Manage article assets

Pasted or dropped images enter an upload lifecycle without sending permanent cloud credentials to the browser. A local object URL provides immediate visual feedback while the server validates and stores the asset.

Key policy

New managed keys combine:

• a configured managed prefix;
• the immutable document ID;
• a content hash; and
• a sanitized extension.

This makes uploads idempotent and groups new resources naturally by article. Changing a file produces a new immutable key instead of overwriting bytes behind an existing cache URL.

Image policy

Original-first is the default. With image processing disabled, the server checks the declared MIME type and decoded content, then stores the original bytes, format, semantic extension, and metadata unchanged. It does not silently turn an upload into WebP.

A Site owner may explicitly enable processing and choose original or WebP output, quality, maximum width, and whether metadata is stripped. Encoding runs in a memory-bounded Worker with a hard deadline; a timed-out Worker is terminated before the provider can be called. A policy change applies only to new uploads—it never recompresses or renames existing local or remote resources. The editor inserts Markdown only after the provider returns the durable public URL. ResourceRecord remains that upload result, not a separate persistent resource entity.

Legacy resources

Existing resource paths are not migrated automatically. Configure them as protected prefixes—for example static—so Studio cannot overwrite or delete them. New article-scoped resources and old paths may coexist indefinitely.

After baseline adoption, Studio carries protected entries forward from the verified manifest even when a later generator omits them. If generated bytes under a protected path differ, the baseline bytes remain authoritative and the release log records how many protected objects were preserved. A generated protected path that is absent from the baseline fails closed; move new files to the configured article-scoped managed prefix instead.

Remove unreferenced managed assets

Choose Check unreferenced assets only after the current draft is saved. Studio lists article-scoped assets and compares their exact public URL/key with the acknowledged front matter and Markdown. It shows the proposed deletions, sizes, and count without deleting anything.

Deletion requires a second browser confirmation plus a server-issued digest of the source revision, draft version, asset IDs, and content hashes. If any of those inputs changes, the server returns a conflict and requires a new preview. Provider deletion also verifies the expected content hash. The scan is confined to the current document’s managed prefix, so configured legacy/protected prefixes are never candidates.