polotno-node 3.2.0 → 3.4.0

package/LICENSE.md

@@ -1,10 +1,24 @@
-Polotno SDK License
+# Polotno SDK License
 
-Copyright (c) 2014–present Anton Lavrenov.
+Copyright (c) 2014–present Anton Lavrenov. All rights reserved.
 
-This package is part of the Polotno SDK. It is not open source. Use in
-production requires a valid Polotno subscription.
+You can use this package for evaluation, development, and testing for 60 days.
+After 60 days, all use requires a valid Polotno subscription.
 
-Full license terms: https://polotno.com/legal/license
+Production use requires a valid Polotno subscription at any time. Production use
+is use of this package in a live product, service, or internal tool, including a
+tool that only your own employees use. Development, testing, continuous
+integration, and evaluation are not production use, wherever they run.
 
-The software is provided "as is", without warranty of any kind.
+An AI agent can use this package for you under the same terms. The agent gets no
+rights of its own.
+
+Do not reverse engineer, decompile, or change this package. Do not republish or
+sublicense it. Do not bypass a license check or a technical limit.
+
+This package is provided "as is", without warranty. To the maximum limit that
+the law permits, the copyright holder has no liability for a claim or for
+damages.
+
+Subscription terms (payment, duration, support):
+https://polotno.com/legal/license

package/README.md

@@ -71,6 +71,10 @@ const instance = await createInstance({
   // see "Custom Browser Arguments" section for more details
   browserArgs: ['--custom-arg'],
 
+  // executablePath - launch this browser binary instead of the one we pick,
+  // e.g. the Chrome installed in your container. Ignored if you pass `browser`.
+  executablePath: '/usr/bin/google-chrome-stable',
+
   // useFontCache - cache Google Fonts responses (in memory + on disk in the
   // OS temp folder, shared across processes) and serve them to every page.
   // Every page starts with an empty HTTP cache, so without it each render
@@ -275,6 +279,17 @@ const url = await instance.jsonToVideoDataURL(json, {
 
 When `skipDownloads` is enabled, `polotno-node` will skip both remote-media downloading and the conditional video preprocessing described above.
 
+### Restricted media hosts
+
+Server-side downloads block cloud-metadata addresses (e.g. `169.254.169.254`) by default. Normal URLs, `localhost`, and private hosts still work. To restrict further:
+
+```js
+await instance.jsonToVideoFile(json, 'out.mp4', {
+  blockPrivateNetwork: true, // also block loopback / private IPs
+  fetchGuard: (url) => isAllowed(url), // custom allow rule (checked per redirect hop)
+});
+```
+
 ### `attrs.assetLoadTimeout`
 
 You can add `assetLoadTimeout` attribute to `attrs` object. It will be used to set timeout for loading assets. By default it is 30000ms.
@@ -408,7 +423,7 @@ console.log(args);
 // ['--disable-web-security', '--allow-file-access-from-files', '--disable-gpu', ...]
 ```
 
-**Platform compatibility:** Using `@sparticuz/chromium` args works best on **Linux** and **macOS**. On **Windows**, these args may not work as expected, so the library automatically skips them on Windows. When manually combining args, be aware of platform differences.
+**Platform compatibility:** `@sparticuz/chromium`'s args are tuned for the chromium binary that package ships, so `polotno-node` applies them only when it launches that binary — on **Linux**, when you did not pass an `executablePath` of your own. Any other browser (puppeteer's bundled Chromium on macOS and Windows, or one you supply) gets the polotno `args` alone. Keep the same pairing when you combine args by hand.
 
 ### Using with custom browser
 
@@ -420,10 +435,9 @@ import chromium from '@sparticuz/chromium';
 import puppeteer from 'puppeteer-core';
 
 // Combine chrome.args (base defaults) with polotno-node's args (optimizations)
-// This works best on Linux/macOS
+// The @sparticuz/chromium binary is Linux-only, so this pairing is too
 const browser = await puppeteer.launch({
   args: [...chromium.args, ...args],
-  defaultViewport: chromium.defaultViewport,
   executablePath: await chromium.executablePath(),
   headless: true,
   ignoreHTTPSErrors: true,
@@ -435,11 +449,11 @@ const instance = await createInstance({
 });
 ```
 
-**Note:** `polotno-node`'s `args` are designed to work on top of `@sparticuz/chromium`'s args for optimal server-side rendering on Linux/macOS environments.
+**Note:** `polotno-node`'s `args` are designed to work on top of `@sparticuz/chromium`'s args for optimal server-side rendering on Linux, where that binary runs.
 
