Appearance
Resource limits
Available in 0.4.0. Both createLipat(bytes, {limits}) and createLipatFromModule(module, {limits}) accept an immutable engine-wide admission policy. Native Rust exposes corresponding *_with_limits functions and a shared lipat_model::ResourceLimits. Native and WASM enforce the same processing budgets.
Font-family names also have a fixed 1024-byte bound to prevent inherited style metadata from expanding excessively. Limits may only be lowered from the hard ceilings below. Omitted fields keep their defaults. Values must be nonnegative integers; request bytes and XML nodes must be positive. Unknown fields, invalid numbers and raised ceilings fail initialization with invalidLimits. Exceeding an admitted budget returns resourceLimit, with the relevant budget named in the message. Failed edits never commit a partial document.
| Field | Default / hard ceiling | Enforcement |
|---|---|---|
maxRequestBytes | 96 MiB | SDK serialized UTF-8 JSON size, before native request-buffer allocation; native canonical request size before operation decoding |
maxPptxBytes | 32 MiB | SDK byte input before base64 encoding; native input before ZIP parsing |
maxExpandedBytes | 64 MiB | Cumulative declared and actual ZIP expansion, with bounded entry reads |
maxEntryBytes | 32 MiB | Each ZIP entry before and during expansion |
maxEntries | 10000 | ZIP central-directory entry count before expansion |
maxXmlBytes | 8 MiB | XML byte admission before DOM parsing; conventional .xml/.rels entries are also capped during ZIP reads |
maxXmlNodes | 200000 | Per XML part, inside the XML parser |
maxSlides | 10000 | Source/scene validation and referenced PPTX slides before slide traversal |
maxNodes | 100000 | Source authoring nodes during validation, before layout; includes containers |
maxDepth | 64 | Source container depth (root = 0) and nested PPTX groups during traversal |
maxAssetBytes | 64 MiB | Aggregate decoded asset bytes before base64 decoding/copying source assets, or before encoding imported image assets |
maxTextBytes | 1000000 | UTF-8 content bytes per source/scene node; list and table content is combined; PPTX text is checked before copying runs |
maxTextLines | 10000 | Resolved lines per text node, checked while wrapping; parsed hard lines and source list items are also bounded |
maxSceneElements | 100000 | Cumulative primitives during layout or PPTX materialization, plus scene admission |
maxTableCells | 10000000 | Cumulative table cells, including headers and importer padding |
maxChartPoints | 100000 | Cumulative chart values (categories × series), before materializing chart caches or compiling source |
maxLayoutWork | 100000000 | Layout/node visits, font/glyph/asset index entries, inherited font-family bytes copied, twice the UTF-8 bytes of every text measurement, and uncached base64 image bytes inspected for intrinsic geometry; charged before the corresponding work |
A flat scene has no authoring hierarchy. maxNodes applies when validating source or lifting a scene into a new canvas document; maxSceneElements bounds flat scene admission and parser/compiler materialization. Parser work includes temporary inherited/decorative objects, so it may reach this budget before the final retained scene would. Layout work counts repeated measurements, rather than only the finished scene's text.
Host responsibilities
These are processing bounds, not a heap limit, a wall-clock deadline or an interrupt mechanism. WASM allocation, JavaScript serialization, XML structures, snapshots and output buffers still consume memory. WASM memory can retain its high-water allocation after buffers are freed. Metadata strings and JSON/XML decoding remain subject to request/part admission rather than the layout-work counter. Intrinsic image dimensions are cached per compilation so repeated use of an asset does not repeatedly decode its bytes. Export validates its input scene and checks generated entry count, entry sizes, cumulative expanded bytes and final compressed bytes. These checks do not turn the writer into a streaming exporter; part construction and compression still allocate memory. SVG fallback pixels are capped before allocation and consume the configured asset budget.
Bound and authenticate incoming request/file bodies before buffering them. The SDK's JSON size check happens after JavaScript serialization; native JSON decoding is still bounded by the admitted request size. A host needing isolation or hard interruption should use an appropriate worker/process/runtime boundary. A JavaScript timer cannot interrupt a synchronous WASM call on the same thread.
Native generated schemas expose deckSchemas.resourceLimits. The configuration is copied and validated at initialization; later changes to the caller's options do not raise an existing engine's limits. Separate engines can use independent profiles without global mutable policy.