Assets

AssetId is a validated relative logical ID, never a path or URL. Sources resolve it against a root: the filesystem source canonicalises to catch symlink escapes, and UrlRoot percent-encodes and normalises bases with rules exercised on every target rather than only in a browser. The load queue is bounded, rejects duplicates, and carries a generation token so a late completion cannot overwrite a replacement. Textures, fonts, sheets, scripts, and scene JSON decode through typed decoders. Nothing pretends browser I/O is synchronous.

A TextureId is a generation-checked slot handle, so the renderer's texture registry can release one texture and reuse its slot without a handle nobody updated drawing whatever lands there next.

AssetLoader drives all of that in one place — request, enqueue, drain, decode, apply — so a caller does not have to know the order. Requesting is idempotent, a failure is reported once rather than retried forever, and retain releases what is no longer wanted and says which IDs went, so a host can drop whatever it built from them. GPU upload stays with the host, which is the only thing that owns a device.

AssetManifest records what a project ships — each asset's length and the SHA-256 of its stored bytes — as a versioned, ID-ordered file. A loader given one holds arriving bytes to it, so a truncated response or a stale cache entry is an error naming the asset rather than a picture from last week; an asset the manifest does not list still loads. The editor picks one up from the directory a scene lives in. The generic browser host sizes each kind's bounded request queue from that manifest, so projects with more than the asset pipeline's default 64 textures or other same-kind assets still load without increasing fetch concurrency.

A corpus of deliberately awkward images — every PNG colour type, sixteen bits per channel, an interlaced encoding, and a JPEG — is decoded and checked pixel by pixel on both native and wasm32-unknown-unknown, so a texture cannot decode one way in the editor and another in the browser.

FontAssetDecoder validates OpenType bytes and records their declared family; text binds that project-owned face under the scene's logical asset reference, so native and browser builds never substitute different installed fonts.

ProfileDocument is the reusable-data counterpart to a prefab: a versioned .profile asset with an author label, an optional game-defined type, and a nested JSON-shaped value payload. ProfileAssetDecoder validates it through the same native/browser loading path, and the manifest records it as profile. Unlike a prefab it creates no entity; many script components can hold the same logical profile reference and read one loaded document.

On native, AssetWatch notices when the file behind a loaded asset changes and AssetLoader::reload loads it again, by polling modification time and length rather than subscribing to filesystem events.