 ### Modifying default arguments
 
-If you need to add, remove, or replace specific arguments (Linux/macOS):
+If you need to add, remove, or replace specific arguments (Linux):
 
 ```js
 import { createInstance, args } from 'polotno-node';
@@ -449,7 +463,6 @@ import puppeteer from 'puppeteer-core';
 // Add custom arguments on top of chrome.args and polotno args
 const browser = await puppeteer.launch({
   args: [...chromium.args, ...args, '--custom-arg', '--another-custom-arg'],
-  defaultViewport: chromium.defaultViewport,
   executablePath: await chromium.executablePath(),
 });
 
@@ -457,7 +470,6 @@ const browser = await puppeteer.launch({
 const filteredArgs = args.filter((arg) => arg !== '--disable-gpu');
 const browser2 = await puppeteer.launch({
   args: [...chromium.args, ...filteredArgs],
-  defaultViewport: chromium.defaultViewport,
   executablePath: await chromium.executablePath(),
 });
 
@@ -467,16 +479,15 @@ const customArgs = args.map((arg) =>
 );
 const browser3 = await puppeteer.launch({
   args: [...chromium.args, ...customArgs],
-  defaultViewport: chromium.defaultViewport,
   executablePath: await chromium.executablePath(),
 });
 ```
 
-**Note:** These examples assume Linux/macOS environment where `chromium.args` work properly.
+**Note:** These examples assume a Linux environment, where the `@sparticuz/chromium` binary and its `args` belong together.
 
 ### Combining with `browserArgs` option
 
-When using `createInstance()` or `createBrowser()`, you can provide additional arguments via `browserArgs` option. Internally, this automatically combines `chrome.args` + `args` + your custom `browserArgs`:
+When using `createInstance()` or `createBrowser()`, you can provide additional arguments via `browserArgs` option. Internally, this combines the polotno `args` with your custom `browserArgs`, and adds `chromium.args` only when it launches the `@sparticuz/chromium` binary — that is, on Linux when you did not pass an `executablePath` of your own. Those flags are tuned for that binary and are not applied to a browser you supply:
 
 ```js
 import { createInstance } from 'polotno-node';
@@ -485,7 +496,7 @@ const instance = await createInstance({
   key: 'your-key',
   browserArgs: ['--custom-arg', '--another-arg'],
 });
-// Internally merges: chrome.args + polotno args + browserArgs
+// Merges: polotno args + browserArgs (+ chromium.args on the bundled binary)
 ```
 
 ## Your own client
@@ -595,7 +606,6 @@ export const handler = async (event) => {
     // Combine chromium args with polotno-node's optimized args
     // Works well on AWS Lambda (Linux environment)
     args: [...chromium.args, ...args],
-    defaultViewport: chromium.defaultViewport,
     executablePath: await chromium.executablePath(),
     headless: true,
     ignoreHTTPSErrors: true,
@@ -712,13 +722,11 @@ import puppeteer from 'puppeteer-core';
 const makeInstance = async () => {
   const browser = await puppeteer.launch({
     // Combine chromium args with polotno-node's optimized args
-    // Best for Linux/macOS environments
     args: [...chromium.args, ...args],
-    defaultViewport: chromium.defaultViewport,
     executablePath: await chromium.executablePath(
       'https://github.com/Sparticuz/chromium/releases/download/v110.0.1/chromium-v110.0.1-pack.tar',
     ),
-    headless: chromium.headless,
+    headless: true,
     ignoreHTTPSErrors: true,
   });
 
@@ -753,3 +761,11 @@ It may mean that Polotno Client Editor was not loaded in `puppeteer` instance. I
   }
 }
 ```
+
+## License
+
+See [LICENSE.md](./LICENSE.md).
+
+This package contains a compiled copy of the `polotno` editor in `dist/`. No
+dependency entry shows this, so a dependency scan will not reveal it. The editor
+obeys the same terms as this package.