@slices.sh/assets 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Severin MARCOMBES
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/client.d.ts

@@ -0,0 +1,2 @@
+export { assetUrl } from "./services/types";
+export type { AssetDefinition, AssetManifest, AssetsClient } from "./services/types";

package/dist/client.js

@@ -0,0 +1,4 @@
+import { assetUrl } from "./services/types.js";
+export {
+  assetUrl
+};

package/dist/exports.json

@@ -0,0 +1,34 @@
+{
+  ".": {
+    "types": "./dist/index.d.ts",
+    "default": "./dist/index.js"
+  },
+  "./client": {
+    "types": "./dist/client.d.ts",
+    "default": "./dist/client.js"
+  },
+  "./next": {
+    "types": "./dist/next.d.ts",
+    "default": "./dist/next.js"
+  },
+  "./react/use-asset-url": {
+    "types": "./dist/hooks/use-asset-url.d.ts",
+    "default": "./dist/hooks/use-asset-url.js"
+  },
+  "./services/capabilities": {
+    "types": "./dist/services/capabilities.d.ts",
+    "default": "./dist/services/capabilities.js"
+  },
+  "./services/collect": {
+    "types": "./dist/services/collect.d.ts",
+    "default": "./dist/services/collect.js"
+  },
+  "./services/declared": {
+    "types": "./dist/services/declared.d.ts",
+    "default": "./dist/services/declared.js"
+  },
+  "./services/types": {
+    "types": "./dist/services/types.d.ts",
+    "default": "./dist/services/types.js"
+  }
+}

package/dist/hooks/use-asset-url.d.ts

@@ -0,0 +1,4 @@
+/** The URL of a named file, inside a component. It only builds the address; the route serves it. */
+export declare function useAssetUrl(name: string, options?: {
+    config?: string;
+}): string;

package/dist/hooks/use-asset-url.js

@@ -0,0 +1,8 @@
+"use client";
+import { assetUrl } from "../services/types.js";
+function useAssetUrl(name, options = {}) {
+  return assetUrl(name, options);
+}
+export {
+  useAssetUrl
+};

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+import { type Provider } from "@slices.sh/core";
+import type { AssetDefinition, AssetsClient } from "./services/types";
+export type { AssetDefinition, AssetManifest, AssetsClient, AssetsService } from "./services/types";
+export type { AssetsCapabilities } from "./services/capabilities";
+/** What a config of this service says besides its provider. */
+export type AssetsConfigOptions = {
+    /**
+     * Your own pinned files, next to the ones packages declare: `{ url, sha256, bytes, mediaType,
+     * package, version, packagePath, license, versionPolicy? }`. Packages declare theirs in their own
+     * package.json, so no install writes into a file of yours.
+     */
+    entries?: Record<string, AssetDefinition>;
+};
+/**
+ * Configures the assets service: services/assets/<config>.config.ts has
+ * `export default assets({ provider: cdn() })`. This module is client-safe: it holds a description,
+ * and the server half of the provider is loaded lazily.
+ */
+export declare function assets(options: {
+    provider: Provider<AssetsClient>;
+} & AssetsConfigOptions): import("@slices.sh/core").ServiceConfig<AssetsClient>;

package/dist/index.js

@@ -0,0 +1,8 @@
+import { defineService } from "@slices.sh/core";
+const configure = defineService("assets");
+function assets(options) {
+  return configure(options);
+}
+export {
+  assets
+};

package/dist/next.d.ts

@@ -0,0 +1,15 @@
+import "server-only";
+/**
+ * app/api/assets/[config]/[[...path]]/route.ts re-exports this, beside `export const runtime = "nodejs"`:
+ * the route hashes bytes and reads public/assets, and a segment option has to be written in the
+ * route file itself.
+ */
+export declare const GET: (request: Request, context: {
+    params: Promise<{
+        config?: string;
+        path?: string[];
+    }> | {
+        config?: string;
+        path?: string[];
+    };
+}) => Promise<Response>;

