Runtime validation & resource governance

Apexify.js 6 treats runtime validation and bounded resource usage as part of the public contract. TypeScript is not a security boundary: JavaScript/JSON callers, non-finite numbers, oversized images/scenes/media, excessive frame counts, invalid runtime configuration, and unbounded persistent/transient registries are rejected at runtime.

1import {2  configureApexifyRuntime,3  getDefaultApexifyRuntimeConfig,4  resolveApexifyRuntimeConfig,5  resetApexifyRuntimeConfig,6  ApexifyInputError,7  ApexifyConfigError,8  ApexifyResourceLimitError,9} from "apexify.js";

#Complete default RenderLimits

These values are the current 6.0.0 defaults from DEFAULT_APEXIFY_RUNTIME_CONFIG.

Most limits must be finite positive integers. maxAudioDurationSeconds, maxVideoDurationSeconds, and maxVideoFps are finite positive continuous limits. Additional configuration invariants include:

• maxAudioChannels <= 2;
• maxSceneDepth <= maxNestedSurfaces;
• maxSceneTotalPixels >= maxTotalPixels;
• maxBatchConcurrency <= maxBatchOperations;
• maxRemoteImageBytes <= maxImageSourceBytes.

#Phase 14 admission-bound clarification

maxCollectionItems is not only an array-length limit. Final Phase 14 hardening also uses it as the finite admission ceiling for process/instance state that can otherwise grow from caller-controlled unique keys:

• painter.assets registry entries, nested values and palette entries;
• plugin API registrations, installed/pending plugin names, and a plugin installation rollback journal;
• process-wide registered/pending native font keys;
• unique in-flight decoded-image promises;
• template flex/grid child collections.

Template flex/grid child measurement is also executed through a worker pool capped by maxBatchConcurrency; it does not create one active measurement promise per user-provided child.

These checks mean a workload can fail with ApexifyResourceLimitError before a registry mutation, decode launch, layout fan-out, or native font admission. Treat that as intentional backpressure/resource policy.

#Network policy defaults

trustedNetworkAccess: true is invalid without at least one explicit allowedHosts entry. See Security deployment for DNS/SSRF/redirect behavior.

#Cache policy defaults

1{2  enabled: true,3  ttlMs: 5 * 60_000,4  maxEntries: 128,5  maxBytes: 128 * 1024 * 1024,6}

The decoded resource cache is bounded by both entry count and bytes and expires entries by TTL. Unique in-flight decodes are separately bounded and are removed from the in-flight map in finally. Disable/reduce caching when process memory is more constrained; do not wrap Apexify with an unbounded global cache.

#FFmpeg policy defaults

1{2  processTimeoutMs: 5 * 60_000,3  probeTimeoutMs: 5_000,4  maxStdoutBytes: 10 * 1024 * 1024,5  maxStderrBytes: 30 * 1024 * 1024,6}

ffmpegPath / ffprobePath are optional. The session layer can also use APEXIFY_FFMPEG_PATH / APEXIFY_FFPROBE_PATH before falling back to commands on PATH.

#Temp policy defaults

1{2  rootDirectory: undefined,3  retainFiles: false,4}

Temporary workspace parent precedence is explicit operation/session option → runtime config → APEXIFY_TEMP_DIR → OS temp. APEXIFY_RETAIN_TEMP_FILES=true is a compatibility/debug override and should remain false in production.

#Diagnostics

diagnostics.handler is optional and receives structured { level, code, message, details? } events. The configuration validator rejects a non-function handler.

#Read and override policy

1const current = getDefaultApexifyRuntimeConfig();2console.log(current.limits.maxTotalPixels);3 4configureApexifyRuntime({5  limits: {6    maxCanvasDimension: 8192,7    maxTotalPixels: 32_000_000,8    maxDecodedImagePixels: 32_000_000,9    maxBatchConcurrency: 2,10    maxAudioDurationSeconds: 120,11    maxAudioBytes: 128 * 1024 * 1024,12  },13  network: {14    timeoutMs: 10_000,15  },16});17 18resetApexifyRuntimeConfig();

configureApexifyRuntime() merges supplied sections into the current process-wide config and validates the resulting whole configuration. resolveApexifyRuntimeConfig() validates/normalizes without changing the process-wide default.

Do not raise a limit merely to silence ApexifyResourceLimitError. A higher canvas/decoded-image/GIF/audio/video/concurrency/registry budget increases worst-case memory, CPU, I/O, native-state, or process pressure.

#Validation coverage

Resource/validation policy is enforced across the high-cost public surface, including:

• canvases, backgrounds, gradients, patterns and filters;
• image placement/decode, crop/mask/distortion/mesh/filter utilities, collage/stitch/blend/palette;
• text arrays/content/coordinates/typography effects and native-font registration admission;
• scene roots, nested surfaces, layer/domain counts, aggregate pixels/text/remote assets and transforms;
• templates, including bounded flex/grid child collections and measurement fan-out;
• assets and plugin registries/installation journals;
• GIF dimensions/frames/generated frames/resource cost/overlays;
• audio duration/sample rate/channels/events/layers/partials and peak working-memory estimates;
• video time/FPS/dimensions/bitrate/overlays/merge inputs/frame extraction/audio tracks/pipeline layers;
• paths/pixels/hit-detection collections;
• batch/chain work;
• output/upload/save validation.

Apexify also inspects image metadata so oversized decoded images can be rejected before full decode where practical, and validates audio/video structures before the largest allocation/process work where practical.

#Error handling

1try {2  await painter.createCanvas({ width: 50_000, height: 50_000 });3} catch (error) {4  if (error instanceof ApexifyResourceLimitError) {5    console.error(error.limit, error.maximum, error.actual);6  }7}

Resource-limit errors are policy failures. Do not automatically retry the unchanged request. Reduce the work or deliberately adjust deployment policy after measuring available capacity.

Apexify 6 runtime code uses the structured ApexifyError hierarchy for runtime/public failure contracts. Do not depend on generic Error messages for branching logic; use the concrete error class/code and documented metadata.

#Audio memory accounting

maxAudioBytes is a peak-allocation guard. It accounts for relevant coexisting Float32 render/mix/source/transformed buffers and final PCM16 WAV allocation rather than checking only final output bytes.

#Concurrency

batch() is bounded by maxBatchOperations and maxBatchConcurrency. Template flex/grid measurement uses the same bounded worker concept. Remote media acquisition is separately bounded by maxConcurrentRemoteFetches, while unique in-flight image decodes additionally have a finite collection admission limit. A deployment may therefore accept a large high-level job while allowing only a small number of active heavy operations and remote requests.

Use Performance & memory for tuning and Security deployment for untrusted services.