export const createInstance = async ({ key, url, useParallelPages = true, browse
         return blob;
     };
     const renderVideoFile = async (json, outputPath, attrs, status) => {
+        // The caller's design is checked here, before its media is downloaded: the
+        // downloads come back as `file:` URLs of our own, which must be served.
+        if (attrs?.allowLocalFiles === false)
+            assertNoLocalFiles(json);
         const shouldDownloadMedia = !hasCustomClientUrl && !(attrs && attrs.skipDownloads);
         const prepared = shouldDownloadMedia
             ? await prepareLocalMediaForVideoExport(json, {
@@ -1026,6 +1091,7 @@ export const createInstance = async ({ key, url, useParallelPages = true, browse
                 }
             }, prepared.json, {
                 ...attrs,
+                allowLocalFiles: true,
                 reportProgress: Boolean(attrs.onProgress),
                 onProgress: attrs.onProgress ? status.progress : undefined,
                 exposeFunctions: {
@@ -1050,11 +1116,11 @@ export const createInstance = async ({ key, url, useParallelPages = true, browse
             await file.close();
             // Convert audio to AAC if needed
             status.update({ stage: 'postprocess' });
-            if (isFfmpegAvailable()) {
-                const codec = getAudioCodec(outputPath);
+            if (await isFfmpegAvailable()) {
+                const codec = await getAudioCodec(outputPath);
                 if (codec && codec !== 'aac') {
                     const tempPath = outputPath + '.tmp.mp4';
-                    convertAudioToAac(outputPath, tempPath);
+                    await convertAudioToAac(outputPath, tempPath);
                     await fs.promises.rename(tempPath, outputPath);
                 }
             }

package/lib/ssrf-guard.d.ts

@@ -1,15 +1,17 @@
-export interface FetchPolicy {
-    /** Also block loopback, link-local and private (RFC1918 / ULA) addresses. */
-    blockPrivateNetwork?: boolean;
-    /**
-     * Full override. Return `false` to reject the URL. When provided, the
-     * built-in IP checks are skipped and this is the sole authority.
-     */
-    fetchGuard?: (url: string) => boolean | Promise<boolean>;
-}
+import { type FetchPolicy } from '@polotno/core/ssrf-guard';
+export type { FetchPolicy };
 /**
- * Throw a branded FETCH_FAILED error if `urlString` must not be fetched under
- * `policy`. Resolves DNS for hostnames and checks every returned address.
- * No-throw = allowed.
+ * Throw `FETCH_FAILED` (marked `ssrfBlocked: true`) if `url` must not be
+ * fetched under `policy`. Hostnames are resolved and every address checked.
  */
-export declare const assertUrlAllowed: (urlString: string, policy?: FetchPolicy) => Promise<void>;
+export declare const assertUrlAllowed: (url: string, policy?: FetchPolicy) => Promise<void>;
+/**
+ * One `fetch` with `assertUrlAllowed` applied to the URL and every redirect
+ * hop (at most 5). Resolves with an ok response; a blocked URL, an HTTP error
+ * or a timeout rejects with `FETCH_FAILED`. `init.timeout` bounds the wait for
+ * the response headers (default 30 s), not the body.
+ */
+export declare const guardedFetch: (url: string, policy?: FetchPolicy, init?: {
+    signal?: AbortSignal;
+    timeout?: number;
+}) => Promise<Response>;