package/dist/next.js

@@ -0,0 +1,6 @@
+import "server-only";
+import { serviceRoute } from "@slices.sh/core/server";
+const { GET } = serviceRoute("assets");
+export {
+  GET
+};

package/dist/services/capabilities.d.ts

@@ -0,0 +1,12 @@
+/**
+ * What an assets provider can do. Both are answered at request time and not claimed by a config:
+ * the names a config serves are every installed package's declared files plus its own entries,
+ * and whether a verified copy sits in public/assets is a question about the disk, which
+ * `npx slices assets --check` and the route answer.
+ */
+export type AssetsCapabilities = {
+    /** The config serves the files packages declare, plus its own `entries`. */
+    entries: boolean;
+    /** A verified copy in public/assets is served by a redirect to the static file. */
+    local: boolean;
+};

package/dist/services/collect.d.ts

@@ -0,0 +1,15 @@
+import "server-only";
+import type { AssetDefinition, AssetManifest } from "./types";
+/** Each part of a name, so a name can never climb out of public/assets or name a hidden file. */
+export declare const safeName: (name: string) => boolean;
+/** Whether an entry is one a request may fetch bytes for: a pinned https file of a bounded size. */
+export declare function validDefinition(asset: AssetDefinition): boolean;
+/**
+ * Every file the installed packages declare, found when the first request needs them.
+ *
+ * The list is read once per process: a package that is added or upgraded shows up when the server
+ * restarts, which is also when the app's own copy of the package changes. An entry that is not a
+ * valid name or definition is left out and said once, so a bad declaration costs its own file
+ * and not the rest.
+ */
+export declare function collectEntries(project?: string): AssetManifest;

package/dist/services/collect.js

@@ -0,0 +1,56 @@
+import "server-only";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+import { declared } from "./declared.js";
+const MAX_BYTES = 16 * 1024 * 1024;
+const safeName = (name) => name.split("/").every((part) => /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(part) && part !== "..");
+function validDefinition(asset) {
+  return /^https:\/\//.test(asset.url) && /^[a-f0-9]{64}$/i.test(asset.sha256) && Number.isSafeInteger(asset.bytes) && asset.bytes > 0 && asset.bytes <= MAX_BYTES;
+}
+const ROOTS = [join("node_modules", "@slices"), join("vendor", "slices")];
+function declaredBy(directory) {
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync(join(directory, "package.json"), "utf8"));
+  } catch {
+    return {};
+  }
+  let entries = manifest.slices?.assets;
+  if (typeof entries === "string") {
+    const file = resolve(directory, entries);
+    if (!file.startsWith(resolve(directory) + sep)) return {};
+    try {
+      entries = JSON.parse(readFileSync(file, "utf8"));
+    } catch {
+      return {};
+    }
+  }
+  return entries && typeof entries === "object" && !Array.isArray(entries) ? entries : {};
+}
+let collected;
+function collectEntries(project = process.cwd()) {
+  if (collected?.project === project) return collected.entries;
+  const entries = { ...declared };
+  for (const root of ROOTS) {
+    const base = join(project, root);
+    if (!existsSync(base)) continue;
+    for (const folder of readdirSync(base)) {
+      const directory = join(base, folder);
+      if (!statSync(directory).isDirectory()) continue;
+      for (const [name, asset] of Object.entries(declaredBy(directory))) {
+        if (!safeName(name) || !asset || typeof asset !== "object" || !validDefinition(asset)) {
+          console.warn(`[slices assets] ${folder} declares ${name}, which is not a valid pinned asset; it is not served.`);
+          continue;
+        }
+        entries[name] = asset;
+      }
+    }
+  }
+  collected = { project, entries };
+  return entries;
+}
+export {
+  collectEntries,
+  safeName,
+  validDefinition
+};

