Serve application assets deliberately

Steps

Distinguish ordinary public UI assets from private framework documentation and protected media. This knowledge base serves its non-sensitive CSS, JavaScript, and application icons directly; it does not route approved document bodies through public assets.

<link rel="stylesheet" href="/assets/css/knowledge.css">
<script src="/assets/js/knowledge.js" defer></script>

For transformation/cache APIs in other applications, use the exact currently documented contracts in Assets. Do not infer that a stylesheet determines every image dimension or that arbitrary query transforms are safe.

Verify

Check a stylesheet's actual status and Content-Type, deployment path, case, and cache version. A 200 response containing a login page is not a working CSS asset.

Candidate image and cache limits

Current candidate URLs preserve ordinary public text paths. Image variants use explicit bounded size/fit/format/quality and source fingerprints; generation checks the loaded version before atomic publication. Long-lived instances rehash sources; scoped GD concurrency/ETag/cleanup checks do not certify every codec or hostile upload. See Assets for actual limits.

Public assets are not authorized private downloads or hotlink protection. There is no request-time CSS/JavaScript minifier or automatic CSS image-sizing analysis. The knowledge base's static shell and no-private-cache/PWA rules remain unchanged; these candidate mechanisms have not been installed here.

Editorial provenance

Source: resources/guides/assets.md. Source SHA-256: 3a42f53cfc8440a28f0662512b1b2828654feb1206510a6d96e8d7ac2661d84f.

Knowledge-base application source; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.