ZZD public AI gateway · zzd_public_ai_gateway_v2
Resource: 05 · Assets and dependencies / 上传
Canonical map: https://zzd.show/docs/ai/map.json
Full handbook: https://zzd.show/llms-full.txt

# Assets, uploads, and dependencies

Upload source-specific project assets; use pinned public CDNs only
for appropriate shared libraries.

## Choose the right asset surface

- Photo: managed raster/thumbnail-like visual assets.
- Upload: video, audio, model, font, JSON, code support, binary, and
  general files.
- StaticFileBinding: an explicit attachment of an uploaded file to a
  Show with a stable mount path and semantic role.
- `cdns` / `esm`: pinned shared browser libraries and module maps,
  not a dumping ground for source-specific media.

Use the logged-in editor's upload and binding UI. Direct upload,
upload-from-URL, and text-upload helpers may be present in that UI.
The current upload-from-URL policy allows at most 50 MB per fetched
file, applies basic unsafe/private-network target checks, and shares
an aggregate account storage cap currently set to 1 GB. Prefer direct
upload. Fetch only user-approved public HTTP(S) assets; never use
credential-bearing or signed private URLs, and do not treat redirect
handling as a complete security boundary. Treat the UI/response as
authoritative because limits may evolve. Never bypass size, MIME,
ownership, SSRF, or quota checks.

## Asset manifest

Keep a compact project manifest with:

- semantic role and useful description/alt/context;
- original project-relative path when applicable;
- resulting ZZD asset reference;
- media/type/codec;
- runtime consumers;
- binding mount path and role, if bound;
- license/rights note where needed.

Enumerate more than static `<img>` tags: CSS `url()`, fonts,
`srcset`, posters, dynamic imports/fetches, GLTF buffers/textures,
Draco decoders, shaders, workers, wasm, Lottie/Rive, HLS segments,
audio, frame sequences, and state-revealed assets. Audit the network
after loader, scroll, click, hover, drag, route, and media changes.

Replace local-machine, temporary, signed, and source-host URLs with
ZZD-managed references. Preserve distinct URL identity when a loader
caches or mutates resources by URL. Patch the smallest source-owned
URL builder rather than globally rewriting network traffic.

Do not upload `.env`, credentials, private keys, source-control
metadata, private datasets, server configuration, analytics beacons,
trackers, or irrelevant build caches. Do not hotlink source-specific
media. Do not expose storage internals in Pieces or prompts.

Validation must include MIME and actual decodability. For example,
a browser may fetch a video successfully and still reject its codec;
a model file may return 200 and still have an invalid binary header.
Inspect rendered `currentSrc`, natural dimensions, media state, model
load completion, and errors after real interaction.