package/dist/services/declared.d.ts

@@ -0,0 +1,134 @@
+/**
+ * The files v1 libraries pinned in services/assets/manifest.ts, which no install writes any more.
+ *
+ * A package declares its own files in `package.json` (`"slices": { "assets": { … } }`, see
+ * `collect.ts`), and a declaration there wins over the same name here. Until each package below
+ * carries its own, this list keeps the viewers and the map working: it is shipped code, not an
+ * app file, so it moves with the version of the package it describes.
+ */
+export declare const declared: {
+    "document-pdf/2.15.1/pdfium.wasm": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+    };
+    "document-pptx/0.2.1/native-parser-worker.js": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+    };
+    "document-pptx/0.2.1/pptx_wasm_bg.wasm": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+    };
+    "maplibre/6.11.2/maplibre-gl.mjs": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+    };
+    "maplibre/6.11.2/maplibre-gl-shared.mjs": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+    };
+    "maplibre/6.11.2/maplibre-gl-worker.mjs": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+    };
+    "maplibre/6.11.2/maplibre-gl.css": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+    };
+    "markdown-diagram/11.17.2/mermaid.tiny.js": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+    };
+    "artifact-runtime/react/19.2.4/react.production.js": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+        versionPolicy: "independent";
+    };
+    "artifact-runtime/react-dom/19.2.4/react-dom.production.js": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+        versionPolicy: "independent";
+    };
+    "artifact-runtime/react-dom/19.2.4/react-dom-client.production.js": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+        versionPolicy: "independent";
+    };
+    "artifact-runtime/scheduler/0.27.0/scheduler.production.js": {
+        url: string;
+        sha256: string;
+        bytes: number;
+        mediaType: string;
+        package: string;
+        version: string;
+        packagePath: string;
+        license: string;
+        versionPolicy: "independent";
+    };
+};

