fix(asset)enable frontend send content to save

[cqhasy]

Change Description

• Fix /asset/save so it accepts caller-supplied content and creates a new immutable content snapshot instead of copying the current asset content.
• Normalize frontend image references before persistence so the backend stores object keys rather than temporary or signed URLs.
• Existing object keys remain unchanged, configured storage URLs are converted back to object keys, and image data URLs are uploaded to object storage.
• Reject external URLs and browser-local absolute paths that cannot be converted to object keys.

Implementation Approach

• Added content as a required field in RecordAssetRequest and updated the OpenAPI and generated frontend TypeScript contracts.
• Added recursive reference transformation for the currently defined asset image fields:
  • prototype[].url
  • animations[].frames[].url
  • items[].tiles[].url
  • layers[].resource
• Reused the upload reference store to persist data URLs and convert configured storage URLs back to object keys.
• Reject references that remain URLs or start with /, preventing image URLs and frontend-local paths from being persisted.
• Preserve unknown and future JSON fields while normalizing known image-reference fields.
• Updated record creation so supplied content is written to a new asset_contents row. Missing or null content is rejected instead of falling back to the current content.
• Kept response behavior unchanged: persisted object keys are resolved to temporary URLs when asset details or record history are returned.

Related Issue

Closes #175

Testing

• go test ./internal/handler ./internal/router ./internal/repository — passed.
• go test ./... — passed.
• pnpm api:check — OpenAPI generation and TypeScript API checks passed.
• pnpm test — 57 test files and 220 tests passed.
• pnpm lint — passed.
• pnpm format:check — passed.
• pnpm build — TypeScript and Vite production build passed.
• git diff --check — passed with no whitespace errors.

Screenshots or Recordings

Not included. This change affects API persistence behavior and does not modify rendered UI.

Risks and Follow-ups

• Clients calling /asset/save must now provide a non-null content payload.
• External image URLs are intentionally rejected because records must contain object keys only.
• Reference normalization currently covers the explicitly modeled image fields listed above. components[].texture remains unchanged because its schema is currently unspecified and typed as arbitrary JSON; it should be handled separately if it is defined as an image reference in the future.

Checklist

• The PR is focused and does not include unrelated changes.
• Asset names, formats, dimensions, and metadata follow project conventions.
• Licensing and attribution information is included or unchanged as appropriate.
• Documentation or examples were updated when needed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
holonic-asset	Ignored	Preview	Aug 14, 2026 5:35am

[codecov]

Codecov Report

❌ Patch coverage is 96.77419% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...api/internal/repository/asset_record_generation.go	92.59%	3 Missing and 3 partials ⚠️

📢 Thoughts on this report? Let us know!

[fennoai]

Found one resource-lifecycle issue in the new save flow. The focused and full Go test suites pass.

[minorcell]

@cqhasy 解决下冲突，没有问题的话就可以合并了。

[minorcell]

@cqhasy 建议同步 main 时尽量用 rebase 而不是 merge：

• 这个 PR 的历史里有两次 merge main into fix/asset-save，都是 main 前进后 merge 分叉产生的额外提交，让 PR 的 commit 列表看起来比较乱；
• rebase 会把改动重放到 main 最新提交之上，PR 历史保持一条直线，不会引入 merge commit；
• 你的分支在 fork 上，同步上游后直接 git fetch upstream && git rebase upstream/main，冲突解决完后 git push --force-with-lease origin fix/asset-save 强推到自己的 fork，是安全的；
• 建议下次同步时改成 rebase，顺便把这两个 merge commit 清掉。