Skip to content

Assets and Security

Serialization policy

  • Font binaries are embedded in the Bento document and declared through its font table.
  • Images, SVG, chart data or snapshots, audio, video, and posters are external.
  • The contract stores only asset ID, kind, locator, media type, and lowercase SHA-256 digest.
  • Authentication material is outside the contract and repository.

Runtime validation rejects non-font data URIs, inline SVG payload, embedded chart data, missing bindings, unsafe schemes, executable HTML, event handlers, and editor collaboration metadata.

Loading policy

The player fetches only declared assets. A response must:

  • resolve to the exact declared locator without redirect;
  • return success;
  • return the declared media type; and
  • match the declared SHA-256 digest.

Requests are deduplicated only when locator, media type, and digest agree. The player records declared asset requests in diagnostics. Verified image, SVG, chart-snapshot, audio, video, and poster bytes are exposed to the renderer through player-local blob URLs, preventing an unchecked second fetch. Chart data is decoded only from verified bytes. Embedded fonts are injected locally and make no network request.

Asset fetches have a bounded timeout and stable network, HTTP, redirect, media-type, integrity, and decode error codes. Credential-bearing, query-string, and fragment locators are rejected by the contract.

The message bridge accepts only the configured origin and parent source. Representative public Bento update and collaboration URLs are denied. The production player build defines hard offline mode and excludes editor, updater, collaboration, autosave, and speaker-view entry points.

Readiness

assets-ready is emitted only after schema and compatibility validation, integrity-checked external asset materialization, all document image and poster decodes, all document media metadata, and embedded document font loading. Capture consumers must not begin before that event.

Unity/Vuplex transport and capture security remain deferred to their owning repository and are not verified by ANU-11.

Editor asset boundary

The editor uses the same materialize/dehydrate rules while switching surfaces and before host save requests. It constructs no production collaboration session, accepts host messages only from the configured origin and parent source, and exposes no asset upload, authentication, or signed-URL storage field. The packaged template catalog is static local JSON generated from repository-owned family definitions; it is the only additional ANU-18 data resource and does not authorize public network access.