package/dist/services/declared.js

@@ -0,0 +1,134 @@
+const declared = {
+  // @slices.sh/document-pdf
+  "document-pdf/2.15.1/pdfium.wasm": {
+    url: "https://cdn.jsdelivr.net/npm/@embedpdf/snippet@2.15.1/dist/pdfium.wasm",
+    sha256: "5e4cd023c3dad4a895b3571ca573d3fc51bac6de48360d95283134385b954eaa",
+    bytes: 4646932,
+    mediaType: "application/wasm",
+    package: "@embedpdf/snippet",
+    version: "2.15.1",
+    packagePath: "dist/pdfium.wasm",
+    license: "MIT"
+  },
+  // @slices.sh/document-pptx
+  "document-pptx/0.2.1/native-parser-worker.js": {
+    url: "https://cdn.jsdelivr.net/npm/@extend-ai/react-pptx@0.2.1/dist/native-parser-worker.js",
+    sha256: "70e6cf8b2937a8df90800f17e5e2df6315a8a61a79af1f932ea85d4381dc540d",
+    bytes: 10039,
+    mediaType: "text/javascript",
+    package: "@extend-ai/react-pptx",
+    version: "0.2.1",
+    packagePath: "dist/native-parser-worker.js",
+    license: "MIT"
+  },
+  "document-pptx/0.2.1/pptx_wasm_bg.wasm": {
+    url: "https://cdn.jsdelivr.net/npm/@extend-ai/react-pptx@0.2.1/dist/pptx_wasm_bg.wasm",
+    sha256: "6cd3fb9f1082477f155009bd583a1d18deb8b46bde829d25cf9ab00b120b4c90",
+    bytes: 573411,
+    mediaType: "application/wasm",
+    package: "@extend-ai/react-pptx",
+    version: "0.2.1",
+    packagePath: "dist/pptx_wasm_bg.wasm",
+    license: "MIT"
+  },
+  // @slices.sh/map-surface
+  "maplibre/6.11.2/maplibre-gl.mjs": {
+    url: "https://cdn.jsdelivr.net/npm/maplibre-gl@6.11.2/dist/maplibre-gl.mjs",
+    sha256: "3f55566295583644617fe17d008a36c580414b8c71dd2e1fcff1309de6fdee5d",
+    bytes: 590228,
+    mediaType: "text/javascript",
+    package: "maplibre-gl",
+    version: "6.11.2",
+    packagePath: "dist/maplibre-gl.mjs",
+    license: "BSD-3-Clause"
+  },
+  "maplibre/6.11.2/maplibre-gl-shared.mjs": {
+    url: "https://cdn.jsdelivr.net/npm/maplibre-gl@6.11.2/dist/maplibre-gl-shared.mjs",
+    sha256: "76b5f55bdee928c65d592684aaff2b913d50b6b17b0ec6334e88b09b6aa47960",
+    bytes: 515924,
+    mediaType: "text/javascript",
+    package: "maplibre-gl",
+    version: "6.11.2",
+    packagePath: "dist/maplibre-gl-shared.mjs",
+    license: "BSD-3-Clause"
+  },
+  "maplibre/6.11.2/maplibre-gl-worker.mjs": {
+    url: "https://cdn.jsdelivr.net/npm/maplibre-gl@6.11.2/dist/maplibre-gl-worker.mjs",
+    sha256: "01ad197aa7f4cec258a890febd71b7515e96309881b036a7095befc01a45296e",
+    bytes: 19133,
+    mediaType: "text/javascript",
+    package: "maplibre-gl",
+    version: "6.11.2",
+    packagePath: "dist/maplibre-gl-worker.mjs",
+    license: "BSD-3-Clause"
+  },
+  "maplibre/6.11.2/maplibre-gl.css": {
+    url: "https://cdn.jsdelivr.net/npm/maplibre-gl@6.11.2/dist/maplibre-gl.css",
+    sha256: "d8617d8421930e3fc6185365400e788c374c1a5d9fbe87999998c0bc14a202d3",
+    bytes: 83310,
+    mediaType: "text/css",
+    package: "maplibre-gl",
+    version: "6.11.2",
+    packagePath: "dist/maplibre-gl.css",
+    license: "BSD-3-Clause"
+  },
+  // @slices.sh/markdown-diagram
+  "markdown-diagram/11.17.2/mermaid.tiny.js": {
+    url: "https://cdn.jsdelivr.net/npm/@mermaid-js/tiny@11.17.2/dist/mermaid.tiny.js",
+    sha256: "7a644017d37f93c8359790884e6b67fb1f747c78eb20475952404bd87190a3f8",
+    bytes: 2555146,
+    mediaType: "text/javascript",
+    package: "@mermaid-js/tiny",
+    version: "11.17.2",
+    packagePath: "dist/mermaid.tiny.js",
+    license: "MIT"
+  },
+  // @slices.sh/artifact-runtime
+  "artifact-runtime/react/19.2.4/react.production.js": {
+    url: "https://cdn.jsdelivr.net/npm/react@19.2.4/cjs/react.production.js",
+    sha256: "6a3554a5287116df819640334924348287618dcdcd7124a05eb126dcbbecd5f9",
+    bytes: 17217,
+    mediaType: "text/javascript",
+    package: "react",
+    version: "19.2.4",
+    packagePath: "cjs/react.production.js",
+    license: "MIT",
+    versionPolicy: "independent"
+  },
+  "artifact-runtime/react-dom/19.2.4/react-dom.production.js": {
+    url: "https://cdn.jsdelivr.net/npm/react-dom@19.2.4/cjs/react-dom.production.js",
+    sha256: "7a5e56724be242e34ddc14f9d0dc7fc6a32f1367ae994f02d3699b00c085eff4",
+    bytes: 6655,
+    mediaType: "text/javascript",
+    package: "react-dom",
+    version: "19.2.4",
+    packagePath: "cjs/react-dom.production.js",
+    license: "MIT",
+    versionPolicy: "independent"
+  },
+  "artifact-runtime/react-dom/19.2.4/react-dom-client.production.js": {
+    url: "https://cdn.jsdelivr.net/npm/react-dom@19.2.4/cjs/react-dom-client.production.js",
+    sha256: "764ffa6adc2c9b02b4dc00f4a58ef13d050e7825898bd9e5dc808d3a3f9d4bb9",
+    bytes: 536016,
+    mediaType: "text/javascript",
+    package: "react-dom",
+    version: "19.2.4",
+    packagePath: "cjs/react-dom-client.production.js",
+    license: "MIT",
+    versionPolicy: "independent"
+  },
+  "artifact-runtime/scheduler/0.27.0/scheduler.production.js": {
+    url: "https://cdn.jsdelivr.net/npm/scheduler@0.27.0/cjs/scheduler.production.js",
+    sha256: "679adff761d31e9426604f80c0e99be44a3e6f4c6834b0218ecf0312a67c171f",
+    bytes: 10181,
+    mediaType: "text/javascript",
+    package: "scheduler",
+    version: "0.27.0",
+    packagePath: "cjs/scheduler.production.js",
+    license: "MIT",
+    versionPolicy: "independent"
+  }
+};
+export {
+  declared
+};

package/dist/services/types.d.ts

@@ -0,0 +1,33 @@
+export type AssetDefinition = {
+    url: string;
+    sha256: string;
+    bytes: number;
+    mediaType: string;
+    package: string;
+    version: string;
+    packagePath: string;
+    license: string;
+    /** Separate runtimes may pin bytes independently of the app’s installed package. Default: match-installed. */
+    versionPolicy?: "match-installed" | "independent";
+};
+export type AssetManifest = Record<string, AssetDefinition>;
+/** The configured service as server code sees it: `await sdk("assets")`. */
+export type AssetsService = {
+    /** What the route delegates to: the redirect, the verified bytes or the refusal. */
+    serve(name: string): Promise<Response>;
+    /** Everything the config serves, for a CSP or a preload list. */
+    entries(): Record<string, AssetDefinition>;
+};
+/** What a browser holds of a config: where its files are. Nothing is fetched until a part asks for a name. */
+export type AssetsClient = {
+    url(name: string): string;
+};
+/**
+ * The URL of a named file, served by `/api/assets/<config>/<name>`.
+ *
+ * Names are manifest keys, never arbitrary upstream URLs.
+ */
+export declare function assetUrl(name: string, { config, basePath }?: {
+    config?: string;
+    basePath?: string;
+}): string;

package/dist/services/types.js

@@ -0,0 +1,6 @@
+function assetUrl(name, { config = "default", basePath = "/api/assets" } = {}) {
+  return `${basePath}/${encodeURIComponent(config)}/${name.split("/").map(encodeURIComponent).join("/")}`;
+}
+export {
+  assetUrl
+};

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@slices.sh/assets",
+  "version": "0.1.0",
+  "description": "slices v2: assets",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "default": "./dist/client.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "default": "./dist/next.js"
+    },
+    "./react/use-asset-url": {
+      "types": "./dist/hooks/use-asset-url.d.ts",
+      "default": "./dist/hooks/use-asset-url.js"
+    },
+    "./services/capabilities": {
+      "types": "./dist/services/capabilities.d.ts",
+      "default": "./dist/services/capabilities.js"
+    },
+    "./services/collect": {
+      "types": "./dist/services/collect.d.ts",
+      "default": "./dist/services/collect.js"
+    },
+    "./services/declared": {
+      "types": "./dist/services/declared.d.ts",
+      "default": "./dist/services/declared.js"
+    },
+    "./services/types": {
+      "types": "./dist/services/types.d.ts",
+      "default": "./dist/services/types.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@slices.sh/core": "^0.1.0",
+    "server-only": "^0.0.1"
+  },
+  "peerDependencies": {
+    "react": "^19.2.0"
+  },
+  "author": "Severin MARCOMBES",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts"
+}